@usecontextlayer/cli 0.14.2 → 0.15.0

package/dist/cli.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
-import { S as execa, _ as record, a as getAccessToken, b as url, c as whoami, d as boolean, f as discriminatedUnion, g as object, h as looseObject, i as secretNameSchema, l as env, m as literal, n as readLocalManifest, o as getCurrentUser, p as hostname, r as connectionRequirementSchema, s as login, t as getLocalAppId, u as array, v as string, x as uuid, y as unknown } from "./app-CJgT3IKd.mjs";
+import { t as __commonJSMin } from "./rolldown-runtime-EAsCxrDo.mjs";
+import { S as uuid, a as login, b as unknown, c as array, d as hostname, f as literal, g as record, h as object, i as listOrganizations, l as boolean, n as getAccessToken, p as looseObject, r as getCurrentUser, t as LoginRequiredError, v as string, x as url, y as union } from "./auth-CMrKVwsH.mjs";
+import { c as resourcesForConsumer, f as execa, i as ownerSchema, l as secretNameSchema, n as saveLocalConnection, o as joinApp, r as appResourceConfigurationSchema, s as env, t as prepareLocalResourceConfiguration, u as databaseQuerySchema } from "./resources-5FTDu19i.mjs";
 import { cp, readFile, writeFile } from "node:fs/promises";
 import path, { join } from "node:path";
 import { EventEmitter } from "node:events";
@@ -9,9 +11,6 @@ import process$1, { stdin, stdout } from "node:process";
 import { stripVTControlCharacters, styleText } from "node:util";
 import { fileURLToPath } from "node:url";
 import l__default, { createInterface } from "node:readline";
-//#region \0rolldown/runtime.js
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-//#endregion
 //#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 /**
 * CommanderError class
@@ -2968,13 +2967,40 @@ function useColor() {
 new Command();
 //#endregion
 //#region agents.ts
-const platformInstructions = "You are a ContextLayer app agent. The user message is the task for this run. Work in the app directory and return the task's result.";
+const platformInstructions = "You are a ContextLayer app agent. The user message is the task for this run. Work in the app directory and return the task's result. Use database_query to read and save persistent data in declared databases. Files are scratch data; schema changes belong in explicitly authored SQL migrations.";
 async function runLocalAgent(name, prompt) {
 	const instructions = await readFile(join("agents", name, "instructions.md"), "utf8");
-	const { query } = await import("@anthropic-ai/claude-agent-sdk");
+	const { createServer } = await import("vite");
+	const { getPreparedLocalBindings, openLocalDatabases } = await import("./vite.mjs");
+	const server = await createServer({
+		logLevel: "error",
+		server: {
+			host: "127.0.0.1",
+			port: 0
+		}
+	});
+	await server.listen();
+	const bindings = getPreparedLocalBindings(server);
+	const configuration = resourcesForConsumer(bindings.configuration, {
+		name,
+		type: "agent"
+	});
+	const storage = await openLocalDatabases(bindings.workerName, configuration.databases);
+	const { query, createSdkMcpServer, tool } = await import("@anthropic-ai/claude-agent-sdk");
 	const run = query({
 		options: {
+			allowedTools: ["mcp__databases__database_query"],
 			cwd: process.cwd(),
+			mcpServers: { databases: createSdkMcpServer({
+				name: "databases",
+				tools: [tool("database_query", "Query or update a declared persistent SQLite database using parameterized SQL.", databaseQuerySchema.shape, async ({ slug, sql, params }) => {
+					const result = await storage.databases.query(slug, sql, params);
+					return { content: [{
+						text: JSON.stringify(result),
+						type: "text"
+					}] };
+				})]
+			}) },
 			settingSources: [],
 			systemPrompt: {
 				append: `${platformInstructions}\n\n${instructions}`,
@@ -3001,169 +3027,11 @@ async function runLocalAgent(name, prompt) {
 		throw new Error("Claude ended without a result");
 	} finally {
 		run.close();
+		await storage.dispose();
+		await server.close();
 	}
 }
 //#endregion
-//#region ../shared/dist/app-connections.mjs
-const appConnectionSchema = connectionRequirementSchema.extend({
-	connection_id: string().nullable(),
-	slug: string()
-});
-const appConnectionsSchema = object({ connections: array(appConnectionSchema) });
-//#endregion
-//#region owner.ts
-const ownerOptionsSchema = object({ org: string().min(1).optional() });
-async function resolveOwner(org, headers) {
-	if (!org) return {
-		id: (await getCurrentUser(headers)).id,
-		type: "user"
-	};
-	const response = await fetch(new URL("/api/platform/organizations", env.CTX_AUTH_ISSUER), { headers });
-	if (!response.ok) throw new Error(`Organization lookup failed: HTTP ${response.status}`);
-	const { organizations } = object({ organizations: array(object({
-		id: string().min(1),
-		slug: string()
-	})) }).parse(await response.json());
-	const organization = organizations.find((organization) => organization.slug === org);
-	if (!organization) throw new Error("Organization is not in your memberships");
-	return {
-		id: organization.id,
-		type: "organization"
-	};
-}
-function ownerPath(owner) {
-	return `${owner.type === "organization" ? "org" : "user"}/${encodeURIComponent(owner.id)}`;
-}
-//#endregion
-//#region connections.ts
-async function getLocalManifest(target) {
-	return target === "local" ? readLocalManifest() : void 0;
-}
-async function resolveAppTarget(target) {
-	if (target !== "local") return target;
-	return getLocalAppId();
-}
-async function assignAppConnection(target, slug, connectionId) {
-	const appTarget = await resolveAppTarget(target);
-	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(appTarget)}/connections/assign`, env.CTX_PLATFORM_URL), {
-		body: JSON.stringify({
-			connection_id: connectionId,
-			manifest: await getLocalManifest(target),
-			slug
-		}),
-		headers: {
-			authorization: `Bearer ${await getAccessToken()}`,
-			"content-type": "application/json"
-		},
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`Connection assignment failed: HTTP ${response.status}`);
-	const assignment = object({
-		connection_id: string(),
-		slug: string()
-	}).parse(await response.json());
-	console.log(`${assignment.slug} → ${assignment.connection_id}`);
-}
-async function listAppConnections(target) {
-	const appTarget = await resolveAppTarget(target);
-	const manifest = await getLocalManifest(target);
-	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(appTarget)}/connections/list`, env.CTX_PLATFORM_URL), {
-		body: JSON.stringify({ manifest }),
-		headers: {
-			authorization: `Bearer ${await getAccessToken()}`,
-			"content-type": "application/json"
-		},
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`App connections request failed: HTTP ${response.status}`);
-	const { connections } = appConnectionsSchema.parse(await response.json());
-	if (!connections.length) {
-		console.log("No connection requirements.");
-		return;
-	}
-	console.table(connections.map(({ connection_id, ...requirement }) => ({
-		...requirement,
-		connection: connection_id ?? "unassigned"
-	})));
-}
-async function addConnection(toolkit, org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
-	const owner = await resolveOwner(org, headers);
-	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), {
-		body: JSON.stringify({ toolkit }),
-		headers: {
-			...headers,
-			"content-type": "application/json"
-		},
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`Connection authorization failed: HTTP ${response.status}`);
-	const { redirect_url } = object({ redirect_url: url() }).parse(await response.json());
-	console.log(`Open this link to authorize the Owner's account:\n${redirect_url}`);
-	console.log(`After authorization, run ctx connections${org ? ` --org ${org}` : ""} list to see the Owner's account.`);
-}
-async function listConnections(org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
-	const owner = await resolveOwner(org, headers);
-	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), { headers });
-	if (!response.ok) throw new Error(`Connection list failed: HTTP ${response.status}`);
-	const { connections } = object({ connections: array(object({
-		alias: string().nullable(),
-		display_name: string().nullable(),
-		id: string(),
-		status: string(),
-		toolkit: string()
-	})) }).parse(await response.json());
-	if (connections.length === 0) {
-		console.log("No connected accounts.");
-		return;
-	}
-	console.table(connections);
-}
-//#endregion
-//#region git-credential.ts
-async function setupGit(cli) {
-	const key = `credential.${new URL("/git", env.CTX_PLATFORM_URL).href}.helper`;
-	const command = [
-		process.execPath,
-		fileURLToPath(cli),
-		"git-credential"
-	].map((argument) => `'${argument.replaceAll("'", "'\\''")}'`).join(" ");
-	await execa("git", [
-		"config",
-		"--global",
-		"--replace-all",
-		key,
-		""
-	]);
-	await execa("git", [
-		"config",
-		"--global",
-		"--add",
-		key,
-		`!${command}`
-	]);
-}
-async function gitCredential(operation) {
-	if (operation === "capability") {
-		process.stdout.write("version 0\ncapability authtype\n");
-		return;
-	}
-	if (operation !== "get") return;
-	const attributes = new URLSearchParams();
-	const lines = createInterface({ input: process.stdin });
-	for await (const line of lines) {
-		if (line === "") break;
-		const separator = line.indexOf("=");
-		attributes.append(line.slice(0, separator), line.slice(separator + 1));
-	}
-	literal("authtype").parse(attributes.getAll("capability[]").find((c) => c === "authtype"));
-	process.stdout.write(`capability[]=authtype\nauthtype=Bearer\ncredential=${await getAccessToken()}\n\n`);
-}
-//#endregion
-//#region package.json
-var version = "0.14.2";
-//#endregion
 //#region ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 const getCodePointsLength = (() => {
 	const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
@@ -3499,6 +3367,11 @@ var import_src = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 		beep
 	};
 })))();
+function findCursor(s, o, l) {
+	if (!l.some((r) => !r.disabled)) return s;
+	const t = s + o, n = Math.max(l.length - 1, 0), e = t < 0 ? n : t > n ? 0 : t;
+	return l[e]?.disabled ? findCursor(e, o < 0 ? -1 : 1, l) : e;
+}
 const settings = {
 	actions: /* @__PURE__ */ new Set([
 		"up",
@@ -3580,7 +3453,19 @@ function setRawMode(e, r) {
 	const o = e;
 	o.isTTY && o.setRawMode(r);
 }
+const getColumns = (e) => "columns" in e && typeof e.columns == "number" ? e.columns : 80;
 const getRows = (e) => "rows" in e && typeof e.rows == "number" ? e.rows : 20;
+function wrapTextWithPrefix(e, r, o, n = o, s = o, t) {
+	return wrapAnsi(r, getColumns(e ?? stdout) - o.length, {
+		hard: true,
+		trim: false
+	}).split(`
+`).map((c, i, m) => {
+		const d = t ? t(c, i) : c;
+		return i === 0 ? `${n}${d}` : i === m.length - 1 ? `${s}${d}` : `${o}${d}`;
+	}).join(`
+`);
+}
 function runValidation(e, a) {
 	if ("~standard" in e) {
 		const n = e["~standard"].validate(a);
@@ -3797,6 +3682,32 @@ let u$1 = class u extends y {
 		});
 	}
 };
+let n$1 = class n extends y {
+	options;
+	cursor = 0;
+	get _selectedValue() {
+		return this.options[this.cursor];
+	}
+	changeValue() {
+		const e = this._selectedValue;
+		this.value = e === void 0 ? void 0 : e.value;
+	}
+	constructor(e) {
+		super(e, false), this.options = e.options;
+		const o = this.options.findIndex(({ value: s }) => s === e.initialValue), t = o === -1 ? 0 : o;
+		this.cursor = this.options[t]?.disabled ? findCursor(t, 1, this.options) : t, this.changeValue(), this.on("cursor", (s) => {
+			switch (s) {
+				case "left":
+				case "up":
+					this.cursor = findCursor(this.cursor, -1, this.options);
+					break;
+				case "down":
+				case "right": this.cursor = findCursor(this.cursor, 1, this.options);
+			}
+			this.changeValue();
+		});
+	}
+};
 //#endregion
 //#region ../../node_modules/.pnpm/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
 function isUnicodeSupported() {
@@ -3811,6 +3722,8 @@ const S_STEP_ERROR = unicodeOr("▲", "x");
 const S_STEP_SUBMIT = unicodeOr("◇", "o");
 const S_BAR = unicodeOr("│", "|");
 const S_BAR_END = unicodeOr("└", "—");
+const S_RADIO_ACTIVE = unicodeOr("●", ">");
+const S_RADIO_INACTIVE = unicodeOr("○", " ");
 const S_PASSWORD_MASK = unicodeOr("▪", "•");
 const symbol = (o) => {
 	switch (o) {
@@ -3822,6 +3735,63 @@ const symbol = (o) => {
 		case "validating": return styleText("dim", S_STEP_ACTIVE);
 	}
 };
+const symbolBar = (o) => {
+	switch (o) {
+		case "initial":
+		case "active": return styleText("cyan", S_BAR);
+		case "cancel": return styleText("red", S_BAR);
+		case "error": return styleText("yellow", S_BAR);
+		case "submit": return styleText("green", S_BAR);
+	}
+};
+function formatInstructionFooter(o, e) {
+	const r = [`${e ? `${styleText("cyan", S_BAR)}  ` : ""}${o.join(" • ")}`];
+	return e && r.push(styleText("cyan", S_BAR_END)), r;
+}
+const I = (l, e, w, p, b, C = false) => {
+	let r = e, O = 0;
+	if (C) for (let i = p - 1; i >= w; i--) {
+		const m = l[i];
+		if (m && (r -= m.length), O++, r <= b) break;
+	}
+	else for (let i = w; i < p; i++) {
+		const m = l[i];
+		if (m && (r -= m.length), O++, r <= b) break;
+	}
+	return {
+		lineCount: r,
+		removals: O
+	};
+};
+const limitOptions = ({ cursor: l, options: e, style: w, output: p = process.stdout, maxItems: b = Number.POSITIVE_INFINITY, columnPadding: C = 0, rowPadding: r = 4 }) => {
+	const i = getColumns(p) - C, m = getRows(p), M = styleText("dim", "..."), v = Math.max(m - r, 0), a = Math.max(Math.min(b, v), 5);
+	let f = 0;
+	l >= a - 3 && (f = Math.max(Math.min(l - a + 3, e.length - a), 0));
+	let d = a < e.length && f > 0, c = a < e.length && f + a < e.length;
+	const W = Math.min(f + a, e.length), s = [];
+	let g = 0;
+	d && g++, c && g++;
+	const T = f + (d ? 1 : 0), y = W - (c ? 1 : 0);
+	for (let t = T; t < y; t++) {
+		const n = e[t], h = wrapAnsi(n ? w(n, t === l) : "", i, {
+			hard: true,
+			trim: false
+		}).split(`
+`);
+		s.push(h), g += h.length;
+	}
+	if (g > v) {
+		let t = 0, n = 0, o = g;
+		const h = l - T;
+		let u = v;
+		const L = () => I(s, o, 0, h, u), E = () => I(s, o, h + 1, s.length, u, true);
+		d ? ({lineCount: o, removals: t} = L(), o > u && (c || (u -= 1), {lineCount: o, removals: n} = E())) : (c || (u -= 1), {lineCount: o, removals: n} = E(), o > u && (u -= 1, {lineCount: o, removals: t} = L())), t > 0 && (d = true, s.splice(0, t)), n > 0 && (c = true, s.splice(s.length - n, n));
+	}
+	const x = [];
+	d && x.push(M);
+	for (const t of s) for (const n of t) x.push(n);
+	return c && x.push(M), x;
+};
 `${styleText("dim", "↑/↓")}`, `${styleText("dim", "Space:")}`, `${styleText("dim", "Enter:")}`;
 const password = (e) => new u$1({
 	validate: e.validate,
@@ -3850,21 +3820,269 @@ ${r ? styleText("cyan", S_BAR_END) : ""}
 		}
 	}
 }).prompt();
-`${styleText("dim", "↑/↓")}`, `${styleText("dim", "Enter:")}`;
+const SELECT_INSTRUCTIONS = [`${styleText("dim", "↑/↓")} to navigate`, `${styleText("dim", "Enter:")} confirm`];
+const c = (t, o) => t.includes(`
+`) ? t.split(`
+`).map((d) => o(d)).join(`
+`) : o(t);
+const select = (t) => {
+	const o = (n, m) => {
+		if (n === void 0) return "";
+		const s = n.label ?? String(n.value);
+		switch (m) {
+			case "disabled": return `${styleText("gray", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("gray", i))}${n.hint ? ` ${styleText("dim", `(${n.hint ?? "disabled"})`)}` : ""}`;
+			case "selected": return `${c(s, (i) => styleText("dim", i))}`;
+			case "active": return `${styleText("green", S_RADIO_ACTIVE)} ${s}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+			case "cancelled": return `${c(s, (i) => styleText(["strikethrough", "dim"], i))}`;
+			default: return `${styleText("dim", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("dim", i))}`;
+		}
+	}, d = t.showInstructions ?? true;
+	return new n$1({
+		options: t.options,
+		signal: t.signal,
+		input: t.input,
+		output: t.output,
+		initialValue: t.initialValue,
+		render() {
+			const n = t.withGuide ?? settings.withGuide, m = `${symbol(this.state)}  `, s = `${symbolBar(this.state)}  `, i = wrapTextWithPrefix(t.output, t.message, s, m), u = `${n ? `${styleText("gray", S_BAR)}
+` : ""}${i}
+`;
+			switch (this.state) {
+				case "submit": {
+					const r = n ? `${styleText("gray", S_BAR)}  ` : "";
+					return `${u}${wrapTextWithPrefix(t.output, o(this.options[this.cursor], "selected"), r)}`;
+				}
+				case "cancel": {
+					const r = n ? `${styleText("gray", S_BAR)}  ` : "";
+					return `${u}${wrapTextWithPrefix(t.output, o(this.options[this.cursor], "cancelled"), r)}${n ? `
+${styleText("gray", S_BAR)}` : ""}`;
+				}
+				default: {
+					const r = n ? `${styleText("cyan", S_BAR)}  ` : "", a = u.split(`
+`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS, n) : n ? [styleText("cyan", S_BAR_END)] : [], f = p.join(`
+`), b = p.length + 1;
+					return `${u}${r}${limitOptions({
+						output: t.output,
+						cursor: this.cursor,
+						options: this.options,
+						maxItems: t.maxItems,
+						columnPadding: r.length,
+						rowPadding: a + b,
+						style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
+					}).join(`
+${r}`)}
+${f}
+`;
+				}
+			}
+		}
+	}).prompt();
+};
 `${styleText("gray", S_BAR)}`;
 //#endregion
-//#region ../shared/dist/app-usage.mjs
-const ownerSchema = discriminatedUnion("type", [object({
-	id: string().min(1),
-	type: literal("user")
-}), object({
-	id: string().min(1),
-	type: literal("organization")
-})]);
-object({
-	id: uuid(),
-	owner: ownerSchema
+//#region ../shared/dist/app-connections.mjs
+const appConnectionSchema = appResourceConfigurationSchema.shape.connections.valueType.extend({ slug: string() });
+const appConnectionsSchema = object({ connections: array(appConnectionSchema) });
+//#endregion
+//#region ../shared/dist/connections.mjs
+const connectionSchema = object({
+	alias: string().nullable(),
+	display_name: string().nullable(),
+	id: string(),
+	status: literal("ACTIVE"),
+	toolkit: string()
+});
+const connectionsSchema = object({ connections: array(connectionSchema) });
+//#endregion
+//#region owner.ts
+const ownerOptionsSchema = object({ org: string().min(1).optional() });
+async function resolveOwner(org, headers) {
+	if (!org) return {
+		id: (await getCurrentUser(env, headers)).id,
+		type: "user"
+	};
+	const organization = (await listOrganizations(env, headers)).find((organization) => organization.slug === org);
+	if (!organization) throw new Error("Organization is not in your memberships");
+	return {
+		id: organization.id,
+		type: "organization"
+	};
+}
+function ownerPath(owner) {
+	return `${owner.type === "organization" ? "org" : "user"}/${encodeURIComponent(owner.id)}`;
+}
+//#endregion
+//#region connections.ts
+const connectionAssignmentSchema = object({
+	connection_id: string().min(1).optional(),
+	slug: string().min(1),
+	target: string().min(1)
+}).superRefine((input, ctx) => {
+	if (input.target !== "local" && input.connection_id === void 0) ctx.addIssue({
+		code: "custom",
+		message: "Hosted assignment requires a connection ID",
+		path: ["connection_id"]
+	});
 });
+async function assignAppConnection(target, slug, connectionId) {
+	if (target === "local") {
+		const configuration = await prepareLocalResourceConfiguration();
+		const requirement = new Map(Object.entries(configuration.connections)).get(slug);
+		if (!requirement) throw new Error(`No local connection requirement for "${slug}"`);
+		if (connectionId === void 0 && !process.stdin.isTTY) throw new Error("Supply a connection ID when assigning without a terminal");
+		const url = new URL("/api/connections", env.CTX_PLATFORM_URL);
+		url.searchParams.set("toolkit", requirement.toolkit);
+		const response = await fetch(url, { headers: { authorization: `Bearer ${await getAccessToken(env)}` } });
+		if (!response.ok) throw new Error(`Personal connection list failed: HTTP ${response.status}`);
+		const { connections } = connectionsSchema.parse(await response.json());
+		if (connections.length === 0) throw new Error(`No personal ${requirement.toolkit} accounts. Run npx @usecontextlayer/cli connections add ${requirement.toolkit}, approve access in your browser, then rerun this assignment.`);
+		if (connectionId === void 0) {
+			const selected = await select({
+				message: `Your ${requirement.toolkit} account for ${slug}`,
+				options: connections.map((connection) => ({
+					label: `${connection.display_name ?? connection.alias ?? connection.id} (${connection.id}; ${connection.status})`,
+					value: connection.id
+				})),
+				output: process.stderr
+			});
+			if (isCancel(selected)) {
+				process.exitCode = 130;
+				return;
+			}
+			connectionId = selected;
+		}
+		if (!connections.some(({ id }) => id === connectionId)) throw new Error(`Account ${connectionId} is not one of your ${requirement.toolkit} accounts`);
+		await saveLocalConnection(slug, connectionId);
+		console.log(`${slug} → ${connectionId}`);
+		console.log("Start or restart pnpm dev to use this assignment.");
+		return;
+	}
+	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(target)}/connections/assign`, env.CTX_PLATFORM_URL), {
+		body: JSON.stringify({
+			connection_id: connectionId,
+			slug
+		}),
+		headers: {
+			authorization: `Bearer ${await getAccessToken(env)}`,
+			"content-type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`Connection assignment failed: HTTP ${response.status}`);
+	const assignment = object({
+		connection_id: string(),
+		slug: string()
+	}).parse(await response.json());
+	console.log(`${assignment.slug} → ${assignment.connection_id}`);
+}
+async function listAppConnections(target) {
+	if (target === "local") {
+		const { connections } = await prepareLocalResourceConfiguration();
+		if (Object.keys(connections).length === 0) {
+			console.log("No connection requirements.");
+			return;
+		}
+		console.table(Object.entries(connections).map(([slug, { connection_id, consumers, mode, toolkit }]) => ({
+			connection: connection_id ?? "unassigned",
+			consumers: consumers.map((consumer) => consumer.type === "app" ? "app" : `agent:${consumer.name}`).join(", "),
+			mode,
+			slug,
+			toolkit
+		})));
+		return;
+	}
+	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(target)}/connections/list`, env.CTX_PLATFORM_URL), {
+		body: JSON.stringify({}),
+		headers: {
+			authorization: `Bearer ${await getAccessToken(env)}`,
+			"content-type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`App connections request failed: HTTP ${response.status}`);
+	const { connections } = appConnectionsSchema.parse(await response.json());
+	if (!connections.length) {
+		console.log("No connection requirements.");
+		return;
+	}
+	console.table(connections.map(({ connection_id, ...requirement }) => ({
+		...requirement,
+		connection: connection_id ?? "unassigned"
+	})));
+}
+async function addConnection(toolkit, org) {
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
+	const owner = await resolveOwner(org, headers);
+	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), {
+		body: JSON.stringify({ toolkit }),
+		headers: {
+			...headers,
+			"content-type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`Connection authorization failed: HTTP ${response.status}`);
+	const { redirect_url } = object({ redirect_url: url() }).parse(await response.json());
+	console.log(`Open this link to authorize the Owner's account:\n${redirect_url}`);
+	console.log("After approving access in your browser, assign the account to an app's declared connection slug.");
+	if (!org) console.log("From your app directory, choose your account for a slug in public/slate.json:\n  npx @usecontextlayer/cli connection local assign <slug>");
+	console.log(`For a hosted app, get the account ID and assign it:\n  npx @usecontextlayer/cli connections${org ? ` --org '${org.replaceAll("'", "'\\''")}'` : ""} list\n  npx @usecontextlayer/cli connection <AppID-or-hostname> assign <slug> <connection_id>`);
+}
+async function listConnections(org) {
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
+	const owner = await resolveOwner(org, headers);
+	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), { headers });
+	if (!response.ok) throw new Error(`Connection list failed: HTTP ${response.status}`);
+	const { connections } = connectionsSchema.parse(await response.json());
+	if (connections.length === 0) {
+		console.log("No connected accounts.");
+		return;
+	}
+	console.table(connections);
+}
+//#endregion
+//#region git-credential.ts
+async function setupGit(cli) {
+	const key = `credential.${new URL("/git", env.CTX_PLATFORM_URL).href}.helper`;
+	const command = [
+		process.execPath,
+		fileURLToPath(cli),
+		"git-credential"
+	].map((argument) => `'${argument.replaceAll("'", "'\\''")}'`).join(" ");
+	await execa("git", [
+		"config",
+		"--global",
+		"--replace-all",
+		key,
+		""
+	]);
+	await execa("git", [
+		"config",
+		"--global",
+		"--add",
+		key,
+		`!${command}`
+	]);
+}
+async function gitCredential(operation) {
+	if (operation === "capability") {
+		process.stdout.write("version 0\ncapability authtype\n");
+		return;
+	}
+	if (operation !== "get") return;
+	const attributes = new URLSearchParams();
+	const lines = createInterface({ input: process.stdin });
+	for await (const line of lines) {
+		if (line === "") break;
+		const separator = line.indexOf("=");
+		attributes.append(line.slice(0, separator), line.slice(separator + 1));
+	}
+	literal("authtype").parse(attributes.getAll("capability[]").find((c) => c === "authtype"));
+	process.stdout.write(`capability[]=authtype\nauthtype=Bearer\ncredential=${await getAccessToken(env)}\n\n`);
+}
+//#endregion
+//#region package.json
+var version = "0.15.0";
 //#endregion
 //#region secrets.ts
 const secretOptionsSchema = ownerOptionsSchema.extend({ stdin: boolean().default(false) });
@@ -3878,7 +4096,7 @@ async function resolveSecretUrl(name, org, headers) {
 	return new URL(`/api/secrets/${ownerPath(owner)}/${encodeURIComponent(name)}`, env.CTX_PLATFORM_URL);
 }
 async function setSecret(name, options) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
 	const url = await resolveSecretUrl(name, options.org, headers);
 	let value;
 	if (options.stdin) {
@@ -3910,7 +4128,7 @@ async function setSecret(name, options) {
 	console.log(JSON.stringify(confirmationSchema.parse(await response.json())));
 }
 async function dropSecret(name, org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
 	const response = await fetch(await resolveSecretUrl(name, org, headers), {
 		headers,
 		method: "DELETE"
@@ -3921,9 +4139,31 @@ async function dropSecret(name, org) {
 //#endregion
 //#region cli.ts
 const program = new Command().name("ctx").description("ContextLayer CLI").version(version);
-program.command("init <directory>").description("Create a Cloudflare React Router project with Tailwind and shadcn Base UI, register an app owned by you or an organization (ctx login), and set its immutable Git remote").option("--org <slug>", "Create the app under an organization you belong to").action(async (directory, options) => {
+program.addHelpText("afterAll", "\nRun without a global install: npx @usecontextlayer/cli <command>");
+async function authenticate(command) {
+	try {
+		return await getCurrentUser(env, { authorization: `Bearer ${await getAccessToken(env)}` });
+	} catch (error) {
+		if (error instanceof LoginRequiredError) command.error(error.message);
+		throw error;
+	}
+}
+async function requireLogin(command) {
+	await authenticate(command);
+}
+program.command("init <directory>").description("Create a private ContextLayer app on main with React Router, Tailwind, and shadcn; requires login, Node.js 24+, pnpm, and Git author identity; sets the Git remote and prints how to start and publish the app").option("--org <slug>", "Create the app under an organization you belong to").hook("preAction", requireLogin).action(async (directory, options) => {
 	const input = object({ organization_slug: string().min(1).optional() }).parse({ organization_slug: options.org });
-	const accessToken = await getAccessToken();
+	const accessToken = await getAccessToken(env);
+	const gitIdentity = await execa("git", ["var", "GIT_AUTHOR_IDENT"], {
+		reject: false,
+		stdio: [
+			"inherit",
+			"ignore",
+			"inherit"
+		]
+	});
+	process.exitCode = gitIdentity.exitCode;
+	if (gitIdentity.exitCode !== 0) return;
 	const result = await execa("pnpm", [
 		"create",
 		"cloudflare@latest",
@@ -3935,6 +4175,11 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 		"--",
 		"--yes"
 	], {
+		env: {
+			GIT_CONFIG_COUNT: "1",
+			GIT_CONFIG_KEY_0: "init.defaultBranch",
+			GIT_CONFIG_VALUE_0: "main"
+		},
 		reject: false,
 		stdio: "inherit"
 	});
@@ -3942,7 +4187,18 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 	if (result.exitCode !== 0) return;
 	const tsconfigPath = join(directory, "tsconfig.json");
 	const tsconfig = looseObject({ compilerOptions: record(string(), unknown()) }).parse(JSON.parse(await readFile(tsconfigPath, "utf8")));
-	tsconfig.compilerOptions.paths = { "~/*": ["./app/*"] };
+	tsconfig.compilerOptions.paths = {
+		"@/*": ["./*"],
+		"~/*": ["./app/*"]
+	};
+	const cloudflareTsconfigPath = join(directory, "tsconfig.cloudflare.json");
+	const cloudflareTsconfig = looseObject({
+		compilerOptions: record(string(), unknown()),
+		include: array(string())
+	}).parse(JSON.parse(await readFile(cloudflareTsconfigPath, "utf8")));
+	cloudflareTsconfig.compilerOptions.paths = tsconfig.compilerOptions.paths;
+	cloudflareTsconfig.include.push("databases/**/schema.ts");
+	await writeFile(cloudflareTsconfigPath, `${JSON.stringify(cloudflareTsconfig, null, 2)}\n`);
 	await writeFile(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}\n`);
 	const ui = await execa("pnpm", [
 		"dlx",
@@ -3979,7 +4235,8 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 	const install = await execa("pnpm", [
 		"add",
 		`@usecontextlayer/sdk@${version}`,
-		"zod@^4.4.3"
+		"zod@^4.4.3",
+		"drizzle-orm@0.45.3"
 	], {
 		cwd: directory,
 		reject: false,
@@ -3987,6 +4244,21 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 	});
 	process.exitCode = install.exitCode;
 	if (install.exitCode !== 0) return;
+	const migrationTool = await execa("pnpm", [
+		"add",
+		"-D",
+		"drizzle-kit@0.31.11"
+	], {
+		cwd: directory,
+		reject: false,
+		stdio: "inherit"
+	});
+	process.exitCode = migrationTool.exitCode;
+	if (migrationTool.exitCode !== 0) return;
+	const packagePath = join(directory, "package.json");
+	const projectPackage = looseObject({ scripts: record(string(), string()) }).parse(JSON.parse(await readFile(packagePath, "utf8")));
+	projectPackage.scripts["db:migration"] = "drizzle-kit generate --custom";
+	await writeFile(packagePath, `${JSON.stringify(projectPackage, null, 2)}\n`);
 	const response = await fetch(new URL("/api/apps", env.CTX_PLATFORM_URL), {
 		body: JSON.stringify(input),
 		headers: {
@@ -4012,27 +4284,63 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 		stdio: "inherit"
 	});
 	process.exitCode = git.exitCode;
+	if (git.exitCode !== 0) return;
+	console.log(`
+ContextLayer app created: ${app.id}
+Dashboard: ${new URL(`/dashboard/apps/${app.id}`, env.CTX_PLATFORM_URL).href}
+Hosted URL: https://${app.public_hostname}/ (available after deployment)
+
+Start locally:
+  cd '${directory.replaceAll("'", "'\\''")}'
+  pnpm dev
+Open the local URL printed by the development server.
+
+Publish your changes:
+  git add .
+  git commit
+  git push -u origin main
+
+See README.md for the development and connection workflow.
+`);
 });
 program.command("login").description("Sign in by approving a browser code and configure Git credentials for ContextLayer repositories").action(async () => {
-	await login();
+	await login(env);
 	await setupGit(new URL(import.meta.url));
 	console.log("Git credentials configured for ContextLayer.");
 });
-program.command("git-credential <operation>").description("Git credential helper using the saved login; invoked automatically by Git").action(gitCredential);
-program.command("whoami").description("Show your ContextLayer user ID using the saved login").action(whoami);
-const connections = program.command("connections").description("Manage Owner-owned connected accounts or list an app's requirements").option("--org <org_slug>", "Manage this organization's connections; defaults to the signed-in user").argument("[target]", "AppID, public hostname, or local (run from the app root)").addArgument(new Argument("[operation]", "App connection operation").choices(["list"])).action(async (target, operation) => {
+program.command("git-credential <operation>").description("Git credential helper using the saved login; invoked automatically by Git").hook("preAction", async (command) => {
+	if (command.args[0] === "get") await requireLogin(command);
+}).action(gitCredential);
+program.command("whoami").description("Show your ContextLayer user ID verified by the auth server").action(async (_options, command) => {
+	console.log((await authenticate(command)).id);
+});
+program.command("join").argument("<target>", "AppID, public hostname, or local (run from the app root)").description("Join a private app you can view using ctx login, enabling member-scoped unattended work; returns app and user IDs").hook("preAction", requireLogin).action(async (target) => {
+	await joinApp(union([
+		literal("local"),
+		uuid(),
+		hostname()
+	]).parse(target));
+});
+const connections = program.command("connections").description("Manage Owner-owned connected accounts or list app and agent connection requirements; local reads only the current folder and its saved development choices").option("--org <org_slug>", "Manage this organization's connections; defaults to the signed-in user").argument("[target]", "AppID or public hostname (pushed requirements), or local (current folder; no platform request)").addArgument(new Argument("[operation]", "App connection operation").choices(["list"])).hook("preAction", async (command, actionCommand) => {
+	if (actionCommand !== command || command.args[0] !== "local") await requireLogin(actionCommand);
+}).action(async (target, operation) => {
 	if (!target || !operation) connections.error("Expected: ctx connections <target> list");
 	await listAppConnections(target);
 });
 connections.command("list").description("List the selected Owner's Composio accounts with their toolkit, identity, and status").action(async (_options, command) => {
 	await listConnections(ownerOptionsSchema.parse(command.optsWithGlobals()).org);
 });
-connections.command("add <toolkit>").description("Print a Composio authorization link for the selected Owner's account (for example, gmail)").action(async (toolkit, _options, command) => {
+connections.command("add <toolkit>").description("Authorize the selected Owner's account in your browser (for example, gmail), then assign it to an app's declared connection slug with ctx connection").action(async (toolkit, _options, command) => {
 	const options = ownerOptionsSchema.parse(command.optsWithGlobals());
 	await addConnection(string().min(1).parse(toolkit), options.org);
 });
-program.command("connection").description("Assign a connection using the requirement’s viewer or owner mode; owner mode requires app management").argument("<target>", "AppID, public hostname, or local (run from the app root)").addArgument(new Argument("<operation>").choices(["assign"])).argument("<slug>", "Connection requirement slug").argument("<connection_id>", "Composio connected-account ID").action(async (target, _operation, slug, connectionId) => {
-	await assignAppConnection(target, slug, connectionId);
+program.command("connection").description("Bind a declared slug: local saves your personal account in .contextlayer/connections.json; AppID/hostname saves a hosted assignment under its declared Owner").argument("<target>", "AppID, public hostname, or local (run from the app root)").addArgument(new Argument("<operation>").choices(["assign"])).argument("<slug>", "Connection slug declared in your Slate (for example, work-email)").argument("[connection_id]", "Connected account ID; omit locally to choose your accounts for the declared toolkit; required for hosted targets").hook("preAction", requireLogin).action(async (target, _operation, slug, connectionId) => {
+	const input = connectionAssignmentSchema.parse({
+		connection_id: connectionId,
+		slug,
+		target
+	});
+	await assignAppConnection(input.target, input.slug, input.connection_id);
 });
 program.command("agent").addArgument(new Argument("<target>", "Run from the app root").choices(["local"])).addArgument(new Argument("<operation>").choices(["run"])).argument("<name>", "Agent directory under agents/").argument("<prompt>", "Task to send as the user message").description("Run agents/<name>/instructions.md locally with Claude Agent SDK and native Claude authentication; no platform server or ctx login required").action(async (_target, _operation, name, prompt) => {
 	const input = object({
@@ -4044,7 +4352,7 @@ program.command("agent").addArgument(new Argument("<target>", "Run from the app
 	});
 	console.log(await runLocalAgent(input.name, input.prompt));
 });
-const secrets = program.command("secrets").description("Save or drop Owner-owned shared secrets through the authenticated platform").option("--org <org_slug>", "Use this organization's Owner; defaults to the signed-in user");
+const secrets = program.command("secrets").description("Save or drop Owner-owned shared secrets through the authenticated platform").option("--org <org_slug>", "Use this organization's Owner; defaults to the signed-in user").hook("preAction", requireLogin);
 secrets.command("set").argument("<name>", "Secret name: uppercase letters, digits, and underscores; cannot start with a digit").description("Save a secret with a masked password prompt; returns only Owner and name").option("--stdin", "Read the exact UTF-8 value from stdin instead of prompting; preserves whitespace and newlines").action(async (name, _options, command) => {
 	await setSecret(secretNameSchema.parse(name), secretOptionsSchema.parse(command.optsWithGlobals()));
 });