@mediamonks/canopy-cli 0.0.1 → 0.1.0

package/dist/upgrade-TbMOjkLY.mjs

@@ -0,0 +1,92 @@
+import { t as PACKAGE_NAME } from "./version-check-CoWgQs2h.mjs";
+import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { defineCommand } from "citty";
+import { spawn } from "node:child_process";
+//#region src/upgrade.ts
+/**
+* canopy upgrade — install the latest published CLI globally.
+*
+* We shell out to whichever package manager we can detect (npm/pnpm/yarn/bun),
+* defaulting to npm, and let it do the actual install so global prefixes,
+* permissions and lockfiles stay the manager's concern. `--pm` overrides the
+* guess; `--version` pins a specific release.
+*/
+/** Best-effort guess of the package manager that installed this CLI. */
+function detectPackageManager() {
+	const ua = process.env["npm_config_user_agent"] ?? "";
+	if (ua.startsWith("pnpm")) return "pnpm";
+	if (ua.startsWith("yarn")) return "yarn";
+	if (ua.startsWith("bun")) return "bun";
+	const path = process.argv[1] ?? process.execPath;
+	if (/[\\/](?:pnpm|\.pnpm)[\\/]/.test(path)) return "pnpm";
+	if (/[\\/]\.bun[\\/]/.test(path)) return "bun";
+	if (/[\\/](?:Yarn|\.yarn)[\\/]/i.test(path)) return "yarn";
+	return "npm";
+}
+/** The global-install argv for `pm`, targeting `spec` (e.g. name@latest). */
+function installArgs(pm, spec) {
+	switch (pm) {
+		case "pnpm": return [
+			"add",
+			"-g",
+			spec
+		];
+		case "yarn": return [
+			"global",
+			"add",
+			spec
+		];
+		case "bun": return [
+			"add",
+			"-g",
+			spec
+		];
+		default: return [
+			"install",
+			"-g",
+			spec
+		];
+	}
+}
+function run(pm, args) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(pm, args, {
+			stdio: "inherit",
+			shell: process.platform === "win32"
+		});
+		child.on("error", (err) => reject(err.code === "ENOENT" ? /* @__PURE__ */ new Error(`\`${pm}\` was not found on your PATH — install it or pass --pm.`) : err));
+		child.on("close", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`${pm} exited with code ${code ?? "unknown"}.`)));
+	});
+}
+const upgradeCommand = defineCommand({
+	meta: {
+		name: "upgrade",
+		description: "Update the Canopy CLI to the latest version"
+	},
+	args: {
+		version: {
+			type: "string",
+			description: "Install this exact version instead of the latest"
+		},
+		pm: {
+			type: "string",
+			description: "Package manager to use: npm, pnpm, yarn or bun (auto-detected by default)"
+		}
+	},
+	run: reportErrors("upgrade", async ({ args }) => {
+		const chosen = args.pm;
+		if (chosen && ![
+			"npm",
+			"pnpm",
+			"yarn",
+			"bun"
+		].includes(chosen)) throw new Error(`Unknown --pm "${chosen}" — use npm, pnpm, yarn or bun.`);
+		const pm = chosen ?? detectPackageManager();
+		const cmd = installArgs(pm, `${PACKAGE_NAME}@${args.version ?? "latest"}`);
+		console.log(`Upgrading via ${pm}: ${pm} ${cmd.join(" ")}`);
+		await run(pm, cmd);
+		console.log(`\nDone. Run \`canopy --version\` to confirm.`);
+	})
+});
+//#endregion
+export { upgradeCommand };

package/dist/version-check-CoWgQs2h.mjs

@@ -0,0 +1,128 @@
+import { spawn } from "node:child_process";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+//#region src/version-check.ts
+/**
+* Best-effort "you're behind" notice for the CLI.
+*
+* On startup we read a small cache at ~/.canopy/version-check.json and, if a
+* newer version is already known, print a one-line hint to stderr. Refreshing
+* that cache from the npm registry happens in a detached background process so
+* it never blocks (or delays) the command the user actually ran. The check is
+* silent on any failure and can be disabled with CANOPY_NO_UPDATE_CHECK.
+*/
+const PACKAGE_NAME = "@mediamonks/canopy-cli";
+const CACHE_PATH = join(homedir(), ".canopy", "version-check.json");
+const CHECK_INTERVAL_MS = 1440 * 60 * 1e3;
+const REFRESH_TIMEOUT_MS = 3e3;
+const REFRESH_ENV = "CANOPY_UPDATE_REFRESH";
+/** The npm registry to query, honouring an npm/pnpm registry override. */
+function registryUrl() {
+	return `${(process.env["npm_config_registry"] ?? "https://registry.npmjs.org").replace(/\/$/, "")}/${PACKAGE_NAME}/latest`;
+}
+/**
+* Compare two semver strings. Returns -1 if a < b, 1 if a > b, 0 if equal.
+* Handles `x.y.z` with an optional `-prerelease`; a prerelease sorts below its
+* release (1.2.0-rc.1 < 1.2.0). Good enough for a behind/ahead check.
+*/
+function compareSemver(a, b) {
+	const parse = (v) => {
+		const [core = "", pre = ""] = v.replace(/^v/, "").split("-", 2);
+		return {
+			nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0),
+			pre: pre ? pre.split(".") : []
+		};
+	};
+	const pa = parse(a);
+	const pb = parse(b);
+	for (let i = 0; i < 3; i++) {
+		const diff = (pa.nums[i] ?? 0) - (pb.nums[i] ?? 0);
+		if (diff !== 0) return diff < 0 ? -1 : 1;
+	}
+	if (pa.pre.length === 0 && pb.pre.length === 0) return 0;
+	if (pa.pre.length === 0) return 1;
+	if (pb.pre.length === 0) return -1;
+	for (let i = 0; i < Math.max(pa.pre.length, pb.pre.length); i++) {
+		const x = pa.pre[i];
+		const y = pb.pre[i];
+		if (x === y) continue;
+		if (x === void 0) return -1;
+		if (y === void 0) return 1;
+		const nx = Number(x);
+		const ny = Number(y);
+		return (!Number.isNaN(nx) && !Number.isNaN(ny) ? nx - ny : x < y ? -1 : 1) < 0 ? -1 : 1;
+	}
+	return 0;
+}
+function readCache() {
+	try {
+		return JSON.parse(readFileSync(CACHE_PATH, "utf8"));
+	} catch {
+		return;
+	}
+}
+function writeCache(cache) {
+	try {
+		mkdirSync(join(homedir(), ".canopy"), { recursive: true });
+		writeFileSync(CACHE_PATH, `${JSON.stringify(cache, null, 2)}\n`);
+	} catch {}
+}
+/** Should we stay out of the way entirely (opt-out, CI, or piped output)? */
+function disabled() {
+	return process.env["CANOPY_NO_UPDATE_CHECK"] === "1" || process.env["CI"] !== void 0 || !process.stderr.isTTY;
+}
+/**
+* Print an update hint from cache (if we're behind), then kick off a detached
+* background refresh when the cache is stale. Never throws, never blocks.
+*/
+function notifyOfUpdate(currentVersion) {
+	if (disabled()) return;
+	const cache = readCache();
+	if (cache?.latest && compareSemver(currentVersion, cache.latest) < 0) process.stderr.write(`\nUpdate available: ${currentVersion} → ${cache.latest}. Run \`canopy upgrade\` to update.\n\n`);
+	if (!(cache && Date.now() - Date.parse(cache.lastCheck) < CHECK_INTERVAL_MS)) spawnBackgroundRefresh();
+}
+/** Spawn `canopy` again, flagged to only refresh the cache, fully detached. */
+function spawnBackgroundRefresh() {
+	try {
+		const entry = process.argv[1];
+		if (entry === void 0) return;
+		const child = spawn(process.execPath, [entry], {
+			detached: true,
+			stdio: "ignore",
+			env: {
+				...process.env,
+				[REFRESH_ENV]: "1"
+			}
+		});
+		child.on("error", () => {});
+		child.unref();
+	} catch {}
+}
+/**
+* The detached process's whole job: fetch the latest version and update the
+* cache. Always records lastCheck so a flaky registry doesn't cause a fetch on
+* every single invocation. Exits the process when done.
+*/
+async function runRefresh() {
+	const cache = {
+		lastCheck: (/* @__PURE__ */ new Date()).toISOString(),
+		latest: readCache()?.latest
+	};
+	try {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);
+		const res = await fetch(registryUrl(), {
+			headers: { accept: "application/json" },
+			signal: controller.signal
+		});
+		clearTimeout(timer);
+		if (res.ok) {
+			const { version } = await res.json();
+			if (version) cache.latest = version;
+		}
+	} catch {}
+	writeCache(cache);
+}
+//#endregion
+export { runRefresh as i, REFRESH_ENV as n, notifyOfUpdate as r, PACKAGE_NAME as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -19,8 +19,8 @@
     "hono": "^4.8.0",
     "miniflare": "^4.20260714.0",
     "vite": "npm:@voidzero-dev/vite-plus-core@0.2.5",
-    "@mediamonks/canopy-data-plane": "0.0.1",
-    "@mediamonks/canopy": "0.0.1"
+    "@mediamonks/canopy": "0.0.1",
+    "@mediamonks/canopy-data-plane": "0.0.1"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",
@@ -28,7 +28,7 @@
     "vite-plus": "0.2.5"
   },
   "scripts": {
-    "build": "vp pack",
+    "build": "vp pack && node ./scripts/sync-templates.mjs",
     "dev": "vp pack --watch",
     "test": "vp test",
     "check": "vp check"

package/dist/api-BEY4O4ap.mjs

@@ -1,36 +0,0 @@
-import { a as readConfig } from "./ui-Cl5P_yQ6.mjs";
-//#region src/api.ts
-/**
-* Authenticated requests to the Canopy control plane, using the CLI token
-* from `canopy login` (~/.canopy/config.json).
-*/
-var ApiError = class extends Error {
-	status;
-	code;
-	constructor(status, code, detail) {
-		super(detail ? `${code}: ${detail}` : code);
-		this.status = status;
-		this.code = code;
-	}
-};
-async function apiRequest(method, path, body, rawContentType) {
-	const config = readConfig();
-	if (!config.token) throw new Error("Not logged in — run `canopy login` first.");
-	const isForm = body instanceof FormData;
-	const response = await fetch(`${config.apiUrl}/v1${path}`, {
-		method,
-		headers: {
-			authorization: `Bearer ${config.token}`,
-			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" }
-		},
-		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
-	});
-	if (!response.ok) {
-		const payload = await response.json().catch(() => ({}));
-		if (response.status === 401) throw new Error("Session expired — run `canopy login` again.");
-		throw new ApiError(response.status, payload.error ?? `http_${response.status}`, payload.detail);
-	}
-	return await response.json();
-}
-//#endregion
-export { apiRequest as t };

package/dist/dev-Bvy21srH.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-BB7CwqoI.mjs";
-export { devCommand };

package/dist/projects-f_KocDae.mjs

@@ -1,295 +0,0 @@
-import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-Cl5P_yQ6.mjs";
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { r as projectUrl } from "./project-CrrpLEPs.mjs";
-import { defineCommand } from "citty";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import * as p from "@clack/prompts";
-import { join, resolve } from "node:path";
-//#region src/template.ts
-function templateFiles({ name, slug }) {
-	return {
-		"canopy.json": `${JSON.stringify({
-			slug,
-			dist: "."
-		}, null, 2)}\n`,
-		".gitignore": `.canopy/
-.DS_Store
-`,
-		"index.html": `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>${name}</title>
-    <link rel="stylesheet" href="./style.css" />
-  </head>
-  <body>
-    <main>
-      <h1>${name}</h1>
-      <p class="status" id="status">connecting to Canopy…</p>
-      <section id="app">
-        <p class="placeholder">Start building — edit <code>main.js</code>, then run <code>canopy deploy</code>.</p>
-      </section>
-    </main>
-    <script type="module" src="./main.js"><\/script>
-  </body>
-</html>
-`,
-		"main.js": `// The Canopy SDK is served by the platform itself — nothing to install.
-// Auth (auth), data (db), files (blob) and AI (ai) are all live — see
-// CLAUDE.md for the full surface.
-import { createCanopy } from "/_api/v1/sdk.js";
-
-const canopy = createCanopy();
-
-const user = await canopy.auth.user();
-document.getElementById("status").textContent = \`signed in as \${user.email}\`;
-`,
-		"style.css": `:root {
-  font-family: system-ui, sans-serif;
-  color-scheme: light dark;
-}
-
-body {
-  margin: 0;
-  display: grid;
-  place-items: center;
-  min-height: 100vh;
-}
-
-main {
-  max-width: 40rem;
-  padding: 2rem;
-  text-align: center;
-}
-
-.status {
-  font-size: 0.9rem;
-  opacity: 0.7;
-}
-
-.placeholder {
-  border: 1px dashed color-mix(in srgb, currentColor 30%, transparent);
-  border-radius: 8px;
-  padding: 1.5rem;
-  opacity: 0.6;
-}
-`,
-		"CLAUDE.md": `# ${name} — a Canopy project
-
-This is a static web app on Canopy, the managed platform for internal Monks
-projects. Everything is served behind company login; there is no
-infrastructure to manage and none should be added.
-
-## The paved road
-
-- Frontend only: html/css/js in this directory (add a bundler if you must,
-  set \`build\` and \`dist\` in canopy.json accordingly).
-- All backend needs go through the Canopy SDK — never call external APIs with
-  secrets from the browser, never add your own server:
-  \`\`\`js
-  import { createCanopy } from "/_api/v1/sdk.js";
-  const canopy = createCanopy();
-  const user = await canopy.auth.user();          // { id, email, name, kind }
-
-  // Data — document collections on the project's own database (no tables, no migrations):
-  const todos = canopy.db.collection("todos");
-  const doc = await todos.insert({ title: "hi", done: false });   // -> data + { _id, _createdAt, _updatedAt }
-  await todos.find({ where: { done: false }, orderBy: "_createdAt", order: "desc", limit: 20 });
-  await todos.get(doc._id);                       // Doc | null
-  await todos.update(doc._id, { done: true });    // merge-patch; null removes a key
-  await todos.delete(doc._id);
-  await todos.search("groceries");                // full-text search over the collection
-  await canopy.db.sql("SELECT ... WHERE x = ?", [param]);         // raw SQL escape hatch, same database — always parameterize with ?
-
-  // Files — private storage on the project's own prefix (never public):
-  await canopy.blob.put("notes.txt", "hello", { contentType: "text/plain" });
-  const blob = await canopy.blob.get("notes.txt");                // Blob | null — .text(), .arrayBuffer(), URL.createObjectURL(...)
-  const { url } = await canopy.blob.getUrl("notes.txt");          // short-lived URL for <img src> / links
-  await canopy.blob.list("some/prefix/");         // [{ key, size, contentType, uploadedAt }]
-  await canopy.blob.delete("notes.txt");
-
-  // AI — LLM calls through the project's metered, budget-capped gateway:
-  const { message } = await canopy.ai.chat({ messages: [{ role: "user", content: "hi" }] });
-  // Streaming variant: canopy.ai.chatStream(sameOptions) -> SSE ReadableStream.
-  const { baseUrl, models } = await canopy.ai.endpoint();         // OpenAI-compatible base URL for ecosystem clients (same budget)
-  \`\`\`
-- AI spend is hard-capped per project; over budget, calls fail with
-  \`ai_budget_exceeded\` (429) — handle it, don't retry in a loop.
-- Develop with \`canopy dev\` — a local server on this directory whose
-  \`/_api\` proxies to the real platform. That is LIVE project data, the same
-  the deployed app uses: read freely, but take a \`canopy db snapshot\` before
-  risky data changes.
-- Prefer \`canopy dev --local\` for risky or destructive experiments — a
-  local-data sandbox (db/blob in \`.canopy/local/\`, writes never reach the
-  platform). Add \`--pull\` to hydrate it from a fresh copy of the live
-  database (pull-only; blobs stay empty). \`canopy.ai\` still works there —
-  it proxies to the platform and is metered as usual.
-- Deploy with \`canopy deploy\` — the live URL is
-  https://${slug}.thanarie.dev (company login required).
-
-## Boundaries
-
-- Do not add auth — the platform handles it before any request reaches this app.
-- Do not store secrets anywhere in this project.
-- Keep it a static site: no SSR, no custom servers, no databases outside canopy.db.
-`,
-		"README.md": `# ${name}
-
-A [Canopy](https://dashboard.thanarie.dev) project. Live (behind company
-login) at https://${slug}.thanarie.dev after the first \`canopy deploy\`.
-
-- \`canopy dev\` — develop locally against the live platform (real data!)
-- \`canopy dev --local [--pull]\` — offline sandbox with local data instead
-- \`canopy deploy\` — publish the current directory
-- \`CLAUDE.md\` — guardrails and SDK guide for coding agents
-`
-	};
-}
-//#endregion
-//#region src/projects.ts
-/**
-* canopy create | projects | delete — the project registry from the terminal
-* (docs/04-roadmap.md Phase 1 item 2). `create` registers the project, then
-* scaffolds ./<slug>/ from the starter template (--no-scaffold to skip, e.g.
-* for an existing directory).
-*/
-function slugify(input) {
-	return input.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/(^-+|-+$)/g, "").slice(0, 40);
-}
-const createCommand = defineCommand({
-	meta: {
-		name: "create",
-		description: "Create a new Canopy project"
-	},
-	args: {
-		name: {
-			type: "positional",
-			description: "Project name (prompted for when omitted)",
-			required: false
-		},
-		slug: {
-			type: "string",
-			description: "URL slug (defaults to a slugified name)"
-		},
-		scaffold: {
-			type: "boolean",
-			default: true,
-			description: "Scaffold ./<slug>/ from the starter template",
-			negativeDescription: "Only register — no files written"
-		}
-	},
-	run: reportErrors("create", async ({ args }) => {
-		let name = args._.join(" ").trim();
-		p.intro("canopy create");
-		if (!name) {
-			requireTty("pass the project name as an argument.");
-			name = unwrap(await p.text({
-				message: "Project name",
-				validate: (value) => value?.trim() ? void 0 : "A project name is required."
-			})).trim();
-		}
-		let slug = args.slug;
-		if (!slug && process.stdin.isTTY) slug = unwrap(await p.text({
-			message: "Slug",
-			defaultValue: slugify(name),
-			placeholder: slugify(name),
-			validate: (value) => !value || /^[a-z0-9][a-z0-9-]*$/.test(value) ? void 0 : "Lowercase letters, digits and dashes only."
-		})).trim();
-		slug ||= slugify(name);
-		const targetDir = resolve(slug);
-		if (args.scaffold && existsSync(targetDir)) throw new Error(`Directory ./${slug} already exists — remove it, or use --no-scaffold to only register.`);
-		const spin = p.spinner();
-		spin.start(`Registering ${slug}…`);
-		let project;
-		try {
-			({project} = await apiRequest("POST", "/projects", {
-				slug,
-				name
-			}));
-		} catch (err) {
-			spin.error("Create failed.");
-			throw err;
-		}
-		spin.stop(`Created ${project.name} — ${projectUrl(project.slug)}`);
-		if (args.scaffold) {
-			mkdirSync(targetDir, { recursive: true });
-			for (const [path, content] of Object.entries(templateFiles({
-				name,
-				slug
-			}))) writeFileSync(join(targetDir, path), content);
-			p.note(`cd ${slug}\ncanopy dev   (or deploy right away: canopy deploy)`, `Scaffolded ./${slug}/ — next`);
-			p.outro(`Live URL (after first deploy): ${projectUrl(project.slug)}`);
-		} else p.outro("Registered without scaffolding — add a canopy.json to deploy an existing app.");
-	})
-});
-const projectsCommand = defineCommand({
-	meta: {
-		name: "projects",
-		description: "List your projects"
-	},
-	args: { all: {
-		type: "boolean",
-		default: false,
-		description: "Include projects you can't edit"
-	} },
-	run: reportErrors("projects", async ({ args }) => {
-		const { projects, is_admin: isAdmin } = await apiRequest("GET", "/projects");
-		const mine = args.all || isAdmin ? projects : projects.filter((project) => project.role);
-		if (mine.length === 0) {
-			console.log(projects.length === 0 ? "No projects yet — run `canopy create`." : `No projects of your own yet — run \`canopy create\`, or --all to list all ${projects.length}.`);
-			return;
-		}
-		const width = Math.max(...mine.map((project) => project.slug.length));
-		for (const project of mine) {
-			const role = project.role ?? (isAdmin ? "admin" : `owner: ${project.owner_email}`);
-			console.log(`${project.slug.padEnd(width)}  ${project.status.padEnd(7)}  ${role.padEnd(6)}  ${projectUrl(project.slug)}  ${project.name}`);
-		}
-	})
-});
-const deleteCommand = defineCommand({
-	meta: {
-		name: "delete",
-		description: "Delete a project (full teardown)"
-	},
-	args: {
-		slug: {
-			type: "positional",
-			description: "Project slug (picked from a list when omitted)",
-			required: false
-		},
-		yes: {
-			type: "boolean",
-			default: false,
-			description: "Skip the type-the-slug confirmation"
-		}
-	},
-	run: reportErrors("delete", async ({ args }) => {
-		let slug = args.slug;
-		if (!slug) {
-			requireTty("pass the project slug as an argument.");
-			const listing = await apiRequest("GET", "/projects");
-			const projects = listing.is_admin ? listing.projects : listing.projects.filter((project) => project.role === "owner");
-			if (projects.length === 0) throw new Error("No projects to delete.");
-			slug = unwrap(await p.select({
-				message: "Project to delete",
-				options: projects.map((project) => ({
-					value: project.slug,
-					label: project.slug,
-					hint: project.name
-				}))
-			}));
-		}
-		if (!args.yes) {
-			requireTty("pass --yes to delete without confirmation.");
-			if (unwrap(await p.text({ message: `Delete "${slug}" permanently? This tears down its database and files. Type the slug to confirm.` })).trim() !== slug) {
-				p.cancel("Aborted.");
-				return;
-			}
-		}
-		await apiRequest("DELETE", `/projects/${slug}`);
-		p.log.success(`Deleted ${slug}.`);
-	})
-});
-//#endregion
-export { createCommand, deleteCommand, projectsCommand };

package/dist/ui-Cl5P_yQ6.mjs

@@ -1,72 +0,0 @@
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { cancel, isCancel } from "@clack/prompts";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { spawn } from "node:child_process";
-//#region src/config.ts
-/**
-* CLI config at ~/.canopy/config.json — platform endpoints and the current
-* CLI token. Env overrides: CANOPY_API_URL, CANOPY_OIDC_ISSUER,
-* CANOPY_OIDC_CLIENT_ID.
-*/
-const DEFAULT_API_URL = "https://canopy-api.arjan-van-wijk.workers.dev";
-const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
-const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
-const configDir = join(homedir(), ".canopy");
-const configPath = join(configDir, "config.json");
-function readConfig() {
-	let stored = {};
-	try {
-		stored = JSON.parse(readFileSync(configPath, "utf8"));
-	} catch {}
-	return {
-		...stored,
-		apiUrl: process.env["CANOPY_API_URL"] ?? stored.apiUrl ?? DEFAULT_API_URL,
-		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? stored.issuer ?? DEFAULT_ISSUER,
-		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? stored.cliClientId ?? DEFAULT_CLI_CLIENT_ID
-	};
-}
-function writeConfig(config) {
-	mkdirSync(configDir, { recursive: true });
-	writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
-	chmodSync(configPath, 384);
-}
-//#endregion
-//#region src/ui.ts
-/**
-* Shared terminal UX plumbing: clack prompt unwrapping and uniform
-* command error reporting.
-*/
-/** Unwrap a clack prompt result, exiting cleanly when the user cancels (ctrl-c). */
-function unwrap(result) {
-	if (isCancel(result)) {
-		cancel("Aborted.");
-		process.exit(130);
-	}
-	return result;
-}
-/** Wrap a command action so failures print as `canopy <name>: <message>` and exit 1. */
-function reportErrors(name, action) {
-	return async (...args) => {
-		try {
-			await action(...args);
-		} catch (err) {
-			console.error(`canopy ${name}: ${err instanceof Error ? err.message : String(err)}`);
-			process.exit(1);
-		}
-	};
-}
-/** Guard interactive prompts: bail with a actionable message on non-TTY runs. */
-function requireTty(hint) {
-	if (!process.stdin.isTTY) throw new Error(`This needs an interactive terminal — ${hint}`);
-}
-/** Open a URL in the default browser, fire-and-forget. */
-function openBrowser(url) {
-	spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open", [url], {
-		stdio: "ignore",
-		detached: true,
-		shell: process.platform === "win32"
-	}).on("error", () => {}).unref();
-}
-//#endregion
-export { readConfig as a, unwrap as i, reportErrors as n, writeConfig as o, requireTty as r, openBrowser as t };