@mediamonks/canopy-cli 0.4.4 → 0.5.0

package/dist/local-C5-GWJcx.mjs

@@ -0,0 +1,826 @@
+import { o as apiDataRequest } from "./ui-DThlyHgo.mjs";
+import { n as rewriteApiPath } from "./dev-CQQhMOoD.mjs";
+import { createRequire } from "node:module";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, sep } from "node:path";
+import { Hono } from "hono";
+//#region ../data-plane/src/blob.ts
+/**
+* /blob — the SDK's file storage over an injectable BlobStore (a bucket
+* plus the project's isolated key prefix). Same single-implementation deal as
+* db.ts: canopy-api and the CLI's local sandbox mount this exact router.
+*
+* Authorization is the HOST's job (canopy-api enforces session-or-signature
+* ahead of this router; the local sandbox has no auth wall). This router only
+* mints download URLs via the injected signer — verification lives with the
+* host's auth middleware (see signing.ts).
+*/
+const MAX_BLOB_BYTES = 25 * 1024 * 1024;
+const MAX_LIST_KEYS = 1e3;
+const URL_TTL_SECONDS = 600;
+/** Keys may nest with `/`, but never escape the prefix or surprise a URL. */
+function safeBlobKey(raw) {
+	if (raw.length === 0 || raw.length > 512) return null;
+	if (raw.includes("\\") || raw.includes("\0")) return null;
+	if (raw.split("/").some((seg) => seg === "" || seg === "." || seg === "..")) return null;
+	return raw;
+}
+function blobRouter(config) {
+	const blob = new Hono();
+	const resolve = async (c) => config.store(c);
+	blob.put("/blob/:key", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		if (Number(c.req.header("content-length") ?? 0) > MAX_BLOB_BYTES) return c.json({
+			error: "blob_too_large",
+			maxBytes: MAX_BLOB_BYTES
+		}, 413);
+		const body = await c.req.raw.arrayBuffer();
+		if (body.byteLength > MAX_BLOB_BYTES) return c.json({
+			error: "blob_too_large",
+			maxBytes: MAX_BLOB_BYTES
+		}, 413);
+		const contentType = c.req.header("content-type") ?? "application/octet-stream";
+		await store.bucket.put(store.prefix + key, body, { httpMetadata: { contentType } });
+		return c.json({
+			key,
+			size: body.byteLength,
+			contentType,
+			uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+		}, 201);
+	});
+	blob.get("/blob", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const prefix = c.req.query("prefix") ?? "";
+		if (prefix.length > 512 || prefix.includes("\0")) return c.json({ error: "invalid_prefix" }, 400);
+		const base = store.prefix;
+		const objects = [];
+		let cursor;
+		do {
+			const page = await store.bucket.list({
+				prefix: base + prefix,
+				cursor,
+				include: ["httpMetadata"]
+			});
+			for (const o of page.objects) objects.push({
+				key: o.key.slice(base.length),
+				size: o.size,
+				contentType: o.httpMetadata?.contentType ?? "application/octet-stream",
+				uploadedAt: o.uploaded.toISOString()
+			});
+			cursor = page.truncated && objects.length < MAX_LIST_KEYS ? page.cursor : void 0;
+		} while (cursor);
+		return c.json(objects.slice(0, MAX_LIST_KEYS));
+	});
+	blob.get("/blob/:key/url", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { slug, store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		if (!await store.bucket.head(store.prefix + key)) return c.json({ error: "not_found" }, 404);
+		const exp = Math.floor(Date.now() / 1e3) + URL_TTL_SECONDS;
+		const sig = await config.signDownload(c, slug, key, exp);
+		return c.json({
+			url: `/_api/data/v1/blob/${encodeURIComponent(key)}?project=${encodeURIComponent(slug)}&exp=${exp}&sig=${sig}`,
+			expiresAt: (/* @__PURE__ */ new Date(exp * 1e3)).toISOString()
+		});
+	});
+	blob.get("/blob/:key", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		const object = await store.bucket.get(store.prefix + key);
+		if (!object) return c.json({ error: "not_found" }, 404);
+		return new Response(object.body, { headers: {
+			"content-type": object.httpMetadata?.contentType ?? "application/octet-stream",
+			"cache-control": "private, no-store"
+		} });
+	});
+	blob.delete("/blob/:key", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		const fullKey = store.prefix + key;
+		const existed = await store.bucket.head(fullKey) !== null;
+		await store.bucket.delete(fullKey);
+		return c.json({ deleted: existed });
+	});
+	return blob;
+}
+//#endregion
+//#region ../data-plane/src/dialect.ts
+/** Platform-managed fields map to real columns instead of JSON extraction. */
+const META_COLUMNS = {
+	_id: "id",
+	_createdAt: "created_at",
+	_updatedAt: "updated_at"
+};
+//#endregion
+//#region ../data-plane/src/db.ts
+/**
+* /db — the SDK's document API + raw-SQL escape hatch, over an injectable
+* DocStore. This is THE data-plane implementation: canopy-api mounts it under
+* /data/v1 against project D1s (or Postgres on GCP), and `canopy dev --local`
+* mounts the very same router against PGlite — one place to change when the
+* API surface moves.
+*
+* Paths carry no project: hosts wrap the router with their own auth/scope
+* middleware, resolve the project themselves (gateway-stamped
+* X-Canopy-Project or token scope — see canopy-api's session.ts), and hand
+* back the store in `config.store` (returning a Response for not-found/paused…).
+*/
+const COLLECTION_RE = /^[a-z][a-z0-9_]{0,63}$/;
+const FIELD_RE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
+const MAX_DOC_BYTES = 256 * 1024;
+const MAX_LIMIT = 1e3;
+function toDoc(row) {
+	return {
+		...JSON.parse(row.data),
+		_id: row.id,
+		_createdAt: row.created_at,
+		_updatedAt: row.updated_at
+	};
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** User fields only — `_`-prefixed keys are platform-managed. */
+function stripMetaKeys(doc) {
+	return Object.fromEntries(Object.entries(doc).filter(([key]) => !key.startsWith("_")));
+}
+function isScalar(value) {
+	return value === null || [
+		"string",
+		"number",
+		"boolean"
+	].includes(typeof value);
+}
+var BadQuery = class extends Error {};
+/** Validate a where object: known meta keys / dot-path fields, scalar values. */
+function validateWhere(where) {
+	for (const [field, value] of Object.entries(where)) {
+		if (!isScalar(value)) throw new BadQuery(`where.${field}: only string/number/boolean/null values are supported`);
+		if (!META_COLUMNS[field] && !FIELD_RE.test(field)) throw new BadQuery(`where.${field}: invalid field name`);
+	}
+	return where;
+}
+function intParam(raw, name, fallback, max) {
+	if (raw === void 0) return fallback;
+	if (!/^\d{1,9}$/.test(raw)) throw new BadQuery(`${name} must be a non-negative integer`);
+	return Math.min(Number(raw), max);
+}
+function dbRouter(config) {
+	const db = new Hono();
+	const resolve = async (c) => config.store(c);
+	db.post("/db/sql", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const body = await c.req.json().catch(() => ({}));
+		const params = body.params ?? [];
+		if (typeof body.query !== "string" || body.query.trim() === "" || !Array.isArray(params) || !params.every(isScalar)) return c.json({
+			error: "invalid_query",
+			detail: "expected { query: string, params?: (string|number|boolean|null)[] }"
+		}, 400);
+		const result = await store.query(body.query, params).catch((err) => err);
+		if (result instanceof Error) return c.json({
+			error: "sql_error",
+			detail: result.message
+		}, 400);
+		return c.json(result.results);
+	});
+	db.post("/db/:collection", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const body = await c.req.json().catch(() => void 0);
+		if (!isPlainObject(body)) return c.json({
+			error: "invalid_document",
+			detail: "expected a JSON object"
+		}, 400);
+		const fields = stripMetaKeys(body);
+		const data = JSON.stringify(fields);
+		if (data.length > MAX_DOC_BYTES) return c.json({
+			error: "document_too_large",
+			maxBytes: MAX_DOC_BYTES
+		}, 413);
+		const id = crypto.randomUUID();
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const insert = dialect.insert(collection, id, data, now);
+		await store.query(insert.sql, insert.params);
+		return c.json({
+			...fields,
+			_id: id,
+			_createdAt: now,
+			_updatedAt: now
+		}, 201);
+	});
+	db.get("/db/:collection", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const q = c.req.query();
+		try {
+			const limit = intParam(q.limit, "limit", 100, MAX_LIMIT);
+			const offset = intParam(q.offset, "offset", 0, 1e9);
+			let whereRaw = {};
+			if (q.where !== void 0) {
+				try {
+					whereRaw = JSON.parse(q.where);
+				} catch {
+					throw new BadQuery("where must be a JSON object");
+				}
+				if (!isPlainObject(whereRaw)) throw new BadQuery("where must be a JSON object");
+			}
+			const where = validateWhere(whereRaw);
+			let query;
+			if (q.search !== void 0) {
+				query = dialect.search({
+					collection,
+					text: q.search,
+					where,
+					limit,
+					offset
+				});
+				if (query === null) return c.json([]);
+			} else {
+				if (q.orderBy !== void 0 && !META_COLUMNS[q.orderBy] && !FIELD_RE.test(q.orderBy)) throw new BadQuery("orderBy: invalid field name");
+				if (q.order !== void 0 && q.order !== "asc" && q.order !== "desc") throw new BadQuery("order must be 'asc' or 'desc'");
+				query = dialect.find({
+					collection,
+					where,
+					orderBy: q.orderBy,
+					order: q.order === "desc" ? "desc" : "asc",
+					limit,
+					offset
+				});
+			}
+			const result = await store.query(query.sql, query.params);
+			return c.json(result.results.map(toDoc));
+		} catch (err) {
+			if (err instanceof BadQuery) return c.json({
+				error: "invalid_query",
+				detail: err.message
+			}, 400);
+			throw err;
+		}
+	});
+	db.get("/db/:collection/:id", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const get = dialect.get(collection, c.req.param("id"));
+		const row = (await store.query(get.sql, get.params)).results[0];
+		return c.json(row ? toDoc(row) : null);
+	});
+	db.patch("/db/:collection/:id", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const body = await c.req.json().catch(() => void 0);
+		if (!isPlainObject(body)) return c.json({
+			error: "invalid_patch",
+			detail: "expected a JSON object"
+		}, 400);
+		const patch = dialect.patch(collection, c.req.param("id"), JSON.stringify(stripMetaKeys(body)), (/* @__PURE__ */ new Date()).toISOString());
+		const row = (await store.query(patch.sql, patch.params)).results[0];
+		if (!row) return c.json({ error: "not_found" }, 404);
+		return c.json(toDoc(row));
+	});
+	db.delete("/db/:collection/:id", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const del = dialect.del(collection, c.req.param("id"));
+		const result = await store.query(del.sql, del.params);
+		return c.json({ deleted: (result.meta.changes ?? 0) > 0 });
+	});
+	return db;
+}
+//#endregion
+//#region ../data-plane/src/dialect-postgres.ts
+/**
+* Postgres doc-store dialect (Cloud SQL, PGlite). Same table shape as SQLite
+* (`data` as TEXT, string timestamps) so dumps stay portable; JSON operations
+* go through jsonb casts.
+*
+* Known, deliberate differences from the SQLite dialect (docs/08 §5):
+*  - `fts: false` — search() is an ILIKE substring fallback: different
+*    matches, no ranking (results order by created_at). Surfaced to clients
+*    as `capabilities.fts` rather than papered over.
+*  - patch() is a shallow jsonb merge (`||`): top-level keys replace rather
+*    than deep-merge, and a null value stores null instead of removing the
+*    key.
+*/
+const DOC_COLUMNS = "id, data, created_at, updated_at";
+const DOC_STORE_DDL_PG = [`CREATE TABLE IF NOT EXISTS _canopy_docs (
+    collection TEXT NOT NULL,
+    id TEXT NOT NULL,
+    data TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (collection, id)
+  )`, `CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`];
+/** `data`'s JSON value at a `$.a.b` path param, as jsonb. */
+const jsonAt = (column, pathParam) => `(${column}::jsonb #> string_to_array(trim(leading '$.' from ${pathParam}::text), '.'))`;
+/**
+* WHERE fragments for a field filter. Values ride as JSON text and compare as
+* jsonb, so 5 matches 5 and false matches false; IS NOT DISTINCT FROM makes
+* null match JSON null (and absent fields, which extract to SQL NULL).
+*/
+function fieldFilters(where, next) {
+	const sql = [];
+	const params = [];
+	for (const [field, value] of Object.entries(where)) {
+		const column = META_COLUMNS[field];
+		if (column) {
+			sql.push(`${column} IS NOT DISTINCT FROM (${next()}::jsonb #>> '{}')`);
+			params.push(JSON.stringify(value));
+		} else {
+			sql.push(`${jsonAt("data", next())} IS NOT DISTINCT FROM (${next()}::jsonb)`);
+			params.push(`$.${field}`, JSON.stringify(value));
+		}
+	}
+	return {
+		sql,
+		params
+	};
+}
+/** Fresh 1-based $n placeholder counter per statement. */
+function counter() {
+	let n = 0;
+	return () => `$${++n}`;
+}
+const postgresDialect = {
+	name: "postgres",
+	fts: false,
+	ddl: DOC_STORE_DDL_PG,
+	insert(collection, id, data, now) {
+		return {
+			sql: "INSERT INTO _canopy_docs (collection, id, data, created_at, updated_at) VALUES ($1, $2, $3, $4, $5)",
+			params: [
+				collection,
+				id,
+				data,
+				now,
+				now
+			]
+		};
+	},
+	get(collection, id) {
+		return {
+			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs WHERE collection = $1 AND id = $2`,
+			params: [collection, id]
+		};
+	},
+	find({ collection, where, orderBy, order, limit, offset }) {
+		const next = counter();
+		const collectionParam = next();
+		const filters = fieldFilters(where, next);
+		const params = [collection, ...filters.params];
+		let orderExpr = "created_at";
+		if (orderBy !== void 0) {
+			const column = META_COLUMNS[orderBy];
+			if (column) orderExpr = column;
+			else {
+				orderExpr = jsonAt("data", next());
+				params.push(`$.${orderBy}`);
+			}
+		}
+		return {
+			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs
+        WHERE collection = ${collectionParam} ${filters.sql.map((f) => `AND ${f}`).join(" ")}
+        ORDER BY ${orderExpr} ${order === "desc" ? "DESC" : "ASC"}
+        LIMIT ${limit} OFFSET ${offset}`,
+			params
+		};
+	},
+	search({ collection, text, where, limit, offset }) {
+		const tokens = text.split(/\s+/).filter(Boolean);
+		if (tokens.length === 0) return null;
+		const next = counter();
+		const patternParam = next();
+		const collectionParam = next();
+		const filters = fieldFilters(where, next);
+		return {
+			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs
+        WHERE data ILIKE ${patternParam} AND collection = ${collectionParam}
+        ${filters.sql.map((f) => `AND ${f}`).join(" ")}
+        ORDER BY created_at
+        LIMIT ${limit} OFFSET ${offset}`,
+			params: [
+				`%${tokens.join("%")}%`,
+				collection,
+				...filters.params
+			]
+		};
+	},
+	patch(collection, id, patchJson, now) {
+		return {
+			sql: `UPDATE _canopy_docs SET data = (data::jsonb || $1::jsonb)::text, updated_at = $2
+        WHERE collection = $3 AND id = $4
+        RETURNING ${DOC_COLUMNS}`,
+			params: [
+				patchJson,
+				now,
+				collection,
+				id
+			]
+		};
+	},
+	del(collection, id) {
+		return {
+			sql: "DELETE FROM _canopy_docs WHERE collection = $1 AND id = $2",
+			params: [collection, id]
+		};
+	},
+	dropFtsIndex() {
+		return [];
+	},
+	rebuildFtsIndex() {
+		return [...DOC_STORE_DDL_PG];
+	}
+};
+//#endregion
+//#region ../data-plane/src/doc-store.ts
+/** Creates the doc store if missing. Idempotent; hosts decide when to memoize. */
+async function ensureDocStore(store, dialect) {
+	for (const ddl of dialect.ddl) await store.query(ddl);
+}
+//#endregion
+//#region ../data-plane/src/sql-dump.ts
+/**
+* SQL dump handling shared by canopy-api and the CLI's local sandbox.
+*/
+/**
+* Splits a SQL dump into statements: quote- and comment-aware. Dollar-quoted
+* strings (`$tag$…$tag$`) are treated as atomic so function bodies stay whole.
+* Also keeps SQLite CREATE TRIGGER … END bodies intact for older dumps.
+*/
+function splitSqlStatements(dump) {
+	const statements = [];
+	let current = "";
+	let i = 0;
+	while (i < dump.length) {
+		const ch = dump[i];
+		const pair = dump.slice(i, i + 2);
+		if (ch === "$") {
+			const tagMatch = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(dump.slice(i));
+			if (tagMatch) {
+				const tag = tagMatch[0];
+				current += tag;
+				i += tag.length;
+				const end = dump.indexOf(tag, i);
+				if (end === -1) {
+					current += dump.slice(i);
+					i = dump.length;
+				} else {
+					current += dump.slice(i, end + tag.length);
+					i = end + tag.length;
+				}
+				continue;
+			}
+		}
+		if (ch === "'" || ch === "\"" || ch === "`" || ch === "[") {
+			const close = ch === "[" ? "]" : ch;
+			current += ch;
+			i++;
+			while (i < dump.length) {
+				current += dump[i];
+				if (dump[i] === close) {
+					if (close !== "]" && dump[i + 1] === close) {
+						current += close;
+						i += 2;
+						continue;
+					}
+					i++;
+					break;
+				}
+				i++;
+			}
+		} else if (pair === "--") while (i < dump.length && dump[i] !== "\n") i++;
+		else if (pair === "/*") {
+			const end = dump.indexOf("*/", i + 2);
+			i = end === -1 ? dump.length : end + 2;
+		} else if (ch === ";") {
+			if (/^\s*CREATE\s+(TEMP(ORARY)?\s+)?TRIGGER/i.test(current) && !/\bEND\s*$/i.test(current)) current += ch;
+			else {
+				if (current.trim()) statements.push(current.trim());
+				current = "";
+			}
+			i++;
+		} else {
+			current += ch;
+			i++;
+		}
+	}
+	if (current.trim()) statements.push(current.trim());
+	return statements;
+}
+//#endregion
+//#region src/fs-blob.ts
+/**
+* Filesystem BlobBucket for `canopy dev --local` — same structural interface
+* as R2 / GCS (`@mediamonks/canopy-data-plane` BlobBucket).
+*/
+function metaPath(root, key) {
+	return join(root, `${key}.canopy-meta.json`);
+}
+function dataPath(root, key) {
+	return join(root, key);
+}
+function readMeta(root, key) {
+	const path = metaPath(root, key);
+	if (!existsSync(path)) return null;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function listKeys(root, prefix = "") {
+	if (!existsSync(root)) return [];
+	const out = [];
+	const walk = (dir) => {
+		for (const entry of readdirSync(dir, { withFileTypes: true })) {
+			const full = join(dir, entry.name);
+			if (entry.isDirectory()) {
+				walk(full);
+				continue;
+			}
+			if (entry.name.endsWith(".canopy-meta.json")) continue;
+			const key = relative(root, full).split(sep).join("/");
+			if (prefix && !key.startsWith(prefix)) continue;
+			out.push(key);
+		}
+	};
+	walk(root);
+	return out.sort();
+}
+/** In-memory blob store (tests / `persistDir: false`). */
+function createMemoryBlobBucket() {
+	const objects = /* @__PURE__ */ new Map();
+	return {
+		async put(key, body, options) {
+			objects.set(key, {
+				body,
+				meta: {
+					contentType: options?.httpMetadata?.contentType,
+					uploaded: (/* @__PURE__ */ new Date()).toISOString()
+				}
+			});
+			return {};
+		},
+		async get(key) {
+			const hit = objects.get(key);
+			if (!hit) return null;
+			const ab = hit.body;
+			return {
+				key,
+				size: ab.byteLength,
+				uploaded: new Date(hit.meta.uploaded),
+				httpMetadata: { contentType: hit.meta.contentType },
+				body: new ReadableStream({ start(controller) {
+					controller.enqueue(new Uint8Array(ab));
+					controller.close();
+				} }),
+				arrayBuffer: async () => ab
+			};
+		},
+		async head(key) {
+			const hit = objects.get(key);
+			if (!hit) return null;
+			return {
+				key,
+				size: hit.body.byteLength,
+				uploaded: new Date(hit.meta.uploaded),
+				httpMetadata: { contentType: hit.meta.contentType }
+			};
+		},
+		async list(options) {
+			const prefix = options?.prefix ?? "";
+			return {
+				objects: [...objects.keys()].filter((k) => k.startsWith(prefix)).sort().map((key) => {
+					const hit = objects.get(key);
+					return {
+						key,
+						size: hit.body.byteLength,
+						uploaded: new Date(hit.meta.uploaded),
+						httpMetadata: { contentType: hit.meta.contentType }
+					};
+				}),
+				truncated: false
+			};
+		},
+		async delete(key) {
+			objects.delete(key);
+		}
+	};
+}
+/** Filesystem-backed blob store under `root/`. */
+function createFsBlobBucket(root) {
+	mkdirSync(root, { recursive: true });
+	return {
+		async put(key, body, options) {
+			const path = dataPath(root, key);
+			mkdirSync(dirname(path), { recursive: true });
+			writeFileSync(path, Buffer.from(body));
+			writeFileSync(metaPath(root, key), `${JSON.stringify({
+				contentType: options?.httpMetadata?.contentType,
+				uploaded: (/* @__PURE__ */ new Date()).toISOString()
+			})}\n`);
+			return {};
+		},
+		async get(key) {
+			const path = dataPath(root, key);
+			if (!existsSync(path)) return null;
+			const buf = readFileSync(path);
+			const ab = buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+			const meta = readMeta(root, key) ?? { uploaded: statSync(path).mtime.toISOString() };
+			return {
+				key,
+				size: ab.byteLength,
+				uploaded: new Date(meta.uploaded),
+				httpMetadata: { contentType: meta.contentType },
+				body: new ReadableStream({ start(controller) {
+					controller.enqueue(new Uint8Array(ab));
+					controller.close();
+				} }),
+				arrayBuffer: async () => ab
+			};
+		},
+		async head(key) {
+			const path = dataPath(root, key);
+			if (!existsSync(path)) return null;
+			const st = statSync(path);
+			const meta = readMeta(root, key) ?? { uploaded: st.mtime.toISOString() };
+			return {
+				key,
+				size: st.size,
+				uploaded: new Date(meta.uploaded),
+				httpMetadata: { contentType: meta.contentType }
+			};
+		},
+		async list(options) {
+			const keys = listKeys(root, options?.prefix ?? "");
+			const objects = [];
+			for (const key of keys) {
+				const h = await this.head(key);
+				if (h) objects.push(h);
+			}
+			return {
+				objects,
+				truncated: false
+			};
+		},
+		async delete(key) {
+			const path = dataPath(root, key);
+			if (existsSync(path)) rmSync(path);
+			const meta = metaPath(root, key);
+			if (existsSync(meta)) rmSync(meta);
+		}
+	};
+}
+//#endregion
+//#region src/local.ts
+/**
+* canopy dev --local — the offline sandbox (docs/02-decisions.md D12,
+* docs/05-gcp-plan.md §10.2 / Phase G4): PGlite + filesystem blobs under the
+* project's .canopy/local/, answering the SDK's data plane with THE SAME
+* routers canopy-api mounts (@mediamonks/canopy-data-plane) — the sandbox can't
+* drift from the platform because they share the implementation.
+*
+* Sync is pull-only: `--pull` hydrates the local database from a fresh prod
+* export; nothing ever pushes back. ai/services aren't data — dev.ts proxies
+* them to the real platform when logged in (metered as usual), and only the
+* offline case lands on the 501 stub here.
+*/
+/** Locate the built browser SDK, served as /_api/data/v1/sdk.js in the sandbox. */
+function resolveSdkBundle() {
+	const bundle = join(dirname(createRequire(import.meta.url).resolve("@mediamonks/canopy/package.json")), "dist/index.mjs");
+	if (!existsSync(bundle)) throw new Error("The local sandbox serves the SDK from @mediamonks/canopy/dist, which is not built — run `pnpm --filter @mediamonks/canopy build` once.");
+	return bundle;
+}
+/** Downloads a fresh SQL dump of the project's production database (pull-only sync). */
+async function fetchProjectDump(slug) {
+	const { url } = await apiDataRequest("POST", "/db/export", slug);
+	const download = await fetch(url);
+	if (!download.ok) throw new Error(`Dump download failed (HTTP ${download.status}).`);
+	return download.text();
+}
+async function createSandbox(options) {
+	const { PGlite } = await import("@electric-sql/pglite");
+	const dataDir = options.persistDir ? join(options.persistDir, "pg") : void 0;
+	if (dataDir) mkdirSync(dataDir, { recursive: true });
+	const db = dataDir ? new PGlite(dataDir) : new PGlite();
+	await db.waitReady;
+	const bucket = options.persistDir ? createFsBlobBucket(join(options.persistDir, "blob")) : createMemoryBlobBucket();
+	const store = { query: async (sql, params = []) => {
+		const result = await db.query(sql, params);
+		return {
+			results: result.rows,
+			meta: { changes: Number(result.affectedRows ?? 0) }
+		};
+	} };
+	await ensureDocStore(store, postgresDialect);
+	const app = new Hono();
+	const ownProject = (c) => {
+		const requested = c.req.header("x-canopy-project") ?? c.req.query("project");
+		return requested === void 0 || requested === options.slug ? null : c.json({ error: "project_not_found" }, 404);
+	};
+	app.route("/data/v1", dbRouter({ store: async (c) => ownProject(c) ?? {
+		store,
+		dialect: postgresDialect
+	} }));
+	app.route("/data/v1", blobRouter({
+		store: async (c) => ownProject(c) ?? {
+			slug: options.slug,
+			store: {
+				bucket,
+				prefix: ""
+			}
+		},
+		signDownload: async () => "local"
+	}));
+	app.get("/data/v1/sdk.js", () => {
+		return new Response(readFileSync(resolveSdkBundle(), "utf8"), { headers: {
+			"content-type": "text/javascript",
+			"cache-control": "no-store"
+		} });
+	});
+	app.get("/data/v1/auth/me", (c) => c.json({
+		id: "local-dev",
+		email: options.email ?? "dev@localhost",
+		name: "Local Dev",
+		kind: "monk"
+	}));
+	app.all("/data/v1/ai/*", (c) => c.json({
+		error: "not_available_in_local_dev",
+		detail: "ai needs the platform — log in (`canopy login`) so --local can proxy it."
+	}, 501));
+	app.all("/data/v1/services/*", (c) => c.json({
+		error: "not_available_in_local_dev",
+		detail: "services need the platform — log in (`canopy login`) so --local can proxy them."
+	}, 501));
+	app.notFound((c) => c.json({
+		error: "not_available_in_local_dev",
+		detail: "the local sandbox serves the data plane only (db, blob, auth.user, sdk.js) — control-plane calls need `canopy dev` against the platform."
+	}, 501));
+	async function handle(request) {
+		const url = new URL(request.url);
+		let pathname = url.pathname;
+		if (pathname.startsWith("/_api/") || pathname === "/_api") pathname = rewriteApiPath(pathname);
+		else if (!pathname.startsWith("/data/v1/") && !pathname.startsWith("/control/v1/")) return Response.json({ error: "not_found" }, { status: 404 });
+		return app.fetch(new Request(`http://sandbox${pathname}${url.search}`, request));
+	}
+	/** Drop every user table so a dump lands on a clean slate. */
+	async function resetLocal() {
+		const tables = (await db.query(`SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`)).rows;
+		for (const { tablename } of tables) await db.exec(`DROP TABLE IF EXISTS "${tablename.replaceAll("\"", "\"\"")}" CASCADE`);
+	}
+	async function applyDump(sql) {
+		await resetLocal();
+		for (const statement of splitSqlStatements(sql)) {
+			if (/^(BEGIN|COMMIT|ROLLBACK|SET\s+search_path|PRAGMA)\b/i.test(statement)) continue;
+			try {
+				await db.exec(statement);
+			} catch (err) {
+				throw new Error(`Dump statement failed: ${err instanceof Error ? err.message : String(err)}\n  in: ${statement.slice(0, 120)}${statement.length > 120 ? "…" : ""}`);
+			}
+		}
+		await ensureDocStore(store, postgresDialect);
+	}
+	return {
+		handle,
+		applyDump,
+		dispose: async () => {
+			await db.close();
+			if (options.persistDir === false && dataDir && existsSync(dataDir)) rmSync(dataDir, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+}
+//#endregion
+export { createSandbox, fetchProjectDump };