@mediamonks/canopy-cli 0.7.31 → 0.7.33

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-CiKTWo0_.mjs";
+import { t as version } from "./package-CQIPmdcO.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -62,36 +62,37 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-B-m-i8uu.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-B-m-i8uu.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-B-m-i8uu.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-CN2YhCZn.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-CN2YhCZn.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-CN2YhCZn.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-CN2YhCZn.mjs").then((m) => m.deleteCommand),
+		login: () => import("./login-D0J5s_Ex.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-D0J5s_Ex.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-D0J5s_Ex.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-DQAhCZm8.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-DQAhCZm8.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-DQAhCZm8.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-DQAhCZm8.mjs").then((m) => m.deleteCommand),
 		dev: () => import("./dev-MoHHjQh1.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-B-znPE-v.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-B-znPE-v.mjs").then((m) => m.promoteCommand),
+		deploy: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.promoteCommand),
 		staging: () => import("./staging-BZVty57b.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-B-znPE-v.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-B-znPE-v.mjs").then((m) => m.downloadCommand),
+		rollback: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.downloadCommand),
 		token: () => import("./token-HHlUR0CF.mjs").then((m) => m.tokenCommand),
 		egress: () => import("./egress-If_Gsx_M.mjs").then((m) => m.egressCommand),
 		secrets: () => import("./secrets-BSEjZnxg.mjs").then((m) => m.secretsCommand),
 		schedule: () => import("./schedule-C5lMf3ny.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-Cd7Rvg9a.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-5oPSxAz0.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-BB6O6085.mjs").then((m) => m.dbCommand),
 		usage: () => import("./usage-CUYrWxv0.mjs").then((m) => m.usageCommand),
 		ai: () => import("./ai-DHLnyqfq.mjs").then((m) => m.aiCommand),
 		open: () => import("./open-DcaQKi1v.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-YD4z70gq.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-BWmXiJAz.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-Cexs9KYX.mjs").then((m) => m.upgradeCommand),
+		docs: () => import("./docs-BP5jmD10.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-Dg7dQF0k.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-huJDjhrV.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-DQQOawOG.mjs").then((m) => m.logsCommand),
-		mcp: () => import("./mcp-GKwctfHN.mjs").then((m) => m.mcpCommand)
+		mcp: () => import("./mcp-DXfTYVN_.mjs").then((m) => m.mcpCommand),
+		repo: () => import("./repo-1RQ1vBMv.mjs").then((m) => m.repoCommand)
 	}
 });
-const quiet = process.argv[2] === "mcp" && process.argv[3] === "serve";
+const quiet = process.argv[2] === "mcp" && process.argv[3] === "serve" || process.argv[2] === "repo" && process.argv[3] === "credential";
 if (process.argv[2] !== "upgrade" && !quiet) notifyOfUpdate(version);
 if (!quiet && process.argv[2] && process.argv[2] !== "--help" && process.argv[2] !== "-h") console.error(siteHeaderLine(version));
 await runMain(main);

package/dist/{login-B-m-i8uu.mjs → login-D0J5s_Ex.mjs}

@@ -1,5 +1,6 @@
 import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-DM2J10CB.mjs";
 import { n as openBrowser, r as reportErrors } from "./ui-C_jSc1Kz.mjs";
+import { n as clearRepoTokenCache } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { hostname } from "node:os";
 import * as p from "@clack/prompts";
@@ -98,8 +99,9 @@ const logoutCommand = defineCommand({
 			if (!result.ok) failed.push(`${id} (${result.error})`);
 		}
 		clearAllProfileTokens();
+		clearRepoTokenCache();
 		if (args.local) {
-			console.log("Logged out locally — tokens removed from ~/.canopy/config.json but still valid on the platform until they expire. Revoke them from the dashboard's Account page.");
+			console.log("Logged out locally — tokens removed from ~/.canopy but still valid on the platform until they expire (git repository tokens within the hour). Revoke them from the dashboard's Account page.");
 			return;
 		}
 		if (failed.length === 0) {

package/dist/{mcp-GKwctfHN.mjs → mcp-DXfTYVN_.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CiKTWo0_.mjs";
+import { t as version } from "./package-CQIPmdcO.mjs";
 import { d as tryResolveProject, l as stagingUrl, n as siteConfig, s as projectUrl } from "./site-DM2J10CB.mjs";
 import { i as apiRequest, t as ApiError } from "./api-C4rMhE7i.mjs";
 import { t as liveDevServer } from "./dev-server-file-Dk9pk4AR.mjs";

package/dist/{package-CiKTWo0_.mjs → package-CQIPmdcO.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.31";
+var version = "0.7.33";
 //#endregion
 export { version as t };

package/dist/{projects-CN2YhCZn.mjs → projects-DQAhCZm8.mjs}

@@ -1,6 +1,7 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
 import { i as apiRequest } from "./api-C4rMhE7i.mjs";
 import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-C_jSc1Kz.mjs";
+import { r as offerRepoOnCreate } from "./repo-Bb9ntNa4.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
@@ -105,6 +106,11 @@ const createCommand = defineCommand({
 			type: "boolean",
 			description: "Scaffold ./<slug>/ from the starter template",
 			negativeDescription: "Only register — no files written"
+		},
+		repo: {
+			type: "boolean",
+			description: "Also create a git repository for the project on Canopy",
+			negativeDescription: "Don't create a git repository (no question asked)"
 		}
 	},
 	run: reportErrors("create", async ({ args }) => {
@@ -166,14 +172,20 @@ const createCommand = defineCommand({
 				...tryReadCanopyJson(targetDir),
 				slug
 			});
+			const remote = await offerRepoOnCreate(slug, targetDir, args.repo);
 			const steps = [
 				`cd ${slug}`,
 				...template.needsInstall ? ["npm install"] : [],
+				...remote ? [`git add -A && git commit -m "Initial commit" && git push -u ${remote} main`] : [],
 				"canopy dev   (or deploy right away: canopy deploy)"
 			];
 			p.note(steps.join("\n"), `Scaffolded ./${slug}/ (${template.id}) — next`);
 			p.outro(`Live URL (after first deploy): ${projectUrl(project.slug)}`);
-		} else p.outro(existsSync(join(process.cwd(), "canopy.json")) ? "Registered without scaffolding — the existing canopy.json was left unchanged." : "Registered without scaffolding — add a canopy.json to deploy an existing app.");
+		} else {
+			const remote = await offerRepoOnCreate(slug, process.cwd(), args.repo);
+			if (remote) p.log.info(`This folder pushes to the project's git repository as "${remote}".`);
+			p.outro(existsSync(join(process.cwd(), "canopy.json")) ? "Registered without scaffolding — the existing canopy.json was left unchanged." : "Registered without scaffolding — add a canopy.json to deploy an existing app.");
+		}
 	})
 });
 /** Empty enough to scaffold into: missing, or holding only dotfiles (.git, .agents…). */

package/dist/repo-1RQ1vBMv.mjs

@@ -0,0 +1,2 @@
+import { i as repoCommand } from "./repo-Bb9ntNa4.mjs";
+export { repoCommand };

package/dist/repo-Bb9ntNa4.mjs

@@ -0,0 +1,423 @@
+import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { i as apiRequest, o as withContext } from "./api-C4rMhE7i.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
+import { a as parseCredentialInput, i as helperCommand, o as runCredentialHelper, r as fileTokenCache, t as RepoCredentialError } from "./repo-credential-CNDRM-tG.mjs";
+import { defineCommand } from "citty";
+import { existsSync, realpathSync } from "node:fs";
+import { delimiter, join, resolve } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import * as p from "@clack/prompts";
+//#region src/git.ts
+/**
+* The little git the CLI needs for Canopy git repositories (OpenSpec change
+* project-git-repos): find git, run it, and read or write a working copy's
+* local configuration. Only `canopy repo` (and `canopy create --repo`) use
+* it; nothing else in the CLI requires git to be installed.
+*/
+/** Run git and capture its output. Never throws on a non-zero exit. */
+function git(args, opts = {}) {
+	return new Promise((resolve, reject) => {
+		execFile("git", args, {
+			cwd: opts.cwd,
+			maxBuffer: 16 * 1024 * 1024
+		}, (err, stdout, stderr) => {
+			if (err && err.code === "ENOENT") {
+				reject(new GitNotFound());
+				return;
+			}
+			resolve({
+				code: err ? Number(err.code ?? 1) || 1 : 0,
+				stdout: String(stdout),
+				stderr: String(stderr)
+			});
+		});
+	});
+}
+/** Run git with its output on the user's terminal (clone progress and the like). */
+function gitInteractive(args, opts = {}) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("git", args, {
+			cwd: opts.cwd,
+			stdio: "inherit"
+		});
+		child.on("error", (err) => reject(err.code === "ENOENT" ? new GitNotFound() : err));
+		child.on("close", (code) => resolve(code ?? 1));
+	});
+}
+var GitNotFound = class extends Error {
+	constructor() {
+		super("git is not installed (or not on your PATH). Install it from https://git-scm.com/downloads — on a Mac, `xcode-select --install` — and try again.");
+	}
+};
+/** Throws GitNotFound when git is missing; returns the version string otherwise. */
+async function requireGit() {
+	const { stdout } = await git(["--version"]);
+	return stdout.trim();
+}
+/** True when `dir` is inside a git working copy. */
+async function isWorkingCopy(dir) {
+	const { code, stdout } = await git(["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+	return code === 0 && stdout.trim() === "true";
+}
+/** The working copy's remotes, name → fetch URL. */
+async function remotes(dir) {
+	const { stdout } = await git(["remote", "-v"], { cwd: dir });
+	const out = /* @__PURE__ */ new Map();
+	for (const line of stdout.split("\n")) {
+		const match = /^(\S+)\s+(\S+)\s+\(fetch\)$/.exec(line.trim());
+		if (match) out.set(match[1], match[2]);
+	}
+	return out;
+}
+/** Replace every value of a key in the local configuration with `values`, in order. */
+async function setLocalConfig(dir, key, values) {
+	const unset = await git([
+		"config",
+		"--local",
+		"--unset-all",
+		key
+	], { cwd: dir });
+	if (unset.code !== 0 && unset.code !== 5) throw new Error(`git config --unset-all ${key} failed: ${unset.stderr.trim()}`);
+	for (const value of values) {
+		const add = await git([
+			"config",
+			"--local",
+			"--add",
+			key,
+			value
+		], { cwd: dir });
+		if (add.code !== 0) throw new Error(`git config --add ${key} failed: ${add.stderr.trim()}`);
+	}
+}
+//#endregion
+//#region src/repo.ts
+/**
+* canopy repo — the project's git repository (OpenSpec change
+* project-git-repos).
+*
+* A project has at most one repository: a Canopy repository, which Canopy
+* keeps for it, or one it links. For a Canopy repository:
+*
+*  - `create`  makes it, then sets up the current folder when it is the project;
+*  - `clone`   clones it into a new folder;
+*  - `connect` sets up an existing folder;
+*  - `show`    says which repository the project has (`--json` for agents);
+*  - `delete`  removes it and its history (owner only).
+*
+* Setting up a folder points a remote at the repository and registers
+* `canopy repo credential` as git's credential helper for that one
+* repository. No token is ever written
+* into the folder or its git configuration; git asks the helper on each fetch
+* and push, and it hands over a short-lived token for the CLI sign-in.
+*/
+/** Plain words for the API's repository errors. */
+const REPO_FIXES = {
+	repos_not_configured: "Git repositories are not available on this site yet. Use your own GitHub repository instead.",
+	repo_exists: "This project already has a repository — `canopy repo show` says which.",
+	repo_already_linked: "This project is linked to its own GitHub repository; a project has one repository.",
+	repo_name_taken: "A leftover repository with this name exists on the git host. Ask a platform admin to remove it, then try again.",
+	owner_only: "Only the project owner can delete its repository.",
+	no_repo: "This project has no Canopy repository — create one with `canopy repo create`."
+};
+const fetchRepo = (slug) => withContext(apiRequest("GET", `/projects/${slug}/repo`), {
+	action: `read ${slug}'s repository`,
+	fixes: REPO_FIXES
+});
+/**
+* How git should start this CLI for the credential helper: the `canopy` (or
+* `canopy-dev`) on PATH when it is this very install, so upgrades keep
+* working; otherwise this node binary and script, by absolute path.
+*/
+function cliInvocation() {
+	const script = realpathSync(process.argv[1]);
+	for (const dir of (process.env["PATH"] ?? "").split(delimiter)) for (const name of ["canopy", "canopy-dev"]) {
+		const candidate = join(dir, name);
+		try {
+			if (existsSync(candidate) && realpathSync(candidate) === script) return [candidate];
+		} catch {}
+	}
+	return [process.execPath, script];
+}
+/** The git config lines that route this repository's credentials to the helper. */
+function credentialConfig(gitUrl, profile, slug) {
+	const section = `credential.${gitUrl}`;
+	return [[`${section}.helper`, ["", helperCommand(cliInvocation(), profile, slug, gitUrl)]], [`${section}.useHttpPath`, ["true"]]];
+}
+function currentProfile() {
+	const profile = siteConfig().profileId;
+	if (!profile) throw new Error("Git repositories need a named site — pass --profile main, staging or gcp-pilot.");
+	return profile;
+}
+function requireCanopyRepo(slug, repo) {
+	if (repo.kind === "canopy") return repo;
+	if (repo.kind === "linked") throw new Error(`${slug} is linked to ${repo.linked_repository}; use that repository with your own git credentials.`);
+	throw new Error(`${slug} has no repository yet — create one with \`canopy repo create\`.`);
+}
+/**
+* Set up `dir` as a working copy of the project's Canopy repository: a git
+* repository if it isn't one, the remote (`origin`, or `canopy` when origin
+* points elsewhere) and the credential helper. Returns the remote's name.
+*/
+async function connectFolder(dir, slug, repo) {
+	await requireGit();
+	if (!await isWorkingCopy(dir)) {
+		const init = await git([
+			"init",
+			"-q",
+			"-b",
+			"main"
+		], { cwd: dir });
+		if (init.code !== 0) throw new Error(`git init failed: ${init.stderr.trim()}`);
+	}
+	const existing = await remotes(dir);
+	let name = "origin";
+	const already = [...existing].find(([, url]) => url === repo.remote);
+	if (already) name = already[0];
+	else {
+		if (existing.has("origin")) name = "canopy";
+		if (existing.has(name)) throw new Error(`This folder already has a remote named "${name}" pointing elsewhere (${existing.get(name)}). Remove or rename it, then run \`canopy repo connect\` again.`);
+		const add = await git([
+			"remote",
+			"add",
+			name,
+			repo.remote
+		], { cwd: dir });
+		if (add.code !== 0) throw new Error(`git remote add failed: ${add.stderr.trim()}`);
+	}
+	for (const [key, values] of credentialConfig(repo.remote, currentProfile(), slug)) await setLocalConfig(dir, key, values);
+	return name;
+}
+const showCommand = defineCommand({
+	meta: {
+		name: "show",
+		description: "Show the project's git repository"
+	},
+	args: {
+		...projectDirArgs,
+		json: {
+			type: "boolean",
+			default: false,
+			description: "Print JSON (for scripts and agents)"
+		}
+	},
+	run: reportErrors("repo show", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const repo = await fetchRepo(slug);
+		if (args.json) {
+			console.log(JSON.stringify(repo, null, 2));
+			return;
+		}
+		if (repo.kind === "none") console.log(`${slug} has no git repository. Create one with \`canopy repo create\`.`);
+		else if (repo.kind === "linked") console.log(`${slug} is linked to ${repo.linked_repository}.`);
+		else {
+			console.log(`${slug} has a Canopy git repository.`);
+			console.log(`  remote     ${repo.remote}`);
+			console.log(`  created    ${repo.created_at ? formatDateTime(repo.created_at) : "—"}`);
+			console.log(`  last push  ${repo.last_push_at ? formatDateTime(repo.last_push_at) : "never"}`);
+			console.log(`\nClone it with \`canopy repo clone ${slug}\`.`);
+		}
+	})
+});
+const createCommand = defineCommand({
+	meta: {
+		name: "create",
+		description: "Create a Canopy git repository for the project"
+	},
+	args: { ...projectDirArgs },
+	run: reportErrors("repo create", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const repo = await withContext(apiRequest("POST", `/projects/${slug}/repo`), {
+			action: `create a git repository for ${slug}`,
+			fixes: REPO_FIXES
+		});
+		p.log.success(`Created a git repository for ${slug}.`);
+		if (tryReadCanopyJson(dir)?.slug === slug) {
+			const remote = await connectFolder(dir, slug, repo);
+			p.log.info(`This folder pushes to it as "${remote}". Commit and push as usual:`);
+			console.log(`  git add -A && git commit -m "Initial commit" && git push -u ${remote} main`);
+		} else p.log.info(`Clone it with \`canopy repo clone ${slug}\`.`);
+	})
+});
+const connectCommand = defineCommand({
+	meta: {
+		name: "connect",
+		description: "Set up a folder to push to the project's Canopy git repository"
+	},
+	args: { ...projectDirArgs },
+	run: reportErrors("repo connect", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const remote = await connectFolder(dir, slug, requireCanopyRepo(slug, await fetchRepo(slug)));
+		p.log.success(`This folder now pushes to ${slug}'s repository as "${remote}".`);
+	})
+});
+const cloneCommand = defineCommand({
+	meta: {
+		name: "clone",
+		description: "Clone a project's Canopy git repository"
+	},
+	args: {
+		slug: {
+			type: "positional",
+			description: "Project slug",
+			required: true
+		},
+		target: {
+			type: "positional",
+			description: "Folder to clone into (defaults to the slug)",
+			required: false
+		}
+	},
+	run: reportErrors("repo clone", async ({ args }) => {
+		const slug = args.slug;
+		const repo = requireCanopyRepo(slug, await fetchRepo(slug));
+		await requireGit();
+		const target = resolve(args.target ?? slug);
+		const code = await gitInteractive([
+			"clone",
+			...credentialConfig(repo.remote, currentProfile(), slug).flatMap(([key, values]) => values.flatMap((value) => ["-c", `${key}=${value}`])),
+			repo.remote,
+			target
+		]);
+		if (code !== 0) throw new Error(`git clone failed (exit ${code}).`);
+		p.log.success(`Cloned ${slug} into ${target}.`);
+	})
+});
+const deleteCommand = defineCommand({
+	meta: {
+		name: "delete",
+		description: "Delete the project's Canopy git repository and its history"
+	},
+	args: {
+		...projectDirArgs,
+		yes: {
+			type: "boolean",
+			default: false,
+			description: "Skip the type-the-slug confirmation"
+		}
+	},
+	run: reportErrors("repo delete", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		if (!args.yes) {
+			requireTty("pass --yes to delete without confirmation.");
+			if (unwrap(await p.text({ message: `Delete ${slug}'s git repository and all its history? Type the slug to confirm.` })).trim() !== slug) {
+				p.cancel("Aborted.");
+				return;
+			}
+		}
+		await withContext(apiRequest("DELETE", `/projects/${slug}/repo`), {
+			action: `delete ${slug}'s git repository`,
+			fixes: REPO_FIXES
+		});
+		p.log.success(`Deleted ${slug}'s git repository.`);
+	})
+});
+/** Exchange this site's CLI sign-in for a repository token (never a deploy token). */
+async function mintRepoToken(profile, slug) {
+	const config = siteConfig();
+	const login = `run \`canopy login --profile ${profile}\``;
+	if (!config.token) throw new RepoCredentialError(`not signed in to ${profile} — ${login}.`);
+	const path = `/projects/${encodeURIComponent(slug)}/repo/token`;
+	const res = await fetch(`${config.apiUrl}/control/v1${path}`, {
+		method: "POST",
+		headers: { authorization: `Bearer ${config.token}` }
+	}).catch(() => null);
+	if (!res) throw new RepoCredentialError(`could not reach Canopy (${config.apiUrl}).`);
+	if (res.status === 201) return await res.json();
+	const body = await res.json().catch(() => ({}));
+	if (res.status === 401) throw new RepoCredentialError(`your ${profile} sign-in has expired — ${login}.`);
+	if (res.status === 404) throw new RepoCredentialError(`you don't have access to ${slug}'s repository (or it no longer exists).`);
+	throw new RepoCredentialError(body.detail ?? body.error ?? `Canopy answered HTTP ${res.status}.`);
+}
+const credentialCommand = defineCommand({
+	meta: {
+		name: "credential",
+		description: "git credential helper (set up by clone/connect)",
+		hidden: true
+	},
+	args: {
+		action: {
+			type: "positional",
+			description: "get | store | erase",
+			required: true
+		},
+		project: {
+			type: "string",
+			description: "Project slug",
+			required: true
+		},
+		url: {
+			type: "string",
+			description: "Repository URL git talks to",
+			required: true
+		}
+	},
+	run: async ({ args }) => {
+		const profile = siteConfig().profileId;
+		const input = parseCredentialInput(await readStdin());
+		const out = profile ? await runCredentialHelper(args.action, input, {
+			cacheKey: `${profile}/${args.project}`,
+			repoUrl: args.url,
+			cache: fileTokenCache(),
+			mint: () => mintRepoToken(profile, args.project)
+		}) : {
+			stdout: "quit=1\n",
+			stderr: "canopy: this repository's site is unknown — run `canopy repo connect` again.\n"
+		};
+		process.stderr.write(out.stderr);
+		process.stdout.write(out.stdout);
+	}
+});
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
+}
+const repoCommand = defineCommand({
+	meta: {
+		name: "repo",
+		description: "The project's git repository (clone, connect, create)"
+	},
+	subCommands: {
+		show: showCommand,
+		clone: cloneCommand,
+		connect: connectCommand,
+		create: createCommand,
+		delete: deleteCommand,
+		credential: credentialCommand
+	}
+});
+/** Whether this site offers Canopy git repositories (the `repos` capability). */
+async function reposAvailable() {
+	const platform = await apiRequest("GET", "/platform").catch(() => null);
+	return Boolean(platform?.capabilities?.repos);
+}
+/**
+* The repository step of `canopy create` (design D-H). `--repo` creates one,
+* `--no-repo` doesn't; otherwise an interactive run is asked (default no) when
+* the site offers repositories and the folder doesn't already push to GitHub.
+* A repository that can't be created never fails the project creation.
+* Returns the remote name when the folder was set up.
+*/
+async function offerRepoOnCreate(slug, dir, flag) {
+	if (flag === false) return null;
+	if (flag === void 0) {
+		if (!process.stdin.isTTY || !await reposAvailable()) return null;
+		const origin = await isWorkingCopy(dir).catch(() => false) ? (await remotes(dir)).get("origin") : void 0;
+		if (origin && /github\.com[:/]/.test(origin)) return null;
+		if (!unwrap(await p.confirm({
+			message: "Create a git repository for this project on Canopy?",
+			initialValue: false
+		}))) return null;
+	}
+	try {
+		return await connectFolder(dir, slug, await withContext(apiRequest("POST", `/projects/${slug}/repo`), {
+			action: `create a git repository for ${slug}`,
+			fixes: REPO_FIXES
+		}));
+	} catch (err) {
+		p.log.warn(`The project was created, but its git repository wasn't: ${err instanceof Error ? err.message : String(err)}\nTry again later with \`canopy repo create\`.`);
+		return null;
+	}
+}
+//#endregion
+export { repoCommand as i, connectFolder as n, offerRepoOnCreate as r, cliInvocation as t };

package/dist/repo-credential-CNDRM-tG.mjs

@@ -0,0 +1,118 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/** Why no token could be had — shown to the user, then git is told to quit. */
+var RepoCredentialError = class extends Error {};
+const REPO_TOKEN_CACHE_PATH = join(homedir(), ".canopy", "repo-tokens.json");
+/** The on-disk cache: one JSON object, owner-only. */
+function fileTokenCache(path = REPO_TOKEN_CACHE_PATH) {
+	const read = () => {
+		try {
+			return JSON.parse(readFileSync(path, "utf8"));
+		} catch {
+			return {};
+		}
+	};
+	const write = (all) => {
+		mkdirSync(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(path, `${JSON.stringify(all, null, 2)}\n`, { mode: 384 });
+		chmodSync(path, 384);
+	};
+	return {
+		get: (key) => read()[key],
+		set: (key, value) => write({
+			...read(),
+			[key]: value
+		}),
+		delete: (key) => {
+			const all = read();
+			if (!(key in all)) return;
+			delete all[key];
+			write(all);
+		}
+	};
+}
+/** `canopy logout` forgets every cached repository token. */
+function clearRepoTokenCache(path = REPO_TOKEN_CACHE_PATH) {
+	rmSync(path, { force: true });
+}
+/** git's credential protocol: `key=value` lines, terminated by a blank line or EOF. */
+function parseCredentialInput(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		if (line === "") break;
+		const eq = line.indexOf("=");
+		if (eq > 0) out.set(line.slice(0, eq), line.slice(eq + 1));
+	}
+	return out;
+}
+const normalize = (url) => url.replace(/\/+$/, "").replace(/\.git$/, "");
+/** Whether git is asking about exactly the repository this helper was registered for. */
+function requestMatches(input, repoUrl) {
+	const protocol = input.get("protocol");
+	const host = input.get("host");
+	const path = input.get("path");
+	if (protocol !== "https" || !host || !path) return false;
+	return normalize(`${protocol}://${host}/${path}`) === normalize(repoUrl);
+}
+/** Answer one git credential request. */
+async function runCredentialHelper(action, input, opts) {
+	const now = opts.now ?? Date.now;
+	if (!requestMatches(input, opts.repoUrl)) return {
+		stdout: "",
+		stderr: ""
+	};
+	if (action === "erase") {
+		opts.cache.delete(opts.cacheKey);
+		return {
+			stdout: "",
+			stderr: ""
+		};
+	}
+	if (action !== "get") return {
+		stdout: "",
+		stderr: ""
+	};
+	let token = opts.cache.get(opts.cacheKey);
+	if (!token || Date.parse(token.expires_at) - now() <= 3e5) {
+		try {
+			token = await opts.mint();
+		} catch (err) {
+			opts.cache.delete(opts.cacheKey);
+			return {
+				stdout: "quit=1\n",
+				stderr: `canopy: ${err instanceof RepoCredentialError ? err.message : String(err)}\n`
+			};
+		}
+		opts.cache.set(opts.cacheKey, token);
+	}
+	const expiry = Math.floor(Date.parse(token.expires_at) / 1e3);
+	return {
+		stdout: `username=x-access-token\npassword=${token.token}\npassword_expiry_utc=${expiry}\n`,
+		stderr: ""
+	};
+}
+/**
+* The shell command git runs for the helper, as written into
+* `credential.<url>.helper`. Absolute paths, so GUI git clients without the
+* user's PATH still find it.
+*/
+function helperCommand(cli, profile, slug, repoUrl) {
+	const quote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+	return `!${[
+		...cli.map(quote),
+		"repo",
+		"credential",
+		"--profile",
+		quote(profile),
+		"--project",
+		quote(slug),
+		"--url",
+		quote(repoUrl)
+	].join(" ")}`;
+}
+//#endregion
+export { parseCredentialInput as a, helperCommand as i, clearRepoTokenCache as n, runCredentialHelper as o, fileTokenCache as r, RepoCredentialError as t };