@softr/cli 0.0.1 → 0.1.1-se21216.10

package/dist/cli.mjs

@@ -1745,7 +1745,7 @@ var require_table = __commonJS({
     var debug = require_debug();
     var utils = require_utils();
     var tableLayout = require_layout_manager();
-    var Table6 = class extends Array {
+    var Table7 = class extends Array {
       constructor(opts) {
         super();
         const options = utils.mergeOptions(opts);
@@ -1820,7 +1820,7 @@ var require_table = __commonJS({
         return str[0].length;
       }
     };
-    Table6.reset = () => debug.reset();
+    Table7.reset = () => debug.reset();
     function doDraw(row, lineNum, result) {
       let line = [];
       row.forEach(function(cell) {
@@ -1829,7 +1829,7 @@ var require_table = __commonJS({
       let str = line.join("");
       if (str.length) result.push(str);
     }
-    module.exports = Table6;
+    module.exports = Table7;
   }
 });
 
@@ -5278,9 +5278,17 @@ function executionOrder(config) {
     }
   };
   for (const trigger of config.triggers ?? []) {
-    add({ id: trigger.id, type: trigger.type, kind: "trigger", title: trigger.title, testable: true, reachable: true });
+    add({
+      id: trigger.id,
+      type: trigger.type,
+      kind: "trigger",
+      title: trigger.title,
+      testable: true,
+      loopPath: [],
+      reachable: true
+    });
   }
-  const collect = (actions, loopId) => {
+  const collect = (actions, loopPath) => {
     for (const action of actions ?? []) {
       add({
         id: action.id,
@@ -5288,17 +5296,18 @@ function executionOrder(config) {
         kind: "action",
         title: action.title,
         testable: !NOT_TESTABLE_TYPES.has(action.type),
-        loopId,
+        loopId: loopPath.at(-1),
+        loopPath,
         reachable: false
       });
       if (action.type === LOOP_TYPE) {
         const inputs = action.inputs;
         pathSets.push(inputs?.paths ?? []);
-        collect(inputs?.actions, action.id);
+        collect(inputs?.actions, [...loopPath, action.id]);
       }
     }
   };
-  collect(config.actions);
+  collect(config.actions, []);
   const outgoing = new Map(appearance.map((id) => [id, []]));
   const indegree = new Map(appearance.map((id) => [id, 0]));
   for (const path13 of pathSets.flat()) {
@@ -5342,6 +5351,9 @@ function executionOrder(config) {
   }
   return [...ordered.filter((node) => node.reachable), ...ordered.filter((node) => !node.reachable)];
 }
+function hierarchyPath(node, iteration = 0) {
+  return [...node.loopPath.flatMap((loopId) => [loopId, String(iteration)]), node.id].join("/");
+}
 
 // src/catalog/catalog.json
 var catalog_default = [
@@ -5698,7 +5710,7 @@ var catalog_default = [
       integrations: {
         type: "array",
         required: false,
-        description: 'Workspace integrations the code may call through fetch: [{"alias": "crm", "integrationId": "<uuid>"}]. A call to a host of an attached integration carries its credentials (a REST_API integration only when the call names its alias); the alias ([A-Za-z_][A-Za-z0-9_]*, unique in the node) names one in fetch(url, { integration: "crm" }) when two share a host. Integration ids: `softr-workflows integrations` lists them, or the studio (Workspace settings \u2192 Integrations, or the URL of the integration).',
+        description: 'Workspace integrations the code may call through fetch: [{"alias": "crm", "integrationId": "<uuid>"}]. A call to a host of an attached integration carries its credentials (a REST_API integration only when the call names its alias); the alias ([A-Za-z_][A-Za-z0-9_]*, unique in the node) names one in fetch(url, { integration: "crm" }) when two share a host. Integration ids: `softr integrations` lists them, or the studio (Workspace settings \u2192 Integrations, or the URL of the integration).',
         example: [
           {
             alias: "crm",
@@ -6086,9 +6098,9 @@ var SoftrApiError = class extends Error {
   body;
   hint;
 };
-function hintFor(status) {
+function hintFor(status, client) {
   if (status === 401 || status === 403) {
-    return "The token was not accepted: revoked, from another environment, missing access to this workflow, or its statements do not grant this action. Run: softr-workflows login";
+    return client.kind === "proxy" ? "The target refused the request: no access to this workflow, or its credential is gone." : "The token was not accepted: revoked, from another environment, missing access to this workflow, or its statements do not grant this action. Run: softr login";
   }
   if (status === 409) {
     return "The workflow changed on the server since the last pull. Pull again with --force, then re-apply your edits.";
@@ -6096,7 +6108,7 @@ function hintFor(status) {
   return void 0;
 }
 function authHeaders(client) {
-  return { Authorization: `Bearer ${client.token}` };
+  return client.kind === "proxy" ? {} : { Authorization: `Bearer ${client.token}` };
 }
 async function send(client, service, method, path13, body) {
   const init = {
@@ -6117,7 +6129,7 @@ async function send(client, service, method, path13, body) {
     `${method} ${path13} failed with status ${response.status}${text ? `: ${text}` : ""}`,
     response.status,
     text,
-    hintFor(response.status)
+    hintFor(response.status, client)
   );
 }
 async function apiRequest(client, method, path13, body) {
@@ -7588,7 +7600,7 @@ async function readConfig(dir) {
     if (error.code === "ENOENT") {
       throw new CliError(
         `No ${CONFIG_FILE_NAME} in ${dir}.`,
-        'Run "softr-workflows pull <workflowId>" here, or pass --dir.'
+        'Run "softr workflows pull <workflowId>" here, or pass --dir.'
       );
     }
     throw error;
@@ -7619,7 +7631,7 @@ async function findWorkflowDir(cwd, explicitDir) {
     return cwd;
   }
   const candidates = await listWorkflowDirs(cwd);
-  const hint = candidates.length ? `Workflows found in: ${candidates.map((dir) => path2.relative(cwd, dir)).join(", ")}. Pass --dir <name> or cd into one.` : 'Run "softr-workflows pull <workflowId>" to create one.';
+  const hint = candidates.length ? `Workflows found in: ${candidates.map((dir) => path2.relative(cwd, dir)).join(", ")}. Pass --dir <name> or cd into one.` : 'Run "softr workflows pull <workflowId>" to create one.';
   throw new CliError(`No ${CONFIG_FILE_NAME} in ${cwd}.`, hint);
 }
 async function listWorkflowDirs(cwd) {
@@ -7641,6 +7653,79 @@ async function editConfig(dir, edits) {
 `);
 }
 
+// src/project/versions.ts
+function compareVersions(a, b) {
+  const pa = a.split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const pb = b.split(".").map((part) => Number.parseInt(part, 10) || 0);
+  for (let i2 = 0; i2 < Math.max(pa.length, pb.length); i2++) {
+    const diff = (pa[i2] ?? 0) - (pb[i2] ?? 0);
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+  return 0;
+}
+var CURRENT = new Map(CATALOG.map((entry) => [entry.type, entry.version]));
+function outdatedNodes(config) {
+  const outdated = [];
+  for (const node of [...config.triggers ?? [], ...allActions(config.actions)]) {
+    const current2 = CURRENT.get(node.type);
+    if (!current2 || !node.version || compareVersions(node.version, current2) >= 0) {
+      continue;
+    }
+    outdated.push({
+      id: node.id,
+      type: node.type,
+      version: node.version,
+      current: current2,
+      upgradable: upgradeOf(node) !== void 0
+    });
+  }
+  return outdated;
+}
+function upgradeOf(node) {
+  const current2 = CURRENT.get(node.type);
+  if (!current2 || !node.version || compareVersions(node.version, current2) >= 0) {
+    return void 0;
+  }
+  if (node.type === CUSTOM_CODE_TYPE) {
+    const inputs = node.inputs ?? {};
+    const ordered = {};
+    for (const key of ["language", "inputData", "integrations", "code"]) {
+      if (key === "integrations") {
+        ordered[key] = inputs[key] ?? [];
+      } else if (inputs[key] !== void 0) {
+        ordered[key] = inputs[key];
+      }
+    }
+    for (const [key, value] of Object.entries(inputs)) {
+      if (!(key in ordered)) {
+        ordered[key] = value;
+      }
+    }
+    return { ...node, version: current2, inputs: ordered };
+  }
+  return void 0;
+}
+function versionNote(config) {
+  const outdated = outdatedNodes(config);
+  if (!outdated.length) {
+    return void 0;
+  }
+  const lines = outdated.map(
+    (node) => `  ${node.id}: ${node.type} ${node.version} \u2192 ${node.current}${node.upgradable ? "" : ` (no automatic upgrade; see "spec ${node.type}")`}`
+  );
+  const hint = outdated.some((node) => node.upgradable) ? '\nRun "softr workflows upgrade" to move them to the current version.' : "";
+  return `Nodes on an older version:
+${lines.join("\n")}${hint}`;
+}
+function emitWithVersionNote(options, config, human, json) {
+  const note = versionNote(config);
+  emit(options, note ? `${human}
+
+${note}` : human, { ...json, versionNote: note ?? null });
+}
+
 // src/commands/edit.ts
 import { access as access2, mkdir as mkdir3, writeFile as writeFile4 } from "node:fs/promises";
 import path5 from "node:path";
@@ -13591,6 +13676,36 @@ function renderPyType(type, depth = 0) {
 }
 
 // src/project/code-wrapper.ts
+function attachedIntegrations(inputs) {
+  const value = inputs?.["integrations"];
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.flatMap(
+    (entry) => entry && typeof entry === "object" && typeof entry.alias === "string" ? [
+      {
+        alias: entry.alias,
+        integrationId: String(entry.integrationId ?? "")
+      }
+    ] : []
+  );
+}
+function integrationLines(header) {
+  if (!hasFetch(header.version)) {
+    return [];
+  }
+  const attached = header.integrations ?? [];
+  if (!attached.length) {
+    return [
+      'No integrations attached: add { alias, integrationId } entries under inputs.integrations in softr-workflows.jsonc (ids from "softr integrations").'
+    ];
+  }
+  return [
+    "Integrations attached to this node; fetch authenticates a call to their own API hosts by itself:",
+    ...attached.map((item) => `  ${item.alias}: ${item.integrationId}`),
+    `Name one with fetch(url, { integration: '${attached[0].alias}' }) only for a REST API integration (it has no host of its own) or when two attached integrations share a host.`
+  ];
+}
 var PLACEHOLDER_IN_CODE = /\{\{?[A-Za-z]+[^{}]*:::/;
 function parseLanguage(value, nodeId) {
   if (value === "JAVASCRIPT" || value === "PYTHON") {
@@ -13613,17 +13728,6 @@ var FETCH_SINCE = "1.2.0";
 function hasFetch(version2) {
   return compareVersions(version2, FETCH_SINCE) >= 0;
 }
-function compareVersions(a, b) {
-  const pa = a.split(".").map((part) => Number.parseInt(part, 10) || 0);
-  const pb = b.split(".").map((part) => Number.parseInt(part, 10) || 0);
-  for (let i2 = 0; i2 < Math.max(pa.length, pb.length); i2++) {
-    const diff = (pa[i2] ?? 0) - (pb[i2] ?? 0);
-    if (diff !== 0) {
-      return diff;
-    }
-  }
-  return 0;
-}
 var JS_RULES = [
   ...RULES,
   "HTTP calls: `await fetch(url, { method, headers, body, integration })`. An attached integration (inputs.integrations) authenticates calls to its own API hosts; a REST_API integration authenticates only a call that names its alias. No `import`/`require`. An undefined return is reported as null."
@@ -13650,8 +13754,8 @@ function rules(language, version2) {
     `This node runs CUSTOM_CODE ${version2}: synchronous, no fetch, inputs.integrations is ignored. Set "version": "1.2.0" on this node in softr-workflows.jsonc to use them.`
   ];
 }
-var HEADER_START = "softr-workflows: generated header - regenerated on pull, do not edit by hand";
-var HEADER_END = "softr-workflows: end of generated header";
+var HEADER_START = "softr: generated header - regenerated on pull, do not edit by hand";
+var HEADER_END = "softr: end of generated header";
 var MAX_EXAMPLE = 60;
 function describe(header) {
   return `Softr Workflows custom code for node "${header.nodeId}"${header.title ? ` (${header.title})` : ""}.`;
@@ -13693,6 +13797,7 @@ function wrapCode(language, body, header) {
       ...rules("JAVASCRIPT", header.version).map((rule) => ` * ${rule}`),
       " */",
       ...typedef,
+      ...integrationLines(header).map((line) => `// ${line}`),
       `// ${HEADER_END}`,
       `/** @param {${paramType}} inputData */`,
       `export default ${hasFetch(header.version) ? "async " : ""}function (inputData) {`,
@@ -13712,6 +13817,7 @@ function wrapCode(language, body, header) {
     ...rules("PYTHON", header.version).map((rule) => `# ${rule}`),
     "#",
     ...inputs,
+    ...integrationLines(header).map((line) => `# ${line}`),
     `# ${HEADER_END}`,
     "def main(inputData):",
     ...lines.length ? lines.map((line) => line === "" ? "" : `    ${line}`) : ["    pass"],
@@ -13948,7 +14054,7 @@ function describePlaceholder(placeholder, raw, config, outputs, depth) {
   }
 }
 function untested(nodeId) {
-  return `node "${nodeId}" has no test output yet (run: softr-workflows test ${nodeId})`;
+  return `node "${nodeId}" has no test output yet (run: softr workflows test ${nodeId})`;
 }
 function describeOutputRef(nodeId, path13, source, outputs) {
   const segments = parsePath(path13);
@@ -14076,7 +14182,8 @@ async function externalizeCode(config, baseDir, outputs = {}) {
         nodeId: node.id,
         title: node.title,
         version: nodeVersion(node),
-        inputs: describeInputData(node, config, outputs)
+        inputs: describeInputData(node, config, outputs),
+        integrations: attachedIntegrations(node.inputs)
       })
     );
     node.inputs["code"] = toFileRef(relative);
@@ -14131,7 +14238,8 @@ async function refreshCodeHeaders(config, baseDir, outputs) {
       nodeId: node.id,
       title: node.title,
       version: nodeVersion(node),
-      inputs: describeInputData(node, config, outputs)
+      inputs: describeInputData(node, config, outputs),
+      integrations: attachedIntegrations(node.inputs)
     });
     if (next !== source) {
       await writeFile3(file, next);
@@ -14221,8 +14329,9 @@ function registerEdit(program3) {
       entry.kind === "trigger" && (config.triggers?.length ?? 0) > 1 ? "The service accepts one trigger per published workflow for now." : "",
       `Fill inputs.${Object.keys(entry.template)[0] ?? "\u2026"} etc. in softr-workflows.jsonc (see "spec ${entry.type}"), then push and test ${nodeId}.`
     ].filter(Boolean);
-    emit(
+    emitWithVersionNote(
       options,
+      await readConfig(dir),
       `Replaced "${nodeId}" (${location.node.type}) with ${entry.type}; paths kept.
 ${notes.join("\n")}`,
       {
@@ -14261,8 +14370,9 @@ ${notes.join("\n")}`,
       codeFiles.length ? `Code files left in place: ${codeFiles.join(", ")}. Delete them when you no longer need them.` : "",
       location.kind === "trigger" && (config.triggers?.length ?? 1) <= 1 ? "The workflow has no trigger now; add one before publishing." : ""
     ].filter(Boolean);
-    emit(
+    emitWithVersionNote(
       options,
+      await readConfig(dir),
       `Removed ${removedNodes.map((id) => `"${id}"`).join(", ")} and ${doomed.length} path(s).${notes.length ? `
 ${notes.join("\n")}` : ""}`,
       {
@@ -14287,13 +14397,12 @@ function updateWorkflow(client, workflowId, body) {
 function getWorkflowOutputs(client, workflowId) {
   return apiRequest(client, "GET", `/v1/workflows/${workflowId}/outputs`);
 }
-function listWorkflows(client, workspaceId) {
-  const query = new URLSearchParams({ workspaceId, limit: "500" });
+function listWorkflows(client, workspaceId, applicationId) {
+  const query = new URLSearchParams({ workspaceId, ...applicationId ? { applicationId } : {}, limit: "500" });
   return apiRequest(client, "GET", `/v1/workflows?${query}`);
 }
-function testAction(client, workflowId, actionId, mode, iterationIndex) {
-  const query = iterationIndex === void 0 ? "" : `?${new URLSearchParams({ iterationIndex: String(iterationIndex) })}`;
-  return apiRequest(client, "POST", `/v1/workflows/${workflowId}/outputs/actions/${actionId}/${mode}${query}`, {});
+function testAction(client, workflowId, hierarchyPath2, mode) {
+  return apiRequest(client, "POST", `/v1/workflows/${workflowId}/outputs/${mode}/actions/${hierarchyPath2}`, {});
 }
 function testTrigger(client, workflowId, triggerId) {
   return apiRequest(client, "POST", `/v1/workflows/${workflowId}/outputs/triggers/${triggerId}/test`, {});
@@ -14320,18 +14429,8 @@ async function getEnabledVersion(client, workflowId) {
     throw error;
   }
 }
-async function getWorkflowReadiness(client, workflowId) {
-  try {
-    return await apiRequest(client, "GET", `/v1/workflows/${workflowId}/readiness`);
-  } catch (error) {
-    if (error instanceof SoftrApiError && (error.status === 404 || isUnknownRouteAnswer(error))) {
-      return null;
-    }
-    throw error;
-  }
-}
-function isUnknownRouteAnswer(error) {
-  return error.status === 500 && error.body.includes("ApiErrorMessages.INTERNAL_SERVER_ERROR");
+function getWorkflowReadiness(client, workflowId) {
+  return apiRequest(client, "GET", `/v1/workflows/${workflowId}/readiness`);
 }
 
 // src/config/credentials.ts
@@ -14341,7 +14440,7 @@ import path6 from "node:path";
 
 // src/api/oauth.ts
 import { createHash as createHash2, randomBytes } from "node:crypto";
-var OAUTH_CLIENT_ID_ENV_VAR = "SOFTR_WORKFLOWS_OAUTH_CLIENT_ID";
+var OAUTH_CLIENT_ID_ENV_VAR = "SOFTR_OAUTH_CLIENT_ID";
 var DEFAULT_OAUTH_CLIENT_ID = "74341326-0061-4f0e-965c-a5aa14a9a89a";
 function oauthClientId() {
   return process.env[OAUTH_CLIENT_ID_ENV_VAR] || DEFAULT_OAUTH_CLIENT_ID;
@@ -14379,7 +14478,7 @@ async function tokenRequest(target, form) {
       `POST ${path13} failed with status ${response.status}${text ? `: ${text}` : ""}`,
       response.status,
       text,
-      form["grant_type"] === "refresh_token" ? "The OAuth grant is gone (revoked or older than 30 days). Run: softr-workflows login" : void 0
+      form["grant_type"] === "refresh_token" ? "The OAuth grant is gone (revoked or older than 30 days). Run: softr login" : void 0
     );
   }
   const tokens = await response.json();
@@ -14403,8 +14502,8 @@ function refreshTokens(target, refreshToken) {
 
 // src/config/target.ts
 var API_URL_ENV_VAR = "SOFTR_WORKFLOWS_API_URL";
-var STUDIO_API_URL_ENV_VAR = "SOFTR_WORKFLOWS_STUDIO_API_URL";
-var STUDIO_URL_ENV_VAR = "SOFTR_WORKFLOWS_STUDIO_URL";
+var STUDIO_API_URL_ENV_VAR = "SOFTR_STUDIO_API_URL";
+var STUDIO_URL_ENV_VAR = "SOFTR_STUDIO_URL";
 var DEFAULT_API_URL = "https://workflows-api.softr.io";
 var DEFAULT_STUDIO_API_URL = "https://studio-api.softr.io";
 var DEFAULT_STUDIO_URL = "https://studio.softr.io";
@@ -14415,7 +14514,7 @@ function normalizeUrl(value, source) {
   } catch {
     throw new CliError(`${source} is not a valid URL: ${value}`);
   }
-  return url.origin;
+  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
 }
 function resolveTarget(remembered) {
   const pick = (envVar, rememberedValue, fallback) => {
@@ -14429,7 +14528,7 @@ function resolveTarget(remembered) {
   };
 }
 function targetHost(target) {
-  return new URL(target.apiUrl).host;
+  return new URL(target.studioApiUrl).host;
 }
 
 // src/config/tokens.ts
@@ -14442,12 +14541,14 @@ function tokenKind(token) {
   }
   throw new CliError(
     "The token is neither a personal API token (pat_...) nor an OAuth access token (oaa_...).",
-    'Create a personal API token in the studio and paste the whole value, or run "softr-workflows login" without --token to log in through the browser.'
+    'Create a personal API token in the studio and paste the whole value, or run "softr login" without --token to log in through the browser.'
   );
 }
 
 // src/config/credentials.ts
-var TOKEN_ENV_VAR = "SOFTR_WORKFLOWS_TOKEN";
+var TOKEN_ENV_VAR = "SOFTR_TOKEN";
+var AUTH_ENV_VAR = "SOFTR_AUTH";
+var PROXY_AUTH = "proxy";
 var REFRESH_MARGIN_MS = 5 * 60 * 1e3;
 function credentialsPath() {
   return path6.join(homedir(), ".softr", "credentials.json");
@@ -14512,13 +14613,16 @@ async function refreshedAccessToken(target, stored) {
   }
 }
 async function authenticatedClient(target) {
+  if (process.env[AUTH_ENV_VAR] === PROXY_AUTH) {
+    return { target, kind: "proxy" };
+  }
   const fromEnv = process.env[TOKEN_ENV_VAR];
   if (fromEnv) {
     return { target, token: fromEnv, kind: tokenKind(fromEnv) };
   }
   const stored = await storedToken(target);
   if (!stored) {
-    throw new CliError(`No token stored for ${targetHost(target)}.`, "Run: softr-workflows login");
+    throw new CliError(`No token stored for ${targetHost(target)}.`, "Run: softr login");
   }
   const kind = stored.kind ?? tokenKind(stored.token);
   const expiresAt = stored.expiresAt ? new Date(stored.expiresAt) : void 0;
@@ -14528,7 +14632,7 @@ async function authenticatedClient(target) {
   if (expiresAt && expiresAt < /* @__PURE__ */ new Date()) {
     throw new CliError(
       `The stored token for ${targetHost(target)} expired at ${stored.expiresAt}.`,
-      "Run: softr-workflows login"
+      "Run: softr login"
     );
   }
   return { target, token: stored.token, kind };
@@ -14545,7 +14649,7 @@ async function resolveTokenOwner(client) {
     if (error instanceof SoftrApiError && error.status === 404) {
       throw new CliError(
         "The studio does not know this token: revoked, expired, or from another environment.",
-        'Create a new personal API token in the studio, or run "softr-workflows login" for the browser login.'
+        'Create a new personal API token in the studio, or run "softr login" for the browser login.'
       );
     }
     throw error;
@@ -14621,7 +14725,7 @@ function toRow(workflow, workspace) {
     updatedAt: workflow.updatedAt ?? null
   };
 }
-async function collectWorkflows(client, workspaceId) {
+async function collectWorkflows(client, workspaceId, applicationId) {
   const workspaces = await listWorkspaces(client);
   const selected = workspaceId ? workspaces.filter((workspace) => workspace.id === workspaceId) : workspaces;
   if (workspaceId && !selected.length) {
@@ -14633,7 +14737,7 @@ async function collectWorkflows(client, workspaceId) {
   const listing = { workspaces: [], workflows: [], failures: [] };
   for (const workspace of selected) {
     try {
-      const page = await listWorkflows(client, workspace.id);
+      const page = await listWorkflows(client, workspace.id, applicationId);
       listing.workspaces.push({ id: workspace.id, name: workspace.name });
       listing.workflows.push(...page.items.map((workflow) => toRow(workflow, workspace)));
     } catch (error) {
@@ -14663,10 +14767,10 @@ function workflowTable(rows) {
   }
   return table.toString();
 }
-function renderWorkflows({ workspaces, workflows, failures }) {
+function renderWorkflows({ workspaces, workflows: workflows2, failures }) {
   const blocks = [];
   for (const workspace of workspaces) {
-    const rows = workflows.filter((row) => row.workspaceId === workspace.id);
+    const rows = workflows2.filter((row) => row.workspaceId === workspace.id);
     const heading = `Workspace: ${workspace.name} (${workspace.id})`;
     blocks.push(rows.length ? `${heading}
 ${workflowTable(rows)}` : `${heading}
@@ -14684,16 +14788,16 @@ ${workflowTable(rows)}` : `${heading}
   }
   return blocks.join("\n\n");
 }
-async function emitWorkflowList(options, client, workspaceId, human) {
-  const listing = await collectWorkflows(client, workspaceId);
+async function emitWorkflowList(options, client, workspaceId, human, applicationId) {
+  const listing = await collectWorkflows(client, workspaceId, applicationId);
   emit(options, [human, renderWorkflows(listing)].filter(Boolean).join("\n\n"), { ...listing });
 }
 function registerList(program3) {
-  program3.command("list").description("List the workflows you can access, grouped by workspace").option("--workspace <id>", "only this workspace").action(async (opts, command) => {
+  program3.command("list").description("List the workflows you can access, grouped by workspace").option("--workspace <id>", "only this workspace (default: $SOFTR_WORKSPACE_ID when set)").option("--app <id>", "only the workflows linked to this application").action(async (opts, command) => {
     const options = globalOptions(command);
     const target = resolveTarget(await readState(process.cwd()));
     const client = await authenticatedClient(target);
-    await emitWorkflowList(options, client, opts.workspace);
+    await emitWorkflowList(options, client, opts.workspace ?? process.env["SOFTR_WORKSPACE_ID"], void 0, opts.app);
   });
 }
 
@@ -14960,7 +15064,7 @@ function registerPull(program3) {
         options,
         client,
         void 0,
-        "Pick a workflow and run: softr-workflows pull <workflowId>"
+        "Pick a workflow and run: softr workflows pull <workflowId>"
       );
       return;
     }
@@ -14991,8 +15095,9 @@ Sample outputs not available, inputData types are unknown: ${error.message}`;
       outputsFile = await writeStateFile(dir, "outputs.json", rows);
     }
     const files = [configFile, ...codeFiles].map((file) => path8.relative(cwd, file));
-    emit(
+    emitWithVersionNote(
       options,
+      config,
       `Pulled "${workflow.title}" (version ${workflow.version}, draft ${workflow.draft}, ${workflow.enabled ? "enabled" : "not enabled"}).
 ` + files.map((file) => `  ${file}`).join("\n") + outputsNote,
       {
@@ -15079,10 +15184,11 @@ function registerAdd(program3) {
       const notes = [
         (config.triggers?.length ?? 0) >= 1 ? "The service accepts one trigger per published workflow for now; multi-trigger support is coming." : "",
         opts.to ? "" : `Connect it with a path to the first action (or pass --to next time).`,
-        `Then: softr-workflows push, softr-workflows test ${id}.`
+        `Then: softr workflows push, softr workflows test ${id}.`
       ].filter(Boolean);
-      emit(
+      emitWithVersionNote(
         options,
+        config,
         `Added ${entry.type} trigger "${id}"${opts.to ? ` leading to "${opts.to}"` : ""}.
 ${notes.join("\n")}`,
         {
@@ -15113,10 +15219,11 @@ ${notes.join("\n")}`,
     const next = [
       codeFile ? `Write the function in ${path9.relative(process.cwd(), codeFile)} and map its inputs under inputs.inputData in softr-workflows.jsonc.` : "",
       entry.type === "BRANCH" || entry.type === "FILTER" ? `Add the condition(s) on the path(s) leaving it in softr-workflows.jsonc (see "spec ${entry.type}").` : "",
-      `Then: softr-workflows push, softr-workflows test ${id}.`
+      `Then: softr workflows push, softr workflows test ${id}.`
     ].filter(Boolean);
-    emit(
+    emitWithVersionNote(
       options,
+      config,
       `Added ${entry.type} "${id}" after "${after}"${opts.inLoop ? ` inside loop "${opts.inLoop}"` : ""}.
 ${next.join("\n")}`,
       {
@@ -15158,58 +15265,66 @@ async function resolveWorkspace(client, requested) {
   );
 }
 function registerInit(program3) {
-  program3.command("init").description("Create a new workflow with one trigger, on the server and as a local directory").argument("<title>", "the workflow title").option("--workspace <id>", "workspace to create it in (default: your only or default workspace)").option("--trigger <TYPE>", 'trigger type from "spec" (default WEBHOOK)', "WEBHOOK").option("--dir <path>", "directory to create (default: ./<title-slug>)").action(async (title, opts, command) => {
-    const options = globalOptions(command);
-    const cwd = process.cwd();
-    const dir = path10.resolve(cwd, opts.dir ?? slug(title));
-    if (await configExists(dir)) {
-      throw new CliError(`${path10.join(dir, CONFIG_FILE_NAME)} already exists.`, "Pick another --dir or title.");
-    }
-    const trigger = findCatalogEntry(opts.trigger, "trigger");
-    const target = resolveTarget();
-    const client = await authenticatedClient(target);
-    const workspaceId = await resolveWorkspace(client, opts.workspace);
-    const created = await createWorkflow(client, {
-      workspaceId,
-      applicationId: null,
-      title,
-      thumbnail: null,
-      triggers: [{ id: TRIGGER_ID, type: trigger.type, version: trigger.version, inputs: trigger.template }],
-      actions: [],
-      paths: [],
-      // Like the studio: the author's time zone, so schedules and waits mean what they read.
-      configuration: { timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC" }
-    });
-    const workflow = await getWorkflow(client, created.id);
-    const config = { $schema: SCHEMA_POINTER, ...toLocalConfig(workflow) };
-    const configFile = await writeConfig(dir, config);
-    await writeSchemaFile(dir);
-    const syncedHash = definitionHash((await packWorkflow(config, dir)).packed);
-    await writeState(dir, {
-      ...target,
-      workflowId: created.id,
-      version: workflow.version,
-      draft: workflow.draft,
-      syncedHash
-    });
-    const studioUrl = `${target.studioUrl}/workflow/${created.id}`;
-    emit(
-      options,
-      `Created "${title}" (${created.id}) with a ${trigger.type} trigger "${TRIGGER_ID}" in workspace ${workspaceId}.
-  ${path10.relative(cwd, configFile)}
-${studioUrl}
-Next: softr-workflows add <TYPE> --dir ${path10.relative(cwd, dir) || "."} (see "spec" for the types), then push and test.`,
-      {
-        workflowId: created.id,
+  program3.command("init").description("Create a new workflow with one trigger, on the server and as a local directory").argument("<title>", "the workflow title").option(
+    "--workspace <id>",
+    "workspace to create it in (default: $SOFTR_WORKSPACE_ID, else your only or default workspace)"
+  ).option("--app <id>", "application to link the workflow to (default: $SOFTR_APP_ID when set)").option("--trigger <TYPE>", 'trigger type from "spec" (default WEBHOOK)', "WEBHOOK").option("--dir <path>", "directory to create (default: ./<title-slug>)").action(
+    async (title, opts, command) => {
+      const options = globalOptions(command);
+      const cwd = process.cwd();
+      const dir = path10.resolve(cwd, opts.dir ?? slug(title));
+      if (await configExists(dir)) {
+        throw new CliError(`${path10.join(dir, CONFIG_FILE_NAME)} already exists.`, "Pick another --dir or title.");
+      }
+      const trigger = findCatalogEntry(opts.trigger, "trigger");
+      const target = resolveTarget();
+      const client = await authenticatedClient(target);
+      const workspaceId = await resolveWorkspace(client, opts.workspace ?? process.env["SOFTR_WORKSPACE_ID"]);
+      const pinToApplicationId = opts.app ?? process.env["SOFTR_APP_ID"];
+      const created = await createWorkflow(client, {
         workspaceId,
+        applicationId: null,
+        ...pinToApplicationId ? { pinToApplicationId } : {},
         title,
-        triggerId: TRIGGER_ID,
-        triggerType: trigger.type,
-        dir,
-        studioUrl
-      }
-    );
-  });
+        thumbnail: null,
+        triggers: [{ id: TRIGGER_ID, type: trigger.type, version: trigger.version, inputs: trigger.template }],
+        actions: [],
+        paths: [],
+        // Like the studio: the author's time zone, so schedules and waits mean what they read.
+        configuration: { timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC" }
+      });
+      const workflow = await getWorkflow(client, created.id);
+      const config = { $schema: SCHEMA_POINTER, ...toLocalConfig(workflow) };
+      const configFile = await writeConfig(dir, config);
+      await writeSchemaFile(dir);
+      const syncedHash = definitionHash((await packWorkflow(config, dir)).packed);
+      await writeState(dir, {
+        ...target,
+        workflowId: created.id,
+        version: workflow.version,
+        draft: workflow.draft,
+        syncedHash
+      });
+      const studioUrl = `${target.studioUrl}/workflow/${created.id}`;
+      emit(
+        options,
+        `Created "${title}" (${created.id}) with a ${trigger.type} trigger "${TRIGGER_ID}" in workspace ${workspaceId}${pinToApplicationId ? `, linked to application ${pinToApplicationId}` : ""}.
+  ${path10.relative(cwd, configFile)}
+${studioUrl}
+Next: softr workflows add <TYPE> --dir ${path10.relative(cwd, dir) || "."} (see "spec" for the types), then push and test.`,
+        {
+          workflowId: created.id,
+          workspaceId,
+          pinnedToApplicationId: pinToApplicationId ?? null,
+          title,
+          triggerId: TRIGGER_ID,
+          triggerType: trigger.type,
+          dir,
+          studioUrl
+        }
+      );
+    }
+  );
 }
 
 // src/commands/integrations.ts
@@ -15263,12 +15378,15 @@ async function workspaceFor(client, requested, workflowDir) {
   return resolveWorkspace(client, void 0);
 }
 function registerIntegrations(program3) {
-  program3.command("integrations").description("List the workspace's connected integrations, whose ids go into integrationId inputs").option("--workspace <id>", "workspace to list (default: the workflow directory's, else your only or default one)").option("--type <TYPE>", "only this integration type, e.g. SLACK or SOFTR_TABLES").option("--dir <path>", "workflow directory whose workspace to use (default: the current directory)").action(async (opts, command) => {
+  program3.command("integrations").description("List the workspace's connected integrations, whose ids go into integrationId inputs").option(
+    "--workspace <id>",
+    "workspace to list (default: $SOFTR_WORKSPACE_ID, else the workflow directory's, else your only or default workspace)"
+  ).option("--type <TYPE>", "only this integration type, e.g. SLACK or SOFTR_TABLES").option("--dir <path>", "workflow directory whose workspace to use (default: the current directory)").action(async (opts, command) => {
     const options = globalOptions(command);
     const workflowDir = await workflowDirOf(process.cwd(), opts.dir);
     const target = resolveTarget(await readState(workflowDir ?? process.cwd()));
     const client = await authenticatedClient(target);
-    const workspaceId = await workspaceFor(client, opts.workspace, workflowDir);
+    const workspaceId = await workspaceFor(client, opts.workspace ?? process.env["SOFTR_WORKSPACE_ID"], workflowDir);
     const wanted = opts.type?.toUpperCase();
     const rows = (await listWorkspaceIntegrations(client, workspaceId)).map(toRow2).filter((row) => !wanted || row.type === wanted).sort(byTypeThenName);
     emit(options, `Workspace ${workspaceId}${wanted ? `, type ${wanted}` : ""}:
@@ -15322,7 +15440,7 @@ async function interactiveLogin(target) {
     if (answer === "2") {
       const token = (await rl.question("Personal API token: ")).trim();
       if (!token) {
-        throw new CliError("No token given.", 'Run "softr-workflows login" again.');
+        throw new CliError("No token given.", 'Run "softr login" again.');
       }
       return pastedToken(token);
     }
@@ -15350,7 +15468,7 @@ function waitForCallback(expectedState) {
       }
       const finish = (status, text) => {
         response.writeHead(status, { "Content-Type": "text/html; charset=utf-8", Connection: "close" });
-        response.end(`<!doctype html><title>softr-workflows</title><p>${text} You can close this tab.</p>`);
+        response.end(`<!doctype html><title>softr</title><p>${text} You can close this tab.</p>`);
         server.close();
       };
       const error = url.searchParams.get("error");
@@ -15377,9 +15495,7 @@ function waitForCallback(expectedState) {
       }
       const timer = setTimeout(() => {
         server.close();
-        settle?.reject(
-          new CliError("No answer from the browser within 5 minutes.", 'Run "softr-workflows login" again.')
-        );
+        settle?.reject(new CliError("No answer from the browser within 5 minutes.", 'Run "softr login" again.'));
       }, CALLBACK_TIMEOUT_MS);
       timer.unref();
       resolveServer({ redirectUri: `http://127.0.0.1:${address.port}/callback`, result });
@@ -15436,6 +15552,11 @@ function registerLogin(program3) {
   ).option("--no-browser", "browser login, but print the URL instead of opening it (for remote shells and agents)").action(async (opts, command) => {
     const options = globalOptions(command);
     const target = resolveTarget();
+    if (process.env[AUTH_ENV_VAR] === "proxy") {
+      throw new CliError(
+        `Login is not needed: the target authenticates the requests itself ($${AUTH_ENV_VAR}=proxy).`
+      );
+    }
     const token = (opts.token ?? process.env[TOKEN_ENV_VAR] ?? "").trim();
     const saved = token ? pastedToken(token) : opts.browser ? await interactiveLogin(target) : await browserLogin(target, true);
     const identity = await identify({ target, token: saved.token, kind: saved.kind });
@@ -15455,6 +15576,14 @@ function registerLogin(program3) {
     const options = globalOptions(command);
     const target = resolveTarget();
     const client = await authenticatedClient(target);
+    if (client.kind === "proxy") {
+      emit(
+        options,
+        `Requests to ${targetHost(target)} carry no token: the target authenticates them itself ($${AUTH_ENV_VAR}=proxy).`,
+        { kind: "proxy", host: targetHost(target) }
+      );
+      return;
+    }
     const identity = await identify(client);
     const stored = process.env[TOKEN_ENV_VAR] ? void 0 : await storedToken(target);
     const expiry = stored?.expiresAt ? ` Expires ${stored.expiresAt.slice(0, 16).replace("T", " ")} UTC.` : "";
@@ -15484,51 +15613,6 @@ function outdatedReferences(row) {
   const outdated = row?.sampleOutput?.outdatedDependencies;
   return outdated && Object.keys(outdated).length ? outdated : {};
 }
-function assessTests(config, rows, lastSavedAt) {
-  const byId = new Map(rows.map((row) => [row.id, row]));
-  const issues = [];
-  for (const node of executionOrder(config)) {
-    if (!node.testable) {
-      continue;
-    }
-    const row = byId.get(node.id);
-    const result = row?.sampleOutput?.result;
-    if (!result) {
-      issues.push({ id: node.id, type: node.type, kind: "untested", detail: "not tested" });
-    } else if (result.status === "FAILED") {
-      issues.push({
-        id: node.id,
-        type: node.type,
-        kind: "failed",
-        detail: `last test failed${result.errorMessage ? `: ${result.errorMessage}` : ""}`
-      });
-    } else if (result.status !== "SUCCEEDED") {
-      issues.push({
-        id: node.id,
-        type: node.type,
-        kind: "pending",
-        detail: `last test ended with ${result.status ?? "no status"}`
-      });
-    } else if (lastSavedAt && row?.sampleOutput?.createdAt && new Date(row.sampleOutput.createdAt) < new Date(lastSavedAt)) {
-      issues.push({
-        id: node.id,
-        type: node.type,
-        kind: "stale",
-        detail: `tested ${row.sampleOutput.createdAt}, before the last save ${lastSavedAt}; test again to be sure`
-      });
-    }
-    const outdated = Object.entries(outdatedReferences(row));
-    if (outdated.length) {
-      issues.push({
-        id: node.id,
-        type: node.type,
-        kind: "outdated",
-        detail: `tested against outdated data of ${outdated.map(([upstream, paths]) => `${upstream} (${paths.join(", ")})`).join("; ")}`
-      });
-    }
-  }
-  return issues;
-}
 function renderIssues(issues) {
   return issues.map((issue) => `  - ${issue.id} (${issue.type}): ${issue.detail}`).join("\n");
 }
@@ -15618,7 +15702,7 @@ async function runOne(client, workflowId, node, opts) {
   if (!node.testable) {
     return { ...base, outcome: "skipped", detail: "branches, filters and loops have no output of their own" };
   }
-  const row = node.kind === "trigger" ? await runTrigger(client, workflowId, node.id, opts.sample ?? 0) : await testAction(client, workflowId, node.id, opts.mock ? "mock" : "test", opts.iteration);
+  const row = node.kind === "trigger" ? await runTrigger(client, workflowId, node.id, opts.sample ?? 0) : await testAction(client, workflowId, hierarchyPath(node, opts.iteration), opts.mock ? "mock" : "test");
   return { ...base, ...outcomeOf(row), row };
 }
 function mergeRows(existing, fresh) {
@@ -15688,7 +15772,7 @@ function registerTest(program3) {
     "Run a node in the workflows service and save its sample output; --all runs every node in execution order"
   ).argument("[nodeId]", "the node to test (its id in softr-workflows.jsonc)").option("--all", "test the trigger and then every action, predecessors first, skipping branches, filters and loops").option("--mock", "mock run instead of a real one (actions only; custom code always runs for real)").option(
     "--iteration <n>",
-    "for a node inside a loop: which iteration to use",
+    "for a node inside a loop: the iteration of the enclosing loop(s) to use (default 0)",
     (value) => Number.parseInt(value, 10)
   ).option(
     "--sample <n>",
@@ -15744,7 +15828,7 @@ function registerTest(program3) {
         ].join("\n")
       );
     }
-    emit(options, [renderResults(results), notes.join("\n")].filter(Boolean).join("\n\n"), {
+    emitWithVersionNote(options, config, [renderResults(results), notes.join("\n")].filter(Boolean).join("\n\n"), {
       workflowId: config.id,
       results: results.map(({ row: _row, ...result }) => result),
       headersRefreshed: headers.refreshed,
@@ -15831,7 +15915,7 @@ function registerOutputs(program3) {
       const row = byId.get(nodeId);
       const sample = row?.sampleOutput?.result?.output;
       if (!row || sample === void 0 || sample === null) {
-        throw new CliError(`No sample output for "${nodeId}" yet.`, `Run: softr-workflows test ${nodeId}`);
+        throw new CliError(`No sample output for "${nodeId}" yet.`, `Run: softr workflows test ${nodeId}`);
       }
       const listing = collectVariables(nodeId, sample, row.outputMetadata ?? []);
       emit(options, renderVariables(nodeId, listing.variables, listing.unverified), {
@@ -15869,7 +15953,7 @@ function registerOutputs(program3) {
       refreshedHeaders.length ? `Headers refreshed: ${refreshedHeaders.join(", ")}` : "",
       problems.length ? `Code files that do not parse (headers not refreshed):
 ${problems.map((problem) => `  ${problem}`).join("\n")}` : "",
-      'Run "softr-workflows outputs <nodeId>" for the variables of one node.'
+      'Run "softr workflows outputs <nodeId>" for the variables of one node.'
     ].filter(Boolean);
     emit(options, `${table.toString()}
 
@@ -15957,7 +16041,7 @@ function registerPlaceholder(program3) {
       }
       throw new CliError(
         `${token} is not backed by test data: ${hint}.`,
-        `Run "softr-workflows outputs ${nodeId}" to list every referenceable path.`
+        `Run "softr workflows outputs ${nodeId}" to list every referenceable path.`
       );
     }
     const type = renderJsType(description.type);
@@ -15979,55 +16063,6 @@ type: ${type}${example3}  (${status})`, {
 import { stdin as stdin2, stdout } from "node:process";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
-// src/project/placeholder-check.ts
-var TOKEN = /\{(?:outputs|loopActionGroup)\.[^:{}]+:::[^{}]*\}/g;
-function* stringsIn(value, path13) {
-  if (typeof value === "string") {
-    yield [path13, value];
-  } else if (Array.isArray(value)) {
-    for (const [index, item] of value.entries()) {
-      yield* stringsIn(item, `${path13}[${index}]`);
-    }
-  } else if (value !== null && typeof value === "object") {
-    for (const [key, item] of Object.entries(value)) {
-      if (key === "actions" || key === "paths") {
-        continue;
-      }
-      yield* stringsIn(item, path13 ? `${path13}.${key}` : key);
-    }
-  }
-}
-function checkPlaceholders(config, outputs) {
-  const findings = [];
-  const nodes = [...config.triggers ?? [], ...allActions(config.actions)];
-  for (const node of nodes) {
-    for (const [input, text] of stringsIn(node.inputs ?? {}, "")) {
-      for (const token of new Set(text.match(TOKEN) ?? [])) {
-        if (!parseWholePlaceholder(token)) {
-          continue;
-        }
-        const [description] = describeInputData(
-          { id: node.id, type: node.type, inputs: { inputData: { probe: token } } },
-          config,
-          outputs
-        );
-        if (!description) {
-          continue;
-        }
-        const status = description.verified ? "verified" : description.type.kind === "unknown" ? "unknown" : "declared";
-        findings.push({
-          nodeId: node.id,
-          input,
-          token,
-          status,
-          ...description.note ? { note: description.note } : {}
-        });
-      }
-    }
-  }
-  return findings;
-}
-
 // src/project/readiness.ts
 var REASONS = {
   REFERENCED_NODE_UNKNOWN: "no node with that id",
@@ -16074,31 +16109,15 @@ function fromReadiness(readiness) {
     }
   }
   return {
-    source: "service",
     validationProblems: readiness.validationProblems,
     testIssues,
     unbacked,
     checked: { version: readiness.version, draft: readiness.draft }
   };
 }
-function fromClientChecks(config, rows, lastUpdatedAt) {
-  const outputs = indexOutputs(rows);
-  return {
-    source: "client",
-    validationProblems: null,
-    testIssues: assessTests(config, rows, lastUpdatedAt),
-    unbacked: checkPlaceholders(config, outputs).filter((finding) => finding.status !== "verified").map((finding) => ({ nodeId: finding.nodeId, token: finding.token, reason: finding.note ?? finding.status })),
-    checked: null
-  };
-}
-async function assess(client, workflowId, packed, rows, lastUpdatedAt) {
-  const readiness = await getWorkflowReadiness(client, workflowId);
-  if (readiness) {
-    return fromReadiness(readiness);
-  }
-  return fromClientChecks(packed ?? { actions: [], triggers: [] }, rows, lastUpdatedAt);
+async function assess(client, workflowId) {
+  return fromReadiness(await getWorkflowReadiness(client, workflowId));
 }
-var CLIENT_SIDE_NOTE = "Checked by this CLI: this deployment of the service has no readiness endpoint (it answered the request the way it answers an unknown route), so the publish validation is not part of this report.";
 
 // src/commands/publish.ts
 async function openWorkflow(dir) {
@@ -16134,15 +16153,15 @@ function registerPublish(program3) {
     if (state?.syncedHash && definitionHash(packed) !== state.syncedHash) {
       throw new CliError("Local edits are not pushed yet.", "Run push first, then publish.");
     }
-    const [remote, rows] = await Promise.all([getWorkflow(client, id), getWorkflowOutputs(client, id)]);
+    const remote = await getWorkflow(client, id);
     if (state && (remote.version !== state.version || remote.draft !== state.draft) && !opts.force) {
       throw new CliError(
         `The server copy changed since your last sync: it is version ${remote.version}, draft ${remote.draft}; this directory knows version ${state.version}, draft ${state.draft}.`,
         'Run "pull --force" to see what would go live, then publish; or "publish --force" to enable it unseen.'
       );
     }
-    const assessment = await assess(client, id, packed, rows, remote.lastUpdatedAt);
-    if (assessment.validationProblems?.length) {
+    const assessment = await assess(client, id);
+    if (assessment.validationProblems.length) {
       throw new CliError(
         `The service would reject publishing:
 ${assessment.validationProblems.map((problem) => `  - ${problem}`).join("\n")}`,
@@ -16152,8 +16171,7 @@ ${assessment.validationProblems.map((problem) => `  - ${problem}`).join("\n")}`,
     const issues = issuesOf(assessment, config);
     if (issues.length && !opts.force) {
       const text = `The workflow is not fully tested:
-${renderIssues(issues)}${assessment.source === "client" ? `
-${CLIENT_SIDE_NOTE}` : ""}`;
+${renderIssues(issues)}`;
       if (stdin2.isTTY && stdout.isTTY) {
         const rl = createInterface2({ input: stdin2, output: stdout });
         let answer;
@@ -16168,7 +16186,7 @@ Publish anyway? [y/N] `);
           return;
         }
       } else {
-        throw new CliError(text, 'Run "softr-workflows test --all" first, or pass --force to publish anyway.');
+        throw new CliError(text, 'Run "softr workflows test --all" first, or pass --force to publish anyway.');
       }
     }
     await enableWorkflow(client, id);
@@ -16190,20 +16208,8 @@ ${target.studioUrl}/workflow/${id}`,
     const options = globalOptions(command);
     const dir = await findWorkflowDir(process.cwd(), opts.dir);
     const { id, config, client, target, state } = await openWorkflow(dir);
-    const [remote, live, rows] = await Promise.all([
-      getWorkflow(client, id),
-      getEnabledVersion(client, id),
-      getWorkflowOutputs(client, id)
-    ]);
-    let packedForStatus;
-    try {
-      packedForStatus = (await packWorkflow(config, dir)).packed;
-    } catch (error) {
-      if (!(error instanceof CliError)) {
-        throw error;
-      }
-    }
-    const assessment = await assess(client, id, packedForStatus, rows, remote.lastUpdatedAt);
+    const [remote, live] = await Promise.all([getWorkflow(client, id), getEnabledVersion(client, id)]);
+    const assessment = await assess(client, id);
     const issues = issuesOf(assessment, config);
     let local = "unknown";
     let problem;
@@ -16224,15 +16230,12 @@ ${target.studioUrl}/workflow/${id}`,
       `Local:   ${local}${problem ? ` (${problem})` : ""}${state ? `; last sync version ${state.version}, draft ${state.draft}` : ""}`,
       `Server:  version ${remote.version}, draft ${remote.draft}${serverMoved ? " (moved since your last sync: pull --force to take it)" : ""}`,
       `Live:    ${live ? `version ${live.version}` : "not published"}`,
-      ...assessment.validationProblems === null ? [] : [
-        `Valid:   ${assessment.validationProblems.length ? `${assessment.validationProblems.length} problem(s)
-${assessment.validationProblems.map((problem2) => `  - ${problem2}`).join("\n")}` : "the service accepts the workflow for publishing"}`
-      ],
+      `Valid:   ${assessment.validationProblems.length ? `${assessment.validationProblems.length} problem(s)
+${assessment.validationProblems.map((problem2) => `  - ${problem2}`).join("\n")}` : "the service accepts the workflow for publishing"}`,
       `Tests:   ${issues.length ? `${issues.length} issue(s)
-${renderIssues(issues)}` : "every node tested on current data"}`,
-      ...assessment.source === "client" ? [CLIENT_SIDE_NOTE] : []
+${renderIssues(issues)}` : "every node tested on current data"}`
     ];
-    emit(options, lines.join("\n"), {
+    emitWithVersionNote(options, config, lines.join("\n"), {
       workflowId: id,
       title: remote.title,
       studioUrl: `${target.studioUrl}/workflow/${id}`,
@@ -16242,14 +16245,64 @@ ${renderIssues(issues)}` : "every node tested on current data"}`,
       server: { version: remote.version, draft: remote.draft, moved: serverMoved },
       liveVersion: live?.version ?? null,
       testIssues: issues,
-      validationProblems: assessment.validationProblems,
-      source: assessment.source
+      validationProblems: assessment.validationProblems
     });
   });
 }
 
 // src/commands/push.ts
 import path12 from "node:path";
+
+// src/project/placeholder-check.ts
+var TOKEN = /\{(?:outputs|loopActionGroup)\.[^:{}]+:::[^{}]*\}/g;
+function* stringsIn(value, path13) {
+  if (typeof value === "string") {
+    yield [path13, value];
+  } else if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) {
+      yield* stringsIn(item, `${path13}[${index}]`);
+    }
+  } else if (value !== null && typeof value === "object") {
+    for (const [key, item] of Object.entries(value)) {
+      if (key === "actions" || key === "paths") {
+        continue;
+      }
+      yield* stringsIn(item, path13 ? `${path13}.${key}` : key);
+    }
+  }
+}
+function checkPlaceholders(config, outputs) {
+  const findings = [];
+  const nodes = [...config.triggers ?? [], ...allActions(config.actions)];
+  for (const node of nodes) {
+    for (const [input, text] of stringsIn(node.inputs ?? {}, "")) {
+      for (const token of new Set(text.match(TOKEN) ?? [])) {
+        if (!parseWholePlaceholder(token)) {
+          continue;
+        }
+        const [description] = describeInputData(
+          { id: node.id, type: node.type, inputs: { inputData: { probe: token } } },
+          config,
+          outputs
+        );
+        if (!description) {
+          continue;
+        }
+        const status = description.verified ? "verified" : description.type.kind === "unknown" ? "unknown" : "declared";
+        findings.push({
+          nodeId: node.id,
+          input,
+          token,
+          status,
+          ...description.note ? { note: description.note } : {}
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+// src/commands/push.ts
 function registerPush(program3) {
   program3.command("push").description("Inline @@ file references and code files, then save the workflow as a new draft").option("--dir <path>", "workflow directory (default: the current directory)").option("--dry-run", "print the request body instead of sending it").option("--force", "push even when nothing changed locally or the server copy changed since the last sync").action(async (opts, command) => {
     const options = globalOptions(command);
@@ -16308,8 +16361,9 @@ function registerPush(program3) {
       syncedHash: hash
     });
     const studioUrl = `${target.studioUrl}/workflow/${config.id}`;
-    emit(
+    emitWithVersionNote(
       options,
+      config,
       `Pushed "${packed.title}": version ${result.version}, draft ${result.draft}` + (inlined.length ? ` (${inlined.length} file${inlined.length === 1 ? "" : "s"} inlined)` : "") + `.
 ${studioUrl}` + (unbacked.length ? `
 Warning: ${unbacked.length} placeholder(s) not backed by test data:
@@ -16347,7 +16401,7 @@ function renderList() {
   return [
     table.toString(),
     "This CLI offers only these node types on purpose: code-first workflows use custom code for everything else.",
-    'Run "softr-workflows spec <TYPE>" for the inputs, output and an example of one type.'
+    'Run "softr workflows spec <TYPE>" for the inputs, output and an example of one type.'
   ].join("\n");
 }
 function integrationIdFields(entry) {
@@ -16382,7 +16436,7 @@ ${table.toString()}`);
     const idFields = integrationIdFields(entry);
     if (idFields.length) {
       blocks.push(
-        `${idFields.join(", ")}: run "softr-workflows integrations" for the ids of the workspace's connected integrations.`
+        `${idFields.join(", ")}: run "softr integrations" for the ids of the workspace's connected integrations.`
       );
     }
   } else {
@@ -16424,6 +16478,75 @@ function registerSpec(program3) {
   });
 }
 
+// src/commands/upgrade.ts
+function registerUpgrade(program3) {
+  program3.command("upgrade").description(
+    "Move nodes on an older version of their type to the current one: CUSTOM_CODE 1.0.0 and 1.1.0 become 1.2.0 (the integrations list is added, the code file keeps its body and gets the new header)"
+  ).argument("[nodeIds...]", "the nodes to upgrade (default: every node the CLI can upgrade)").option("--dir <path>", "workflow directory (default: the current directory)").action(async (nodeIds, opts, command) => {
+    const options = globalOptions(command);
+    const dir = await findWorkflowDir(process.cwd(), opts.dir);
+    const config = await readConfig(dir);
+    const outdated = outdatedNodes(config);
+    for (const id of nodeIds) {
+      if (!locateNode(config, id)) {
+        throw new CliError(
+          `No node "${id}" in this workflow.`,
+          'Node ids are the "id" values in softr-workflows.jsonc.'
+        );
+      }
+    }
+    const wanted = nodeIds.length ? outdated.filter((node) => nodeIds.includes(node.id)) : outdated;
+    const current2 = nodeIds.filter((id) => !outdated.some((node) => node.id === id));
+    const upgraded = [];
+    const manual = [];
+    const edits = [];
+    for (const node of wanted) {
+      const location = locateNode(config, node.id);
+      const next = location ? upgradeOf(location.node) : void 0;
+      if (!location || !next) {
+        manual.push(node);
+        continue;
+      }
+      edits.push({ path: location.path, value: next });
+      upgraded.push(node);
+    }
+    if (edits.length) {
+      await editConfig(dir, edits);
+    }
+    const headers = edits.length ? await refreshCodeHeaders(
+      await readConfig(dir),
+      dir,
+      indexOutputs(await readStateFile(dir, OUTPUTS_FILE) ?? [])
+    ) : { refreshed: [], problems: [] };
+    if (!wanted.length && manual.length === 0 && current2.length === 0) {
+      emit(options, "Every node is on the current version of its type.", { upgraded: [], manual: [], current: [] });
+      return;
+    }
+    if (headers.problems.length) {
+      throw new CliError(
+        `Upgraded, but a code file could not get its new header:
+${headers.problems.map((problem) => `  ${problem}`).join("\n")}`,
+        'Fix the file, then run "pull" to regenerate its header.'
+      );
+    }
+    const lines = [
+      ...upgraded.map((node) => `Upgraded ${node.id}: ${node.type} ${node.version} \u2192 ${node.current}.`),
+      ...manual.map(
+        (node) => `No automatic upgrade for ${node.id}: ${node.type} ${node.version} \u2192 ${node.current}; compare its inputs with "spec ${node.type}" and set the version by hand.`
+      ),
+      ...current2.map((id) => `${id} is already on the current version.`),
+      headers.refreshed.length ? `Headers refreshed: ${headers.refreshed.join(", ")}` : "",
+      upgraded.length ? "Then: softr workflows push, softr workflows test --all." : ""
+    ].filter(Boolean);
+    emit(options, lines.join("\n"), {
+      upgraded: upgraded.map((node) => ({ id: node.id, type: node.type, from: node.version, to: node.current })),
+      manual: manual.map((node) => ({ id: node.id, type: node.type, from: node.version, to: node.current })),
+      current: current2,
+      headersRefreshed: headers.refreshed
+    });
+  });
+}
+
 // src/commands/verify.ts
 function section(title, lines, okText) {
   return { title, ok: lines.length === 0, lines: lines.length ? lines : [okText] };
@@ -16479,7 +16602,7 @@ function registerVerify(program3) {
       `in sync with the server (version ${remote.version}, draft ${remote.draft})`
     );
     let rows = await getWorkflowOutputs(client, config.id);
-    let assessment = await assess(client, config.id, packed, rows, remote.lastUpdatedAt);
+    let assessment = await assess(client, config.id);
     let ran = [];
     if (opts.testMissing && sync.ok && files.ok) {
       const wanted = new Set(
@@ -16489,23 +16612,19 @@ function registerVerify(program3) {
       if (nodes.length) {
         ran = await runNodeTests(client, config.id, nodes, {}, true);
         rows = await getWorkflowOutputs(client, config.id);
-        assessment = await assess(client, config.id, packed, rows, remote.lastUpdatedAt);
+        assessment = await assess(client, config.id);
       }
     }
     await writeStateFile(dir, OUTPUTS_FILE, mergeRows([], rows));
     const headers = await refreshCodeHeaders(config, dir, indexOutputs(rows));
-    if (assessment.checked && (assessment.checked.version !== remote.version || assessment.checked.draft !== remote.draft)) {
+    if (assessment.checked.version !== remote.version || assessment.checked.draft !== remote.draft) {
       syncLines.push(
         `the service assessed version ${assessment.checked.version}, draft ${assessment.checked.draft}, but the workflow is already at version ${remote.version}, draft ${remote.draft} (run verify again)`
       );
     }
     const sections = [files, sync];
-    if (assessment.validationProblems !== null) {
-      sections.push(
-        section("Validation", assessment.validationProblems, "the service accepts the workflow for publishing")
-      );
-    }
     sections.push(
+      section("Validation", assessment.validationProblems, "the service accepts the workflow for publishing"),
       section(
         "Tests",
         assessment.testIssues.map((issue) => `${issue.id} (${issue.type}): ${issue.detail}`),
@@ -16525,17 +16644,15 @@ function registerVerify(program3) {
         (item) => `${item.ok ? "OK " : "NOT"}  ${item.title}
 ${item.lines.map((line) => `       ${line}`).join("\n")}`
       ),
-      assessment.source === "client" ? CLIENT_SIDE_NOTE : "",
       headers.refreshed.length ? `Headers refreshed: ${headers.refreshed.join(", ")}` : "",
       ready ? "Ready to publish." : `Not ready to publish: ${sections.filter((item) => !item.ok).length} section(s) need attention.`
     ].filter(Boolean).join("\n\n");
-    emit(options, human, {
+    emitWithVersionNote(options, config, human, {
       workflowId: config.id,
       ready,
-      source: assessment.source,
       files: { ok: files.ok, problems: fileProblems },
       sync: { ok: sync.ok, problems: syncLines, server: { version: remote.version, draft: remote.draft } },
-      validation: assessment.validationProblems === null ? null : { ok: assessment.validationProblems.length === 0, problems: assessment.validationProblems },
+      validation: { ok: assessment.validationProblems.length === 0, problems: assessment.validationProblems },
       tests: {
         ok: assessment.testIssues.length === 0,
         issues: assessment.testIssues,
@@ -16549,10 +16666,36 @@ ${item.lines.map((line) => `       ${line}`).join("\n")}`
   });
 }
 
+// src/commands/workspaces.ts
+var import_cli_table36 = __toESM(require_cli_table3(), 1);
+function registerWorkspaces(program3) {
+  program3.command("workspaces").description("The workspaces the stored token reaches, with your role in each").action(async (_opts, command) => {
+    const options = globalOptions(command);
+    const target = resolveTarget();
+    const client = await authenticatedClient(target);
+    const workspaces = await listWorkspaces(client);
+    const table = new import_cli_table36.default({
+      head: ["ID", "Name", "Role", "Default"],
+      colWidths: [38, 34, 14, 9],
+      wordWrap: true,
+      style: { head: [], border: [], "padding-left": 1, "padding-right": 1 }
+    });
+    for (const workspace of workspaces) {
+      table.push([workspace.id, workspace.name, workspace.userRole ?? "", workspace.isDefault ? "yes" : ""]);
+    }
+    emit(
+      options,
+      workspaces.length ? `${table.toString()}
+Pass --workspace <id> to a command, or set SOFTR_WORKSPACE_ID, to work in one of them.` : "The token reaches no workspace.",
+      { workspaces }
+    );
+  });
+}
+
 // package.json
 var package_default = {
   name: "@softr/cli",
-  version: "0.0.1",
+  version: "0.1.1-se21216.10",
   description: "The Softr command line: build, test and publish Softr workflows from local files; more Softr APIs to come",
   keywords: [
     "softr",
@@ -16562,8 +16705,7 @@ var package_default = {
   license: "UNLICENSED",
   type: "module",
   bin: {
-    softr: "dist/cli.mjs",
-    "softr-workflows": "dist/cli.mjs"
+    softr: "dist/cli.mjs"
   },
   files: [
     "dist"
@@ -16580,7 +16722,7 @@ var package_default = {
     format: "prettier --write .",
     "format:check": "prettier --check .",
     check: "npm run typecheck && npm run format:check && npm test && npm run build",
-    "check:skill": "npx -y skills-ref@0.1.5 validate skills/softr-workflows"
+    "check:skill": "npx -y skills-ref@0.1.5 validate skills/softr-cli && npx -y skills-ref@0.1.5 validate skills/softr-workflows"
   },
   publishConfig: {
     access: "public"
@@ -16603,20 +16745,23 @@ var package_default = {
 };
 
 // src/cli.ts
-var program2 = new Command().name("softr").description("Build, test and publish Softr Workflows from local files").version(package_default.version).option("--json", "print results as JSON");
+var program2 = new Command().name("softr").description("The Softr command line: workflows today, more of Softr to come").version(package_default.version).option("--json", "print results as JSON");
 registerLogin(program2);
-registerList(program2);
+registerWorkspaces(program2);
 registerIntegrations(program2);
-registerPull(program2);
-registerPush(program2);
-registerTest(program2);
-registerVerify(program2);
-registerOutputs(program2);
-registerPlaceholder(program2);
-registerInit(program2);
-registerAdd(program2);
-registerEdit(program2);
-registerPublish(program2);
-registerSpec(program2);
-registerSchema(program2);
+var workflows = program2.command("workflows").description("Build, test and publish Softr Workflows from local files (one directory per workflow)");
+registerList(workflows);
+registerPull(workflows);
+registerPush(workflows);
+registerTest(workflows);
+registerVerify(workflows);
+registerOutputs(workflows);
+registerPlaceholder(workflows);
+registerInit(workflows);
+registerAdd(workflows);
+registerEdit(workflows);
+registerUpgrade(workflows);
+registerPublish(workflows);
+registerSpec(workflows);
+registerSchema(workflows);
 program2.parseAsync(process.argv).catch(reportError);