@mediamonks/canopy-cli 0.5.1 → 0.6.0

package/dist/{local-C5-GWJcx.mjs → local-D9OVEHDg.mjs}

@@ -1,5 +1,5 @@
-import { o as apiDataRequest } from "./ui-DThlyHgo.mjs";
-import { n as rewriteApiPath } from "./dev-CQQhMOoD.mjs";
+import { o as apiDataRequest } from "./ui-BhzMeKQl.mjs";
+import { n as rewriteApiPath } from "./dev-OxeYndd1.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
@@ -332,7 +332,7 @@ function dbRouter(config) {
 *    than deep-merge, and a null value stores null instead of removing the
 *    key.
 */
-const DOC_COLUMNS = "id, data, created_at, updated_at";
+const DOC_COLUMNS$1 = "id, data, created_at, updated_at";
 const DOC_STORE_DDL_PG = [`CREATE TABLE IF NOT EXISTS _canopy_docs (
     collection TEXT NOT NULL,
     id TEXT NOT NULL,
@@ -348,7 +348,7 @@ const jsonAt = (column, pathParam) => `(${column}::jsonb #> string_to_array(trim
 * jsonb, so 5 matches 5 and false matches false; IS NOT DISTINCT FROM makes
 * null match JSON null (and absent fields, which extract to SQL NULL).
 */
-function fieldFilters(where, next) {
+function fieldFilters$1(where, next) {
 	const sql = [];
 	const params = [];
 	for (const [field, value] of Object.entries(where)) {
@@ -389,14 +389,14 @@ const postgresDialect = {
 	},
 	get(collection, id) {
 		return {
-			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs WHERE collection = $1 AND id = $2`,
+			sql: `SELECT ${DOC_COLUMNS$1} FROM _canopy_docs WHERE collection = $1 AND id = $2`,
 			params: [collection, id]
 		};
 	},
 	find({ collection, where, orderBy, order, limit, offset }) {
 		const next = counter();
 		const collectionParam = next();
-		const filters = fieldFilters(where, next);
+		const filters = fieldFilters$1(where, next);
 		const params = [collection, ...filters.params];
 		let orderExpr = "created_at";
 		if (orderBy !== void 0) {
@@ -408,7 +408,7 @@ const postgresDialect = {
 			}
 		}
 		return {
-			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs
+			sql: `SELECT ${DOC_COLUMNS$1} FROM _canopy_docs
         WHERE collection = ${collectionParam} ${filters.sql.map((f) => `AND ${f}`).join(" ")}
         ORDER BY ${orderExpr} ${order === "desc" ? "DESC" : "ASC"}
         LIMIT ${limit} OFFSET ${offset}`,
@@ -421,9 +421,9 @@ const postgresDialect = {
 		const next = counter();
 		const patternParam = next();
 		const collectionParam = next();
-		const filters = fieldFilters(where, next);
+		const filters = fieldFilters$1(where, next);
 		return {
-			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs
+			sql: `SELECT ${DOC_COLUMNS$1} FROM _canopy_docs
         WHERE data ILIKE ${patternParam} AND collection = ${collectionParam}
         ${filters.sql.map((f) => `AND ${f}`).join(" ")}
         ORDER BY created_at
@@ -439,7 +439,7 @@ const postgresDialect = {
 		return {
 			sql: `UPDATE _canopy_docs SET data = (data::jsonb || $1::jsonb)::text, updated_at = $2
         WHERE collection = $3 AND id = $4
-        RETURNING ${DOC_COLUMNS}`,
+        RETURNING ${DOC_COLUMNS$1}`,
 			params: [
 				patchJson,
 				now,
@@ -462,11 +462,172 @@ const postgresDialect = {
 	}
 };
 //#endregion
+//#region ../data-plane/src/dialect-sqlite.ts
+/**
+* SQLite/D1 doc-store dialect: one shared table for all collections plus an
+* external-content FTS5 index kept in sync by triggers. Statements are one
+* call each — BEGIN…END bodies rule out naive multi-statement splitting on
+* some hosts.
+*/
+const DOC_COLUMNS = "id, data, created_at, updated_at";
+const DOC_STORE_DDL = [
+	`CREATE TABLE IF NOT EXISTS _canopy_docs (
+    collection TEXT NOT NULL,
+    id TEXT NOT NULL,
+    data TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (collection, id)
+  )`,
+	`CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`,
+	`CREATE VIRTUAL TABLE IF NOT EXISTS _canopy_docs_fts
+    USING fts5(data, content='_canopy_docs', content_rowid='rowid')`,
+	`CREATE TRIGGER IF NOT EXISTS _canopy_docs_fts_insert AFTER INSERT ON _canopy_docs BEGIN
+    INSERT INTO _canopy_docs_fts (rowid, data) VALUES (new.rowid, new.data);
+  END`,
+	`CREATE TRIGGER IF NOT EXISTS _canopy_docs_fts_delete AFTER DELETE ON _canopy_docs BEGIN
+    INSERT INTO _canopy_docs_fts (_canopy_docs_fts, rowid, data) VALUES ('delete', old.rowid, old.data);
+  END`,
+	`CREATE TRIGGER IF NOT EXISTS _canopy_docs_fts_update AFTER UPDATE ON _canopy_docs BEGIN
+    INSERT INTO _canopy_docs_fts (_canopy_docs_fts, rowid, data) VALUES ('delete', old.rowid, old.data);
+    INSERT INTO _canopy_docs_fts (rowid, data) VALUES (new.rowid, new.data);
+  END`
+];
+/**
+* WHERE fragments for a field filter. All params are strings: the value rides
+* as JSON text and `json_extract(?, '$')` rehydrates its SQLite type, so 5
+* matches 5 and false matches false. `IS` makes null match JSON null (and
+* absent fields).
+*/
+function fieldFilters(where, table = "") {
+	const sql = [];
+	const params = [];
+	for (const [field, value] of Object.entries(where)) {
+		const column = META_COLUMNS[field];
+		if (column) {
+			sql.push(`${table}${column} IS json_extract(?, '$')`);
+			params.push(JSON.stringify(value));
+		} else {
+			sql.push(`json_extract(${table}data, ?) IS json_extract(?, '$')`);
+			params.push(`$.${field}`, JSON.stringify(value));
+		}
+	}
+	return {
+		sql,
+		params
+	};
+}
+/** Query text → FTS5 MATCH expression: quoted tokens, implicit AND. */
+function ftsMatch(text) {
+	return text.split(/\s+/).filter(Boolean).map((token) => `"${token.replaceAll("\"", "\"\"")}"`).join(" ");
+}
+const sqliteDialect = {
+	name: "sqlite",
+	fts: true,
+	ddl: DOC_STORE_DDL,
+	insert(collection, id, data, now) {
+		return {
+			sql: "INSERT INTO _canopy_docs (collection, id, data, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",
+			params: [
+				collection,
+				id,
+				data,
+				now,
+				now
+			]
+		};
+	},
+	get(collection, id) {
+		return {
+			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs WHERE collection = ? AND id = ?`,
+			params: [collection, id]
+		};
+	},
+	find({ collection, where, orderBy, order, limit, offset }) {
+		const filters = fieldFilters(where);
+		const params = [collection, ...filters.params];
+		let orderExpr = "created_at";
+		if (orderBy !== void 0) {
+			const column = META_COLUMNS[orderBy];
+			if (column) orderExpr = column;
+			else {
+				orderExpr = "json_extract(data, ?)";
+				params.push(`$.${orderBy}`);
+			}
+		}
+		return {
+			sql: `SELECT ${DOC_COLUMNS} FROM _canopy_docs
+        WHERE collection = ? ${filters.sql.map((f) => `AND ${f}`).join(" ")}
+        ORDER BY ${orderExpr} ${order === "desc" ? "DESC" : "ASC"}
+        LIMIT ${limit} OFFSET ${offset}`,
+			params
+		};
+	},
+	search({ collection, text, where, limit, offset }) {
+		const match = ftsMatch(text);
+		if (!match) return null;
+		const filters = fieldFilters(where, "d.");
+		return {
+			sql: `SELECT d.id, d.data, d.created_at, d.updated_at
+        FROM _canopy_docs_fts
+        JOIN _canopy_docs d ON d.rowid = _canopy_docs_fts.rowid
+        WHERE _canopy_docs_fts MATCH ? AND d.collection = ?
+        ${filters.sql.map((f) => `AND ${f}`).join(" ")}
+        ORDER BY _canopy_docs_fts.rank
+        LIMIT ${limit} OFFSET ${offset}`,
+			params: [
+				match,
+				collection,
+				...filters.params
+			]
+		};
+	},
+	patch(collection, id, patchJson, now) {
+		return {
+			sql: `UPDATE _canopy_docs SET data = json_patch(data, ?), updated_at = ?
+        WHERE collection = ? AND id = ?
+        RETURNING ${DOC_COLUMNS}`,
+			params: [
+				patchJson,
+				now,
+				collection,
+				id
+			]
+		};
+	},
+	del(collection, id) {
+		return {
+			sql: "DELETE FROM _canopy_docs WHERE collection = ? AND id = ?",
+			params: [collection, id]
+		};
+	},
+	/**
+	* D1 export refuses databases containing virtual tables, so data-safety
+	* operations drop the FTS index (and its triggers) around an export and
+	* rebuild it afterwards. The index is external-content over _canopy_docs —
+	* dropping it loses nothing a rebuild can't restore.
+	*/
+	dropFtsIndex() {
+		return [...[
+			"insert",
+			"delete",
+			"update"
+		].map((trigger) => `DROP TRIGGER IF EXISTS _canopy_docs_fts_${trigger}`), "DROP TABLE IF EXISTS _canopy_docs_fts"];
+	},
+	rebuildFtsIndex() {
+		return [...DOC_STORE_DDL, "INSERT INTO _canopy_docs_fts (_canopy_docs_fts) VALUES ('rebuild')"];
+	}
+};
+//#endregion
 //#region ../data-plane/src/doc-store.ts
 /** Creates the doc store if missing. Idempotent; hosts decide when to memoize. */
 async function ensureDocStore(store, dialect) {
 	for (const ddl of dialect.ddl) await store.query(ddl);
 }
+/** Recreates the doc store's FTS index and re-indexes every document. */
+async function rebuildFtsIndex(store, dialect) {
+	for (const sql of dialect.rebuildFtsIndex()) await store.query(sql);
+}
 //#endregion
 //#region ../data-plane/src/sql-dump.ts
 /**
@@ -538,6 +699,123 @@ function splitSqlStatements(dump) {
 	return statements;
 }
 //#endregion
+//#region ../data-plane/src/migrations.ts
+var MigrationError = class extends Error {
+	code;
+	/** The migration file the error is about, when there is one. */
+	migration;
+	constructor(code, message, migration) {
+		super(message);
+		this.name = "MigrationError";
+		this.code = code;
+		if (migration !== void 0) this.migration = migration;
+	}
+};
+/** Same DDL in both dialects — TEXT keys, ISO-8601 timestamps. */
+const JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS _canopy_migrations (
+  name TEXT PRIMARY KEY,
+  hash TEXT NOT NULL,
+  applied_at TEXT NOT NULL
+)`;
+/** Filenames only — no paths, no shell metacharacters, journal-key sized. */
+const MIGRATION_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/** Transaction control and session settings the host channel can't honor. */
+const SKIPPED_STATEMENT_RE = /^(BEGIN|COMMIT|ROLLBACK|SET\s+search_path|PRAGMA)\b/i;
+async function sha256Hex(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** Hash over normalized line endings so a CRLF checkout isn't an "edit". */
+function migrationHash(sql) {
+	return sha256Hex(sql.replaceAll("\r\n", "\n"));
+}
+async function ensureJournal(store) {
+	await store.query(JOURNAL_DDL);
+}
+function sortedByName(files) {
+	return [...files].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+}
+/**
+* Reject any pending statement that mentions the platform's reserved prefix.
+* Deliberately conservative (a string literal naming `_canopy_docs` trips it
+* too — docs/13 §8.2): the doc store and the journal are not the user's to
+* migrate, and a false positive has an easy workaround (don't say `_canopy_`).
+*/
+function guardReservedTables(file, statements) {
+	for (const statement of statements) if (/_canopy_/i.test(statement)) throw new MigrationError("reserved_table", `Migration ${file.name} references a reserved _canopy_* object — platform tables are not migratable.`, file.name);
+}
+function validateNames(files) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const file of files) {
+		if (!MIGRATION_NAME_RE.test(file.name)) throw new MigrationError("invalid_migration", `Invalid migration name ${JSON.stringify(file.name)} — use plain filenames (letters, digits, ".", "_", "-"; max 128 chars).`, file.name);
+		if (seen.has(file.name)) throw new MigrationError("invalid_migration", `Duplicate migration name ${file.name}.`);
+		seen.add(file.name);
+	}
+}
+/**
+* Compare the provided files against the journal: which are pending, which
+* already applied (hash-verified), which journaled-but-missing. Throws
+* `edited_migration` when an applied file's content changed — write a new
+* migration instead, like every mainstream tool.
+*/
+async function planMigrations(store, files) {
+	validateNames(files);
+	await ensureJournal(store);
+	const { results } = await store.query("SELECT name, hash FROM _canopy_migrations");
+	const journal = new Map(results.map((row) => [String(row["name"]), String(row["hash"])]));
+	const ordered = sortedByName(files);
+	const pending = [];
+	const applied = [];
+	for (const file of ordered) {
+		const journaledHash = journal.get(file.name);
+		if (journaledHash === void 0) {
+			pending.push(file);
+			continue;
+		}
+		if (journaledHash !== await migrationHash(file.sql)) throw new MigrationError("edited_migration", `Migration ${file.name} was edited after it was applied — write a new migration instead of changing history.`, file.name);
+		applied.push(file.name);
+	}
+	for (const file of pending) guardReservedTables(file, splitSqlStatements(file.sql));
+	const provided = new Set(ordered.map((f) => f.name));
+	return {
+		pending,
+		applied,
+		missing: [...journal.keys()].filter((name) => !provided.has(name)).sort()
+	};
+}
+/**
+* Apply every pending migration in order, journaling each file after its
+* statements ran. All validation (names, hashes, reserved tables) happens
+* before the first statement executes; a statement failure surfaces as
+* `statement_failed` naming the file and statement.
+*/
+async function applyMigrations(store, dialect, files) {
+	const plan = await planMigrations(store, files);
+	const statementsByFile = plan.pending.map((file) => ({
+		file,
+		statements: splitSqlStatements(file.sql).filter((s) => !SKIPPED_STATEMENT_RE.test(s))
+	}));
+	const journalInsert = dialect.name === "postgres" ? "INSERT INTO _canopy_migrations (name, hash, applied_at) VALUES ($1, $2, $3)" : "INSERT INTO _canopy_migrations (name, hash, applied_at) VALUES (?, ?, ?)";
+	const applied = [];
+	for (const { file, statements } of statementsByFile) {
+		for (const statement of statements) try {
+			await store.query(statement);
+		} catch (err) {
+			throw new MigrationError("statement_failed", `Migration ${file.name} failed: ${err instanceof Error ? err.message : String(err)}\n  in: ${statement.slice(0, 160)}${statement.length > 160 ? "…" : ""}`, file.name);
+		}
+		await store.query(journalInsert, [
+			file.name,
+			await migrationHash(file.sql),
+			(/* @__PURE__ */ new Date()).toISOString()
+		]);
+		applied.push(file.name);
+	}
+	return {
+		applied,
+		missing: plan.missing
+	};
+}
+//#endregion
 //#region src/fs-blob.ts
 /**
 * Filesystem BlobBucket for `canopy dev --local` — same structural interface
@@ -705,10 +983,12 @@ function createFsBlobBucket(root) {
 //#region src/local.ts
 /**
 * canopy dev --local — the offline sandbox (docs/02-decisions.md D12,
-* docs/05-gcp-plan.md §10.2 / Phase G4): PGlite + filesystem blobs under the
-* project's .canopy/local/, answering the SDK's data plane with THE SAME
-* routers canopy-api mounts (@mediamonks/canopy-data-plane) — the sandbox can't
-* drift from the platform because they share the implementation.
+* docs/05-gcp-plan.md §10.2 / Phase G4): a local database + filesystem blobs
+* under the project's .canopy/local/, answering the SDK's data plane with THE
+* SAME routers canopy-api mounts (@mediamonks/canopy-data-plane) — the sandbox
+* can't drift from the platform because they share the implementation. The
+* canopy.json "dialect" lock picks the engine (sqlite → node:sqlite, postgres →
+* PGlite) so raw sql() written for the project's target runs unchanged.
 *
 * Sync is pull-only: `--pull` hydrates the local database from a fresh prod
 * export; nothing ever pushes back. ai/services aren't data — dev.ts proxies
@@ -728,21 +1008,71 @@ async function fetchProjectDump(slug) {
 	if (!download.ok) throw new Error(`Dump download failed (HTTP ${download.status}).`);
 	return download.text();
 }
-async function createSandbox(options) {
+async function createPgliteDb(persistDir) {
 	const { PGlite } = await import("@electric-sql/pglite");
-	const dataDir = options.persistDir ? join(options.persistDir, "pg") : void 0;
+	const dataDir = persistDir ? join(persistDir, "pg") : void 0;
 	if (dataDir) mkdirSync(dataDir, { recursive: true });
 	const db = dataDir ? new PGlite(dataDir) : new PGlite();
 	await db.waitReady;
+	return {
+		store: { query: async (sql, params = []) => {
+			const result = await db.query(sql, params);
+			return {
+				results: result.rows,
+				meta: { changes: Number(result.affectedRows ?? 0) }
+			};
+		} },
+		exec: async (sql) => {
+			await db.exec(sql);
+		},
+		reset: async () => {
+			const tables = (await db.query(`SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`)).rows;
+			for (const { tablename } of tables) await db.exec(`DROP TABLE IF EXISTS "${tablename.replaceAll("\"", "\"\"")}" CASCADE`);
+		},
+		close: () => db.close()
+	};
+}
+async function createSqliteDb(persistDir) {
+	let DatabaseSync;
+	try {
+		({DatabaseSync} = await import("node:sqlite"));
+		const probe = new DatabaseSync(":memory:");
+		probe.exec("CREATE VIRTUAL TABLE _fts_probe USING fts5(x)");
+		probe.close();
+	} catch {
+		throw new Error(`The sqlite sandbox needs Node 24+ (node:sqlite with FTS5); this is Node ${process.version}. Upgrade Node, or remove the "dialect" lock from canopy.json to use the PGlite sandbox.`);
+	}
+	if (persistDir) mkdirSync(persistDir, { recursive: true });
+	const db = new DatabaseSync(persistDir ? join(persistDir, "sqlite.db") : ":memory:");
+	const listTables = (where) => db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND ${where}`).all().map((row) => row.name);
+	return {
+		store: { query: async (sql, params = []) => {
+			const bound = params.map((p) => typeof p === "boolean" ? p ? 1 : 0 : p);
+			const results = db.prepare(sql).all(...bound);
+			const { c } = db.prepare("SELECT changes() AS c").get();
+			return {
+				results,
+				meta: { changes: Number(c) }
+			};
+		} },
+		exec: async (sql) => {
+			db.exec(sql);
+		},
+		reset: async () => {
+			for (const name of listTables(`sql LIKE 'CREATE VIRTUAL TABLE%'`)) db.exec(`DROP TABLE IF EXISTS "${name.replaceAll("\"", "\"\"")}"`);
+			for (const name of listTables(`name NOT LIKE 'sqlite_%'`)) db.exec(`DROP TABLE IF EXISTS "${name.replaceAll("\"", "\"\"")}"`);
+		},
+		close: async () => {
+			db.close();
+		}
+	};
+}
+async function createSandbox(options) {
+	const dialect = options.dialect === "sqlite" ? sqliteDialect : postgresDialect;
+	const db = options.dialect === "sqlite" ? await createSqliteDb(options.persistDir) : await createPgliteDb(options.persistDir);
+	const store = db.store;
 	const bucket = options.persistDir ? createFsBlobBucket(join(options.persistDir, "blob")) : createMemoryBlobBucket();
-	const store = { query: async (sql, params = []) => {
-		const result = await db.query(sql, params);
-		return {
-			results: result.rows,
-			meta: { changes: Number(result.affectedRows ?? 0) }
-		};
-	} };
-	await ensureDocStore(store, postgresDialect);
+	await ensureDocStore(store, dialect);
 	const app = new Hono();
 	const ownProject = (c) => {
 		const requested = c.req.header("x-canopy-project") ?? c.req.query("project");
@@ -750,7 +1080,7 @@ async function createSandbox(options) {
 	};
 	app.route("/data/v1", dbRouter({ store: async (c) => ownProject(c) ?? {
 		store,
-		dialect: postgresDialect
+		dialect
 	} }));
 	app.route("/data/v1", blobRouter({
 		store: async (c) => ownProject(c) ?? {
@@ -768,6 +1098,10 @@ async function createSandbox(options) {
 			"cache-control": "no-store"
 		} });
 	});
+	app.get("/data/v1/platform", (c) => c.json({
+		dialect: dialect.name,
+		capabilities: { fts: dialect.fts }
+	}));
 	app.get("/data/v1/auth/me", (c) => c.json({
 		id: "local-dev",
 		email: options.email ?? "dev@localhost",
@@ -793,13 +1127,8 @@ async function createSandbox(options) {
 		else if (!pathname.startsWith("/data/v1/") && !pathname.startsWith("/control/v1/")) return Response.json({ error: "not_found" }, { status: 404 });
 		return app.fetch(new Request(`http://sandbox${pathname}${url.search}`, request));
 	}
-	/** Drop every user table so a dump lands on a clean slate. */
-	async function resetLocal() {
-		const tables = (await db.query(`SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`)).rows;
-		for (const { tablename } of tables) await db.exec(`DROP TABLE IF EXISTS "${tablename.replaceAll("\"", "\"\"")}" CASCADE`);
-	}
 	async function applyDump(sql) {
-		await resetLocal();
+		await db.reset();
 		for (const statement of splitSqlStatements(sql)) {
 			if (/^(BEGIN|COMMIT|ROLLBACK|SET\s+search_path|PRAGMA)\b/i.test(statement)) continue;
 			try {
@@ -808,18 +1137,13 @@ async function createSandbox(options) {
 				throw new Error(`Dump statement failed: ${err instanceof Error ? err.message : String(err)}\n  in: ${statement.slice(0, 120)}${statement.length > 120 ? "…" : ""}`);
 			}
 		}
-		await ensureDocStore(store, postgresDialect);
+		await rebuildFtsIndex(store, dialect);
 	}
 	return {
 		handle,
 		applyDump,
-		dispose: async () => {
-			await db.close();
-			if (options.persistDir === false && dataDir && existsSync(dataDir)) rmSync(dataDir, {
-				recursive: true,
-				force: true
-			});
-		}
+		applyMigrations: (files) => applyMigrations(store, dialect, files),
+		dispose: () => db.close()
 	};
 }
 //#endregion

package/dist/{login-BO6abf40.mjs → login-Cb8D8a1Z.mjs}

@@ -1,5 +1,5 @@
-import { d as readConfigFile, f as setActiveProfile, g as isProfileId, h as getBakedProfile, l as clearAllProfileTokens, m as writeConfigFile, n as siteConfig, p as upsertProfileAuth, u as listBakedProfiles } from "./site-BJjoePQS.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-DThlyHgo.mjs";
+import { _ as isProfileId, d as listBakedProfiles, f as readConfigFile, g as getBakedProfile, h as writeConfigFile, m as upsertProfileAuth, n as siteConfig, p as setActiveProfile, u as clearAllProfileTokens } from "./site-DQnysZ3W.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-BhzMeKQl.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";
@@ -287,7 +287,9 @@ async function login(json, profileFlag) {
 		url: authorizeHref
 	}));
 	else {
-		p.note(`If nothing opens, visit:\n${authorizeHref}`, "Opening OneLogin in your browser");
+		p.log.step("Opening OneLogin in your browser");
+		p.log.message("If nothing opens, visit:");
+		console.log(authorizeHref);
 		spin?.start("Waiting for you to sign in in the browser…");
 	}
 	let code;

package/dist/migrations-B0kJarjr.mjs

@@ -0,0 +1,50 @@
+import { l as tryReadCanopyJson } from "./site-DQnysZ3W.mjs";
+import { o as apiDataRequest } from "./ui-BhzMeKQl.mjs";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+//#region src/migrations.ts
+/**
+* The CLI side of schema migrations (docs/13-migrations-and-drizzle.md):
+* reads the project's migration files (canopy.json "migrations" dir, e.g.
+* Drizzle's `drizzle-kit generate` output) and sends them to the platform's
+* migrate primitive. Shared by `canopy db migrate`, the deploy step, and the
+* `--local` sandbox boot.
+*/
+/**
+* The project's migration files in apply order, or undefined when canopy.json
+* configures no "migrations" dir. A configured-but-unreadable dir is an error;
+* a readable dir with no .sql files is an empty list.
+*/
+function readMigrationFiles(dir) {
+	const migrationsPath = tryReadCanopyJson(dir)?.migrations;
+	if (!migrationsPath) return void 0;
+	const migrationsDir = resolve(dir, migrationsPath);
+	let entries;
+	try {
+		entries = readdirSync(migrationsDir, { withFileTypes: true });
+	} catch {
+		throw new Error(`Migrations directory not found: ${migrationsDir} (canopy.json "migrations").`);
+	}
+	return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => ({
+		name: entry.name,
+		sql: readFileSync(join(migrationsDir, entry.name), "utf8")
+	})).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+}
+/** Run (or dry-run) the project's migrations against its live database. */
+function migrateProject(slug, migrations, plan = false) {
+	return apiDataRequest("POST", "/db/migrate", slug, {
+		migrations,
+		plan
+	});
+}
+/** One-line-per-fact summary shared by `db migrate` and the deploy step. */
+function describeMigrateResult(result) {
+	const lines = [];
+	for (const name of result.appliedNow) lines.push(`applied ${name}`);
+	if (result.appliedNow.length === 0 && result.pending.length === 0) lines.push(`nothing pending (${result.applied.length} applied previously)`);
+	if (result.snapshot !== void 0) lines.push(`pre-migrate snapshot: ${result.snapshot} (canopy db restore --snapshot …)`);
+	if (result.missing.length > 0) lines.push(`note: ${result.missing.length} journaled migration(s) have no local file`);
+	return lines;
+}
+//#endregion
+export { migrateProject as n, readMigrationFiles as r, describeMigrateResult as t };

package/dist/{open-DnlYDqrU.mjs → open-BmgYBSdR.mjs}

@@ -1,5 +1,5 @@
-import { i as projectDirArgs, o as projectUrl, s as resolveProject } from "./site-BJjoePQS.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-DThlyHgo.mjs";
+import { a as projectDirArgs, c as resolveProject, s as projectUrl } from "./site-DQnysZ3W.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-BhzMeKQl.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-CHoZKzaw.mjs → package-D1wDsLSU.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.5.1";
+var version = "0.6.0";
 //#endregion
 export { version as t };

package/dist/{projects-ijfe7Ffx.mjs → projects-CoGh8m9A.mjs}

@@ -1,5 +1,5 @@
-import { c as tryReadCanopyJson, n as siteConfig, o as projectUrl } from "./site-BJjoePQS.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-DThlyHgo.mjs";
+import { l as tryReadCanopyJson, n as siteConfig, s as projectUrl } from "./site-DQnysZ3W.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-BhzMeKQl.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
@@ -75,7 +75,12 @@ function writeCanopyJson(dir, fields) {
 	writeFileSync(join(dir, "canopy.json"), `${JSON.stringify(next, null, 2)}\n`);
 }
 function slugify(input) {
-	return input.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/(^-+|-+$)/g, "").slice(0, 40);
+	let slug = input.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/(^-+|-+$)/g, "").slice(0, 40);
+	while (slug.includes("-dot-")) slug = slug.replaceAll("-dot-", "-");
+	return slug;
+}
+function shouldScaffoldCreate(requested, cwd = process.cwd()) {
+	return requested ?? !existsSync(join(cwd, "canopy.json"));
 }
 const createCommand = defineCommand({
 	meta: {
@@ -98,7 +103,6 @@ const createCommand = defineCommand({
 		},
 		scaffold: {
 			type: "boolean",
-			default: true,
 			description: "Scaffold ./<slug>/ from the starter template",
 			negativeDescription: "Only register — no files written"
 		}
@@ -118,12 +122,16 @@ const createCommand = defineCommand({
 			message: "Slug",
 			defaultValue: slugify(name),
 			placeholder: slugify(name),
-			validate: (value) => !value || /^[a-z0-9][a-z0-9-]*$/.test(value) ? void 0 : "Lowercase letters, digits and dashes only."
+			validate: (value) => {
+				if (value && !/^[a-z0-9][a-z0-9-]*$/.test(value)) return "Lowercase letters, digits and dashes only.";
+				if (value?.includes("-dot-")) return `"-dot-" is reserved for preview hostnames.`;
+			}
 		})).trim();
 		slug ||= slugify(name);
+		const scaffold = shouldScaffoldCreate(args.scaffold);
 		let template = TEMPLATES.find((t) => t.id === (args.template ?? "static"));
 		if (!template) throw new Error(`Unknown template "${args.template}" — available: ${TEMPLATES.map((t) => t.id).join(", ")}.`);
-		if (args.scaffold && !args.template && process.stdin.isTTY) {
+		if (scaffold && !args.template && process.stdin.isTTY) {
 			const id = unwrap(await p.select({
 				message: "Template",
 				options: TEMPLATES.filter((t) => !t.hidden).map((t) => ({
@@ -136,7 +144,7 @@ const createCommand = defineCommand({
 		}
 		if (template.hidden) p.log.warn("Per-project Workers are not deployable yet (Phase 2) — `canopy deploy` publishes the frontend only for now.");
 		const targetDir = resolve(slug);
-		if (args.scaffold && existsSync(targetDir)) throw new Error(`Directory ./${slug} already exists — remove it, or use --no-scaffold to only register.`);
+		if (scaffold && existsSync(targetDir)) throw new Error(`Directory ./${slug} already exists — remove it, or use --no-scaffold to only register.`);
 		const spin = p.spinner();
 		spin.start(`Registering ${slug}…`);
 		let project;
@@ -150,7 +158,7 @@ const createCommand = defineCommand({
 			throw err;
 		}
 		spin.stop(`Created ${project.name} — ${projectUrl(project.slug)}`);
-		if (args.scaffold) {
+		if (scaffold) {
 			scaffoldTemplate(template.id, targetDir, {
 				name,
 				slug
@@ -166,7 +174,7 @@ const createCommand = defineCommand({
 			];
 			p.note(steps.join("\n"), `Scaffolded ./${slug}/ (${template.id}) — next`);
 			p.outro(`Live URL (after first deploy): ${projectUrl(project.slug)}`);
-		} else p.outro("Registered without scaffolding — add a canopy.json to deploy an existing app.");
+		} else p.outro(existsSync(join(process.cwd(), "canopy.json")) ? "Registered without scaffolding — the existing canopy.json was left unchanged." : "Registered without scaffolding — add a canopy.json to deploy an existing app.");
 	})
 });
 /** Empty enough to scaffold into: missing, or holding only dotfiles (.git, .agents…). */