@softr/cli 0.1.2 → 0.1.4

package/dist/cli.mjs

@@ -1745,7 +1745,7 @@ var require_table = __commonJS({
     var debug = require_debug();
     var utils = require_utils();
     var tableLayout = require_layout_manager();
-    var Table7 = class extends Array {
+    var Table8 = class extends Array {
       constructor(opts) {
         super();
         const options = utils.mergeOptions(opts);
@@ -1820,7 +1820,7 @@ var require_table = __commonJS({
         return str[0].length;
       }
     };
-    Table7.reset = () => debug.reset();
+    Table8.reset = () => debug.reset();
     function doDraw(row, lineNum, result) {
       let line = [];
       row.forEach(function(cell) {
@@ -1829,7 +1829,7 @@ var require_table = __commonJS({
       let str = line.join("");
       if (str.length) result.push(str);
     }
-    module.exports = Table7;
+    module.exports = Table8;
   }
 });
 
@@ -4951,9 +4951,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path13) {
-    if (path13 === void 0) return this._executableDir;
-    this._executableDir = path13;
+  executableDir(path15) {
+    if (path15 === void 0) return this._executableDir;
+    this._executableDir = path15;
     return this;
   }
   /**
@@ -5209,7 +5209,7 @@ function useColor() {
 var program = new Command();
 
 // src/commands/add.ts
-import path9 from "node:path";
+import path6 from "node:path";
 
 // src/errors.ts
 var CliError = class extends Error {
@@ -5310,12 +5310,12 @@ function executionOrder(config) {
   collect(config.actions, []);
   const outgoing = new Map(appearance.map((id) => [id, []]));
   const indegree = new Map(appearance.map((id) => [id, 0]));
-  for (const path13 of pathSets.flat()) {
-    const to = path13.toActionId;
-    if (!to || !nodes.has(path13.fromActionId) || !nodes.has(to) || outgoing.get(path13.fromActionId).includes(to)) {
+  for (const path15 of pathSets.flat()) {
+    const to = path15.toActionId;
+    if (!to || !nodes.has(path15.fromActionId) || !nodes.has(to) || outgoing.get(path15.fromActionId).includes(to)) {
       continue;
     }
-    outgoing.get(path13.fromActionId).push(to);
+    outgoing.get(path15.fromActionId).push(to);
     indegree.set(to, indegree.get(to) + 1);
   }
   const queue = [...nodes.values()].filter((node) => node.kind === "trigger").map((node) => node.id);
@@ -6098,7 +6098,10 @@ var SoftrApiError = class extends Error {
   body;
   hint;
 };
-function hintFor(status, client) {
+function hintFor(status, client, service) {
+  if (service === "tables") {
+    return tablesHintFor(status, client);
+  }
   if (status === 401 || status === 403) {
     return client.kind === "proxy" ? "The target refused the request: no access to this workflow, or its credential is gone." : "The token was not accepted: revoked, from another environment, missing access to this workflow, or its statements do not grant this action. Run: softr login";
   }
@@ -6107,40 +6110,63 @@ function hintFor(status, client) {
   }
   return void 0;
 }
-function authHeaders(client) {
-  return client.kind === "proxy" ? {} : { Authorization: `Bearer ${client.token}` };
+function tablesHintFor(status, client) {
+  if (status === 401 || status === 403) {
+    return client.kind === "proxy" ? "The target refused the request: no access to this database, or its credential is gone." : "The token was not accepted: revoked, from another environment, or its statements do not grant this databases action (databases.records:read, databases.records:write, databases.schema:write). Run: softr login";
+  }
+  if (status === 429) {
+    return "Too many requests for this token. Wait a moment and try again.";
+  }
+  return void 0;
+}
+function authHeaders(client, service) {
+  if (client.kind === "proxy") {
+    return {};
+  }
+  return service === "tables" ? { "Softr-Api-Key": client.token } : { Authorization: `Bearer ${client.token}` };
 }
-async function send(client, service, method, path13, body) {
+var BASE_URLS = {
+  workflows: (target) => target.apiUrl,
+  studio: (target) => target.studioApiUrl,
+  tables: (target) => target.tablesApiUrl
+};
+async function send(client, service, method, path15, body) {
   const init = {
     method,
-    headers: { ...authHeaders(client), Accept: "application/json" }
+    headers: { ...authHeaders(client, service), Accept: "application/json" }
   };
   if (body !== void 0) {
     init.headers = { ...init.headers, "Content-Type": "application/json" };
     init.body = JSON.stringify(body);
   }
-  const baseUrl = service === "workflows" ? client.target.apiUrl : client.target.studioApiUrl;
-  const response = await fetch(`${baseUrl}${path13}`, init);
+  const response = await fetch(`${BASE_URLS[service](client.target)}${path15}`, init);
   if (response.ok) {
     return response;
   }
   const text = await response.text();
   throw new SoftrApiError(
-    `${method} ${path13} failed with status ${response.status}${text ? `: ${text}` : ""}`,
+    `${method} ${path15} failed with status ${response.status}${text ? `: ${text}` : ""}`,
     response.status,
     text,
-    hintFor(response.status, client)
+    hintFor(response.status, client, service)
   );
 }
-async function apiRequest(client, method, path13, body) {
-  const response = await send(client, "workflows", method, path13, body);
+async function apiRequest(client, method, path15, body) {
+  const response = await send(client, "workflows", method, path15, body);
+  return await response.json();
+}
+async function apiRequestVoid(client, method, path15, body) {
+  await send(client, "workflows", method, path15, body);
+}
+async function tablesRequest(client, method, path15, body) {
+  const response = await send(client, "tables", method, path15, body);
   return await response.json();
 }
-async function apiRequestVoid(client, method, path13, body) {
-  await send(client, "workflows", method, path13, body);
+async function tablesRequestVoid(client, method, path15, body) {
+  await send(client, "tables", method, path15, body);
 }
-async function studioRequest(client, method, path13, body) {
-  const response = await send(client, "studio", method, path13, body);
+async function studioRequest(client, method, path15, body) {
+  const response = await send(client, "studio", method, path15, body);
   return await response.json();
 }
 
@@ -6963,12 +6989,12 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
-function findNodeAtLocation(root, path13) {
+function findNodeAtLocation(root, path15) {
   if (!root) {
     return void 0;
   }
   let node = root;
-  for (let segment of path13) {
+  for (let segment of path15) {
     if (typeof segment === "string") {
       if (node.type !== "object" || !Array.isArray(node.children)) {
         return void 0;
@@ -7322,14 +7348,14 @@ function getNodeType(value) {
 
 // node_modules/jsonc-parser/lib/esm/impl/edit.js
 function setProperty(text, originalPath, value, options) {
-  const path13 = originalPath.slice();
+  const path15 = originalPath.slice();
   const errors = [];
   const root = parseTree(text, errors);
   let parent = void 0;
   let lastSegment = void 0;
-  while (path13.length > 0) {
-    lastSegment = path13.pop();
-    parent = findNodeAtLocation(root, path13);
+  while (path15.length > 0) {
+    lastSegment = path15.pop();
+    parent = findNodeAtLocation(root, path15);
     if (parent === void 0 && value !== void 0) {
       if (typeof lastSegment === "string") {
         value = { [lastSegment]: value };
@@ -7552,8 +7578,8 @@ function printParseErrorCode(code) {
   }
   return "<unknown ParseErrorCode>";
 }
-function modify(text, path13, value, options) {
-  return setProperty(text, path13, value, options);
+function modify(text, path15, value, options) {
+  return setProperty(text, path15, value, options);
 }
 function applyEdits(text, edits) {
   let sortedEdits = edits.slice(0).sort((a, b) => {
@@ -7583,14 +7609,36 @@ var CONFIG_FILE_NAME = "softr-workflows.jsonc";
 function configPath(dir) {
   return path2.join(dir, CONFIG_FILE_NAME);
 }
-async function configExists(dir) {
+async function fileExists(file) {
   try {
-    await access(configPath(dir));
+    await access(file);
     return true;
   } catch {
     return false;
   }
 }
+async function configExists(dir) {
+  return fileExists(configPath(dir));
+}
+function parseJsoncFile(file, text) {
+  const errors = [];
+  const value = parse2(text, errors, { allowTrailingComma: true });
+  if (errors.length) {
+    const first = errors[0];
+    const line = text.slice(0, first.offset).split("\n").length;
+    throw new CliError(`${file}:${line}: ${printParseErrorCode(first.error)}`);
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new CliError(`${file}: the top level must be a JSON object.`);
+  }
+  return value;
+}
+async function listSubdirsWith(cwd, holds) {
+  const entries = await readdir(cwd, { withFileTypes: true });
+  const dirs = entries.filter((entry) => entry.isDirectory()).map((entry) => path2.join(cwd, entry.name));
+  const flags = await Promise.all(dirs.map((dir) => holds(dir)));
+  return dirs.filter((_, index) => flags[index]);
+}
 async function readConfig(dir) {
   const file = configPath(dir);
   let text;
@@ -7605,17 +7653,7 @@ async function readConfig(dir) {
     }
     throw error;
   }
-  const errors = [];
-  const value = parse2(text, errors, { allowTrailingComma: true });
-  if (errors.length) {
-    const first = errors[0];
-    const line = text.slice(0, first.offset).split("\n").length;
-    throw new CliError(`${file}:${line}: ${printParseErrorCode(first.error)}`);
-  }
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new CliError(`${file}: the top level must be a JSON object.`);
-  }
-  return value;
+  return parseJsoncFile(file, text);
 }
 async function writeConfig(dir, config) {
   const file = configPath(dir);
@@ -7635,10 +7673,7 @@ async function findWorkflowDir(cwd, explicitDir) {
   throw new CliError(`No ${CONFIG_FILE_NAME} in ${cwd}.`, hint);
 }
 async function listWorkflowDirs(cwd) {
-  const entries = await readdir(cwd, { withFileTypes: true });
-  const dirs = entries.filter((entry) => entry.isDirectory()).map((entry) => path2.join(cwd, entry.name));
-  const flags = await Promise.all(dirs.map((dir) => configExists(dir)));
-  return dirs.filter((_, index) => flags[index]);
+  return listSubdirsWith(cwd, configExists);
 }
 
 // src/project/config-edit.ts
@@ -13555,8 +13590,8 @@ function typeOfField(field) {
   return field.allowMultipleEntries ? arrayOf(base) : base;
 }
 var SEGMENT = /^(?:\.?\[\s*'((?:[^'\\]|\\.)*)'\s*\]|\.?\[\s*"((?:[^"\\]|\\.)*)"\s*\]|\.?\[\s*(\d+)\s*\]|\.?\[\s*\*\s*\]|\.([^.[\]]+))/;
-function parsePath(path13) {
-  let rest = path13.trim();
+function parsePath(path15) {
+  let rest = path15.trim();
   if (rest.startsWith("$")) {
     rest = rest.slice(1);
   }
@@ -14056,10 +14091,10 @@ function describePlaceholder(placeholder, raw, config, outputs, depth) {
 function untested(nodeId) {
   return `node "${nodeId}" has no test output yet (run: softr workflows test ${nodeId})`;
 }
-function describeOutputRef(nodeId, path13, source, outputs) {
-  const segments = parsePath(path13);
+function describeOutputRef(nodeId, path15, source, outputs) {
+  const segments = parsePath(path15);
   if (!segments) {
-    return { type: UNKNOWN, source, verified: false, note: `unsupported path "${path13}"` };
+    return { type: UNKNOWN, source, verified: false, note: `unsupported path "${path15}"` };
   }
   const row = outputs[nodeId];
   if (!row) {
@@ -14384,65 +14419,167 @@ ${notes.join("\n")}` : ""}`,
   });
 }
 
-// src/commands/pull.ts
-import path8 from "node:path";
-
-// src/api/workflows.ts
-function getWorkflow(client, workflowId) {
-  return apiRequest(client, "GET", `/v1/workflows/${workflowId}`);
-}
-function updateWorkflow(client, workflowId, body) {
-  return apiRequest(client, "PUT", `/v1/workflows/${workflowId}`, body);
-}
-function getWorkflowOutputs(client, workflowId) {
-  return apiRequest(client, "GET", `/v1/workflows/${workflowId}/outputs`);
-}
-function listWorkflows(client, workspaceId, { applicationId } = {}) {
-  const query = new URLSearchParams({ workspaceId, ...applicationId ? { applicationId } : {}, limit: "500" });
-  return apiRequest(client, "GET", `/v1/workflows?${query}`);
-}
-function pinWorkflow(client, workflowId, applicationId) {
-  return apiRequestVoid(client, "POST", `/v1/workflows/${workflowId}/pinned-applications/${applicationId}`);
+// src/project/slug.ts
+function slug(title, fallback = "workflow") {
+  return title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || fallback;
 }
-function unpinWorkflow(client, workflowId, applicationId) {
-  return apiRequestVoid(client, "DELETE", `/v1/workflows/${workflowId}/pinned-applications/${applicationId}`);
+
+// src/commands/add.ts
+function uniqueId(base, taken) {
+  if (!taken.has(base)) {
+    return base;
+  }
+  for (let n = 2; ; n++) {
+    if (!taken.has(`${base}-${n}`)) {
+      return `${base}-${n}`;
+    }
+  }
 }
-function testAction(client, workflowId, hierarchyPath2, mode) {
-  return apiRequest(client, "POST", `/v1/workflows/${workflowId}/outputs/${mode}/actions/${hierarchyPath2}`, {});
+function defaultAfter(config, loopId) {
+  const order = executionOrder(config);
+  const container = loopId ? order.filter((node) => node.loopId === loopId) : order.filter((node) => node.loopId === void 0 && node.reachable);
+  if (!container.length) {
+    if (loopId) {
+      return loopId;
+    }
+    const trigger = config.triggers?.[0];
+    if (!trigger) {
+      throw new CliError("The workflow has no trigger to attach the first action to.");
+    }
+    return trigger.id;
+  }
+  const paths = loopId ? [...allActions(config.actions)].find((node) => node.id === loopId)?.inputs?.paths ?? [] : config.paths ?? [];
+  const withOutgoing = new Set(paths.map((p) => p.fromActionId));
+  const leaves = container.filter((node) => !withOutgoing.has(node.id));
+  if (leaves.length === 1 && leaves[0]) {
+    return leaves[0].id;
+  }
+  throw new CliError(
+    leaves.length ? `Several nodes have no successor: ${leaves.map((node) => node.id).join(", ")}.` : "Every node already has a successor.",
+    "Pass --after <nodeId> to say where the new node goes."
+  );
 }
-function testTrigger(client, workflowId, triggerId) {
-  return apiRequest(client, "POST", `/v1/workflows/${workflowId}/outputs/triggers/${triggerId}/test`, {});
+function registerAdd(program3) {
+  program3.command("add").description("Add an action after an existing node, or a trigger; custom code gets its own file under actions/").argument("<type>", 'node type from "spec", e.g. CUSTOM_CODE or WEBHOOK').option("--id <id>", "node id, readable and unique (default: derived from the type)").option("--title <title>", "node title shown in the studio (default: the type label)").option("--after <nodeId>", "actions: the node the new one follows (default: the only node without a successor)").option("--to <nodeId>", "triggers: an action the new trigger leads to").option("--in-loop <loopId>", "put the node inside this loop body").option("--lang <language>", "for CUSTOM_CODE: JAVASCRIPT or PYTHON (default JAVASCRIPT)").option("--dir <path>", "workflow directory (default: the current directory)").action(async (type, opts, command) => {
+    const options = globalOptions(command);
+    const dir = await findWorkflowDir(process.cwd(), opts.dir);
+    const config = await readConfig(dir);
+    const entry = findCatalogEntry(type);
+    const nodes = [...config.triggers ?? [], ...allActions(config.actions)];
+    const taken = new Set(nodes.map((node2) => node2.id));
+    const id = opts.id ?? uniqueId(entry.kind === "trigger" ? "trigger" : slug(entry.label), taken);
+    if (taken.has(id)) {
+      throw new CliError(`Node id "${id}" is already used.`);
+    }
+    if (id.includes(":::") || /[\s/?#]/.test(id)) {
+      throw new CliError(`Node id "${id}" must not contain ":::", spaces, "/", "?" or "#".`);
+    }
+    const title = opts.title ?? entry.label;
+    const { inputs, codeFile } = await newNodeInputs(entry, id, title, opts.lang, dir);
+    const node = { id, title, type: entry.type, version: entry.version, inputs };
+    if (entry.kind === "trigger") {
+      if (opts.after || opts.inLoop) {
+        throw new CliError(
+          "Triggers start the workflow: use --to <actionId> to connect one, not --after or --in-loop."
+        );
+      }
+      if (opts.to && !taken.has(opts.to)) {
+        throw new CliError(`No node "${opts.to}" to connect to.`, `Known nodes: ${[...taken].join(", ")}`);
+      }
+      await editConfig(dir, [
+        { path: ["triggers", -1], value: node },
+        ...opts.to ? [{ path: ["paths", -1], value: { fromActionId: id, toActionId: opts.to } }] : []
+      ]);
+      const notes = [
+        (config.triggers?.length ?? 0) >= 1 ? "The service accepts one trigger per published workflow for now; multi-trigger support is coming." : "",
+        opts.to ? "" : `Connect it with a path to the first action (or pass --to next time).`,
+        `Then: softr workflows push, softr workflows test ${id}.`
+      ].filter(Boolean);
+      emitWithVersionNote(
+        options,
+        config,
+        `Added ${entry.type} trigger "${id}"${opts.to ? ` leading to "${opts.to}"` : ""}.
+${notes.join("\n")}`,
+        {
+          id,
+          kind: "trigger",
+          type: entry.type,
+          to: opts.to ?? null
+        }
+      );
+      return;
+    }
+    if (opts.inLoop) {
+      const loop = [...allActions(config.actions)].find((candidate) => candidate.id === opts.inLoop);
+      if (!loop || loop.type !== LOOP_TYPE) {
+        throw new CliError(`"${opts.inLoop}" is not a loop in this workflow.`);
+      }
+    }
+    const after = opts.after ?? defaultAfter(config, opts.inLoop);
+    if (!taken.has(after)) {
+      throw new CliError(`No node "${after}" to attach to.`, `Known nodes: ${[...taken].join(", ")}`);
+    }
+    const loopIndex = opts.inLoop ? (config.actions ?? []).findIndex((action) => action.id === opts.inLoop) : -1;
+    const base = opts.inLoop && loopIndex >= 0 ? ["actions", loopIndex, "inputs"] : [];
+    await editConfig(dir, [
+      { path: [...base, "actions", -1], value: node },
+      { path: [...base, "paths", -1], value: { fromActionId: after, toActionId: id } }
+    ]);
+    const next = [
+      codeFile ? `Write the function in ${path6.relative(process.cwd(), codeFile)} and map its inputs under inputs.inputData in softr-workflows.jsonc.` : "",
+      entry.type === "BRANCH" || entry.type === "FILTER" ? `Add the condition(s) on the path(s) leaving it in softr-workflows.jsonc (see "spec ${entry.type}").` : "",
+      `Then: softr workflows push, softr workflows test ${id}.`
+    ].filter(Boolean);
+    emitWithVersionNote(
+      options,
+      config,
+      `Added ${entry.type} "${id}" after "${after}"${opts.inLoop ? ` inside loop "${opts.inLoop}"` : ""}.
+${next.join("\n")}`,
+      {
+        id,
+        kind: "action",
+        type: entry.type,
+        after,
+        loopId: opts.inLoop ?? null,
+        codeFile: codeFile ? path6.relative(process.cwd(), codeFile) : null
+      }
+    );
+  });
 }
-function saveTriggerSample(client, workflowId, triggerId, sample) {
-  return apiRequestVoid(client, "POST", `/v1/workflows/${workflowId}/sample-output/triggers/${triggerId}`, sample);
+
+// src/commands/db/databases.ts
+var import_cli_table3 = __toESM(require_cli_table3(), 1);
+import path11 from "node:path";
+
+// src/api/tables.ts
+var DATABASES = "/api/v1/databases";
+async function listDatabases(client) {
+  return (await tablesRequest(client, "GET", DATABASES)).data;
 }
-function createWorkflow(client, body) {
-  return apiRequest(client, "POST", "/v1/workflows", body);
+async function getDatabase(client, databaseId) {
+  return (await tablesRequest(client, "GET", `${DATABASES}/${encodeURIComponent(databaseId)}`)).data;
 }
-function enableWorkflow(client, workflowId) {
-  return apiRequestVoid(client, "PUT", `/v1/workflows/${workflowId}/enabled`);
+async function createDatabase(client, database) {
+  return (await tablesRequest(client, "POST", DATABASES, database)).data;
 }
-function disableWorkflow(client, workflowId) {
-  return apiRequestVoid(client, "DELETE", `/v1/workflows/${workflowId}/enabled`);
+async function updateDatabase(client, databaseId, changes) {
+  return (await tablesRequest(client, "PUT", `${DATABASES}/${encodeURIComponent(databaseId)}`, changes)).data;
 }
-async function getEnabledVersion(client, workflowId) {
-  try {
-    return await apiRequest(client, "GET", `/v1/workflows/${workflowId}/enabled`);
-  } catch (error) {
-    if (error instanceof SoftrApiError && error.status === 404) {
-      return null;
-    }
-    throw error;
-  }
+async function deleteDatabase(client, databaseId, force) {
+  await tablesRequestVoid(
+    client,
+    "DELETE",
+    `${DATABASES}/${encodeURIComponent(databaseId)}${force ? "?force=true" : ""}`
+  );
 }
-function getWorkflowReadiness(client, workflowId) {
-  return apiRequest(client, "GET", `/v1/workflows/${workflowId}/readiness`);
+async function listTables(client, databaseId) {
+  return (await tablesRequest(client, "GET", `${DATABASES}/${encodeURIComponent(databaseId)}/tables`)).data;
 }
 
 // src/config/credentials.ts
 import { chmod, mkdir as mkdir4, readFile as readFile5, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir } from "node:os";
-import path6 from "node:path";
+import path7 from "node:path";
 
 // src/api/oauth.ts
 import { createHash as createHash2, randomBytes } from "node:crypto";
@@ -14475,8 +14612,8 @@ function refreshFailureHint(status) {
   return status === 401 ? "The OAuth grant is gone (revoked or older than 30 days). Run: softr login" : "The studio could not renew the login right now; try again in a moment.";
 }
 async function tokenRequest(target, form) {
-  const path13 = "/v1/oauth/token";
-  const response = await fetch(`${target.studioApiUrl}${path13}`, {
+  const path15 = "/v1/oauth/token";
+  const response = await fetch(`${target.studioApiUrl}${path15}`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
     body: new URLSearchParams({ ...form, client_id: oauthClientId() }).toString()
@@ -14484,7 +14621,7 @@ async function tokenRequest(target, form) {
   if (!response.ok) {
     const text = await response.text();
     throw new SoftrApiError(
-      `POST ${path13} failed with status ${response.status}${text ? `: ${text}` : ""}`,
+      `POST ${path15} failed with status ${response.status}${text ? `: ${text}` : ""}`,
       response.status,
       text,
       form["grant_type"] === "refresh_token" ? refreshFailureHint(response.status) : void 0
@@ -14513,9 +14650,11 @@ function refreshTokens(target, refreshToken) {
 var API_URL_ENV_VAR = "SOFTR_WORKFLOWS_API_URL";
 var STUDIO_API_URL_ENV_VAR = "SOFTR_STUDIO_API_URL";
 var STUDIO_URL_ENV_VAR = "SOFTR_STUDIO_URL";
+var TABLES_API_URL_ENV_VAR = "SOFTR_TABLES_API_URL";
 var DEFAULT_API_URL = "https://workflows-api.softr.io";
 var DEFAULT_STUDIO_API_URL = "https://studio-api.softr.io";
 var DEFAULT_STUDIO_URL = "https://studio.softr.io";
+var DEFAULT_TABLES_API_URL = "https://tables-api.softr.io";
 function normalizeUrl(value, source) {
   let url;
   try {
@@ -14533,7 +14672,8 @@ function resolveTarget(remembered) {
   return {
     apiUrl: pick(API_URL_ENV_VAR, remembered?.apiUrl, DEFAULT_API_URL),
     studioApiUrl: pick(STUDIO_API_URL_ENV_VAR, remembered?.studioApiUrl, DEFAULT_STUDIO_API_URL),
-    studioUrl: pick(STUDIO_URL_ENV_VAR, remembered?.studioUrl, DEFAULT_STUDIO_URL)
+    studioUrl: pick(STUDIO_URL_ENV_VAR, remembered?.studioUrl, DEFAULT_STUDIO_URL),
+    tablesApiUrl: pick(TABLES_API_URL_ENV_VAR, remembered?.tablesApiUrl, DEFAULT_TABLES_API_URL)
   };
 }
 function targetHost(target) {
@@ -14563,7 +14703,7 @@ function isProxyAuth() {
 }
 var REFRESH_MARGIN_MS = 5 * 60 * 1e3;
 function credentialsPath() {
-  return path6.join(homedir(), ".softr", "credentials.json");
+  return path7.join(homedir(), ".softr", "credentials.json");
 }
 async function readCredentials() {
   try {
@@ -14577,7 +14717,7 @@ async function readCredentials() {
 }
 async function writeCredentials(credentials) {
   const file = credentialsPath();
-  await mkdir4(path6.dirname(file), { recursive: true, mode: 448 });
+  await mkdir4(path7.dirname(file), { recursive: true, mode: 448 });
   await writeFile5(file, JSON.stringify(credentials, null, 2) + "\n", { mode: 384 });
   await chmod(file, 384);
   return file;
@@ -14650,51 +14790,46 @@ async function authenticatedClient(target) {
   return { target, token: stored.token, kind };
 }
 
-// src/commands/list.ts
-var import_cli_table3 = __toESM(require_cli_table3(), 1);
-
-// src/api/studio.ts
-async function resolveTokenOwner(client) {
+// src/project/db-dir.ts
+import { mkdir as mkdir5, readFile as readFile6, rm, writeFile as writeFile6 } from "node:fs/promises";
+import path8 from "node:path";
+var DB_CONFIG_FILE_NAME = "softr-db.jsonc";
+var DB_CACHE_DIR_NAME = ".softr-db";
+var DATABASE_ID_ENV_VAR = "SOFTR_DATABASE_ID";
+function configFile(dir) {
+  return path8.join(dir, DB_CONFIG_FILE_NAME);
+}
+function cacheFile(dir) {
+  return path8.join(dir, DB_CACHE_DIR_NAME, "schema.json");
+}
+async function dbConfigExists(dir) {
+  return fileExists(configFile(dir));
+}
+async function readDbConfig(dir) {
+  const file = configFile(dir);
+  let text;
   try {
-    return await studioRequest(client, "POST", "/v1/users/me/token", { token: client.token });
+    text = await readFile6(file, "utf8");
   } catch (error) {
-    if (error instanceof SoftrApiError && error.status === 404) {
-      throw new CliError(
-        "The studio does not know this token: revoked, expired, or from another environment.",
-        'Create a new personal API token in the studio, or run "softr login" for the browser login.'
-      );
+    if (error.code === "ENOENT") {
+      return void 0;
     }
     throw error;
   }
+  const value = parseJsoncFile(file, text);
+  if (typeof value["databaseId"] !== "string" || !value["databaseId"]) {
+    throw new CliError(`${file}: "databaseId" must be a non-empty string.`);
+  }
+  return { databaseId: value["databaseId"] };
 }
-function grantsWorkflows(statements) {
-  return (statements ?? []).some(
-    (statement) => statement.actions.some((action) => action === "*" || action.startsWith("workflows:"))
-  );
-}
-async function listWorkspaces(client) {
-  const workspaces = await studioRequest(client, "GET", "/v1/api/me/workspaces");
-  return workspaces.map((workspace) => ({
-    id: workspace.id,
-    name: workspace.name,
-    ...workspace.role ? { userRole: workspace.role } : {},
-    isDefault: workspace.isDefault
-  }));
-}
-function listWorkspaceIntegrations(client, workspaceId) {
-  return studioRequest(client, "GET", `/v1/api/me/workspaces/${workspaceId}/integrations`);
-}
-
-// src/project/state.ts
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile6 } from "node:fs/promises";
-import path7 from "node:path";
-var STATE_DIR_NAME = ".softr-workflows";
-function stateDir(dir) {
-  return path7.join(dir, STATE_DIR_NAME);
+async function writeDbConfig(dir, config) {
+  await mkdir5(dir, { recursive: true });
+  await writeFile6(configFile(dir), JSON.stringify(config, null, 2) + "\n");
+  return configFile(dir);
 }
-async function readState(dir) {
+async function readSchemaCache(dir) {
   try {
-    return JSON.parse(await readFile6(path7.join(stateDir(dir), "state.json"), "utf8"));
+    return JSON.parse(await readFile6(cacheFile(dir), "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") {
       return void 0;
@@ -14702,127 +14837,250 @@ async function readState(dir) {
     throw error;
   }
 }
-async function writeState(dir, state) {
-  await mkdir5(stateDir(dir), { recursive: true });
-  const value = { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await writeFile6(path7.join(stateDir(dir), "state.json"), JSON.stringify(value, null, 2) + "\n");
+async function writeSchemaCache(dir, database, tables) {
+  const cache = { database, tables, refreshedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await mkdir5(path8.dirname(cacheFile(dir)), { recursive: true });
+  await writeFile6(cacheFile(dir), JSON.stringify(cache, null, 2) + "\n");
+  return cache;
 }
-async function readStateFile(dir, name) {
-  try {
-    return JSON.parse(await readFile6(path7.join(stateDir(dir), name), "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return void 0;
-    }
-    throw error;
+async function refreshSchemaCache(client, dir, databaseId) {
+  const [database, tables] = await Promise.all([getDatabase(client, databaseId), listTables(client, databaseId)]);
+  return writeSchemaCache(dir, database, tables);
+}
+async function removeSchemaCache(dir) {
+  await rm(path8.join(dir, DB_CACHE_DIR_NAME), { recursive: true, force: true });
+}
+async function resolveDatabase(cwd, databaseId, explicitDir) {
+  const dir = path8.resolve(cwd, explicitDir ?? ".");
+  const config = await readDbConfig(dir);
+  if (explicitDir && !config) {
+    throw new CliError(`No ${DB_CONFIG_FILE_NAME} in ${dir}.`, 'Run "softr db get <database>" to create one.');
   }
+  const given = databaseId ?? (process.env[DATABASE_ID_ENV_VAR] || void 0);
+  if (given) {
+    return config?.databaseId === given ? { databaseId: given, dir } : { databaseId: given };
+  }
+  if (config) {
+    return { databaseId: config.databaseId, dir };
+  }
+  const candidates = await listSubdirsWith(cwd, dbConfigExists);
+  throw new CliError(
+    `Which database? There is no ${DB_CONFIG_FILE_NAME} in ${cwd}.`,
+    candidates.length ? `Databases found in: ${candidates.map((candidate) => path8.relative(cwd, candidate)).join(", ")}. Pass --dir <name> or cd into one.` : `Pass the database id, set ${DATABASE_ID_ENV_VAR}, or run "softr db get <database>".`
+  );
 }
-async function writeStateFile(dir, name, value) {
-  await mkdir5(stateDir(dir), { recursive: true });
-  const file = path7.join(stateDir(dir), name);
-  await writeFile6(file, JSON.stringify(value, null, 2) + "\n");
-  return file;
+function belongsToAnother(dir, existingId, wantedId, hint) {
+  return new CliError(
+    `${path8.join(dir, DB_CONFIG_FILE_NAME)} belongs to database ${existingId}${wantedId ? `, not ${wantedId}` : ""}.`,
+    hint
+  );
 }
-
-// src/commands/list.ts
-function toRow(workflow, workspace) {
-  return {
-    id: workflow.id,
-    title: workflow.title,
-    workspaceId: workspace.id,
-    workspaceName: workspace.name,
-    live: workflow.enabledVersion ?? null,
-    version: workflow.version,
-    draft: workflow.draft,
-    updatedAt: workflow.updatedAt ?? null,
-    triggers: (workflow.triggerSummaries ?? []).map(({ id, type }) => ({ id, type }))
-  };
+async function databaseDirFor(cwd, explicitDir, databaseId, dirName) {
+  const here = path8.resolve(cwd, explicitDir ?? ".");
+  const inHere = await readDbConfig(here);
+  if (inHere) {
+    if (databaseId && inHere.databaseId === databaseId) {
+      return { dir: here, existing: true };
+    }
+    throw belongsToAnother(
+      here,
+      inHere.databaseId,
+      databaseId,
+      explicitDir ? "Pick another --dir." : "Run it from the parent directory (a new subdirectory is created) or pass --dir."
+    );
+  }
+  if (explicitDir) {
+    return { dir: here, existing: false };
+  }
+  const sibling2 = path8.join(cwd, dirName);
+  const inSibling = await readDbConfig(sibling2);
+  if (inSibling) {
+    if (inSibling.databaseId === databaseId) {
+      return { dir: sibling2, existing: true };
+    }
+    throw belongsToAnother(sibling2, inSibling.databaseId, databaseId, "Pass --dir <path>.");
+  }
+  return { dir: sibling2, existing: false };
 }
-async function collectWorkflows(client, { workspaceId, applicationId } = {}) {
-  const workspaces = await listWorkspaces(client);
-  const selected = workspaceId ? workspaces.filter((workspace) => workspace.id === workspaceId) : workspaces;
-  if (workspaceId && !selected.length) {
+async function findReachableDatabase(client, reference) {
+  const reachable = await listDatabases(client);
+  const byId = reachable.find((database) => database.id === reference);
+  if (byId) {
+    return byId;
+  }
+  const byName = reachable.filter((database) => database.name === reference);
+  if (byName.length > 1) {
     throw new CliError(
-      `You have no access to workspace ${workspaceId}.`,
-      `Known workspaces: ${workspaces.map((w) => `${w.name} (${w.id})`).join(", ")}`
+      `Several databases are named "${reference}".`,
+      `Pass the id of one: ${byName.map((database) => `${database.id} (workspace ${database.workspaceId})`).join(", ")}`
     );
   }
-  const listing = { workspaces: [], workflows: [], failures: [] };
-  for (const workspace of selected) {
-    try {
-      const page = await listWorkflows(client, workspace.id, { applicationId });
-      listing.workspaces.push({ id: workspace.id, name: workspace.name });
-      listing.workflows.push(...page.items.map((workflow) => toRow(workflow, workspace)));
-    } catch (error) {
-      if (!(error instanceof SoftrApiError) || selected.length === 1) {
-        throw error;
-      }
-      listing.failures.push({
-        workspaceId: workspace.id,
-        workspaceName: workspace.name,
-        status: error.status,
-        message: error.body
-      });
+  if (!byName[0]) {
+    throw new CliError(
+      `The token reaches no database with the id or name "${reference}".`,
+      '"softr db list" shows the ones it reaches.'
+    );
+  }
+  return byName[0];
+}
+async function bindDatabaseDir(client, cwd, reference, explicitDir) {
+  const here = path8.resolve(cwd, explicitDir ?? ".");
+  const config = await readDbConfig(here);
+  if (!reference || reference === config?.databaseId) {
+    if (!config) {
+      const candidates = await listSubdirsWith(cwd, dbConfigExists);
+      throw new CliError(
+        `Which database? There is no ${DB_CONFIG_FILE_NAME} in ${here}.`,
+        candidates.length ? `Databases found in: ${candidates.map((candidate) => path8.relative(cwd, candidate)).join(", ")}. Pass --dir <name> or cd into one.` : 'Pass its id or name: softr db get <database>. "softr db list" shows the ones the token reaches.'
+      );
     }
+    return { databaseId: config.databaseId, dir: here, wrote: false };
   }
-  return listing;
+  const database = await findReachableDatabase(client, reference);
+  const { dir, existing } = await databaseDirFor(cwd, explicitDir, database.id, slug(database.name, "database"));
+  if (!existing) {
+    await writeDbConfig(dir, { databaseId: database.id });
+  }
+  return { databaseId: database.id, dir, wrote: !existing };
 }
-var TITLE_WIDTH = 34;
-function workflowTable(rows) {
-  const table = new import_cli_table3.default({
-    head: ["ID", "Title", "Triggers", "Status", "Version", "Draft"],
-    // Only the free-text title wraps; the other columns size to their content, so trigger types are never cut off.
-    colWidths: [null, TITLE_WIDTH, null, null, null, null],
-    wordWrap: true,
-    style: { head: [], border: [], "padding-left": 1, "padding-right": 1 }
-  });
-  for (const row of rows) {
-    table.push([
-      row.id,
-      row.title,
-      row.triggers.map((trigger) => trigger.type).join("\n") || "-",
-      row.live === null ? "not enabled" : `live v${row.live}`,
-      row.version,
-      row.draft
-    ]);
+
+// src/api/studio.ts
+async function resolveTokenOwner(client) {
+  try {
+    return await studioRequest(client, "POST", "/v1/users/me/token", { token: client.token });
+  } catch (error) {
+    if (error instanceof SoftrApiError && error.status === 404) {
+      throw new CliError(
+        "The studio does not know this token: revoked, expired, or from another environment.",
+        'Create a new personal API token in the studio, or run "softr login" for the browser login.'
+      );
+    }
+    throw error;
   }
-  return table.toString();
 }
-function renderWorkflows({ workspaces, workflows: workflows2, failures }) {
-  const blocks = [];
-  for (const workspace of workspaces) {
-    const rows = workflows2.filter((row) => row.workspaceId === workspace.id);
-    const heading = `Workspace: ${workspace.name} (${workspace.id})`;
-    blocks.push(rows.length ? `${heading}
-${workflowTable(rows)}` : `${heading}
-  (no workflows)`);
+var WORKFLOWS_READ_SCOPE = "workflows:read";
+var DATABASES_SCHEMA_WRITE_SCOPE = "databases.schema:write";
+function grantsActionOf(statements, prefix) {
+  return (statements ?? []).some(
+    (statement) => statement.actions.some((action) => action === "*" || action.startsWith(prefix))
+  );
+}
+function grantsWorkflows(statements) {
+  return grantsActionOf(statements, "workflows:");
+}
+function grantsDatabases(statements) {
+  return grantsActionOf(statements, "databases.");
+}
+async function listWorkspacesWith(client, scope) {
+  const reachable = await listWorkspaces(client);
+  return { reachable, granted: reachable.filter((workspace) => !workspace.scopes || workspace.scopes.includes(scope)) };
+}
+async function listWorkspaces(client) {
+  const workspaces = await studioRequest(client, "GET", "/v1/api/me/workspaces");
+  return workspaces.map((workspace) => ({
+    id: workspace.id,
+    name: workspace.name,
+    ...workspace.role ? { userRole: workspace.role } : {},
+    isDefault: workspace.isDefault,
+    ...workspace.scopes ? { scopes: workspace.scopes } : {}
+  }));
+}
+function listWorkspaceIntegrations(client, workspaceId) {
+  return studioRequest(client, "GET", `/v1/api/me/workspaces/${workspaceId}/integrations`);
+}
+
+// src/commands/init.ts
+import path10 from "node:path";
+
+// src/api/workflows.ts
+function getWorkflow(client, workflowId) {
+  return apiRequest(client, "GET", `/v1/workflows/${workflowId}`);
+}
+function updateWorkflow(client, workflowId, body) {
+  return apiRequest(client, "PUT", `/v1/workflows/${workflowId}`, body);
+}
+function getWorkflowOutputs(client, workflowId) {
+  return apiRequest(client, "GET", `/v1/workflows/${workflowId}/outputs`);
+}
+function listWorkflows(client, workspaceId, { applicationId } = {}) {
+  const query = new URLSearchParams({ workspaceId, ...applicationId ? { applicationId } : {}, limit: "500" });
+  return apiRequest(client, "GET", `/v1/workflows?${query}`);
+}
+function pinWorkflow(client, workflowId, applicationId) {
+  return apiRequestVoid(client, "POST", `/v1/workflows/${workflowId}/pinned-applications/${applicationId}`);
+}
+function unpinWorkflow(client, workflowId, applicationId) {
+  return apiRequestVoid(client, "DELETE", `/v1/workflows/${workflowId}/pinned-applications/${applicationId}`);
+}
+function testAction(client, workflowId, hierarchyPath2, mode) {
+  return apiRequest(client, "POST", `/v1/workflows/${workflowId}/outputs/${mode}/actions/${hierarchyPath2}`, {});
+}
+function testTrigger(client, workflowId, triggerId) {
+  return apiRequest(client, "POST", `/v1/workflows/${workflowId}/outputs/triggers/${triggerId}/test`, {});
+}
+function saveTriggerSample(client, workflowId, triggerId, sample) {
+  return apiRequestVoid(client, "POST", `/v1/workflows/${workflowId}/sample-output/triggers/${triggerId}`, sample);
+}
+function createWorkflow(client, body) {
+  return apiRequest(client, "POST", "/v1/workflows", body);
+}
+function enableWorkflow(client, workflowId) {
+  return apiRequestVoid(client, "PUT", `/v1/workflows/${workflowId}/enabled`);
+}
+function disableWorkflow(client, workflowId) {
+  return apiRequestVoid(client, "DELETE", `/v1/workflows/${workflowId}/enabled`);
+}
+async function getEnabledVersion(client, workflowId) {
+  try {
+    return await apiRequest(client, "GET", `/v1/workflows/${workflowId}/enabled`);
+  } catch (error) {
+    if (error instanceof SoftrApiError && error.status === 404) {
+      return null;
+    }
+    throw error;
   }
-  if (failures.length) {
-    blocks.push(
-      [
-        `Listing failed for ${failures.length} workspace${failures.length === 1 ? "" : "s"} (skipped):`,
-        ...failures.map(
-          (failure) => `  ${failure.workspaceName} (${failure.workspaceId}): status ${failure.status}${failure.message ? `: ${failure.message}` : ""}`
-        )
-      ].join("\n")
-    );
+}
+function getWorkflowReadiness(client, workflowId) {
+  return apiRequest(client, "GET", `/v1/workflows/${workflowId}/readiness`);
+}
+
+// src/project/state.ts
+import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile7 } from "node:fs/promises";
+import path9 from "node:path";
+var STATE_DIR_NAME = ".softr-workflows";
+function stateDir(dir) {
+  return path9.join(dir, STATE_DIR_NAME);
+}
+async function readState(dir) {
+  try {
+    return JSON.parse(await readFile7(path9.join(stateDir(dir), "state.json"), "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return void 0;
+    }
+    throw error;
   }
-  return blocks.join("\n\n");
 }
-async function emitWorkflowList(options, client, { workspaceId, applicationId, human } = {}) {
-  const listing = await collectWorkflows(client, { workspaceId, applicationId });
-  emit(options, [human, renderWorkflows(listing)].filter(Boolean).join("\n\n"), { ...listing });
+async function writeState(dir, state) {
+  await mkdir6(stateDir(dir), { recursive: true });
+  const value = { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await writeFile7(path9.join(stateDir(dir), "state.json"), JSON.stringify(value, null, 2) + "\n");
 }
-function registerList(program3) {
-  program3.command("list").description("List the workflows you can access, grouped by workspace").option("--workspace <id>", "only this workspace (default: $SOFTR_WORKSPACE_ID when set)").option("--app <id>", "only the workflows linked to this application").action(async (opts, command) => {
-    const options = globalOptions(command);
-    const target = resolveTarget(await readState(process.cwd()));
-    const client = await authenticatedClient(target);
-    await emitWorkflowList(options, client, {
-      workspaceId: opts.workspace ?? process.env["SOFTR_WORKSPACE_ID"],
-      applicationId: opts.app
-    });
-  });
+async function readStateFile(dir, name) {
+  try {
+    return JSON.parse(await readFile7(path9.join(stateDir(dir), name), "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return void 0;
+    }
+    throw error;
+  }
+}
+async function writeStateFile(dir, name, value) {
+  await mkdir6(stateDir(dir), { recursive: true });
+  const file = path9.join(stateDir(dir), name);
+  await writeFile7(file, JSON.stringify(value, null, 2) + "\n");
+  return file;
 }
 
 // src/catalog/schema.ts
@@ -15056,226 +15314,39 @@ function registerSchema(program3) {
   });
 }
 
-// src/commands/pull.ts
-function slug(title) {
-  return title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "workflow";
-}
-async function targetDir(cwd, explicitDir, workflowId, title) {
-  if (explicitDir) {
-    return path8.resolve(cwd, explicitDir);
-  }
-  if (await configExists(cwd)) {
-    const existing = await readConfig(cwd);
-    if (existing.id && existing.id !== workflowId) {
-      throw new CliError(
-        `${CONFIG_FILE_NAME} here belongs to workflow ${existing.id}, not ${workflowId}.`,
-        "Run pull from the parent directory (a new subdirectory is created) or pass --dir."
-      );
-    }
-    return cwd;
-  }
-  return path8.join(cwd, slug(title));
-}
-function registerPull(program3) {
-  program3.command("pull").description("Download a workflow into softr-workflows.jsonc and one code file per custom code node").argument("[workflowId]", "the workflow id (last segment of its studio URL); omit to list what you can pull").option("--dir <path>", "target directory (default: this directory if it holds the workflow, else ./<title-slug>)").option("--force", "overwrite an existing softr-workflows.jsonc and its code files").action(async (workflowId, opts, command) => {
-    const options = globalOptions(command);
-    const cwd = process.cwd();
-    const remembered = await readState(opts.dir ? path8.resolve(cwd, opts.dir) : cwd);
-    const target = resolveTarget(remembered);
-    const client = await authenticatedClient(target);
-    if (!workflowId) {
-      await emitWorkflowList(options, client, {
-        human: "Pick a workflow and run: softr workflows pull <workflowId>"
-      });
-      return;
-    }
-    const workflow = await getWorkflow(client, workflowId);
-    const dir = await targetDir(cwd, opts.dir, workflowId, workflow.title);
-    if (await configExists(dir) && !opts.force) {
-      throw new CliError(
-        `${path8.join(dir, CONFIG_FILE_NAME)} already exists.`,
-        "Pass --force to overwrite it and its code files."
-      );
-    }
-    let rows = [];
-    let outputsNote = "";
-    let outputsFile;
-    try {
-      rows = await getWorkflowOutputs(client, workflowId);
-    } catch (error) {
-      outputsNote = `
-Sample outputs not available, inputData types are unknown: ${error.message}`;
-    }
-    const config = { $schema: SCHEMA_POINTER, ...toLocalConfig(workflow) };
-    const codeFiles = await externalizeCode(config, dir, indexOutputs(rows));
-    await writeSchemaFile(dir);
-    const configFile = await writeConfig(dir, config);
-    const syncedHash = definitionHash((await packWorkflow(config, dir)).packed);
-    await writeState(dir, { ...target, workflowId, version: workflow.version, draft: workflow.draft, syncedHash });
-    if (!outputsNote) {
-      outputsFile = await writeStateFile(dir, "outputs.json", rows);
-    }
-    const files = [configFile, ...codeFiles].map((file) => path8.relative(cwd, file));
-    emitWithVersionNote(
-      options,
-      config,
-      `Pulled "${workflow.title}" (version ${workflow.version}, draft ${workflow.draft}, ${workflow.enabled ? "enabled" : "not enabled"}).
-` + files.map((file) => `  ${file}`).join("\n") + outputsNote,
-      {
-        workflowId,
-        apiUrl: target.apiUrl,
-        title: workflow.title,
-        version: workflow.version,
-        draft: workflow.draft,
-        enabled: workflow.enabled ?? false,
-        dir,
-        files,
-        outputsFile: outputsFile ?? null
-      }
-    );
-  });
-}
-
-// src/commands/add.ts
-function uniqueId(base, taken) {
-  if (!taken.has(base)) {
-    return base;
-  }
-  for (let n = 2; ; n++) {
-    if (!taken.has(`${base}-${n}`)) {
-      return `${base}-${n}`;
-    }
-  }
-}
-function defaultAfter(config, loopId) {
-  const order = executionOrder(config);
-  const container = loopId ? order.filter((node) => node.loopId === loopId) : order.filter((node) => node.loopId === void 0 && node.reachable);
-  if (!container.length) {
-    if (loopId) {
-      return loopId;
-    }
-    const trigger = config.triggers?.[0];
-    if (!trigger) {
-      throw new CliError("The workflow has no trigger to attach the first action to.");
-    }
-    return trigger.id;
-  }
-  const paths = loopId ? [...allActions(config.actions)].find((node) => node.id === loopId)?.inputs?.paths ?? [] : config.paths ?? [];
-  const withOutgoing = new Set(paths.map((p) => p.fromActionId));
-  const leaves = container.filter((node) => !withOutgoing.has(node.id));
-  if (leaves.length === 1 && leaves[0]) {
-    return leaves[0].id;
-  }
-  throw new CliError(
-    leaves.length ? `Several nodes have no successor: ${leaves.map((node) => node.id).join(", ")}.` : "Every node already has a successor.",
-    "Pass --after <nodeId> to say where the new node goes."
-  );
-}
-function registerAdd(program3) {
-  program3.command("add").description("Add an action after an existing node, or a trigger; custom code gets its own file under actions/").argument("<type>", 'node type from "spec", e.g. CUSTOM_CODE or WEBHOOK').option("--id <id>", "node id, readable and unique (default: derived from the type)").option("--title <title>", "node title shown in the studio (default: the type label)").option("--after <nodeId>", "actions: the node the new one follows (default: the only node without a successor)").option("--to <nodeId>", "triggers: an action the new trigger leads to").option("--in-loop <loopId>", "put the node inside this loop body").option("--lang <language>", "for CUSTOM_CODE: JAVASCRIPT or PYTHON (default JAVASCRIPT)").option("--dir <path>", "workflow directory (default: the current directory)").action(async (type, opts, command) => {
-    const options = globalOptions(command);
-    const dir = await findWorkflowDir(process.cwd(), opts.dir);
-    const config = await readConfig(dir);
-    const entry = findCatalogEntry(type);
-    const nodes = [...config.triggers ?? [], ...allActions(config.actions)];
-    const taken = new Set(nodes.map((node2) => node2.id));
-    const id = opts.id ?? uniqueId(entry.kind === "trigger" ? "trigger" : slug(entry.label), taken);
-    if (taken.has(id)) {
-      throw new CliError(`Node id "${id}" is already used.`);
-    }
-    if (id.includes(":::") || /[\s/?#]/.test(id)) {
-      throw new CliError(`Node id "${id}" must not contain ":::", spaces, "/", "?" or "#".`);
-    }
-    const title = opts.title ?? entry.label;
-    const { inputs, codeFile } = await newNodeInputs(entry, id, title, opts.lang, dir);
-    const node = { id, title, type: entry.type, version: entry.version, inputs };
-    if (entry.kind === "trigger") {
-      if (opts.after || opts.inLoop) {
-        throw new CliError(
-          "Triggers start the workflow: use --to <actionId> to connect one, not --after or --in-loop."
-        );
-      }
-      if (opts.to && !taken.has(opts.to)) {
-        throw new CliError(`No node "${opts.to}" to connect to.`, `Known nodes: ${[...taken].join(", ")}`);
-      }
-      await editConfig(dir, [
-        { path: ["triggers", -1], value: node },
-        ...opts.to ? [{ path: ["paths", -1], value: { fromActionId: id, toActionId: opts.to } }] : []
-      ]);
-      const notes = [
-        (config.triggers?.length ?? 0) >= 1 ? "The service accepts one trigger per published workflow for now; multi-trigger support is coming." : "",
-        opts.to ? "" : `Connect it with a path to the first action (or pass --to next time).`,
-        `Then: softr workflows push, softr workflows test ${id}.`
-      ].filter(Boolean);
-      emitWithVersionNote(
-        options,
-        config,
-        `Added ${entry.type} trigger "${id}"${opts.to ? ` leading to "${opts.to}"` : ""}.
-${notes.join("\n")}`,
-        {
-          id,
-          kind: "trigger",
-          type: entry.type,
-          to: opts.to ?? null
-        }
-      );
-      return;
-    }
-    if (opts.inLoop) {
-      const loop = [...allActions(config.actions)].find((candidate) => candidate.id === opts.inLoop);
-      if (!loop || loop.type !== LOOP_TYPE) {
-        throw new CliError(`"${opts.inLoop}" is not a loop in this workflow.`);
-      }
-    }
-    const after = opts.after ?? defaultAfter(config, opts.inLoop);
-    if (!taken.has(after)) {
-      throw new CliError(`No node "${after}" to attach to.`, `Known nodes: ${[...taken].join(", ")}`);
-    }
-    const loopIndex = opts.inLoop ? (config.actions ?? []).findIndex((action) => action.id === opts.inLoop) : -1;
-    const base = opts.inLoop && loopIndex >= 0 ? ["actions", loopIndex, "inputs"] : [];
-    await editConfig(dir, [
-      { path: [...base, "actions", -1], value: node },
-      { path: [...base, "paths", -1], value: { fromActionId: after, toActionId: id } }
-    ]);
-    const next = [
-      codeFile ? `Write the function in ${path9.relative(process.cwd(), codeFile)} and map its inputs under inputs.inputData in softr-workflows.jsonc.` : "",
-      entry.type === "BRANCH" || entry.type === "FILTER" ? `Add the condition(s) on the path(s) leaving it in softr-workflows.jsonc (see "spec ${entry.type}").` : "",
-      `Then: softr workflows push, softr workflows test ${id}.`
-    ].filter(Boolean);
-    emitWithVersionNote(
-      options,
-      config,
-      `Added ${entry.type} "${id}" after "${after}"${opts.inLoop ? ` inside loop "${opts.inLoop}"` : ""}.
-${next.join("\n")}`,
-      {
-        id,
-        kind: "action",
-        type: entry.type,
-        after,
-        loopId: opts.inLoop ?? null,
-        codeFile: codeFile ? path9.relative(process.cwd(), codeFile) : null
-      }
-    );
-  });
-}
-
 // src/commands/init.ts
-import path10 from "node:path";
 var TRIGGER_ID = "trigger";
-async function resolveWorkspace(client, requested) {
-  const workspaces = await listWorkspaces(client);
+function requireGrantedWorkspace({ reachable, granted }, requested, scope) {
+  if (granted.some((workspace) => workspace.id === requested)) {
+    return;
+  }
+  if (reachable.some((workspace) => workspace.id === requested)) {
+    throw new CliError(
+      `The token does not grant ${scope} on workspace ${requested}.`,
+      `Check the token's grants with "softr whoami", or run "softr login" again.`
+    );
+  }
+  throw new CliError(
+    `You have no access to workspace ${requested}.`,
+    `Known workspaces: ${granted.map((w) => `${w.name} (${w.id})`).join(", ")}`
+  );
+}
+async function resolveWorkspace(client, requested, scope = WORKFLOWS_READ_SCOPE) {
+  const listing = await listWorkspacesWith(client, scope);
+  const workspaces = listing.granted;
   if (requested) {
-    if (!workspaces.some((workspace) => workspace.id === requested)) {
-      throw new CliError(
-        `You have no access to workspace ${requested}.`,
-        `Known workspaces: ${workspaces.map((w) => `${w.name} (${w.id})`).join(", ")}`
-      );
-    }
+    requireGrantedWorkspace(listing, requested, scope);
     return requested;
   }
   if (workspaces.length === 1 && workspaces[0]) {
     return workspaces[0].id;
   }
+  if (!workspaces.length) {
+    throw new CliError(
+      `The token grants ${scope} on no workspace.`,
+      `Check the token's grants with "softr whoami", or run "softr login" again.`
+    );
+  }
   const preferred = workspaces.find((workspace) => workspace.isDefault);
   if (preferred) {
     return preferred.id;
@@ -15316,7 +15387,7 @@ function registerInit(program3) {
       });
       const workflow = await getWorkflow(client, created.id);
       const config = { $schema: SCHEMA_POINTER, ...toLocalConfig(workflow) };
-      const configFile = await writeConfig(dir, config);
+      const configFile2 = await writeConfig(dir, config);
       await writeSchemaFile(dir);
       const syncedHash = definitionHash((await packWorkflow(config, dir)).packed);
       await writeState(dir, {
@@ -15330,7 +15401,7 @@ function registerInit(program3) {
       emit(
         options,
         `Created "${title}" (${created.id}) with a ${trigger.type} trigger "${TRIGGER_ID}" in workspace ${workspaceId}${pinToApplicationId ? `, linked to application ${pinToApplicationId}` : ""}.
-  ${path10.relative(cwd, configFile)}
+  ${path10.relative(cwd, configFile2)}
 ${studioUrl}
 Next: softr workflows add <TYPE> --dir ${path10.relative(cwd, dir) || "."} (see "spec" for the types), then push and test.`,
         {
@@ -15348,10 +15419,129 @@ Next: softr workflows add <TYPE> --dir ${path10.relative(cwd, dir) || "."} (see
   );
 }
 
+// src/commands/db/databases.ts
+var DATABASE_ARGUMENT = `the database id (default: $SOFTR_DATABASE_ID, else the one in ${DB_CONFIG_FILE_NAME})`;
+var DIR_OPTION = `database directory, the one holding ${DB_CONFIG_FILE_NAME} (default: the current directory)`;
+function renderDatabases(databases) {
+  if (!databases.length) {
+    return "The token reaches no database. Create one with: softr db create <name>";
+  }
+  const table = new import_cli_table3.default({
+    head: ["ID", "Name", "Workspace", "Tables"],
+    colWidths: [38, 34, 38, 8],
+    wordWrap: true,
+    style: { head: [], border: [], "padding-left": 1, "padding-right": 1 }
+  });
+  for (const database of databases) {
+    table.push([database.id, database.name, database.workspaceId, String(database.tablesCount)]);
+  }
+  return table.toString();
+}
+function renderDatabase(database, tables) {
+  return [
+    `${database.name} (${database.id})`,
+    ...database.description ? [`  ${database.description}`] : [],
+    `  Workspace: ${database.workspaceId}`,
+    `  Created:   ${database.createdAt}`,
+    `  Updated:   ${database.updatedAt}`,
+    `  Tables:    ${tables.length}`,
+    ...tables.map((table) => `    ${table.name} (${table.id}), ${table.fields.length} fields`)
+  ].join("\n");
+}
+function relativeDir(cwd, dir) {
+  return path11.relative(cwd, dir) || ".";
+}
+function registerDatabases(db2) {
+  db2.command("list").description("List the databases the token reaches, across all workspaces").action(async (_opts, command) => {
+    const options = globalOptions(command);
+    const client = await authenticatedClient(resolveTarget());
+    const databases = await listDatabases(client);
+    emit(options, renderDatabases(databases), { databases });
+  });
+  db2.command("get").description(
+    `Show a database with its tables and keep its directory: ${DB_CONFIG_FILE_NAME} and the schema cache in ${DB_CACHE_DIR_NAME}/`
+  ).argument(
+    "[database]",
+    `the database id or exact name (default: $SOFTR_DATABASE_ID, else the one in ${DB_CONFIG_FILE_NAME})`
+  ).option(
+    "--dir <path>",
+    "database directory (default: this directory if it holds a database, else a new ./<name-slug> for the one given)"
+  ).action(async (argument, opts, command) => {
+    const options = globalOptions(command);
+    const cwd = process.cwd();
+    const reference = argument ?? (process.env[DATABASE_ID_ENV_VAR] || void 0);
+    const client = await authenticatedClient(resolveTarget());
+    const { databaseId, dir, wrote } = await bindDatabaseDir(client, cwd, reference, opts.dir);
+    const { database, tables } = await refreshSchemaCache(client, dir, databaseId);
+    const note = wrote ? `
+Wrote ${path11.join(relativeDir(cwd, dir), DB_CONFIG_FILE_NAME)}.` : "";
+    emit(options, renderDatabase(database, tables) + note, { database, tables, dir });
+  });
+  db2.command("create").description(`Create an empty database and a directory for it with ${DB_CONFIG_FILE_NAME}`).argument("<name>", "the database name").option("--description <text>", "what the database holds").option(
+    "--workspace <id>",
+    "workspace to create it in (default: $SOFTR_WORKSPACE_ID, else your only or default workspace)"
+  ).option("--dir <path>", "directory to create (default: ./<name-slug>)").action(
+    async (name, opts, command) => {
+      const options = globalOptions(command);
+      const cwd = process.cwd();
+      const { dir } = await databaseDirFor(cwd, opts.dir, void 0, slug(name, "database"));
+      const client = await authenticatedClient(resolveTarget());
+      const workspaceId = await resolveWorkspace(
+        client,
+        opts.workspace ?? process.env["SOFTR_WORKSPACE_ID"],
+        DATABASES_SCHEMA_WRITE_SCOPE
+      );
+      const database = await createDatabase(client, { workspaceId, name, description: opts.description });
+      await writeDbConfig(dir, { databaseId: database.id });
+      await refreshSchemaCache(client, dir, database.id);
+      emit(
+        options,
+        `Created database ${database.name} (${database.id}) in workspace ${workspaceId}.
+  ${path11.join(relativeDir(cwd, dir), DB_CONFIG_FILE_NAME)}`,
+        { database, dir }
+      );
+    }
+  );
+  db2.command("update").description("Change a database's name or description").argument("[databaseId]", DATABASE_ARGUMENT).option("--name <name>", "the new name").option("--description <text>", "the new description").option("--dir <path>", DIR_OPTION).action(
+    async (databaseId, opts, command) => {
+      if (!opts.name && !opts.description) {
+        throw new CliError("Nothing to change: pass --name, --description or both.");
+      }
+      const options = globalOptions(command);
+      const target = await resolveDatabase(process.cwd(), databaseId, opts.dir);
+      const client = await authenticatedClient(resolveTarget());
+      const database = await updateDatabase(client, target.databaseId, {
+        name: opts.name,
+        description: opts.description
+      });
+      if (target.dir) {
+        const cache = await readSchemaCache(target.dir);
+        await (cache ? writeSchemaCache(target.dir, database, cache.tables) : refreshSchemaCache(client, target.dir, database.id));
+      }
+      emit(options, `Updated database ${database.name} (${database.id}).`, { database });
+    }
+  );
+  db2.command("delete").description("Delete a database; one that still has tables needs --force").argument("[databaseId]", DATABASE_ARGUMENT).option("--force", "also delete its tables and all their records").option("--dir <path>", DIR_OPTION).action(async (databaseId, opts, command) => {
+    const options = globalOptions(command);
+    const target = await resolveDatabase(process.cwd(), databaseId, opts.dir);
+    const client = await authenticatedClient(resolveTarget());
+    await deleteDatabase(client, target.databaseId, opts.force === true);
+    if (target.dir) {
+      await removeSchemaCache(target.dir);
+    }
+    emit(
+      options,
+      `Deleted database ${target.databaseId}.` + (target.dir ? `
+${path11.join(relativeDir(process.cwd(), target.dir), DB_CONFIG_FILE_NAME)} still names the deleted database; delete the directory.` : ""),
+      { deleted: target.databaseId }
+    );
+  });
+}
+
 // src/commands/integrations.ts
 var import_cli_table32 = __toESM(require_cli_table3(), 1);
-import path11 from "node:path";
-function toRow2(integration) {
+import path12 from "node:path";
+function toRow(integration) {
   return {
     id: integration.id,
     name: integration.name,
@@ -15382,7 +15572,7 @@ Use the ID as the integrationId input of a node (see "spec <TYPE>").`;
 }
 async function workflowDirOf(cwd, dir) {
   if (dir) {
-    return path11.resolve(cwd, dir);
+    return path12.resolve(cwd, dir);
   }
   return await configExists(cwd) ? cwd : void 0;
 }
@@ -15399,7 +15589,7 @@ async function workspaceFor(client, requested, workflowDir) {
   return resolveWorkspace(client, void 0);
 }
 function registerIntegrations(program3) {
-  program3.command("integrations").description("List the workspace's connected integrations, whose ids go into integrationId inputs").option(
+  program3.command("integrations").description("List the workspace's connected integrations").option(
     "--workspace <id>",
     "workspace to list (default: $SOFTR_WORKSPACE_ID, else the workflow directory's, else your only or default workspace)"
   ).option("--type <TYPE>", "only this integration type, e.g. SLACK or SOFTR_TABLES").option("--dir <path>", "workflow directory whose workspace to use (default: the current directory)").action(async (opts, command) => {
@@ -15409,7 +15599,7 @@ function registerIntegrations(program3) {
     const client = await authenticatedClient(target);
     const workspaceId = await workspaceFor(client, opts.workspace ?? process.env["SOFTR_WORKSPACE_ID"], workflowDir);
     const wanted = opts.type?.toUpperCase();
-    const rows = (await listWorkspaceIntegrations(client, workspaceId)).map(toRow2).filter((row) => !wanted || row.type === wanted).sort(byTypeThenName);
+    const rows = (await listWorkspaceIntegrations(client, workspaceId)).map(toRow).filter((row) => !wanted || row.type === wanted).sort(byTypeThenName);
     emit(options, `Workspace ${workspaceId}${wanted ? `, type ${wanted}` : ""}:
 ${renderIntegrations(rows)}`, {
       workspaceId,
@@ -15419,10 +15609,110 @@ ${renderIntegrations(rows)}`, {
   });
 }
 
+// src/commands/list.ts
+var import_cli_table33 = __toESM(require_cli_table3(), 1);
+function toRow2(workflow, workspace) {
+  return {
+    id: workflow.id,
+    title: workflow.title,
+    workspaceId: workspace.id,
+    workspaceName: workspace.name,
+    live: workflow.enabledVersion ?? null,
+    version: workflow.version,
+    draft: workflow.draft,
+    updatedAt: workflow.updatedAt ?? null,
+    triggers: (workflow.triggerSummaries ?? []).map(({ id, type }) => ({ id, type }))
+  };
+}
+async function collectWorkflows(client, { workspaceId, applicationId } = {}) {
+  const workspaces = await listWorkspacesWith(client, WORKFLOWS_READ_SCOPE);
+  if (workspaceId) {
+    requireGrantedWorkspace(workspaces, workspaceId, WORKFLOWS_READ_SCOPE);
+  }
+  const selected = workspaceId ? workspaces.granted.filter((workspace) => workspace.id === workspaceId) : workspaces.granted;
+  const listing = { workspaces: [], workflows: [], failures: [] };
+  for (const workspace of selected) {
+    try {
+      const page = await listWorkflows(client, workspace.id, { applicationId });
+      listing.workspaces.push({ id: workspace.id, name: workspace.name });
+      listing.workflows.push(...page.items.map((workflow) => toRow2(workflow, workspace)));
+    } catch (error) {
+      if (!(error instanceof SoftrApiError) || selected.length === 1) {
+        throw error;
+      }
+      listing.failures.push({
+        workspaceId: workspace.id,
+        workspaceName: workspace.name,
+        status: error.status,
+        message: error.body
+      });
+    }
+  }
+  return listing;
+}
+var TITLE_WIDTH = 34;
+function workflowTable(rows) {
+  const table = new import_cli_table33.default({
+    head: ["ID", "Title", "Triggers", "Status", "Version", "Draft"],
+    // Only the free-text title wraps; the other columns size to their content, so trigger types are never cut off.
+    colWidths: [null, TITLE_WIDTH, null, null, null, null],
+    wordWrap: true,
+    style: { head: [], border: [], "padding-left": 1, "padding-right": 1 }
+  });
+  for (const row of rows) {
+    table.push([
+      row.id,
+      row.title,
+      row.triggers.map((trigger) => trigger.type).join("\n") || "-",
+      row.live === null ? "not enabled" : `live v${row.live}`,
+      row.version,
+      row.draft
+    ]);
+  }
+  return table.toString();
+}
+function renderWorkflows({ workspaces, workflows: workflows2, failures }) {
+  const blocks = [];
+  for (const workspace of workspaces) {
+    const rows = workflows2.filter((row) => row.workspaceId === workspace.id);
+    const heading = `Workspace: ${workspace.name} (${workspace.id})`;
+    blocks.push(rows.length ? `${heading}
+${workflowTable(rows)}` : `${heading}
+  (no workflows)`);
+  }
+  if (failures.length) {
+    blocks.push(
+      [
+        `Listing failed for ${failures.length} workspace${failures.length === 1 ? "" : "s"} (skipped):`,
+        ...failures.map(
+          (failure) => `  ${failure.workspaceName} (${failure.workspaceId}): status ${failure.status}${failure.message ? `: ${failure.message}` : ""}`
+        )
+      ].join("\n")
+    );
+  }
+  return blocks.join("\n\n");
+}
+async function emitWorkflowList(options, client, { workspaceId, applicationId, human } = {}) {
+  const listing = await collectWorkflows(client, { workspaceId, applicationId });
+  emit(options, [human, renderWorkflows(listing)].filter(Boolean).join("\n\n"), { ...listing });
+}
+function registerList(program3) {
+  program3.command("list").description("List the workflows you can access, grouped by workspace").option("--workspace <id>", "only this workspace (default: $SOFTR_WORKSPACE_ID when set)").option("--app <id>", "only the workflows linked to this application").action(async (opts, command) => {
+    const options = globalOptions(command);
+    const target = resolveTarget(await readState(process.cwd()));
+    const client = await authenticatedClient(target);
+    await emitWorkflowList(options, client, {
+      workspaceId: opts.workspace ?? process.env["SOFTR_WORKSPACE_ID"],
+      applicationId: opts.app
+    });
+  });
+}
+
 // src/commands/login.ts
 import { execFile } from "node:child_process";
 import { createServer } from "node:http";
 import { stderr, stdin } from "node:process";
+import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
 async function identify(client) {
@@ -15430,19 +15720,20 @@ async function identify(client) {
   return { userId: owner.id, email: owner.email, statements: owner.statements };
 }
 function scopeWarning(identity) {
-  if (grantsWorkflows(identity.statements)) {
+  if (grantsWorkflows(identity.statements) || grantsDatabases(identity.statements)) {
     return "";
   }
-  return "\nWarning: this token grants no workflows action (workflows:read, workflows:write, workflows:execute); most commands will be refused.";
+  return "\nWarning: this token grants no workflows action (workflows:read, workflows:write, workflows:execute) and no databases action (databases.records:read, databases.records:write, databases.schema:write); most commands will be refused.";
 }
 async function interactiveLogin(target) {
   if (!stdin.isTTY) {
     throw new CliError(
       "No login method given and stdin is not a terminal.",
-      `Pass --token <pat_...>, set ${TOKEN_ENV_VAR}, or run "login --no-browser" and open the printed URL.`
+      `Pipe a personal API token to "login --token", set ${TOKEN_ENV_VAR}, or run "login --no-browser" and open the printed URL.`
     );
   }
   const rl = createInterface({ input: stdin, output: stderr });
+  let answer = "";
   try {
     stderr.write(
       `How do you want to log in to ${target.studioUrl}?
@@ -15450,7 +15741,6 @@ async function interactiveLogin(target) {
   2. Personal API token: paste a pat_... created in the studio under API tokens
 `
     );
-    let answer = "";
     for (; ; ) {
       answer = (await rl.question("Choose 1 or 2 [1]: ")).trim();
       if (answer === "" || answer === "1" || answer === "2") {
@@ -15458,17 +15748,59 @@ async function interactiveLogin(target) {
       }
       stderr.write("Please answer 1 or 2.\n");
     }
-    if (answer === "2") {
-      const token = (await rl.question("Personal API token: ")).trim();
-      if (!token) {
-        throw new CliError("No token given.", 'Run "softr login" again.');
-      }
-      return pastedToken(token);
-    }
   } finally {
     rl.close();
   }
-  return browserLogin(target, false);
+  return answer === "2" ? pastedToken(await promptToken()) : browserLogin(target, false);
+}
+function promptToken() {
+  stderr.write("Personal API token: ");
+  emitKeypressEvents(stdin);
+  stdin.setRawMode(true);
+  stdin.resume();
+  return new Promise((resolve, reject) => {
+    let token = "";
+    const finish = (error) => {
+      stdin.off("keypress", onKey);
+      stdin.setRawMode(false);
+      stdin.pause();
+      stderr.write("\n");
+      if (error) {
+        reject(error);
+      } else if (token.trim()) {
+        resolve(token.trim());
+      } else {
+        reject(new CliError("No token given.", 'Run "softr login" again.'));
+      }
+    };
+    const onKey = (text, key = {}) => {
+      if (key.ctrl && (key.name === "c" || key.name === "d")) {
+        finish(new CliError("Login cancelled."));
+      } else if (key.name === "return" || key.name === "enter") {
+        finish();
+      } else if (key.name === "backspace") {
+        if (token) {
+          token = token.slice(0, -1);
+          stderr.write("\b \b");
+        }
+      } else if (text && !key.ctrl && !key.meta && text >= " ") {
+        token += text;
+        stderr.write("*".repeat(text.length));
+      }
+    };
+    stdin.on("keypress", onKey);
+  });
+}
+async function readTokenFromStdin() {
+  let input = "";
+  for await (const chunk of stdin) {
+    input += chunk;
+  }
+  const token = input.trim();
+  if (!token) {
+    throw new CliError("No token on stdin.", 'Pipe the token in, for example "pbpaste | softr login --token".');
+  }
+  return token;
 }
 function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
@@ -15568,17 +15900,26 @@ function registerLogin(program3) {
   program3.command("login").description(
     "Log in through the browser (recommended) or with a personal API token; asks which when run in a terminal"
   ).option(
-    "--token <value>",
-    `a personal API token (pat_...) from the studio, no questions asked; defaults to $${TOKEN_ENV_VAR}`
-  ).option("--no-browser", "browser login, but print the URL instead of opening it (for remote shells and agents)").action(async (opts, command) => {
+    "--token",
+    `log in with a personal API token (pat_...) from the studio: read from stdin when piped, else asked for with the input hidden; without the flag, $${TOKEN_ENV_VAR} is used when set`
+  ).option("--no-browser", "browser login, but print the URL instead of opening it (for remote shells and agents)").allowExcessArguments().allowUnknownOption().action(async (opts, command) => {
     const options = globalOptions(command);
     const target = resolveTarget();
+    if (command.args.length > 0) {
+      throw opts.token || command.args.some((arg) => arg.startsWith("--token=")) ? new CliError(
+        '"--token" takes no value any more: a token on the command line ends up in the shell history.',
+        'Pipe it in ("pbpaste | softr login --token") or run "softr login --token" and paste it at the prompt. Revoke the token you passed in the studio (API tokens) and create a new one.'
+      ) : new CliError(
+        '"login" takes no arguments and knows only the options its help lists.',
+        'Run "softr login --help".'
+      );
+    }
     if (isProxyAuth()) {
       throw new CliError(
         `Login is not needed: the target authenticates the requests itself ($${AUTH_ENV_VAR}=proxy).`
       );
     }
-    const token = (opts.token ?? process.env[TOKEN_ENV_VAR] ?? "").trim();
+    const token = opts.token ? stdin.isTTY ? await promptToken() : await readTokenFromStdin() : (process.env[TOKEN_ENV_VAR] ?? "").trim();
     const saved = token ? pastedToken(token) : opts.browser ? await interactiveLogin(target) : await browserLogin(target, true);
     const identity = await identify({ target, token: saved.token, kind: saved.kind });
     await report(options, target, saved, identity);
@@ -15632,7 +15973,7 @@ ${identity.statements.map((s) => `  ${s.actions.join(", ")} on ${s.resources.joi
 }
 
 // src/commands/outputs.ts
-var import_cli_table34 = __toESM(require_cli_table3(), 1);
+var import_cli_table35 = __toESM(require_cli_table3(), 1);
 
 // src/project/test-state.ts
 function outdatedReferences(row) {
@@ -15645,28 +15986,28 @@ function renderIssues(issues) {
 
 // src/project/variables.ts
 var MAX_VARIABLES = 200;
-function appendKey(path13, key) {
-  return /^[A-Za-z_]\w*$/.test(key) ? `${path13}.${key}` : `${path13}['${key.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}']`;
+function appendKey(path15, key) {
+  return /^[A-Za-z_]\w*$/.test(key) ? `${path15}.${key}` : `${path15}['${key.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}']`;
 }
 function isPrimitive2(value) {
   return value !== void 0 && value !== null && typeof value !== "object";
 }
-function walk(type, raw, path13, token, out) {
+function walk(type, raw, path15, token, out) {
   if (out.length >= MAX_VARIABLES) {
     return;
   }
-  out.push({ variable: token(path13), path: path13, type, ...isPrimitive2(raw) ? { example: raw } : {} });
+  out.push({ variable: token(path15), path: path15, type, ...isPrimitive2(raw) ? { example: raw } : {} });
   if (type.kind === "object") {
     for (const [key, field] of Object.entries(type.fields)) {
       const rawField = raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw[key] : void 0;
-      walk(field.type, rawField, appendKey(path13, key), token, out);
+      walk(field.type, rawField, appendKey(path15, key), token, out);
     }
   } else if (type.kind === "array") {
-    walk(type.items, Array.isArray(raw) ? raw[0] : void 0, `${path13}[*]`, token, out);
+    walk(type.items, Array.isArray(raw) ? raw[0] : void 0, `${path15}[*]`, token, out);
   }
 }
 function collectVariables(nodeId, sample, metadata) {
-  const token = (path13) => `{outputs.${nodeId}:::${path13}}`;
+  const token = (path15) => `{outputs.${nodeId}:::${path15}}`;
   const variables = [];
   if (sample !== void 0 && sample !== null) {
     walk(typeOfJson(sample), sample, "$", token, variables);
@@ -15681,7 +16022,7 @@ function collectVariables(nodeId, sample, metadata) {
 }
 
 // src/commands/test.ts
-var import_cli_table33 = __toESM(require_cli_table3(), 1);
+var import_cli_table34 = __toESM(require_cli_table3(), 1);
 var OUTPUTS_FILE = "outputs.json";
 function fieldCount(row) {
   const output = row.sampleOutput?.result?.output;
@@ -15782,7 +16123,7 @@ var LABEL = {
   error: "ERROR"
 };
 function renderResults(results) {
-  const table = new import_cli_table33.default({
+  const table = new import_cli_table34.default({
     head: ["Result", "Node", "Type", "Detail"],
     colWidths: [9, 30, 24, 60],
     wordWrap: true,
@@ -15898,7 +16239,7 @@ function sampleState(row) {
   }
 }
 function renderVariables(nodeId, entries, unverified) {
-  const table = new import_cli_table34.default({
+  const table = new import_cli_table35.default({
     head: ["Variable", "Type", "Example"],
     colWidths: [64, 32, 44],
     wordWrap: true,
@@ -15966,7 +16307,7 @@ function registerOutputs(program3) {
         outdated: Object.keys(outdatedReferences(row))
       };
     });
-    const table = new import_cli_table34.default({
+    const table = new import_cli_table35.default({
       head: ["Node", "Type", "Sample", "Fields"],
       colWidths: [30, 24, 60, 8],
       wordWrap: true,
@@ -15998,19 +16339,19 @@ function pathFromKeys(keys) {
     const only = keys[0].trim();
     return only.startsWith("$") ? only : `$${only.startsWith("[") ? "" : "."}${only}`;
   }
-  let path13 = "$";
+  let path15 = "$";
   for (const key of keys) {
     if (key === "*") {
-      path13 += "[*]";
+      path15 += "[*]";
     } else if (/^\d+$/.test(key)) {
-      path13 += `[${key}]`;
+      path15 += `[${key}]`;
     } else if (/^[A-Za-z_]\w*$/.test(key)) {
-      path13 += `.${key}`;
+      path15 += `.${key}`;
     } else {
-      path13 += `['${key.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}']`;
+      path15 += `['${key.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}']`;
     }
   }
-  return path13;
+  return path15;
 }
 function keysAt(type) {
   switch (type.kind) {
@@ -16035,12 +16376,12 @@ function registerPlaceholder(program3) {
     }
     const rows = await readStateFile(dir, OUTPUTS_FILE) ?? [];
     const outputs = indexOutputs(rows);
-    const path13 = pathFromKeys(keys);
-    if (!parsePath(path13)) {
-      throw new CliError(`Cannot read the path "${path13}".`);
+    const path15 = pathFromKeys(keys);
+    if (!parsePath(path15)) {
+      throw new CliError(`Cannot read the path "${path15}".`);
     }
     const isLoop = location.node.type === LOOP_TYPE;
-    const token = isLoop ? `{loopActionGroup.${nodeId}:::loopVariables.items${path13 === "$" ? "" : path13.slice(1)}}` : `{outputs.${nodeId}:::${path13}}`;
+    const token = isLoop ? `{loopActionGroup.${nodeId}:::loopVariables.items${path15 === "$" ? "" : path15.slice(1)}}` : `{outputs.${nodeId}:::${path15}}`;
     const [description] = describeInputData(
       { id: "probe", type: "CUSTOM_CODE", inputs: { inputData: { probe: token } } },
       config,
@@ -16050,7 +16391,7 @@ function registerPlaceholder(program3) {
       throw new CliError("Could not evaluate the token.");
     }
     if (description.type.kind === "unknown") {
-      const segments = parsePath(path13) ?? [];
+      const segments = parsePath(path15) ?? [];
       let hint = description.note ?? "not found";
       const row = outputs[nodeId];
       if (row?.hasSample && segments.length) {
@@ -16076,7 +16417,7 @@ function registerPlaceholder(program3) {
     emit(options, `${token}
 type: ${type}${example3}  (${status})`, {
       token,
-      path: path13,
+      path: path15,
       type,
       example: description.example ?? null,
       verified: description.verified,
@@ -16085,6 +16426,84 @@ type: ${type}${example3}  (${status})`, {
   });
 }
 
+// src/commands/pull.ts
+import path13 from "node:path";
+async function targetDir(cwd, explicitDir, workflowId, title) {
+  if (explicitDir) {
+    return path13.resolve(cwd, explicitDir);
+  }
+  if (await configExists(cwd)) {
+    const existing = await readConfig(cwd);
+    if (existing.id && existing.id !== workflowId) {
+      throw new CliError(
+        `${CONFIG_FILE_NAME} here belongs to workflow ${existing.id}, not ${workflowId}.`,
+        "Run pull from the parent directory (a new subdirectory is created) or pass --dir."
+      );
+    }
+    return cwd;
+  }
+  return path13.join(cwd, slug(title));
+}
+function registerPull(program3) {
+  program3.command("pull").description("Download a workflow into softr-workflows.jsonc and one code file per custom code node").argument("[workflowId]", "the workflow id (last segment of its studio URL); omit to list what you can pull").option("--dir <path>", "target directory (default: this directory if it holds the workflow, else ./<title-slug>)").option("--force", "overwrite an existing softr-workflows.jsonc and its code files").action(async (workflowId, opts, command) => {
+    const options = globalOptions(command);
+    const cwd = process.cwd();
+    const remembered = await readState(opts.dir ? path13.resolve(cwd, opts.dir) : cwd);
+    const target = resolveTarget(remembered);
+    const client = await authenticatedClient(target);
+    if (!workflowId) {
+      await emitWorkflowList(options, client, {
+        human: "Pick a workflow and run: softr workflows pull <workflowId>"
+      });
+      return;
+    }
+    const workflow = await getWorkflow(client, workflowId);
+    const dir = await targetDir(cwd, opts.dir, workflowId, workflow.title);
+    if (await configExists(dir) && !opts.force) {
+      throw new CliError(
+        `${path13.join(dir, CONFIG_FILE_NAME)} already exists.`,
+        "Pass --force to overwrite it and its code files."
+      );
+    }
+    let rows = [];
+    let outputsNote = "";
+    let outputsFile;
+    try {
+      rows = await getWorkflowOutputs(client, workflowId);
+    } catch (error) {
+      outputsNote = `
+Sample outputs not available, inputData types are unknown: ${error.message}`;
+    }
+    const config = { $schema: SCHEMA_POINTER, ...toLocalConfig(workflow) };
+    const codeFiles = await externalizeCode(config, dir, indexOutputs(rows));
+    await writeSchemaFile(dir);
+    const configFile2 = await writeConfig(dir, config);
+    const syncedHash = definitionHash((await packWorkflow(config, dir)).packed);
+    await writeState(dir, { ...target, workflowId, version: workflow.version, draft: workflow.draft, syncedHash });
+    if (!outputsNote) {
+      outputsFile = await writeStateFile(dir, "outputs.json", rows);
+    }
+    const files = [configFile2, ...codeFiles].map((file) => path13.relative(cwd, file));
+    emitWithVersionNote(
+      options,
+      config,
+      `Pulled "${workflow.title}" (version ${workflow.version}, draft ${workflow.draft}, ${workflow.enabled ? "enabled" : "not enabled"}).
+` + files.map((file) => `  ${file}`).join("\n") + outputsNote,
+      {
+        workflowId,
+        apiUrl: target.apiUrl,
+        title: workflow.title,
+        version: workflow.version,
+        draft: workflow.draft,
+        enabled: workflow.enabled ?? false,
+        dir,
+        files,
+        outputsFile: outputsFile ?? null
+      }
+    );
+  });
+}
+
 // src/commands/publish.ts
 import { stdin as stdin2, stdout } from "node:process";
 import { createInterface as createInterface2 } from "node:readline/promises";
@@ -16322,23 +16741,23 @@ function registerPin(program3) {
 }
 
 // src/commands/push.ts
-import path12 from "node:path";
+import path14 from "node:path";
 
 // src/project/placeholder-check.ts
 var TOKEN = /\{(?:outputs|loopActionGroup)\.[^:{}]+:::[^{}]*\}/g;
-function* stringsIn(value, path13) {
+function* stringsIn(value, path15) {
   if (typeof value === "string") {
-    yield [path13, value];
+    yield [path15, value];
   } else if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      yield* stringsIn(item, `${path13}[${index}]`);
+      yield* stringsIn(item, `${path15}[${index}]`);
     }
   } else if (value !== null && typeof value === "object") {
     for (const [key, item] of Object.entries(value)) {
       if (key === "actions" || key === "paths") {
         continue;
       }
-      yield* stringsIn(item, path13 ? `${path13}.${key}` : key);
+      yield* stringsIn(item, path15 ? `${path15}.${key}` : key);
     }
   }
 }
@@ -16449,7 +16868,7 @@ ${unbacked.map(
         draft: result.draft,
         inlined,
         studioUrl,
-        dir: path12.resolve(dir),
+        dir: path14.resolve(dir),
         unbackedPlaceholders: unbacked
       }
     );
@@ -16457,10 +16876,10 @@ ${unbacked.map(
 }
 
 // src/commands/spec.ts
-var import_cli_table35 = __toESM(require_cli_table3(), 1);
+var import_cli_table36 = __toESM(require_cli_table3(), 1);
 var TABLE_STYLE2 = { head: [], border: [], "padding-left": 1, "padding-right": 1 };
 function renderList() {
-  const table = new import_cli_table35.default({
+  const table = new import_cli_table36.default({
     head: ["Type", "Kind", "Label", "Summary"],
     colWidths: [40, 9, 24, 70],
     wordWrap: true,
@@ -16488,7 +16907,7 @@ function renderEntry(entry) {
   const blocks = [`${entry.type} (${entry.kind}) \u2014 ${entry.label}`, entry.summary, `Docs: ${entry.docs}`];
   const inputs = Object.entries(entry.inputs);
   if (inputs.length) {
-    const table = new import_cli_table35.default({
+    const table = new import_cli_table36.default({
       head: ["Input", "Type", "Required", "Description"],
       colWidths: [20, 9, 10, 90],
       wordWrap: true,
@@ -16738,21 +17157,27 @@ ${item.lines.map((line) => `       ${line}`).join("\n")}`
 }
 
 // src/commands/workspaces.ts
-var import_cli_table36 = __toESM(require_cli_table3(), 1);
+var import_cli_table37 = __toESM(require_cli_table3(), 1);
 function registerWorkspaces(program3) {
-  program3.command("workspaces").description("The workspaces the stored token reaches, with your role in each").action(async (_opts, command) => {
+  program3.command("workspaces").description("The workspaces the stored token reaches, with your role and the scopes the token grants in each").action(async (_opts, command) => {
     const options = globalOptions(command);
     const target = resolveTarget();
     const client = await authenticatedClient(target);
     const workspaces = await listWorkspaces(client);
-    const table = new import_cli_table36.default({
-      head: ["ID", "Name", "Role", "Default"],
-      colWidths: [38, 34, 14, 9],
+    const table = new import_cli_table37.default({
+      head: ["ID", "Name", "Role", "Default", "Scopes"],
+      colWidths: [38, 26, 10, 9, 34],
       wordWrap: true,
       style: { head: [], border: [], "padding-left": 1, "padding-right": 1 }
     });
     for (const workspace of workspaces) {
-      table.push([workspace.id, workspace.name, workspace.userRole ?? "", workspace.isDefault ? "yes" : ""]);
+      table.push([
+        workspace.id,
+        workspace.name,
+        workspace.userRole ?? "",
+        workspace.isDefault ? "yes" : "",
+        (workspace.scopes ?? []).join(", ")
+      ]);
     }
     emit(
       options,
@@ -16766,11 +17191,12 @@ Pass --workspace <id> to a command, or set SOFTR_WORKSPACE_ID, to work in one of
 // package.json
 var package_default = {
   name: "@softr/cli",
-  version: "0.1.2",
-  description: "The Softr command line: build, test and publish Softr workflows from local files; more Softr APIs to come",
+  version: "0.1.4",
+  description: "The Softr command line: build, test and publish Softr workflows from local files, manage Softr Databases; more Softr APIs to come",
   keywords: [
     "softr",
     "workflows",
+    "databases",
     "cli"
   ],
   license: "UNLICENSED",
@@ -16816,7 +17242,7 @@ var package_default = {
 };
 
 // src/cli.ts
-var program2 = new Command().name("softr").description("The Softr command line: workflows today, more of Softr to come").version(package_default.version).option("--json", "print results as JSON");
+var program2 = new Command().name("softr").description("The Softr command line: workflows and databases today, more of Softr to come").version(package_default.version).option("--json", "print results as JSON");
 registerLogin(program2);
 registerWorkspaces(program2);
 registerIntegrations(program2);
@@ -16836,4 +17262,6 @@ registerPublish(workflows);
 registerPin(workflows);
 registerSpec(workflows);
 registerSchema(workflows);
+var db = program2.command("db").description("Manage Softr Databases: databases, their tables, fields and records");
+registerDatabases(db);
 program2.parseAsync(process.argv).catch(reportError);