@mediamonks/canopy-cli 0.4.5 → 0.5.1

package/dist/site-BJjoePQS.mjs

@@ -0,0 +1,254 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+//#region src/profiles.ts
+const BAKED_PROFILES = [
+	{
+		id: "main",
+		label: "main (canopy.website)",
+		cloud: "cloudflare",
+		apiUrl: "https://api.canopy.website",
+		projectDomain: "canopy.website"
+	},
+	{
+		id: "staging",
+		label: "staging (thanarie.dev)",
+		cloud: "cloudflare",
+		apiUrl: "https://api.thanarie.dev",
+		projectDomain: "thanarie.dev"
+	},
+	{
+		id: "gcp-pilot",
+		label: "gcp-pilot (canopy.monks.zone)",
+		cloud: "gcp",
+		apiUrl: "https://api.canopy.monks.zone",
+		projectDomain: "canopy.monks.zone"
+	}
+];
+const DEFAULT_PROFILE_ID = "main";
+const byId = new Map(BAKED_PROFILES.map((p) => [p.id, p]));
+function isProfileId(value) {
+	return byId.has(value);
+}
+function getBakedProfile(id) {
+	return byId.get(id);
+}
+/** Map a legacy/env apiUrl back to a baked profile when possible. */
+function profileIdForApiUrl(apiUrl) {
+	const normalized = apiUrl.replace(/\/$/, "");
+	for (const profile of BAKED_PROFILES) if (profile.apiUrl === normalized) return profile.id;
+	if (normalized.includes("monks.workers.dev") || normalized.includes("canopy.website")) return "main";
+	if (normalized.includes("arjan-van-wijk.workers.dev") || normalized.includes("thanarie.dev")) return "staging";
+	if (normalized.includes("run.app") || normalized.includes("canopy.monks.zone")) return "gcp-pilot";
+}
+//#endregion
+//#region src/config.ts
+/**
+* CLI config at ~/.canopy/config.json — active profile + per-site tokens
+* (docs/10-cli-sites.md D17). Baked apiUrl/projectDomain live in profiles.ts.
+*
+* Env overrides: CANOPY_PROFILE, CANOPY_API_URL, CANOPY_OIDC_ISSUER,
+* CANOPY_OIDC_CLIENT_ID, CANOPY_PROJECT_DOMAIN, CANOPY_PROJECT_PROTOCOL.
+*/
+const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
+const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
+const configDir = join(homedir(), ".canopy");
+const configPath = join(configDir, "config.json");
+function readRaw() {
+	try {
+		return JSON.parse(readFileSync(configPath, "utf8"));
+	} catch {
+		return {};
+	}
+}
+/** Migrate legacy flat `{ apiUrl, token }` into `profiles` + `activeProfile`. */
+function migrateConfigFile(stored) {
+	if (stored.profiles && Object.keys(stored.profiles).length > 0) return stored;
+	if (!stored.token && !stored.apiUrl) return stored;
+	const id = (stored.activeProfile && isProfileId(stored.activeProfile) ? stored.activeProfile : void 0) ?? (stored.apiUrl ? profileIdForApiUrl(stored.apiUrl) : void 0) ?? "main";
+	return {
+		activeProfile: id,
+		profiles: { [id]: {
+			token: stored.token,
+			tokenExpiresAt: stored.tokenExpiresAt,
+			email: stored.email
+		} },
+		issuer: stored.issuer,
+		cliClientId: stored.cliClientId
+	};
+}
+function readConfigFile() {
+	const raw = readRaw();
+	const migrated = migrateConfigFile(raw);
+	if (raw.token && !raw.profiles) writeConfigFile(migrated);
+	return migrated;
+}
+function writeConfigFile(config) {
+	mkdirSync(configDir, { recursive: true });
+	const clean = {
+		activeProfile: config.activeProfile,
+		profiles: config.profiles,
+		issuer: config.issuer,
+		cliClientId: config.cliClientId
+	};
+	writeFileSync(configPath, `${JSON.stringify(clean, null, 2)}\n`);
+	chmodSync(configPath, 384);
+}
+/**
+* Resolve which site this invocation talks to.
+* Precedence: --profile / CANOPY_PROFILE → canopy.json → activeProfile → main.
+* Then CANOPY_API_URL / domain envs may override the baked URL.
+*/
+function resolveConfig(opts = {}) {
+	const file = readConfigFile();
+	const envProfile = process.env["CANOPY_PROFILE"]?.trim();
+	const requested = opts.profileFlag?.trim() || envProfile || opts.projectProfile?.trim() || file.activeProfile;
+	const profileId = requested && isProfileId(requested) ? requested : requested ? void 0 : DEFAULT_PROFILE_ID;
+	const baked = profileId ? getBakedProfile(profileId) : void 0;
+	const auth = profileId ? file.profiles?.[profileId] : void 0;
+	const envApi = process.env["CANOPY_API_URL"];
+	const envDomain = process.env["CANOPY_PROJECT_DOMAIN"];
+	const envProto = process.env["CANOPY_PROJECT_PROTOCOL"]?.trim();
+	const apiUrl = envApi ?? baked?.apiUrl ?? getBakedProfile("main").apiUrl;
+	const projectDomain = envDomain !== void 0 ? envDomain.trim() || void 0 : baked?.projectDomain ?? void 0;
+	const projectProtocol = (() => {
+		if (envProto === "http" || envProto === "https") return envProto;
+		return baked?.projectProtocol;
+	})();
+	return {
+		profileId: profileId ?? profileIdForApiUrl(apiUrl),
+		apiUrl,
+		projectDomain,
+		projectProtocol,
+		cloud: baked?.cloud,
+		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? file.issuer ?? DEFAULT_ISSUER,
+		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? file.cliClientId ?? DEFAULT_CLI_CLIENT_ID,
+		token: auth?.token,
+		tokenExpiresAt: auth?.tokenExpiresAt,
+		email: auth?.email,
+		envOverride: envApi !== void 0 || envDomain !== void 0,
+		projectProfile: opts.projectProfile
+	};
+}
+function listBakedProfiles() {
+	return BAKED_PROFILES;
+}
+function setActiveProfile(id) {
+	writeConfigFile({
+		...readConfigFile(),
+		activeProfile: id
+	});
+}
+function upsertProfileAuth(id, auth) {
+	const file = readConfigFile();
+	writeConfigFile({
+		...file,
+		activeProfile: file.activeProfile ?? id,
+		profiles: {
+			...file.profiles,
+			[id]: {
+				...file.profiles?.[id],
+				...auth
+			}
+		}
+	});
+}
+function clearAllProfileTokens() {
+	writeConfigFile({
+		...readConfigFile(),
+		profiles: {}
+	});
+}
+//#endregion
+//#region src/project.ts
+/**
+* Which project is a command about? Every project-scoped command resolves it
+* the same way: `--project <slug>` wins, otherwise canopy.json in the target
+* directory (the optional [dir] positional, defaulting to the cwd).
+*/
+/** The wildcard apex projects are served under (`slug.<domain>`). */
+function projectUrl(slug) {
+	const config = siteConfig();
+	const apex = config.projectDomain?.trim();
+	if (apex) return `${config.projectProtocol ?? (apex.includes("sslip.io") ? "http" : "https")}://${slug}.${apex.replace(/^\./, "")}`;
+	const apiHost = new URL(config.apiUrl).hostname;
+	if (apiHost === "run.app" || apiHost.endsWith(".run.app") || apiHost.startsWith("api.")) throw new Error("Cannot derive the project URL. Set projectDomain (baked profile or CANOPY_PROJECT_DOMAIN).");
+	return `https://${slug}.${apiHost.split(".").slice(-2).join(".")}`;
+}
+/** canopy.json parsed if present; undefined when the file is missing. */
+function tryReadCanopyJson(dir) {
+	let raw;
+	try {
+		raw = readFileSync(join(dir, "canopy.json"), "utf8");
+	} catch {
+		return;
+	}
+	return JSON.parse(raw);
+}
+function readCanopyJson(dir) {
+	const config = tryReadCanopyJson(dir);
+	if (config === void 0) throw new Error(`No canopy.json in ${dir} — run from a project created by \`canopy create\`, add one ({"slug": "<slug>", "dist": "dist"}), or pass --project <slug>.`);
+	if (!config.slug) throw new Error("canopy.json is missing \"slug\".");
+	return config;
+}
+/** For commands scoped to a project but not to a directory (db, rollback). */
+const projectFlagArgs = { project: {
+	type: "string",
+	description: "Project slug (overrides canopy.json in the target directory)"
+} };
+/** For commands that operate on a project directory (dev, deploy, open). */
+const projectDirArgs = {
+	dir: {
+		type: "positional",
+		description: "Project directory (defaults to the current directory)",
+		required: false
+	},
+	...projectFlagArgs
+};
+/** Resolve the target directory and project slug from the shared args. */
+function resolveProject(args) {
+	const dir = resolve(args.dir ?? ".");
+	setProjectDirForPin(dir);
+	return {
+		dir,
+		slug: args.project ?? readCanopyJson(dir).slug
+	};
+}
+//#endregion
+//#region src/site.ts
+/**
+* Per-invocation site resolution (docs/10-cli-sites.md D17).
+* Set once from global --profile / CANOPY_PROFILE + optional canopy.json pin.
+*/
+let invocationProfile;
+let projectDirForPin;
+let mismatchNoticed = false;
+function setInvocationProfile(profile) {
+	invocationProfile = profile?.trim() || void 0;
+}
+function setProjectDirForPin(dir) {
+	projectDirForPin = dir;
+}
+function projectProfileFromCwd() {
+	return tryReadCanopyJson(projectDirForPin ?? ".")?.profile;
+}
+/** Resolved site for this process (cached per call args — cheap). */
+function siteConfig() {
+	const projectProfile = projectProfileFromCwd();
+	const config = resolveConfig({
+		profileFlag: invocationProfile,
+		projectProfile
+	});
+	if (!mismatchNoticed && projectProfile && config.profileId && projectProfile !== config.profileId && (invocationProfile || process.env["CANOPY_PROFILE"])) {
+		mismatchNoticed = true;
+		console.error(`note: canopy.json pins profile "${projectProfile}" but this command uses "${config.profileId}"`);
+	}
+	return config;
+}
+/** One-line context for command headers. */
+function siteHeaderLine(cliVersion) {
+	const c = siteConfig();
+	return `canopy ${cliVersion} · ${c.envOverride || !c.profileId ? c.apiUrl : `${c.profileId} (${c.projectDomain ?? new URL(c.apiUrl).hostname})`}`;
+}
+//#endregion
+export { projectFlagArgs as a, tryReadCanopyJson as c, readConfigFile as d, setActiveProfile as f, isProfileId as g, getBakedProfile as h, projectDirArgs as i, clearAllProfileTokens as l, writeConfigFile as m, siteConfig as n, projectUrl as o, upsertProfileAuth as p, siteHeaderLine as r, resolveProject as s, setInvocationProfile as t, listBakedProfiles as u };

package/dist/skill/canopy/SKILL.md

@@ -99,7 +99,7 @@ truth and never go stale.
 Both `canopy create` and `canopy init` scaffold from the same three templates.
 **`static` is the default, but reach
 for it only when the app is genuinely trivial** — a page or two with light SDK
-use. Its SDK is served untyped from the platform (`/_api/v1/sdk.js`): no
+use. Its SDK is served untyped from the platform (`/_api/data/v1/sdk.js`): no
 autocomplete, no type-checking, mistakes only show up in the browser.
 
 Prefer **`spa`** the moment either is true — which covers most real projects:

package/dist/{skill-h7QlCMhc.mjs → skill-CW0QSbAJ.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-Bnu23N0A.mjs";
-import { n as reportErrors } from "./ui-D1DXoDN1.mjs";
+import { t as version } from "./package-CHoZKzaw.mjs";
+import { n as reportErrors } from "./ui-DThlyHgo.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";

package/dist/templates/static/AGENTS.md

@@ -21,7 +21,7 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
 
 - Plain html/css/js in this directory — no bundler, no install step. The
   Canopy SDK is imported straight from the platform, so it always matches the
-  API version: `import { createCanopy } from "/_api/v1/sdk.js";`
+  API version: `import { createCanopy } from "/_api/data/v1/sdk.js";`
 - `canopy dev` — local dev server; its `/_api` proxies to the real platform.
   That is LIVE project data: read freely, but take a `canopy db snapshot`
   before risky data changes.

package/dist/templates/static/main.js

@@ -1,7 +1,7 @@
 // The Canopy SDK is served by the platform itself — nothing to install.
 // Auth (auth), data (db), files (blob) and AI (ai) are all live — see
 // AGENTS.md for how to get the full SDK reference.
-import { createCanopy } from "/_api/v1/sdk.js";
+import { createCanopy } from "/_api/data/v1/sdk.js";
 
 const canopy = createCanopy();
 

package/dist/templates/worker/AGENTS.md

@@ -5,9 +5,8 @@ A Vite + React single-page app plus a per-project backend Worker on
 projects. Everything is served behind company login; there is no
 infrastructure to manage and none should be added.
 
-> **Phase 2 preview:** per-project Workers are not deployable yet.
-> `canopy deploy` publishes the frontend only; `worker/` is picked up
-> automatically once the platform supports it.
+> On GCP, `canopy deploy` publishes the frontend **and** the `worker/`
+> backend (Cloud Run). Cloudflare WfP upload is still Phase 2.
 
 ## Canopy skill
 
@@ -27,10 +26,11 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
 - Frontend: a standard Vite + React + TypeScript app in `src/`; `npm install`
   once, then develop with `canopy dev` (it runs Vite with this project's
   `vite.config.ts` and proxies `/_api` to the platform).
-- Backend: Hono-style handlers in `worker/index.ts`, serving `/api/*`. It runs
-  behind the Canopy gateway (requests arrive authenticated) and reaches the
-  platform through a service binding — same SDK, same budgets and data
-  isolation as the browser.
+- Backend: Hono-style handlers in `worker/index.ts`, serving `/api/*`, plus an
+  optional `scheduled(event, env)` for dashboard Schedules (switch on
+  `event.name`). It runs behind the Canopy gateway (HTTP requests arrive
+  authenticated) and reaches the platform through a service binding — same
+  SDK, same budgets and data isolation as the browser.
 - The SDK comes from npm (`@mediamonks/canopy`) — the browser's shared
   instance lives in `src/canopy.ts`.
 - `canopy dev` uses LIVE project data: read freely, but take a
@@ -44,8 +44,10 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
 
 - Do not add auth — the platform authenticates every request before it
   reaches this app or the Worker.
-- Do not store secrets anywhere in this project — platform access goes
+- Do not store secrets in the repo or SPA. Set them in the Canopy dashboard
+  (Settings → Secrets); the Worker reads them as `c.env.SECRET_NAME`
+  (Workers-shaped bindings — not `process.env`). Platform access still goes
   through the Canopy SDK (`canopy.auth`, `canopy.db`, `canopy.blob`,
   `canopy.ai`) in both the browser and the Worker.
 - The Worker is the only backend: no SSR, no long-running processes, no
-  databases outside `canopy.db`.
+  databases outside `canopy.db` / `c.env.DB`.

package/dist/templates/worker/worker/index.ts

@@ -4,9 +4,10 @@
  * platform (db/blob/ai) through the CANOPY service binding, so budgets and
  * data isolation still apply.
  *
- * NOTE: per-project Workers are a Canopy Phase 2 capability. `canopy deploy`
- * does not upload this Worker yet — the frontend deploys like any SPA, and
- * this directory is picked up automatically once the platform supports it.
+ * On GCP, `canopy deploy` bundles this file and rolls a per-project Cloud Run
+ * service (docs/05-gcp-plan.md G6). Routes under `/api/*` reach this Worker;
+ * everything else serves the SPA. Dashboard schedules call `scheduled()`
+ * (docs/07-schedules.md).
  */
 
 import { createCanopy } from "@mediamonks/canopy";
@@ -15,6 +16,15 @@ import { Hono } from "hono";
 interface Env {
   // Service binding to the platform API (canopy-api), scoped to this project.
   CANOPY: { fetch: typeof fetch };
+  // Dashboard secrets (Settings → Secrets) land as Workers-shaped bindings:
+  // MY_API_KEY?: string;
+}
+
+interface ScheduledEvent {
+  name: string;
+  cron: string;
+  scheduledTime: number;
+  type: "scheduled";
 }
 
 const app = new Hono<{ Bindings: Env }>();
@@ -26,4 +36,17 @@ app.get("/api/hello", async (c) => {
   return c.json({ message: `Hello from the backend, ${user.name}!` });
 });
 
-export default app;
+export default {
+  fetch: app.fetch.bind(app),
+
+  // Settings → Schedules: switch on event.name (not the cron string).
+  async scheduled(event: ScheduledEvent, _env: Env) {
+    switch (event.name) {
+      // case "daily-digest":
+      //   await doWork(_env);
+      //   break;
+      default:
+        console.warn("unhandled schedule", event.name);
+    }
+  },
+};

package/dist/{token-yuwQTQB8.mjs → token-BeF9zczg.mjs}

@@ -1,5 +1,5 @@
-import { n as reportErrors, s as apiRequest } from "./ui-D1DXoDN1.mjs";
-import { i as resolveProject, n as projectFlagArgs, t as projectDirArgs } from "./project-DKbgJACM.mjs";
+import { a as projectFlagArgs, i as projectDirArgs, s as resolveProject } from "./site-BJjoePQS.mjs";
+import { c as apiRequest, n as reportErrors } from "./ui-DThlyHgo.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/{ui-D1DXoDN1.mjs → ui-DThlyHgo.mjs}

@@ -1,37 +1,6 @@
+import { n as siteConfig } from "./site-BJjoePQS.mjs";
 import { spawn } from "node:child_process";
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { cancel, isCancel } from "@clack/prompts";
-//#region src/config.ts
-/**
-* CLI config at ~/.canopy/config.json — platform endpoints and the current
-* CLI token. Env overrides: CANOPY_API_URL, CANOPY_OIDC_ISSUER,
-* CANOPY_OIDC_CLIENT_ID.
-*/
-const DEFAULT_API_URL = "https://canopy-api.arjan-van-wijk.workers.dev";
-const DEFAULT_ISSUER = "https://s4capital.onelogin.com/oidc/2";
-const DEFAULT_CLI_CLIENT_ID = "b69755d0-6678-013f-b5ce-09fe44a57aa0180501";
-const configDir = join(homedir(), ".canopy");
-const configPath = join(configDir, "config.json");
-function readConfig() {
-	let stored = {};
-	try {
-		stored = JSON.parse(readFileSync(configPath, "utf8"));
-	} catch {}
-	return {
-		...stored,
-		apiUrl: process.env["CANOPY_API_URL"] ?? stored.apiUrl ?? DEFAULT_API_URL,
-		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? stored.issuer ?? DEFAULT_ISSUER,
-		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? stored.cliClientId ?? DEFAULT_CLI_CLIENT_ID
-	};
-}
-function writeConfig(config) {
-	mkdirSync(configDir, { recursive: true });
-	writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
-	chmodSync(configPath, 384);
-}
-//#endregion
 //#region src/api.ts
 /**
 * Authenticated requests to the Canopy control plane. Credentials, in order:
@@ -81,6 +50,10 @@ const ERROR_COPY = {
 		why: "the AI service is temporarily unavailable",
 		fix: "This is usually transient — wait a moment and try again."
 	},
+	not_supported_on_target: {
+		why: "this Canopy deployment's cloud target doesn't support that feature",
+		fix: "Per-project workers, schedules and secrets are capability-gated per target — remove the unsupported part (e.g. the worker bundle) or run against a target that supports it."
+	},
 	deploy_too_large: {
 		why: "the deploy bundle exceeds the 25 MB limit",
 		fix: "Trim large assets from the build output (or move them to blob storage), then redeploy."
@@ -190,7 +163,7 @@ async function withContext(request, context) {
 }
 /** Resolve the bearer token: CI deploy token first (D11), then the login token. */
 function credentials() {
-	const config = readConfig();
+	const config = siteConfig();
 	const deployToken = process.env["CANOPY_DEPLOY_TOKEN"];
 	const token = deployToken || config.token;
 	if (!token) throw new Error("Not logged in — run `canopy login` first.");
@@ -214,7 +187,7 @@ async function fail(response, isDeployToken, method, path) {
 async function apiRequest(method, path, body, rawContentType, headers) {
 	const { apiUrl, token, isDeployToken } = credentials();
 	const isForm = body instanceof FormData;
-	const response = await fetch(`${apiUrl}/v1${path}`, {
+	const response = await fetch(`${apiUrl}/control/v1${path}`, {
 		method,
 		headers: {
 			authorization: `Bearer ${token}`,
@@ -229,10 +202,29 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 /** Authenticated GET returning raw bytes (e.g. a deploy zip). */
 async function apiDownload(path) {
 	const { apiUrl, token, isDeployToken } = credentials();
-	const response = await fetch(`${apiUrl}/v1${path}`, { headers: { authorization: `Bearer ${token}` } });
+	const response = await fetch(`${apiUrl}/control/v1${path}`, { headers: { authorization: `Bearer ${token}` } });
 	if (!response.ok) return fail(response, isDeployToken, "GET", path);
 	return Buffer.from(await response.arrayBuffer());
 }
+/**
+* Data-plane call (db safety: export/snapshots/restore). The CLI token is
+* unscoped; the target project rides as X-Canopy-Project and the api. gateway
+* re-vouches it (docs/10-cli-sites.md D17).
+*/
+async function apiDataRequest(method, path, projectSlug, body, rawContentType) {
+	const { apiUrl, token, isDeployToken } = credentials();
+	const response = await fetch(`${apiUrl}/data/v1${path}`, {
+		method,
+		headers: {
+			authorization: `Bearer ${token}`,
+			"x-canopy-project": projectSlug,
+			...body === void 0 ? {} : { "content-type": rawContentType ?? "application/json" }
+		},
+		body: body === void 0 ? void 0 : rawContentType !== void 0 ? body : JSON.stringify(body)
+	});
+	if (!response.ok) return fail(response, isDeployToken, method, path);
+	return await response.json();
+}
 //#endregion
 //#region src/ui.ts
 /**
@@ -305,4 +297,4 @@ function openBrowser(url) {
 	}).on("error", () => {}).unref();
 }
 //#endregion
-export { ApiError as a, withContext as c, unwrap as i, readConfig as l, reportErrors as n, apiDownload as o, requireTty as r, apiRequest as s, openBrowser as t, writeConfig as u };
+export { ApiError as a, apiRequest as c, unwrap as i, withContext as l, reportErrors as n, apiDataRequest as o, requireTty as r, apiDownload as s, openBrowser as t };

package/dist/{upgrade-sXoqYLRu.mjs → upgrade-CGz1yzsW.mjs}

@@ -1,5 +1,5 @@
-import { t as PACKAGE_NAME } from "./version-check-CoWgQs2h.mjs";
-import { n as reportErrors } from "./ui-D1DXoDN1.mjs";
+import { t as PACKAGE_NAME } from "./version-check-Cuh6HaLX.mjs";
+import { n as reportErrors } from "./ui-DThlyHgo.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-h7QlCMhc.mjs");
+		const { skillInstalled } = await import("./skill-CW0QSbAJ.mjs");
 		const refreshSkill = skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);

package/dist/usage-DQpH7A3X.mjs

@@ -0,0 +1,79 @@
+import { a as projectFlagArgs, s as resolveProject } from "./site-BJjoePQS.mjs";
+import { c as apiRequest, l as withContext, n as reportErrors } from "./ui-DThlyHgo.mjs";
+import { defineCommand } from "citty";
+//#region src/usage.ts
+/**
+* canopy usage — print a project's AI spend + storage footprint
+* (same data as the dashboard Usage tab / GET /v1/projects/:slug/usage).
+*/
+function formatBytes(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} kB`;
+	if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+function formatUsd(n) {
+	if (n === 0) return "$0";
+	if (n < 1e-4) return `$${n.toExponential(1)}`;
+	if (n < .01) return `$${n.toFixed(4)}`;
+	return `$${n.toFixed(2)}`;
+}
+function formatTokens(n) {
+	if (n < 1e3) return String(n);
+	if (n < 1e6) return `${(n / 1e3).toFixed(1)}k`;
+	return `${(n / 1e6).toFixed(2)}M`;
+}
+function pad(label, width = 12) {
+	return label.padEnd(width);
+}
+function renderUsage(slug, usage) {
+	const lines = [`${slug} — last ${usage.ai.windowDays ?? 30} days`, ""];
+	lines.push("AI");
+	if (!usage.ai.available) lines.push(`  ${pad("status")}unavailable${usage.ai.reason ? ` (${usage.ai.reason})` : ""}`);
+	else {
+		lines.push(`  ${pad("spend")}${formatUsd(usage.ai.costUsd ?? 0)}`);
+		lines.push(`  ${pad("requests")}${usage.ai.requests ?? 0}`);
+		lines.push(`  ${pad("tokens")}${formatTokens(usage.ai.tokensIn ?? 0)} in / ${formatTokens(usage.ai.tokensOut ?? 0)} out`);
+		if (usage.ai.byModel?.length) {
+			lines.push("  by model");
+			for (const row of usage.ai.byModel.slice(0, 8)) lines.push(`    ${row.model.padEnd(36)} ${String(row.requests).padStart(4)}  ${formatUsd(row.costUsd)}`);
+		}
+		if (usage.ai.truncated) lines.push("  (truncated — more requests in the window than we summarized)");
+	}
+	lines.push("");
+	lines.push("Storage");
+	lines.push(usage.db ? `  ${pad("database")}${formatBytes(usage.db.sizeBytes)} · ${usage.db.tables} tables` : `  ${pad("database")}—`);
+	lines.push(usage.blob ? `  ${pad("blobs")}${formatBytes(usage.blob.totalBytes)} · ${usage.blob.objects} objects` : `  ${pad("blobs")}—`);
+	const deploys = usage.deploys.count;
+	const live = usage.deploys.latestVersion != null ? ` · v${usage.deploys.latestVersion} live` : "";
+	lines.push(`  ${pad("deploys")}${deploys}${live}`);
+	return lines.join("\n");
+}
+const usageCommand = defineCommand({
+	meta: {
+		name: "usage",
+		description: "Show AI spend and storage usage for a project"
+	},
+	args: {
+		...projectFlagArgs,
+		json: {
+			type: "boolean",
+			description: "Print raw JSON (same shape as the dashboard Usage API)",
+			default: false
+		}
+	},
+	run: reportErrors("usage", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const { usage } = await withContext(apiRequest("GET", `/projects/${slug}/usage`), { action: `look up usage for "${slug}"` });
+		if (args.json) {
+			console.log(JSON.stringify({
+				slug,
+				usage
+			}, null, 2));
+			return;
+		}
+		console.log(renderUsage(slug, usage));
+	})
+});
+//#endregion
+export { usageCommand };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.4.5",
+  "version": "0.5.1",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -15,11 +15,12 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
+    "@electric-sql/pglite": "^0.3.14",
     "citty": "^0.2.2",
+    "esbuild": "^0.28.1",
     "hono": "^4.8.0",
-    "miniflare": "^4.20260714.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy": "0.0.2",
+    "@mediamonks/canopy": "0.0.3",
     "@mediamonks/canopy-data-plane": "0.0.1"
   },
   "devDependencies": {

package/dist/dev-BYv6BmcI.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-CuvlJpcO.mjs";
-export { devCommand };