@mediamonks/canopy-cli 0.7.11 → 0.7.12

package/dist/{skill-DJHlTEhS.mjs → skill-BOWfqwr2.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-BBpw-n7k.mjs";
+import { t as version } from "./package-CDLufecy.mjs";
 import { n as reportErrors } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/src-Bu4Ze32I.mjs

@@ -0,0 +1,470 @@
+import { Hono } from "hono";
+//#region ../data-plane/src/blob.ts
+/**
+* /blob — the SDK's file storage over an injectable BlobStore (a bucket
+* plus the project's isolated key prefix). Same single-implementation deal as
+* db.ts: canopy-api and the CLI's local sandbox mount this exact router.
+*
+* Authorization is the HOST's job (canopy-api enforces session-or-signature
+* ahead of this router; the local sandbox has no auth wall). This router only
+* mints download URLs via the injected signer — verification lives with the
+* host's auth middleware (see signing.ts).
+*/
+const MAX_BLOB_BYTES = 25 * 1024 * 1024;
+const MAX_LIST_KEYS = 1e3;
+const URL_TTL_SECONDS = 600;
+/** Keys may nest with `/`, but never escape the prefix or surprise a URL. */
+function safeBlobKey(raw) {
+	if (raw.length === 0 || raw.length > 512) return null;
+	if (raw.includes("\\") || raw.includes("\0")) return null;
+	if (raw.split("/").some((seg) => seg === "" || seg === "." || seg === "..")) return null;
+	return raw;
+}
+function blobRouter(config) {
+	const blob = new Hono();
+	const resolve = async (c) => config.store(c);
+	blob.put("/blob/:key", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		if (Number(c.req.header("content-length") ?? 0) > MAX_BLOB_BYTES) return c.json({
+			error: "blob_too_large",
+			maxBytes: MAX_BLOB_BYTES
+		}, 413);
+		const body = await c.req.raw.arrayBuffer();
+		if (body.byteLength > MAX_BLOB_BYTES) return c.json({
+			error: "blob_too_large",
+			maxBytes: MAX_BLOB_BYTES
+		}, 413);
+		const contentType = c.req.header("content-type") ?? "application/octet-stream";
+		await store.bucket.put(store.prefix + key, body, { httpMetadata: { contentType } });
+		return c.json({
+			key,
+			size: body.byteLength,
+			contentType,
+			uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+		}, 201);
+	});
+	blob.get("/blob", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const prefix = c.req.query("prefix") ?? "";
+		if (prefix.length > 512 || prefix.includes("\0")) return c.json({ error: "invalid_prefix" }, 400);
+		const base = store.prefix;
+		const objects = [];
+		let cursor;
+		do {
+			const page = await store.bucket.list({
+				prefix: base + prefix,
+				cursor,
+				include: ["httpMetadata"]
+			});
+			for (const o of page.objects) objects.push({
+				key: o.key.slice(base.length),
+				size: o.size,
+				contentType: o.httpMetadata?.contentType ?? "application/octet-stream",
+				uploadedAt: o.uploaded.toISOString()
+			});
+			cursor = page.truncated && objects.length < MAX_LIST_KEYS ? page.cursor : void 0;
+		} while (cursor);
+		return c.json(objects.slice(0, MAX_LIST_KEYS));
+	});
+	blob.get("/blob/:key/url", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { slug, store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		if (!await store.bucket.head(store.prefix + key)) return c.json({ error: "not_found" }, 404);
+		const exp = Math.floor(Date.now() / 1e3) + URL_TTL_SECONDS;
+		const sig = await config.signDownload(c, slug, key, exp);
+		return c.json({
+			url: `/_api/data/v1/blob/${encodeURIComponent(key)}?project=${encodeURIComponent(slug)}&exp=${exp}&sig=${sig}`,
+			expiresAt: (/* @__PURE__ */ new Date(exp * 1e3)).toISOString()
+		});
+	});
+	blob.get("/blob/:key", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		const object = await store.bucket.get(store.prefix + key);
+		if (!object) return c.json({ error: "not_found" }, 404);
+		return new Response(object.body, { headers: {
+			"content-type": object.httpMetadata?.contentType ?? "application/octet-stream",
+			"cache-control": "private, no-store"
+		} });
+	});
+	blob.delete("/blob/:key", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const key = safeBlobKey(c.req.param("key"));
+		if (!key) return c.json({ error: "invalid_key" }, 400);
+		const fullKey = store.prefix + key;
+		const existed = await store.bucket.head(fullKey) !== null;
+		await store.bucket.delete(fullKey);
+		return c.json({ deleted: existed });
+	});
+	return blob;
+}
+//#endregion
+//#region ../data-plane/src/dialect.ts
+/** Platform-managed fields map to real columns instead of JSON extraction. */
+const META_COLUMNS = {
+	_id: "id",
+	_createdAt: "created_at",
+	_updatedAt: "updated_at"
+};
+//#endregion
+//#region ../data-plane/src/schema.ts
+/** Platform/system tables never shown to users. */
+const RESERVED = /^(_canopy_|_cf_|sqlite_|pg_)/;
+/** Single-quoted SQL string literal (introspection args ride inline, not bound). */
+const lit = (value) => `'${value.replaceAll("'", "''")}'`;
+async function sqliteSchema(store) {
+	const names = (await store.query(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`)).results.map((r) => String(r.name)).filter((n) => !RESERVED.test(n));
+	return Promise.all(names.map(async (name) => {
+		const [cols, idxList] = await Promise.all([store.query(`SELECT name, type, "notnull" AS not_null, pk FROM pragma_table_info(${lit(name)})`), store.query(`SELECT name, "unique" AS is_unique FROM pragma_index_list(${lit(name)})`)]);
+		const indexes = await Promise.all(idxList.results.filter((idx) => !RESERVED.test(String(idx.name))).map(async (idx) => ({
+			name: String(idx.name),
+			unique: Boolean(Number(idx.is_unique)),
+			columns: (await store.query(`SELECT name FROM pragma_index_info(${lit(String(idx.name))})`)).results.map((r) => String(r.name))
+		})));
+		return {
+			name,
+			columns: cols.results.map((col) => ({
+				name: String(col.name),
+				type: String(col.type),
+				nullable: !Number(col.not_null),
+				pk: Number(col.pk) > 0
+			})),
+			indexes
+		};
+	}));
+}
+async function postgresSchema(store) {
+	const [tables, columns, pks, indexes] = await Promise.all([
+		store.query(`SELECT table_name AS name FROM information_schema.tables
+        WHERE table_schema = current_schema() AND table_type = 'BASE TABLE'
+        ORDER BY table_name`),
+		store.query(`SELECT table_name, column_name, data_type, is_nullable
+         FROM information_schema.columns
+        WHERE table_schema = current_schema()
+        ORDER BY table_name, ordinal_position`),
+		store.query(`SELECT tc.table_name, kcu.column_name
+         FROM information_schema.table_constraints tc
+         JOIN information_schema.key_column_usage kcu
+           ON kcu.constraint_name = tc.constraint_name
+          AND kcu.table_schema = tc.table_schema
+        WHERE tc.constraint_type = 'PRIMARY KEY' AND tc.table_schema = current_schema()`),
+		store.query(`SELECT t.relname AS table_name, i.relname AS index_name,
+              ix.indisunique AS is_unique, a.attname AS column_name
+         FROM pg_index ix
+         JOIN pg_class i ON i.oid = ix.indexrelid
+         JOIN pg_class t ON t.oid = ix.indrelid
+         JOIN pg_namespace n ON n.oid = t.relnamespace
+         JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = ANY(ix.indkey)
+        WHERE n.nspname = current_schema() AND NOT ix.indisprimary`)
+	]);
+	const pkSet = new Set(pks.results.map((r) => `${String(r.table_name)}.${String(r.column_name)}`));
+	const byTable = /* @__PURE__ */ new Map();
+	for (const row of tables.results) {
+		const name = String(row.name);
+		if (!RESERVED.test(name)) byTable.set(name, {
+			name,
+			columns: [],
+			indexes: []
+		});
+	}
+	for (const col of columns.results) {
+		const table = byTable.get(String(col.table_name));
+		if (!table) continue;
+		table.columns.push({
+			name: String(col.column_name),
+			type: String(col.data_type),
+			nullable: col.is_nullable === "YES",
+			pk: pkSet.has(`${String(col.table_name)}.${String(col.column_name)}`)
+		});
+	}
+	for (const idx of indexes.results) {
+		const table = byTable.get(String(idx.table_name));
+		if (!table) continue;
+		const name = String(idx.index_name);
+		let index = table.indexes.find((i) => i.name === name);
+		if (!index) {
+			index = {
+				name,
+				unique: Boolean(idx.is_unique),
+				columns: []
+			};
+			table.indexes.push(index);
+		}
+		index.columns.push(String(idx.column_name));
+	}
+	return [...byTable.values()];
+}
+async function introspectSchema(store, dialect) {
+	const [tables, collections] = await Promise.all([dialect === "postgres" ? postgresSchema(store) : sqliteSchema(store), store.query("SELECT collection, COUNT(*) AS docs FROM _canopy_docs GROUP BY collection ORDER BY collection").then((r) => r.results.map((row) => ({
+		name: String(row.collection),
+		docs: Number(row.docs)
+	}))).catch(() => [])]);
+	return {
+		dialect,
+		collections,
+		tables
+	};
+}
+//#endregion
+//#region ../data-plane/src/db.ts
+/**
+* /db — the SDK's document API + raw-SQL escape hatch, over an injectable
+* DocStore. This is THE data-plane implementation: canopy-api mounts it under
+* /data/v1 against project D1s (or Postgres on GCP), and `canopy dev --local`
+* mounts the very same router against PGlite — one place to change when the
+* API surface moves.
+*
+* Paths carry no project: hosts wrap the router with their own auth/scope
+* middleware, resolve the project themselves (gateway-stamped
+* X-Canopy-Project or token scope — see canopy-api's session.ts), and hand
+* back the store in `config.store` (returning a Response for not-found/paused…).
+*/
+const COLLECTION_RE = /^[a-z][a-z0-9_]{0,63}$/;
+const FIELD_RE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
+const MAX_DOC_BYTES = 256 * 1024;
+const MAX_LIMIT = 1e3;
+/** Row cap for versioned /db/sql responses (the legacy shape is uncapped). */
+const MAX_SQL_ROWS = 1e3;
+/**
+* Statement classifier for read-only /db/sql runs. First keyword must be a
+* read; WITH additionally may not smuggle DML in a CTE (impossible on SQLite,
+* possible on Postgres — where hosts also enforce `SET TRANSACTION READ ONLY`
+* at the engine, making this the belt to that suspender).
+*/
+function readOnlySqlViolation(query) {
+	const bare = query.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/'(?:[^']|'')*'/g, "''").replace(/"(?:[^"]|"")*"/g, "\"\"");
+	const first = /^\s*([A-Za-z]+)/.exec(bare)?.[1]?.toUpperCase();
+	if (first === void 0) return "empty statement";
+	if (![
+		"SELECT",
+		"EXPLAIN",
+		"VALUES",
+		"WITH"
+	].includes(first)) return `${first} is not allowed in read-only mode`;
+	const dml = /\b(INSERT|UPDATE|DELETE|MERGE|REPLACE|CREATE|ALTER|DROP|TRUNCATE|GRANT|REVOKE|VACUUM|ATTACH|REINDEX)\b/i.exec(bare);
+	if (first === "WITH" && dml) return `${dml[1].toUpperCase()} is not allowed in read-only mode`;
+	if (first === "EXPLAIN" && dml && /\bANALYZE\b/i.test(bare)) return "EXPLAIN ANALYZE on a write is not allowed in read-only mode";
+	return null;
+}
+function toDoc(row) {
+	return {
+		...JSON.parse(row.data),
+		_id: row.id,
+		_createdAt: row.created_at,
+		_updatedAt: row.updated_at
+	};
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** User fields only — `_`-prefixed keys are platform-managed. */
+function stripMetaKeys(doc) {
+	return Object.fromEntries(Object.entries(doc).filter(([key]) => !key.startsWith("_")));
+}
+function isScalar(value) {
+	return value === null || [
+		"string",
+		"number",
+		"boolean"
+	].includes(typeof value);
+}
+var BadQuery = class extends Error {};
+/** Validate a where object: known meta keys / dot-path fields, scalar values. */
+function validateWhere(where) {
+	for (const [field, value] of Object.entries(where)) {
+		if (!isScalar(value)) throw new BadQuery(`where.${field}: only string/number/boolean/null values are supported`);
+		if (!META_COLUMNS[field] && !FIELD_RE.test(field)) throw new BadQuery(`where.${field}: invalid field name`);
+	}
+	return where;
+}
+function intParam(raw, name, fallback, max) {
+	if (raw === void 0) return fallback;
+	if (!/^\d{1,9}$/.test(raw)) throw new BadQuery(`${name} must be a non-negative integer`);
+	return Math.min(Number(raw), max);
+}
+function dbRouter(config) {
+	const db = new Hono();
+	const resolve = async (c) => config.store(c);
+	db.post("/db/sql", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store } = resolved;
+		const body = await c.req.json().catch(() => ({}));
+		const params = body.params ?? [];
+		if (typeof body.query !== "string" || body.query.trim() === "" || !Array.isArray(params) || !params.every(isScalar) || !(body.readonly === void 0 || typeof body.readonly === "boolean")) return c.json({
+			error: "invalid_query",
+			detail: "expected { query: string, params?: (string|number|boolean|null)[], readonly?: boolean }"
+		}, 400);
+		if (body.readonly === void 0) {
+			const result = await store.query(body.query, params).catch((err) => err);
+			if (result instanceof Error) return c.json({
+				error: "sql_error",
+				detail: result.message
+			}, 400);
+			return c.json(result.results);
+		}
+		if (body.readonly) {
+			const violation = readOnlySqlViolation(body.query);
+			if (violation) return c.json({
+				error: "read_only",
+				detail: violation
+			}, 400);
+		}
+		const result = await store.query(body.query, params, { readonly: body.readonly }).catch((err) => err);
+		if (result instanceof Error) return c.json({
+			error: "sql_error",
+			detail: result.message
+		}, 400);
+		if (!body.readonly) await config.onSqlWrite?.(c, body.query);
+		const truncated = result.results.length > MAX_SQL_ROWS;
+		const rows = truncated ? result.results.slice(0, MAX_SQL_ROWS) : result.results;
+		return c.json({
+			rows,
+			rowCount: rows.length,
+			truncated
+		});
+	});
+	db.get("/db/schema", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const schema = await introspectSchema(resolved.store, resolved.dialect.name).catch((err) => err);
+		if (schema instanceof Error) return c.json({
+			error: "sql_error",
+			detail: schema.message
+		}, 400);
+		return c.json(schema);
+	});
+	db.post("/db/:collection", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const body = await c.req.json().catch(() => void 0);
+		if (!isPlainObject(body)) return c.json({
+			error: "invalid_document",
+			detail: "expected a JSON object"
+		}, 400);
+		const fields = stripMetaKeys(body);
+		const data = JSON.stringify(fields);
+		if (data.length > MAX_DOC_BYTES) return c.json({
+			error: "document_too_large",
+			maxBytes: MAX_DOC_BYTES
+		}, 413);
+		const id = crypto.randomUUID();
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const insert = dialect.insert(collection, id, data, now);
+		await store.query(insert.sql, insert.params);
+		return c.json({
+			...fields,
+			_id: id,
+			_createdAt: now,
+			_updatedAt: now
+		}, 201);
+	});
+	db.get("/db/:collection", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const q = c.req.query();
+		try {
+			const limit = intParam(q.limit, "limit", 100, MAX_LIMIT);
+			const offset = intParam(q.offset, "offset", 0, 1e9);
+			let whereRaw = {};
+			if (q.where !== void 0) {
+				try {
+					whereRaw = JSON.parse(q.where);
+				} catch {
+					throw new BadQuery("where must be a JSON object");
+				}
+				if (!isPlainObject(whereRaw)) throw new BadQuery("where must be a JSON object");
+			}
+			const where = validateWhere(whereRaw);
+			let query;
+			if (q.search !== void 0) {
+				query = dialect.search({
+					collection,
+					text: q.search,
+					where,
+					limit,
+					offset
+				});
+				if (query === null) return c.json([]);
+			} else {
+				if (q.orderBy !== void 0 && !META_COLUMNS[q.orderBy] && !FIELD_RE.test(q.orderBy)) throw new BadQuery("orderBy: invalid field name");
+				if (q.order !== void 0 && q.order !== "asc" && q.order !== "desc") throw new BadQuery("order must be 'asc' or 'desc'");
+				query = dialect.find({
+					collection,
+					where,
+					orderBy: q.orderBy,
+					order: q.order === "desc" ? "desc" : "asc",
+					limit,
+					offset
+				});
+			}
+			const result = await store.query(query.sql, query.params);
+			return c.json(result.results.map(toDoc));
+		} catch (err) {
+			if (err instanceof BadQuery) return c.json({
+				error: "invalid_query",
+				detail: err.message
+			}, 400);
+			throw err;
+		}
+	});
+	db.get("/db/:collection/:id", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const get = dialect.get(collection, c.req.param("id"));
+		const row = (await store.query(get.sql, get.params)).results[0];
+		return c.json(row ? toDoc(row) : null);
+	});
+	db.patch("/db/:collection/:id", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const body = await c.req.json().catch(() => void 0);
+		if (!isPlainObject(body)) return c.json({
+			error: "invalid_patch",
+			detail: "expected a JSON object"
+		}, 400);
+		const patch = dialect.patch(collection, c.req.param("id"), JSON.stringify(stripMetaKeys(body)), (/* @__PURE__ */ new Date()).toISOString());
+		const row = (await store.query(patch.sql, patch.params)).results[0];
+		if (!row) return c.json({ error: "not_found" }, 404);
+		return c.json(toDoc(row));
+	});
+	db.delete("/db/:collection/:id", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const { store, dialect } = resolved;
+		const collection = c.req.param("collection");
+		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const del = dialect.del(collection, c.req.param("id"));
+		const result = await store.query(del.sql, del.params);
+		return c.json({ deleted: (result.meta.changes ?? 0) > 0 });
+	});
+	return db;
+}
+//#endregion
+export { META_COLUMNS as n, blobRouter as r, dbRouter as t };

package/dist/{upgrade-B86Ao6T5.mjs → upgrade-fhfrid_O.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-DJHlTEhS.mjs");
+		const { skillInstalled } = await import("./skill-BOWfqwr2.mjs");
 		const refreshSkill = skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -20,8 +20,8 @@
     "esbuild": "^0.28.1",
     "hono": "^4.8.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy": "0.0.4",
-    "@mediamonks/canopy-data-plane": "0.0.3"
+    "@mediamonks/canopy": "0.0.5",
+    "@mediamonks/canopy-data-plane": "0.0.4"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/dev-BYxSHUH6.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-DtoZrexp.mjs";
-export { devCommand };

package/dist/docs/ci.md

@@ -1,50 +0,0 @@
----
-title: CI and deploy tokens
-description: Push-to-main deploys using a project-scoped deploy token.
----
-
-Interactive `canopy login` is for humans at a terminal. For automated deploys
-(GitHub Actions, etc.) use a **deploy token**: a project-scoped credential that
-can deploy that one project and nothing else.
-
-## Create a token
-
-From inside the project directory:
-
-```bash
-canopy token create --name "GitHub Actions"
-```
-
-This prints the token **once** — copy it immediately and store it as a CI secret
-(e.g. `CANOPY_DEPLOY_TOKEN`). It is not shown again.
-
-Manage tokens:
-
-```bash
-canopy token list
-canopy token revoke <id>
-```
-
-## Use it in CI
-
-The CLI picks up `CANOPY_DEPLOY_TOKEN` from the environment and uses it instead
-of an interactive login. A minimal GitHub Actions step:
-
-```yaml
-- run: npm install -g @mediamonks/canopy-cli
-- run: canopy deploy
-  env:
-    CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
-```
-
-(`canopy deploy` runs the project's `canopy.json` build command by default;
-pass `--no-build` if CI already built the output directory.)
-
-No `canopy login` step is needed — the token is the credential.
-
-## Notes
-
-- A deploy token can only deploy its own project — it reaches that project's
-  deploy endpoints and upload grants and nothing else. If it strays to another
-  project's resources, the platform rejects it.
-- Revoke a token the moment it might be exposed; create a fresh one to replace it.

package/dist/docs/cli-create.md

@@ -1,46 +0,0 @@
----
-title: canopy create
-description: Register a new project on Canopy and scaffold it locally from a starter template.
----
-
-`canopy create` is the start of every new project: it registers the project on Canopy (claiming its slug and live URL) and scaffolds a runnable starter into `./<slug>/`. Everything is prompted for interactively, or passable as flags for scripted use.
-
-## Usage
-
-```bash
-canopy create                             # fully interactive
-canopy create "My Portfolio" --slug my-portfolio --template spa
-canopy create existing-app --no-scaffold  # register only, no files written
-```
-
-## Arguments & flags
-
-- `<name>` — the project's display name. Multi-word names work unquoted (every positional joins the name). Prompted for when omitted on a TTY.
-- `--slug <slug>` — the URL slug; the project will live at `https://<slug>.<site-domain>`. Lowercase letters, digits and dashes only. Defaults to a slugified version of the name (prompted on a TTY).
-- `--template <id>` — starter to scaffold: `static` (plain HTML/CSS/JS, no build step, untyped SDK from the platform — simplest apps), `spa` (Vite + React + TypeScript with the typed SDK from npm — best for real SDK use or growth), or `worker` (`spa` plus a backend worker in `worker/` — for server-side code: secrets, schedules, calling external APIs). A picker appears when omitted on a TTY; `static` is the default otherwise.
-- `--scaffold` / `--no-scaffold` — whether to write `./<slug>/` from the template. When neither is given, the CLI scaffolds unless the current directory already has a `canopy.json` (in which case it assumes you're registering an existing app and only registers).
-- `--profile <site>` — global flag (or `CANOPY_PROFILE`): which site to create the project on. The chosen profile is pinned into the scaffolded `canopy.json`.
-
-## How it works
-
-The project is registered with the platform first — this is what reserves the slug and creates the entry you'll see in `canopy projects` and the dashboard. Taken, reserved, or invalid slugs fail here with an actionable error, before anything touches disk.
-
-With scaffolding on, the CLI then copies the template into `./<slug>/` (refusing if that directory already exists), substituting the name and slug into the files, and writes a `canopy.json` containing the slug and the profile pin. Templates ship a README, an `AGENTS.md`, and a `.gitignore`; the `spa` template also needs an `npm install` before `canopy dev`. With `--no-scaffold`, nothing is written — an existing `canopy.json` is left untouched, and you're told to add one if the directory has none.
-
-The live URL is printed at the end, but it only serves content after your first `canopy deploy`.
-
-## Examples
-
-```bash
-canopy create
-```
-
-Walks you through name, slug, and template, registers the project, and scaffolds a ready-to-run starter with next steps printed.
-
-```bash
-canopy create "Team Retro Board" --slug retro-board --template spa
-```
-
-Registers `retro-board`, scaffolds a React SPA into `./retro-board/`, and tells you to `npm install` then `canopy dev`.
-
-To set up a local folder for a project that already exists on Canopy, use [canopy init](https://docs.canopy.website/cli/init) instead. See also [canopy projects](https://docs.canopy.website/cli/projects) and [canopy delete](https://docs.canopy.website/cli/delete).