@mediamonks/canopy-cli 0.0.1 → 0.1.0

package/dist/templates/spa/src/main.tsx

@@ -0,0 +1,10 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { App } from "./app.tsx";
+import "./style.css";
+
+createRoot(document.getElementById("root") as HTMLElement).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

package/dist/templates/spa/src/style.css

@@ -0,0 +1,29 @@
+:root {
+  font-family: system-ui, sans-serif;
+  color-scheme: light dark;
+}
+
+body {
+  margin: 0;
+  display: grid;
+  place-items: center;
+  min-height: 100vh;
+}
+
+main {
+  max-width: 40rem;
+  padding: 2rem;
+  text-align: center;
+}
+
+.status {
+  font-size: 0.9rem;
+  opacity: 0.7;
+}
+
+.placeholder {
+  border: 1px dashed color-mix(in srgb, currentColor 30%, transparent);
+  border-radius: 8px;
+  padding: 1.5rem;
+  opacity: 0.6;
+}

package/dist/templates/spa/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "allowImportingTsExtensions": true,
+    "noUncheckedIndexedAccess": true
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/dist/templates/spa/vite.config.ts

@@ -0,0 +1,7 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+// `canopy dev` picks this config up and adds its own /_api proxy on top.
+export default defineConfig({
+  plugins: [react()],
+});

package/dist/templates/static/AGENTS.md

@@ -0,0 +1,41 @@
+# {{name}} — a Canopy static app
+
+A no-build web app on [Canopy](https://dashboard.thanarie.dev), Monks' managed
+platform for internal projects. Everything is served behind company login;
+there is no infrastructure to manage and none should be added.
+
+## Canopy skill
+
+The full SDK reference (auth, db, blob, ai) and platform guardrails ship as an
+agent skill, kept out of this scaffold so it stays current. Install it before
+building features:
+
+```
+npx skills add mediamonks/canopy
+```
+
+If that fails the skill isn't published yet — the SDK surface is documented on
+the [Canopy dashboard](https://dashboard.thanarie.dev).
+
+## Working on this project
+
+- Plain html/css/js in this directory — no bundler, no install step. The
+  Canopy SDK is imported straight from the platform, so it always matches the
+  API version: `import { createCanopy } from "/_api/v1/sdk.js";`
+- `canopy dev` — local dev server; its `/_api` proxies to the real platform.
+  That is LIVE project data: read freely, but take a `canopy db snapshot`
+  before risky data changes.
+- `canopy dev --local [--pull]` — offline sandbox with local data instead;
+  writes never reach the platform. Prefer it for destructive experiments.
+- `canopy deploy` — publish; live (behind company login) at
+  https://{{slug}}.thanarie.dev.
+
+## Boundaries
+
+- Do not add auth — the platform authenticates every request before it
+  reaches this app.
+- Do not store secrets anywhere in this project, and never call external APIs
+  that need them from the browser — all backend needs go through the Canopy
+  SDK (`canopy.auth`, `canopy.db`, `canopy.blob`, `canopy.ai`).
+- Keep it a static site: no SSR, no custom servers, no databases outside
+  `canopy.db`.

package/dist/templates/static/README.md

@@ -0,0 +1,9 @@
+# {{name}}
+
+A [Canopy](https://dashboard.thanarie.dev) project. Live (behind company
+login) at https://{{slug}}.thanarie.dev after the first `canopy deploy`.
+
+- `canopy dev` — develop locally against the live platform (real data!)
+- `canopy dev --local [--pull]` — offline sandbox with local data instead
+- `canopy deploy` — publish the current directory
+- `AGENTS.md` — project guardrails and skill setup for coding agents

package/dist/templates/static/_gitignore

@@ -0,0 +1,2 @@
+.canopy/
+.DS_Store

package/dist/templates/static/canopy.json

@@ -0,0 +1,4 @@
+{
+  "slug": "{{slug}}",
+  "dist": "."
+}

package/dist/templates/static/index.html

@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{name}}</title>
+    <link rel="stylesheet" href="./style.css" />
+  </head>
+  <body>
+    <main>
+      <h1>{{name}}</h1>
+      <p class="status" id="status">connecting to Canopy…</p>
+      <section id="app">
+        <p class="placeholder">
+          Start building — edit <code>main.js</code>, then run <code>canopy deploy</code>.
+        </p>
+      </section>
+    </main>
+    <script type="module" src="./main.js"></script>
+  </body>
+</html>

package/dist/templates/static/main.js

@@ -0,0 +1,9 @@
+// The Canopy SDK is served by the platform itself — nothing to install.
+// Auth (auth), data (db), files (blob) and AI (ai) are all live — see
+// AGENTS.md for how to get the full SDK reference.
+import { createCanopy } from "/_api/v1/sdk.js";
+
+const canopy = createCanopy();
+
+const user = await canopy.auth.user();
+document.getElementById("status").textContent = `signed in as ${user.email}`;

package/dist/templates/static/style.css

@@ -0,0 +1,29 @@
+:root {
+  font-family: system-ui, sans-serif;
+  color-scheme: light dark;
+}
+
+body {
+  margin: 0;
+  display: grid;
+  place-items: center;
+  min-height: 100vh;
+}
+
+main {
+  max-width: 40rem;
+  padding: 2rem;
+  text-align: center;
+}
+
+.status {
+  font-size: 0.9rem;
+  opacity: 0.7;
+}
+
+.placeholder {
+  border: 1px dashed color-mix(in srgb, currentColor 30%, transparent);
+  border-radius: 8px;
+  padding: 1.5rem;
+  opacity: 0.6;
+}

package/dist/templates/worker/.github/workflows/canopy-deploy.yml

@@ -0,0 +1,34 @@
+# Deploy to Canopy on every push to main. GitHub's runners are the build
+# farm — the platform owns no build infrastructure.
+#
+# Needs a CANOPY_DEPLOY_TOKEN repo secret: create a deploy token in the
+# dashboard (project → Settings → Deploy tokens) or with `canopy token
+# create`, then add it via `gh secret set CANOPY_DEPLOY_TOKEN` or the repo's
+# Settings → Secrets. Until the secret is set, this workflow skips itself
+# instead of failing the build.
+name: Deploy to Canopy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install dependencies
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: |
+          if [ -f package-lock.json ]; then npm ci; else npm install; fi
+      - name: Deploy
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: npm exec --yes @mediamonks/canopy-cli deploy
+      - name: Skipped (no deploy token)
+        if: env.CANOPY_DEPLOY_TOKEN == ''
+        run: echo "CANOPY_DEPLOY_TOKEN secret not set — skipping deploy."

package/dist/templates/worker/AGENTS.md

@@ -0,0 +1,51 @@
+# {{name}} — a Canopy React SPA with a backend Worker
+
+A Vite + React single-page app plus a per-project backend Worker on
+[Canopy](https://dashboard.thanarie.dev), Monks' managed platform for internal
+projects. Everything is served behind company login; there is no
+infrastructure to manage and none should be added.
+
+> **Phase 2 preview:** per-project Workers are not deployable yet.
+> `canopy deploy` publishes the frontend only; `worker/` is picked up
+> automatically once the platform supports it.
+
+## Canopy skill
+
+The full SDK reference (auth, db, blob, ai) and platform guardrails ship as an
+agent skill, kept out of this scaffold so it stays current. Install it before
+building features:
+
+```
+npx skills add mediamonks/canopy
+```
+
+If that fails the skill isn't published yet — the SDK surface is documented on
+the [Canopy dashboard](https://dashboard.thanarie.dev).
+
+## Working on this project
+
+- Frontend: a standard Vite + React + TypeScript app in `src/`; `npm install`
+  once, then develop with `canopy dev` (it runs Vite with this project's
+  `vite.config.ts` and proxies `/_api` to the platform).
+- Backend: Hono-style handlers in `worker/index.ts`, serving `/api/*`. It runs
+  behind the Canopy gateway (requests arrive authenticated) and reaches the
+  platform through a service binding — same SDK, same budgets and data
+  isolation as the browser.
+- The SDK comes from npm (`@mediamonks/canopy`) — the browser's shared
+  instance lives in `src/canopy.ts`.
+- `canopy dev` uses LIVE project data: read freely, but take a
+  `canopy db snapshot` before risky data changes.
+- `canopy dev --local [--pull]` — offline sandbox with local data instead;
+  writes never reach the platform. Prefer it for destructive experiments.
+- `canopy deploy` — builds (`npm run build`) and publishes; live (behind
+  company login) at https://{{slug}}.thanarie.dev.
+
+## Boundaries
+
+- Do not add auth — the platform authenticates every request before it
+  reaches this app or the Worker.
+- Do not store secrets anywhere in this project — platform access goes
+  through the Canopy SDK (`canopy.auth`, `canopy.db`, `canopy.blob`,
+  `canopy.ai`) in both the browser and the Worker.
+- The Worker is the only backend: no SSR, no long-running processes, no
+  databases outside `canopy.db`.

package/dist/templates/worker/README.md

@@ -0,0 +1,18 @@
+# {{name}}
+
+A [Canopy](https://dashboard.thanarie.dev) project — Vite + React with a
+backend Worker (`worker/`). Live (behind company login) at
+https://{{slug}}.thanarie.dev after the first `canopy deploy`.
+
+> Per-project Workers are a Canopy Phase 2 capability: `canopy deploy`
+> publishes the frontend only for now — `worker/` deploys automatically once
+> the platform supports it.
+
+- `npm install` — once, then:
+- `canopy dev` — develop locally against the live platform (real data!)
+- `canopy dev --local [--pull]` — offline sandbox with local data instead
+- `canopy deploy` — build and publish `dist/`
+- `AGENTS.md` — project guardrails and skill setup for coding agents
+
+Push-to-main deploys are prepared in `.github/workflows/canopy-deploy.yml`
+(needs a `CANOPY_DEPLOY_TOKEN` repo secret — see the workflow file).

package/dist/templates/worker/_gitignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+.canopy/
+.DS_Store

package/dist/templates/worker/canopy.json

@@ -0,0 +1,6 @@
+{
+  "slug": "{{slug}}",
+  "build": "npm run build",
+  "dist": "dist",
+  "worker": "worker/index.ts"
+}

package/dist/templates/worker/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{name}}</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/dist/templates/worker/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "{{slug}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "canopy dev",
+    "build": "tsc && vite build"
+  },
+  "dependencies": {
+    "@mediamonks/canopy": "^0.0.1",
+    "hono": "^4.8.0",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "@vitejs/plugin-react": "^5.0.0",
+    "typescript": "^5.8.0",
+    "vite": "^7.0.0"
+  }
+}

package/dist/templates/worker/src/app.tsx

@@ -0,0 +1,25 @@
+import { useEffect, useState } from "react";
+import { canopy } from "./canopy.ts";
+
+export function App() {
+  const [status, setStatus] = useState("connecting to Canopy…");
+
+  useEffect(() => {
+    canopy.auth
+      .user()
+      .then((user) => setStatus(`signed in as ${user.email}`))
+      .catch(() => setStatus("could not reach Canopy — is `canopy dev` running?"));
+  }, []);
+
+  return (
+    <main>
+      <h1>{"{{name}}"}</h1>
+      <p className="status">{status}</p>
+      <section>
+        <p className="placeholder">
+          Start building — edit <code>src/app.tsx</code>, then run <code>canopy deploy</code>.
+        </p>
+      </section>
+    </main>
+  );
+}

package/dist/templates/worker/src/canopy.ts

@@ -0,0 +1,5 @@
+// One SDK instance for the whole app. Auth (auth), data (db), files (blob)
+// and AI (ai) are all live — see AGENTS.md for how to get the full reference.
+import { createCanopy } from "@mediamonks/canopy";
+
+export const canopy = createCanopy();

package/dist/templates/worker/src/main.tsx

@@ -0,0 +1,10 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { App } from "./app.tsx";
+import "./style.css";
+
+createRoot(document.getElementById("root") as HTMLElement).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

package/dist/templates/worker/src/style.css

@@ -0,0 +1,29 @@
+:root {
+  font-family: system-ui, sans-serif;
+  color-scheme: light dark;
+}
+
+body {
+  margin: 0;
+  display: grid;
+  place-items: center;
+  min-height: 100vh;
+}
+
+main {
+  max-width: 40rem;
+  padding: 2rem;
+  text-align: center;
+}
+
+.status {
+  font-size: 0.9rem;
+  opacity: 0.7;
+}
+
+.placeholder {
+  border: 1px dashed color-mix(in srgb, currentColor 30%, transparent);
+  border-radius: 8px;
+  padding: 1.5rem;
+  opacity: 0.6;
+}

package/dist/templates/worker/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "allowImportingTsExtensions": true,
+    "noUncheckedIndexedAccess": true
+  },
+  "include": ["src", "worker", "vite.config.ts"]
+}

package/dist/templates/worker/vite.config.ts

@@ -0,0 +1,7 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+// `canopy dev` picks this config up and adds its own /_api proxy on top.
+export default defineConfig({
+  plugins: [react()],
+});

package/dist/templates/worker/worker/index.ts

@@ -0,0 +1,29 @@
+/**
+ * The project's own backend Worker (Hono-style handlers). It runs behind the
+ * Canopy gateway — every request is already authenticated — and reaches the
+ * platform (db/blob/ai) through the CANOPY service binding, so budgets and
+ * data isolation still apply.
+ *
+ * NOTE: per-project Workers are a Canopy Phase 2 capability. `canopy deploy`
+ * does not upload this Worker yet — the frontend deploys like any SPA, and
+ * this directory is picked up automatically once the platform supports it.
+ */
+
+import { createCanopy } from "@mediamonks/canopy";
+import { Hono } from "hono";
+
+interface Env {
+  // Service binding to the platform API (canopy-api), scoped to this project.
+  CANOPY: { fetch: typeof fetch };
+}
+
+const app = new Hono<{ Bindings: Env }>();
+
+// Routes under /api/* reach this Worker; everything else serves the SPA.
+app.get("/api/hello", async (c) => {
+  const canopy = createCanopy({ fetch: c.env.CANOPY.fetch.bind(c.env.CANOPY) });
+  const user = await canopy.auth.user();
+  return c.json({ message: `Hello from the backend, ${user.name}!` });
+});
+
+export default app;

package/dist/token-rTD9jxPZ.mjs

@@ -0,0 +1,75 @@
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { i as resolveProject, n as projectFlagArgs, t as projectDirArgs } from "./project-CpiPLNby.mjs";
+import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { defineCommand } from "citty";
+const tokenCommand = defineCommand({
+	meta: {
+		name: "token",
+		description: "Manage deploy tokens for push-to-main deploys (CI)"
+	},
+	subCommands: {
+		create: defineCommand({
+			meta: {
+				name: "create",
+				description: "Create a deploy token for CI"
+			},
+			args: {
+				...projectDirArgs,
+				name: {
+					type: "string",
+					description: "Label shown in the dashboard, e.g. \"GitHub Actions\""
+				}
+			},
+			run: reportErrors("token create", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { token } = await apiRequest("POST", `/projects/${slug}/deploy-tokens`, { name: args.name });
+				console.log(`Deploy token for ${slug} (shown once — store it now):\n`);
+				console.log(`  ${token}\n`);
+				console.log("Add it to the GitHub repo as secret CANOPY_DEPLOY_TOKEN");
+				console.log("(gh secret set CANOPY_DEPLOY_TOKEN, or repo Settings → Secrets).");
+				console.log("Pushes to main then deploy via .github/workflows/canopy-deploy.yml.");
+			})
+		}),
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List the project's deploy tokens"
+			},
+			args: { ...projectDirArgs },
+			run: reportErrors("token list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { tokens } = await apiRequest("GET", `/projects/${slug}/deploy-tokens`);
+				if (tokens.length === 0) {
+					console.log(`No deploy tokens for ${slug} — create one with \`canopy token create\`.`);
+					return;
+				}
+				for (const t of tokens) console.log(`${t.id}  ${t.name ?? "(unnamed)"}  created ${t.created_at} by ${t.created_by ?? "?"}`);
+			})
+		}),
+		revoke: defineCommand({
+			meta: {
+				name: "revoke",
+				description: "Revoke a deploy token (id from `canopy token list`)"
+			},
+			args: {
+				id: {
+					type: "positional",
+					description: "Token id to revoke",
+					required: true
+				},
+				...projectFlagArgs,
+				dir: {
+					type: "string",
+					description: "Project directory (defaults to the current directory)"
+				}
+			},
+			run: reportErrors("token revoke", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await apiRequest("DELETE", `/projects/${slug}/deploy-tokens/${args.id}`);
+				console.log(`Revoked ${args.id} — deploys using it stop working immediately.`);
+			})
+		})
+	}
+});
+//#endregion
+export { tokenCommand };

package/dist/ui-C8VuPzGp.mjs

@@ -0,0 +1,40 @@
+import { spawn } from "node:child_process";
+import { cancel, isCancel } from "@clack/prompts";
+//#region src/ui.ts
+/**
+* Shared terminal UX plumbing: clack prompt unwrapping and uniform
+* command error reporting.
+*/
+/** Unwrap a clack prompt result, exiting cleanly when the user cancels (ctrl-c). */
+function unwrap(result) {
+	if (isCancel(result)) {
+		cancel("Aborted.");
+		process.exit(130);
+	}
+	return result;
+}
+/** Wrap a command action so failures print as `canopy <name>: <message>` and exit 1. */
+function reportErrors(name, action) {
+	return async (...args) => {
+		try {
+			await action(...args);
+		} catch (err) {
+			console.error(`canopy ${name}: ${err instanceof Error ? err.message : String(err)}`);
+			process.exit(1);
+		}
+	};
+}
+/** Guard interactive prompts: bail with a actionable message on non-TTY runs. */
+function requireTty(hint) {
+	if (!process.stdin.isTTY) throw new Error(`This needs an interactive terminal — ${hint}`);
+}
+/** Open a URL in the default browser, fire-and-forget. */
+function openBrowser(url) {
+	spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open", [url], {
+		stdio: "ignore",
+		detached: true,
+		shell: process.platform === "win32"
+	}).on("error", () => {}).unref();
+}
+//#endregion
+export { unwrap as i, reportErrors as n, requireTty as r, openBrowser as t };