@mediamonks/canopy-cli 0.0.1 → 0.2.0

package/dist/api-CyJ-wBZh.mjs

@@ -0,0 +1,40 @@
+import { t as readConfig } from "./config-C-z7st1X.mjs";
+//#region src/api.ts
+/**
+* Authenticated requests to the Canopy control plane. Credentials, in order:
+* CANOPY_DEPLOY_TOKEN (CI — a project-scoped deploy token, docs/02-decisions.md
+* D11), then the CLI token from `canopy login` (~/.canopy/config.json).
+*/
+var ApiError = class extends Error {
+	status;
+	code;
+	constructor(status, code, detail) {
+		super(detail ? `${code}: ${detail}` : code);
+		this.status = status;
+		this.code = code;
+	}
+};
+async function apiRequest(method, path, body, rawContentType, headers) {
+	const config = readConfig();
+	const deployToken = process.env["CANOPY_DEPLOY_TOKEN"];
+	const token = deployToken || config.token;
+	if (!token) throw new Error("Not logged in — run `canopy login` first.");
+	const isForm = body instanceof FormData;
+	const response = await fetch(`${config.apiUrl}/v1${path}`, {
+		method,
+		headers: {
+			authorization: `Bearer ${token}`,
+			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" },
+			...headers
+		},
+		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
+	});
+	if (!response.ok) {
+		const payload = await response.json().catch(() => ({}));
+		if (response.status === 401) throw new Error(deployToken ? "Deploy token rejected — it may have been revoked. Create a new one in the dashboard (Settings → Deploy tokens) or with `canopy token create`." : "Session expired — run `canopy login` again.");
+		throw new ApiError(response.status, payload.error ?? `http_${response.status}`, payload.detail);
+	}
+	return await response.json();
+}
+//#endregion
+export { apiRequest as t };

package/dist/config-C-z7st1X.mjs

@@ -0,0 +1,33 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+//#region src/config.ts
+/**
+* CLI config at ~/.canopy/config.json — platform endpoints and the current
+* CLI token. Env overrides: CANOPY_API_URL, CANOPY_OIDC_ISSUER,
+* CANOPY_OIDC_CLIENT_ID.
+*/
+const DEFAULT_API_URL = "https://canopy-api.arjan-van-wijk.workers.dev";
+const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
+const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
+const configDir = join(homedir(), ".canopy");
+const configPath = join(configDir, "config.json");
+function readConfig() {
+	let stored = {};
+	try {
+		stored = JSON.parse(readFileSync(configPath, "utf8"));
+	} catch {}
+	return {
+		...stored,
+		apiUrl: process.env["CANOPY_API_URL"] ?? stored.apiUrl ?? DEFAULT_API_URL,
+		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? stored.issuer ?? DEFAULT_ISSUER,
+		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? stored.cliClientId ?? DEFAULT_CLI_CLIENT_ID
+	};
+}
+function writeConfig(config) {
+	mkdirSync(configDir, { recursive: true });
+	writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+	chmodSync(configPath, 384);
+}
+//#endregion
+export { writeConfig as n, readConfig as t };

package/dist/{db-BBcgT1md.mjs → db-CtUG4vfG.mjs}

@@ -1,6 +1,6 @@
-import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-Cl5P_yQ6.mjs";
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { i as resolveProject, n as projectFlagArgs } from "./project-CrrpLEPs.mjs";
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { i as resolveProject, n as projectFlagArgs } from "./project-CpiPLNby.mjs";
+import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-BfhAlb91.mjs → deploy-N88l4Kt3.mjs}

@@ -1,11 +1,11 @@
-import { i as unwrap, n as reportErrors } from "./ui-Cl5P_yQ6.mjs";
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { a as tryReadCanopyJson, i as resolveProject, n as projectFlagArgs, r as projectUrl, t as projectDirArgs } from "./project-CrrpLEPs.mjs";
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { a as tryReadCanopyJson, i as resolveProject, n as projectFlagArgs, r as projectUrl, t as projectDirArgs } from "./project-CpiPLNby.mjs";
+import { i as unwrap, n as reportErrors } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
+import { spawn } from "node:child_process";
 import { readFileSync, readdirSync, statSync } from "node:fs";
-import * as p from "@clack/prompts";
 import { join, relative, resolve } from "node:path";
-import { spawn } from "node:child_process";
+import * as p from "@clack/prompts";
 //#region src/deploy.ts
 /**
 * canopy deploy — build (optional), bundle the output directory as multipart
@@ -17,6 +17,7 @@ import { spawn } from "node:child_process";
 */
 const IGNORED = /* @__PURE__ */ new Set([
 	"canopy.json",
+	"AGENTS.md",
 	"CLAUDE.md",
 	"README.md",
 	".gitignore",
@@ -88,7 +89,7 @@ const deployCommand = defineCommand({
 		spin.start(`Deploying ${paths.length} files (${(total / 1024).toFixed(0)} kB) → ${slug}`);
 		let result;
 		try {
-			({deploy: result} = await apiRequest("POST", `/projects/${slug}/deploys`, form));
+			({deploy: result} = await apiRequest("POST", `/projects/${slug}/deploys`, form, void 0, process.env["GITHUB_ACTIONS"] ? { "x-canopy-source": "github-action" } : void 0));
 		} catch (err) {
 			spin.error("Deploy failed.");
 			throw err;

package/dist/{dev-BB7CwqoI.mjs → dev-DTGW0lm0.mjs}

@@ -1,6 +1,7 @@
-import { a as readConfig, n as reportErrors } from "./ui-Cl5P_yQ6.mjs";
-import { t as apiRequest } from "./api-BEY4O4ap.mjs";
-import { i as resolveProject, t as projectDirArgs } from "./project-CrrpLEPs.mjs";
+import { t as readConfig } from "./config-C-z7st1X.mjs";
+import { t as apiRequest } from "./api-CyJ-wBZh.mjs";
+import { i as resolveProject, t as projectDirArgs } from "./project-CpiPLNby.mjs";
+import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
 import { defineCommand } from "citty";
 import { join } from "node:path";
 //#region src/dev.ts
@@ -54,7 +55,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-DhufX0eJ.mjs");
+		const { fetchProjectDump } = await import("./local-951zc9qJ.mjs");
 		console.log(`Pulling a fresh export of ${slug}…`);
 		dump = await fetchProjectDump(slug);
 	}
@@ -68,7 +69,7 @@ async function devLocal(flags, slug) {
 	} catch (err) {
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${err instanceof Error ? err.message : String(err)}).`);
 	}
-	const { createSandbox } = await import("./local-DhufX0eJ.mjs");
+	const { createSandbox } = await import("./local-951zc9qJ.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-D_GlUULk.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-DTGW0lm0.mjs";
+export { devCommand };

package/dist/docs/ci.md

@@ -0,0 +1,48 @@
+---
+title: CI and deploy tokens
+summary: Push-to-main deploys using a project-scoped deploy token.
+---
+
+# CI and deploy tokens
+
+Interactive `canopy login` is for humans at a terminal. For automated deploys
+(GitHub Actions, etc.) use a **deploy token**: a project-scoped credential that
+can deploy that one project and nothing else.
+
+## Create a token
+
+From inside the project directory:
+
+```bash
+canopy token create --name "GitHub Actions"
+```
+
+This prints the token **once** — copy it immediately and store it as a CI secret
+(e.g. `CANOPY_DEPLOY_TOKEN`). It is not shown again.
+
+Manage tokens:
+
+```bash
+canopy token list
+canopy token revoke <id>
+```
+
+## Use it in CI
+
+The CLI picks up `CANOPY_DEPLOY_TOKEN` from the environment and uses it instead
+of an interactive login. A minimal GitHub Actions step:
+
+```yaml
+- run: npm install -g @mediamonks/canopy-cli
+- run: canopy deploy --build
+  env:
+    CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
+```
+
+No `canopy login` step is needed — the token is the credential.
+
+## Notes
+
+- A deploy token can only deploy its own project. If it strays to another
+  project's resources, the platform rejects it.
+- Revoke a token the moment it might be exposed; create a fresh one to replace it.

package/dist/docs/cli.md

@@ -0,0 +1,67 @@
+---
+title: CLI command reference
+summary: Every canopy command, its flags, and what it does.
+---
+
+# CLI command reference
+
+Run `canopy <command> --help` for the authoritative flags of any command. This
+is the overview.
+
+## Auth
+
+- `canopy login` — sign in via OneLogin (opens the browser; finish there).
+  Add `--json` for machine-readable status output (for agents/CI).
+- `canopy whoami` — show the current login and token expiry.
+- `canopy logout` — forget the local CLI token.
+
+## Projects
+
+- `canopy create [name]` — create and register a project.
+  - `--slug <slug>` — URL slug (defaults to a slugified name).
+  - `--template <id>` — `static` | `spa` | `worker` (picker when omitted).
+  - `--scaffold` — write `./<slug>/` from the starter template.
+- `canopy projects` — list your projects. `--all` includes ones you can't edit.
+- `canopy delete [slug]` — full teardown of a project. `--yes` skips the
+  type-the-slug confirmation.
+
+## Develop
+
+- `canopy dev` — run the project locally against live platform data.
+  - `--port <port>` — dev server port.
+  - `--local` — offline sandbox (Miniflare D1/R2 under `.canopy/local/`).
+  - `--pull` — hydrate the sandbox from a fresh prod export first (with `--local`).
+
+## Deploy
+
+- `canopy deploy` — build and deploy the project.
+  - `--build` — run the `canopy.json` build command first.
+- `canopy rollback [version]` — make an earlier deploy live again, e.g. `v3`
+  (picked from history when omitted). `--dir <path>` to target another directory.
+- `canopy open` — open the deployed project in your browser.
+
+## Data
+
+- `canopy db pull` — download a fresh SQL dump. `--out <file>` to name it.
+- `canopy db snapshot` — store a dump server-side (restorable anytime).
+- `canopy db snapshots` — list stored snapshots.
+- `canopy db restore [file]` — replace ALL project data from a `.sql` file or
+  `--snapshot <key>`. `--yes` skips the confirmation. **Destructive.**
+
+## CI / deploy tokens
+
+- `canopy token create` — create a project-scoped deploy token for CI.
+  `--name "<label>"` to label it.
+- `canopy token list` — list the project's deploy tokens.
+- `canopy token revoke <id>` — revoke a token.
+
+See `canopy docs ci` for wiring push-to-main deploys.
+
+## Maintenance
+
+- `canopy upgrade` — update the CLI to the latest version. `--version <v>` pins a
+  release; `--pm <npm|pnpm|yarn|bun>` overrides the package-manager guess.
+  Upgrading also refreshes the installed Canopy agent skill.
+- `canopy docs [topic]` — list docs, or print one. `--refresh` re-fetches from
+  the platform.
+- `canopy skill install` — (re)install the Canopy agent skill into this repo.

package/dist/docs/data.md

@@ -0,0 +1,49 @@
+---
+title: Working with project data
+summary: Pulling, snapshotting, and restoring your project database.
+---
+
+# Working with project data
+
+Each Canopy project gets its own database (D1) and blob storage (R2). Your app
+reads and writes them through the Canopy SDK at runtime; the CLI gives you tools
+to manage the data around it.
+
+## Download a dump
+
+```bash
+canopy db pull                 # writes <slug>-<timestamp>.sql
+canopy db pull --out data.sql  # choose the filename
+```
+
+A plain SQL dump you can inspect, diff, or keep as a backup.
+
+## Snapshots (server-side backups)
+
+```bash
+canopy db snapshot     # store a dump on the platform
+canopy db snapshots    # list stored snapshots
+```
+
+Snapshots live on the platform and can be restored at any time — handy before a
+risky change.
+
+## Restore — destructive
+
+Restoring **replaces ALL project data**:
+
+```bash
+canopy db restore backup.sql          # from a local dump
+canopy db restore --snapshot <key>    # from a server-side snapshot
+```
+
+You'll be asked to type the project slug to confirm. `--yes` skips that prompt —
+use it only in scripts you trust.
+
+## Safe workflow for agents
+
+Before any destructive data change:
+
+1. `canopy db snapshot` — take a restore point.
+2. Make the change (or test it first with `canopy dev --local --pull`).
+3. If something goes wrong, `canopy db restore --snapshot <key>`.

package/dist/docs/deploy.md

@@ -0,0 +1,50 @@
+---
+title: Deploying a project
+summary: How canopy deploy builds, uploads, and makes a version live.
+---
+
+# Deploying a project
+
+From inside a project directory:
+
+```bash
+canopy deploy
+```
+
+This uploads your built assets to the platform, creates a new immutable deploy
+version, and makes it live. Each deploy is versioned (`v1`, `v2`, …).
+
+## Building first
+
+If your project needs a build step (React SPA, anything with a bundler), declare
+the build command in `canopy.json` and pass `--build`:
+
+```bash
+canopy deploy --build
+```
+
+`--build` runs the project's configured build command before uploading. Without
+it, `canopy deploy` uploads whatever is already built (or the static files as-is
+for a `static` project).
+
+## Rolling back
+
+Every deploy is kept, so you can instantly revert:
+
+```bash
+canopy rollback          # pick a version from history
+canopy rollback v3       # make v3 live again
+```
+
+Rollback re-points the live version at an existing deploy — it does not rebuild.
+
+## Seeing the live site
+
+```bash
+canopy open
+```
+
+## Deploying from CI
+
+For automated push-to-main deploys, use a deploy token instead of an interactive
+login — see `canopy docs ci`.

package/dist/docs/dev.md

@@ -0,0 +1,44 @@
+---
+title: Local development
+summary: Running a project locally against live or sandboxed data.
+---
+
+# Local development
+
+From inside a project directory:
+
+```bash
+canopy dev
+```
+
+By default `canopy dev` runs your project locally but talks to **live platform
+data** (your project's real database, blobs, and AI). This is the fastest way to
+develop against realistic state.
+
+- `--port <port>` — choose the dev-server port.
+
+## Offline sandbox
+
+To develop without touching live data — for example on a plane, or before you
+trust a destructive change — use a local sandbox backed by Miniflare:
+
+```bash
+canopy dev --local
+```
+
+This creates local D1 and R2 under `.canopy/local/` in your project. The sandbox
+starts empty.
+
+To seed the sandbox from a fresh copy of production data first:
+
+```bash
+canopy dev --local --pull
+```
+
+`.canopy/local/` is disposable — delete it to reset the sandbox.
+
+## Which mode should an agent use?
+
+- Iterating on UI or read-only features → `canopy dev` (live data, realistic).
+- Testing writes, migrations, or anything destructive → `canopy dev --local`
+  (optionally `--pull` to start from real data).

package/dist/docs/getting-started.md

@@ -0,0 +1,100 @@
+---
+title: Getting started
+summary: Install the CLI, sign in with OneLogin, and ship your first project.
+---
+
+# Getting started with Canopy
+
+Canopy is Monks' managed platform for vibecoded projects. You build a small web
+app, and Canopy hosts it, gives it a database, blob storage, and AI — no
+infrastructure to manage.
+
+This guide is written so an AI coding agent (Claude, Cursor, etc.) can follow it
+on your behalf. Everything runs through one command-line tool: `canopy`.
+
+## 1. Install the CLI
+
+The CLI is published on npm. Install it globally:
+
+```bash
+npm install -g @mediamonks/canopy-cli
+```
+
+Confirm it's on your PATH:
+
+```bash
+canopy --version
+```
+
+If `npm` isn't available, install Node.js 20+ first (https://nodejs.org), then
+re-run the install.
+
+## 2. Sign in
+
+Canopy authenticates through Monks' OneLogin. Run:
+
+```bash
+canopy login
+```
+
+This opens your browser. **Finish the sign-in there** — the CLI waits for the
+browser to redirect back, then stores a token in `~/.canopy/config.json`.
+
+> If you are an agent: run `canopy login`, then stop and tell the human to
+> complete the sign-in in the browser window that just opened. Never ask for or
+> type the user's password or any codes yourself.
+
+Check who you are at any time:
+
+```bash
+canopy whoami
+```
+
+## 3. Create a project
+
+```bash
+canopy create
+```
+
+This prompts for a name and a starter template, scaffolds a runnable project
+directory, and registers the project on the platform. To skip the prompts:
+
+```bash
+canopy create "My App" --scaffold --template static
+```
+
+## 4. Run it locally
+
+```bash
+cd my-app
+canopy dev
+```
+
+Your project runs against live platform data by default. For an offline sandbox
+with local data, use `canopy dev --local`.
+
+## 5. Deploy
+
+```bash
+canopy deploy
+```
+
+Then open the live site:
+
+```bash
+canopy open
+```
+
+## Where to go next
+
+Everything the CLI can do is documented and available offline. List the topics:
+
+```bash
+canopy docs
+```
+
+Read one, e.g.:
+
+```bash
+canopy docs deploy
+```

package/dist/docs/troubleshooting.md

@@ -0,0 +1,61 @@
+---
+title: Troubleshooting
+summary: Common errors and how to resolve them.
+---
+
+# Troubleshooting
+
+## `command not found: canopy`
+
+The CLI isn't installed or isn't on your PATH. Install it:
+
+```bash
+npm install -g @mediamonks/canopy-cli
+```
+
+If it installs but still isn't found, your npm global bin directory isn't on your
+PATH. Run `npm bin -g` to find it and add that directory to your PATH.
+
+## `Not logged in — run canopy login`
+
+You have no valid CLI token. Run `canopy login` and finish the sign-in in the
+browser. Check status with `canopy whoami`.
+
+## `Session expired — run canopy login again`
+
+Your token expired. Just run `canopy login` again.
+
+## The browser didn't open during login
+
+`canopy login` prints the sign-in URL as a fallback — open it manually in a
+browser on the **same machine** as the CLI (login uses a local loopback
+redirect, so it must be the same machine).
+
+## `Port 8976 is in use`
+
+A previous login attempt is still holding the callback port. Close it (or wait a
+moment) and retry `canopy login`.
+
+## Login hangs and never completes
+
+Login only works when the CLI runs on the machine whose browser you're using
+(the redirect goes to `127.0.0.1`). It cannot complete on a remote/headless box.
+Run it on your own laptop.
+
+## `Deploy token rejected`
+
+The `CANOPY_DEPLOY_TOKEN` was revoked or is wrong. Create a new one with
+`canopy token create` (or in the dashboard) and update your CI secret.
+
+## Docs are stale
+
+`canopy docs` caches the platform's docs. Force a refresh:
+
+```bash
+canopy docs <topic> --refresh
+```
+
+## Still stuck?
+
+Run the failing command again and share its full output. `canopy whoami` and
+`canopy --version` are useful to include.