@mediamonks/canopy-cli 0.7.45 → 0.7.47

package/dist/{login-CREcZfLH.mjs → login-2MW9sGJO.mjs}

@@ -1,6 +1,6 @@
-import { _ as setActiveProfile, b as getBakedProfile, g as readConfigFile, h as listBakedProfiles, m as clearAllProfileTokens, r as siteConfig, v as upsertProfileAuth, x as isProfileId, y as writeConfigFile } from "./site-0i7wAJqg.mjs";
-import { n as agentHeaders } from "./api-Bl6SG8Oq.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CLnICOne.mjs";
+import { C as isProfileId, S as getBakedProfile, _ as listBakedProfiles, b as upsertProfileAuth, g as clearAllProfileTokens, r as siteConfig, v as readConfigFile, x as writeConfigFile, y as setActiveProfile } from "./site-BL5Ik-yj.mjs";
+import { n as agentHeaders } from "./api-DmJrIsE7.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { n as clearRepoTokenCache } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { hostname } from "node:os";

package/dist/{logs-BnrNZvLc.mjs → logs-dZMPTJLu.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { r as reportErrors } from "./ui-CLnICOne.mjs";
+import { d as resolveProject, l as projectFlagArgs } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{mcp-Cy8EwhhD.mjs → mcp-DuCxfb85.mjs}

@@ -1,6 +1,6 @@
-import { t as version } from "./package-Dph4v1Cq.mjs";
-import { c as projectUrl, d as stagingUrl, p as tryResolveProject, r as siteConfig } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, d as noticeRenamesOnly, l as currentSlug, t as ApiError } from "./api-Bl6SG8Oq.mjs";
+import { t as version } from "./package-BksVeJZB.mjs";
+import { h as tryResolveProject, p as stagingUrl, r as siteConfig, u as projectUrl } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, f as noticeRenamesOnly, l as currentSlug, t as ApiError } from "./api-DmJrIsE7.mjs";
 import { t as liveDevServer } from "./dev-server-file-Dk9pk4AR.mjs";
 import { defineCommand } from "citty";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";

package/dist/{migrations-D8NqjC5I.mjs → migrations-BReMlGWP.mjs}

@@ -1,5 +1,5 @@
-import { f as tryReadCanopyJson } from "./site-0i7wAJqg.mjs";
-import { r as apiDataRequest } from "./api-Bl6SG8Oq.mjs";
+import { m as tryReadCanopyJson } from "./site-BL5Ik-yj.mjs";
+import { r as apiDataRequest } from "./api-DmJrIsE7.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-Bpz4C2Sr.mjs → open-DcQSdfx5.mjs}

@@ -1,5 +1,5 @@
-import { c as projectUrl, d as stagingUrl, l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CLnICOne.mjs";
+import { c as projectDirArgs, d as resolveProject, p as stagingUrl, u as projectUrl } from "./site-BL5Ik-yj.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-Dph4v1Cq.mjs → package-BksVeJZB.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.45";
+var version = "0.7.47";
 //#endregion
 export { version as t };

package/dist/{project-template-Cdr1uwwE.mjs → project-template-BPW_Dgxj.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
+import { c as projectDirArgs, d as resolveProject } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 /** Plain words for the API's template errors. */

package/dist/project-template-Dw11151p.mjs

@@ -0,0 +1,2 @@
+import { a as templateCommand } from "./project-template-BPW_Dgxj.mjs";
+export { templateCommand };

package/dist/{projects-BRG2HnBs.mjs → projects-CnU3194_.mjs}

@@ -1,8 +1,8 @@
-import { c as projectUrl, f as tryReadCanopyJson, r as siteConfig } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
-import { i as nextSteps, n as describeCopy, r as fetchTemplate, t as TEMPLATE_FIXES } from "./project-template-Cdr1uwwE.mjs";
-import { i as offerRepoOnCreate, n as cloneProjectRepo } from "./repo-CwT2RDoW.mjs";
+import { m as tryReadCanopyJson, r as siteConfig, u as projectUrl } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-26ETk1n8.mjs";
+import { i as nextSteps, n as describeCopy, r as fetchTemplate, t as TEMPLATE_FIXES } from "./project-template-BPW_Dgxj.mjs";
+import { a as offerRepoOnCreate, i as githubOrigin, n as cloneProjectRepo } from "./repo-6a7gRQaf.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
@@ -84,6 +84,17 @@ function slugify(input) {
 function shouldScaffoldCreate(requested, cwd = process.cwd()) {
 	return requested ?? !existsSync(join(cwd, "canopy.json"));
 }
+/**
+* The "deploy from GitHub" next step (OpenSpec platform-oauth-oidc). Never a
+* link: linking turns CI deploys on, which is the owner's call. With a GitHub
+* `origin` the exact command; without one the shape of it. A folder that
+* pushes to a Canopy repository needs no link, so no step.
+*/
+async function ciLinkStep(dir, canopyRemote) {
+	if (canopyRemote) return [];
+	const origin = await githubOrigin(dir);
+	return origin ? [`canopy repo link ${origin.host}/${origin.repository}   (deploy on every push to main)`] : ["canopy repo link <owner/name>   (once it's on GitHub: deploy on every push to main)"];
+}
 const createCommand = defineCommand({
 	meta: {
 		name: "create",
@@ -186,13 +197,15 @@ const createCommand = defineCommand({
 				`cd ${slug}`,
 				...template.needsInstall ? ["npm install"] : [],
 				...remote ? [`git add -A && git commit -m "Initial commit" && git push -u ${remote} main`] : [],
-				"canopy dev   (or deploy right away: canopy deploy)"
+				"canopy dev   (or deploy right away: canopy deploy)",
+				...await ciLinkStep(targetDir, remote)
 			];
 			p.note(steps.join("\n"), `Scaffolded ./${slug}/ (${template.id}) — next`);
 			p.outro(`Live URL (after first deploy): ${projectUrl(project.slug)}`);
 		} else {
 			const remote = await offerRepoOnCreate(slug, process.cwd(), args.repo);
 			if (remote) p.log.info(`This folder pushes to the project's git repository as "${remote}".`);
+			for (const step of await ciLinkStep(process.cwd(), remote)) p.log.info(`Next: ${step}`);
 			p.outro(existsSync(join(process.cwd(), "canopy.json")) ? "Registered without scaffolding — the existing canopy.json was left unchanged." : "Registered without scaffolding — add a canopy.json to deploy an existing app.");
 		}
 	})
@@ -319,7 +332,8 @@ const initCommand = defineCommand({
 			const steps = [
 				...rel === "." ? [] : [`cd ${rel}`],
 				...template.needsInstall ? ["npm install"] : [],
-				"canopy dev   (or deploy right away: canopy deploy)"
+				"canopy dev   (or deploy right away: canopy deploy)",
+				...await ciLinkStep(targetDir, null)
 			];
 			p.note(steps.join("\n"), `Scaffolded ${rel}/ (${template.id}) for ${slug} — next`);
 			p.outro(`Live URL (after first deploy): ${projectUrl(slug)}`);
@@ -333,7 +347,11 @@ const initCommand = defineCommand({
 			return;
 		}
 		writeCanopyJson(targetDir, { slug });
-		p.note("Add \"dist\"/\"build\" to canopy.json if this app has a build step, then:\ncanopy deploy", `Linked ${rel} to ${slug}`);
+		p.note([
+			"Add \"dist\"/\"build\" to canopy.json if this app has a build step, then:",
+			"canopy deploy",
+			...await ciLinkStep(targetDir, null)
+		].join("\n"), `Linked ${rel} to ${slug}`);
 		p.outro(`Live URL (after first deploy): ${projectUrl(slug)}`);
 	})
 });

package/dist/{rename-BGKa25Rq.mjs → rename-BWvERJgA.mjs}

@@ -1,6 +1,6 @@
-import { c as projectUrl, l as resolveProject, o as projectDirArgs, u as rewriteCanopyJsonSlug } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
+import { c as projectDirArgs, d as resolveProject, f as rewriteCanopyJsonSlug, u as projectUrl } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/rename.ts

package/dist/{repo-CwT2RDoW.mjs → repo-6a7gRQaf.mjs}

@@ -1,6 +1,6 @@
-import { f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, r as siteConfig } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, d as noticeRenamesOnly, f as withContext, n as agentHeaders, u as followRename } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { a as parseGithubRemote, c as projectDirArgs, d as resolveProject, l as projectFlagArgs, m as tryReadCanopyJson, o as parseRepositoryArg, r as siteConfig } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, f as noticeRenamesOnly, m as withContext, n as agentHeaders, u as followRename } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-26ETk1n8.mjs";
 import { a as parseCredentialInput, i as helperCommand, o as runCredentialHelper, r as fileTokenCache, t as RepoCredentialError } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { existsSync, realpathSync } from "node:fs";
@@ -104,6 +104,13 @@ async function setLocalConfig(dir, key, values) {
 *  - `show`    says which repository the project has (`--json` for agents);
 *  - `delete`  removes it and its history (owner only).
 *
+* CI deploys from GitHub Actions (OpenSpec platform-oauth-oidc), owner only:
+*
+*  - `link`     links a GitHub repository outside Canopy (a Canopy repository needs none);
+*  - `unlink`   removes that link;
+*  - `branches` sets the live and staging branches CI deploys from;
+*  - `deploys`  turns CI deploys on or off without unlinking.
+*
 * Setting up a folder points a remote at the repository and registers
 * `canopy repo credential` as git's credential helper for that one
 * repository. No token is ever written
@@ -208,16 +215,26 @@ const showCommand = defineCommand({
 			return;
 		}
 		if (repo.kind === "none") console.log(`${slug} has no git repository. Create one with \`canopy repo create\`.`);
-		else if (repo.kind === "linked") console.log(`${slug} is linked to ${repo.linked_repository}.`);
-		else {
+		else if (repo.kind === "linked") {
+			console.log(`${slug} is linked to ${repo.host ? `${repo.host}/` : ""}${repo.linked_repository}.`);
+			printCiDeploys(repo);
+		} else {
 			console.log(`${slug} has a Canopy git repository.`);
 			console.log(`  remote     ${repo.remote}`);
 			console.log(`  created    ${repo.created_at ? formatDateTime(repo.created_at) : "—"}`);
 			console.log(`  last push  ${repo.last_push_at ? formatDateTime(repo.last_push_at) : "never"}`);
+			printCiDeploys(repo);
 			console.log(`\nClone it with \`canopy repo clone ${slug}\`.`);
 		}
 	})
 });
+/** The CI lines of `repo show`: both branches and whether CI deploys are on. */
+function printCiDeploys(repo) {
+	if (repo.deploys_enabled === void 0 || repo.deploys_enabled === null) return;
+	console.log(`  live       ${repo.ref ?? "refs/heads/main"}`);
+	console.log(`  staging    ${repo.staging_ref ?? "—"}`);
+	console.log(`  CI deploys ${repo.deploys_enabled ? "on" : "off"}`);
+}
 const createCommand = defineCommand({
 	meta: {
 		name: "create",
@@ -380,13 +397,159 @@ async function readStdin() {
 	for await (const chunk of process.stdin) chunks.push(chunk);
 	return Buffer.concat(chunks).toString("utf8");
 }
+/** Plain words for the link routes' errors; `invalid_host` here is a GitHub host. */
+const LINK_FIXES = {
+	owner_only: "Only the project owner (or a platform admin) can change where CI deploys come from.",
+	repo_exists: "This project has a Canopy repository, and CI deploys from it without a link. Set its branches with `canopy repo branches`.",
+	invalid_host: "Link a repository on github.com or this site's GitHub Enterprise host (e.g. monks.ghe.com/monks/my-tool).",
+	repository_not_linked: "Link a repository first with `canopy repo link <owner/name>`.",
+	not_linked: "This project has no linked GitHub repository — `canopy repo show` says what it has."
+};
+/** `main` → `refs/heads/main`; a full ref passes through. */
+function toRef(value) {
+	const trimmed = value.trim();
+	return trimmed.startsWith("refs/") ? trimmed : `refs/heads/${trimmed}`;
+}
+/** `refs/heads/develop` → `develop`, for the workflow's `on.push.branches`. */
+const branchName = (ref) => ref.replace(/^refs\/heads\//, "");
+/** The GitHub repository the folder's `origin` remote points at, if any. */
+async function githubOrigin(dir) {
+	if (!await isWorkingCopy(dir).catch(() => false)) return null;
+	const origin = (await remotes(dir).catch(() => /* @__PURE__ */ new Map())).get("origin");
+	return origin ? parseGithubRemote(origin) : null;
+}
+function printLink(slug, link) {
+	console.log(`  repository ${link.host}/${link.repository}`);
+	console.log(`  live       ${link.ref}`);
+	console.log(`  staging    ${link.staging_ref ?? "—"}`);
+	console.log(`  CI deploys ${link.deploys_enabled ? "on" : "off"}`);
+	if (link.staging_ref) p.log.info(`Pushes to ${branchName(link.staging_ref)} deploy ${slug}'s staging channel once the workflow runs on them: add "${branchName(link.staging_ref)}" to on.push.branches in .github/workflows/canopy-deploy.yml.`);
+}
 const repoCommand = defineCommand({
 	meta: {
 		name: "repo",
-		description: "The project's git repository (clone, connect, create)"
+		description: "The project's git repository (clone, connect, create, link CI deploys)"
 	},
 	subCommands: {
 		show: showCommand,
+		link: defineCommand({
+			meta: {
+				name: "link",
+				description: "Link a GitHub repository so its pushes deploy the project (owner only)"
+			},
+			args: {
+				repository: {
+					type: "positional",
+					description: "[<host>/]<owner/name> — defaults to this folder's origin remote",
+					required: false
+				},
+				...projectFlagArgs,
+				ref: {
+					type: "string",
+					description: "Live branch (default main)"
+				},
+				"staging-ref": {
+					type: "string",
+					description: "Staging branch: its pushes deploy to the staging channel only"
+				}
+			},
+			run: reportErrors("repo link", async ({ args }) => {
+				const { dir, slug } = resolveProject({ project: args.project });
+				let target;
+				if (args.repository) {
+					target = parseRepositoryArg(args.repository);
+					if (!target) throw new Error(`"${args.repository}" is not a repository — pass <owner/name> or <host>/<owner/name>, e.g. monks/my-tool.`);
+				} else {
+					target = await githubOrigin(dir);
+					if (!target) throw new Error("This folder has no GitHub origin remote to link — pass the repository: `canopy repo link <owner/name>`.");
+				}
+				const link = await withContext(apiRequest("PUT", `/projects/${slug}/github`, {
+					repository: target.repository,
+					...target.host && { host: target.host },
+					...args.ref && { ref: toRef(args.ref) },
+					...args["staging-ref"] && { staging_ref: toRef(args["staging-ref"]) }
+				}), {
+					action: `link ${slug} to ${target.repository}`,
+					fixes: LINK_FIXES
+				});
+				p.log.success(`Linked ${slug} to ${link.host}/${link.repository} @ ${link.ref}. A push there now deploys ${slug}.`);
+				printLink(slug, link);
+			})
+		}),
+		unlink: defineCommand({
+			meta: {
+				name: "unlink",
+				description: "Remove the project's GitHub repository link (owner only)"
+			},
+			args: { ...projectDirArgs },
+			run: reportErrors("repo unlink", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("DELETE", `/projects/${slug}/github`), {
+					action: `unlink ${slug}'s repository`,
+					fixes: LINK_FIXES
+				});
+				p.log.success(`Unlinked ${slug}. GitHub Actions runs now skip the deploy.`);
+			})
+		}),
+		branches: defineCommand({
+			meta: {
+				name: "branches",
+				description: "Set the live and staging branches CI deploys from (owner only)"
+			},
+			args: {
+				...projectDirArgs,
+				ref: {
+					type: "string",
+					description: "Live branch, e.g. main"
+				},
+				"staging-ref": {
+					type: "string",
+					description: "Staging branch, e.g. develop (`none` removes it)"
+				}
+			},
+			run: reportErrors("repo branches", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const stagingArg = args["staging-ref"];
+				if (!args.ref && stagingArg === void 0) throw new Error("Pass --ref and/or --staging-ref (see `canopy repo show` for the current ones).");
+				const link = await withContext(apiRequest("PATCH", `/projects/${slug}/github`, {
+					...args.ref && { ref: toRef(args.ref) },
+					...stagingArg !== void 0 && { staging_ref: stagingArg === "none" || stagingArg === "" ? null : toRef(stagingArg) }
+				}), {
+					action: `set ${slug}'s CI branches`,
+					fixes: LINK_FIXES
+				});
+				p.log.success(`CI deploys for ${slug} come from:`);
+				printLink(slug, link);
+			})
+		}),
+		deploys: defineCommand({
+			meta: {
+				name: "deploys",
+				description: "Turn CI deploys from GitHub Actions on or off (owner only)"
+			},
+			args: {
+				state: {
+					type: "positional",
+					description: "on | off",
+					required: true
+				},
+				...projectFlagArgs
+			},
+			run: reportErrors("repo deploys", async ({ args }) => {
+				if (args.state !== "on" && args.state !== "off") throw new Error(`Pass on or off (got "${args.state}").`);
+				const { slug } = resolveProject({ project: args.project });
+				const enabled = args.state === "on";
+				await withContext(apiRequest("PATCH", `/projects/${slug}/github`, { deploys_enabled: enabled }), {
+					action: `turn CI deploys ${args.state} for ${slug}`,
+					fixes: LINK_FIXES
+				});
+				if (enabled) p.log.success(`CI deploys are on for ${slug}: pushes to its branches deploy again.`);
+				else {
+					p.log.success(`CI deploys are off for ${slug}: GitHub Actions runs skip the deploy with a warning. The repository link stays.`);
+					p.log.info("Deploy tokens are not affected — a workflow with CANOPY_DEPLOY_TOKEN still deploys. Revoke them with `canopy token revoke` to stop those too.");
+				}
+			})
+		}),
 		clone: cloneCommand,
 		connect: connectCommand,
 		create: createCommand,
@@ -411,7 +574,7 @@ async function offerRepoOnCreate(slug, dir, flag) {
 	if (flag === void 0) {
 		if (!process.stdin.isTTY || !await reposAvailable()) return null;
 		const origin = await isWorkingCopy(dir).catch(() => false) ? (await remotes(dir)).get("origin") : void 0;
-		if (origin && /github\.com[:/]/.test(origin)) return null;
+		if (origin && parseGithubRemote(origin)) return null;
 		if (!unwrap(await p.confirm({
 			message: "Create a git repository for this project on Canopy?",
 			initialValue: false
@@ -428,4 +591,4 @@ async function offerRepoOnCreate(slug, dir, flag) {
 	}
 }
 //#endregion
-export { repoCommand as a, offerRepoOnCreate as i, cloneProjectRepo as n, connectFolder as r, cliInvocation as t };
+export { offerRepoOnCreate as a, githubOrigin as i, cloneProjectRepo as n, repoCommand as o, connectFolder as r, toRef as s, cliInvocation as t };

package/dist/repo-C7AXDtFZ.mjs

@@ -0,0 +1,2 @@
+import { o as repoCommand } from "./repo-6a7gRQaf.mjs";
+export { repoCommand };

package/dist/{roles-C7pq9bIx.mjs → roles-CrYf_8wk.mjs}

@@ -1,2 +1,2 @@
-import { i as membersCommand, o as rolesCommand } from "./roles-DAPPXf4U.mjs";
+import { i as membersCommand, o as rolesCommand } from "./roles-S2D9Id0W.mjs";
 export { membersCommand, rolesCommand };

package/dist/{roles-DAPPXf4U.mjs → roles-S2D9Id0W.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
+import { c as projectDirArgs, d as resolveProject } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/roles.ts

package/dist/{schedule-BcqBspn3.mjs → schedule-DvHSSzfR.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { d as resolveProject, l as projectFlagArgs } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**

package/dist/{secrets-BjbIi7Gp.mjs → secrets-BIn2RPoe.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { c as projectDirArgs, d as resolveProject } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/secrets.ts

package/dist/{site-0i7wAJqg.mjs → site-BL5Ik-yj.mjs}

@@ -259,6 +259,55 @@ function tryResolveProject(args) {
 		slug: args.project ?? tryReadCanopyJson(dir)?.slug
 	};
 }
+const GITHUB_HOST = /^(?:github\.com|[a-z0-9][a-z0-9-]*\.ghe\.com)$/;
+/**
+* The GitHub repository a git remote URL points at, or null when it is not on
+* github.com or a `*.ghe.com` host (OpenSpec platform-oauth-oidc). Whether the
+* host is one this site trusts is the API's call, not ours.
+*
+*   git@monks.ghe.com:monks/my-tool.git
+*   ssh://git@github.com/monks/my-tool.git
+*   https://github.com/monks/my-tool(.git)
+*/
+function parseGithubRemote(url) {
+	const trimmed = url.trim();
+	const scp = /^[\w.-]+@([^:/]+):([^/]+)\/([^/]+?)(?:\.git)?\/?$/.exec(trimmed);
+	let host;
+	let parts;
+	if (scp) {
+		host = scp[1];
+		parts = [scp[2], scp[3]];
+	} else try {
+		const parsed = new URL(trimmed);
+		if (![
+			"https:",
+			"http:",
+			"ssh:",
+			"git:"
+		].includes(parsed.protocol)) return null;
+		host = parsed.hostname;
+		parts = parsed.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "").split("/");
+	} catch {
+		return null;
+	}
+	host = host?.toLowerCase();
+	if (!host || !GITHUB_HOST.test(host) || parts?.length !== 2 || !parts[0] || !parts[1]) return null;
+	return {
+		host,
+		repository: `${parts[0]}/${parts[1]}`
+	};
+}
+/** `[<host>/]owner/name` as typed on the command line; null when it is neither. */
+function parseRepositoryArg(value) {
+	const parts = value.trim().replace(/\.git$/, "").split("/");
+	if (parts.some((part) => part === "")) return null;
+	if (parts.length === 2) return { repository: `${parts[0]}/${parts[1]}` };
+	if (parts.length === 3 && parts[0].includes(".")) return {
+		host: parts[0].toLowerCase(),
+		repository: `${parts[1]}/${parts[2]}`
+	};
+	return null;
+}
 //#endregion
 //#region src/site.ts
 /**
@@ -300,4 +349,4 @@ function siteHeaderLine(cliVersion) {
 	return `canopy ${cliVersion} · ${c.envOverride || !c.profileId ? c.apiUrl : `${c.profileId} (${c.projectDomain ?? new URL(c.apiUrl).hostname})`}`;
 }
 //#endregion
-export { setActiveProfile as _, projectDialect as a, getBakedProfile as b, projectUrl as c, stagingUrl as d, tryReadCanopyJson as f, readConfigFile as g, listBakedProfiles as h, siteHeaderLine as i, resolveProject as l, clearAllProfileTokens as m, setInvocationProfile as n, projectDirArgs as o, tryResolveProject as p, siteConfig as r, projectFlagArgs as s, projectDir as t, rewriteCanopyJsonSlug as u, upsertProfileAuth as v, isProfileId as x, writeConfigFile as y };
+export { isProfileId as C, getBakedProfile as S, listBakedProfiles as _, parseGithubRemote as a, upsertProfileAuth as b, projectDirArgs as c, resolveProject as d, rewriteCanopyJsonSlug as f, clearAllProfileTokens as g, tryResolveProject as h, siteHeaderLine as i, projectFlagArgs as l, tryReadCanopyJson as m, setInvocationProfile as n, parseRepositoryArg as o, stagingUrl as p, siteConfig as r, projectDialect as s, projectDir as t, projectUrl as u, readConfigFile as v, writeConfigFile as x, setActiveProfile as y };

package/dist/{skill-Zj19RNo2.mjs → skill-Bz39NhTN.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-Dph4v1Cq.mjs";
-import { r as reportErrors } from "./ui-CLnICOne.mjs";
+import { t as version } from "./package-BksVeJZB.mjs";
+import { r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{staging-_2Js0Fkc.mjs → staging-Dn8kH9cK.mjs}

@@ -1,6 +1,6 @@
-import { c as projectUrl, d as stagingUrl, l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { d as resolveProject, l as projectFlagArgs, p as stagingUrl, u as projectUrl } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/templates/spa/.github/workflows/canopy-deploy.yml

@@ -1,34 +1,40 @@
 # Deploy to Canopy on every push to main. GitHub's runners are the build
 # farm — the platform owns no build infrastructure.
 #
-# Needs a CANOPY_DEPLOY_TOKEN repo secret: create a deploy token in the
-# dashboard (project → Settings → Deploy tokens) or with `canopy token
-# create`, then add it via `gh secret set CANOPY_DEPLOY_TOKEN` or the repo's
-# Settings → Secrets. Until the secret is set, this workflow skips itself
-# instead of failing the build.
+# No secret needed: the run proves which repository and branch it comes from
+# with GitHub's own identity token (the id-token permission below), and
+# Canopy deploys it once the project owner has linked this repository:
+#
+#   canopy repo link            (in this folder: links the origin remote)
+#
+# Until then, every run skips the deploy with a warning instead of failing.
+# The owner can pause CI deploys without editing this file:
+#
+#   canopy repo deploys off     (and `on` to resume)
+#
+# A staging branch (`canopy repo branches --staging-ref develop`) deploys to
+# the project's staging channel only. Add it to `branches` below, e.g.
+# [main, develop], so pushes to it run this workflow.
 name: Deploy to Canopy
 
 on:
   push:
     branches: [main]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    env:
-      CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
           node-version: 24
       - name: Install dependencies
-        if: env.CANOPY_DEPLOY_TOKEN != ''
         run: |
           if [ -f package-lock.json ]; then npm ci; else npm install; fi
       - name: Deploy
-        if: env.CANOPY_DEPLOY_TOKEN != ''
         run: npm exec --yes @mediamonks/canopy-cli deploy
-      - name: Skipped (no deploy token)
-        if: env.CANOPY_DEPLOY_TOKEN == ''
-        run: echo "CANOPY_DEPLOY_TOKEN secret not set — skipping deploy."

package/dist/templates/spa/README.md

@@ -11,4 +11,4 @@ A [Canopy](https://dashboard.thanarie.dev) project — Vite + React. Live
 - `AGENTS.md` — project guardrails and skill setup for coding agents
 
 Push-to-main deploys are prepared in `.github/workflows/canopy-deploy.yml`
-(needs a `CANOPY_DEPLOY_TOKEN` repo secret — see the workflow file).
+(no secret: link the repository once with `canopy repo link` — see the workflow file).

package/dist/templates/worker/.github/workflows/canopy-deploy.yml

@@ -1,34 +1,40 @@
 # Deploy to Canopy on every push to main. GitHub's runners are the build
 # farm — the platform owns no build infrastructure.
 #
-# Needs a CANOPY_DEPLOY_TOKEN repo secret: create a deploy token in the
-# dashboard (project → Settings → Deploy tokens) or with `canopy token
-# create`, then add it via `gh secret set CANOPY_DEPLOY_TOKEN` or the repo's
-# Settings → Secrets. Until the secret is set, this workflow skips itself
-# instead of failing the build.
+# No secret needed: the run proves which repository and branch it comes from
+# with GitHub's own identity token (the id-token permission below), and
+# Canopy deploys it once the project owner has linked this repository:
+#
+#   canopy repo link            (in this folder: links the origin remote)
+#
+# Until then, every run skips the deploy with a warning instead of failing.
+# The owner can pause CI deploys without editing this file:
+#
+#   canopy repo deploys off     (and `on` to resume)
+#
+# A staging branch (`canopy repo branches --staging-ref develop`) deploys to
+# the project's staging channel only. Add it to `branches` below, e.g.
+# [main, develop], so pushes to it run this workflow.
 name: Deploy to Canopy
 
 on:
   push:
     branches: [main]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    env:
-      CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
           node-version: 24
       - name: Install dependencies
-        if: env.CANOPY_DEPLOY_TOKEN != ''
         run: |
           if [ -f package-lock.json ]; then npm ci; else npm install; fi
       - name: Deploy
-        if: env.CANOPY_DEPLOY_TOKEN != ''
         run: npm exec --yes @mediamonks/canopy-cli deploy
-      - name: Skipped (no deploy token)
-        if: env.CANOPY_DEPLOY_TOKEN == ''
-        run: echo "CANOPY_DEPLOY_TOKEN secret not set — skipping deploy."

package/dist/templates/worker/README.md

@@ -14,4 +14,4 @@ https://{{slug}}.thanarie.dev after the first `canopy deploy`.
 - `AGENTS.md` — project guardrails and skill setup for coding agents
 
 Push-to-main deploys are prepared in `.github/workflows/canopy-deploy.yml`
-(needs a `CANOPY_DEPLOY_TOKEN` repo secret — see the workflow file).
+(no secret: link the repository once with `canopy repo link` — see the workflow file).