@mediamonks/canopy-cli 0.7.12 → 0.7.13

package/dist/{egress-CN_axsAN.mjs → egress-BFSwa8Uu.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors } from "./ui-2mrJcjYC.mjs";
+import { c as apiRequest, n as reportErrors } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 //#region src/egress.ts
 /**

package/dist/{feedback-B-GXUBPs.mjs → feedback-BMX_d4KZ.mjs}

@@ -1,6 +1,6 @@
-import { t as version } from "./package-CDLufecy.mjs";
+import { t as version } from "./package-vJXq4RNN.mjs";
 import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, l as apiUpload, n as reportErrors, s as apiDownload } from "./ui-2mrJcjYC.mjs";
+import { c as apiRequest, l as apiUpload, n as reportErrors, s as apiDownload } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-CDLufecy.mjs";
+import { t as version } from "./package-vJXq4RNN.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BUlQR117.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,29 +60,30 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-D7dI8D9N.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-D7dI8D9N.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-D7dI8D9N.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-C6JQjVqg.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-C6JQjVqg.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-C6JQjVqg.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-C6JQjVqg.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-CySBxW7I.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-B1WrPq5W.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-B1WrPq5W.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-Bw1D_J8M.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-B1WrPq5W.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-B1WrPq5W.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-D7zrIF8G.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-CN_axsAN.mjs").then((m) => m.egressCommand),
-		feedback: () => import("./feedback-B-GXUBPs.mjs").then((m) => m.feedbackCommand),
-		db: () => import("./db-8Etjmzxh.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-CX1Izj_l.mjs").then((m) => m.usageCommand),
-		open: () => import("./open-DRPp4QJg.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-DxB7NhZs.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-BOWfqwr2.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-fhfrid_O.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-DNiZquki.mjs").then((m) => m.logsCommand)
+		login: () => import("./login-BDTO3nVw.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-BDTO3nVw.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-BDTO3nVw.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-MMbv7MmK.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-MMbv7MmK.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-MMbv7MmK.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-MMbv7MmK.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-BqLvttKc.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-D8G4amjO.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-BUxgRJVA.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-BFSwa8Uu.mjs").then((m) => m.egressCommand),
+		schedule: () => import("./schedule-Cq9K0rnE.mjs").then((m) => m.scheduleCommand),
+		feedback: () => import("./feedback-BMX_d4KZ.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-DKnJQPm5.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-DjNngyvy.mjs").then((m) => m.usageCommand),
+		open: () => import("./open-C5x3tX6I.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-BBMVxVta.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-Zq9aIPKf.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-ES8u8_Pn.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-C53y2eAS.mjs").then((m) => m.logsCommand)
 	}
 });
 if (process.argv[2] !== "upgrade") notifyOfUpdate(version);

package/dist/{local-BGRd_FMZ.mjs → local-BQxsp-ZQ.mjs}

@@ -1,6 +1,6 @@
-import { o as apiDataRequest } from "./ui-2mrJcjYC.mjs";
+import { o as apiDataRequest } from "./ui-B1Px5y7q.mjs";
 import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-Bu4Ze32I.mjs";
-import { n as rewriteApiPath } from "./dev-BnUYGQQm.mjs";
+import { n as rewriteApiPath } from "./dev-CyJT6EfQ.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{login-D7dI8D9N.mjs → login-BDTO3nVw.mjs}

@@ -1,5 +1,5 @@
 import { _ as getBakedProfile, d as clearAllProfileTokens, f as listBakedProfiles, g as writeConfigFile, h as upsertProfileAuth, m as setActiveProfile, n as siteConfig, p as readConfigFile, v as isProfileId } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-2mrJcjYC.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";

package/dist/{logs-DNiZquki.mjs → logs-C53y2eAS.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-2mrJcjYC.mjs";
+import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{migrations-C-5x6SYf.mjs → migrations-C6EcKD6a.mjs}

@@ -1,5 +1,5 @@
 import { u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { o as apiDataRequest } from "./ui-2mrJcjYC.mjs";
+import { o as apiDataRequest } from "./ui-B1Px5y7q.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-DRPp4QJg.mjs → open-C5x3tX6I.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-2mrJcjYC.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-CDLufecy.mjs → package-vJXq4RNN.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.12";
+var version = "0.7.13";
 //#endregion
 export { version as t };

package/dist/{projects-C6JQjVqg.mjs → projects-MMbv7MmK.mjs}

@@ -1,5 +1,5 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-2mrJcjYC.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/schedule-Cq9K0rnE.mjs

@@ -0,0 +1,106 @@
+import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
+import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-B1Px5y7q.mjs";
+import { defineCommand } from "citty";
+//#region src/schedule.ts
+/**
+* canopy schedule — manage the project's cron schedules (docs/07-schedules.md).
+* Each schedule ticks the backend worker's scheduled() handler on its cron.
+* Same control-plane routes the dashboard's Schedules panel uses.
+*/
+/** One line per schedule: name, cron, state, last run. */
+function renderSchedules(schedules) {
+	const nameWidth = Math.max(...schedules.map((s) => s.name.length));
+	const cronWidth = Math.max(...schedules.map((s) => s.cron.length));
+	return schedules.map((s) => {
+		const state = s.enabled ? "enabled " : "disabled";
+		const lastRun = s.last_run_at ? `last run ${s.last_run_at} ${s.last_status ?? ""}`.trimEnd() + (s.last_error ? ` (${s.last_error})` : "") : "never run";
+		return `${s.name.padEnd(nameWidth)}  ${s.cron.padEnd(cronWidth)}  ${state}  ${lastRun}`;
+	}).join("\n");
+}
+const scheduleCommand = defineCommand({
+	meta: {
+		name: "schedule",
+		description: "Manage the project's cron schedules (they tick the backend worker)"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List the project's cron schedules"
+			},
+			args: {
+				...projectFlagArgs,
+				json: {
+					type: "boolean",
+					description: "Print raw JSON (same shape as the dashboard Schedules API)",
+					default: false
+				}
+			},
+			run: reportErrors("schedule list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { schedules, max } = await withContext(apiRequest("GET", `/projects/${slug}/schedules`), { action: `list schedules for "${slug}"` });
+				if (args.json) {
+					console.log(JSON.stringify({
+						slug,
+						schedules,
+						max
+					}, null, 2));
+					return;
+				}
+				if (schedules.length === 0) {
+					console.log(`No schedules for ${slug} — add one with \`canopy schedule add <name> "<cron>"\`.`);
+					return;
+				}
+				console.log(renderSchedules(schedules));
+			})
+		}),
+		add: defineCommand({
+			meta: {
+				name: "add",
+				description: "Add or update a schedule (e.g. canopy schedule add refresh-feeds \"0 5 * * *\")"
+			},
+			args: {
+				name: {
+					type: "positional",
+					description: "Schedule name (lowercase letters, digits, hyphens)",
+					required: true
+				},
+				cron: {
+					type: "positional",
+					description: "Five-field cron expression, quoted (e.g. \"0 5 * * *\")",
+					required: true
+				},
+				...projectFlagArgs
+			},
+			run: reportErrors("schedule add", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { schedule } = await withContext(apiRequest("PUT", `/projects/${slug}/schedules/${encodeURIComponent(args.name)}`, { cron: args.cron }), { action: `add schedule "${args.name}" to "${slug}"` });
+				console.log(`Scheduled ${schedule.name} (${schedule.cron}) for ${slug} — it ticks the worker's scheduled() handler.`);
+			})
+		}),
+		remove: defineCommand({
+			meta: {
+				name: "remove",
+				description: "Remove a schedule"
+			},
+			args: {
+				name: {
+					type: "positional",
+					description: "Schedule name to remove",
+					required: true
+				},
+				...projectFlagArgs
+			},
+			run: reportErrors("schedule remove", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("DELETE", `/projects/${slug}/schedules/${encodeURIComponent(args.name)}`), {
+					action: `remove schedule "${args.name}" from "${slug}"`,
+					fixes: { not_found: `No schedule named "${args.name}" on ${slug} — see \`canopy schedule list\`.` }
+				});
+				console.log(`Removed ${args.name} from ${slug} — it will not run again.`);
+			})
+		})
+	}
+});
+//#endregion
+export { scheduleCommand };

package/dist/skill/canopy/SKILL.md

@@ -0,0 +1,160 @@
+---
+name: canopy
+description: >-
+  Build, run, and deploy projects on Canopy — Monks' managed platform for
+  vibecoded apps (hosting + database + blob storage + AI). Use this whenever the
+  user wants to create a Canopy project, run/deploy one, manage its data or
+  deploy tokens, or asks how to use the `canopy` CLI. All platform docs are
+  available offline via `canopy docs`.
+---
+
+# Canopy
+
+Canopy is Monks' managed platform for vibecoded projects. Everything is driven
+by one CLI: **`canopy`**. This skill tells you how to drive it; the CLI itself
+carries the full, always-current documentation.
+
+## First: is the CLI installed and signed in?
+
+Run these before anything else, in order:
+
+```bash
+canopy --version   # is the CLI installed?
+canopy whoami      # is there a valid login?
+```
+
+- **`canopy --version` fails / command not found** → install it:
+
+  ```bash
+  npm install -g @mediamonks/canopy-cli
+  ```
+
+  (Needs Node.js 20+. If `npm` is missing, tell the user to install Node first.)
+
+- **`canopy whoami` says not logged in / expired** → run:
+  ```bash
+  canopy login
+  ```
+  This opens the user's browser. **Then STOP and tell the user to complete the
+  sign-in in their browser.** The command waits for them and finishes on its own.
+  - Never ask for or type the user's password, OneLogin codes, or any
+    credentials yourself.
+  - Login only works on the user's own machine (it uses a `127.0.0.1` redirect).
+    If you're on a remote/headless box, tell the user — it can't complete there.
+  - `canopy login --json` gives machine-readable status if you need to parse it.
+
+Skip login if `canopy whoami` already shows a valid, unexpired token.
+
+## Then: offer to build their first project
+
+Once the CLI is installed and signed in, **do not just print a list of
+commands and stop.** The person following the getting-started prompt is often
+non-technical and expects you to drive. Take the lead:
+
+1. Ask them, in plain language, whether they'd like to create their first
+   Canopy project now — and **what it's about** (what should it do, who's it
+   for). Ask one short question at a time; wait for the answer.
+2. From their answer, pick a sensible name and template (see the template
+   guidance below — default to `spa` for anything beyond a trivial page), then
+   scaffold it for them non-interactively, e.g.
+   `canopy create "Their App Name" --template spa`.
+3. `cd` into the new folder, then keep going — build the thing they described,
+   running `canopy dev` to preview and `canopy docs`/`canopy <cmd> --help`
+   whenever you need platform details.
+
+Only fall back to handing them raw commands if they say they'd rather do it
+themselves. The goal is a working first project, not a command cheat-sheet.
+
+## Then: read the docs for whatever you're doing
+
+The CLI ships the full documentation and keeps it fresh from the platform. List
+the topics and read the relevant one _before_ running unfamiliar commands:
+
+```bash
+canopy docs            # list all topics
+canopy docs deploy     # print one topic
+```
+
+The listing is grouped by section: guides (`getting-started`, `deploy`, `dev`,
+`data`, `ci`, `troubleshooting`, …), platform feature pages (`platform-*`), a
+per-command CLI reference (`cli-<command>`, plus `cli` for the one-page
+overview), and the SDK reference (`sdk-*`). Always prefer `canopy docs` and
+`canopy <command> --help` over guessing flags — they are the source of truth
+and never go stale.
+
+## Command map (quick orientation — see `canopy docs cli` for detail)
+
+- Create a **new** project: `canopy create`
+- Set up a folder for an **existing** project (e.g. made in the dashboard):
+  `canopy init <slug>` — never use `canopy create` for a project that already
+  exists; that would register a duplicate. `canopy init <slug> .` targets the
+  current directory; add `--no-scaffold` to link an app you already have.
+- Run locally: `canopy dev` (live data) or `canopy dev --local` (offline sandbox)
+- Deploy: `canopy deploy` (add `--build` if the project has a build step)
+- Test first on staging: `canopy deploy --staging` → verify → `canopy promote`
+  (own database cloned from live; `canopy staging status | sync | destroy`)
+- Roll back: `canopy rollback`
+- Open the live site: `canopy open`
+- Manage data: `canopy db pull | snapshot | snapshots | restore | migrate`
+- Work bug reports & feedback: `canopy feedback list | show | comment | status | report`
+  — see `canopy docs platform-feedback` for the triage and reporting loops
+- CI credentials: `canopy token create | list | revoke`
+
+## Custom tables & migrations (devs; Drizzle recommended)
+
+The document API (`canopy.db.collection(…)`) needs no schema — prefer it. When
+a project defines its **own tables** (raw `canopy.db.sql()` / Drizzle), use the
+migrations flow — read `canopy docs migrations` first. The rules that prevent
+confusing failures:
+
+- Pin `"dialect"` and `"migrations"` in `canopy.json`; put ordered `.sql`
+  files in that directory (Drizzle: `npx drizzle-kit generate` writes them).
+- **There is no `DATABASE_URL` and never will be.** Never run
+  `drizzle-kit push`/`migrate`/`studio` or Drizzle's runtime `migrate()` —
+  generating is local, applying is Canopy's job: `canopy deploy` applies
+  pending migrations automatically (`canopy db migrate` applies without a
+  deploy; `canopy dev --local` applies to the sandbox on boot).
+- Never edit an applied migration (the platform refuses edited history) and
+  never reference `_canopy_*` tables.
+- **Schema change? Rehearse it on staging.** `canopy deploy --staging` applies
+  pending migrations to the staging database (a clone of live) — verify the
+  app there, then `canopy promote` replays them against live and flips the
+  version. Never promote with failing checks.
+
+## Choosing a starter template (`canopy create` / `canopy init`)
+
+Both `canopy create` and `canopy init` scaffold from the same three templates.
+**`static` is the default, but reach
+for it only when the app is genuinely trivial** — a page or two with light SDK
+use. Its SDK is served untyped from the platform (`/_api/data/v1/sdk.js`): no
+autocomplete, no type-checking, mistakes only show up in the browser.
+
+Prefer **`spa`** the moment either is true — which covers most real projects:
+
+- **You lean on the SDK** (`db` queries, `blob`, `ai` — anything past a stray
+  `auth.user()`). `spa` installs the SDK from npm (`@mediamonks/canopy`), fully
+  typed, so the compiler catches mistakes as you write them.
+- **The app will grow.** `spa` is Vite + React + TypeScript, giving components,
+  routing, and state a real home; `static` has no build step to organise into.
+
+Use **`worker`** when you need server-side backend code — e.g. calling an
+external API with a secret the browser can't hold, or running scheduled jobs.
+It's `spa` plus Hono-style handlers in `worker/`; `canopy deploy` publishes
+the frontend and the worker together.
+
+Non-interactive: `canopy create "My App" --template spa`. **When unsure between
+`static` and `spa`, pick `spa`.**
+
+## Safety rules
+
+- **Destructive commands** — `canopy db restore` and `canopy delete` wipe data.
+  Confirm intent with the user first, and take a `canopy db snapshot` before
+  restores.
+- **Deploys are public.** `canopy deploy` makes a version live. Confirm before
+  deploying unless the user clearly asked you to.
+- Keep the CLI current: `canopy upgrade` (this also refreshes this skill).
+- **A `canopy` command itself failing?** First rule out user error (re-read
+  `canopy docs troubleshooting` and the command's `--help`). If the platform
+  really misbehaved, check `canopy feedback mine` for a duplicate, then file it:
+  `canopy feedback report "<what happened>" --command "<the command>" --error "<output>"`
+  — it reaches the platform team directly (no `--project` needed).

package/dist/{skill-BOWfqwr2.mjs → skill-Zq9aIPKf.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-CDLufecy.mjs";
-import { n as reportErrors } from "./ui-2mrJcjYC.mjs";
+import { t as version } from "./package-vJXq4RNN.mjs";
+import { n as reportErrors } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";

package/dist/{staging-Bw1D_J8M.mjs → staging-D8G4amjO.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty, u as withContext } from "./ui-2mrJcjYC.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty, u as withContext } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/templates/spa/.github/workflows/canopy-deploy.yml

@@ -0,0 +1,34 @@
+# Deploy to Canopy on every push to main. GitHub's runners are the build
+# farm — the platform owns no build infrastructure.
+#
+# Needs a CANOPY_DEPLOY_TOKEN repo secret: create a deploy token in the
+# dashboard (project → Settings → Deploy tokens) or with `canopy token
+# create`, then add it via `gh secret set CANOPY_DEPLOY_TOKEN` or the repo's
+# Settings → Secrets. Until the secret is set, this workflow skips itself
+# instead of failing the build.
+name: Deploy to Canopy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install dependencies
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: |
+          if [ -f package-lock.json ]; then npm ci; else npm install; fi
+      - name: Deploy
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: npm exec --yes @mediamonks/canopy-cli deploy
+      - name: Skipped (no deploy token)
+        if: env.CANOPY_DEPLOY_TOKEN == ''
+        run: echo "CANOPY_DEPLOY_TOKEN secret not set — skipping deploy."

package/dist/templates/spa/AGENTS.md

@@ -0,0 +1,47 @@
+# {{name}} — a Canopy React SPA
+
+A Vite + React single-page app on [Canopy](https://dashboard.thanarie.dev),
+Monks' managed platform for internal projects. Everything is served behind
+company login; there is no infrastructure to manage and none should be added.
+
+## Canopy skill
+
+The full SDK reference (auth, db, blob, ai) and platform guardrails ship as an
+agent skill, kept out of this scaffold so it stays current. Install it before
+building features:
+
+```
+npx skills add mediamonks/canopy
+```
+
+If that fails the skill isn't published yet — the SDK surface is documented on
+the [Canopy dashboard](https://dashboard.thanarie.dev).
+
+## Working on this project
+
+- A standard Vite + React + TypeScript app; `npm install` once, then develop
+  with `canopy dev` (it runs Vite with this project's `vite.config.ts` and
+  proxies `/_api` to the platform).
+- The SDK comes from npm (`@mediamonks/canopy`) — the shared instance lives in
+  `src/canopy.ts`.
+- `canopy dev` uses LIVE project data: read freely, but take a
+  `canopy db snapshot` before risky data changes.
+- `canopy dev --local [--pull]` — offline sandbox with local data instead;
+  writes never reach the platform. Prefer it for destructive experiments.
+- `canopy deploy` — builds (`npm run build`) and publishes `dist/`; live
+  (behind company login) at https://{{slug}}.thanarie.dev.
+- Risky change (schema migration, backend rework)? `canopy deploy --staging`
+  first — a private copy with its own database cloned from live — verify, then
+  `canopy promote` ships the exact tested version. Never promote with failing
+  checks.
+
+## Boundaries
+
+- Do not add auth — the platform authenticates every request before it
+  reaches this app.
+- Do not store secrets anywhere in this project, and never call external APIs
+  that need them from the browser — all backend needs go through the Canopy
+  SDK (`canopy.auth`, `canopy.db`, `canopy.blob`, `canopy.ai`).
+- Frontend only: no SSR, no custom servers, no databases outside `canopy.db`.
+  (Need backend code? Recreate on the `worker` template, or ask the Canopy
+  team.)

package/dist/templates/spa/README.md

@@ -0,0 +1,14 @@
+# {{name}}
+
+A [Canopy](https://dashboard.thanarie.dev) project — Vite + React. Live
+(behind company login) at https://{{slug}}.thanarie.dev after the first
+`canopy deploy`.
+
+- `npm install` — once, then:
+- `canopy dev` — develop locally against the live platform (real data!)
+- `canopy dev --local [--pull]` — offline sandbox with local data instead
+- `canopy deploy` — build and publish `dist/`
+- `AGENTS.md` — project guardrails and skill setup for coding agents
+
+Push-to-main deploys are prepared in `.github/workflows/canopy-deploy.yml`
+(needs a `CANOPY_DEPLOY_TOKEN` repo secret — see the workflow file).

package/dist/templates/spa/_gitignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+.canopy/
+.DS_Store

package/dist/templates/spa/canopy.json

@@ -0,0 +1,5 @@
+{
+  "slug": "{{slug}}",
+  "build": "npm run build",
+  "dist": "dist"
+}

package/dist/templates/spa/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{name}}</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/dist/templates/spa/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "{{slug}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "canopy dev",
+    "build": "tsc && vite build"
+  },
+  "dependencies": {
+    "@mediamonks/canopy": "^0.0.4",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "@vitejs/plugin-react": "^5.0.0",
+    "typescript": "^5.8.0",
+    "vite": "^7.0.0"
+  }
+}

package/dist/templates/spa/src/app.tsx

@@ -0,0 +1,25 @@
+import { useEffect, useState } from "react";
+import { canopy } from "./canopy.ts";
+
+export function App() {
+  const [status, setStatus] = useState("connecting to Canopy…");
+
+  useEffect(() => {
+    canopy.auth
+      .user()
+      .then((user) => setStatus(`signed in as ${user.email}`))
+      .catch(() => setStatus("could not reach Canopy — is `canopy dev` running?"));
+  }, []);
+
+  return (
+    <main>
+      <h1>{"{{name}}"}</h1>
+      <p className="status">{status}</p>
+      <section>
+        <p className="placeholder">
+          Start building — edit <code>src/app.tsx</code>, then run <code>canopy deploy</code>.
+        </p>
+      </section>
+    </main>
+  );
+}

package/dist/templates/spa/src/canopy.ts

@@ -0,0 +1,5 @@
+// One SDK instance for the whole app. Auth (auth), data (db), files (blob)
+// and AI (ai) are all live — see AGENTS.md for how to get the full reference.
+import { createCanopy } from "@mediamonks/canopy";
+
+export const canopy = createCanopy();

package/dist/templates/spa/src/main.tsx

@@ -0,0 +1,10 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { App } from "./app.tsx";
+import "./style.css";
+
+createRoot(document.getElementById("root") as HTMLElement).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

package/dist/templates/spa/src/style.css

@@ -0,0 +1,29 @@
+:root {
+  font-family: system-ui, sans-serif;
+  color-scheme: light dark;
+}
+
+body {
+  margin: 0;
+  display: grid;
+  place-items: center;
+  min-height: 100vh;
+}
+
+main {
+  max-width: 40rem;
+  padding: 2rem;
+  text-align: center;
+}
+
+.status {
+  font-size: 0.9rem;
+  opacity: 0.7;
+}
+
+.placeholder {
+  border: 1px dashed color-mix(in srgb, currentColor 30%, transparent);
+  border-radius: 8px;
+  padding: 1.5rem;
+  opacity: 0.6;
+}