@usecontextlayer/cli 0.16.1 → 0.17.0

package/dist/cli.mjs

@@ -1,16 +1,21 @@
 #!/usr/bin/env node
-import { t as __commonJSMin } from "./rolldown-runtime-EAsCxrDo.mjs";
-import { S as uuid, a as login, b as unknown, c as array, d as hostname, f as literal, g as record, h as object, i as listOrganizations, l as boolean, n as getAccessToken, p as looseObject, r as getCurrentUser, t as LoginRequiredError, v as string, x as url, y as union } from "./auth-DOsE8GwJ.mjs";
-import { a as env, c as resourcesForConsumer, f as execa, i as joinSlate, l as secretNameSchema, n as saveLocalConnection, o as slateResourceConfigurationSchema, s as ownerSchema, t as prepareLocalResourceConfiguration, u as databaseQuerySchema } from "./resources-B-EYHG1j.mjs";
-import { cp, readFile, writeFile } from "node:fs/promises";
-import path, { join } from "node:path";
+import { a as login, i as listOrganizations, n as getAccessToken, r as getCurrentUser, t as LoginRequiredError } from "./auth-BL9AxZGb.mjs";
+import { a as boolean, c as literal, g as uuid, h as url, i as array, o as discriminatedUnion, p as string, r as _undefined, s as hostname, u as object } from "./schemas-D9UReYiT.mjs";
+import { a as databaseSlugSchema, l as secretNameSchema, n as env, s as resourcesForConsumer } from "./env-C_tllJ4u.mjs";
+import { a as noCommitSchema, c as execa, n as prepareLocalResourceConfiguration, o as slateResourceConfigurationSchema, r as saveLocalConnection, s as ownerSchema } from "./resources-BhJbHzU0.mjs";
+import { t as databaseQuerySchema } from "./databases-SvX3IgqC.mjs";
+import { readFile } from "node:fs/promises";
+import path, { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { EventEmitter } from "node:events";
 import childProcess from "node:child_process";
 import fs from "node:fs";
 import process$1, { stdin, stdout } from "node:process";
 import { stripVTControlCharacters, styleText } from "node:util";
-import { fileURLToPath } from "node:url";
 import l__default, { createInterface } from "node:readline";
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+//#endregion
 //#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 /**
 * CommanderError class
@@ -2966,12 +2971,72 @@ function useColor() {
 }
 new Command();
 //#endregion
+//#region ../shared/dist/connections.mjs
+const connectionSchema = object({
+	alias: string().nullable(),
+	display_name: string().nullable(),
+	id: string(),
+	status: literal("ACTIVE"),
+	toolkit: string()
+});
+const connectionsSchema = object({ connections: array(connectionSchema) });
+//#endregion
+//#region owner.ts
+const ownerOptionsSchema = object({ org: string().min(1).optional() });
+async function resolveOwner(org, headers) {
+	if (!org) return {
+		id: (await getCurrentUser(env, headers)).id,
+		type: "personal"
+	};
+	const organization = (await listOrganizations(env, headers)).find((organization) => organization.slug === org);
+	if (!organization) throw new Error("Organization is not in your memberships");
+	return {
+		id: organization.id,
+		type: "organization"
+	};
+}
+function ownerPath(owner) {
+	return `${owner.type === "organization" ? "org" : "personal"}/${encodeURIComponent(owner.id)}`;
+}
+//#endregion
+//#region accounts.ts
+async function connectAccount(toolkit, org) {
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
+	const owner = await resolveOwner(org, headers);
+	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), {
+		body: JSON.stringify({ toolkit }),
+		headers: {
+			...headers,
+			"content-type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`Connecting account failed: HTTP ${response.status}`);
+	const { redirect_url } = object({ redirect_url: url() }).parse(await response.json());
+	console.log(`Open this link to connect the Owner's account:\n${redirect_url}`);
+	console.log("After connecting in your browser, assign the connected account to a slate's declared connection.");
+	if (!org) console.log("From your checkout, assign your connected account to a connection declared in slate.json:\n  npx @usecontextlayer/cli connections local assign <slug>");
+	console.log(`For a hosted slate, get the connected account ID and assign it:\n  npx @usecontextlayer/cli accounts${org ? ` --org '${org.replaceAll("'", "'\\''")}'` : ""} list\n  npx @usecontextlayer/cli connections <SlateID-or-hostname> assign <slug> <connection_id>`);
+}
+async function listAccounts(org) {
+	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
+	const owner = await resolveOwner(org, headers);
+	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), { headers });
+	if (!response.ok) throw new Error(`Connected account list failed: HTTP ${response.status}`);
+	const { connections } = connectionsSchema.parse(await response.json());
+	if (connections.length === 0) {
+		console.log("No connected accounts.");
+		return;
+	}
+	console.table(connections);
+}
+//#endregion
 //#region agents.ts
-const platformInstructions = "You are an agent of a ContextLayer slate.The user message is the task for this run. Work in the checkout and return the task's result. Use database_query to read and save persistent data in declared databases. Files are scratch data; schema changes belong in explicitly authored SQL migrations.";
+const platformInstructions = "You are an agent of a ContextLayer slate. The user message is the task for this run. Work in the checkout and return the task's result. Use database_query to read and save persistent data in declared databases. Files are scratch data; schema changes belong in explicitly authored Kysely migrations.";
 async function runLocalAgent(name, prompt) {
 	const instructions = await readFile(join("agents", name, "instructions.md"), "utf8");
 	const { createServer } = await import("vite");
-	const { getPreparedLocalBindings, openLocalDatabases } = await import("./vite.mjs");
+	const { getPreparedLocalBindings } = await import("./vite.mjs");
 	const server = await createServer({
 		logLevel: "error",
 		server: {
@@ -2985,6 +3050,7 @@ async function runLocalAgent(name, prompt) {
 		name,
 		type: "agent"
 	});
+	const { openLocalDatabases } = await import("./local-databases-ChvVgJH6.mjs");
 	const storage = await openLocalDatabases(bindings.workerName, configuration.databases);
 	const { query, createSdkMcpServer, tool } = await import("@anthropic-ai/claude-agent-sdk");
 	const run = query({
@@ -3880,41 +3946,19 @@ ${f}
 };
 `${styleText("gray", S_BAR)}`;
 //#endregion
-//#region ../shared/dist/connections.mjs
-const connectionSchema = object({
-	alias: string().nullable(),
-	display_name: string().nullable(),
-	id: string(),
-	status: literal("ACTIVE"),
-	toolkit: string()
-});
-const connectionsSchema = object({ connections: array(connectionSchema) });
-//#endregion
 //#region ../shared/dist/slate-connections.mjs
 const slateConnectionSchema = slateResourceConfigurationSchema.shape.connections.valueType.extend({ slug: string() });
 const slateConnectionsSchema = object({ connections: array(slateConnectionSchema) });
 //#endregion
-//#region owner.ts
-const ownerOptionsSchema = object({ org: string().min(1).optional() });
-async function resolveOwner(org, headers) {
-	if (!org) return {
-		id: (await getCurrentUser(env, headers)).id,
-		type: "personal"
-	};
-	const organization = (await listOrganizations(env, headers)).find((organization) => organization.slug === org);
-	if (!organization) throw new Error("Organization is not in your memberships");
-	return {
-		id: organization.id,
-		type: "organization"
-	};
-}
-function ownerPath(owner) {
-	return `${owner.type === "organization" ? "org" : "personal"}/${encodeURIComponent(owner.id)}`;
-}
-//#endregion
 //#region connections.ts
-const connectionAssignmentSchema = object({
+const connectionsCommandSchema = discriminatedUnion("operation", [object({
+	connection_id: _undefined(),
+	operation: literal("list"),
+	slug: _undefined(),
+	target: string().min(1)
+}), object({
 	connection_id: string().min(1).optional(),
+	operation: literal("assign"),
 	slug: string().min(1),
 	target: string().min(1)
 }).superRefine((input, ctx) => {
@@ -3923,7 +3967,7 @@ const connectionAssignmentSchema = object({
 		message: "Hosted assignment requires a connection ID",
 		path: ["connection_id"]
 	});
-});
+})]);
 async function assignSlateConnection(target, slug, connectionId) {
 	if (target === "local") {
 		const configuration = await prepareLocalResourceConfiguration();
@@ -3935,7 +3979,7 @@ async function assignSlateConnection(target, slug, connectionId) {
 		const response = await fetch(url, { headers: { authorization: `Bearer ${await getAccessToken(env)}` } });
 		if (!response.ok) throw new Error(`Personal connected account list failed: HTTP ${response.status}`);
 		const { connections } = connectionsSchema.parse(await response.json());
-		if (connections.length === 0) throw new Error(`No personal connected accounts for ${requirement.toolkit}. Run npx @usecontextlayer/cli connections add ${requirement.toolkit} to connect an account in your browser, then rerun this assignment.`);
+		if (connections.length === 0) throw new Error(`No personal connected accounts for ${requirement.toolkit}. Run npx @usecontextlayer/cli accounts add ${requirement.toolkit} to connect an account in your browser, then rerun this assignment.`);
 		if (connectionId === void 0) {
 			const accountId = await select({
 				message: `Assign a connected ${requirement.toolkit} account to ${slug}`,
@@ -3968,6 +4012,7 @@ async function assignSlateConnection(target, slug, connectionId) {
 		},
 		method: "POST"
 	});
+	if (response.status === 409 && noCommitSchema.safeParse(await response.json()).success) throw new Error("Nothing has been pushed to this slate yet. Push to main before configuring hosted resources.");
 	if (!response.ok) throw new Error(`Connection assignment failed: HTTP ${response.status}`);
 	const assignment = object({
 		connection_id: string(),
@@ -3975,21 +4020,13 @@ async function assignSlateConnection(target, slug, connectionId) {
 	}).parse(await response.json());
 	console.log(`${assignment.slug} → ${assignment.connection_id}`);
 }
-async function listSlateConnections(target) {
+async function prepareSlateConnections(target) {
 	if (target === "local") {
 		const { connections } = await prepareLocalResourceConfiguration();
-		if (Object.keys(connections).length === 0) {
-			console.log("No connection requirements.");
-			return;
-		}
-		console.table(Object.entries(connections).map(([slug, { connection_id, consumers, mode, toolkit }]) => ({
-			connected_account: connection_id ?? "unassigned",
-			consumers: consumers.map((consumer) => consumer.type === "app" ? "app" : `agent:${consumer.name}`).join(", "),
-			mode,
-			slug,
-			toolkit
-		})));
-		return;
+		return Object.entries(connections).map(([slug, connection]) => ({
+			...connection,
+			slug
+		}));
 	}
 	const response = await fetch(new URL(`/api/slates/${encodeURIComponent(target)}/connections/list`, env.CTX_PLATFORM_URL), {
 		body: JSON.stringify({}),
@@ -3999,47 +4036,22 @@ async function listSlateConnections(target) {
 		},
 		method: "POST"
 	});
+	if (response.status === 409 && noCommitSchema.safeParse(await response.json()).success) throw new Error("Nothing has been pushed to this slate yet. Push to main before configuring hosted resources.");
 	if (!response.ok) throw new Error(`Slate connections request failed: HTTP ${response.status}`);
-	const { connections } = slateConnectionsSchema.parse(await response.json());
+	return slateConnectionsSchema.parse(await response.json()).connections;
+}
+async function listSlateConnections(target) {
+	const connections = await prepareSlateConnections(target);
 	if (!connections.length) {
 		console.log("No connection requirements.");
 		return;
 	}
-	console.table(connections.map(({ connection_id, ...requirement }) => ({
+	console.table(connections.map(({ connection_id, consumers, ...requirement }) => ({
 		...requirement,
-		connected_account: connection_id ?? "unassigned"
+		connected_account: connection_id ?? "unassigned",
+		consumers: consumers.map((consumer) => consumer.type === "app" ? "app" : `agent:${consumer.name}`).join(", ")
 	})));
 }
-async function connectAccount(toolkit, org) {
-	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
-	const owner = await resolveOwner(org, headers);
-	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), {
-		body: JSON.stringify({ toolkit }),
-		headers: {
-			...headers,
-			"content-type": "application/json"
-		},
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`Connecting account failed: HTTP ${response.status}`);
-	const { redirect_url } = object({ redirect_url: url() }).parse(await response.json());
-	console.log(`Open this link to connect the Owner's account:\n${redirect_url}`);
-	console.log("After connecting in your browser, assign the connected account to a slate's declared connection.");
-	if (!org) console.log("From your checkout, assign your connected account to a connection declared in slate.json:\n  npx @usecontextlayer/cli connection local assign <slug>");
-	console.log(`For a hosted slate, get the connected account ID and assign it:\n  npx @usecontextlayer/cli connections${org ? ` --org '${org.replaceAll("'", "'\\''")}'` : ""} list\n  npx @usecontextlayer/cli connection <SlateID-or-hostname> assign <slug> <connection_id>`);
-}
-async function listConnections(org) {
-	const headers = { authorization: `Bearer ${await getAccessToken(env)}` };
-	const owner = await resolveOwner(org, headers);
-	const response = await fetch(new URL(`/api/connections/${ownerPath(owner)}`, env.CTX_PLATFORM_URL), { headers });
-	if (!response.ok) throw new Error(`Connected account list failed: HTTP ${response.status}`);
-	const { connections } = connectionsSchema.parse(await response.json());
-	if (connections.length === 0) {
-		console.log("No connected accounts.");
-		return;
-	}
-	console.table(connections);
-}
 //#endregion
 //#region git-credential.ts
 async function configureGit(cli) {
@@ -4082,7 +4094,7 @@ async function gitCredential(operation) {
 }
 //#endregion
 //#region package.json
-var version = "0.16.1";
+var version = "0.17.0";
 //#endregion
 //#region secrets.ts
 const secretOptionsSchema = ownerOptionsSchema.extend({ stdin: boolean().default(false) });
@@ -4139,19 +4151,29 @@ async function dropSecret(name, org) {
 //#endregion
 //#region cli.ts
 const program = new Command().name("ctx").description("ContextLayer CLI").version(version);
-program.addHelpText("afterAll", "\nRun without a global install: npx @usecontextlayer/cli <command>");
+program.addHelpText("afterAll", `\nEnvironment (current values):\n  CTX_PLATFORM_URL    ${env.CTX_PLATFORM_URL}\n  CTX_AUTH_ISSUER     ${env.CTX_AUTH_ISSUER}\n  CTX_AUTH_CLIENT_ID  ${env.CTX_AUTH_CLIENT_ID}\n  CTX_CONFIG_DIR      ${env.CTX_CONFIG_DIR}  Saved-login directory; one login per directory.\n\nRun without a global install: npx @usecontextlayer/cli <command>`);
 async function authenticate(command) {
 	try {
 		return await getCurrentUser(env, { authorization: `Bearer ${await getAccessToken(env)}` });
 	} catch (error) {
-		if (error instanceof LoginRequiredError) command.error(error.message);
+		if (error instanceof LoginRequiredError) {
+			const lines = [error.message];
+			if (error.mismatch) {
+				const { saved, expected } = error.mismatch;
+				lines.push(`Saved issuer: ${saved.issuer}`, `Expected issuer: ${expected.issuer}`);
+				if (saved.clientId !== expected.clientId) lines.push(`Saved client ID: ${saved.clientId}`, `Expected client ID: ${expected.clientId}`);
+			}
+			const settings = Object.entries(env).map(([key, value]) => `${key}='${value.replaceAll("'", "'\\''")}'`).join(" ");
+			lines.push(`Run: ${settings} npx @usecontextlayer/cli login`);
+			command.error(lines.join("\n"));
+		}
 		throw error;
 	}
 }
 async function requireLogin(command) {
 	await authenticate(command);
 }
-program.command("init <directory>").description("Create a private ContextLayer slate on main with React Router, Tailwind, and shadcn; requires login, Node.js 24+, pnpm, and Git author identity; sets the Git remote and prints how to start and deploy the slate").option("--org <slug>", "Create the slate under an organization you belong to").hook("preAction", requireLogin).action(async (directory, options) => {
+program.command("init <directory>").description("Create a private ContextLayer slate on main with React Router, Tailwind, and shadcn; requires login, Node.js 22.22.0+, pnpm, and Git author identity; sets the Git remote and prints how to start and deploy the slate").option("--org <slug>", "Create the slate under an organization you belong to").hook("preAction", requireLogin).action(async (directory, options) => {
 	const input = object({ organization_slug: string().min(1).optional() }).parse({ organization_slug: options.org });
 	const accessToken = await getAccessToken(env);
 	const gitIdentity = await execa("git", ["var", "GIT_AUTHOR_IDENT"], {
@@ -4164,15 +4186,15 @@ program.command("init <directory>").description("Create a private ContextLayer s
 	});
 	process.exitCode = gitIdentity.exitCode;
 	if (gitIdentity.exitCode !== 0) return;
-	const result = await execa("pnpm", [
-		"create",
-		"cloudflare@latest",
+	const result = await execa(process.execPath, [
+		fileURLToPath(new URL("./dist/cli.js", import.meta.resolve("create-react-router/package.json"))),
 		directory,
-		"--framework=react-router",
-		"--accept-defaults",
-		"--git",
-		"--no-deploy",
-		"--",
+		"--template",
+		fileURLToPath(new URL("./template.tar.gz", import.meta.url)),
+		"--package-manager",
+		"pnpm",
+		"--install",
+		"--git-init",
 		"--yes"
 	], {
 		env: {
@@ -4185,80 +4207,6 @@ program.command("init <directory>").description("Create a private ContextLayer s
 	});
 	process.exitCode = result.exitCode;
 	if (result.exitCode !== 0) return;
-	const tsconfigPath = join(directory, "tsconfig.json");
-	const tsconfig = looseObject({ compilerOptions: record(string(), unknown()) }).parse(JSON.parse(await readFile(tsconfigPath, "utf8")));
-	tsconfig.compilerOptions.paths = {
-		"@/*": ["./*"],
-		"~/*": ["./app/*"]
-	};
-	const cloudflareTsconfigPath = join(directory, "tsconfig.cloudflare.json");
-	const cloudflareTsconfig = looseObject({
-		compilerOptions: record(string(), unknown()),
-		include: array(string())
-	}).parse(JSON.parse(await readFile(cloudflareTsconfigPath, "utf8")));
-	cloudflareTsconfig.compilerOptions.paths = tsconfig.compilerOptions.paths;
-	cloudflareTsconfig.include.push("databases/**/schema.ts");
-	await writeFile(cloudflareTsconfigPath, `${JSON.stringify(cloudflareTsconfig, null, 2)}\n`);
-	await writeFile(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}\n`);
-	const ui = await execa("pnpm", [
-		"dlx",
-		"shadcn@latest",
-		"init",
-		"--preset",
-		"nova",
-		"--base",
-		"base",
-		"--yes",
-		"--no-monorepo"
-	], {
-		cwd: directory,
-		reject: false,
-		stdio: "inherit"
-	});
-	process.exitCode = ui.exitCode;
-	if (ui.exitCode !== 0) return;
-	await cp(new URL("./template/", import.meta.url), directory, { recursive: true });
-	const configure = await execa("pnpm", [
-		"config",
-		"set",
-		"--location=project",
-		"--json",
-		"minimumReleaseAgeExclude",
-		"[\"@usecontextlayer/*\"]"
-	], {
-		cwd: directory,
-		reject: false,
-		stdio: "inherit"
-	});
-	process.exitCode = configure.exitCode;
-	if (configure.exitCode !== 0) return;
-	const install = await execa("pnpm", [
-		"add",
-		`@usecontextlayer/sdk@${version}`,
-		"zod@^4.4.3",
-		"drizzle-orm@0.45.3"
-	], {
-		cwd: directory,
-		reject: false,
-		stdio: "inherit"
-	});
-	process.exitCode = install.exitCode;
-	if (install.exitCode !== 0) return;
-	const migrationTool = await execa("pnpm", [
-		"add",
-		"-D",
-		"drizzle-kit@0.31.11"
-	], {
-		cwd: directory,
-		reject: false,
-		stdio: "inherit"
-	});
-	process.exitCode = migrationTool.exitCode;
-	if (migrationTool.exitCode !== 0) return;
-	const packagePath = join(directory, "package.json");
-	const checkoutPackage = looseObject({ scripts: record(string(), string()) }).parse(JSON.parse(await readFile(packagePath, "utf8")));
-	checkoutPackage.scripts["db:migration"] = "drizzle-kit generate --custom";
-	await writeFile(packagePath, `${JSON.stringify(checkoutPackage, null, 2)}\n`);
 	const response = await fetch(new URL("/api/slates", env.CTX_PLATFORM_URL), {
 		body: JSON.stringify(input),
 		headers: {
@@ -4295,11 +4243,11 @@ Start locally:
   pnpm dev
 Open the local URL printed by the development server.
 
-Deploy your changes:
-  git add .
-  git commit
+Deploy the committed starter:
   git push -u origin main
 
+Commit your own changes before subsequent pushes.
+
 See README.md for the development and connection workflow.
 `);
 });
@@ -4311,36 +4259,37 @@ program.command("login").description("Sign in by approving a browser code and co
 program.command("git-credential <operation>").description("Git credential helper using the saved login; invoked automatically by Git").hook("preAction", async (command) => {
 	if (command.args[0] === "get") await requireLogin(command);
 }).action(gitCredential);
-program.command("whoami").description("Show your ContextLayer user ID verified by the auth server").action(async (_options, command) => {
-	console.log((await authenticate(command)).id);
-});
-program.command("join").argument("<target>", "SlateID, public hostname, or local (run from the checkout root)").description("Join a private slate you can view using ctx login, enabling member-scoped unattended work; returns slate and user IDs").hook("preAction", requireLogin).action(async (target) => {
-	await joinSlate(union([
-		literal("local"),
-		uuid(),
-		hostname()
-	]).parse(target));
-});
-const connections = program.command("connections").description("Manage Owner-owned connected accounts or list app and agent connections and assignments; local reads only the current checkout and its saved development assignments").option("--org <slug>", "Manage this organization's connected accounts; defaults to the signed-in user").argument("[target]", "SlateID or public hostname (pushed requirements), or local (current checkout; no platform request)").addArgument(new Argument("[operation]", "Slate connection operation").choices(["list"])).hook("preAction", async (command, actionCommand) => {
-	if (actionCommand !== command || command.args[0] !== "local") await requireLogin(actionCommand);
-}).action(async (target, operation) => {
-	if (!target || !operation) connections.error("Expected: ctx connections <target> list");
-	await listSlateConnections(target);
+program.command("whoami").description("Show your ContextLayer user ID verified by the auth server, with the issuer and platform URL in use").action(async (_options, command) => {
+	const { id } = await authenticate(command);
+	console.log(`User: ${id}\nIssuer: ${env.CTX_AUTH_ISSUER}\nPlatform: ${env.CTX_PLATFORM_URL}`);
 });
-connections.command("list").description("List the selected Owner's connected accounts with their toolkit, identity, and status").action(async (_options, command) => {
-	await listConnections(ownerOptionsSchema.parse(command.optsWithGlobals()).org);
+const accounts = program.command("accounts").description("Connect and list the selected Owner's connected accounts").option("--org <slug>", "Manage this organization's connected accounts; defaults to the signed-in user").hook("preAction", requireLogin);
+accounts.command("list").description("List the selected Owner's connected accounts with their toolkit, identity, and status").action(async (_options, command) => {
+	await listAccounts(ownerOptionsSchema.parse(command.optsWithGlobals()).org);
 });
-connections.command("add <toolkit>").description("Connect the selected Owner's account in your browser (for example, gmail), then assign the connected account to a slate's declared connection with ctx connection").action(async (toolkit, _options, command) => {
+accounts.command("add <toolkit>").description("Connect the selected Owner's account in your browser (for example, gmail), then assign it with ctx connections <target> assign <slug> [connection_id]").action(async (toolkit, _options, command) => {
 	const options = ownerOptionsSchema.parse(command.optsWithGlobals());
 	await connectAccount(string().min(1).parse(toolkit), options.org);
 });
-program.command("connection").description("Assign a connected account to a declared connection: local saves a personal connected account assignment in .contextlayer/connections.json; SlateID/hostname saves a hosted assignment under its declared Owner").argument("<target>", "SlateID, public hostname, or local (run from the checkout root)").addArgument(new Argument("<operation>").choices(["assign"])).argument("<slug>", "Connection slug declared in slate.json (for example, work-email)").argument("[connection_id]", "Connected account ID; omit locally to assign a connected account for the declared toolkit interactively; required for hosted targets").hook("preAction", requireLogin).action(async (target, _operation, slug, connectionId) => {
-	const input = connectionAssignmentSchema.parse({
+program.command("connections").description("List declared app and agent connections or assign connected accounts; local reads and saves checkout configuration, SlateID/hostname uses pushed declarations and hosted assignments").argument("<target>", "SlateID, public hostname, or local (run from the checkout root)").addArgument(new Argument("<operation>").choices(["list", "assign"])).argument("[slug]", "Required for assign: connection slug declared in slate.json (for example, work-email)").argument("[connection_id]", "For assign: connected account ID; omit locally to choose interactively; required for hosted targets").action(async (target, operation, slug, connectionId, _options, command) => {
+	const parsed = connectionsCommandSchema.safeParse({
 		connection_id: connectionId,
+		operation,
 		slug,
 		target
 	});
-	await assignSlateConnection(input.target, input.slug, input.connection_id);
+	if (!parsed.success) command.error(parsed.error.issues.map((issue) => issue.message).join("\n"));
+	const input = parsed.data;
+	if (input.operation !== "list" || input.target !== "local") await requireLogin(command);
+	switch (input.operation) {
+		case "list":
+			await listSlateConnections(input.target);
+			break;
+		case "assign":
+			await assignSlateConnection(input.target, input.slug, input.connection_id);
+			break;
+		default: throw new Error(`Unhandled connections operation: ${JSON.stringify(input)}`);
+	}
 });
 program.command("agent").addArgument(new Argument("<target>", "Run from the checkout root").choices(["local"])).addArgument(new Argument("<operation>").choices(["run"])).argument("<name>", "Agent directory under agents/").argument("<prompt>", "Task to send as the user message").description("Run agents/<name>/instructions.md locally with Claude Agent SDK and native Claude authentication; Vite startup also requires ctx login when the app declares connections").action(async (_target, _operation, name, prompt) => {
 	const input = object({
@@ -4359,6 +4308,15 @@ secrets.command("set").argument("<name>", "Secret name: uppercase letters, digit
 secrets.command("drop").argument("<name>", "Secret name: uppercase letters, digits, and underscores; cannot start with a digit").description("Delete the selected Owner's shared secret; returns only Owner and name").action(async (name, _options, command) => {
 	await dropSecret(secretNameSchema.parse(name), secretOptionsSchema.parse(command.optsWithGlobals()).org);
 });
+program.command("db.codegen").argument("<slug>", "Database declared in public/slate.json or agents/<name>/slate.json").description("Generate databases/<slug>/types.ts from the migrated local database").addHelpText("after", "\nRun from the slate root with pnpm dev running.\nApply migrations with pnpm exec kysely before generating types.\n\nExample:\n  pnpm db.codegen notes").action(async (slug, _options, command) => {
+	const { generateDatabaseTypes } = await import("./database-codegen-C5TEhR5_.mjs");
+	try {
+		await generateDatabaseTypes(databaseSlugSchema.parse(slug));
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT" && "path" in error && error.path === resolve("public/slate.json")) command.error(`Missing ${error.path}. Run pnpm db.codegen from the slate root containing public/slate.json.`);
+		throw error;
+	}
+});
 await program.parseAsync();
 //#endregion
 export {};