@usecontextlayer/cli 0.14.2 → 0.14.3

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { S as execa, _ as record, a as getAccessToken, b as url, c as whoami, d as boolean, f as discriminatedUnion, g as object, h as looseObject, i as secretNameSchema, l as env, m as literal, n as readLocalManifest, o as getCurrentUser, p as hostname, r as connectionRequirementSchema, s as login, t as getLocalAppId, u as array, v as string, x as uuid, y as unknown } from "./app-CJgT3IKd.mjs";
+import { C as unknown, E as execa, S as union, T as uuid, _ as literal, b as record, c as getCurrentUser, d as env, g as hostname, h as boolean, i as ownerSchema, l as login, m as array, n as saveLocalConnection, o as joinApp, p as secretNameSchema, r as appResourceConfigurationSchema, s as getAccessToken, t as prepareLocalResourceConfiguration, u as whoami, v as looseObject, w as url, x as string, y as object } from "./resources-DEdwfmku.mjs";
 import { cp, readFile, writeFile } from "node:fs/promises";
 import path, { join } from "node:path";
 import { EventEmitter } from "node:events";
@@ -3004,166 +3004,6 @@ async function runLocalAgent(name, prompt) {
 	}
 }
 //#endregion
-//#region ../shared/dist/app-connections.mjs
-const appConnectionSchema = connectionRequirementSchema.extend({
-	connection_id: string().nullable(),
-	slug: string()
-});
-const appConnectionsSchema = object({ connections: array(appConnectionSchema) });
-//#endregion
-//#region owner.ts
-const ownerOptionsSchema = object({ org: string().min(1).optional() });
-async function resolveOwner(org, headers) {
-	if (!org) return {
-		id: (await getCurrentUser(headers)).id,
-		type: "user"
-	};
-	const response = await fetch(new URL("/api/platform/organizations", env.CTX_AUTH_ISSUER), { headers });
-	if (!response.ok) throw new Error(`Organization lookup failed: HTTP ${response.status}`);
-	const { organizations } = object({ organizations: array(object({
-		id: string().min(1),
-		slug: string()
-	})) }).parse(await response.json());
-	const organization = organizations.find((organization) => organization.slug === org);
-	if (!organization) throw new Error("Organization is not in your memberships");
-	return {
-		id: organization.id,
-		type: "organization"
-	};
-}
-function ownerPath(owner) {
-	return `${owner.type === "organization" ? "org" : "user"}/${encodeURIComponent(owner.id)}`;
-}
-//#endregion
-//#region connections.ts
-async function getLocalManifest(target) {
-	return target === "local" ? readLocalManifest() : void 0;
-}
-async function resolveAppTarget(target) {
-	if (target !== "local") return target;
-	return getLocalAppId();
-}
-async function assignAppConnection(target, slug, connectionId) {
-	const appTarget = await resolveAppTarget(target);
-	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(appTarget)}/connections/assign`, env.CTX_PLATFORM_URL), {
-		body: JSON.stringify({
-			connection_id: connectionId,
-			manifest: await getLocalManifest(target),
-			slug
-		}),
-		headers: {
-			authorization: `Bearer ${await getAccessToken()}`,
-			"content-type": "application/json"
-		},
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`Connection assignment failed: HTTP ${response.status}`);
-	const assignment = object({
-		connection_id: string(),
-		slug: string()
-	}).parse(await response.json());
-	console.log(`${assignment.slug} → ${assignment.connection_id}`);
-}
-async function listAppConnections(target) {
-	const appTarget = await resolveAppTarget(target);
-	const manifest = await getLocalManifest(target);
-	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(appTarget)}/connections/list`, env.CTX_PLATFORM_URL), {
-		body: JSON.stringify({ manifest }),
-		headers: {
-			authorization: `Bearer ${await getAccessToken()}`,
-			"content-type": "application/json"
-		},
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`App connections request failed: HTTP ${response.status}`);
-	const { connections } = appConnectionsSchema.parse(await response.json());
-	if (!connections.length) {
-		console.log("No connection requirements.");
-		return;
-	}
-	console.table(connections.map(({ connection_id, ...requirement }) => ({
-		...requirement,
-		connection: connection_id ?? "unassigned"
-	})));
-}
-async function addConnection(toolkit, org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
-	const owner = await resolveOwner(org, headers);
-	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), {
-		body: JSON.stringify({ toolkit }),
-		headers: {
-			...headers,
-			"content-type": "application/json"
-		},
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`Connection authorization failed: HTTP ${response.status}`);
-	const { redirect_url } = object({ redirect_url: url() }).parse(await response.json());
-	console.log(`Open this link to authorize the Owner's account:\n${redirect_url}`);
-	console.log(`After authorization, run ctx connections${org ? ` --org ${org}` : ""} list to see the Owner's account.`);
-}
-async function listConnections(org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
-	const owner = await resolveOwner(org, headers);
-	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), { headers });
-	if (!response.ok) throw new Error(`Connection list failed: HTTP ${response.status}`);
-	const { connections } = object({ connections: array(object({
-		alias: string().nullable(),
-		display_name: string().nullable(),
-		id: string(),
-		status: string(),
-		toolkit: string()
-	})) }).parse(await response.json());
-	if (connections.length === 0) {
-		console.log("No connected accounts.");
-		return;
-	}
-	console.table(connections);
-}
-//#endregion
-//#region git-credential.ts
-async function setupGit(cli) {
-	const key = `credential.${new URL("/git", env.CTX_PLATFORM_URL).href}.helper`;
-	const command = [
-		process.execPath,
-		fileURLToPath(cli),
-		"git-credential"
-	].map((argument) => `'${argument.replaceAll("'", "'\\''")}'`).join(" ");
-	await execa("git", [
-		"config",
-		"--global",
-		"--replace-all",
-		key,
-		""
-	]);
-	await execa("git", [
-		"config",
-		"--global",
-		"--add",
-		key,
-		`!${command}`
-	]);
-}
-async function gitCredential(operation) {
-	if (operation === "capability") {
-		process.stdout.write("version 0\ncapability authtype\n");
-		return;
-	}
-	if (operation !== "get") return;
-	const attributes = new URLSearchParams();
-	const lines = createInterface({ input: process.stdin });
-	for await (const line of lines) {
-		if (line === "") break;
-		const separator = line.indexOf("=");
-		attributes.append(line.slice(0, separator), line.slice(separator + 1));
-	}
-	literal("authtype").parse(attributes.getAll("capability[]").find((c) => c === "authtype"));
-	process.stdout.write(`capability[]=authtype\nauthtype=Bearer\ncredential=${await getAccessToken()}\n\n`);
-}
-//#endregion
-//#region package.json
-var version = "0.14.2";
-//#endregion
 //#region ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 const getCodePointsLength = (() => {
 	const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
@@ -3499,6 +3339,11 @@ var import_src = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 		beep
 	};
 })))();
+function findCursor(s, o, l) {
+	if (!l.some((r) => !r.disabled)) return s;
+	const t = s + o, n = Math.max(l.length - 1, 0), e = t < 0 ? n : t > n ? 0 : t;
+	return l[e]?.disabled ? findCursor(e, o < 0 ? -1 : 1, l) : e;
+}
 const settings = {
 	actions: /* @__PURE__ */ new Set([
 		"up",
@@ -3580,7 +3425,19 @@ function setRawMode(e, r) {
 	const o = e;
 	o.isTTY && o.setRawMode(r);
 }
+const getColumns = (e) => "columns" in e && typeof e.columns == "number" ? e.columns : 80;
 const getRows = (e) => "rows" in e && typeof e.rows == "number" ? e.rows : 20;
+function wrapTextWithPrefix(e, r, o, n = o, s = o, t) {
+	return wrapAnsi(r, getColumns(e ?? stdout) - o.length, {
+		hard: true,
+		trim: false
+	}).split(`
+`).map((c, i, m) => {
+		const d = t ? t(c, i) : c;
+		return i === 0 ? `${n}${d}` : i === m.length - 1 ? `${s}${d}` : `${o}${d}`;
+	}).join(`
+`);
+}
 function runValidation(e, a) {
 	if ("~standard" in e) {
 		const n = e["~standard"].validate(a);
@@ -3797,6 +3654,32 @@ let u$1 = class u extends y {
 		});
 	}
 };
+let n$1 = class n extends y {
+	options;
+	cursor = 0;
+	get _selectedValue() {
+		return this.options[this.cursor];
+	}
+	changeValue() {
+		const e = this._selectedValue;
+		this.value = e === void 0 ? void 0 : e.value;
+	}
+	constructor(e) {
+		super(e, false), this.options = e.options;
+		const o = this.options.findIndex(({ value: s }) => s === e.initialValue), t = o === -1 ? 0 : o;
+		this.cursor = this.options[t]?.disabled ? findCursor(t, 1, this.options) : t, this.changeValue(), this.on("cursor", (s) => {
+			switch (s) {
+				case "left":
+				case "up":
+					this.cursor = findCursor(this.cursor, -1, this.options);
+					break;
+				case "down":
+				case "right": this.cursor = findCursor(this.cursor, 1, this.options);
+			}
+			this.changeValue();
+		});
+	}
+};
 //#endregion
 //#region ../../node_modules/.pnpm/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
 function isUnicodeSupported() {
@@ -3811,6 +3694,8 @@ const S_STEP_ERROR = unicodeOr("▲", "x");
 const S_STEP_SUBMIT = unicodeOr("◇", "o");
 const S_BAR = unicodeOr("│", "|");
 const S_BAR_END = unicodeOr("└", "—");
+const S_RADIO_ACTIVE = unicodeOr("●", ">");
+const S_RADIO_INACTIVE = unicodeOr("○", " ");
 const S_PASSWORD_MASK = unicodeOr("▪", "•");
 const symbol = (o) => {
 	switch (o) {
@@ -3822,6 +3707,63 @@ const symbol = (o) => {
 		case "validating": return styleText("dim", S_STEP_ACTIVE);
 	}
 };
+const symbolBar = (o) => {
+	switch (o) {
+		case "initial":
+		case "active": return styleText("cyan", S_BAR);
+		case "cancel": return styleText("red", S_BAR);
+		case "error": return styleText("yellow", S_BAR);
+		case "submit": return styleText("green", S_BAR);
+	}
+};
+function formatInstructionFooter(o, e) {
+	const r = [`${e ? `${styleText("cyan", S_BAR)}  ` : ""}${o.join(" • ")}`];
+	return e && r.push(styleText("cyan", S_BAR_END)), r;
+}
+const I = (l, e, w, p, b, C = false) => {
+	let r = e, O = 0;
+	if (C) for (let i = p - 1; i >= w; i--) {
+		const m = l[i];
+		if (m && (r -= m.length), O++, r <= b) break;
+	}
+	else for (let i = w; i < p; i++) {
+		const m = l[i];
+		if (m && (r -= m.length), O++, r <= b) break;
+	}
+	return {
+		lineCount: r,
+		removals: O
+	};
+};
+const limitOptions = ({ cursor: l, options: e, style: w, output: p = process.stdout, maxItems: b = Number.POSITIVE_INFINITY, columnPadding: C = 0, rowPadding: r = 4 }) => {
+	const i = getColumns(p) - C, m = getRows(p), M = styleText("dim", "..."), v = Math.max(m - r, 0), a = Math.max(Math.min(b, v), 5);
+	let f = 0;
+	l >= a - 3 && (f = Math.max(Math.min(l - a + 3, e.length - a), 0));
+	let d = a < e.length && f > 0, c = a < e.length && f + a < e.length;
+	const W = Math.min(f + a, e.length), s = [];
+	let g = 0;
+	d && g++, c && g++;
+	const T = f + (d ? 1 : 0), y = W - (c ? 1 : 0);
+	for (let t = T; t < y; t++) {
+		const n = e[t], h = wrapAnsi(n ? w(n, t === l) : "", i, {
+			hard: true,
+			trim: false
+		}).split(`
+`);
+		s.push(h), g += h.length;
+	}
+	if (g > v) {
+		let t = 0, n = 0, o = g;
+		const h = l - T;
+		let u = v;
+		const L = () => I(s, o, 0, h, u), E = () => I(s, o, h + 1, s.length, u, true);
+		d ? ({lineCount: o, removals: t} = L(), o > u && (c || (u -= 1), {lineCount: o, removals: n} = E())) : (c || (u -= 1), {lineCount: o, removals: n} = E(), o > u && (u -= 1, {lineCount: o, removals: t} = L())), t > 0 && (d = true, s.splice(0, t)), n > 0 && (c = true, s.splice(s.length - n, n));
+	}
+	const x = [];
+	d && x.push(M);
+	for (const t of s) for (const n of t) x.push(n);
+	return c && x.push(M), x;
+};
 `${styleText("dim", "↑/↓")}`, `${styleText("dim", "Space:")}`, `${styleText("dim", "Enter:")}`;
 const password = (e) => new u$1({
 	validate: e.validate,
@@ -3850,21 +3792,272 @@ ${r ? styleText("cyan", S_BAR_END) : ""}
 		}
 	}
 }).prompt();
-`${styleText("dim", "↑/↓")}`, `${styleText("dim", "Enter:")}`;
+const SELECT_INSTRUCTIONS = [`${styleText("dim", "↑/↓")} to navigate`, `${styleText("dim", "Enter:")} confirm`];
+const c = (t, o) => t.includes(`
+`) ? t.split(`
+`).map((d) => o(d)).join(`
+`) : o(t);
+const select = (t) => {
+	const o = (n, m) => {
+		if (n === void 0) return "";
+		const s = n.label ?? String(n.value);
+		switch (m) {
+			case "disabled": return `${styleText("gray", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("gray", i))}${n.hint ? ` ${styleText("dim", `(${n.hint ?? "disabled"})`)}` : ""}`;
+			case "selected": return `${c(s, (i) => styleText("dim", i))}`;
+			case "active": return `${styleText("green", S_RADIO_ACTIVE)} ${s}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+			case "cancelled": return `${c(s, (i) => styleText(["strikethrough", "dim"], i))}`;
+			default: return `${styleText("dim", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("dim", i))}`;
+		}
+	}, d = t.showInstructions ?? true;
+	return new n$1({
+		options: t.options,
+		signal: t.signal,
+		input: t.input,
+		output: t.output,
+		initialValue: t.initialValue,
+		render() {
+			const n = t.withGuide ?? settings.withGuide, m = `${symbol(this.state)}  `, s = `${symbolBar(this.state)}  `, i = wrapTextWithPrefix(t.output, t.message, s, m), u = `${n ? `${styleText("gray", S_BAR)}
+` : ""}${i}
+`;
+			switch (this.state) {
+				case "submit": {
+					const r = n ? `${styleText("gray", S_BAR)}  ` : "";
+					return `${u}${wrapTextWithPrefix(t.output, o(this.options[this.cursor], "selected"), r)}`;
+				}
+				case "cancel": {
+					const r = n ? `${styleText("gray", S_BAR)}  ` : "";
+					return `${u}${wrapTextWithPrefix(t.output, o(this.options[this.cursor], "cancelled"), r)}${n ? `
+${styleText("gray", S_BAR)}` : ""}`;
+				}
+				default: {
+					const r = n ? `${styleText("cyan", S_BAR)}  ` : "", a = u.split(`
+`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS, n) : n ? [styleText("cyan", S_BAR_END)] : [], f = p.join(`
+`), b = p.length + 1;
+					return `${u}${r}${limitOptions({
+						output: t.output,
+						cursor: this.cursor,
+						options: this.options,
+						maxItems: t.maxItems,
+						columnPadding: r.length,
+						rowPadding: a + b,
+						style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
+					}).join(`
+${r}`)}
+${f}
+`;
+				}
+			}
+		}
+	}).prompt();
+};
 `${styleText("gray", S_BAR)}`;
 //#endregion
-//#region ../shared/dist/app-usage.mjs
-const ownerSchema = discriminatedUnion("type", [object({
-	id: string().min(1),
-	type: literal("user")
-}), object({
-	id: string().min(1),
-	type: literal("organization")
-})]);
-object({
-	id: uuid(),
-	owner: ownerSchema
+//#region ../shared/dist/app-connections.mjs
+const appConnectionSchema = appResourceConfigurationSchema.shape.connections.valueType.extend({ slug: string() });
+const appConnectionsSchema = object({ connections: array(appConnectionSchema) });
+//#endregion
+//#region ../shared/dist/connections.mjs
+const connectionSchema = object({
+	alias: string().nullable(),
+	display_name: string().nullable(),
+	id: string(),
+	status: string(),
+	toolkit: string()
+});
+const connectionsSchema = object({ connections: array(connectionSchema) });
+//#endregion
+//#region owner.ts
+const ownerOptionsSchema = object({ org: string().min(1).optional() });
+async function resolveOwner(org, headers) {
+	if (!org) return {
+		id: (await getCurrentUser(headers)).id,
+		type: "user"
+	};
+	const response = await fetch(new URL("/api/platform/organizations", env.CTX_AUTH_ISSUER), { headers });
+	if (!response.ok) throw new Error(`Organization lookup failed: HTTP ${response.status}`);
+	const { organizations } = object({ organizations: array(object({
+		id: string().min(1),
+		slug: string()
+	})) }).parse(await response.json());
+	const organization = organizations.find((organization) => organization.slug === org);
+	if (!organization) throw new Error("Organization is not in your memberships");
+	return {
+		id: organization.id,
+		type: "organization"
+	};
+}
+function ownerPath(owner) {
+	return `${owner.type === "organization" ? "org" : "user"}/${encodeURIComponent(owner.id)}`;
+}
+//#endregion
+//#region connections.ts
+const connectionAssignmentSchema = object({
+	connection_id: string().min(1).optional(),
+	slug: string().min(1),
+	target: string().min(1)
+}).superRefine((input, ctx) => {
+	if (input.target !== "local" && input.connection_id === void 0) ctx.addIssue({
+		code: "custom",
+		message: "Hosted assignment requires a connection ID",
+		path: ["connection_id"]
+	});
 });
+async function assignAppConnection(target, slug, connectionId) {
+	if (target === "local") {
+		const configuration = await prepareLocalResourceConfiguration();
+		const requirement = new Map(Object.entries(configuration.connections)).get(slug);
+		if (!requirement) throw new Error(`No local connection requirement for "${slug}"`);
+		if (connectionId === void 0 && !process.stdin.isTTY) throw new Error("Supply a connection ID when assigning without a terminal");
+		const url = new URL("/api/connections", env.CTX_PLATFORM_URL);
+		url.searchParams.set("toolkit", requirement.toolkit);
+		const response = await fetch(url, { headers: { authorization: `Bearer ${await getAccessToken()}` } });
+		if (!response.ok) throw new Error(`Personal connection list failed: HTTP ${response.status}`);
+		const { connections } = connectionsSchema.parse(await response.json());
+		if (connections.length === 0) throw new Error(`No personal ${requirement.toolkit} accounts. Run ctx connections add ${requirement.toolkit}.`);
+		if (connectionId === void 0) {
+			const selected = await select({
+				message: `Your ${requirement.toolkit} account for ${slug}`,
+				options: connections.map((connection) => ({
+					label: `${connection.display_name ?? connection.alias ?? connection.id} (${connection.id}; ${connection.status})`,
+					value: connection.id
+				})),
+				output: process.stderr
+			});
+			if (isCancel(selected)) {
+				process.exitCode = 130;
+				return;
+			}
+			connectionId = selected;
+		}
+		if (!connections.some(({ id }) => id === connectionId)) throw new Error(`Account ${connectionId} is not one of your ${requirement.toolkit} accounts`);
+		await saveLocalConnection(slug, connectionId);
+		console.log(`${slug} → ${connectionId}`);
+		return;
+	}
+	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(target)}/connections/assign`, env.CTX_PLATFORM_URL), {
+		body: JSON.stringify({
+			connection_id: connectionId,
+			slug
+		}),
+		headers: {
+			authorization: `Bearer ${await getAccessToken()}`,
+			"content-type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`Connection assignment failed: HTTP ${response.status}`);
+	const assignment = object({
+		connection_id: string(),
+		slug: string()
+	}).parse(await response.json());
+	console.log(`${assignment.slug} → ${assignment.connection_id}`);
+}
+async function listAppConnections(target) {
+	if (target === "local") {
+		const { connections } = await prepareLocalResourceConfiguration();
+		if (Object.keys(connections).length === 0) {
+			console.log("No connection requirements.");
+			return;
+		}
+		console.table(Object.entries(connections).map(([slug, { connection_id, consumers, mode, toolkit }]) => ({
+			connection: connection_id ?? "unassigned",
+			consumers: consumers.map((consumer) => consumer.type === "app" ? "app" : `agent:${consumer.name}`).join(", "),
+			mode,
+			slug,
+			toolkit
+		})));
+		return;
+	}
+	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(target)}/connections/list`, env.CTX_PLATFORM_URL), {
+		body: JSON.stringify({}),
+		headers: {
+			authorization: `Bearer ${await getAccessToken()}`,
+			"content-type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`App connections request failed: HTTP ${response.status}`);
+	const { connections } = appConnectionsSchema.parse(await response.json());
+	if (!connections.length) {
+		console.log("No connection requirements.");
+		return;
+	}
+	console.table(connections.map(({ connection_id, ...requirement }) => ({
+		...requirement,
+		connection: connection_id ?? "unassigned"
+	})));
+}
+async function addConnection(toolkit, org) {
+	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+	const owner = await resolveOwner(org, headers);
+	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), {
+		body: JSON.stringify({ toolkit }),
+		headers: {
+			...headers,
+			"content-type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`Connection authorization failed: HTTP ${response.status}`);
+	const { redirect_url } = object({ redirect_url: url() }).parse(await response.json());
+	console.log(`Open this link to authorize the Owner's account:\n${redirect_url}`);
+	console.log(`After authorization, run ctx connections${org ? ` --org ${org}` : ""} list to see the Owner's account.`);
+}
+async function listConnections(org) {
+	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+	const owner = await resolveOwner(org, headers);
+	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), { headers });
+	if (!response.ok) throw new Error(`Connection list failed: HTTP ${response.status}`);
+	const { connections } = connectionsSchema.parse(await response.json());
+	if (connections.length === 0) {
+		console.log("No connected accounts.");
+		return;
+	}
+	console.table(connections);
+}
+//#endregion
+//#region git-credential.ts
+async function setupGit(cli) {
+	const key = `credential.${new URL("/git", env.CTX_PLATFORM_URL).href}.helper`;
+	const command = [
+		process.execPath,
+		fileURLToPath(cli),
+		"git-credential"
+	].map((argument) => `'${argument.replaceAll("'", "'\\''")}'`).join(" ");
+	await execa("git", [
+		"config",
+		"--global",
+		"--replace-all",
+		key,
+		""
+	]);
+	await execa("git", [
+		"config",
+		"--global",
+		"--add",
+		key,
+		`!${command}`
+	]);
+}
+async function gitCredential(operation) {
+	if (operation === "capability") {
+		process.stdout.write("version 0\ncapability authtype\n");
+		return;
+	}
+	if (operation !== "get") return;
+	const attributes = new URLSearchParams();
+	const lines = createInterface({ input: process.stdin });
+	for await (const line of lines) {
+		if (line === "") break;
+		const separator = line.indexOf("=");
+		attributes.append(line.slice(0, separator), line.slice(separator + 1));
+	}
+	literal("authtype").parse(attributes.getAll("capability[]").find((c) => c === "authtype"));
+	process.stdout.write(`capability[]=authtype\nauthtype=Bearer\ncredential=${await getAccessToken()}\n\n`);
+}
+//#endregion
+//#region package.json
+var version = "0.14.3";
 //#endregion
 //#region secrets.ts
 const secretOptionsSchema = ownerOptionsSchema.extend({ stdin: boolean().default(false) });
@@ -3921,7 +4114,7 @@ async function dropSecret(name, org) {
 //#endregion
 //#region cli.ts
 const program = new Command().name("ctx").description("ContextLayer CLI").version(version);
-program.command("init <directory>").description("Create a Cloudflare React Router project with Tailwind and shadcn Base UI, register an app owned by you or an organization (ctx login), and set its immutable Git remote").option("--org <slug>", "Create the app under an organization you belong to").action(async (directory, options) => {
+program.command("init <directory>").description("Create a Cloudflare React Router project with Tailwind and shadcn Base UI, register and join a private app owned by you or an organization (ctx login), and set its immutable Git remote").option("--org <slug>", "Create the app under an organization you belong to").action(async (directory, options) => {
 	const input = object({ organization_slug: string().min(1).optional() }).parse({ organization_slug: options.org });
 	const accessToken = await getAccessToken();
 	const result = await execa("pnpm", [
@@ -4020,7 +4213,14 @@ program.command("login").description("Sign in by approving a browser code and co
 });
 program.command("git-credential <operation>").description("Git credential helper using the saved login; invoked automatically by Git").action(gitCredential);
 program.command("whoami").description("Show your ContextLayer user ID using the saved login").action(whoami);
-const connections = program.command("connections").description("Manage Owner-owned connected accounts or list an app's requirements").option("--org <org_slug>", "Manage this organization's connections; defaults to the signed-in user").argument("[target]", "AppID, public hostname, or local (run from the app root)").addArgument(new Argument("[operation]", "App connection operation").choices(["list"])).action(async (target, operation) => {
+program.command("join").argument("<target>", "AppID, public hostname, or local (run from the app root)").description("Join a private app you can view using ctx login, enabling member-scoped unattended work; returns app and user IDs").action(async (target) => {
+	await joinApp(union([
+		literal("local"),
+		uuid(),
+		hostname()
+	]).parse(target));
+});
+const connections = program.command("connections").description("Manage Owner-owned connected accounts or list app and agent connection requirements; local reads only the current folder and its saved development choices").option("--org <org_slug>", "Manage this organization's connections; defaults to the signed-in user").argument("[target]", "AppID or public hostname (pushed requirements), or local (current folder; no platform request)").addArgument(new Argument("[operation]", "App connection operation").choices(["list"])).action(async (target, operation) => {
 	if (!target || !operation) connections.error("Expected: ctx connections <target> list");
 	await listAppConnections(target);
 });
@@ -4031,8 +4231,13 @@ connections.command("add <toolkit>").description("Print a Composio authorization
 	const options = ownerOptionsSchema.parse(command.optsWithGlobals());
 	await addConnection(string().min(1).parse(toolkit), options.org);
 });
-program.command("connection").description("Assign a connection using the requirement’s viewer or owner mode; owner mode requires app management").argument("<target>", "AppID, public hostname, or local (run from the app root)").addArgument(new Argument("<operation>").choices(["assign"])).argument("<slug>", "Connection requirement slug").argument("<connection_id>", "Composio connected-account ID").action(async (target, _operation, slug, connectionId) => {
-	await assignAppConnection(target, slug, connectionId);
+program.command("connection").description("Bind a declared slug: local saves your personal account in .contextlayer/connections.json; AppID/hostname saves a hosted assignment under its declared Owner").argument("<target>", "AppID, public hostname, or local (run from the app root)").addArgument(new Argument("<operation>").choices(["assign"])).argument("<slug>", "Connection requirement slug").argument("[connection_id]", "Connected account ID; omit locally to choose your accounts for the declared toolkit; required for hosted targets").action(async (target, _operation, slug, connectionId) => {
+	const input = connectionAssignmentSchema.parse({
+		connection_id: connectionId,
+		slug,
+		target
+	});
+	await assignAppConnection(input.target, input.slug, input.connection_id);
 });
 program.command("agent").addArgument(new Argument("<target>", "Run from the app root").choices(["local"])).addArgument(new Argument("<operation>").choices(["run"])).argument("<name>", "Agent directory under agents/").argument("<prompt>", "Task to send as the user message").description("Run agents/<name>/instructions.md locally with Claude Agent SDK and native Claude authentication; no platform server or ctx login required").action(async (_target, _operation, name, prompt) => {
 	const input = object({