@mediamonks/canopy-cli 0.7.2 → 0.7.4

package/dist/{db-B8c6nhQ8.mjs → db-D3RKaLVU.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { i as unwrap, l as withContext, n as reportErrors, o as apiDataRequest, r as requireTty } from "./ui-OMOjXJ2y.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-D1Va4TyD.mjs";
+import { i as unwrap, l as withContext, n as reportErrors, o as apiDataRequest, r as requireTty } from "./ui-CpdtK7mt.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-DpWHuqkQ.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-DuW0-201.mjs → deploy-ClioT9ZC.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, l as withContext, n as reportErrors, o as apiDataRequest, s as apiDownload } from "./ui-OMOjXJ2y.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-D1Va4TyD.mjs";
+import { c as apiRequest, i as unwrap, l as withContext, n as reportErrors, o as apiDataRequest, s as apiDownload } from "./ui-CpdtK7mt.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-DpWHuqkQ.mjs";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";

package/dist/{dev-DJwGvkDZ.mjs → dev-BbAVZcAR.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { a as ApiError, c as apiRequest, l as withContext, n as reportErrors } from "./ui-OMOjXJ2y.mjs";
-import { r as readMigrationFiles } from "./migrations-D1Va4TyD.mjs";
+import { a as ApiError, c as apiRequest, l as withContext, n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { r as readMigrationFiles } from "./migrations-DpWHuqkQ.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { join } from "node:path";
@@ -112,7 +112,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-DUp7p_2m.mjs");
+		const { fetchProjectDump } = await import("./local-BHxSZwUT.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -127,7 +127,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-DUp7p_2m.mjs");
+	const { createSandbox } = await import("./local-BHxSZwUT.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-D6Sy15Wv.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-BbAVZcAR.mjs";
+export { devCommand };

package/dist/docs/cli.md

@@ -70,6 +70,12 @@ has a full page per command.
 
 See `canopy docs ci` for wiring push-to-main deploys.
 
+## Outbound hosts (egress)
+
+- `canopy egress list` — hosts the project's worker may `fetch` directly.
+- `canopy egress allow <host>` — allow a hostname (or `"*.sub.wildcard"`).
+- `canopy egress remove <host>` — remove an entry.
+
 ## Maintenance
 
 - `canopy upgrade` — update the CLI to the latest version. `--version <v>` pins a

package/dist/docs/porting-nextjs.md

@@ -166,13 +166,10 @@ Rules of the road for the worker:
   stick to packages that don't need Node built-ins or native modules.
 - **No filesystem, no long-lived state.** Persist through `canopy.db` and
   `canopy.blob`.
-- **Outbound requests are controlled.** On the GCP target, calls to external
-  APIs pass through a platform-managed egress allowlist that is currently
-  fixed to platform infrastructure — there is no self-service way to add
-  hosts yet. Contact the platform team with the exact hostnames your project
-  needs (per-project allowlist management is planned; see `egress_denied` in
-  the [troubleshooting guide](https://docs.canopy.website/guides/troubleshooting)). On the Cloudflare
-  target outbound requests are currently unrestricted.
+- **Outbound requests are controlled.** Calls to external APIs pass through a
+  per-project egress allowlist — deny-by-default, managed by you. Allow the
+  hosts your worker calls with `canopy egress allow <host>` or in dashboard
+  Settings → Outbound hosts (see [Outbound requests](https://docs.canopy.website/platform/egress)).
 - Frontend calls are plain `fetch("/api/…")` — same origin, the platform
   session cookie rides along automatically.
 

package/dist/docs/troubleshooting.md

@@ -62,14 +62,33 @@ the dashboard.
 ## `egress_denied` (403)
 
 An outbound `fetch` from your worker was blocked by the platform's egress
-guard: `host <hostname> is not on the project allowlist`. On the GCP target
-workers can only reach hosts on an allowlist, and today that list is fixed to
-platform infrastructure (blob storage, Google auth, the Canopy API) — there is
-no self-service way to add hosts yet. If your project needs to call an external
-API, contact the platform team with the exact hostnames; per-project allowlist
-management is planned. Calls made through the SDK / `env.CANOPY.fetch` don't
-count as egress and are unaffected. On the Cloudflare target outbound requests
-are currently unrestricted, so this error only appears on GCP.
+guard: `host <hostname> is not on the project allowlist`. Outbound requests
+are deny-by-default — only platform infrastructure and the hosts on your
+project's own allowlist get through. Add the host and retry (running workers
+pick the change up without a deploy):
+
+```bash
+canopy egress allow api.example.com
+```
+
+or use dashboard Settings → Outbound hosts. Details and entry rules:
+[Outbound requests](https://docs.canopy.website/platform/egress). Calls made through the SDK /
+`env.CANOPY.fetch` don't count as egress and are unaffected. On the Cloudflare
+target outbound requests are currently unrestricted, so this error only
+appears on GCP.
+
+## The worker returns errors and you can't see why
+
+Read its console output instead of adding diagnostic endpoints:
+
+```bash
+canopy logs --since 15m
+```
+
+`console.log` / `console.error` from your deployed worker, straight in the
+terminal; `--follow` tails it live while you reproduce the problem. See
+[canopy logs](https://docs.canopy.website/cli/logs). (On sites without worker log capture the command
+answers `not_supported_on_target`.)
 
 ## Docs are stale
 

package/dist/{docs-tof6Ou2-.mjs → docs-IxKmYx_G.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-BGFOC-Tg.mjs";
+import { t as version } from "./package-DBEmT6Uh.mjs";
 import { n as siteConfig } from "./site-BUlQR117.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { n as reportErrors } from "./ui-OMOjXJ2y.mjs";
+import { n as reportErrors } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/egress-BkkG9Jzs.mjs

@@ -0,0 +1,88 @@
+import { a as projectDirArgs, c as resolveProject } from "./site-BUlQR117.mjs";
+import { c as apiRequest, n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { defineCommand } from "citty";
+//#region src/egress.ts
+/**
+* canopy egress — manage the project's outbound-host allowlist
+* (docs/16-egress-allowlist.md). Worker fetches to hosts outside the list are
+* denied (`egress_denied`) on targets that enforce egress control; the list
+* lives on the platform, not in canopy.json, so a repo file can never widen
+* egress silently on deploy.
+*/
+function printList({ hosts, denied, enforced }, slug) {
+	if (hosts.length === 0) console.log(`No extra egress hosts for ${slug} — the worker can reach platform hosts only.`);
+	else for (const host of hosts) console.log(host);
+	if (denied.length > 0) {
+		console.log(`\nRecently blocked (allow with \`canopy egress allow <host>\`):`);
+		for (const d of denied) console.log(`  ${d.host}  ×${d.count}  last ${d.last_seen}`);
+	}
+	if (!enforced) console.error("(note: this site's target does not enforce egress yet — the list is recorded for when it does)");
+}
+const egressCommand = defineCommand({
+	meta: {
+		name: "egress",
+		description: "Manage which outbound hosts the project's worker may fetch"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List the project's allowed outbound hosts"
+			},
+			args: { ...projectDirArgs },
+			run: reportErrors("egress list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				printList(await apiRequest("GET", `/projects/${slug}/egress`), slug);
+			})
+		}),
+		allow: defineCommand({
+			meta: {
+				name: "allow",
+				description: "Allow the worker to fetch a host (e.g. api.example.com or *.googleapis.com)"
+			},
+			args: {
+				host: {
+					type: "positional",
+					description: "Hostname to allow",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("egress allow", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const current = await apiRequest("GET", `/projects/${slug}/egress`);
+				const updated = await apiRequest("PUT", `/projects/${slug}/egress`, { hosts: [...current.hosts, args.host] });
+				console.log(`Allowed ${args.host} for ${slug} — running workers pick it up now.\n`);
+				printList(updated, slug);
+			})
+		}),
+		remove: defineCommand({
+			meta: {
+				name: "remove",
+				description: "Remove a host from the allowlist"
+			},
+			args: {
+				host: {
+					type: "positional",
+					description: "Hostname to remove",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("egress remove", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const current = await apiRequest("GET", `/projects/${slug}/egress`);
+				const wanted = args.host.trim().toLowerCase();
+				if (!current.hosts.includes(wanted)) {
+					console.error(`${wanted} is not on the allowlist for ${slug} (see \`canopy egress list\`).`);
+					process.exit(1);
+				}
+				const updated = await apiRequest("PUT", `/projects/${slug}/egress`, { hosts: current.hosts.filter((h) => h !== wanted) });
+				console.log(`Removed ${wanted} from ${slug} — running workers stop reaching it now.\n`);
+				printList(updated, slug);
+			})
+		})
+	}
+});
+//#endregion
+export { egressCommand };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-BGFOC-Tg.mjs";
+import { t as version } from "./package-DBEmT6Uh.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BUlQR117.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -15,7 +15,7 @@ import { defineCommand, runMain } from "citty";
 *   deploy                build & deploy assets (+ worker)        [phase 1/2]
 *   token create|list|revoke   deploy tokens for CI               [phase 2]
 *   db pull|snapshot|restore                                      [phase 2]
-*   logs                  tail the project's worker logs          [phase 2]
+*   logs [--follow]       read the project's worker logs          [phase 2]
 *   usage                 AI spend + storage for a project        [phase 1]
 *   open                  open the deployed project / dashboard   [phase 1]
 */
@@ -53,19 +53,6 @@ function takeGlobalProfile(argv) {
 const profileFlag = takeGlobalProfile(process.argv);
 if (profileFlag) setInvocationProfile(profileFlag);
 else if (process.env["CANOPY_PROFILE"]) setInvocationProfile(process.env["CANOPY_PROFILE"]);
-/** A roadmap command that has not landed yet (docs/04-roadmap.md). */
-function planned(name, description, phase) {
-	return defineCommand({
-		meta: {
-			name,
-			description: `${description} (not implemented yet — Phase ${phase})`
-		},
-		run() {
-			console.error(`canopy ${name}: not implemented yet — lands in Phase ${phase} (docs/04-roadmap.md).`);
-			process.exit(1);
-		}
-	});
-}
 const main = defineCommand({
 	meta: {
 		name: "canopy",
@@ -73,27 +60,28 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-DZWQF4fS.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-DZWQF4fS.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-DZWQF4fS.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-CaGxv-4p.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-CaGxv-4p.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-CaGxv-4p.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-CaGxv-4p.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-U9u6katn.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-DuW0-201.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-DuW0-201.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-DQQZXoKz.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-DuW0-201.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-DuW0-201.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-CBuhzauo.mjs").then((m) => m.tokenCommand),
-		db: () => import("./db-B8c6nhQ8.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-DATkqUN0.mjs").then((m) => m.usageCommand),
-		open: () => import("./open-1ARSL5XC.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-tof6Ou2-.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-DHmCX1U-.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-B8LKMI4s.mjs").then((m) => m.upgradeCommand),
-		logs: planned("logs", "Tail worker logs", "2")
+		login: () => import("./login-C1x1l3qg.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-C1x1l3qg.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-C1x1l3qg.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-D2fDeWNU.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-D2fDeWNU.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-D2fDeWNU.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-D2fDeWNU.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-D6Sy15Wv.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-95xeXyZN.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-BjlqT2Xj.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-BkkG9Jzs.mjs").then((m) => m.egressCommand),
+		db: () => import("./db-D3RKaLVU.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-wpew0a2M.mjs").then((m) => m.usageCommand),
+		open: () => import("./open-CLSh6oez.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-IxKmYx_G.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-D3MHtg4s.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-PcE6l9uj.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-DBLDS3aQ.mjs").then((m) => m.logsCommand)
 	}
 });
 if (process.argv[2] !== "upgrade") notifyOfUpdate(version);

package/dist/{local-DUp7p_2m.mjs → local-BHxSZwUT.mjs}

@@ -1,5 +1,5 @@
-import { o as apiDataRequest } from "./ui-OMOjXJ2y.mjs";
-import { n as rewriteApiPath } from "./dev-DJwGvkDZ.mjs";
+import { o as apiDataRequest } from "./ui-CpdtK7mt.mjs";
+import { n as rewriteApiPath } from "./dev-BbAVZcAR.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{login-DZWQF4fS.mjs → login-C1x1l3qg.mjs}

@@ -1,5 +1,5 @@
 import { _ as getBakedProfile, d as clearAllProfileTokens, f as listBakedProfiles, g as writeConfigFile, h as upsertProfileAuth, m as setActiveProfile, n as siteConfig, p as readConfigFile, v as isProfileId } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-OMOjXJ2y.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";

package/dist/logs-DBLDS3aQ.mjs

@@ -0,0 +1,109 @@
+import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
+import { c as apiRequest, l as withContext, n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { defineCommand } from "citty";
+//#region src/logs.ts
+/**
+* canopy logs — read the project worker's stdout/stderr
+* (GET /v1/projects/:slug/logs, docs/17-worker-logs.md). `--follow` is a
+* polling loop on since=<last ts>; output is stdout-clean for piping.
+*/
+const FOLLOW_INTERVAL_MS = 4e3;
+/** `--since` accepts a duration (30s, 15m, 2h, 1d) or an RFC 3339 timestamp. */
+function parseSince(value, now = Date.now()) {
+	const duration = /^(\d+)([smhd])$/.exec(value.trim());
+	if (duration) {
+		const unitMs = {
+			s: 1e3,
+			m: 6e4,
+			h: 36e5,
+			d: 864e5
+		}[duration[2]];
+		return new Date(now - Number(duration[1]) * unitMs).toISOString();
+	}
+	const ms = Date.parse(value);
+	if (Number.isNaN(ms)) throw new Error(`--since must be a duration (30s, 15m, 2h, 1d) or a timestamp, not ${JSON.stringify(value)}.`);
+	return new Date(ms).toISOString();
+}
+/** `SEVERITY  ts  text` — severity padded so lines column-align. */
+function formatEntry(entry) {
+	return `${entry.severity.padEnd(8)} ${entry.ts}  ${entry.text}`;
+}
+async function fetchLogs(slug, params) {
+	const query = new URLSearchParams({ channel: params.channel });
+	if (params.since) query.set("since", params.since);
+	if (params.limit) query.set("limit", String(params.limit));
+	return withContext(apiRequest("GET", `/projects/${slug}/logs?${query}`), {
+		action: `read worker logs for "${slug}"`,
+		fixes: { not_supported_on_target: "Worker logs aren't available on this site yet — GCP sites only." }
+	});
+}
+const logsCommand = defineCommand({
+	meta: {
+		name: "logs",
+		description: "Show the project worker's logs (stdout/stderr)"
+	},
+	args: {
+		...projectFlagArgs,
+		staging: {
+			type: "boolean",
+			default: false,
+			description: "Read the staging channel's worker instead of live"
+		},
+		since: {
+			type: "string",
+			description: "How far back to read: a duration (30s, 15m, 2h, 1d) or a timestamp",
+			default: "1h"
+		},
+		limit: {
+			type: "string",
+			description: "Max entries to print (1–1000)",
+			default: "100"
+		},
+		follow: {
+			type: "boolean",
+			alias: "f",
+			default: false,
+			description: "Keep polling for new entries (Ctrl-C to stop)"
+		},
+		json: {
+			type: "boolean",
+			default: false,
+			description: "Print entries as JSON lines instead of formatted text"
+		}
+	},
+	run: reportErrors("logs", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const channel = args.staging ? "staging" : "live";
+		const limit = Number(args.limit);
+		if (!Number.isInteger(limit) || limit < 1 || limit > 1e3) throw new Error("--limit must be an integer between 1 and 1000.");
+		let since = parseSince(args.since);
+		const print = (entries) => {
+			for (const entry of entries) console.log(args.json ? JSON.stringify(entry) : formatEntry(entry));
+		};
+		const initial = [...(await fetchLogs(slug, {
+			channel,
+			since,
+			limit
+		})).entries].reverse();
+		print(initial);
+		if (!args.follow) {
+			if (initial.length === 0) console.error(`No log entries since ${since} — is the worker getting traffic?`);
+			return;
+		}
+		console.error(`Following ${slug}${channel === "staging" ? " [staging]" : ""}… (Ctrl-C to stop)`);
+		let lastTs = initial.at(-1)?.ts ?? since;
+		for (;;) {
+			await new Promise((resolve) => setTimeout(resolve, FOLLOW_INTERVAL_MS));
+			const fresh = [...(await fetchLogs(slug, {
+				channel,
+				since: lastTs,
+				limit: 1e3
+			})).entries].reverse().filter((e) => e.ts > lastTs);
+			if (fresh.length === 0) continue;
+			print(fresh);
+			lastTs = fresh.at(-1).ts;
+		}
+	})
+});
+//#endregion
+export { logsCommand };

package/dist/{migrations-D1Va4TyD.mjs → migrations-DpWHuqkQ.mjs}

@@ -1,5 +1,5 @@
 import { u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { o as apiDataRequest } from "./ui-OMOjXJ2y.mjs";
+import { o as apiDataRequest } from "./ui-CpdtK7mt.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-1ARSL5XC.mjs → open-CLSh6oez.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-OMOjXJ2y.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-BGFOC-Tg.mjs → package-DBEmT6Uh.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.2";
+var version = "0.7.4";
 //#endregion
 export { version as t };

package/dist/{projects-CaGxv-4p.mjs → projects-D2fDeWNU.mjs}

@@ -1,5 +1,5 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-OMOjXJ2y.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{skill-DHmCX1U-.mjs → skill-D3MHtg4s.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-BGFOC-Tg.mjs";
-import { n as reportErrors } from "./ui-OMOjXJ2y.mjs";
+import { t as version } from "./package-DBEmT6Uh.mjs";
+import { n as reportErrors } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";

package/dist/{staging-DQQZXoKz.mjs → staging-95xeXyZN.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, l as withContext, n as reportErrors, r as requireTty } from "./ui-OMOjXJ2y.mjs";
+import { c as apiRequest, i as unwrap, l as withContext, n as reportErrors, r as requireTty } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/{token-CBuhzauo.mjs → token-BjlqT2Xj.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors } from "./ui-OMOjXJ2y.mjs";
+import { c as apiRequest, n as reportErrors } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/{ui-OMOjXJ2y.mjs → ui-CpdtK7mt.mjs}

@@ -93,6 +93,18 @@ const ERROR_COPY = {
 	version_not_found: {
 		why: "no deploy with that version exists for this project",
 		fix: "Run `canopy deploys` to list versions you can roll back to."
+	},
+	invalid_host: {
+		why: "that entry is not a plain hostname",
+		fix: "Use a bare hostname (api.example.com) or a subdomain wildcard (*.googleapis.com) — no IPs, ports, schemes or paths."
+	},
+	too_many_hosts: {
+		why: "the allowlist is at its 32-entry limit",
+		fix: "Remove hosts you no longer need (`canopy egress list` / `canopy egress remove`), or cover several subdomains with one *. wildcard."
+	},
+	worker_egress_sync_failed: {
+		why: "the list was saved but redeploying the running worker with it failed",
+		fix: "Retry, or redeploy the project (`canopy deploy`) to apply the new allowlist."
 	}
 };
 /** Generic explanation for a status code when we have no per-code copy. */

package/dist/{upgrade-B8LKMI4s.mjs → upgrade-PcE6l9uj.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { n as reportErrors } from "./ui-OMOjXJ2y.mjs";
+import { n as reportErrors } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-DHmCX1U-.mjs");
+		const { skillInstalled } = await import("./skill-D3MHtg4s.mjs");
 		const refreshSkill = skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);

package/dist/{usage-DATkqUN0.mjs → usage-wpew0a2M.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, l as withContext, n as reportErrors } from "./ui-OMOjXJ2y.mjs";
+import { c as apiRequest, l as withContext, n as reportErrors } from "./ui-CpdtK7mt.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-U9u6katn.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-DJwGvkDZ.mjs";
-export { devCommand };