@mediamonks/canopy-cli 0.4.4 → 0.4.5

package/dist/{db-Bkq-_qkd.mjs → db-PpaU3V-B.mjs}

@@ -1,6 +1,5 @@
-import { n as apiRequest } from "./api-BcX_w6Xf.mjs";
-import { i as resolveProject, n as projectFlagArgs } from "./project-CpiPLNby.mjs";
-import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-C8VuPzGp.mjs";
+import { c as withContext, i as unwrap, n as reportErrors, r as requireTty, s as apiRequest } from "./ui-D1DXoDN1.mjs";
+import { i as resolveProject, n as projectFlagArgs } from "./project-DKbgJACM.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";
@@ -137,10 +136,11 @@ const dbCommand = defineCommand({
 						return;
 					}
 				}
-				if (snapshotKey) await apiRequest("POST", `/projects/${slug}/restore`, { snapshot: snapshotKey });
+				const restoreContext = { action: `restore "${slug}" from ${snapshotKey ?? file}` };
+				if (snapshotKey) await withContext(apiRequest("POST", `/projects/${slug}/restore`, { snapshot: snapshotKey }), restoreContext);
 				else if (file) {
 					const sql = readFileSync(file, "utf8");
-					await apiRequest("POST", `/projects/${slug}/restore`, sql, "application/sql");
+					await withContext(apiRequest("POST", `/projects/${slug}/restore`, sql, "application/sql"), restoreContext);
 				}
 				p.log.success(`Restored ${slug}.`);
 			})

package/dist/{deploy-BO_-gK32.mjs → deploy-B064KXtr.mjs}

@@ -1,6 +1,5 @@
-import { n as apiRequest, t as apiDownload } from "./api-BcX_w6Xf.mjs";
-import { a as tryReadCanopyJson, i as resolveProject, n as projectFlagArgs, r as projectUrl, t as projectDirArgs } from "./project-CpiPLNby.mjs";
-import { i as unwrap, n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { c as withContext, i as unwrap, n as reportErrors, o as apiDownload, s as apiRequest } from "./ui-D1DXoDN1.mjs";
+import { a as tryReadCanopyJson, i as resolveProject, n as projectFlagArgs, r as projectUrl, t as projectDirArgs } from "./project-DKbgJACM.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
@@ -89,7 +88,7 @@ const deployCommand = defineCommand({
 		spin.start(`Deploying ${paths.length} files (${(total / 1024).toFixed(0)} kB) → ${slug}`);
 		let result;
 		try {
-			({deploy: result} = await apiRequest("POST", `/projects/${slug}/deploys`, form, void 0, process.env["GITHUB_ACTIONS"] ? { "x-canopy-source": "github-action" } : void 0));
+			({deploy: result} = await withContext(apiRequest("POST", `/projects/${slug}/deploys`, form, void 0, process.env["GITHUB_ACTIONS"] ? { "x-canopy-source": "github-action" } : void 0), { action: `deploy "${slug}"` }));
 		} catch (err) {
 			spin.error("Deploy failed.");
 			throw err;

package/dist/dev-BYv6BmcI.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-CuvlJpcO.mjs";
+export { devCommand };

package/dist/{dev-pPVCUaFp.mjs → dev-CuvlJpcO.mjs}

@@ -1,7 +1,5 @@
-import { t as readConfig } from "./config-C-z7st1X.mjs";
-import { n as apiRequest } from "./api-BcX_w6Xf.mjs";
-import { i as resolveProject, t as projectDirArgs } from "./project-CpiPLNby.mjs";
-import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { a as ApiError, c as withContext, l as readConfig, n as reportErrors, s as apiRequest } from "./ui-D1DXoDN1.mjs";
+import { i as resolveProject, t as projectDirArgs } from "./project-DKbgJACM.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { join } from "node:path";
@@ -76,8 +74,19 @@ async function startVite(flags, serverOverrides) {
 	await server.listen();
 	return server;
 }
+/**
+* Context for the dev-token lookup — the first (and most common) place a stale
+* `canopy.json` slug surfaces. Turns a bare `not_found` into a message that
+* names the slug and both ways out (rename locally, or register online).
+*/
+function devTokenContext(slug) {
+	return {
+		action: `look up project "${slug}" on Canopy`,
+		fixes: { not_found: `No project "${slug}" is registered on Canopy (or your account can't access it). Either rename "slug" in canopy.json to match an existing project (see \`canopy projects\`), or register this one — create it in the dashboard, then set that slug in canopy.json.` }
+	};
+}
 async function devRemote(flags, slug) {
-	const { token, expires_at } = await apiRequest("POST", `/projects/${slug}/dev-token`);
+	const { token, expires_at } = await withContext(apiRequest("POST", `/projects/${slug}/dev-token`), devTokenContext(slug));
 	const { apiUrl } = readConfig();
 	const server = await startVite(flags, { proxy: { "/_api": {
 		target: apiUrl,
@@ -94,21 +103,22 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-MLfuFVZb.mjs");
+		const { fetchProjectDump } = await import("./local-B3dyT2fh.mjs");
 		console.log(`Pulling a fresh export of ${slug}…`);
 		dump = await fetchProjectDump(slug);
 	}
 	let remote;
 	try {
-		const { token } = await apiRequest("POST", `/projects/${slug}/dev-token`);
+		const { token } = await withContext(apiRequest("POST", `/projects/${slug}/dev-token`), devTokenContext(slug));
 		remote = {
 			target: readConfig().apiUrl,
 			token
 		};
 	} catch (err) {
-		console.log(`Note: ai/services will be unavailable — could not reach the platform (${err instanceof Error ? err.message : String(err)}).`);
+		const reason = err instanceof ApiError ? err.explain().why : String(err);
+		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-MLfuFVZb.mjs");
+	const { createSandbox } = await import("./local-B3dyT2fh.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/{docs-C3aOAx_A.mjs → docs-UYzmzpz-.mjs}

@@ -1,5 +1,4 @@
-import { t as readConfig } from "./config-C-z7st1X.mjs";
-import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { l as readConfig, n as reportErrors } from "./ui-D1DXoDN1.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-BHlmIdUm.mjs";
+import { t as version } from "./package-Bnu23N0A.mjs";
 import { i as runRefresh, r as notifyOfUpdate } from "./version-check-CoWgQs2h.mjs";
 import { defineCommand, runMain } from "citty";
 //#region src/index.ts
@@ -41,23 +41,23 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-Dif9Y32q.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-Dif9Y32q.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-Dif9Y32q.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-oyjC4ZGb.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-oyjC4ZGb.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-oyjC4ZGb.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-oyjC4ZGb.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-R6nzDtA-.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-BO_-gK32.mjs").then((m) => m.deployCommand),
-		rollback: () => import("./deploy-BO_-gK32.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-BO_-gK32.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-BXc2klNm.mjs").then((m) => m.tokenCommand),
-		db: () => import("./db-Bkq-_qkd.mjs").then((m) => m.dbCommand),
-		open: () => import("./open-xLiGUz_W.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-C3aOAx_A.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-BsZKAgGI.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-nYLjXxPk.mjs").then((m) => m.upgradeCommand),
+		login: () => import("./login-DdNc9OjU.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-DdNc9OjU.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-DdNc9OjU.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-CK4DNxgZ.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-CK4DNxgZ.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-CK4DNxgZ.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-CK4DNxgZ.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-BYv6BmcI.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-B064KXtr.mjs").then((m) => m.deployCommand),
+		rollback: () => import("./deploy-B064KXtr.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-B064KXtr.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-yuwQTQB8.mjs").then((m) => m.tokenCommand),
+		db: () => import("./db-PpaU3V-B.mjs").then((m) => m.dbCommand),
+		open: () => import("./open-CBuZBJlv.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-UYzmzpz-.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-h7QlCMhc.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-sXoqYLRu.mjs").then((m) => m.upgradeCommand),
 		logs: planned("logs", "Tail worker logs", "2")
 	}
 });

package/dist/{local-MLfuFVZb.mjs → local-B3dyT2fh.mjs}

@@ -1,5 +1,5 @@
-import { n as apiRequest } from "./api-BcX_w6Xf.mjs";
-import { n as rewriteApiPath } from "./dev-pPVCUaFp.mjs";
+import { s as apiRequest } from "./ui-D1DXoDN1.mjs";
+import { n as rewriteApiPath } from "./dev-CuvlJpcO.mjs";
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";

package/dist/{login-Dif9Y32q.mjs → login-DdNc9OjU.mjs}

@@ -1,5 +1,4 @@
-import { n as writeConfig, t as readConfig } from "./config-C-z7st1X.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-C8VuPzGp.mjs";
+import { l as readConfig, n as reportErrors, t as openBrowser, u as writeConfig } from "./ui-D1DXoDN1.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";

package/dist/{open-xLiGUz_W.mjs → open-CBuZBJlv.mjs}

@@ -1,5 +1,5 @@
-import { i as resolveProject, r as projectUrl, t as projectDirArgs } from "./project-CpiPLNby.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-C8VuPzGp.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-D1DXoDN1.mjs";
+import { i as resolveProject, r as projectUrl, t as projectDirArgs } from "./project-DKbgJACM.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-BHlmIdUm.mjs → package-Bnu23N0A.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.4.4";
+var version = "0.4.5";
 //#endregion
 export { version as t };

package/dist/{project-CpiPLNby.mjs → project-DKbgJACM.mjs}

@@ -1,4 +1,4 @@
-import { t as readConfig } from "./config-C-z7st1X.mjs";
+import { l as readConfig } from "./ui-D1DXoDN1.mjs";
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/project.ts

package/dist/{projects-oyjC4ZGb.mjs → projects-CK4DNxgZ.mjs}

@@ -1,6 +1,5 @@
-import { n as apiRequest } from "./api-BcX_w6Xf.mjs";
-import { a as tryReadCanopyJson, r as projectUrl } from "./project-CpiPLNby.mjs";
-import { i as unwrap, n as reportErrors, r as requireTty } from "./ui-C8VuPzGp.mjs";
+import { i as unwrap, n as reportErrors, r as requireTty, s as apiRequest } from "./ui-D1DXoDN1.mjs";
+import { a as tryReadCanopyJson, r as projectUrl } from "./project-DKbgJACM.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{skill-BsZKAgGI.mjs → skill-h7QlCMhc.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-BHlmIdUm.mjs";
-import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { t as version } from "./package-Bnu23N0A.mjs";
+import { n as reportErrors } from "./ui-D1DXoDN1.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";

package/dist/{token-BXc2klNm.mjs → token-yuwQTQB8.mjs}

@@ -1,6 +1,5 @@
-import { n as apiRequest } from "./api-BcX_w6Xf.mjs";
-import { i as resolveProject, n as projectFlagArgs, t as projectDirArgs } from "./project-CpiPLNby.mjs";
-import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { n as reportErrors, s as apiRequest } from "./ui-D1DXoDN1.mjs";
+import { i as resolveProject, n as projectFlagArgs, t as projectDirArgs } from "./project-DKbgJACM.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/ui-D1DXoDN1.mjs

@@ -0,0 +1,308 @@
+import { spawn } from "node:child_process";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { cancel, isCancel } from "@clack/prompts";
+//#region src/config.ts
+/**
+* CLI config at ~/.canopy/config.json — platform endpoints and the current
+* CLI token. Env overrides: CANOPY_API_URL, CANOPY_OIDC_ISSUER,
+* CANOPY_OIDC_CLIENT_ID.
+*/
+const DEFAULT_API_URL = "https://canopy-api.arjan-van-wijk.workers.dev";
+const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
+const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
+const configDir = join(homedir(), ".canopy");
+const configPath = join(configDir, "config.json");
+function readConfig() {
+	let stored = {};
+	try {
+		stored = JSON.parse(readFileSync(configPath, "utf8"));
+	} catch {}
+	return {
+		...stored,
+		apiUrl: process.env["CANOPY_API_URL"] ?? stored.apiUrl ?? DEFAULT_API_URL,
+		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? stored.issuer ?? DEFAULT_ISSUER,
+		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? stored.cliClientId ?? DEFAULT_CLI_CLIENT_ID
+	};
+}
+function writeConfig(config) {
+	mkdirSync(configDir, { recursive: true });
+	writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+	chmodSync(configPath, 384);
+}
+//#endregion
+//#region src/api.ts
+/**
+* Authenticated requests to the Canopy control plane. Credentials, in order:
+* CANOPY_DEPLOY_TOKEN (CI — a project-scoped deploy token, docs/02-decisions.md
+* D11), then the CLI token from `canopy login` (~/.canopy/config.json).
+*/
+/**
+* Human copy for the error codes the control plane returns (apps/api): `why`
+* explains what the code means, `fix` is the default next step. A command can
+* override `fix` per code via ErrorContext.fixes; unlisted codes fall back to
+* status-based copy (statusWhy/statusFix).
+*/
+const ERROR_COPY = {
+	not_found: {
+		why: "the resource does not exist there, or your account can't access it",
+		fix: "Double-check the slug/id and that it exists on Canopy under your account (`canopy projects`)."
+	},
+	project_not_found: {
+		why: "no project with that slug exists on Canopy (or your account can't access it)",
+		fix: "Run `canopy projects` to list the projects you can access, then use one of those slugs."
+	},
+	slug_taken: {
+		why: "another project already uses that slug",
+		fix: "Pick a different slug, or reuse the existing project instead of creating a new one."
+	},
+	reserved_slug: {
+		why: "that slug is reserved",
+		fix: "Choose a different slug."
+	},
+	invalid_slug: {
+		why: "the slug is not a valid format",
+		fix: "Use lowercase letters, digits and hyphens only (e.g. my-project)."
+	},
+	project_paused: {
+		why: "the project is paused",
+		fix: "Resume it from the dashboard, then retry."
+	},
+	no_database: {
+		why: "the project has no database yet",
+		fix: "Deploy the project once (`canopy deploy`) to provision its database, then retry."
+	},
+	ai_budget_exceeded: {
+		why: "the project has hit its AI spend limit",
+		fix: "Raise the budget in the dashboard, or wait for the next billing cycle."
+	},
+	ai_unavailable: {
+		why: "the AI service is temporarily unavailable",
+		fix: "This is usually transient — wait a moment and try again."
+	},
+	deploy_too_large: {
+		why: "the deploy bundle exceeds the 25 MB limit",
+		fix: "Trim large assets from the build output (or move them to blob storage), then redeploy."
+	},
+	too_many_files: {
+		why: "the deploy has more than 500 files",
+		fix: "Reduce the file count — bundle/minify assets or drop what isn't served — then redeploy."
+	},
+	empty_deploy: {
+		why: "the deploy contained no files",
+		fix: "Check your build produced output before deploying (is the build dir correct?)."
+	},
+	missing_index_html: {
+		why: "the deploy has no index.html at its root",
+		fix: "Ensure your build output has an index.html at the top level, then redeploy."
+	},
+	dump_too_large: {
+		why: "the SQL dump exceeds the 25 MB limit",
+		fix: "Split the import into smaller batches, or trim the data before restoring."
+	},
+	invalid_dump: {
+		why: "the SQL dump is empty or malformed",
+		fix: "Check the file is non-empty, valid SQL (e.g. a `canopy db export`), then retry."
+	},
+	restore_failed: {
+		why: "the database rejected the restore while executing the SQL",
+		fix: "Fix the SQL the server reported above, then retry. A snapshot (`canopy db snapshot`) first is safest."
+	},
+	invalid_description: {
+		why: "the description is invalid (at most 1000 characters)",
+		fix: "Shorten the description to 1000 characters or fewer."
+	},
+	snapshot_not_found: {
+		why: "no snapshot with that id exists for this project",
+		fix: "Run `canopy db snapshots` to list available snapshots."
+	},
+	version_not_found: {
+		why: "no deploy with that version exists for this project",
+		fix: "Run `canopy deploys` to list versions you can roll back to."
+	}
+};
+/** Generic explanation for a status code when we have no per-code copy. */
+function statusWhy(status) {
+	if (status === 401 || status === 403) return "your account is not allowed to do that";
+	if (status === 404) return "the resource does not exist there, or your account can't access it";
+	if (status === 409) return "the request conflicts with the current state";
+	if (status >= 500) return "the platform hit an internal problem";
+	if (status >= 400) return "the request was rejected";
+	return "the request did not succeed";
+}
+/** Generic remediation for a status code when we have no per-code fix. */
+function statusFix(status) {
+	if (status === 401 || status === 403) return "Check you're logged in as the right account (`canopy whoami`).";
+	if (status >= 500) return "This is usually temporary — wait a moment and try again.";
+	return "Re-check the command arguments and try again.";
+}
+var ApiError = class extends Error {
+	status;
+	code;
+	method;
+	path;
+	detail;
+	/** Command-specific copy, layered on by `withContext` (or `fail` for 401s). */
+	context;
+	constructor(status, code, method, path, detail) {
+		super(detail ? `${code}: ${detail}` : code);
+		this.status = status;
+		this.code = code;
+		this.method = method;
+		this.path = path;
+		this.detail = detail;
+		this.name = "ApiError";
+	}
+	/**
+	* The three things a caller needs: what we were doing (`headline`), why it
+	* failed (`why`), and how to fix it (`fix`). See `reportErrors` for layout.
+	*/
+	explain() {
+		const copy = ERROR_COPY[this.code];
+		const headline = this.context?.action ? `could not ${this.context.action}` : `${this.method} ${this.path} failed`;
+		const detail = this.detail ? `: ${this.detail}` : "";
+		return {
+			headline,
+			why: `${this.status} ${this.code}${detail} — ${copy?.why ?? statusWhy(this.status)}`,
+			fix: this.context?.fixes?.[this.code] ?? copy?.fix ?? statusFix(this.status)
+		};
+	}
+};
+/**
+* Attach command-specific context to any ApiError thrown by `request`, so the
+* generic client failure becomes an actionable, command-aware message. Other
+* errors pass through untouched.
+*/
+async function withContext(request, context) {
+	try {
+		return await request;
+	} catch (err) {
+		if (err instanceof ApiError) err.context = {
+			action: context.action ?? err.context?.action,
+			fixes: {
+				...err.context?.fixes,
+				...context.fixes
+			}
+		};
+		throw err;
+	}
+}
+/** Resolve the bearer token: CI deploy token first (D11), then the login token. */
+function credentials() {
+	const config = readConfig();
+	const deployToken = process.env["CANOPY_DEPLOY_TOKEN"];
+	const token = deployToken || config.token;
+	if (!token) throw new Error("Not logged in — run `canopy login` first.");
+	return {
+		apiUrl: config.apiUrl,
+		token,
+		isDeployToken: Boolean(deployToken)
+	};
+}
+/** Turn a non-2xx response into a thrown ApiError (friendlier copy on 401). */
+async function fail(response, isDeployToken, method, path) {
+	const payload = await response.json().catch(() => ({}));
+	const code = payload.error ?? (response.status === 401 ? "unauthenticated" : `http_${response.status}`);
+	const err = new ApiError(response.status, code, method, path, payload.detail);
+	if (response.status === 401) err.context = {
+		action: "authenticate with Canopy",
+		fixes: { [code]: isDeployToken ? "The deploy token was rejected — it may have been revoked. Create a new one in the dashboard (Settings → Deploy tokens) or with `canopy token create`." : "Your session has expired — run `canopy login` again." }
+	};
+	throw err;
+}
+async function apiRequest(method, path, body, rawContentType, headers) {
+	const { apiUrl, token, isDeployToken } = credentials();
+	const isForm = body instanceof FormData;
+	const response = await fetch(`${apiUrl}/v1${path}`, {
+		method,
+		headers: {
+			authorization: `Bearer ${token}`,
+			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" },
+			...headers
+		},
+		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
+	});
+	if (!response.ok) return fail(response, isDeployToken, method, path);
+	return await response.json();
+}
+/** Authenticated GET returning raw bytes (e.g. a deploy zip). */
+async function apiDownload(path) {
+	const { apiUrl, token, isDeployToken } = credentials();
+	const response = await fetch(`${apiUrl}/v1${path}`, { headers: { authorization: `Bearer ${token}` } });
+	if (!response.ok) return fail(response, isDeployToken, "GET", path);
+	return Buffer.from(await response.arrayBuffer());
+}
+//#endregion
+//#region src/ui.ts
+/**
+* Shared terminal UX plumbing: clack prompt unwrapping and uniform
+* command error reporting.
+*/
+/** Unwrap a clack prompt result, exiting cleanly when the user cancels (ctrl-c). */
+function unwrap(result) {
+	if (isCancel(result)) {
+		cancel("Aborted.");
+		process.exit(130);
+	}
+	return result;
+}
+/** Terminal width to wrap error copy to, bounded so it stays readable. */
+const TEXT_WIDTH = Math.min(process.stdout.columns || 80, 88);
+/** Render `  Label  text…`, wrapping and aligning continuation lines under the text. */
+function labeled(label, text) {
+	const lead = `  ${label}  `;
+	const indent = " ".repeat(lead.length);
+	const max = Math.max(TEXT_WIDTH - lead.length, 24);
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/)) if (line && line.length + 1 + word.length > max) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines.map((l, i) => (i === 0 ? lead : indent) + l).join("\n");
+}
+/**
+* Compose a command failure. API failures get a three-part block — what we
+* tried (headline), why it failed, and how to fix it — everything else prints
+* as a single `canopy <name>: <message>` line.
+*/
+function formatCliError(name, err) {
+	if (err instanceof ApiError) {
+		const { headline, why, fix } = err.explain();
+		return [
+			`canopy ${name}: ${headline}`,
+			"",
+			labeled("Why", why),
+			labeled("Fix", fix),
+			""
+		].join("\n");
+	}
+	return `canopy ${name}: ${err instanceof Error ? err.message : String(err)}`;
+}
+/** Wrap a command action so failures print an actionable report and exit 1. */
+function reportErrors(name, action) {
+	return async (...args) => {
+		try {
+			await action(...args);
+		} catch (err) {
+			console.error(formatCliError(name, err));
+			process.exit(1);
+		}
+	};
+}
+/** Guard interactive prompts: bail with a actionable message on non-TTY runs. */
+function requireTty(hint) {
+	if (!process.stdin.isTTY) throw new Error(`This needs an interactive terminal — ${hint}`);
+}
+/** Open a URL in the default browser, fire-and-forget. */
+function openBrowser(url) {
+	spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open", [url], {
+		stdio: "ignore",
+		detached: true,
+		shell: process.platform === "win32"
+	}).on("error", () => {}).unref();
+}
+//#endregion
+export { ApiError as a, withContext as c, unwrap as i, readConfig as l, reportErrors as n, apiDownload as o, requireTty as r, apiRequest as s, openBrowser as t, writeConfig as u };

package/dist/{upgrade-nYLjXxPk.mjs → upgrade-sXoqYLRu.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CoWgQs2h.mjs";
-import { n as reportErrors } from "./ui-C8VuPzGp.mjs";
+import { n as reportErrors } from "./ui-D1DXoDN1.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-BsZKAgGI.mjs");
+		const { skillInstalled } = await import("./skill-h7QlCMhc.mjs");
 		const refreshSkill = skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -19,8 +19,8 @@
     "hono": "^4.8.0",
     "miniflare": "^4.20260714.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy-data-plane": "0.0.1",
-    "@mediamonks/canopy": "0.0.2"
+    "@mediamonks/canopy": "0.0.2",
+    "@mediamonks/canopy-data-plane": "0.0.1"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/api-BcX_w6Xf.mjs

@@ -1,58 +0,0 @@
-import { t as readConfig } from "./config-C-z7st1X.mjs";
-//#region src/api.ts
-/**
-* Authenticated requests to the Canopy control plane. Credentials, in order:
-* CANOPY_DEPLOY_TOKEN (CI — a project-scoped deploy token, docs/02-decisions.md
-* D11), then the CLI token from `canopy login` (~/.canopy/config.json).
-*/
-var ApiError = class extends Error {
-	status;
-	code;
-	constructor(status, code, detail) {
-		super(detail ? `${code}: ${detail}` : code);
-		this.status = status;
-		this.code = code;
-	}
-};
-/** Resolve the bearer token: CI deploy token first (D11), then the login token. */
-function credentials() {
-	const config = readConfig();
-	const deployToken = process.env["CANOPY_DEPLOY_TOKEN"];
-	const token = deployToken || config.token;
-	if (!token) throw new Error("Not logged in — run `canopy login` first.");
-	return {
-		apiUrl: config.apiUrl,
-		token,
-		isDeployToken: Boolean(deployToken)
-	};
-}
-/** Turn a non-2xx response into a thrown error (friendlier copy on 401). */
-async function fail(response, isDeployToken) {
-	const payload = await response.json().catch(() => ({}));
-	if (response.status === 401) throw new Error(isDeployToken ? "Deploy token rejected — it may have been revoked. Create a new one in the dashboard (Settings → Deploy tokens) or with `canopy token create`." : "Session expired — run `canopy login` again.");
-	throw new ApiError(response.status, payload.error ?? `http_${response.status}`, payload.detail);
-}
-async function apiRequest(method, path, body, rawContentType, headers) {
-	const { apiUrl, token, isDeployToken } = credentials();
-	const isForm = body instanceof FormData;
-	const response = await fetch(`${apiUrl}/v1${path}`, {
-		method,
-		headers: {
-			authorization: `Bearer ${token}`,
-			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" },
-			...headers
-		},
-		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
-	});
-	if (!response.ok) return fail(response, isDeployToken);
-	return await response.json();
-}
-/** Authenticated GET returning raw bytes (e.g. a deploy zip). */
-async function apiDownload(path) {
-	const { apiUrl, token, isDeployToken } = credentials();
-	const response = await fetch(`${apiUrl}/v1${path}`, { headers: { authorization: `Bearer ${token}` } });
-	if (!response.ok) return fail(response, isDeployToken);
-	return Buffer.from(await response.arrayBuffer());
-}
-//#endregion
-export { apiRequest as n, apiDownload as t };

package/dist/config-C-z7st1X.mjs

@@ -1,33 +0,0 @@
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-//#region src/config.ts
-/**
-* CLI config at ~/.canopy/config.json — platform endpoints and the current
-* CLI token. Env overrides: CANOPY_API_URL, CANOPY_OIDC_ISSUER,
-* CANOPY_OIDC_CLIENT_ID.
-*/
-const DEFAULT_API_URL = "https://canopy-api.arjan-van-wijk.workers.dev";
-const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
-const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
-const configDir = join(homedir(), ".canopy");
-const configPath = join(configDir, "config.json");
-function readConfig() {
-	let stored = {};
-	try {
-		stored = JSON.parse(readFileSync(configPath, "utf8"));
-	} catch {}
-	return {
-		...stored,
-		apiUrl: process.env["CANOPY_API_URL"] ?? stored.apiUrl ?? DEFAULT_API_URL,
-		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? stored.issuer ?? DEFAULT_ISSUER,
-		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? stored.cliClientId ?? DEFAULT_CLI_CLIENT_ID
-	};
-}
-function writeConfig(config) {
-	mkdirSync(configDir, { recursive: true });
-	writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
-	chmodSync(configPath, 384);
-}
-//#endregion
-export { writeConfig as n, readConfig as t };

package/dist/dev-R6nzDtA-.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-pPVCUaFp.mjs";
-export { devCommand };

package/dist/ui-C8VuPzGp.mjs

@@ -1,40 +0,0 @@
-import { spawn } from "node:child_process";
-import { cancel, isCancel } from "@clack/prompts";
-//#region src/ui.ts
-/**
-* Shared terminal UX plumbing: clack prompt unwrapping and uniform
-* command error reporting.
-*/
-/** Unwrap a clack prompt result, exiting cleanly when the user cancels (ctrl-c). */
-function unwrap(result) {
-	if (isCancel(result)) {
-		cancel("Aborted.");
-		process.exit(130);
-	}
-	return result;
-}
-/** Wrap a command action so failures print as `canopy <name>: <message>` and exit 1. */
-function reportErrors(name, action) {
-	return async (...args) => {
-		try {
-			await action(...args);
-		} catch (err) {
-			console.error(`canopy ${name}: ${err instanceof Error ? err.message : String(err)}`);
-			process.exit(1);
-		}
-	};
-}
-/** Guard interactive prompts: bail with a actionable message on non-TTY runs. */
-function requireTty(hint) {
-	if (!process.stdin.isTTY) throw new Error(`This needs an interactive terminal — ${hint}`);
-}
-/** Open a URL in the default browser, fire-and-forget. */
-function openBrowser(url) {
-	spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open", [url], {
-		stdio: "ignore",
-		detached: true,
-		shell: process.platform === "win32"
-	}).on("error", () => {}).unref();
-}
-//#endregion
-export { unwrap as i, reportErrors as n, requireTty as r, openBrowser as t };