@mediamonks/canopy-cli 0.7.23 → 0.7.24

package/dist/db-jmYaum8F.mjs

@@ -0,0 +1,251 @@
+import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, s as apiDataRequest } from "./ui-CUNkis89.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Btzr9_q7.mjs";
+import { defineCommand } from "citty";
+import { readFileSync, writeFileSync } from "node:fs";
+import * as p from "@clack/prompts";
+//#region src/db.ts
+/**
+* canopy db pull | snapshot | snapshots | restore — data safety from the
+* terminal (docs/04-roadmap.md Phase 2 item 4, pulled forward).
+*
+* pull      download a fresh SQL dump of the project database
+* snapshot  store a dump server-side (restorable from CLI or dashboard)
+* snapshots list stored snapshots
+* restore   replace ALL project data from a snapshot or a local .sql file
+* migrate   apply pending schema migrations (docs/13-migrations-and-drizzle.md)
+* access    show or set what the app's pages may do with the database (docs/35)
+*
+* The project comes from canopy.json in the current directory, or
+* --project <slug>.
+*/
+/** Shared flag: operate on the staging channel's database (docs/14). */
+const stagingFlagArgs = { staging: {
+	type: "boolean",
+	default: false,
+	description: "Target the staging channel's database instead of live"
+} };
+const channelOf = (args) => args.staging ? "staging" : "live";
+const channelNote = (args) => args.staging ? " [staging]" : "";
+const formatSize = (bytes) => bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)} kB` : `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+const pullCommand = defineCommand({
+	meta: {
+		name: "pull",
+		description: "Download a fresh SQL dump of the project database"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs,
+		out: {
+			type: "string",
+			description: "Output file (defaults to <slug>-<timestamp>.sql)"
+		}
+	},
+	run: reportErrors("db pull", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const out = args.out ?? `${slug}-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replaceAll(/[:T]/g, "-")}.sql`;
+		const spin = p.spinner();
+		spin.start(`Exporting ${slug}${channelNote(args)}…`);
+		try {
+			const { url } = await apiDataRequest("POST", "/db/export", slug, void 0, void 0, channelOf(args));
+			const download = await fetch(url);
+			if (!download.ok) throw new Error(`Download failed (HTTP ${download.status}).`);
+			const sql = Buffer.from(await download.arrayBuffer());
+			writeFileSync(out, sql);
+			spin.stop(`Wrote ${out} (${formatSize(sql.byteLength)}).`);
+		} catch (err) {
+			spin.error("Export failed.");
+			throw err;
+		}
+	})
+});
+const snapshotCommand = defineCommand({
+	meta: {
+		name: "snapshot",
+		description: "Store a dump server-side (restorable anytime)"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs
+	},
+	run: reportErrors("db snapshot", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const spin = p.spinner();
+		spin.start(`Snapshotting ${slug}${channelNote(args)}…`);
+		let created;
+		try {
+			({snapshot: created} = await apiDataRequest("POST", "/db/snapshots", slug, void 0, void 0, channelOf(args)));
+		} catch (err) {
+			spin.error("Snapshot failed.");
+			throw err;
+		}
+		spin.stop(`Stored ${created.key} (${formatSize(created.size)}).`);
+		console.log(`Restore anytime with \`canopy db restore --snapshot ${created.key}\`.`);
+	})
+});
+const snapshotsCommand = defineCommand({
+	meta: {
+		name: "snapshots",
+		description: "List stored snapshots"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs
+	},
+	run: reportErrors("db snapshots", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const { snapshots } = await apiDataRequest("GET", "/db/snapshots", slug, void 0, void 0, channelOf(args));
+		if (snapshots.length === 0) {
+			console.log(`No snapshots for ${slug} yet — run \`canopy db snapshot\`.`);
+			return;
+		}
+		for (const snapshot of snapshots) console.log(`${snapshot.key}  ${formatSize(snapshot.size).padStart(9)}  ${snapshot.createdAt}`);
+	})
+});
+const restoreCommand = defineCommand({
+	meta: {
+		name: "restore",
+		description: "Replace ALL project data from a snapshot or a local .sql file"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs,
+		file: {
+			type: "positional",
+			description: "Local .sql dump to restore from",
+			required: false
+		},
+		snapshot: {
+			type: "string",
+			description: "Server-side snapshot key to restore from"
+		},
+		yes: {
+			type: "boolean",
+			default: false,
+			description: "Skip the type-the-slug confirmation"
+		}
+	},
+	run: reportErrors("db restore", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const { file } = args;
+		let snapshotKey = args.snapshot;
+		if (!snapshotKey && !file) {
+			requireTty("pass a local .sql dump or --snapshot <key>.");
+			const { snapshots } = await apiDataRequest("GET", "/db/snapshots", slug, void 0, void 0, channelOf(args));
+			if (snapshots.length === 0) throw new Error(`No snapshots for ${slug} — run \`canopy db snapshot\` first, or pass a local .sql dump.`);
+			snapshotKey = unwrap(await p.select({
+				message: `Snapshot to restore into ${slug}`,
+				options: snapshots.map((snapshot) => ({
+					value: snapshot.key,
+					label: snapshot.key,
+					hint: `${formatSize(snapshot.size)} · ${snapshot.createdAt}`
+				}))
+			}));
+		}
+		if (!args.yes) {
+			requireTty("pass --yes to restore without confirmation.");
+			if (unwrap(await p.text({ message: `Restore will REPLACE all current data in "${slug}"${channelNote(args)} with ${snapshotKey ?? file}. Type the slug to confirm.` })).trim() !== slug) {
+				p.cancel("Aborted.");
+				return;
+			}
+		}
+		const restoreContext = { action: `restore "${slug}" from ${snapshotKey ?? file}` };
+		if (snapshotKey) await withContext(apiDataRequest("POST", "/db/restore", slug, { snapshot: snapshotKey }, void 0, channelOf(args)), restoreContext);
+		else if (file) await withContext(apiDataRequest("POST", "/db/restore", slug, readFileSync(file, "utf8"), "application/sql", channelOf(args)), restoreContext);
+		p.log.success(`Restored ${slug}${channelNote(args)}.`);
+	})
+});
+const migrateCommand = defineCommand({
+	meta: {
+		name: "migrate",
+		description: "Apply pending schema migrations to the project database"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs,
+		plan: {
+			type: "boolean",
+			default: false,
+			description: "Dry run: list pending migrations without applying anything"
+		}
+	},
+	run: reportErrors("db migrate", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const files = readMigrationFiles(dir);
+		if (files === void 0) throw new Error("No migrations directory configured — set \"migrations\" in canopy.json (e.g. {\"migrations\": \"./migrations\"}, pointing at your drizzle-kit output).");
+		if (args.plan) {
+			const result = await withContext(migrateProject(slug, files, true, channelOf(args)), { action: `plan migrations for "${slug}"${channelNote(args)}` });
+			if (result.pending.length === 0) console.log(`Nothing pending (${result.applied.length} applied previously).`);
+			else for (const name of result.pending) console.log(`pending ${name}`);
+			for (const line of describeMigrateResult(result)) console.log(line);
+			return;
+		}
+		const spin = p.spinner();
+		spin.start(`Migrating ${slug}${channelNote(args)}…`);
+		let result;
+		try {
+			result = await withContext(migrateProject(slug, files, false, channelOf(args)), { action: `migrate "${slug}"${channelNote(args)}` });
+		} catch (err) {
+			spin.error("Migrate failed.");
+			throw err;
+		}
+		spin.stop(result.appliedNow.length === 0 ? `Nothing pending for ${slug}.` : `Applied ${result.appliedNow.length} migration(s) to ${slug}.`);
+		for (const line of describeMigrateResult(result)) console.log(`  ${line}`);
+	})
+});
+const LEVEL_MEANING = {
+	full: "pages can read and write the database (collections and raw SQL)",
+	readonly: "pages can read; SQL that writes and collection writes are refused",
+	off: "pages cannot touch the database — only the worker and the CLI can"
+};
+function printAccess(slug, access) {
+	console.log(`${slug}: browser access is ${access.level} — ${LEVEL_MEANING[access.level]}.`);
+	console.log("Tables and collections named private_… are worker-only at every level.");
+	if (access.clientAccess && access.level !== "off") {
+		console.log("");
+		console.log(`  ! Client access is on: visitors who know the password can ${access.level === "full" ? "read and change" : "read"} this data from their browser.`);
+		console.log("    Name tables private_… to keep them worker-only, or `canopy db access off`.");
+	}
+}
+const dbCommand = defineCommand({
+	meta: {
+		name: "db",
+		description: "Data tools: pull, snapshot, snapshots, restore, migrate, access"
+	},
+	subCommands: {
+		pull: pullCommand,
+		snapshot: snapshotCommand,
+		snapshots: snapshotsCommand,
+		restore: restoreCommand,
+		migrate: migrateCommand,
+		access: defineCommand({
+			meta: {
+				name: "access",
+				description: "Show or set what the app's own pages may do with the database (full | readonly | off)"
+			},
+			args: {
+				...projectFlagArgs,
+				level: {
+					type: "positional",
+					description: "full | readonly | off (omit to show)",
+					required: false
+				}
+			},
+			run: reportErrors("db access", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const wanted = args.level?.trim().toLowerCase();
+				if (!wanted) {
+					printAccess(slug, await apiRequest("GET", `/projects/${slug}/db-access`));
+					return;
+				}
+				if (wanted !== "full" && wanted !== "readonly" && wanted !== "off") {
+					console.error(`unknown level "${wanted}" — expected full, readonly or off.`);
+					process.exit(1);
+				}
+				printAccess(slug, await apiRequest("PUT", `/projects/${slug}/db-access`, { level: wanted }));
+			})
+		})
+	}
+});
+//#endregion
+export { dbCommand };

package/dist/{deploy-DCggsLD7.mjs → deploy-CYKiBnrg.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, c as apiDownload, d as withContext, l as apiRequest, r as reportErrors, s as apiDataRequest, t as formatDateTime } from "./ui--atbZ-TM.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Bg9FEGFh.mjs";
+import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { a as unwrap, c as apiDownload, d as withContext, l as apiRequest, r as reportErrors, s as apiDataRequest, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Btzr9_q7.mjs";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";

package/dist/dev-C5BmSJo1.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-DVUEJ80c.mjs";
+export { devCommand };

package/dist/{dev-XULukupE.mjs → dev-DVUEJ80c.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui--atbZ-TM.mjs";
-import { r as readMigrationFiles } from "./migrations-Bg9FEGFh.mjs";
+import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { r as readMigrationFiles } from "./migrations-Btzr9_q7.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { existsSync } from "node:fs";
@@ -37,7 +37,7 @@ async function workerPlugin(flags, slug) {
 		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
 		return;
 	}
-	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-BDMjExps.mjs");
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-CWU6XFe_.mjs");
 	const secrets = readDevVars(flags.dir);
 	const email = siteConfig().email;
 	const plugin = workerDevPlugin({
@@ -165,7 +165,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-BjsuI1IB.mjs");
+		const { fetchProjectDump } = await import("./local-CNPBZ89U.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -180,7 +180,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-BjsuI1IB.mjs");
+	const { createSandbox } = await import("./local-CNPBZ89U.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/{dev-worker-BDMjExps.mjs → dev-worker-CWU6XFe_.mjs}

@@ -1,4 +1,4 @@
-import "./src-BPKfY9IN.mjs";
+import "./src-BK0Hiwsn.mjs";
 import { readFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
 //#region ../data-plane/src/worker-request.ts

package/dist/docs/ci.md

@@ -9,7 +9,8 @@ can deploy that one project and nothing else.
 
 ## Create a token
 
-From inside the project directory:
+Only the project owner can create a deploy token (any collaborator can list
+and revoke them). From inside the project directory:
 
 ```bash
 canopy token create --name "GitHub Actions"
@@ -47,4 +48,10 @@ No `canopy login` step is needed — the token is the credential.
 - A deploy token can only deploy its own project — it reaches that project's
   deploy endpoints and upload grants and nothing else. If it strays to another
   project's resources, the platform rejects it.
+- The token belongs to the project, not to the person who created it. It keeps
+  working when they leave the project or the company; deploys it makes show up
+  in the history under the token's name.
+- A token that goes 90 days without a deploy stops working. Active pipelines
+  never notice; a forgotten one dies on its own. The token list shows when each
+  was last used.
 - Revoke a token the moment it might be exposed; create a fresh one to replace it.

package/dist/docs/cli-egress.md

@@ -32,7 +32,8 @@ target directory, or `--project <slug>` to override — and honor the global
 - `mode [allowlist|open]` — show or switch the
   [egress mode](https://docs.canopy.website/platform/egress#open-mode). Switching to `open` prints a risk
   summary and asks you to type the project slug; pass `--accept-risk` to
-  acknowledge it non-interactively. Switching back needs no ceremony.
+  acknowledge it non-interactively. Only the project owner can switch to
+  `open`; switching back needs no ceremony and any member can do it.
 - `log` — print the [outbound traffic log](https://docs.canopy.website/platform/egress#the-outbound-traffic-log):
   hosts the worker actually fetched, with counts and last-seen times.
 

package/dist/docs/cli-token.md

@@ -17,15 +17,17 @@ canopy token revoke <id>
 
 All subcommands resolve the project the usual way — `canopy.json` in the target directory, or `--project <slug>` to override — and honor the global `--profile <site>` / `CANOPY_PROFILE` for which site the token belongs to.
 
-- `create` — mint a new deploy token for the project.
+- `create` — mint a new deploy token for the project. Owner only: collaborators get a clear error and should ask the owner.
   - `--name <label>` — a label shown in the dashboard, e.g. `"GitHub Actions"`. Optional but recommended so you can tell tokens apart later.
-- `list` — show the project's deploy tokens: id, name, creation time, and who created them. Token values are never shown here.
+- `list` — show the project's deploy tokens: id, name, creation time, who created them, and when each was last used. Token values are never shown here.
 - `revoke <id>` — delete a token by its id (from `canopy token list`). Deploys using it stop working immediately.
 
 ## How it works
 
 `create` prints the token plaintext **exactly once** — the platform stores only a hash, so copy it right away. The token is scoped to a single project on a single site: it can deploy that project and nothing else, which makes it safe to hand to a CI system.
 
+The token belongs to the project rather than to whoever created it, so CI keeps working when that person leaves. It has no fixed expiry but stops working after 90 days without a deploy; `list` shows when each token was last used.
+
 To use it in CI, put the value in the `CANOPY_DEPLOY_TOKEN` environment variable — the CLI checks it before the login token, so `canopy deploy` works on a runner with no `canopy login`. For GitHub Actions, add it as the repo secret `CANOPY_DEPLOY_TOKEN` (`gh secret set CANOPY_DEPLOY_TOKEN`, or Settings → Secrets); pushes to main then deploy via the project's `canopy-deploy.yml` workflow.
 
 If a deploy fails with a rejected token, it was likely revoked — create a fresh one here or in the dashboard (Settings → Deploy tokens) and update the secret. Losing a token is never a problem: revoke the old id and mint a new one.

package/dist/docs/platform-client-access.md

@@ -54,4 +54,13 @@ the app down for Monks outside the team while a client with the password
 still gets in. That combination — "the client and the project team, nobody
 else" — is a common setup during a review phase.
 
+The password opens the app's data the same way it opens the app. Whatever a
+page may do with the project database under **Browser access** on the Data
+tab — read and write by default — a visitor who knows the password may do
+too, from their own browser. The dashboard points this out wherever the two
+settings meet. If the project has tables the client should not see or change,
+name them `private_…` so only the worker can reach them, or set browser
+access to read only or off. See
+[Who can call this from the browser](https://docs.canopy.website/sdk/database#who-can-call-this-from-the-browser).
+
 - [Members & access](https://docs.canopy.website/platform/members-and-access) — Who can view and who can manage a project, and how to tighten it.

package/dist/docs/platform-egress.md

@@ -102,9 +102,11 @@ allowlist:
 Because open mode means _users of your app can decide where it connects_,
 enabling it is a deliberate act: the dashboard asks you to type the project
 slug under a plain-language risk summary, and the CLI wants an interactive
-confirmation or the explicit `--accept-risk` flag. Extra care applies if the
-project has [client access](https://docs.canopy.website/platform/client-access) enabled — then untrusted
-visitors drive the fetches.
+confirmation or the explicit `--accept-risk` flag. Only the **project owner**
+can switch open mode on; other members can still manage the allowlist and
+switch back. Extra care applies if the project has
+[client access](https://docs.canopy.website/platform/client-access) enabled — then untrusted visitors
+drive the fetches.
 
 Switching back is one command (`canopy egress mode allowlist`), and the
 dashboard offers to **seed the allowlist from the observed hosts** so

package/dist/docs/platform-project-data.md

@@ -60,6 +60,7 @@ canopy db pull        # download a fresh SQL dump
 canopy db snapshot    # store a dump server-side
 canopy db snapshots   # list stored snapshots
 canopy db restore     # replace project data with a snapshot
+canopy db access      # what the app's own pages may do with the database
 ```
 
 `canopy db pull` is also how you develop against realistic data: pull a dump,

package/dist/docs/sdk-database.md

@@ -122,5 +122,35 @@ per SDK instance, so calling it often is free.
 > `db.sql()` only when you genuinely need SQL (aggregates, joins, bulk updates), and branch on
 > `db.dialect()` whenever the syntax differs.
 
+## Who can call this from the browser
+
+Everything above works from a page as well as from your worker — that is the
+point of `canopy.db`: a form, a guestbook or an internal tool needs no backend
+at all. But once a project _has_ a worker with tables the page must not touch,
+you want a say. Two things give you that, both on the project's **Data** tab in
+the dashboard (or `canopy db access` from the terminal):
+
+- **Browser access** — one setting for what the app's own pages may do with the
+  database. **Read and write** is the default and how every project starts.
+  **Read only** lets pages read collections and run SQL that only reads, so
+  writes have to come from the worker. **Off** means pages cannot touch the
+  database at all. Your worker, the CLI and the dashboard's data explorer keep
+  full access whatever you pick.
+- **`private_` names** — a collection or table whose name starts with
+  `private_` is only reachable from the worker, at every level. Pages calling
+  `collection("private_notes")` get a 403. Raw SQL cannot be checked table by
+  table, so while your database holds any `private_` name, `db.sql()` from a
+  page is refused too; use collections there, or run the SQL in the worker.
+
+Everyone who opens the app gets the same rule — colleagues signed in with
+OneLogin and, if you turned on [client access](https://docs.canopy.website/platform/client-access),
+visitors with the password. Read only protects your data from being changed,
+not from being seen: anyone who can open the app can read every table that is
+not `private_`. To hide data, name it `private_` or turn browser access off
+and serve it through a worker route.
+
+A refused call throws a `CanopyError` with status 403 and a one-line
+explanation that names the setting, so the fix is never a guess.
+
 Where the data lives, snapshots, and how to inspect it from the dashboard are
 covered in [Project data](https://docs.canopy.website/platform/project-data).

package/dist/{docs-BDPL0TI3.mjs → docs-BLWio_65.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-C5rZwlw8.mjs";
-import { n as siteConfig } from "./site-BFaWfSVu.mjs";
+import { t as version } from "./package-DTm0EzxR.mjs";
+import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{egress-BhbQfjjV.mjs → egress-BjN-7vil.mjs}

@@ -1,5 +1,5 @@
-import { a as projectDirArgs, c as resolveProject } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui--atbZ-TM.mjs";
+import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts
@@ -152,7 +152,10 @@ const egressCommand = defineCommand({
 						}
 					}
 				}
-				const updated = await apiRequest("PUT", `/projects/${slug}/egress`, { mode: wanted });
+				const updated = await withContext(apiRequest("PUT", `/projects/${slug}/egress`, { mode: wanted }), {
+					action: `switch ${slug} to ${wanted} egress mode`,
+					fixes: { owner_only: "Only the project owner can switch egress to open mode — ask them to run this command or flip it in the dashboard." }
+				});
 				if (wanted === "open") {
 					console.log(`Open egress mode is ON for ${slug} — running workers pick it up now.`);
 					console.log(`Switch back anytime with \`canopy egress mode allowlist\`.`);

package/dist/{feedback-B3pnUPLf.mjs → feedback-Bnmi1Ukv.mjs}

@@ -1,6 +1,6 @@
-import { t as version } from "./package-C5rZwlw8.mjs";
-import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui--atbZ-TM.mjs";
+import { t as version } from "./package-DTm0EzxR.mjs";
+import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";

package/dist/index.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "./package-C5rZwlw8.mjs";
-import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BFaWfSVu.mjs";
+import { t as version } from "./package-DTm0EzxR.mjs";
+import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
 //#region src/index.ts
@@ -60,30 +60,30 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-By4y5O5-.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-By4y5O5-.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-By4y5O5-.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-1r5387ui.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-1r5387ui.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-1r5387ui.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-1r5387ui.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-BFPlhkzp.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-DCggsLD7.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-DCggsLD7.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-CdpV2YHB.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-DCggsLD7.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-DCggsLD7.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-C8Bmzwfl.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-BhbQfjjV.mjs").then((m) => m.egressCommand),
-		schedule: () => import("./schedule-DK_Cv6Xf.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-B3pnUPLf.mjs").then((m) => m.feedbackCommand),
-		db: () => import("./db-TaSLpQZ5.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-C1-cvS2-.mjs").then((m) => m.usageCommand),
-		open: () => import("./open-D7f1wNn3.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-BDPL0TI3.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-CgToW_Ac.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-Bl_NJ_m5.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-Beqz--Df.mjs").then((m) => m.logsCommand)
+		login: () => import("./login-COZ7Xcm0.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-COZ7Xcm0.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-COZ7Xcm0.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-CLs6MEF7.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-CLs6MEF7.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-CLs6MEF7.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-CLs6MEF7.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-C5BmSJo1.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-pZpdZuj_.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-BKwGa10J.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-BjN-7vil.mjs").then((m) => m.egressCommand),
+		schedule: () => import("./schedule-B8zA8WlG.mjs").then((m) => m.scheduleCommand),
+		feedback: () => import("./feedback-Bnmi1Ukv.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-jmYaum8F.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-UmzU6sGp.mjs").then((m) => m.usageCommand),
+		open: () => import("./open-D2hH933K.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-BLWio_65.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-Dt49jdUT.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-Cf81feok.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-B_YoflCq.mjs").then((m) => m.logsCommand)
 	}
 });
 if (process.argv[2] !== "upgrade") notifyOfUpdate(version);

package/dist/{local-BjsuI1IB.mjs → local-CNPBZ89U.mjs}

@@ -1,6 +1,6 @@
-import { s as apiDataRequest } from "./ui--atbZ-TM.mjs";
-import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BPKfY9IN.mjs";
-import { n as rewriteApiPath } from "./dev-XULukupE.mjs";
+import { s as apiDataRequest } from "./ui-CUNkis89.mjs";
+import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BK0Hiwsn.mjs";
+import { n as rewriteApiPath } from "./dev-DVUEJ80c.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{login-By4y5O5-.mjs → login-COZ7Xcm0.mjs}

@@ -1,5 +1,5 @@
-import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-BFaWfSVu.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-DM2J10CB.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { hostname } from "node:os";
 import * as p from "@clack/prompts";

package/dist/{logs-Beqz--Df.mjs → logs-B_YoflCq.mjs}

@@ -1,5 +1,5 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-BFaWfSVu.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{migrations-Bg9FEGFh.mjs → migrations-Btzr9_q7.mjs}

@@ -1,5 +1,5 @@
-import { u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { s as apiDataRequest } from "./ui--atbZ-TM.mjs";
+import { u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { s as apiDataRequest } from "./ui-CUNkis89.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-D7f1wNn3.mjs → open-D2hH933K.mjs}

@@ -1,5 +1,5 @@
-import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-BFaWfSVu.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-DM2J10CB.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-C5rZwlw8.mjs → package-DTm0EzxR.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.23";
+var version = "0.7.24";
 //#endregion
 export { version as t };

package/dist/{projects-1r5387ui.mjs → projects-CLs6MEF7.mjs}

@@ -1,5 +1,5 @@
-import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{schedule-DK_Cv6Xf.mjs → schedule-B8zA8WlG.mjs}

@@ -1,5 +1,5 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-BFaWfSVu.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui--atbZ-TM.mjs";
+import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**

package/dist/{site-BFaWfSVu.mjs → site-DM2J10CB.mjs}

@@ -170,7 +170,7 @@ function clearAllProfileTokens() {
 function projectUrl(slug) {
 	const config = siteConfig();
 	const apex = config.projectDomain?.trim();
-	if (apex) return `${config.projectProtocol ?? (apex.includes("sslip.io") ? "http" : "https")}://${slug}.${apex.replace(/^\./, "")}`;
+	if (apex) return `${config.projectProtocol ?? "https"}://${slug}.${apex.replace(/^\./, "")}`;
 	const apiHost = new URL(config.apiUrl).hostname;
 	if (apiHost === "run.app" || apiHost.endsWith(".run.app") || apiHost.startsWith("api.")) throw new Error("Cannot derive the project URL. Set projectDomain (baked profile or CANOPY_PROJECT_DOMAIN).");
 	return `https://${slug}.${apiHost.split(".").slice(-2).join(".")}`;

package/dist/{skill-CgToW_Ac.mjs → skill-Dt49jdUT.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-C5rZwlw8.mjs";
-import { r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { t as version } from "./package-DTm0EzxR.mjs";
+import { r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{src-BPKfY9IN.mjs → src-BK0Hiwsn.mjs}

@@ -384,8 +384,21 @@ function dbRouter(config) {
 			error: "invalid_query",
 			detail: "expected { query: string, params?: (string|number|boolean|null)[], readonly?: boolean }"
 		}, 400);
+		const verdict = await config.guard?.(c, {
+			kind: "sql",
+			readonly: body.readonly
+		}, resolved);
+		if (verdict instanceof Response) return verdict;
+		const forced = verdict?.readonly === true;
+		if (forced) {
+			const violation = readOnlySqlViolation(body.query);
+			if (violation) return c.json({
+				error: "browser_db_access",
+				detail: `${violation}. ${verdict.refusal}`
+			}, 403);
+		}
 		if (body.readonly === void 0) {
-			const result = await store.query(body.query, params).catch((err) => err);
+			const result = await store.query(body.query, params, forced ? { readonly: true } : void 0).catch((err) => err);
 			if (result instanceof Error) return c.json({
 				error: "sql_error",
 				detail: result.message
@@ -399,7 +412,7 @@ function dbRouter(config) {
 				detail: violation
 			}, 400);
 		}
-		const result = await store.query(body.query, params, { readonly: body.readonly }).catch((err) => err);
+		const result = await store.query(body.query, params, { readonly: body.readonly || forced }).catch((err) => err);
 		if (result instanceof Error) return c.json({
 			error: "sql_error",
 			detail: result.message
@@ -416,6 +429,8 @@ function dbRouter(config) {
 	db.get("/db/schema", async (c) => {
 		const resolved = await resolve(c);
 		if (resolved instanceof Response) return resolved;
+		const verdict = await config.guard?.(c, { kind: "schema" }, resolved);
+		if (verdict instanceof Response) return verdict;
 		const schema = await introspectSchema(resolved.store, resolved.dialect.name).catch((err) => err);
 		if (schema instanceof Error) return c.json({
 			error: "sql_error",
@@ -429,6 +444,11 @@ function dbRouter(config) {
 		const { store, dialect } = resolved;
 		const collection = c.req.param("collection");
 		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const verdict = await config.guard?.(c, {
+			kind: "write",
+			collection
+		}, resolved);
+		if (verdict instanceof Response) return verdict;
 		const body = await c.req.json().catch(() => void 0);
 		if (!isPlainObject(body)) return c.json({
 			error: "invalid_document",
@@ -457,6 +477,11 @@ function dbRouter(config) {
 		const { store, dialect } = resolved;
 		const collection = c.req.param("collection");
 		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const verdict = await config.guard?.(c, {
+			kind: "read",
+			collection
+		}, resolved);
+		if (verdict instanceof Response) return verdict;
 		const q = c.req.query();
 		try {
 			const limit = intParam(q.limit, "limit", 100, MAX_LIMIT);
@@ -509,6 +534,11 @@ function dbRouter(config) {
 		const { store, dialect } = resolved;
 		const collection = c.req.param("collection");
 		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const verdict = await config.guard?.(c, {
+			kind: "read",
+			collection
+		}, resolved);
+		if (verdict instanceof Response) return verdict;
 		const get = dialect.get(collection, c.req.param("id"));
 		const row = (await store.query(get.sql, get.params)).results[0];
 		return c.json(row ? toDoc(row) : null);
@@ -519,6 +549,11 @@ function dbRouter(config) {
 		const { store, dialect } = resolved;
 		const collection = c.req.param("collection");
 		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const verdict = await config.guard?.(c, {
+			kind: "write",
+			collection
+		}, resolved);
+		if (verdict instanceof Response) return verdict;
 		const body = await c.req.json().catch(() => void 0);
 		if (!isPlainObject(body)) return c.json({
 			error: "invalid_patch",
@@ -535,6 +570,11 @@ function dbRouter(config) {
 		const { store, dialect } = resolved;
 		const collection = c.req.param("collection");
 		if (!COLLECTION_RE.test(collection)) return c.json({ error: "invalid_collection" }, 400);
+		const verdict = await config.guard?.(c, {
+			kind: "write",
+			collection
+		}, resolved);
+		if (verdict instanceof Response) return verdict;
 		const del = dialect.del(collection, c.req.param("id"));
 		const result = await store.query(del.sql, del.params);
 		return c.json({ deleted: (result.meta.changes ?? 0) > 0 });

package/dist/{staging-CdpV2YHB.mjs → staging-pZpdZuj_.mjs}

@@ -1,5 +1,5 @@
-import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui--atbZ-TM.mjs";
+import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-DM2J10CB.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/{token-C8Bmzwfl.mjs → token-BKwGa10J.mjs}

@@ -1,5 +1,5 @@
-import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-BFaWfSVu.mjs";
-import { l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui--atbZ-TM.mjs";
+import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
+import { l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {
@@ -21,9 +21,10 @@ const tokenCommand = defineCommand({
 			},
 			run: reportErrors("token create", async ({ args }) => {
 				const { slug } = resolveProject(args);
-				const { token } = await apiRequest("POST", `/projects/${slug}/deploy-tokens`, { name: args.name });
+				const { token, idle_days } = await apiRequest("POST", `/projects/${slug}/deploy-tokens`, { name: args.name });
 				console.log(`Deploy token for ${slug} (shown once — store it now):\n`);
 				console.log(`  ${token}\n`);
+				console.log(`It belongs to the project and stops working after ${idle_days} days without a deploy.`);
 				console.log("Add it to the GitHub repo as secret CANOPY_DEPLOY_TOKEN");
 				console.log("(gh secret set CANOPY_DEPLOY_TOKEN, or repo Settings → Secrets).");
 				console.log("Pushes to main then deploy via .github/workflows/canopy-deploy.yml.");
@@ -42,7 +43,10 @@ const tokenCommand = defineCommand({
 					console.log(`No deploy tokens for ${slug} — create one with \`canopy token create\`.`);
 					return;
 				}
-				for (const t of tokens) console.log(`${t.id}  ${t.name ?? "(unnamed)"}  created ${formatDateTime(t.created_at)} by ${t.created_by ?? "?"}`);
+				for (const t of tokens) {
+					const used = t.last_used_at ? `last used ${formatDateTime(t.last_used_at)}` : "never used";
+					console.log(`${t.id}  ${t.name ?? "(unnamed)"}  created ${formatDateTime(t.created_at)} by ${t.created_by ?? "?"}  ${used}`);
+				}
 			})
 		}),
 		revoke: defineCommand({

package/dist/{ui--atbZ-TM.mjs → ui-CUNkis89.mjs}

@@ -1,4 +1,4 @@
-import { n as siteConfig } from "./site-BFaWfSVu.mjs";
+import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { spawn } from "node:child_process";
 import { cancel, isCancel } from "@clack/prompts";
 //#region src/api.ts

package/dist/{upgrade-Bl_NJ_m5.mjs → upgrade-Cf81feok.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-CgToW_Ac.mjs");
+		const { skillInstalled } = await import("./skill-Dt49jdUT.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/dist/{usage-C1-cvS2-.mjs → usage-UmzU6sGp.mjs}

@@ -1,5 +1,5 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-BFaWfSVu.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.23",
+  "version": "0.7.24",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/db-TaSLpQZ5.mjs

@@ -1,204 +0,0 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, d as withContext, i as requireTty, r as reportErrors, s as apiDataRequest } from "./ui--atbZ-TM.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Bg9FEGFh.mjs";
-import { defineCommand } from "citty";
-import { readFileSync, writeFileSync } from "node:fs";
-import * as p from "@clack/prompts";
-//#region src/db.ts
-/**
-* canopy db pull | snapshot | snapshots | restore — data safety from the
-* terminal (docs/04-roadmap.md Phase 2 item 4, pulled forward).
-*
-* pull      download a fresh SQL dump of the project database
-* snapshot  store a dump server-side (restorable from CLI or dashboard)
-* snapshots list stored snapshots
-* restore   replace ALL project data from a snapshot or a local .sql file
-* migrate   apply pending schema migrations (docs/13-migrations-and-drizzle.md)
-*
-* The project comes from canopy.json in the current directory, or
-* --project <slug>.
-*/
-/** Shared flag: operate on the staging channel's database (docs/14). */
-const stagingFlagArgs = { staging: {
-	type: "boolean",
-	default: false,
-	description: "Target the staging channel's database instead of live"
-} };
-const channelOf = (args) => args.staging ? "staging" : "live";
-const channelNote = (args) => args.staging ? " [staging]" : "";
-const formatSize = (bytes) => bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)} kB` : `${(bytes / 1024 / 1024).toFixed(1)} MB`;
-const dbCommand = defineCommand({
-	meta: {
-		name: "db",
-		description: "Data tools: pull, snapshot, snapshots, restore, migrate"
-	},
-	subCommands: {
-		pull: defineCommand({
-			meta: {
-				name: "pull",
-				description: "Download a fresh SQL dump of the project database"
-			},
-			args: {
-				...projectFlagArgs,
-				...stagingFlagArgs,
-				out: {
-					type: "string",
-					description: "Output file (defaults to <slug>-<timestamp>.sql)"
-				}
-			},
-			run: reportErrors("db pull", async ({ args }) => {
-				const { slug } = resolveProject(args);
-				const out = args.out ?? `${slug}-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replaceAll(/[:T]/g, "-")}.sql`;
-				const spin = p.spinner();
-				spin.start(`Exporting ${slug}${channelNote(args)}…`);
-				try {
-					const { url } = await apiDataRequest("POST", "/db/export", slug, void 0, void 0, channelOf(args));
-					const download = await fetch(url);
-					if (!download.ok) throw new Error(`Download failed (HTTP ${download.status}).`);
-					const sql = Buffer.from(await download.arrayBuffer());
-					writeFileSync(out, sql);
-					spin.stop(`Wrote ${out} (${formatSize(sql.byteLength)}).`);
-				} catch (err) {
-					spin.error("Export failed.");
-					throw err;
-				}
-			})
-		}),
-		snapshot: defineCommand({
-			meta: {
-				name: "snapshot",
-				description: "Store a dump server-side (restorable anytime)"
-			},
-			args: {
-				...projectFlagArgs,
-				...stagingFlagArgs
-			},
-			run: reportErrors("db snapshot", async ({ args }) => {
-				const { slug } = resolveProject(args);
-				const spin = p.spinner();
-				spin.start(`Snapshotting ${slug}${channelNote(args)}…`);
-				let created;
-				try {
-					({snapshot: created} = await apiDataRequest("POST", "/db/snapshots", slug, void 0, void 0, channelOf(args)));
-				} catch (err) {
-					spin.error("Snapshot failed.");
-					throw err;
-				}
-				spin.stop(`Stored ${created.key} (${formatSize(created.size)}).`);
-				console.log(`Restore anytime with \`canopy db restore --snapshot ${created.key}\`.`);
-			})
-		}),
-		snapshots: defineCommand({
-			meta: {
-				name: "snapshots",
-				description: "List stored snapshots"
-			},
-			args: {
-				...projectFlagArgs,
-				...stagingFlagArgs
-			},
-			run: reportErrors("db snapshots", async ({ args }) => {
-				const { slug } = resolveProject(args);
-				const { snapshots } = await apiDataRequest("GET", "/db/snapshots", slug, void 0, void 0, channelOf(args));
-				if (snapshots.length === 0) {
-					console.log(`No snapshots for ${slug} yet — run \`canopy db snapshot\`.`);
-					return;
-				}
-				for (const snapshot of snapshots) console.log(`${snapshot.key}  ${formatSize(snapshot.size).padStart(9)}  ${snapshot.createdAt}`);
-			})
-		}),
-		restore: defineCommand({
-			meta: {
-				name: "restore",
-				description: "Replace ALL project data from a snapshot or a local .sql file"
-			},
-			args: {
-				...projectFlagArgs,
-				...stagingFlagArgs,
-				file: {
-					type: "positional",
-					description: "Local .sql dump to restore from",
-					required: false
-				},
-				snapshot: {
-					type: "string",
-					description: "Server-side snapshot key to restore from"
-				},
-				yes: {
-					type: "boolean",
-					default: false,
-					description: "Skip the type-the-slug confirmation"
-				}
-			},
-			run: reportErrors("db restore", async ({ args }) => {
-				const { slug } = resolveProject(args);
-				const { file } = args;
-				let snapshotKey = args.snapshot;
-				if (!snapshotKey && !file) {
-					requireTty("pass a local .sql dump or --snapshot <key>.");
-					const { snapshots } = await apiDataRequest("GET", "/db/snapshots", slug, void 0, void 0, channelOf(args));
-					if (snapshots.length === 0) throw new Error(`No snapshots for ${slug} — run \`canopy db snapshot\` first, or pass a local .sql dump.`);
-					snapshotKey = unwrap(await p.select({
-						message: `Snapshot to restore into ${slug}`,
-						options: snapshots.map((snapshot) => ({
-							value: snapshot.key,
-							label: snapshot.key,
-							hint: `${formatSize(snapshot.size)} · ${snapshot.createdAt}`
-						}))
-					}));
-				}
-				if (!args.yes) {
-					requireTty("pass --yes to restore without confirmation.");
-					if (unwrap(await p.text({ message: `Restore will REPLACE all current data in "${slug}"${channelNote(args)} with ${snapshotKey ?? file}. Type the slug to confirm.` })).trim() !== slug) {
-						p.cancel("Aborted.");
-						return;
-					}
-				}
-				const restoreContext = { action: `restore "${slug}" from ${snapshotKey ?? file}` };
-				if (snapshotKey) await withContext(apiDataRequest("POST", "/db/restore", slug, { snapshot: snapshotKey }, void 0, channelOf(args)), restoreContext);
-				else if (file) await withContext(apiDataRequest("POST", "/db/restore", slug, readFileSync(file, "utf8"), "application/sql", channelOf(args)), restoreContext);
-				p.log.success(`Restored ${slug}${channelNote(args)}.`);
-			})
-		}),
-		migrate: defineCommand({
-			meta: {
-				name: "migrate",
-				description: "Apply pending schema migrations to the project database"
-			},
-			args: {
-				...projectFlagArgs,
-				...stagingFlagArgs,
-				plan: {
-					type: "boolean",
-					default: false,
-					description: "Dry run: list pending migrations without applying anything"
-				}
-			},
-			run: reportErrors("db migrate", async ({ args }) => {
-				const { dir, slug } = resolveProject(args);
-				const files = readMigrationFiles(dir);
-				if (files === void 0) throw new Error("No migrations directory configured — set \"migrations\" in canopy.json (e.g. {\"migrations\": \"./migrations\"}, pointing at your drizzle-kit output).");
-				if (args.plan) {
-					const result = await withContext(migrateProject(slug, files, true, channelOf(args)), { action: `plan migrations for "${slug}"${channelNote(args)}` });
-					if (result.pending.length === 0) console.log(`Nothing pending (${result.applied.length} applied previously).`);
-					else for (const name of result.pending) console.log(`pending ${name}`);
-					for (const line of describeMigrateResult(result)) console.log(line);
-					return;
-				}
-				const spin = p.spinner();
-				spin.start(`Migrating ${slug}${channelNote(args)}…`);
-				let result;
-				try {
-					result = await withContext(migrateProject(slug, files, false, channelOf(args)), { action: `migrate "${slug}"${channelNote(args)}` });
-				} catch (err) {
-					spin.error("Migrate failed.");
-					throw err;
-				}
-				spin.stop(result.appliedNow.length === 0 ? `Nothing pending for ${slug}.` : `Applied ${result.appliedNow.length} migration(s) to ${slug}.`);
-				for (const line of describeMigrateResult(result)) console.log(`  ${line}`);
-			})
-		})
-	}
-});
-//#endregion
-export { dbCommand };

package/dist/dev-BFPlhkzp.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-XULukupE.mjs";
-export { devCommand };