@usecontextlayer/cli 0.14.3 → 0.16.0

package/dist/auth.d.mts

@@ -0,0 +1,23 @@
+//#region env.d.ts
+declare const env: {
+  CTX_AUTH_CLIENT_ID: string;
+  CTX_AUTH_ISSUER: string;
+  CTX_PLATFORM_URL: string;
+};
+//#endregion
+//#region auth.d.ts
+type AuthEnv = Pick<typeof env, "CTX_AUTH_ISSUER" | "CTX_AUTH_CLIENT_ID">;
+export declare class LoginRequiredError extends Error {
+  constructor(reason: string, options?: ErrorOptions);
+}
+export declare function getAccessToken(env: AuthEnv): Promise<string>;
+export declare function getCurrentUser(env: AuthEnv, headers: HeadersInit): Promise<{
+  id: string;
+}>;
+export declare function listOrganizations(env: AuthEnv, headers: HeadersInit): Promise<{
+  id: string;
+  slug: string;
+}[]>;
+//#endregion
+export type { AuthEnv };
+//# sourceMappingURL=auth.d.mts.map

package/dist/auth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.mts","names":[],"sources":["../env.ts","../auth.ts"],"mappings":";cAMa;;;;;;;KCCD,UAAU,YAAY;qBAYrB,2BAA2B;EACvC,YAAY,gBAAgB,UAAU;;wBAiDjB,eAAe,KAAK,UAAO;wBAqC3B,eAAe,KAAK,SAAS,SAAS,cAAW;;;wBAOjD,kBAAkB,KAAK,SAAS,SAAS,cAAW"}

package/dist/auth.mjs

@@ -0,0 +1,2 @@
+import { i as listOrganizations, n as getAccessToken, r as getCurrentUser, t as LoginRequiredError } from "./auth-DOsE8GwJ.mjs";
+export { LoginRequiredError, getAccessToken, getCurrentUser, listOrganizations };

package/dist/cli.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
-import { C as unknown, E as execa, S as union, T as uuid, _ as literal, b as record, c as getCurrentUser, d as env, g as hostname, h as boolean, i as ownerSchema, l as login, m as array, n as saveLocalConnection, o as joinApp, p as secretNameSchema, r as appResourceConfigurationSchema, s as getAccessToken, t as prepareLocalResourceConfiguration, u as whoami, v as looseObject, w as url, x as string, y as object } from "./resources-DEdwfmku.mjs";
+import { t as __commonJSMin } from "./rolldown-runtime-EAsCxrDo.mjs";
+import { S as uuid, a as login, b as unknown, c as array, d as hostname, f as literal, g as record, h as object, i as listOrganizations, l as boolean, n as getAccessToken, p as looseObject, r as getCurrentUser, t as LoginRequiredError, v as string, x as url, y as union } from "./auth-DOsE8GwJ.mjs";
+import { a as env, c as resourcesForConsumer, f as execa, i as joinSlate, l as secretNameSchema, n as saveLocalConnection, o as slateResourceConfigurationSchema, s as ownerSchema, t as prepareLocalResourceConfiguration, u as databaseQuerySchema } from "./resources-B-EYHG1j.mjs";
 import { cp, readFile, writeFile } from "node:fs/promises";
 import path, { join } from "node:path";
 import { EventEmitter } from "node:events";
@@ -9,9 +11,6 @@ import process$1, { stdin, stdout } from "node:process";
 import { stripVTControlCharacters, styleText } from "node:util";
 import { fileURLToPath } from "node:url";
 import l__default, { createInterface } from "node:readline";
-//#region \0rolldown/runtime.js
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-//#endregion
 //#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 /**
 * CommanderError class
@@ -2968,13 +2967,40 @@ function useColor() {
 new Command();
 //#endregion
 //#region agents.ts
-const platformInstructions = "You are a ContextLayer app agent. The user message is the task for this run. Work in the app directory and return the task's result.";
+const platformInstructions = "You are an agent of a ContextLayer slate.The user message is the task for this run. Work in the checkout and return the task's result. Use database_query to read and save persistent data in declared databases. Files are scratch data; schema changes belong in explicitly authored SQL migrations.";
 async function runLocalAgent(name, prompt) {
 	const instructions = await readFile(join("agents", name, "instructions.md"), "utf8");
-	const { query } = await import("@anthropic-ai/claude-agent-sdk");
+	const { createServer } = await import("vite");
+	const { getPreparedLocalBindings, openLocalDatabases } = await import("./vite.mjs");
+	const server = await createServer({
+		logLevel: "error",
+		server: {
+			host: "127.0.0.1",
+			port: 0
+		}
+	});
+	await server.listen();
+	const bindings = getPreparedLocalBindings(server);
+	const configuration = resourcesForConsumer(bindings.configuration, {
+		name,
+		type: "agent"
+	});
+	const storage = await openLocalDatabases(bindings.workerName, configuration.databases);
+	const { query, createSdkMcpServer, tool } = await import("@anthropic-ai/claude-agent-sdk");
 	const run = query({
 		options: {
+			allowedTools: ["mcp__databases__database_query"],
 			cwd: process.cwd(),
+			mcpServers: { databases: createSdkMcpServer({
+				name: "databases",
+				tools: [tool("database_query", "Query or update a declared persistent SQLite database using parameterized SQL.", databaseQuerySchema.shape, async ({ slug, sql, params }) => {
+					const result = await storage.databases.query(slug, sql, params);
+					return { content: [{
+						text: JSON.stringify(result),
+						type: "text"
+					}] };
+				})]
+			}) },
 			settingSources: [],
 			systemPrompt: {
 				append: `${platformInstructions}\n\n${instructions}`,
@@ -3001,6 +3027,8 @@ async function runLocalAgent(name, prompt) {
 		throw new Error("Claude ended without a result");
 	} finally {
 		run.close();
+		await storage.dispose();
+		await server.close();
 	}
 }
 //#endregion
@@ -3852,34 +3880,28 @@ ${f}
 };
 `${styleText("gray", S_BAR)}`;
 //#endregion
-//#region ../shared/dist/app-connections.mjs
-const appConnectionSchema = appResourceConfigurationSchema.shape.connections.valueType.extend({ slug: string() });
-const appConnectionsSchema = object({ connections: array(appConnectionSchema) });
-//#endregion
 //#region ../shared/dist/connections.mjs
 const connectionSchema = object({
 	alias: string().nullable(),
 	display_name: string().nullable(),
 	id: string(),
-	status: string(),
+	status: literal("ACTIVE"),
 	toolkit: string()
 });
 const connectionsSchema = object({ connections: array(connectionSchema) });
 //#endregion
+//#region ../shared/dist/slate-connections.mjs
+const slateConnectionSchema = slateResourceConfigurationSchema.shape.connections.valueType.extend({ slug: string() });
+const slateConnectionsSchema = object({ connections: array(slateConnectionSchema) });
+//#endregion
 //#region owner.ts
 const ownerOptionsSchema = object({ org: string().min(1).optional() });
 async function resolveOwner(org, headers) {
 	if (!org) return {
-		id: (await getCurrentUser(headers)).id,
-		type: "user"
+		id: (await getCurrentUser(env, headers)).id,
+		type: "personal"
 	};
-	const response = await fetch(new URL("/api/platform/organizations", env.CTX_AUTH_ISSUER), { headers });
-	if (!response.ok) throw new Error(`Organization lookup failed: HTTP ${response.status}`);
-	const { organizations } = object({ organizations: array(object({
-		id: string().min(1),
-		slug: string()
-	})) }).parse(await response.json());
-	const organization = organizations.find((organization) => organization.slug === org);
+	const organization = (await listOrganizations(env, headers)).find((organization) => organization.slug === org);
 	if (!organization) throw new Error("Organization is not in your memberships");
 	return {
 		id: organization.id,
@@ -3887,7 +3909,7 @@ async function resolveOwner(org, headers) {
 	};
 }
 function ownerPath(owner) {
-	return `${owner.type === "organization" ? "org" : "user"}/${encodeURIComponent(owner.id)}`;
+	return `${owner.type === "organization" ? "org" : "personal"}/${encodeURIComponent(owner.id)}`;
 }
 //#endregion
 //#region connections.ts
@@ -3902,7 +3924,7 @@ const connectionAssignmentSchema = object({
 		path: ["connection_id"]
 	});
 });
-async function assignAppConnection(target, slug, connectionId) {
+async function assignSlateConnection(target, slug, connectionId) {
 	if (target === "local") {
 		const configuration = await prepareLocalResourceConfiguration();
 		const requirement = new Map(Object.entries(configuration.connections)).get(slug);
@@ -3910,37 +3932,38 @@ async function assignAppConnection(target, slug, connectionId) {
 		if (connectionId === void 0 && !process.stdin.isTTY) throw new Error("Supply a connection ID when assigning without a terminal");
 		const url = new URL("/api/connections", env.CTX_PLATFORM_URL);
 		url.searchParams.set("toolkit", requirement.toolkit);
-		const response = await fetch(url, { headers: { authorization: `Bearer ${await getAccessToken()}` } });
-		if (!response.ok) throw new Error(`Personal connection list failed: HTTP ${response.status}`);
+		const response = await fetch(url, { headers: { authorization: `Bearer ${await getAccessToken(env)}` } });
+		if (!response.ok) throw new Error(`Personal connected account list failed: HTTP ${response.status}`);
 		const { connections } = connectionsSchema.parse(await response.json());
-		if (connections.length === 0) throw new Error(`No personal ${requirement.toolkit} accounts. Run ctx connections add ${requirement.toolkit}.`);
+		if (connections.length === 0) throw new Error(`No personal connected accounts for ${requirement.toolkit}. Run npx @usecontextlayer/cli connections add ${requirement.toolkit} to connect an account in your browser, then rerun this assignment.`);
 		if (connectionId === void 0) {
-			const selected = await select({
-				message: `Your ${requirement.toolkit} account for ${slug}`,
+			const accountId = await select({
+				message: `Assign a connected ${requirement.toolkit} account to ${slug}`,
 				options: connections.map((connection) => ({
 					label: `${connection.display_name ?? connection.alias ?? connection.id} (${connection.id}; ${connection.status})`,
 					value: connection.id
 				})),
 				output: process.stderr
 			});
-			if (isCancel(selected)) {
+			if (isCancel(accountId)) {
 				process.exitCode = 130;
 				return;
 			}
-			connectionId = selected;
+			connectionId = accountId;
 		}
-		if (!connections.some(({ id }) => id === connectionId)) throw new Error(`Account ${connectionId} is not one of your ${requirement.toolkit} accounts`);
+		if (!connections.some(({ id }) => id === connectionId)) throw new Error(`Connected account ${connectionId} is not one of your connected ${requirement.toolkit} accounts`);
 		await saveLocalConnection(slug, connectionId);
 		console.log(`${slug} → ${connectionId}`);
+		console.log("Start or restart pnpm dev to use this assignment.");
 		return;
 	}
-	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(target)}/connections/assign`, env.CTX_PLATFORM_URL), {
+	const response = await fetch(new URL(`/api/slates/${encodeURIComponent(target)}/connections/assign`, env.CTX_PLATFORM_URL), {
 		body: JSON.stringify({
 			connection_id: connectionId,
 			slug
 		}),
 		headers: {
-			authorization: `Bearer ${await getAccessToken()}`,
+			authorization: `Bearer ${await getAccessToken(env)}`,
 			"content-type": "application/json"
 		},
 		method: "POST"
@@ -3952,7 +3975,7 @@ async function assignAppConnection(target, slug, connectionId) {
 	}).parse(await response.json());
 	console.log(`${assignment.slug} → ${assignment.connection_id}`);
 }
-async function listAppConnections(target) {
+async function listSlateConnections(target) {
 	if (target === "local") {
 		const { connections } = await prepareLocalResourceConfiguration();
 		if (Object.keys(connections).length === 0) {
@@ -3960,7 +3983,7 @@ async function listAppConnections(target) {
 			return;
 		}
 		console.table(Object.entries(connections).map(([slug, { connection_id, consumers, mode, toolkit }]) => ({
-			connection: connection_id ?? "unassigned",
+			connected_account: connection_id ?? "unassigned",
 			consumers: consumers.map((consumer) => consumer.type === "app" ? "app" : `agent:${consumer.name}`).join(", "),
 			mode,
 			slug,
@@ -3968,27 +3991,27 @@ async function listAppConnections(target) {
 		})));
 		return;
 	}
-	const response = await fetch(new URL(`/api/apps/${encodeURIComponent(target)}/connections/list`, env.CTX_PLATFORM_URL), {
+	const response = await fetch(new URL(`/api/slates/${encodeURIComponent(target)}/connections/list`, env.CTX_PLATFORM_URL), {
 		body: JSON.stringify({}),
 		headers: {
-			authorization: `Bearer ${await getAccessToken()}`,
+			authorization: `Bearer ${await getAccessToken(env)}`,
 			"content-type": "application/json"
 		},
 		method: "POST"
 	});
-	if (!response.ok) throw new Error(`App connections request failed: HTTP ${response.status}`);
-	const { connections } = appConnectionsSchema.parse(await response.json());
+	if (!response.ok) throw new Error(`Slate connections request failed: HTTP ${response.status}`);
+	const { connections } = slateConnectionsSchema.parse(await response.json());
 	if (!connections.length) {
 		console.log("No connection requirements.");
 		return;
 	}
 	console.table(connections.map(({ connection_id, ...requirement }) => ({
 		...requirement,
-		connection: connection_id ?? "unassigned"
+		connected_account: connection_id ?? "unassigned"
 	})));
 }
-async function addConnection(toolkit, org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+async function connectAccount(toolkit, org) {
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
 	const owner = await resolveOwner(org, headers);
 	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), {
 		body: JSON.stringify({ toolkit }),
@@ -3998,16 +4021,18 @@ async function addConnection(toolkit, org) {
 		},
 		method: "POST"
 	});
-	if (!response.ok) throw new Error(`Connection authorization failed: HTTP ${response.status}`);
+	if (!response.ok) throw new Error(`Connecting account failed: HTTP ${response.status}`);
 	const { redirect_url } = object({ redirect_url: url() }).parse(await response.json());
-	console.log(`Open this link to authorize the Owner's account:\n${redirect_url}`);
-	console.log(`After authorization, run ctx connections${org ? ` --org ${org}` : ""} list to see the Owner's account.`);
+	console.log(`Open this link to connect the Owner's account:\n${redirect_url}`);
+	console.log("After connecting in your browser, assign the connected account to a slate's declared connection.");
+	if (!org) console.log("From your checkout, assign your connected account to a connection declared in slate.json:\n  npx @usecontextlayer/cli connection local assign <slug>");
+	console.log(`For a hosted slate, get the connected account ID and assign it:\n  npx @usecontextlayer/cli connections${org ? ` --org '${org.replaceAll("'", "'\\''")}'` : ""} list\n  npx @usecontextlayer/cli connection <SlateID-or-hostname> assign <slug> <connection_id>`);
 }
 async function listConnections(org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
 	const owner = await resolveOwner(org, headers);
 	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), { headers });
-	if (!response.ok) throw new Error(`Connection list failed: HTTP ${response.status}`);
+	if (!response.ok) throw new Error(`Connected account list failed: HTTP ${response.status}`);
 	const { connections } = connectionsSchema.parse(await response.json());
 	if (connections.length === 0) {
 		console.log("No connected accounts.");
@@ -4017,7 +4042,7 @@ async function listConnections(org) {
 }
 //#endregion
 //#region git-credential.ts
-async function setupGit(cli) {
+async function configureGit(cli) {
 	const key = `credential.${new URL("/git", env.CTX_PLATFORM_URL).href}.helper`;
 	const command = [
 		process.execPath,
@@ -4053,11 +4078,11 @@ async function gitCredential(operation) {
 		attributes.append(line.slice(0, separator), line.slice(separator + 1));
 	}
 	literal("authtype").parse(attributes.getAll("capability[]").find((c) => c === "authtype"));
-	process.stdout.write(`capability[]=authtype\nauthtype=Bearer\ncredential=${await getAccessToken()}\n\n`);
+	process.stdout.write(`capability[]=authtype\nauthtype=Bearer\ncredential=${await getAccessToken(env)}\n\n`);
 }
 //#endregion
 //#region package.json
-var version = "0.14.3";
+var version = "0.16.0";
 //#endregion
 //#region secrets.ts
 const secretOptionsSchema = ownerOptionsSchema.extend({ stdin: boolean().default(false) });
@@ -4071,7 +4096,7 @@ async function resolveSecretUrl(name, org, headers) {
 	return new URL(`/api/secrets/${ownerPath(owner)}/${encodeURIComponent(name)}`, env.CTX_PLATFORM_URL);
 }
 async function setSecret(name, options) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
 	const url = await resolveSecretUrl(name, options.org, headers);
 	let value;
 	if (options.stdin) {
@@ -4103,7 +4128,7 @@ async function setSecret(name, options) {
 	console.log(JSON.stringify(confirmationSchema.parse(await response.json())));
 }
 async function dropSecret(name, org) {
-	const headers = { authorization: `Bearer ${await getAccessToken()}` };
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
 	const response = await fetch(await resolveSecretUrl(name, org, headers), {
 		headers,
 		method: "DELETE"
@@ -4114,9 +4139,31 @@ async function dropSecret(name, org) {
 //#endregion
 //#region cli.ts
 const program = new Command().name("ctx").description("ContextLayer CLI").version(version);
-program.command("init <directory>").description("Create a Cloudflare React Router project with Tailwind and shadcn Base UI, register and join a private app owned by you or an organization (ctx login), and set its immutable Git remote").option("--org <slug>", "Create the app under an organization you belong to").action(async (directory, options) => {
+program.addHelpText("afterAll", "\nRun without a global install: npx @usecontextlayer/cli <command>");
+async function authenticate(command) {
+	try {
+		return await getCurrentUser(env, { authorization: `Bearer ${await getAccessToken(env)}` });
+	} catch (error) {
+		if (error instanceof LoginRequiredError) command.error(error.message);
+		throw error;
+	}
+}
+async function requireLogin(command) {
+	await authenticate(command);
+}
+program.command("init <directory>").description("Create a private ContextLayer slate on main with React Router, Tailwind, and shadcn; requires login, Node.js 24+, pnpm, and Git author identity; sets the Git remote and prints how to start and deploy the slate").option("--org <slug>", "Create the slate under an organization you belong to").hook("preAction", requireLogin).action(async (directory, options) => {
 	const input = object({ organization_slug: string().min(1).optional() }).parse({ organization_slug: options.org });
-	const accessToken = await getAccessToken();
+	const accessToken = await getAccessToken(env);
+	const gitIdentity = await execa("git", ["var", "GIT_AUTHOR_IDENT"], {
+		reject: false,
+		stdio: [
+			"inherit",
+			"ignore",
+			"inherit"
+		]
+	});
+	process.exitCode = gitIdentity.exitCode;
+	if (gitIdentity.exitCode !== 0) return;
 	const result = await execa("pnpm", [
 		"create",
 		"cloudflare@latest",
@@ -4128,6 +4175,11 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 		"--",
 		"--yes"
 	], {
+		env: {
+			GIT_CONFIG_COUNT: "1",
+			GIT_CONFIG_KEY_0: "init.defaultBranch",
+			GIT_CONFIG_VALUE_0: "main"
+		},
 		reject: false,
 		stdio: "inherit"
 	});
@@ -4135,7 +4187,18 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 	if (result.exitCode !== 0) return;
 	const tsconfigPath = join(directory, "tsconfig.json");
 	const tsconfig = looseObject({ compilerOptions: record(string(), unknown()) }).parse(JSON.parse(await readFile(tsconfigPath, "utf8")));
-	tsconfig.compilerOptions.paths = { "~/*": ["./app/*"] };
+	tsconfig.compilerOptions.paths = {
+		"@/*": ["./*"],
+		"~/*": ["./app/*"]
+	};
+	const cloudflareTsconfigPath = join(directory, "tsconfig.cloudflare.json");
+	const cloudflareTsconfig = looseObject({
+		compilerOptions: record(string(), unknown()),
+		include: array(string())
+	}).parse(JSON.parse(await readFile(cloudflareTsconfigPath, "utf8")));
+	cloudflareTsconfig.compilerOptions.paths = tsconfig.compilerOptions.paths;
+	cloudflareTsconfig.include.push("databases/**/schema.ts");
+	await writeFile(cloudflareTsconfigPath, `${JSON.stringify(cloudflareTsconfig, null, 2)}\n`);
 	await writeFile(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}\n`);
 	const ui = await execa("pnpm", [
 		"dlx",
@@ -4172,7 +4235,8 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 	const install = await execa("pnpm", [
 		"add",
 		`@usecontextlayer/sdk@${version}`,
-		"zod@^4.4.3"
+		"zod@^4.4.3",
+		"drizzle-orm@0.45.3"
 	], {
 		cwd: directory,
 		reject: false,
@@ -4180,7 +4244,22 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 	});
 	process.exitCode = install.exitCode;
 	if (install.exitCode !== 0) return;
-	const response = await fetch(new URL("/api/apps", env.CTX_PLATFORM_URL), {
+	const migrationTool = await execa("pnpm", [
+		"add",
+		"-D",
+		"drizzle-kit@0.31.11"
+	], {
+		cwd: directory,
+		reject: false,
+		stdio: "inherit"
+	});
+	process.exitCode = migrationTool.exitCode;
+	if (migrationTool.exitCode !== 0) return;
+	const packagePath = join(directory, "package.json");
+	const checkoutPackage = looseObject({ scripts: record(string(), string()) }).parse(JSON.parse(await readFile(packagePath, "utf8")));
+	checkoutPackage.scripts["db:migration"] = "drizzle-kit generate --custom";
+	await writeFile(packagePath, `${JSON.stringify(checkoutPackage, null, 2)}\n`);
+	const response = await fetch(new URL("/api/slates", env.CTX_PLATFORM_URL), {
 		body: JSON.stringify(input),
 		headers: {
 			authorization: `Bearer ${accessToken}`,
@@ -4188,12 +4267,12 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 		},
 		method: "POST"
 	});
-	if (!response.ok) throw new Error(`App creation failed: HTTP ${response.status}`);
-	const app = object({
+	if (!response.ok) throw new Error(`Slate creation failed: HTTP ${response.status}`);
+	const slate = object({
 		id: uuid(),
 		public_hostname: hostname()
 	}).parse(await response.json());
-	const remote = new URL(`/git/${app.id}`, env.CTX_PLATFORM_URL);
+	const remote = new URL(`/git/${slate.id}`, env.CTX_PLATFORM_URL);
 	const git = await execa("git", [
 		"remote",
 		"add",
@@ -4205,41 +4284,65 @@ program.command("init <directory>").description("Create a Cloudflare React Route
 		stdio: "inherit"
 	});
 	process.exitCode = git.exitCode;
+	if (git.exitCode !== 0) return;
+	console.log(`
+ContextLayer slate created: ${slate.id}
+Dashboard: ${new URL(`/dashboard/slates/${slate.id}`, env.CTX_PLATFORM_URL).href}
+Hosted URL: https://${slate.public_hostname}/ (available after deployment)
+
+Start locally:
+  cd '${directory.replaceAll("'", "'\\''")}'
+  pnpm dev
+Open the local URL printed by the development server.
+
+Deploy your changes:
+  git add .
+  git commit
+  git push -u origin main
+
+See README.md for the development and connection workflow.
+`);
 });
 program.command("login").description("Sign in by approving a browser code and configure Git credentials for ContextLayer repositories").action(async () => {
-	await login();
-	await setupGit(new URL(import.meta.url));
+	await login(env);
+	await configureGit(new URL(import.meta.url));
 	console.log("Git credentials configured for ContextLayer.");
 });
-program.command("git-credential <operation>").description("Git credential helper using the saved login; invoked automatically by Git").action(gitCredential);
-program.command("whoami").description("Show your ContextLayer user ID using the saved login").action(whoami);
-program.command("join").argument("<target>", "AppID, public hostname, or local (run from the app root)").description("Join a private app you can view using ctx login, enabling member-scoped unattended work; returns app and user IDs").action(async (target) => {
-	await joinApp(union([
+program.command("git-credential <operation>").description("Git credential helper using the saved login; invoked automatically by Git").hook("preAction", async (command) => {
+	if (command.args[0] === "get") await requireLogin(command);
+}).action(gitCredential);
+program.command("whoami").description("Show your ContextLayer user ID verified by the auth server").action(async (_options, command) => {
+	console.log((await authenticate(command)).id);
+});
+program.command("join").argument("<target>", "SlateID, public hostname, or local (run from the checkout root)").description("Join a private slate you can view using ctx login, enabling member-scoped unattended work; returns slate and user IDs").hook("preAction", requireLogin).action(async (target) => {
+	await joinSlate(union([
 		literal("local"),
 		uuid(),
 		hostname()
 	]).parse(target));
 });
-const connections = program.command("connections").description("Manage Owner-owned connected accounts or list app and agent connection requirements; local reads only the current folder and its saved development choices").option("--org <org_slug>", "Manage this organization's connections; defaults to the signed-in user").argument("[target]", "AppID or public hostname (pushed requirements), or local (current folder; no platform request)").addArgument(new Argument("[operation]", "App connection operation").choices(["list"])).action(async (target, operation) => {
+const connections = program.command("connections").description("Manage Owner-owned connected accounts or list app and agent connections and assignments; local reads only the current checkout and its saved development assignments").option("--org <slug>", "Manage this organization's connected accounts; defaults to the signed-in user").argument("[target]", "SlateID or public hostname (pushed requirements), or local (current checkout; no platform request)").addArgument(new Argument("[operation]", "Slate connection operation").choices(["list"])).hook("preAction", async (command, actionCommand) => {
+	if (actionCommand !== command || command.args[0] !== "local") await requireLogin(actionCommand);
+}).action(async (target, operation) => {
 	if (!target || !operation) connections.error("Expected: ctx connections <target> list");
-	await listAppConnections(target);
+	await listSlateConnections(target);
 });
-connections.command("list").description("List the selected Owner's Composio accounts with their toolkit, identity, and status").action(async (_options, command) => {
+connections.command("list").description("List the selected Owner's connected accounts with their toolkit, identity, and status").action(async (_options, command) => {
 	await listConnections(ownerOptionsSchema.parse(command.optsWithGlobals()).org);
 });
-connections.command("add <toolkit>").description("Print a Composio authorization link for the selected Owner's account (for example, gmail)").action(async (toolkit, _options, command) => {
+connections.command("add <toolkit>").description("Connect the selected Owner's account in your browser (for example, gmail), then assign the connected account to a slate's declared connection with ctx connection").action(async (toolkit, _options, command) => {
 	const options = ownerOptionsSchema.parse(command.optsWithGlobals());
-	await addConnection(string().min(1).parse(toolkit), options.org);
+	await connectAccount(string().min(1).parse(toolkit), options.org);
 });
-program.command("connection").description("Bind a declared slug: local saves your personal account in .contextlayer/connections.json; AppID/hostname saves a hosted assignment under its declared Owner").argument("<target>", "AppID, public hostname, or local (run from the app root)").addArgument(new Argument("<operation>").choices(["assign"])).argument("<slug>", "Connection requirement slug").argument("[connection_id]", "Connected account ID; omit locally to choose your accounts for the declared toolkit; required for hosted targets").action(async (target, _operation, slug, connectionId) => {
+program.command("connection").description("Assign a connected account to a declared connection: local saves a personal connected account assignment in .contextlayer/connections.json; SlateID/hostname saves a hosted assignment under its declared Owner").argument("<target>", "SlateID, public hostname, or local (run from the checkout root)").addArgument(new Argument("<operation>").choices(["assign"])).argument("<slug>", "Connection slug declared in slate.json (for example, work-email)").argument("[connection_id]", "Connected account ID; omit locally to assign a connected account for the declared toolkit interactively; required for hosted targets").hook("preAction", requireLogin).action(async (target, _operation, slug, connectionId) => {
 	const input = connectionAssignmentSchema.parse({
 		connection_id: connectionId,
 		slug,
 		target
 	});
-	await assignAppConnection(input.target, input.slug, input.connection_id);
+	await assignSlateConnection(input.target, input.slug, input.connection_id);
 });
-program.command("agent").addArgument(new Argument("<target>", "Run from the app root").choices(["local"])).addArgument(new Argument("<operation>").choices(["run"])).argument("<name>", "Agent directory under agents/").argument("<prompt>", "Task to send as the user message").description("Run agents/<name>/instructions.md locally with Claude Agent SDK and native Claude authentication; no platform server or ctx login required").action(async (_target, _operation, name, prompt) => {
+program.command("agent").addArgument(new Argument("<target>", "Run from the checkout root").choices(["local"])).addArgument(new Argument("<operation>").choices(["run"])).argument("<name>", "Agent directory under agents/").argument("<prompt>", "Task to send as the user message").description("Run agents/<name>/instructions.md locally with Claude Agent SDK and native Claude authentication; Vite startup also requires ctx login when the app declares connections").action(async (_target, _operation, name, prompt) => {
 	const input = object({
 		name: string().min(1),
 		prompt: string().min(1)
@@ -4249,7 +4352,7 @@ program.command("agent").addArgument(new Argument("<target>", "Run from the app
 	});
 	console.log(await runLocalAgent(input.name, input.prompt));
 });
-const secrets = program.command("secrets").description("Save or drop Owner-owned shared secrets through the authenticated platform").option("--org <org_slug>", "Use this organization's Owner; defaults to the signed-in user");
+const secrets = program.command("secrets").description("Save or drop Owner-owned shared secrets through the authenticated platform").option("--org <slug>", "Use this organization's Owner; defaults to the signed-in user").hook("preAction", requireLogin);
 secrets.command("set").argument("<name>", "Secret name: uppercase letters, digits, and underscores; cannot start with a digit").description("Save a secret with a masked password prompt; returns only Owner and name").option("--stdin", "Read the exact UTF-8 value from stdin instead of prompting; preserves whitespace and newlines").action(async (name, _options, command) => {
 	await setSecret(secretNameSchema.parse(name), secretOptionsSchema.parse(command.optsWithGlobals()));
 });