@mediamonks/canopy-cli 0.7.25 → 0.7.26

package/dist/{db-jmYaum8F.mjs → db-DVMwCLlU.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, s as apiDataRequest } from "./ui-CUNkis89.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Btzr9_q7.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, s as apiDataRequest } from "./ui-DR-siu2S.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-B9fXxMDj.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-CYKiBnrg.mjs → deploy-CTMcwHhI.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as unwrap, c as apiDownload, d as withContext, l as apiRequest, r as reportErrors, s as apiDataRequest, t as formatDateTime } from "./ui-CUNkis89.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Btzr9_q7.mjs";
+import { a as unwrap, c as apiDownload, d as withContext, l as apiRequest, r as reportErrors, s as apiDataRequest, t as formatDateTime } from "./ui-DR-siu2S.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-B9fXxMDj.mjs";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";

package/dist/dev-BOvMCaML.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-BvjbJcse.mjs";
+export { devCommand };

package/dist/{dev-BanjQNiD.mjs → dev-BvjbJcse.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
-import { r as readMigrationFiles } from "./migrations-Btzr9_q7.mjs";
+import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui-DR-siu2S.mjs";
+import { r as readMigrationFiles } from "./migrations-B9fXxMDj.mjs";
 import { n as stampWorkerHeaders } from "./src-CwSKZwNK.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
@@ -176,7 +176,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-DvzG4XUB.mjs");
+		const { fetchProjectDump } = await import("./local-laAZEDVJ.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -191,7 +191,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-DvzG4XUB.mjs");
+	const { createSandbox } = await import("./local-laAZEDVJ.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/docs/cli-dev.md

@@ -47,7 +47,7 @@ To tick a schedule by hand, post its name to the same path the platform uses:
 curl -X POST localhost:5173/__canopy/scheduled -d '{"name":"nightly-digest"}'
 ```
 
-**Worker secrets.** Secrets you set in the dashboard are never downloaded — the platform can't hand a stored value back, and your laptop is not where a live API key belongs. Put local values in a `.dev.vars` file next to `canopy.json` instead:
+**Worker secrets.** Secrets you set in the dashboard or with [`canopy secrets set`](https://docs.canopy.website/cli/secrets) are never downloaded — the platform can't hand a stored value back, and your laptop is not where a live API key belongs. Put local values in a `.dev.vars` file next to `canopy.json` instead:
 
 ```
 STRIPE_KEY=sk_test_local

package/dist/docs/cli-secrets.md

@@ -0,0 +1,45 @@
+---
+title: canopy secrets
+description: Set, list, and remove the project's worker secrets from the terminal.
+---
+
+`canopy secrets` manages the secrets your backend worker reads as `c.env.NAME`
+— API keys, signing secrets, anything the browser must never see. It does the
+same job as the dashboard's Secrets panel, so a first deploy can be scripted
+end to end: create the project, allow its hosts, set its secrets, deploy.
+
+## Usage
+
+```bash
+canopy secrets list
+printf %s "$STRIPE_SECRET" | canopy secrets set STRIPE_SECRET
+canopy secrets set STRIPE_SECRET --from-env STRIPE_SECRET
+canopy secrets set STRIPE_SECRET            # hidden prompt in a terminal
+canopy secrets remove STRIPE_SECRET
+```
+
+## Arguments & flags
+
+All subcommands resolve the project the usual way — `canopy.json` in the
+target directory, or `--project <slug>` to override — and honor the global
+`--profile <site>` / `CANOPY_PROFILE`.
+
+- `list` — print the secret names and when each was last set. Values are
+  never shown.
+- `set <name>` — store a value. Names are `UPPER_SNAKE_CASE`, up to 64
+  characters. The value comes from **stdin** when piped (one trailing newline
+  is trimmed, so `echo` works too), from `--from-env <VAR>` to read an
+  environment variable, or from a hidden prompt when you run it in a terminal.
+  There is deliberately no `--value` flag: a value on the command line would
+  end up in shell history and process lists.
+- `remove <name>` — delete a secret. The worker stops seeing it right away.
+
+## How it works
+
+Secrets live on the platform, encrypted, per project. Setting or removing one
+re-rolls the running worker immediately — no deploy needed. The live and
+staging channels share one set of secrets, like the egress allowlist. Values
+travel one way: once stored they can't be read back by anyone, including
+`canopy dev`, which is why local development uses a `.dev.vars` file with
+stand-in values (see [`canopy dev`](https://docs.canopy.website/cli/dev)). A project holds at most 64
+secrets of up to 8 KiB each.

package/dist/docs/dev.md

@@ -53,9 +53,9 @@ Projects with a `worker` entry in `canopy.json` get their backend locally too:
 production (`env.CANOPY`, `env.DB`, `env.BLOB`, `env.USER`). Edit and refresh —
 there's no build step.
 
-Secrets are the one thing that doesn't come from the dashboard. Stored values
-are never downloadable, so put local ones in a `.dev.vars` file next to
-`canopy.json`:
+Secrets are the one thing that doesn't come from the platform. Stored values
+(set in the dashboard or with `canopy secrets set`) are never downloadable, so
+put local ones in a `.dev.vars` file next to `canopy.json`:
 
 ```
 STRIPE_KEY=sk_test_local

package/dist/docs/index.json

@@ -251,6 +251,11 @@
           "title": "canopy egress",
           "summary": "Manage which outbound hosts the project's backend worker may fetch."
         },
+        {
+          "slug": "cli-secrets",
+          "title": "canopy secrets",
+          "summary": "Set, list, and remove the project's worker secrets from the terminal."
+        },
         {
           "slug": "cli-schedule",
           "title": "canopy schedule",

package/dist/docs/platform-google.md

@@ -97,6 +97,12 @@ so is a write using a reading-only permission.
 
 Drive is deliberately limited to files your project created or that someone
 explicitly opened with it — connecting Drive does not expose a whole Drive.
+The one exception is **Copy files it is given**: hand your project the id of a
+file the account can open (a template deck, say) and it may copy that one file.
+The copy is a file your project made, so with _Files this project makes_ it can
+open and change the copy from then on — the original is never touched. It cannot
+list, search or read anything else. Because Google has no copy-only permission,
+this one counts as wider access and needs a Canopy admin to unlock it.
 
 ### Wider permissions
 
@@ -145,14 +151,15 @@ reading-only permission is refused before it reaches Google.
 
 **Drive**
 
-| Permission                                    | What it allows                                                                |
-| --------------------------------------------- | ----------------------------------------------------------------------------- |
-| Files this project makes                      | Create files, and reopen the ones this project made or someone picked for it. |
-| Its own config folder                         | A hidden folder only this project can see. Invisible in the account's Drive.  |
-| Recordings and transcripts **(wider access)** | Read the recordings and transcripts Meet saved to Drive.                      |
-| Read the whole Drive _(under consideration)_  | Read and download every file the account can see.                             |
-| Read all file names _(under consideration)_   | Names and metadata of every file the account can see, without contents.       |
-| Full Drive access _(under consideration)_     | Read, change and delete every file the account can see.                       |
+| Permission                                    | What it allows                                                                                                     |
+| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| Files this project makes                      | Create files, and reopen the ones this project made or someone picked for it.                                      |
+| Its own config folder                         | A hidden folder only this project can see. Invisible in the account's Drive.                                       |
+| Copy files it is given **(wider access)**     | Copy a file the account can open, by id, into a file this project owns. Cannot list, read or change anything else. |
+| Recordings and transcripts **(wider access)** | Read the recordings and transcripts Meet saved to Drive.                                                           |
+| Read the whole Drive _(under consideration)_  | Read and download every file the account can see.                                                                  |
+| Read all file names _(under consideration)_   | Names and metadata of every file the account can see, without contents.                                            |
+| Full Drive access _(under consideration)_     | Read, change and delete every file the account can see.                                                            |
 
 **Gmail**
 

package/dist/docs/porting-nextjs.md

@@ -62,24 +62,24 @@ together as a single version, with rollback.
 List everything in the app that runs on the server. Each item lands in one of
 three buckets:
 
-| Next.js feature                                 | Where it goes on Canopy                                                          |
-| ----------------------------------------------- | -------------------------------------------------------------------------------- |
-| Pages, layouts, client components               | Static build (unchanged in spirit)                                               |
-| Server components fetching data at request time | Client-side fetching, or a worker endpoint                                       |
-| Route handlers (`app/api/*/route.ts`)           | Worker endpoints under `/api/*`                                                  |
-| Server actions                                  | Explicit worker endpoints, called with `fetch` from the client                   |
-| Middleware                                      | Usually deleted (auth is platform-provided); anything else moves into the worker |
-| NextAuth / auth middleware                      | Deleted — use `canopy.auth.user()` (client) or `env.USER` (worker)               |
-| Database (Prisma, Postgres, …)                  | `canopy.db` — per-project database, document API + SQL escape hatch              |
-| File uploads (S3, …)                            | `canopy.blob` — per-project file storage with signed downloads                   |
-| AI SDK / OpenAI client                          | `canopy.ai.chat()`, or point the Vercel AI SDK at `canopy.ai.endpoint()`         |
-| `NEXT_PUBLIC_*` env vars                        | Build-time env vars in your CI — the platform doesn't inject build config        |
-| Server-side env vars / secrets                  | Project secrets (dashboard Settings) — injected into the worker's `env`          |
-| Cron (`vercel.json` crons)                      | [Schedules](https://docs.canopy.website/platform/schedules) — delivered to the worker's `scheduled()`       |
-| ISR / `revalidate` / caching                    | Dropped — at internal-tool scale, fetch fresh or cache in the client             |
-| `next/image` optimization                       | Plain `<img>`, or optimize at build time                                         |
-| Custom domain                                   | Not available — projects live at `<slug>.canopy.<domain>` behind sign-in         |
-| Queues / background jobs                        | Not supported — restructure around request/response plus schedules               |
+| Next.js feature                                 | Where it goes on Canopy                                                                         |
+| ----------------------------------------------- | ----------------------------------------------------------------------------------------------- |
+| Pages, layouts, client components               | Static build (unchanged in spirit)                                                              |
+| Server components fetching data at request time | Client-side fetching, or a worker endpoint                                                      |
+| Route handlers (`app/api/*/route.ts`)           | Worker endpoints under `/api/*`                                                                 |
+| Server actions                                  | Explicit worker endpoints, called with `fetch` from the client                                  |
+| Middleware                                      | Usually deleted (auth is platform-provided); anything else moves into the worker                |
+| NextAuth / auth middleware                      | Deleted — use `canopy.auth.user()` (client) or `env.USER` (worker)                              |
+| Database (Prisma, Postgres, …)                  | `canopy.db` — per-project database, document API + SQL escape hatch                             |
+| File uploads (S3, …)                            | `canopy.blob` — per-project file storage with signed downloads                                  |
+| AI SDK / OpenAI client                          | `canopy.ai.chat()`, or point the Vercel AI SDK at `canopy.ai.endpoint()`                        |
+| `NEXT_PUBLIC_*` env vars                        | Build-time env vars in your CI — the platform doesn't inject build config                       |
+| Server-side env vars / secrets                  | Project secrets (`canopy secrets set` or dashboard Settings) — injected into the worker's `env` |
+| Cron (`vercel.json` crons)                      | [Schedules](https://docs.canopy.website/platform/schedules) — delivered to the worker's `scheduled()`                      |
+| ISR / `revalidate` / caching                    | Dropped — at internal-tool scale, fetch fresh or cache in the client                            |
+| `next/image` optimization                       | Plain `<img>`, or optimize at build time                                                        |
+| Custom domain                                   | Not available — projects live at `<slug>.canopy.<domain>` behind sign-in                        |
+| Queues / background jobs                        | Not supported — restructure around request/response plus schedules                              |
 
 If the last two rows are deal-breakers, stop here: see
 [When not to port](#when-not-to-port).
@@ -253,6 +253,6 @@ past greenhouse size (see [Use cases](https://docs.canopy.website/overview/use-c
 - [ ] Worker: route handlers + server actions → `/api/*` endpoints in `worker/index.ts`
 - [ ] Data: ORM → `canopy.db`; uploads → `canopy.blob`; AI clients → `canopy.ai`
 - [ ] Delete NextAuth/middleware; read identity from `canopy.auth.user()` / `env.USER`
-- [ ] Secrets into dashboard Settings; `NEXT_PUBLIC_*` into your CI build
+- [ ] Secrets via `canopy secrets set` (or dashboard Settings); `NEXT_PUBLIC_*` into your CI build
 - [ ] Crons into Settings → Schedules, handled in `scheduled()`
 - [ ] `canopy.json` with `build`, `dist`, `worker` — then `canopy deploy`

package/dist/{docs-xRbVshXp.mjs → docs-x3hMtUzT.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-vZ0xH49Y.mjs";
+import { t as version } from "./package-CBso2611.mjs";
 import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui-CUNkis89.mjs";
+import { r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{egress-BjN-7vil.mjs → egress-Cn-P46O3.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts

package/dist/{feedback-CGjOAHON.mjs → feedback-C9m3dNkJ.mjs}

@@ -1,6 +1,6 @@
-import { t as version } from "./package-vZ0xH49Y.mjs";
+import { t as version } from "./package-CBso2611.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui-CUNkis89.mjs";
+import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-vZ0xH49Y.mjs";
+import { t as version } from "./package-CBso2611.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,30 +60,31 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-COZ7Xcm0.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-COZ7Xcm0.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-COZ7Xcm0.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-CLs6MEF7.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-CLs6MEF7.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-CLs6MEF7.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-CLs6MEF7.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-BAcZi226.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-pZpdZuj_.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-BKwGa10J.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-BjN-7vil.mjs").then((m) => m.egressCommand),
-		schedule: () => import("./schedule-B8zA8WlG.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-CGjOAHON.mjs").then((m) => m.feedbackCommand),
-		db: () => import("./db-jmYaum8F.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-UmzU6sGp.mjs").then((m) => m.usageCommand),
-		open: () => import("./open-D2hH933K.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-xRbVshXp.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-PoaZrCNy.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-DjrNZ-B4.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-B_YoflCq.mjs").then((m) => m.logsCommand)
+		login: () => import("./login-C4MDP5NM.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-C4MDP5NM.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-C4MDP5NM.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-Dmm_976k.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-Dmm_976k.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-Dmm_976k.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-Dmm_976k.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-BOvMCaML.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-CTMcwHhI.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-CTMcwHhI.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-CKEoDnac.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-CTMcwHhI.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-CTMcwHhI.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-Dp2CoIYj.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-Cn-P46O3.mjs").then((m) => m.egressCommand),
+		secrets: () => import("./secrets-BD3DaTih.mjs").then((m) => m.secretsCommand),
+		schedule: () => import("./schedule-Buu71RWQ.mjs").then((m) => m.scheduleCommand),
+		feedback: () => import("./feedback-C9m3dNkJ.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-DVMwCLlU.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-81JSiWIx.mjs").then((m) => m.usageCommand),
+		open: () => import("./open-rS1ARzOy.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-x3hMtUzT.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-DmVlZXgv.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-C7u8pxeV.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-CfDINw7U.mjs").then((m) => m.logsCommand)
 	}
 });
 if (process.argv[2] !== "upgrade") notifyOfUpdate(version);

package/dist/{local-DvzG4XUB.mjs → local-laAZEDVJ.mjs}

@@ -1,6 +1,6 @@
-import { s as apiDataRequest } from "./ui-CUNkis89.mjs";
+import { s as apiDataRequest } from "./ui-DR-siu2S.mjs";
 import { a as blobRouter, i as META_COLUMNS, r as dbRouter } from "./src-CwSKZwNK.mjs";
-import { r as rewriteApiPath } from "./dev-BanjQNiD.mjs";
+import { r as rewriteApiPath } from "./dev-BvjbJcse.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{login-COZ7Xcm0.mjs → login-C4MDP5NM.mjs}

@@ -1,5 +1,5 @@
 import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-DM2J10CB.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CUNkis89.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import { hostname } from "node:os";
 import * as p from "@clack/prompts";

package/dist/{logs-B_YoflCq.mjs → logs-CfDINw7U.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{migrations-Btzr9_q7.mjs → migrations-B9fXxMDj.mjs}

@@ -1,5 +1,5 @@
 import { u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { s as apiDataRequest } from "./ui-CUNkis89.mjs";
+import { s as apiDataRequest } from "./ui-DR-siu2S.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-D2hH933K.mjs → open-rS1ARzOy.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CUNkis89.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-vZ0xH49Y.mjs → package-CBso2611.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.25";
+var version = "0.7.26";
 //#endregion
 export { version as t };

package/dist/{projects-CLs6MEF7.mjs → projects-Dmm_976k.mjs}

@@ -1,5 +1,5 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
+import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{schedule-B8zA8WlG.mjs → schedule-Buu71RWQ.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**

package/dist/secrets-BD3DaTih.mjs

@@ -0,0 +1,121 @@
+import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
+import { a as unwrap, d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-DR-siu2S.mjs";
+import { defineCommand } from "citty";
+import * as p from "@clack/prompts";
+//#region src/secrets.ts
+/**
+* canopy secrets — manage the project's worker secrets from the terminal so a
+* first deploy can be scripted end to end (create → egress → secrets → deploy).
+* Values travel one way: set via stdin or an environment variable (never a
+* flag, so nothing lands in shell history), listed by name only, and never
+* echoed or downloaded — the same rule the dashboard follows. Secrets are
+* shared by the live and staging channels (docs/14 §4.6).
+*/
+/**
+* A piped value usually ends in the newline `echo` or a heredoc appends; a
+* secret never legitimately does. Strip exactly one trailing line break and
+* leave everything else verbatim (leading/inner whitespace may be meaningful).
+*/
+function normalizeSecretValue(raw) {
+	return raw.replace(/\r?\n$/, "");
+}
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+	return Buffer.concat(chunks).toString("utf8");
+}
+/** Resolve the value: --from-env, then piped stdin, then a hidden prompt on a TTY. */
+async function resolveValue(name, fromEnv) {
+	if (fromEnv !== void 0) {
+		const value = process.env[fromEnv];
+		if (value === void 0) throw new Error(`environment variable ${fromEnv} is not set (nothing to store for ${name}).`);
+		return value;
+	}
+	if (!process.stdin.isTTY) return normalizeSecretValue(await readStdin());
+	return unwrap(await p.password({
+		message: `Value for ${name} (input is hidden)`,
+		validate: (v) => v ? void 0 : "A secret value cannot be empty."
+	}));
+}
+const secretsCommand = defineCommand({
+	meta: {
+		name: "secrets",
+		description: "Manage the project's worker secrets (set / list / remove — values never shown)"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List the project's secret names (values are never shown)"
+			},
+			args: { ...projectDirArgs },
+			run: reportErrors("secrets list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { secrets } = await apiRequest("GET", `/projects/${slug}/secrets`);
+				if (secrets.length === 0) {
+					console.log(`No secrets set for ${slug} — add one with \`canopy secrets set NAME\`.`);
+					return;
+				}
+				const width = Math.max(...secrets.map((s) => s.key.length));
+				for (const s of secrets) console.log(`${s.key.padEnd(width)}  updated ${formatDateTime(s.updated_at)}`);
+			})
+		}),
+		set: defineCommand({
+			meta: {
+				name: "set",
+				description: "Set a secret — value from stdin (`printf %s \"$V\" | canopy secrets set NAME`), --from-env, or a hidden prompt"
+			},
+			args: {
+				name: {
+					type: "positional",
+					description: "Secret name (UPPER_SNAKE_CASE, e.g. STRIPE_SECRET)",
+					required: true
+				},
+				"from-env": {
+					type: "string",
+					description: "Read the value from this environment variable instead of stdin"
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("secrets set", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const name = args.name.trim();
+				const value = await resolveValue(name, args["from-env"]);
+				if (value.length === 0) {
+					console.error(`No value provided for ${name} — pipe it on stdin or pass --from-env VAR.`);
+					process.exit(1);
+				}
+				await withContext(apiRequest("PUT", `/projects/${slug}/secrets/${name}`, { value }), {
+					action: `set secret ${name} on ${slug}`,
+					fixes: { not_supported_on_target: "This site has no worker runtime, so secrets have nowhere to go — set them on a site that runs workers (e.g. `--profile main`)." }
+				});
+				console.log(`Set ${name} for ${slug} — running workers pick it up now.`);
+			})
+		}),
+		remove: defineCommand({
+			meta: {
+				name: "remove",
+				description: "Remove a secret"
+			},
+			args: {
+				name: {
+					type: "positional",
+					description: "Secret name (as shown by `list`)",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("secrets remove", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const name = args.name.trim();
+				await withContext(apiRequest("DELETE", `/projects/${slug}/secrets/${name}`), {
+					action: `remove secret ${name} from ${slug}`,
+					fixes: { not_found: `${name} is not set on ${slug} (see \`canopy secrets list\`), or your account can't access the project.` }
+				});
+				console.log(`Removed ${name} from ${slug} — running workers no longer see it.`);
+			})
+		})
+	}
+});
+//#endregion
+export { secretsCommand };

package/dist/{skill-PoaZrCNy.mjs → skill-DmVlZXgv.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-vZ0xH49Y.mjs";
-import { r as reportErrors } from "./ui-CUNkis89.mjs";
+import { t as version } from "./package-CBso2611.mjs";
+import { r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{staging-pZpdZuj_.mjs → staging-CKEoDnac.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/templates/worker/.dev.vars.example

@@ -1,6 +1,6 @@
 # Local worker secrets for `canopy dev` — copy to .dev.vars (gitignored).
 #
-# Dashboard secrets (Settings → Secrets) are never downloaded: the platform
+# Project secrets (`canopy secrets set NAME` or Settings → Secrets) are never downloaded: the platform
 # can't hand a stored value back, and live keys don't belong on a laptop. Set
 # local stand-ins here; the worker reads them as c.env.NAME, exactly as it
 # reads the dashboard's in production. `canopy dev` prints which dashboard

package/dist/templates/worker/AGENTS.md

@@ -56,7 +56,7 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
 - Do not add auth — the platform authenticates every request before it
   reaches this app or the Worker.
 - Do not store secrets in the repo or SPA. Set them in the Canopy dashboard
-  (Settings → Secrets); the Worker reads them as `c.env.SECRET_NAME`
+  (`canopy secrets set NAME`, or Settings → Secrets); the Worker reads them as `c.env.SECRET_NAME`
   (Workers-shaped bindings — not `process.env`). Locally, put stand-in values
   in `.dev.vars` (gitignored, see `.dev.vars.example`) — dashboard values are
   never downloaded, and `canopy dev` prints which names are still missing. Platform access still goes

package/dist/templates/worker/worker/index.ts

@@ -25,7 +25,7 @@ interface Env {
   //   DB   — this project's database: `dialect` plus
   //          `query(text, params) => { rows, rowCount }`
   //   BLOB — this project's files: `get` / `put` / `list` / `delete`
-  // Dashboard secrets (Settings → Secrets) land as Workers-shaped bindings:
+  // Project secrets (`canopy secrets set` / Settings → Secrets) land as Workers-shaped bindings:
   // MY_API_KEY?: string;
 }
 

package/dist/{token-BKwGa10J.mjs → token-Dp2CoIYj.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/{ui-CUNkis89.mjs → ui-DR-siu2S.mjs}

@@ -137,6 +137,26 @@ const ERROR_COPY = {
 	worker_egress_sync_failed: {
 		why: "the list was saved but redeploying the running worker with it failed",
 		fix: "Retry, or redeploy the project (`canopy deploy`) to apply the new allowlist."
+	},
+	invalid_key: {
+		why: "secret names must be UPPER_SNAKE_CASE (a letter, then letters/digits/underscores, at most 64 chars)",
+		fix: "Rename it, e.g. STRIPE_SECRET."
+	},
+	reserved_key: {
+		why: "that name is reserved for the platform runtime",
+		fix: "Pick a name that isn't a Canopy or runtime binding."
+	},
+	value_too_large: {
+		why: "a secret value is limited to 8 KiB",
+		fix: "Store a reference (an id or a shorter key) and fetch the large payload from your worker instead."
+	},
+	too_many_secrets: {
+		why: "the project already holds the maximum number of secrets (64)",
+		fix: "Remove one you no longer need (`canopy secrets remove NAME`) first."
+	},
+	worker_secret_sync_failed: {
+		why: "the secret was saved but redeploying the running worker with it failed",
+		fix: "Retry, or redeploy the project (`canopy deploy`) to apply it."
 	}
 };
 /** Generic explanation for a status code when we have no per-code copy. */
@@ -154,21 +174,40 @@ function statusFix(status) {
 	if (status >= 500) return "This is usually temporary — wait a moment and try again.";
 	return "Re-check the command arguments and try again.";
 }
+/**
+* One trace per CLI invocation (docs/42-observability.md §3.7): every request
+* this process makes carries the same W3C traceparent, so the platform's logs
+* for a `canopy deploy` line up under one id. The api echoes it back as
+* `x-canopy-request-id`, which failures print for the user to quote.
+*/
+const TRACE_ID = randomHex(16);
+function randomHex(bytes) {
+	const buf = new Uint8Array(bytes);
+	crypto.getRandomValues(buf);
+	let out = "";
+	for (const b of buf) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function traceHeaders() {
+	return { traceparent: `00-${TRACE_ID}-${randomHex(8)}-01` };
+}
 var ApiError = class extends Error {
 	status;
 	code;
 	method;
 	path;
 	detail;
+	requestId;
 	/** Command-specific copy, layered on by `withContext` (or `fail` for 401s). */
 	context;
-	constructor(status, code, method, path, detail) {
+	constructor(status, code, method, path, detail, requestId) {
 		super(detail ? `${code}: ${detail}` : code);
 		this.status = status;
 		this.code = code;
 		this.method = method;
 		this.path = path;
 		this.detail = detail;
+		this.requestId = requestId;
 		this.name = "ApiError";
 	}
 	/**
@@ -179,10 +218,12 @@ var ApiError = class extends Error {
 		const copy = ERROR_COPY[this.code];
 		const headline = this.context?.action ? `could not ${this.context.action}` : `${this.method} ${this.path} failed`;
 		const detail = this.detail ? `: ${this.detail}` : "";
+		const why = `${this.status} ${this.code}${detail} — ${copy?.why ?? statusWhy(this.status)}`;
+		const fix = this.context?.fixes?.[this.code] ?? copy?.fix ?? statusFix(this.status);
 		return {
 			headline,
-			why: `${this.status} ${this.code}${detail} — ${copy?.why ?? statusWhy(this.status)}`,
-			fix: this.context?.fixes?.[this.code] ?? copy?.fix ?? statusFix(this.status)
+			why: this.requestId ? `${why} (request id ${this.requestId})` : why,
+			fix
 		};
 	}
 };
@@ -221,7 +262,7 @@ function credentials() {
 async function fail(response, isDeployToken, method, path) {
 	const payload = await response.json().catch(() => ({}));
 	const code = payload.error ?? (response.status === 401 ? "unauthenticated" : `http_${response.status}`);
-	const err = new ApiError(response.status, code, method, path, payload.detail);
+	const err = new ApiError(response.status, code, method, path, payload.detail, response.headers.get("x-canopy-request-id") ?? void 0);
 	if (response.status === 401) err.context = {
 		action: "authenticate with Canopy",
 		fixes: { [code]: isDeployToken ? "The deploy token was rejected — it may have been revoked. Create a new one in the dashboard (Settings → Deploy tokens) or with `canopy token create`." : "Your session has expired — run `canopy login` again." }
@@ -234,6 +275,7 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 	const response = await fetch(`${apiUrl}/control/v1${path}`, {
 		method,
 		headers: {
+			...traceHeaders(),
 			authorization: `Bearer ${token}`,
 			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" },
 			...headers
@@ -253,6 +295,7 @@ async function apiUpload(path, bytes, contentType) {
 	const response = await fetch(`${apiUrl}/control/v1${path}`, {
 		method: "POST",
 		headers: {
+			...traceHeaders(),
 			authorization: `Bearer ${token}`,
 			"content-type": contentType
 		},
@@ -264,7 +307,10 @@ async function apiUpload(path, bytes, contentType) {
 /** Authenticated GET returning raw bytes (e.g. a deploy zip). */
 async function apiDownload(path) {
 	const { apiUrl, token, isDeployToken } = credentials();
-	const response = await fetch(`${apiUrl}/control/v1${path}`, { headers: { authorization: `Bearer ${token}` } });
+	const response = await fetch(`${apiUrl}/control/v1${path}`, { headers: {
+		...traceHeaders(),
+		authorization: `Bearer ${token}`
+	} });
 	if (!response.ok) return fail(response, isDeployToken, "GET", path);
 	return Buffer.from(await response.arrayBuffer());
 }
@@ -278,6 +324,7 @@ async function apiDataRequest(method, path, projectSlug, body, rawContentType, c
 	const response = await fetch(`${apiUrl}/data/v1${path}`, {
 		method,
 		headers: {
+			...traceHeaders(),
 			authorization: `Bearer ${token}`,
 			"x-canopy-project": projectSlug,
 			...channel === "staging" ? { "x-canopy-channel": "staging" } : {},

package/dist/{upgrade-DjrNZ-B4.mjs → upgrade-C7u8pxeV.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui-CUNkis89.mjs";
+import { r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-PoaZrCNy.mjs");
+		const { skillInstalled } = await import("./skill-DmVlZXgv.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/dist/{usage-UmzU6sGp.mjs → usage-81JSiWIx.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-DR-siu2S.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.25",
+  "version": "0.7.26",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-BAcZi226.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-BanjQNiD.mjs";
-export { devCommand };