@mediamonks/canopy-cli 0.7.12 → 0.7.13

package/dist/templates/spa/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "allowImportingTsExtensions": true,
+    "noUncheckedIndexedAccess": true
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/dist/templates/spa/vite.config.ts

@@ -0,0 +1,7 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+// `canopy dev` picks this config up and adds its own /_api proxy on top.
+export default defineConfig({
+  plugins: [react()],
+});

package/dist/templates/static/AGENTS.md

@@ -0,0 +1,45 @@
+# {{name}} — a Canopy static app
+
+A no-build web app on [Canopy](https://dashboard.thanarie.dev), Monks' managed
+platform for internal projects. Everything is served behind company login;
+there is no infrastructure to manage and none should be added.
+
+## Canopy skill
+
+The full SDK reference (auth, db, blob, ai) and platform guardrails ship as an
+agent skill, kept out of this scaffold so it stays current. Install it before
+building features:
+
+```
+npx skills add mediamonks/canopy
+```
+
+If that fails the skill isn't published yet — the SDK surface is documented on
+the [Canopy dashboard](https://dashboard.thanarie.dev).
+
+## Working on this project
+
+- Plain html/css/js in this directory — no bundler, no install step. The
+  Canopy SDK is imported straight from the platform, so it always matches the
+  API version: `import { createCanopy } from "/_api/data/v1/sdk.js";`
+- `canopy dev` — local dev server; its `/_api` proxies to the real platform.
+  That is LIVE project data: read freely, but take a `canopy db snapshot`
+  before risky data changes.
+- `canopy dev --local [--pull]` — offline sandbox with local data instead;
+  writes never reach the platform. Prefer it for destructive experiments.
+- `canopy deploy` — publish; live (behind company login) at
+  https://{{slug}}.thanarie.dev.
+- Risky change (schema migration, backend rework)? `canopy deploy --staging`
+  first — a private copy with its own database cloned from live — verify, then
+  `canopy promote` ships the exact tested version. Never promote with failing
+  checks.
+
+## Boundaries
+
+- Do not add auth — the platform authenticates every request before it
+  reaches this app.
+- Do not store secrets anywhere in this project, and never call external APIs
+  that need them from the browser — all backend needs go through the Canopy
+  SDK (`canopy.auth`, `canopy.db`, `canopy.blob`, `canopy.ai`).
+- Keep it a static site: no SSR, no custom servers, no databases outside
+  `canopy.db`.

package/dist/templates/static/README.md

@@ -0,0 +1,9 @@
+# {{name}}
+
+A [Canopy](https://dashboard.thanarie.dev) project. Live (behind company
+login) at https://{{slug}}.thanarie.dev after the first `canopy deploy`.
+
+- `canopy dev` — develop locally against the live platform (real data!)
+- `canopy dev --local [--pull]` — offline sandbox with local data instead
+- `canopy deploy` — publish the current directory
+- `AGENTS.md` — project guardrails and skill setup for coding agents

package/dist/templates/static/_gitignore

@@ -0,0 +1,2 @@
+.canopy/
+.DS_Store

package/dist/templates/static/canopy.json

@@ -0,0 +1,4 @@
+{
+  "slug": "{{slug}}",
+  "dist": "."
+}

package/dist/templates/static/index.html

@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{name}}</title>
+    <link rel="stylesheet" href="./style.css" />
+  </head>
+  <body>
+    <main>
+      <h1>{{name}}</h1>
+      <p class="status" id="status">connecting to Canopy…</p>
+      <section id="app">
+        <p class="placeholder">
+          Start building — edit <code>main.js</code>, then run <code>canopy deploy</code>.
+        </p>
+      </section>
+    </main>
+    <script type="module" src="./main.js"></script>
+  </body>
+</html>

package/dist/templates/static/main.js

@@ -0,0 +1,9 @@
+// The Canopy SDK is served by the platform itself — nothing to install.
+// Auth (auth), data (db), files (blob) and AI (ai) are all live — see
+// AGENTS.md for how to get the full SDK reference.
+import { createCanopy } from "/_api/data/v1/sdk.js";
+
+const canopy = createCanopy();
+
+const user = await canopy.auth.user();
+document.getElementById("status").textContent = `signed in as ${user.email}`;

package/dist/templates/static/style.css

@@ -0,0 +1,29 @@
+:root {
+  font-family: system-ui, sans-serif;
+  color-scheme: light dark;
+}
+
+body {
+  margin: 0;
+  display: grid;
+  place-items: center;
+  min-height: 100vh;
+}
+
+main {
+  max-width: 40rem;
+  padding: 2rem;
+  text-align: center;
+}
+
+.status {
+  font-size: 0.9rem;
+  opacity: 0.7;
+}
+
+.placeholder {
+  border: 1px dashed color-mix(in srgb, currentColor 30%, transparent);
+  border-radius: 8px;
+  padding: 1.5rem;
+  opacity: 0.6;
+}

package/dist/templates/worker/.dev.vars.example

@@ -0,0 +1,9 @@
+# Local worker secrets for `canopy dev` — copy to .dev.vars (gitignored).
+#
+# Dashboard secrets (Settings → Secrets) are never downloaded: the platform
+# can't hand a stored value back, and live keys don't belong on a laptop. Set
+# local stand-ins here; the worker reads them as c.env.NAME, exactly as it
+# reads the dashboard's in production. `canopy dev` prints which dashboard
+# secret names this file is missing.
+#
+# MY_API_KEY=local-test-key

package/dist/templates/worker/.github/workflows/canopy-deploy.yml

@@ -0,0 +1,34 @@
+# Deploy to Canopy on every push to main. GitHub's runners are the build
+# farm — the platform owns no build infrastructure.
+#
+# Needs a CANOPY_DEPLOY_TOKEN repo secret: create a deploy token in the
+# dashboard (project → Settings → Deploy tokens) or with `canopy token
+# create`, then add it via `gh secret set CANOPY_DEPLOY_TOKEN` or the repo's
+# Settings → Secrets. Until the secret is set, this workflow skips itself
+# instead of failing the build.
+name: Deploy to Canopy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install dependencies
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: |
+          if [ -f package-lock.json ]; then npm ci; else npm install; fi
+      - name: Deploy
+        if: env.CANOPY_DEPLOY_TOKEN != ''
+        run: npm exec --yes @mediamonks/canopy-cli deploy
+      - name: Skipped (no deploy token)
+        if: env.CANOPY_DEPLOY_TOKEN == ''
+        run: echo "CANOPY_DEPLOY_TOKEN secret not set — skipping deploy."

package/dist/templates/worker/AGENTS.md

@@ -0,0 +1,63 @@
+# {{name}} — a Canopy React SPA with a backend Worker
+
+A Vite + React single-page app plus a per-project backend Worker on
+[Canopy](https://dashboard.thanarie.dev), Monks' managed platform for internal
+projects. Everything is served behind company login; there is no
+infrastructure to manage and none should be added.
+
+## Canopy skill
+
+The full SDK reference (auth, db, blob, ai) and platform guardrails ship as an
+agent skill, kept out of this scaffold so it stays current. Install it before
+building features:
+
+```
+npx skills add mediamonks/canopy
+```
+
+If that fails the skill isn't published yet — the SDK surface is documented on
+the [Canopy dashboard](https://dashboard.thanarie.dev).
+
+## Working on this project
+
+- Frontend: a standard Vite + React + TypeScript app in `src/`; `npm install`
+  once, then develop with `canopy dev` (it runs Vite with this project's
+  `vite.config.ts` and proxies `/_api` to the platform).
+- Backend: Hono-style handlers in `worker/index.ts`, serving `/api/*`, plus an
+  optional `scheduled(event, env)` for dashboard Schedules (switch on
+  `event.name`). It runs behind the Canopy gateway (HTTP requests arrive
+  authenticated) and reaches the platform through a service binding — same
+  SDK, same budgets and data isolation as the browser.
+- `canopy dev` serves the worker as well: `/api/*` goes to
+  `worker/index.ts` with the same `env` it gets deployed, no build step. Tick a
+  schedule by hand with
+  `curl -X POST localhost:5173/__canopy/scheduled -d '{"name":"<schedule>"}'`.
+- The SDK comes from npm (`@mediamonks/canopy`) — the browser's shared
+  instance lives in `src/canopy.ts`.
+- `canopy dev` uses LIVE project data: read freely, but take a
+  `canopy db snapshot` before risky data changes.
+- `canopy dev --local [--pull]` — offline sandbox with local data instead;
+  writes never reach the platform. Prefer it for destructive experiments.
+- `canopy deploy` — builds (`npm run build`) and publishes; live (behind
+  company login) at https://{{slug}}.thanarie.dev.
+- Defining your own tables (raw `sql()` / Drizzle)? Use the migrations flow —
+  `canopy docs migrations`. Never invent a `DATABASE_URL` (none exists):
+  generate migrations locally, and `canopy deploy` applies them.
+- Risky change (schema migration, backend rework)? `canopy deploy --staging`
+  first — a private copy with its own database cloned from live — verify, then
+  `canopy promote` ships the exact tested version. Never promote with failing
+  checks.
+
+## Boundaries
+
+- Do not add auth — the platform authenticates every request before it
+  reaches this app or the Worker.
+- Do not store secrets in the repo or SPA. Set them in the Canopy dashboard
+  (Settings → Secrets); the Worker reads them as `c.env.SECRET_NAME`
+  (Workers-shaped bindings — not `process.env`). Locally, put stand-in values
+  in `.dev.vars` (gitignored, see `.dev.vars.example`) — dashboard values are
+  never downloaded, and `canopy dev` prints which names are still missing. Platform access still goes
+  through the Canopy SDK (`canopy.auth`, `canopy.db`, `canopy.blob`,
+  `canopy.ai`) in both the browser and the Worker.
+- The Worker is the only backend: no SSR, no long-running processes, no
+  databases outside `canopy.db` / `c.env.DB`.

package/dist/templates/worker/README.md

@@ -0,0 +1,17 @@
+# {{name}}
+
+A [Canopy](https://dashboard.thanarie.dev) project — Vite + React with a
+backend Worker (`worker/`). Live (behind company login) at
+https://{{slug}}.thanarie.dev after the first `canopy deploy`.
+
+- `npm install` — once, then:
+- `canopy dev` — develop locally against the live platform (real data!);
+  `/api/*` is served by `worker/index.ts`, everything else by the SPA
+- `.dev.vars` — local values for the worker's secrets (copy
+  `.dev.vars.example`); dashboard secrets are never downloaded
+- `canopy dev --local [--pull]` — offline sandbox with local data instead
+- `canopy deploy` — build and publish the frontend and the `worker/` backend
+- `AGENTS.md` — project guardrails and skill setup for coding agents
+
+Push-to-main deploys are prepared in `.github/workflows/canopy-deploy.yml`
+(needs a `CANOPY_DEPLOY_TOKEN` repo secret — see the workflow file).

package/dist/templates/worker/_gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+.canopy/
+.dev.vars
+.DS_Store

package/dist/templates/worker/canopy.json

@@ -0,0 +1,6 @@
+{
+  "slug": "{{slug}}",
+  "build": "npm run build",
+  "dist": "dist",
+  "worker": "worker/index.ts"
+}

package/dist/templates/worker/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{name}}</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/dist/templates/worker/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "{{slug}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "canopy dev",
+    "build": "tsc && vite build"
+  },
+  "dependencies": {
+    "@mediamonks/canopy": "^0.0.4",
+    "hono": "^4.8.0",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "@vitejs/plugin-react": "^5.0.0",
+    "typescript": "^5.8.0",
+    "vite": "^7.0.0"
+  }
+}

package/dist/templates/worker/src/app.tsx

@@ -0,0 +1,25 @@
+import { useEffect, useState } from "react";
+import { canopy } from "./canopy.ts";
+
+export function App() {
+  const [status, setStatus] = useState("connecting to Canopy…");
+
+  useEffect(() => {
+    canopy.auth
+      .user()
+      .then((user) => setStatus(`signed in as ${user.email}`))
+      .catch(() => setStatus("could not reach Canopy — is `canopy dev` running?"));
+  }, []);
+
+  return (
+    <main>
+      <h1>{"{{name}}"}</h1>
+      <p className="status">{status}</p>
+      <section>
+        <p className="placeholder">
+          Start building — edit <code>src/app.tsx</code>, then run <code>canopy deploy</code>.
+        </p>
+      </section>
+    </main>
+  );
+}

package/dist/templates/worker/src/canopy.ts

@@ -0,0 +1,5 @@
+// One SDK instance for the whole app. Auth (auth), data (db), files (blob)
+// and AI (ai) are all live — see AGENTS.md for how to get the full reference.
+import { createCanopy } from "@mediamonks/canopy";
+
+export const canopy = createCanopy();

package/dist/templates/worker/src/main.tsx

@@ -0,0 +1,10 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { App } from "./app.tsx";
+import "./style.css";
+
+createRoot(document.getElementById("root") as HTMLElement).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

package/dist/templates/worker/src/style.css

@@ -0,0 +1,29 @@
+:root {
+  font-family: system-ui, sans-serif;
+  color-scheme: light dark;
+}
+
+body {
+  margin: 0;
+  display: grid;
+  place-items: center;
+  min-height: 100vh;
+}
+
+main {
+  max-width: 40rem;
+  padding: 2rem;
+  text-align: center;
+}
+
+.status {
+  font-size: 0.9rem;
+  opacity: 0.7;
+}
+
+.placeholder {
+  border: 1px dashed color-mix(in srgb, currentColor 30%, transparent);
+  border-radius: 8px;
+  padding: 1.5rem;
+  opacity: 0.6;
+}

package/dist/templates/worker/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "allowImportingTsExtensions": true,
+    "noUncheckedIndexedAccess": true
+  },
+  "include": ["src", "worker", "vite.config.ts"]
+}

package/dist/templates/worker/vite.config.ts

@@ -0,0 +1,7 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+// `canopy dev` picks this config up and adds its own /_api proxy on top.
+export default defineConfig({
+  plugins: [react()],
+});

package/dist/templates/worker/worker/index.ts

@@ -0,0 +1,52 @@
+/**
+ * The project's own backend Worker (Hono-style handlers). It runs behind the
+ * Canopy gateway — every request is already authenticated — and reaches the
+ * platform (db/blob/ai) through the CANOPY service binding, so budgets and
+ * data isolation still apply.
+ *
+ * On GCP, `canopy deploy` bundles this file and rolls a per-project Cloud Run
+ * service (docs/05-gcp-plan.md G6). Routes under `/api/*` reach this Worker;
+ * everything else serves the SPA. Dashboard schedules call `scheduled()`
+ * (docs/07-schedules.md).
+ */
+
+import { createCanopy } from "@mediamonks/canopy";
+import { Hono } from "hono";
+
+interface Env {
+  // Service binding to the platform API (canopy-api), scoped to this project.
+  CANOPY: { fetch: typeof fetch };
+  // Dashboard secrets (Settings → Secrets) land as Workers-shaped bindings:
+  // MY_API_KEY?: string;
+}
+
+interface ScheduledEvent {
+  name: string;
+  cron: string;
+  scheduledTime: number;
+  type: "scheduled";
+}
+
+const app = new Hono<{ Bindings: Env }>();
+
+// Routes under /api/* reach this Worker; everything else serves the SPA.
+app.get("/api/hello", async (c) => {
+  const canopy = createCanopy({ fetch: c.env.CANOPY.fetch.bind(c.env.CANOPY) });
+  const user = await canopy.auth.user();
+  return c.json({ message: `Hello from the backend, ${user.name}!` });
+});
+
+export default {
+  fetch: app.fetch.bind(app),
+
+  // Settings → Schedules: switch on event.name (not the cron string).
+  async scheduled(event: ScheduledEvent, _env: Env) {
+    switch (event.name) {
+      // case "daily-digest":
+      //   await doWork(_env);
+      //   break;
+      default:
+        console.warn("unhandled schedule", event.name);
+    }
+  },
+};

package/dist/{token-D7zrIF8G.mjs → token-BUxgRJVA.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors } from "./ui-2mrJcjYC.mjs";
+import { c as apiRequest, n as reportErrors } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/{ui-2mrJcjYC.mjs → ui-B1Px5y7q.mjs}

@@ -114,6 +114,22 @@ const ERROR_COPY = {
 		why: "the report already has the maximum number of screenshots",
 		fix: "Remove one from the report on the dashboard before attaching another."
 	},
+	invalid_name: {
+		why: "the schedule name is not a valid format",
+		fix: "Use lowercase letters, digits and hyphens, starting with a letter (e.g. refresh-feeds)."
+	},
+	invalid_cron: {
+		why: "the cron expression is not a valid five-field cron",
+		fix: "Use five space-separated fields, quoted — minute hour day month weekday (e.g. \"0 5 * * *\")."
+	},
+	too_many_schedules: {
+		why: "the project is at its schedule limit",
+		fix: "Remove a schedule you no longer need (`canopy schedule list` / `canopy schedule remove`)."
+	},
+	scheduler_sync_failed: {
+		why: "the schedule was saved but syncing it to the platform scheduler failed",
+		fix: "Retry the same command — it re-syncs the saved schedule."
+	},
 	worker_egress_sync_failed: {
 		why: "the list was saved but redeploying the running worker with it failed",
 		fix: "Retry, or redeploy the project (`canopy deploy`) to apply the new allowlist."
@@ -221,6 +237,7 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
 	});
 	if (!response.ok) return fail(response, isDeployToken, method, path);
+	if (response.status === 204) return void 0;
 	return await response.json();
 }
 /**

package/dist/{upgrade-fhfrid_O.mjs → upgrade-ES8u8_Pn.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { n as reportErrors } from "./ui-2mrJcjYC.mjs";
+import { n as reportErrors } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-BOWfqwr2.mjs");
+		const { skillInstalled } = await import("./skill-Zq9aIPKf.mjs");
 		const refreshSkill = skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);

package/dist/{usage-CX1Izj_l.mjs → usage-DjNngyvy.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-2mrJcjYC.mjs";
+import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-B1Px5y7q.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.12",
+  "version": "0.7.13",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-CySBxW7I.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-BnUYGQQm.mjs";
-export { devCommand };