@mediamonks/canopy-cli 0.0.1 → 0.1.0

package/dist/api-CyJ-wBZh.mjs

@@ -0,0 +1,40 @@
+import { t as readConfig } from "./config-C-z7st1X.mjs";
+//#region src/api.ts
+/**
+* Authenticated requests to the Canopy control plane. Credentials, in order:
+* CANOPY_DEPLOY_TOKEN (CI — a project-scoped deploy token, docs/02-decisions.md
+* D11), then the CLI token from `canopy login` (~/.canopy/config.json).
+*/
+var ApiError = class extends Error {
+	status;
+	code;
+	constructor(status, code, detail) {
+		super(detail ? `${code}: ${detail}` : code);
+		this.status = status;
+		this.code = code;
+	}
+};
+async function apiRequest(method, path, body, rawContentType, headers) {
+	const config = readConfig();
+	const deployToken = process.env["CANOPY_DEPLOY_TOKEN"];
+	const token = deployToken || config.token;
+	if (!token) throw new Error("Not logged in — run `canopy login` first.");
+	const isForm = body instanceof FormData;
+	const response = await fetch(`${config.apiUrl}/v1${path}`, {
+		method,
+		headers: {
+			authorization: `Bearer ${token}`,
+			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" },
+			...headers
+		},
+		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
+	});
+	if (!response.ok) {
+		const payload = await response.json().catch(() => ({}));
+		if (response.status === 401) throw new Error(deployToken ? "Deploy token rejected — it may have been revoked. Create a new one in the dashboard (Settings → Deploy tokens) or with `canopy token create`." : "Session expired — run `canopy login` again.");
+		throw new ApiError(response.status, payload.error ?? `http_${response.status}`, payload.detail);
+	}
+	return await response.json();
+}
+//#endregion
+export { apiRequest as t };

package/dist/config-C-z7st1X.mjs

@@ -0,0 +1,33 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+//#region src/config.ts
+/**
+* CLI config at ~/.canopy/config.json — platform endpoints and the current
+* CLI token. Env overrides: CANOPY_API_URL, CANOPY_OIDC_ISSUER,
+* CANOPY_OIDC_CLIENT_ID.
+*/
+const DEFAULT_API_URL = "https://canopy-api.arjan-van-wijk.workers.dev";
+const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
+const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
+const configDir = join(homedir(), ".canopy");
+const configPath = join(configDir, "config.json");
+function readConfig() {
+	let stored = {};
+	try {
+		stored = JSON.parse(readFileSync(configPath, "utf8"));
+	} catch {}
+	return {
+		...stored,
+		apiUrl: process.env["CANOPY_API_URL"] ?? stored.apiUrl ?? DEFAULT_API_URL,
+		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? stored.issuer ?? DEFAULT_ISSUER,
+		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? stored.cliClientId ?? DEFAULT_CLI_CLIENT_ID
+	};
+}
+function writeConfig(config) {
+	mkdirSync(configDir, { recursive: true });
+	writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+	chmodSync(configPath, 384);
+}
+//#endregion
+export { writeConfig as n, readConfig as t };

package/dist/{db-BBcgT1md.mjs → db-CtUG4vfG.mjs}

@@ -1,6 +1,6 @@
-import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-Cl5P_yQ6.mjs";
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { i as resolveProject, n as projectFlagArgs } from "./project-CrrpLEPs.mjs";
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { i as resolveProject, n as projectFlagArgs } from "./project-CpiPLNby.mjs";
+import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-BfhAlb91.mjs → deploy-N88l4Kt3.mjs}

@@ -1,11 +1,11 @@
-import { i as unwrap, n as reportErrors } from "./ui-Cl5P_yQ6.mjs";
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { a as tryReadCanopyJson, i as resolveProject, n as projectFlagArgs, r as projectUrl, t as projectDirArgs } from "./project-CrrpLEPs.mjs";
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { a as tryReadCanopyJson, i as resolveProject, n as projectFlagArgs, r as projectUrl, t as projectDirArgs } from "./project-CpiPLNby.mjs";
+import { i as unwrap, n as reportErrors } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
+import { spawn } from "node:child_process";
 import { readFileSync, readdirSync, statSync } from "node:fs";
-import * as p from "@clack/prompts";
 import { join, relative, resolve } from "node:path";
-import { spawn } from "node:child_process";
+import * as p from "@clack/prompts";
 //#region src/deploy.ts
 /**
 * canopy deploy — build (optional), bundle the output directory as multipart
@@ -17,6 +17,7 @@ import { spawn } from "node:child_process";
 */
 const IGNORED = /* @__PURE__ */ new Set([
 	"canopy.json",
+	"AGENTS.md",
 	"CLAUDE.md",
 	"README.md",
 	".gitignore",
@@ -88,7 +89,7 @@ const deployCommand = defineCommand({
 		spin.start(`Deploying ${paths.length} files (${(total / 1024).toFixed(0)} kB) → ${slug}`);
 		let result;
 		try {
-			({deploy: result} = await apiRequest("POST", `/projects/${slug}/deploys`, form));
+			({deploy: result} = await apiRequest("POST", `/projects/${slug}/deploys`, form, void 0, process.env["GITHUB_ACTIONS"] ? { "x-canopy-source": "github-action" } : void 0));
 		} catch (err) {
 			spin.error("Deploy failed.");
 			throw err;

package/dist/{dev-BB7CwqoI.mjs → dev-DTGW0lm0.mjs}

@@ -1,6 +1,7 @@
-import { a as readConfig, n as reportErrors } from "./ui-Cl5P_yQ6.mjs";
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { i as resolveProject, t as projectDirArgs } from "./project-CrrpLEPs.mjs";
+import { t as readConfig } from "./config-C-z7st1X.mjs";
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { i as resolveProject, t as projectDirArgs } from "./project-CpiPLNby.mjs";
+import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
 import { join } from "node:path";
 //#region src/dev.ts
@@ -54,7 +55,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-DhufX0eJ.mjs");
+		const { fetchProjectDump } = await import("./local-951zc9qJ.mjs");
 		console.log(`Pulling a fresh export of ${slug}…`);
 		dump = await fetchProjectDump(slug);
 	}
@@ -68,7 +69,7 @@ async function devLocal(flags, slug) {
 	} catch (err) {
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${err instanceof Error ? err.message : String(err)}).`);
 	}
-	const { createSandbox } = await import("./local-DhufX0eJ.mjs");
+	const { createSandbox } = await import("./local-951zc9qJ.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-D_GlUULk.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-DTGW0lm0.mjs";
+export { devCommand };

package/dist/index.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
+import { i as runRefresh, r as notifyOfUpdate } from "./version-check-CoWgQs2h.mjs";
 import { defineCommand, runMain } from "citty";
 //#region package.json
-var version = "0.0.1";
+var version = "0.1.0";
 //#endregion
 //#region src/index.ts
 /**
@@ -13,10 +14,15 @@ var version = "0.0.1";
 *   create                scaffold + register a project           [phase 1]
 *   dev [--local [--pull]] local dev: remote-first, or offline sandbox [phase 1/2]
 *   deploy                build & deploy assets (+ worker)        [phase 1/2]
+*   token create|list|revoke   deploy tokens for CI               [phase 2]
 *   db pull|snapshot|restore                                      [phase 2]
 *   logs                  tail the project's worker logs          [phase 2]
 *   open                  open the deployed project / dashboard   [phase 1]
 */
+if (process.env["CANOPY_UPDATE_REFRESH"] === "1") {
+	await runRefresh();
+	process.exit(0);
+}
 /** A roadmap command that has not landed yet (docs/04-roadmap.md). */
 function planned(name, description, phase) {
 	return defineCommand({
@@ -30,26 +36,30 @@ function planned(name, description, phase) {
 		}
 	});
 }
-await runMain(defineCommand({
+const main = defineCommand({
 	meta: {
 		name: "canopy",
 		version,
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-DrXKOEmr.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-DrXKOEmr.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-DrXKOEmr.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-f_KocDae.mjs").then((m) => m.createCommand),
-		projects: () => import("./projects-f_KocDae.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-f_KocDae.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-Bvy21srH.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-BfhAlb91.mjs").then((m) => m.deployCommand),
-		rollback: () => import("./deploy-BfhAlb91.mjs").then((m) => m.rollbackCommand),
-		db: () => import("./db-BBcgT1md.mjs").then((m) => m.dbCommand),
-		open: () => import("./open-DFWvrLFc.mjs").then((m) => m.openCommand),
+		login: () => import("./login-DsWvYc8C.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-DsWvYc8C.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-DsWvYc8C.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-DJT_mJDR.mjs").then((m) => m.createCommand),
+		projects: () => import("./projects-DJT_mJDR.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-DJT_mJDR.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-D_GlUULk.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-N88l4Kt3.mjs").then((m) => m.deployCommand),
+		rollback: () => import("./deploy-N88l4Kt3.mjs").then((m) => m.rollbackCommand),
+		token: () => import("./token-rTD9jxPZ.mjs").then((m) => m.tokenCommand),
+		db: () => import("./db-CtUG4vfG.mjs").then((m) => m.dbCommand),
+		open: () => import("./open-xLiGUz_W.mjs").then((m) => m.openCommand),
+		upgrade: () => import("./upgrade-TbMOjkLY.mjs").then((m) => m.upgradeCommand),
 		logs: planned("logs", "Tail worker logs", "2")
 	}
-}));
+});
+if (process.argv[2] !== "upgrade") notifyOfUpdate(version);
+await runMain(main);
 //#endregion
 export {};

package/dist/{local-DhufX0eJ.mjs → local-951zc9qJ.mjs}

@@ -1,5 +1,5 @@
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { n as rewriteApiPath } from "./dev-BB7CwqoI.mjs";
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { n as rewriteApiPath } from "./dev-DTGW0lm0.mjs";
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";

package/dist/{login-DrXKOEmr.mjs → login-DsWvYc8C.mjs}

@@ -1,4 +1,5 @@
-import { a as readConfig, n as reportErrors, o as writeConfig, t as openBrowser } from "./ui-Cl5P_yQ6.mjs";
+import { n as writeConfig, t as readConfig } from "./config-C-z7st1X.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";

package/dist/{open-DFWvrLFc.mjs → open-xLiGUz_W.mjs}

@@ -1,5 +1,5 @@
-import { n as reportErrors, t as openBrowser } from "./ui-Cl5P_yQ6.mjs";
-import { i as resolveProject, r as projectUrl, t as projectDirArgs } from "./project-CrrpLEPs.mjs";
+import { i as resolveProject, r as projectUrl, t as projectDirArgs } from "./project-CpiPLNby.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{project-CrrpLEPs.mjs → project-CpiPLNby.mjs}

@@ -1,4 +1,4 @@
-import { a as readConfig } from "./ui-Cl5P_yQ6.mjs";
+import { t as readConfig } from "./config-C-z7st1X.mjs";
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/project.ts

package/dist/projects-DJT_mJDR.mjs

@@ -0,0 +1,228 @@
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { r as projectUrl } from "./project-CpiPLNby.mjs";
+import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-C8VuPzGp.mjs";
+import { defineCommand } from "citty";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+import * as p from "@clack/prompts";
+import { fileURLToPath } from "node:url";
+//#region src/template.ts
+/**
+* Template registry + scaffolder for `canopy create`. Templates are real,
+* runnable project directories in packages/templates — linted and built like
+* any code — copied into the CLI's dist/templates at build time
+* (scripts/sync-templates.mjs) so the published tarball is self-contained.
+*
+* Scaffolding copies a template recursively, substitutes {{name}}/{{slug}},
+* and renames _gitignore → .gitignore (npm strips .gitignore files from
+* published tarballs, so templates can't ship one under its real name).
+*/
+const TEMPLATES = [
+	{
+		id: "static",
+		label: "Static site",
+		hint: "plain html/css/js, no build step (default)"
+	},
+	{
+		id: "spa",
+		label: "React SPA",
+		hint: "Vite + React + TypeScript, SDK from npm",
+		needsInstall: true
+	},
+	{
+		id: "worker",
+		label: "React SPA + backend Worker",
+		hint: "adds Hono handlers in worker/ — Phase 2 preview",
+		needsInstall: true,
+		hidden: true
+	}
+];
+function templatesRoot() {
+	const base = fileURLToPath(new URL(".", import.meta.url));
+	for (const candidate of [join(base, "templates"), join(base, "..", "..", "templates")]) if (existsSync(join(candidate, "static"))) return candidate;
+	throw new Error("Template files not found — the CLI build is incomplete (missing templates/).");
+}
+function scaffoldTemplate(templateId, targetDir, vars) {
+	const source = join(templatesRoot(), templateId);
+	mkdirSync(targetDir, { recursive: true });
+	for (const entry of readdirSync(source, {
+		recursive: true,
+		withFileTypes: true
+	})) {
+		const dest = join(targetDir, relative(source, join(entry.parentPath, entry.name)).split(sep).map((part) => part === "_gitignore" ? ".gitignore" : part).join(sep));
+		if (entry.isDirectory()) {
+			mkdirSync(dest, { recursive: true });
+			continue;
+		}
+		writeFileSync(dest, readFileSync(join(entry.parentPath, entry.name), "utf8").replaceAll("{{name}}", vars.name).replaceAll("{{slug}}", vars.slug));
+	}
+}
+//#endregion
+//#region src/projects.ts
+/**
+* canopy create | projects | delete — the project registry from the terminal
+* (docs/04-roadmap.md Phase 1 item 2). `create` registers the project, then
+* scaffolds ./<slug>/ from the starter template (--no-scaffold to skip, e.g.
+* for an existing directory).
+*/
+function slugify(input) {
+	return input.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/(^-+|-+$)/g, "").slice(0, 40);
+}
+const createCommand = defineCommand({
+	meta: {
+		name: "create",
+		description: "Create a new Canopy project"
+	},
+	args: {
+		name: {
+			type: "positional",
+			description: "Project name (prompted for when omitted)",
+			required: false
+		},
+		slug: {
+			type: "string",
+			description: "URL slug (defaults to a slugified name)"
+		},
+		template: {
+			type: "string",
+			description: `Template to scaffold: ${TEMPLATES.map((t) => t.id).join(" | ")} (picker when omitted)`
+		},
+		scaffold: {
+			type: "boolean",
+			default: true,
+			description: "Scaffold ./<slug>/ from the starter template",
+			negativeDescription: "Only register — no files written"
+		}
+	},
+	run: reportErrors("create", async ({ args }) => {
+		let name = args._.join(" ").trim();
+		p.intro("canopy create");
+		if (!name) {
+			requireTty("pass the project name as an argument.");
+			name = unwrap(await p.text({
+				message: "Project name",
+				validate: (value) => value?.trim() ? void 0 : "A project name is required."
+			})).trim();
+		}
+		let slug = args.slug;
+		if (!slug && process.stdin.isTTY) slug = unwrap(await p.text({
+			message: "Slug",
+			defaultValue: slugify(name),
+			placeholder: slugify(name),
+			validate: (value) => !value || /^[a-z0-9][a-z0-9-]*$/.test(value) ? void 0 : "Lowercase letters, digits and dashes only."
+		})).trim();
+		slug ||= slugify(name);
+		let template = TEMPLATES.find((t) => t.id === (args.template ?? "static"));
+		if (!template) throw new Error(`Unknown template "${args.template}" — available: ${TEMPLATES.map((t) => t.id).join(", ")}.`);
+		if (args.scaffold && !args.template && process.stdin.isTTY) {
+			const id = unwrap(await p.select({
+				message: "Template",
+				options: TEMPLATES.filter((t) => !t.hidden).map((t) => ({
+					value: t.id,
+					label: t.label,
+					hint: t.hint
+				}))
+			}));
+			template = TEMPLATES.find((t) => t.id === id) ?? template;
+		}
+		if (template.hidden) p.log.warn("Per-project Workers are not deployable yet (Phase 2) — `canopy deploy` publishes the frontend only for now.");
+		const targetDir = resolve(slug);
+		if (args.scaffold && existsSync(targetDir)) throw new Error(`Directory ./${slug} already exists — remove it, or use --no-scaffold to only register.`);
+		const spin = p.spinner();
+		spin.start(`Registering ${slug}…`);
+		let project;
+		try {
+			({project} = await apiRequest("POST", "/projects", {
+				slug,
+				name
+			}));
+		} catch (err) {
+			spin.error("Create failed.");
+			throw err;
+		}
+		spin.stop(`Created ${project.name} — ${projectUrl(project.slug)}`);
+		if (args.scaffold) {
+			scaffoldTemplate(template.id, targetDir, {
+				name,
+				slug
+			});
+			const steps = [
+				`cd ${slug}`,
+				...template.needsInstall ? ["npm install"] : [],
+				"canopy dev   (or deploy right away: canopy deploy)"
+			];
+			p.note(steps.join("\n"), `Scaffolded ./${slug}/ (${template.id}) — next`);
+			p.outro(`Live URL (after first deploy): ${projectUrl(project.slug)}`);
+		} else p.outro("Registered without scaffolding — add a canopy.json to deploy an existing app.");
+	})
+});
+const projectsCommand = defineCommand({
+	meta: {
+		name: "projects",
+		description: "List your projects"
+	},
+	args: { all: {
+		type: "boolean",
+		default: false,
+		description: "Include projects you can't edit"
+	} },
+	run: reportErrors("projects", async ({ args }) => {
+		const { projects, is_admin: isAdmin } = await apiRequest("GET", "/projects");
+		const mine = args.all || isAdmin ? projects : projects.filter((project) => project.role);
+		if (mine.length === 0) {
+			console.log(projects.length === 0 ? "No projects yet — run `canopy create`." : `No projects of your own yet — run \`canopy create\`, or --all to list all ${projects.length}.`);
+			return;
+		}
+		const width = Math.max(...mine.map((project) => project.slug.length));
+		for (const project of mine) {
+			const role = project.role ?? (isAdmin ? "admin" : `owner: ${project.owner_email}`);
+			console.log(`${project.slug.padEnd(width)}  ${project.status.padEnd(7)}  ${role.padEnd(6)}  ${projectUrl(project.slug)}  ${project.name}`);
+		}
+	})
+});
+const deleteCommand = defineCommand({
+	meta: {
+		name: "delete",
+		description: "Delete a project (full teardown)"
+	},
+	args: {
+		slug: {
+			type: "positional",
+			description: "Project slug (picked from a list when omitted)",
+			required: false
+		},
+		yes: {
+			type: "boolean",
+			default: false,
+			description: "Skip the type-the-slug confirmation"
+		}
+	},
+	run: reportErrors("delete", async ({ args }) => {
+		let slug = args.slug;
+		if (!slug) {
+			requireTty("pass the project slug as an argument.");
+			const listing = await apiRequest("GET", "/projects");
+			const projects = listing.is_admin ? listing.projects : listing.projects.filter((project) => project.role === "owner");
+			if (projects.length === 0) throw new Error("No projects to delete.");
+			slug = unwrap(await p.select({
+				message: "Project to delete",
+				options: projects.map((project) => ({
+					value: project.slug,
+					label: project.slug,
+					hint: project.name
+				}))
+			}));
+		}
+		if (!args.yes) {
+			requireTty("pass --yes to delete without confirmation.");
+			if (unwrap(await p.text({ message: `Delete "${slug}" permanently? This tears down its database and files. Type the slug to confirm.` })).trim() !== slug) {
+				p.cancel("Aborted.");
+				return;
+			}
+		}
+		await apiRequest("DELETE", `/projects/${slug}`);
+		p.log.success(`Deleted ${slug}.`);
+	})
+});
+//#endregion
+export { createCommand, deleteCommand, projectsCommand };

package/dist/templates/spa/.github/workflows/canopy-deploy.yml

@@ -0,0 +1,34 @@
+# Deploy to Canopy on every push to main. GitHub's runners are the build
+# farm — the platform owns no build infrastructure.
+#
+# Needs a CANOPY_DEPLOY_TOKEN repo secret: create a deploy token in the
+# dashboard (project → Settings → Deploy tokens) or with `canopy token
+# create`, then add it via `gh secret set CANOPY_DEPLOY_TOKEN` or the repo's
+# Settings → Secrets. Until the secret is set, this workflow skips itself
+# instead of failing the build.
+name: Deploy to Canopy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install dependencies
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: |
+          if [ -f package-lock.json ]; then npm ci; else npm install; fi
+      - name: Deploy
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: npm exec --yes @mediamonks/canopy-cli deploy
+      - name: Skipped (no deploy token)
+        if: env.CANOPY_DEPLOY_TOKEN == ''
+        run: echo "CANOPY_DEPLOY_TOKEN secret not set — skipping deploy."

package/dist/templates/spa/AGENTS.md

@@ -0,0 +1,43 @@
+# {{name}} — a Canopy React SPA
+
+A Vite + React single-page app on [Canopy](https://dashboard.thanarie.dev),
+Monks' managed platform for internal projects. Everything is served behind
+company login; there is no infrastructure to manage and none should be added.
+
+## Canopy skill
+
+The full SDK reference (auth, db, blob, ai) and platform guardrails ship as an
+agent skill, kept out of this scaffold so it stays current. Install it before
+building features:
+
+```
+npx skills add mediamonks/canopy
+```
+
+If that fails the skill isn't published yet — the SDK surface is documented on
+the [Canopy dashboard](https://dashboard.thanarie.dev).
+
+## Working on this project
+
+- A standard Vite + React + TypeScript app; `npm install` once, then develop
+  with `canopy dev` (it runs Vite with this project's `vite.config.ts` and
+  proxies `/_api` to the platform).
+- The SDK comes from npm (`@mediamonks/canopy`) — the shared instance lives in
+  `src/canopy.ts`.
+- `canopy dev` uses LIVE project data: read freely, but take a
+  `canopy db snapshot` before risky data changes.
+- `canopy dev --local [--pull]` — offline sandbox with local data instead;
+  writes never reach the platform. Prefer it for destructive experiments.
+- `canopy deploy` — builds (`npm run build`) and publishes `dist/`; live
+  (behind company login) at https://{{slug}}.thanarie.dev.
+
+## Boundaries
+
+- Do not add auth — the platform authenticates every request before it
+  reaches this app.
+- Do not store secrets anywhere in this project, and never call external APIs
+  that need them from the browser — all backend needs go through the Canopy
+  SDK (`canopy.auth`, `canopy.db`, `canopy.blob`, `canopy.ai`).
+- Frontend only: no SSR, no custom servers, no databases outside `canopy.db`.
+  (Need backend code? Recreate on the `worker` template, or ask the Canopy
+  team.)

package/dist/templates/spa/README.md

@@ -0,0 +1,14 @@
+# {{name}}
+
+A [Canopy](https://dashboard.thanarie.dev) project — Vite + React. Live
+(behind company login) at https://{{slug}}.thanarie.dev after the first
+`canopy deploy`.
+
+- `npm install` — once, then:
+- `canopy dev` — develop locally against the live platform (real data!)
+- `canopy dev --local [--pull]` — offline sandbox with local data instead
+- `canopy deploy` — build and publish `dist/`
+- `AGENTS.md` — project guardrails and skill setup for coding agents
+
+Push-to-main deploys are prepared in `.github/workflows/canopy-deploy.yml`
+(needs a `CANOPY_DEPLOY_TOKEN` repo secret — see the workflow file).

package/dist/templates/spa/_gitignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+.canopy/
+.DS_Store

package/dist/templates/spa/canopy.json

@@ -0,0 +1,5 @@
+{
+  "slug": "{{slug}}",
+  "build": "npm run build",
+  "dist": "dist"
+}

package/dist/templates/spa/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{name}}</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/dist/templates/spa/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "{{slug}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "canopy dev",
+    "build": "tsc && vite build"
+  },
+  "dependencies": {
+    "@mediamonks/canopy": "^0.0.1",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "@vitejs/plugin-react": "^5.0.0",
+    "typescript": "^5.8.0",
+    "vite": "^7.0.0"
+  }
+}

package/dist/templates/spa/src/app.tsx

@@ -0,0 +1,25 @@
+import { useEffect, useState } from "react";
+import { canopy } from "./canopy.ts";
+
+export function App() {
+  const [status, setStatus] = useState("connecting to Canopy…");
+
+  useEffect(() => {
+    canopy.auth
+      .user()
+      .then((user) => setStatus(`signed in as ${user.email}`))
+      .catch(() => setStatus("could not reach Canopy — is `canopy dev` running?"));
+  }, []);
+
+  return (
+    <main>
+      <h1>{"{{name}}"}</h1>
+      <p className="status">{status}</p>
+      <section>
+        <p className="placeholder">
+          Start building — edit <code>src/app.tsx</code>, then run <code>canopy deploy</code>.
+        </p>
+      </section>
+    </main>
+  );
+}

package/dist/templates/spa/src/canopy.ts

@@ -0,0 +1,5 @@
+// One SDK instance for the whole app. Auth (auth), data (db), files (blob)
+// and AI (ai) are all live — see AGENTS.md for how to get the full reference.
+import { createCanopy } from "@mediamonks/canopy";
+
+export const canopy = createCanopy();