@mediamonks/canopy-cli 0.4.5 → 0.5.0

package/dist/login-Bz-rwlFF.mjs

@@ -0,0 +1,264 @@
+import { d as readConfigFile, f as setActiveProfile, g as isProfileId, h as getBakedProfile, l as clearAllProfileTokens, m as writeConfigFile, n as siteConfig, p as upsertProfileAuth, u as listBakedProfiles } from "./site-BJjoePQS.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-DThlyHgo.mjs";
+import { defineCommand } from "citty";
+import * as p from "@clack/prompts";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+//#region src/login.ts
+/**
+* canopy login | whoami | logout — browser PKCE flow against OneLogin (public
+* client), then trade the ID token for platform CLI tokens via POST
+* /control/v1/auth/cli-token on every baked site (docs/10-cli-sites.md D17).
+*/
+const CALLBACK_PORT = 8976;
+const REDIRECT_URI = `http://127.0.0.1:${CALLBACK_PORT}/callback`;
+const LOGIN_TIMEOUT_MS = 300 * 1e3;
+const base64url = (buf) => buf.toString("base64url");
+const whoamiCommand = defineCommand({
+	meta: {
+		name: "whoami",
+		description: "Show the current Canopy login"
+	},
+	run: reportErrors("whoami", async () => {
+		const config = siteConfig();
+		if (!config.token) throw new Error("Not logged in — run `canopy login`.");
+		console.log(config.email ?? "<unknown email>");
+		if (config.cloud) console.log(`Cloud: ${config.cloud}`);
+		console.log(`API: ${config.apiUrl}`);
+		if (config.tokenExpiresAt !== void 0) {
+			const expired = Date.parse(config.tokenExpiresAt) < Date.now();
+			console.log(expired ? `Token EXPIRED ${config.tokenExpiresAt} — run \`canopy login\` again.` : `Token expires ${config.tokenExpiresAt}.`);
+		}
+	})
+});
+const logoutCommand = defineCommand({
+	meta: {
+		name: "logout",
+		description: "Sign out: forget all local CLI tokens"
+	},
+	run: reportErrors("logout", async () => {
+		const file = readConfigFile();
+		if (!Object.values(file.profiles ?? {}).some((p) => p?.token)) {
+			console.log("Not logged in.");
+			return;
+		}
+		clearAllProfileTokens();
+		console.log("Logged out — all site tokens removed from ~/.canopy/config.json.");
+	})
+});
+/** Wait for OneLogin to redirect back to the local loopback server. */
+function waitForCallback(expectedState) {
+	return new Promise((resolve, reject) => {
+		const server = createServer((req, res) => {
+			const url = new URL(req.url ?? "/", REDIRECT_URI);
+			if (url.pathname !== "/callback") {
+				res.writeHead(404).end();
+				return;
+			}
+			const code = url.searchParams.get("code");
+			const state = url.searchParams.get("state");
+			const ok = Boolean(code) && state === expectedState;
+			res.writeHead(ok ? 200 : 400, { "content-type": "text/html" }).end(ok ? "<h1>Logged in</h1><p>You can close this tab and return to the terminal.</p>" : "<h1>Login failed</h1><p>Return to the terminal and try again.</p>");
+			server.close();
+			clearTimeout(timer);
+			if (ok) resolve(code);
+			else reject(new Error(url.searchParams.get("error_description") ?? "Login rejected"));
+		});
+		const timer = setTimeout(() => {
+			server.close();
+			reject(/* @__PURE__ */ new Error("Timed out waiting for the browser login (5 minutes)."));
+		}, LOGIN_TIMEOUT_MS);
+		server.on("error", (err) => reject(err.message.includes("EADDRINUSE") ? /* @__PURE__ */ new Error(`Port ${CALLBACK_PORT} is in use — close the other process and retry.`) : err));
+		server.listen(CALLBACK_PORT, "127.0.0.1");
+	});
+}
+async function pickActiveProfile(json, flag) {
+	if (flag) {
+		if (!isProfileId(flag)) throw new Error(`Unknown profile "${flag}". Choose one of: ${listBakedProfiles().map((p) => p.id).join(", ")}.`);
+		return flag;
+	}
+	const env = process.env["CANOPY_PROFILE"]?.trim();
+	if (env) {
+		if (!isProfileId(env)) throw new Error(`Unknown CANOPY_PROFILE "${env}".`);
+		return env;
+	}
+	const profiles = listBakedProfiles();
+	if (!process.stdin.isTTY || json) throw new Error(`Pass --profile <id> (or CANOPY_PROFILE) when not on a TTY. Options: ${profiles.map((p) => p.id).join(", ")}.`);
+	const choice = await p.select({
+		message: "Which Canopy site should be your default?",
+		options: profiles.map((prof) => ({
+			value: prof.id,
+			label: prof.label,
+			hint: prof.cloud
+		})),
+		initialValue: "main"
+	});
+	if (p.isCancel(choice)) {
+		p.cancel("Login cancelled.");
+		process.exit(1);
+	}
+	p.note(`Using profile "${choice}". Agents/non-TTY: canopy login --profile ${choice}`, "Active profile");
+	return choice;
+}
+async function mintForProfile(id, idToken) {
+	const baked = getBakedProfile(id);
+	try {
+		const cliTokenRes = await fetch(`${baked.apiUrl}/control/v1/auth/cli-token`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ id_token: idToken })
+		});
+		if (!cliTokenRes.ok) return {
+			ok: false,
+			error: `${cliTokenRes.status} ${await cliTokenRes.text()}`
+		};
+		const { token, expires_at, user } = await cliTokenRes.json();
+		upsertProfileAuth(id, {
+			token,
+			tokenExpiresAt: expires_at,
+			email: user.email
+		});
+		return {
+			ok: true,
+			email: user.email,
+			expiresAt: expires_at
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+async function login(json, profileFlag) {
+	if (!json) p.intro("canopy login");
+	const active = await pickActiveProfile(json, profileFlag);
+	const file = readConfigFile();
+	const { issuer, cliClientId } = {
+		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? file.issuer ?? "https://s4capital.onelogin.com/oidc/2",
+		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? file.cliClientId ?? "b69755d0-6678-013f-b5ce-09fe44a57aa0180501"
+	};
+	if (cliClientId.includes("REPLACE")) throw new Error("The CLI's OneLogin app is not configured yet (set CANOPY_OIDC_CLIENT_ID or packages/cli/src/config.ts).");
+	writeConfigFile({
+		...file,
+		issuer,
+		cliClientId,
+		activeProfile: active
+	});
+	const discoveryRes = await fetch(`${issuer}/.well-known/openid-configuration`);
+	if (!discoveryRes.ok) throw new Error(`OIDC discovery failed: ${discoveryRes.status}`);
+	const discovery = await discoveryRes.json();
+	const state = base64url(randomBytes(32));
+	const codeVerifier = base64url(randomBytes(32));
+	const authorizeUrl = new URL(discovery.authorization_endpoint);
+	authorizeUrl.search = new URLSearchParams({
+		response_type: "code",
+		client_id: cliClientId,
+		redirect_uri: REDIRECT_URI,
+		scope: "openid profile email",
+		state,
+		code_challenge: base64url(createHash("sha256").update(codeVerifier).digest()),
+		code_challenge_method: "S256"
+	}).toString();
+	const authorizeHref = authorizeUrl.toString();
+	openBrowser(authorizeHref);
+	const spin = json ? void 0 : p.spinner();
+	if (json) console.log(JSON.stringify({
+		status: "waiting",
+		url: authorizeHref
+	}));
+	else {
+		p.note(`If nothing opens, visit:\n${authorizeHref}`, "Opening OneLogin in your browser");
+		spin?.start("Waiting for you to sign in in the browser…");
+	}
+	let code;
+	try {
+		code = await waitForCallback(state);
+	} catch (err) {
+		spin?.error("Sign-in failed.");
+		throw err;
+	}
+	spin?.stop("Signed in with OneLogin.");
+	const tokenRes = await fetch(discovery.token_endpoint, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: cliClientId,
+			code,
+			redirect_uri: REDIRECT_URI,
+			code_verifier: codeVerifier
+		})
+	});
+	if (!tokenRes.ok) throw new Error(`Token exchange failed: ${tokenRes.status} ${await tokenRes.text()}`);
+	const { id_token: idToken } = await tokenRes.json();
+	if (!idToken) throw new Error("OneLogin returned no id_token.");
+	const mintSpin = json ? void 0 : p.spinner();
+	mintSpin?.start("Minting CLI tokens for each site…");
+	const results = [];
+	for (const prof of listBakedProfiles()) {
+		const result = await mintForProfile(prof.id, idToken);
+		results.push({
+			id: prof.id,
+			ok: result.ok,
+			detail: result.ok ? `expires ${result.expiresAt}` : result.error
+		});
+	}
+	mintSpin?.stop("Token mint finished.");
+	if (!results.find((r) => r.id === active)?.ok) {
+		const summary = results.map((r) => `${r.id} ${r.ok ? "✓" : "✗"}`).join("  ");
+		throw new Error(`Could not mint a token for active profile "${active}". ${summary}. Re-run \`canopy login\`.`);
+	}
+	setActiveProfile(active);
+	const email = readConfigFile().profiles?.[active]?.email;
+	const summary = results.map((r) => `${r.id} ${r.ok ? "✓" : `✗ (${r.detail})`}`).join("\n");
+	if (json) console.log(JSON.stringify({
+		status: "ok",
+		email,
+		activeProfile: active,
+		profiles: Object.fromEntries(results.map((r) => [r.id, {
+			ok: r.ok,
+			detail: r.detail
+		}]))
+	}));
+	else {
+		p.note(summary, "Sites");
+		p.outro(`Logged in as ${email ?? "unknown"} — default profile "${active}".`);
+		for (const r of results.filter((x) => !x.ok)) p.log.warn(`${r.id} failed — re-run \`canopy login\` to retry all sites.`);
+	}
+}
+const loginCommand = defineCommand({
+	meta: {
+		name: "login",
+		description: "Sign in to Canopy via OneLogin"
+	},
+	args: {
+		json: {
+			type: "boolean",
+			default: false,
+			description: "Emit machine-readable status to stdout (for agents/CI)"
+		},
+		profile: {
+			type: "string",
+			description: "Active default profile (main | staging | gcp-pilot); required non-TTY"
+		}
+	},
+	run: reportErrors("login", async ({ args }) => {
+		const json = args.json;
+		try {
+			await login(json, args.profile);
+		} catch (err) {
+			if (json) {
+				console.log(JSON.stringify({
+					status: "error",
+					message: err instanceof Error ? err.message : String(err)
+				}));
+				process.exitCode = 1;
+				return;
+			}
+			throw err;
+		}
+	})
+});
+//#endregion
+export { loginCommand, logoutCommand, whoamiCommand };

package/dist/{open-CBuZBJlv.mjs → open-DnlYDqrU.mjs}

@@ -1,5 +1,5 @@
-import { n as reportErrors, t as openBrowser } from "./ui-D1DXoDN1.mjs";
-import { i as resolveProject, r as projectUrl, t as projectDirArgs } from "./project-DKbgJACM.mjs";
+import { i as projectDirArgs, o as projectUrl, s as resolveProject } from "./site-BJjoePQS.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-DThlyHgo.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-Bnu23N0A.mjs → package-Bi5FfVSP.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.4.5";
+var version = "0.5.0";
 //#endregion
 export { version as t };

package/dist/{projects-CK4DNxgZ.mjs → projects-ijfe7Ffx.mjs}

@@ -1,5 +1,5 @@
-import { i as unwrap, n as reportErrors, r as requireTty, s as apiRequest } from "./ui-D1DXoDN1.mjs";
-import { a as tryReadCanopyJson, r as projectUrl } from "./project-DKbgJACM.mjs";
+import { c as tryReadCanopyJson, n as siteConfig, o as projectUrl } from "./site-BJjoePQS.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-DThlyHgo.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
@@ -64,6 +64,16 @@ function scaffoldTemplate(templateId, targetDir, vars) {
 * scaffolds ./<slug>/ from the starter template (--no-scaffold to skip, e.g.
 * for an existing directory).
 */
+/** Write/update canopy.json with the effective profile pin (D17). */
+function writeCanopyJson(dir, fields) {
+	const profile = siteConfig().profileId;
+	const next = {
+		...tryReadCanopyJson(dir) ?? {},
+		...fields,
+		...profile ? { profile } : {}
+	};
+	writeFileSync(join(dir, "canopy.json"), `${JSON.stringify(next, null, 2)}\n`);
+}
 function slugify(input) {
 	return input.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/(^-+|-+$)/g, "").slice(0, 40);
 }
@@ -145,6 +155,10 @@ const createCommand = defineCommand({
 				name,
 				slug
 			});
+			writeCanopyJson(targetDir, {
+				...tryReadCanopyJson(targetDir),
+				slug
+			});
 			const steps = [
 				`cd ${slug}`,
 				...template.needsInstall ? ["npm install"] : [],
@@ -232,6 +246,10 @@ const initCommand = defineCommand({
 				name: project.name,
 				slug
 			});
+			writeCanopyJson(targetDir, {
+				...tryReadCanopyJson(targetDir),
+				slug
+			});
 			const steps = [
 				...rel === "." ? [] : [`cd ${rel}`],
 				...template.needsInstall ? ["npm install"] : [],
@@ -248,7 +266,7 @@ const initCommand = defineCommand({
 			p.outro(`${rel} is already linked to ${slug}.`);
 			return;
 		}
-		writeFileSync(join(targetDir, "canopy.json"), `${JSON.stringify({ slug }, null, 2)}\n`);
+		writeCanopyJson(targetDir, { slug });
 		p.note("Add \"dist\"/\"build\" to canopy.json if this app has a build step, then:\ncanopy deploy", `Linked ${rel} to ${slug}`);
 		p.outro(`Live URL (after first deploy): ${projectUrl(slug)}`);
 	})

package/dist/site-BJjoePQS.mjs

@@ -0,0 +1,254 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+//#region src/profiles.ts
+const BAKED_PROFILES = [
+	{
+		id: "main",
+		label: "main (canopy.website)",
+		cloud: "cloudflare",
+		apiUrl: "https://api.canopy.website",
+		projectDomain: "canopy.website"
+	},
+	{
+		id: "staging",
+		label: "staging (thanarie.dev)",
+		cloud: "cloudflare",
+		apiUrl: "https://api.thanarie.dev",
+		projectDomain: "thanarie.dev"
+	},
+	{
+		id: "gcp-pilot",
+		label: "gcp-pilot (canopy.monks.zone)",
+		cloud: "gcp",
+		apiUrl: "https://api.canopy.monks.zone",
+		projectDomain: "canopy.monks.zone"
+	}
+];
+const DEFAULT_PROFILE_ID = "main";
+const byId = new Map(BAKED_PROFILES.map((p) => [p.id, p]));
+function isProfileId(value) {
+	return byId.has(value);
+}
+function getBakedProfile(id) {
+	return byId.get(id);
+}
+/** Map a legacy/env apiUrl back to a baked profile when possible. */
+function profileIdForApiUrl(apiUrl) {
+	const normalized = apiUrl.replace(/\/$/, "");
+	for (const profile of BAKED_PROFILES) if (profile.apiUrl === normalized) return profile.id;
+	if (normalized.includes("monks.workers.dev") || normalized.includes("canopy.website")) return "main";
+	if (normalized.includes("arjan-van-wijk.workers.dev") || normalized.includes("thanarie.dev")) return "staging";
+	if (normalized.includes("run.app") || normalized.includes("canopy.monks.zone")) return "gcp-pilot";
+}
+//#endregion
+//#region src/config.ts
+/**
+* CLI config at ~/.canopy/config.json — active profile + per-site tokens
+* (docs/10-cli-sites.md D17). Baked apiUrl/projectDomain live in profiles.ts.
+*
+* Env overrides: CANOPY_PROFILE, CANOPY_API_URL, CANOPY_OIDC_ISSUER,
+* CANOPY_OIDC_CLIENT_ID, CANOPY_PROJECT_DOMAIN, CANOPY_PROJECT_PROTOCOL.
+*/
+const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
+const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
+const configDir = join(homedir(), ".canopy");
+const configPath = join(configDir, "config.json");
+function readRaw() {
+	try {
+		return JSON.parse(readFileSync(configPath, "utf8"));
+	} catch {
+		return {};
+	}
+}
+/** Migrate legacy flat `{ apiUrl, token }` into `profiles` + `activeProfile`. */
+function migrateConfigFile(stored) {
+	if (stored.profiles && Object.keys(stored.profiles).length > 0) return stored;
+	if (!stored.token && !stored.apiUrl) return stored;
+	const id = (stored.activeProfile && isProfileId(stored.activeProfile) ? stored.activeProfile : void 0) ?? (stored.apiUrl ? profileIdForApiUrl(stored.apiUrl) : void 0) ?? "main";
+	return {
+		activeProfile: id,
+		profiles: { [id]: {
+			token: stored.token,
+			tokenExpiresAt: stored.tokenExpiresAt,
+			email: stored.email
+		} },
+		issuer: stored.issuer,
+		cliClientId: stored.cliClientId
+	};
+}
+function readConfigFile() {
+	const raw = readRaw();
+	const migrated = migrateConfigFile(raw);
+	if (raw.token && !raw.profiles) writeConfigFile(migrated);
+	return migrated;
+}
+function writeConfigFile(config) {
+	mkdirSync(configDir, { recursive: true });
+	const clean = {
+		activeProfile: config.activeProfile,
+		profiles: config.profiles,
+		issuer: config.issuer,
+		cliClientId: config.cliClientId
+	};
+	writeFileSync(configPath, `${JSON.stringify(clean, null, 2)}\n`);
+	chmodSync(configPath, 384);
+}
+/**
+* Resolve which site this invocation talks to.
+* Precedence: --profile / CANOPY_PROFILE → canopy.json → activeProfile → main.
+* Then CANOPY_API_URL / domain envs may override the baked URL.
+*/
+function resolveConfig(opts = {}) {
+	const file = readConfigFile();
+	const envProfile = process.env["CANOPY_PROFILE"]?.trim();
+	const requested = opts.profileFlag?.trim() || envProfile || opts.projectProfile?.trim() || file.activeProfile;
+	const profileId = requested && isProfileId(requested) ? requested : requested ? void 0 : DEFAULT_PROFILE_ID;
+	const baked = profileId ? getBakedProfile(profileId) : void 0;
+	const auth = profileId ? file.profiles?.[profileId] : void 0;
+	const envApi = process.env["CANOPY_API_URL"];
+	const envDomain = process.env["CANOPY_PROJECT_DOMAIN"];
+	const envProto = process.env["CANOPY_PROJECT_PROTOCOL"]?.trim();
+	const apiUrl = envApi ?? baked?.apiUrl ?? getBakedProfile("main").apiUrl;
+	const projectDomain = envDomain !== void 0 ? envDomain.trim() || void 0 : baked?.projectDomain ?? void 0;
+	const projectProtocol = (() => {
+		if (envProto === "http" || envProto === "https") return envProto;
+		return baked?.projectProtocol;
+	})();
+	return {
+		profileId: profileId ?? profileIdForApiUrl(apiUrl),
+		apiUrl,
+		projectDomain,
+		projectProtocol,
+		cloud: baked?.cloud,
+		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? file.issuer ?? DEFAULT_ISSUER,
+		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? file.cliClientId ?? DEFAULT_CLI_CLIENT_ID,
+		token: auth?.token,
+		tokenExpiresAt: auth?.tokenExpiresAt,
+		email: auth?.email,
+		envOverride: envApi !== void 0 || envDomain !== void 0,
+		projectProfile: opts.projectProfile
+	};
+}
+function listBakedProfiles() {
+	return BAKED_PROFILES;
+}
+function setActiveProfile(id) {
+	writeConfigFile({
+		...readConfigFile(),
+		activeProfile: id
+	});
+}
+function upsertProfileAuth(id, auth) {
+	const file = readConfigFile();
+	writeConfigFile({
+		...file,
+		activeProfile: file.activeProfile ?? id,
+		profiles: {
+			...file.profiles,
+			[id]: {
+				...file.profiles?.[id],
+				...auth
+			}
+		}
+	});
+}
+function clearAllProfileTokens() {
+	writeConfigFile({
+		...readConfigFile(),
+		profiles: {}
+	});
+}
+//#endregion
+//#region src/project.ts
+/**
+* Which project is a command about? Every project-scoped command resolves it
+* the same way: `--project <slug>` wins, otherwise canopy.json in the target
+* directory (the optional [dir] positional, defaulting to the cwd).
+*/
+/** The wildcard apex projects are served under (`slug.<domain>`). */
+function projectUrl(slug) {
+	const config = siteConfig();
+	const apex = config.projectDomain?.trim();
+	if (apex) return `${config.projectProtocol ?? (apex.includes("sslip.io") ? "http" : "https")}://${slug}.${apex.replace(/^\./, "")}`;
+	const apiHost = new URL(config.apiUrl).hostname;
+	if (apiHost === "run.app" || apiHost.endsWith(".run.app") || apiHost.startsWith("api.")) throw new Error("Cannot derive the project URL. Set projectDomain (baked profile or CANOPY_PROJECT_DOMAIN).");
+	return `https://${slug}.${apiHost.split(".").slice(-2).join(".")}`;
+}
+/** canopy.json parsed if present; undefined when the file is missing. */
+function tryReadCanopyJson(dir) {
+	let raw;
+	try {
+		raw = readFileSync(join(dir, "canopy.json"), "utf8");
+	} catch {
+		return;
+	}
+	return JSON.parse(raw);
+}
+function readCanopyJson(dir) {
+	const config = tryReadCanopyJson(dir);
+	if (config === void 0) throw new Error(`No canopy.json in ${dir} — run from a project created by \`canopy create\`, add one ({"slug": "<slug>", "dist": "dist"}), or pass --project <slug>.`);
+	if (!config.slug) throw new Error("canopy.json is missing \"slug\".");
+	return config;
+}
+/** For commands scoped to a project but not to a directory (db, rollback). */
+const projectFlagArgs = { project: {
+	type: "string",
+	description: "Project slug (overrides canopy.json in the target directory)"
+} };
+/** For commands that operate on a project directory (dev, deploy, open). */
+const projectDirArgs = {
+	dir: {
+		type: "positional",
+		description: "Project directory (defaults to the current directory)",
+		required: false
+	},
+	...projectFlagArgs
+};
+/** Resolve the target directory and project slug from the shared args. */
+function resolveProject(args) {
+	const dir = resolve(args.dir ?? ".");
+	setProjectDirForPin(dir);
+	return {
+		dir,
+		slug: args.project ?? readCanopyJson(dir).slug
+	};
+}
+//#endregion
+//#region src/site.ts
+/**
+* Per-invocation site resolution (docs/10-cli-sites.md D17).
+* Set once from global --profile / CANOPY_PROFILE + optional canopy.json pin.
+*/
+let invocationProfile;
+let projectDirForPin;
+let mismatchNoticed = false;
+function setInvocationProfile(profile) {
+	invocationProfile = profile?.trim() || void 0;
+}
+function setProjectDirForPin(dir) {
+	projectDirForPin = dir;
+}
+function projectProfileFromCwd() {
+	return tryReadCanopyJson(projectDirForPin ?? ".")?.profile;
+}
+/** Resolved site for this process (cached per call args — cheap). */
+function siteConfig() {
+	const projectProfile = projectProfileFromCwd();
+	const config = resolveConfig({
+		profileFlag: invocationProfile,
+		projectProfile
+	});
+	if (!mismatchNoticed && projectProfile && config.profileId && projectProfile !== config.profileId && (invocationProfile || process.env["CANOPY_PROFILE"])) {
+		mismatchNoticed = true;
+		console.error(`note: canopy.json pins profile "${projectProfile}" but this command uses "${config.profileId}"`);
+	}
+	return config;
+}
+/** One-line context for command headers. */
+function siteHeaderLine(cliVersion) {
+	const c = siteConfig();
+	return `canopy ${cliVersion} · ${c.envOverride || !c.profileId ? c.apiUrl : `${c.profileId} (${c.projectDomain ?? new URL(c.apiUrl).hostname})`}`;
+}
+//#endregion
+export { projectFlagArgs as a, tryReadCanopyJson as c, readConfigFile as d, setActiveProfile as f, isProfileId as g, getBakedProfile as h, projectDirArgs as i, clearAllProfileTokens as l, writeConfigFile as m, siteConfig as n, projectUrl as o, upsertProfileAuth as p, siteHeaderLine as r, resolveProject as s, setInvocationProfile as t, listBakedProfiles as u };

package/dist/skill/canopy/SKILL.md

@@ -99,7 +99,7 @@ truth and never go stale.
 Both `canopy create` and `canopy init` scaffold from the same three templates.
 **`static` is the default, but reach
 for it only when the app is genuinely trivial** — a page or two with light SDK
-use. Its SDK is served untyped from the platform (`/_api/v1/sdk.js`): no
+use. Its SDK is served untyped from the platform (`/_api/data/v1/sdk.js`): no
 autocomplete, no type-checking, mistakes only show up in the browser.
 
 Prefer **`spa`** the moment either is true — which covers most real projects:

package/dist/{skill-h7QlCMhc.mjs → skill-IAAa2EkK.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-Bnu23N0A.mjs";
-import { n as reportErrors } from "./ui-D1DXoDN1.mjs";
+import { t as version } from "./package-Bi5FfVSP.mjs";
+import { n as reportErrors } from "./ui-DThlyHgo.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";

package/dist/templates/static/AGENTS.md

@@ -21,7 +21,7 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
 
 - Plain html/css/js in this directory — no bundler, no install step. The
   Canopy SDK is imported straight from the platform, so it always matches the
-  API version: `import { createCanopy } from "/_api/v1/sdk.js";`
+  API version: `import { createCanopy } from "/_api/data/v1/sdk.js";`
 - `canopy dev` — local dev server; its `/_api` proxies to the real platform.
   That is LIVE project data: read freely, but take a `canopy db snapshot`
   before risky data changes.

package/dist/templates/static/main.js

@@ -1,7 +1,7 @@
 // The Canopy SDK is served by the platform itself — nothing to install.
 // Auth (auth), data (db), files (blob) and AI (ai) are all live — see
 // AGENTS.md for how to get the full SDK reference.
-import { createCanopy } from "/_api/v1/sdk.js";
+import { createCanopy } from "/_api/data/v1/sdk.js";
 
 const canopy = createCanopy();
 

package/dist/templates/worker/AGENTS.md

@@ -5,9 +5,8 @@ A Vite + React single-page app plus a per-project backend Worker on
 projects. Everything is served behind company login; there is no
 infrastructure to manage and none should be added.
 
-> **Phase 2 preview:** per-project Workers are not deployable yet.
-> `canopy deploy` publishes the frontend only; `worker/` is picked up
-> automatically once the platform supports it.
+> On GCP, `canopy deploy` publishes the frontend **and** the `worker/`
+> backend (Cloud Run). Cloudflare WfP upload is still Phase 2.
 
 ## Canopy skill
 
@@ -27,10 +26,11 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
 - Frontend: a standard Vite + React + TypeScript app in `src/`; `npm install`
   once, then develop with `canopy dev` (it runs Vite with this project's
   `vite.config.ts` and proxies `/_api` to the platform).
-- Backend: Hono-style handlers in `worker/index.ts`, serving `/api/*`. It runs
-  behind the Canopy gateway (requests arrive authenticated) and reaches the
-  platform through a service binding — same SDK, same budgets and data
-  isolation as the browser.
+- Backend: Hono-style handlers in `worker/index.ts`, serving `/api/*`, plus an
+  optional `scheduled(event, env)` for dashboard Schedules (switch on
+  `event.name`). It runs behind the Canopy gateway (HTTP requests arrive
+  authenticated) and reaches the platform through a service binding — same
+  SDK, same budgets and data isolation as the browser.
 - The SDK comes from npm (`@mediamonks/canopy`) — the browser's shared
   instance lives in `src/canopy.ts`.
 - `canopy dev` uses LIVE project data: read freely, but take a
@@ -44,8 +44,10 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
 
 - Do not add auth — the platform authenticates every request before it
   reaches this app or the Worker.
-- Do not store secrets anywhere in this project — platform access goes
+- Do not store secrets in the repo or SPA. Set them in the Canopy dashboard
+  (Settings → Secrets); the Worker reads them as `c.env.SECRET_NAME`
+  (Workers-shaped bindings — not `process.env`). Platform access still goes
   through the Canopy SDK (`canopy.auth`, `canopy.db`, `canopy.blob`,
   `canopy.ai`) in both the browser and the Worker.
 - The Worker is the only backend: no SSR, no long-running processes, no
-  databases outside `canopy.db`.
+  databases outside `canopy.db` / `c.env.DB`.