@mediamonks/canopy-cli 0.7.24 → 0.7.25

package/dist/dev-BAcZi226.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-BanjQNiD.mjs";
+export { devCommand };

package/dist/{dev-DVUEJ80c.mjs → dev-BanjQNiD.mjs}

@@ -1,6 +1,7 @@
 import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
 import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
 import { r as readMigrationFiles } from "./migrations-Btzr9_q7.mjs";
+import { n as stampWorkerHeaders } from "./src-CwSKZwNK.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { existsSync } from "node:fs";
@@ -37,7 +38,7 @@ async function workerPlugin(flags, slug) {
 		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
 		return;
 	}
-	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-CWU6XFe_.mjs");
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-BerdPJ_U.mjs");
 	const secrets = readDevVars(flags.dir);
 	const email = siteConfig().email;
 	const plugin = workerDevPlugin({
@@ -132,6 +133,19 @@ function devTokenContext(slug) {
 		fixes: { not_found: `No project "${slug}" is registered on Canopy (or your account can't access it). Either rename "slug" in canopy.json to match an existing project (see \`canopy projects\`), or register this one — create it in the dashboard, then set that slug in canopy.json.` }
 	};
 }
+/**
+* Headers the remote-mode /_api proxy attaches to every browser-SDK call.
+* Project scope is transport-level (docs/10 D17): the api. gateway refuses
+* /data/v1 without X-Canopy-Project, so the proxy stamps it exactly the way
+* the worker path does — one definition, no drift between the two.
+*/
+function devProxyHeaders(token, slug, channel) {
+	const headers = stampWorkerHeaders(new Headers({ authorization: `Bearer ${token}` }), {
+		projectSlug: slug,
+		channel
+	});
+	return Object.fromEntries(headers);
+}
 async function devRemote(flags, slug) {
 	const { token, expires_at } = await withContext(apiRequest("POST", `/projects/${slug}/dev-token`), devTokenContext(slug));
 	const { apiUrl } = siteConfig();
@@ -139,10 +153,7 @@ async function devRemote(flags, slug) {
 	const server = await startVite(flags, { proxy: { "/_api": {
 		target: apiUrl,
 		changeOrigin: true,
-		headers: {
-			authorization: `Bearer ${token}`,
-			...flags.staging ? { "x-canopy-channel": "staging" } : {}
-		},
+		headers: devProxyHeaders(token, slug, flags.staging ? "staging" : "live"),
 		rewrite: rewriteApiPath
 	} } }, worker ? [worker.plugin] : []);
 	if (flags.staging) {
@@ -165,7 +176,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-CNPBZ89U.mjs");
+		const { fetchProjectDump } = await import("./local-DvzG4XUB.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -180,7 +191,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-CNPBZ89U.mjs");
+	const { createSandbox } = await import("./local-DvzG4XUB.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),
@@ -301,4 +312,4 @@ const devCommand = defineCommand({
 	})
 });
 //#endregion
-export { rewriteApiPath as n, devCommand as t };
+export { devProxyHeaders as n, rewriteApiPath as r, devCommand as t };

package/dist/{dev-worker-CWU6XFe_.mjs → dev-worker-BerdPJ_U.mjs}

@@ -1,76 +1,6 @@
-import "./src-BK0Hiwsn.mjs";
+import { n as stampWorkerHeaders, t as redactCanopyCredentials } from "./src-CwSKZwNK.mjs";
 import { readFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
-//#region ../data-plane/src/worker-request.ts
-/**
-* How a project's backend addresses the platform — the one definition.
-*
-* Three hosts run project workers and each builds this request itself: the
-* Workers-for-Platforms shim (apps/api/src/platform/wfp-shim.ts), the Node
-* runtime (apps/project-runtime/src/canopy-fetch.ts), and `canopy dev`
-* (packages/cli/src/dev-worker.ts). They had three copies of the header
-* shaping, and the two that hold a worker token had two copies of the
-* credential rule — which is exactly how the Google project grant came to
-* work on one target and not the other.
-*
-* The shim cannot import this: it ships as a standalone module uploaded
-* beside the user bundle, so it may only import `./bundle.mjs`. It keeps a
-* transcription, and `wfp-shim.test.ts` runs it against the table in
-* `worker-request.cases.ts` alongside this implementation, so the two cannot
-* drift silently.
-*/
-/** Gateway-stamped identity, for the worker's own `env.USER` — never relayed. */
-const IDENTITY_STAMP_HEADERS = [
-	"x-canopy-user-sub",
-	"x-canopy-user-email",
-	"x-canopy-user-name"
-];
-/** Cookies that authenticate to Canopy itself — the monk session and the client-page session. */
-const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_client"]);
-/**
-* Strip Canopy's own credentials from a request before untrusted project code
-* sees it (R-01).
-*
-* The visitor's session cookie arrives with every request the gateway
-* dispatches, and a bundle that can read it can replay it against the platform
-* as that person — against the control plane, and against other projects' data
-* on the api host. It is a credential, so the host keeps it in closure scope
-* like the raw DB and blob handles, and hands the bundle a redacted request.
-*
-* Redaction is surgical on purpose: an app's own cookies and its own
-* Authorization scheme survive, because those belong to the app. Only
-* `canopy_session` / `canopy_client` and a `cnpy_` bearer are removed.
-*
-* `env.CANOPY.fetch` still authenticates as the visitor — the host passes it
-* the unredacted headers — so nothing about the platform-facing behaviour
-* changes; the credential simply stops being reachable from bundle code.
-*/
-function redactCanopyCredentials(headers) {
-	const cookie = headers.get("cookie");
-	if (cookie !== null) {
-		const kept = cookie.split(";").filter((part) => {
-			const name = part.split("=")[0]?.trim() ?? "";
-			return name !== "" && !CANOPY_COOKIE_NAMES.has(name);
-		}).join(";").trim();
-		if (kept === "") headers.delete("cookie");
-		else headers.set("cookie", kept);
-	}
-	if (headers.get("authorization")?.startsWith("Bearer cnpy_")) headers.delete("authorization");
-	return headers;
-}
-/**
-* Strip what must never travel upstream and stamp who is calling. Common to
-* every host; says nothing about credentials.
-*/
-function stampWorkerHeaders(headers, ctx) {
-	headers.delete("host");
-	for (const stamp of IDENTITY_STAMP_HEADERS) headers.delete(stamp);
-	headers.set("x-canopy-project", ctx.projectSlug);
-	if (ctx.channel === "staging") headers.set("x-canopy-channel", "staging");
-	else headers.delete("x-canopy-channel");
-	return headers;
-}
-//#endregion
 //#region src/dev-worker.ts
 /**
 * Paths that belong to the worker rather than the SPA — the gateway's rule

package/dist/{docs-BLWio_65.mjs → docs-xRbVshXp.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-DTm0EzxR.mjs";
+import { t as version } from "./package-vZ0xH49Y.mjs";
 import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { r as reportErrors } from "./ui-CUNkis89.mjs";

package/dist/{feedback-Bnmi1Ukv.mjs → feedback-CGjOAHON.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-DTm0EzxR.mjs";
+import { t as version } from "./package-vZ0xH49Y.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
 import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-DTm0EzxR.mjs";
+import { t as version } from "./package-vZ0xH49Y.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -67,7 +67,7 @@ const main = defineCommand({
 		init: () => import("./projects-CLs6MEF7.mjs").then((m) => m.initCommand),
 		projects: () => import("./projects-CLs6MEF7.mjs").then((m) => m.projectsCommand),
 		delete: () => import("./projects-CLs6MEF7.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-C5BmSJo1.mjs").then((m) => m.devCommand),
+		dev: () => import("./dev-BAcZi226.mjs").then((m) => m.devCommand),
 		deploy: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.deployCommand),
 		promote: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.promoteCommand),
 		staging: () => import("./staging-pZpdZuj_.mjs").then((m) => m.stagingCommand),
@@ -76,13 +76,13 @@ const main = defineCommand({
 		token: () => import("./token-BKwGa10J.mjs").then((m) => m.tokenCommand),
 		egress: () => import("./egress-BjN-7vil.mjs").then((m) => m.egressCommand),
 		schedule: () => import("./schedule-B8zA8WlG.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-Bnmi1Ukv.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-CGjOAHON.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-jmYaum8F.mjs").then((m) => m.dbCommand),
 		usage: () => import("./usage-UmzU6sGp.mjs").then((m) => m.usageCommand),
 		open: () => import("./open-D2hH933K.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-BLWio_65.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-Dt49jdUT.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-Cf81feok.mjs").then((m) => m.upgradeCommand),
+		docs: () => import("./docs-xRbVshXp.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-PoaZrCNy.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-DjrNZ-B4.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-B_YoflCq.mjs").then((m) => m.logsCommand)
 	}
 });

package/dist/{local-CNPBZ89U.mjs → local-DvzG4XUB.mjs}

@@ -1,6 +1,6 @@
 import { s as apiDataRequest } from "./ui-CUNkis89.mjs";
-import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BK0Hiwsn.mjs";
-import { n as rewriteApiPath } from "./dev-DVUEJ80c.mjs";
+import { a as blobRouter, i as META_COLUMNS, r as dbRouter } from "./src-CwSKZwNK.mjs";
+import { r as rewriteApiPath } from "./dev-BanjQNiD.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{package-DTm0EzxR.mjs → package-vZ0xH49Y.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.24";
+var version = "0.7.25";
 //#endregion
 export { version as t };

package/dist/{skill-Dt49jdUT.mjs → skill-PoaZrCNy.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-DTm0EzxR.mjs";
+import { t as version } from "./package-vZ0xH49Y.mjs";
 import { r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/{src-BK0Hiwsn.mjs → src-CwSKZwNK.mjs}

@@ -582,4 +582,74 @@ function dbRouter(config) {
 	return db;
 }
 //#endregion
-export { META_COLUMNS as n, blobRouter as r, dbRouter as t };
+//#region ../data-plane/src/worker-request.ts
+/**
+* How a project's backend addresses the platform — the one definition.
+*
+* Three hosts run project workers and each builds this request itself: the
+* Workers-for-Platforms shim (apps/api/src/platform/wfp-shim.ts), the Node
+* runtime (apps/project-runtime/src/canopy-fetch.ts), and `canopy dev`
+* (packages/cli/src/dev-worker.ts). They had three copies of the header
+* shaping, and the two that hold a worker token had two copies of the
+* credential rule — which is exactly how the Google project grant came to
+* work on one target and not the other.
+*
+* The shim cannot import this: it ships as a standalone module uploaded
+* beside the user bundle, so it may only import `./bundle.mjs`. It keeps a
+* transcription, and `wfp-shim.test.ts` runs it against the table in
+* `worker-request.cases.ts` alongside this implementation, so the two cannot
+* drift silently.
+*/
+/** Gateway-stamped identity, for the worker's own `env.USER` — never relayed. */
+const IDENTITY_STAMP_HEADERS = [
+	"x-canopy-user-sub",
+	"x-canopy-user-email",
+	"x-canopy-user-name"
+];
+/** Cookies that authenticate to Canopy itself — the monk session and the client-page session. */
+const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_client"]);
+/**
+* Strip Canopy's own credentials from a request before untrusted project code
+* sees it (R-01).
+*
+* The visitor's session cookie arrives with every request the gateway
+* dispatches, and a bundle that can read it can replay it against the platform
+* as that person — against the control plane, and against other projects' data
+* on the api host. It is a credential, so the host keeps it in closure scope
+* like the raw DB and blob handles, and hands the bundle a redacted request.
+*
+* Redaction is surgical on purpose: an app's own cookies and its own
+* Authorization scheme survive, because those belong to the app. Only
+* `canopy_session` / `canopy_client` and a `cnpy_` bearer are removed.
+*
+* `env.CANOPY.fetch` still authenticates as the visitor — the host passes it
+* the unredacted headers — so nothing about the platform-facing behaviour
+* changes; the credential simply stops being reachable from bundle code.
+*/
+function redactCanopyCredentials(headers) {
+	const cookie = headers.get("cookie");
+	if (cookie !== null) {
+		const kept = cookie.split(";").filter((part) => {
+			const name = part.split("=")[0]?.trim() ?? "";
+			return name !== "" && !CANOPY_COOKIE_NAMES.has(name);
+		}).join(";").trim();
+		if (kept === "") headers.delete("cookie");
+		else headers.set("cookie", kept);
+	}
+	if (headers.get("authorization")?.startsWith("Bearer cnpy_")) headers.delete("authorization");
+	return headers;
+}
+/**
+* Strip what must never travel upstream and stamp who is calling. Common to
+* every host; says nothing about credentials.
+*/
+function stampWorkerHeaders(headers, ctx) {
+	headers.delete("host");
+	for (const stamp of IDENTITY_STAMP_HEADERS) headers.delete(stamp);
+	headers.set("x-canopy-project", ctx.projectSlug);
+	if (ctx.channel === "staging") headers.set("x-canopy-channel", "staging");
+	else headers.delete("x-canopy-channel");
+	return headers;
+}
+//#endregion
+export { blobRouter as a, META_COLUMNS as i, stampWorkerHeaders as n, dbRouter as r, redactCanopyCredentials as t };

package/dist/{upgrade-Cf81feok.mjs → upgrade-DjrNZ-B4.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-Dt49jdUT.mjs");
+		const { skillInstalled } = await import("./skill-PoaZrCNy.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.24",
+  "version": "0.7.25",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-C5BmSJo1.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-DVUEJ80c.mjs";
-export { devCommand };