@mediamonks/canopy-cli 0.7.6 → 0.7.8

package/dist/{db-D3RKaLVU.mjs → db-8Etjmzxh.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { i as unwrap, l as withContext, n as reportErrors, o as apiDataRequest, r as requireTty } from "./ui-CpdtK7mt.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-DpWHuqkQ.mjs";
+import { i as unwrap, n as reportErrors, o as apiDataRequest, r as requireTty, u as withContext } from "./ui-2mrJcjYC.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-C-5x6SYf.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-ClioT9ZC.mjs → deploy-y75cgauK.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, l as withContext, n as reportErrors, o as apiDataRequest, s as apiDownload } from "./ui-CpdtK7mt.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-DpWHuqkQ.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, o as apiDataRequest, s as apiDownload, u as withContext } from "./ui-2mrJcjYC.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-C-5x6SYf.mjs";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";

package/dist/dev-CQq2uzSz.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-CxfnHPI4.mjs";
+export { devCommand };

package/dist/{dev-BbAVZcAR.mjs → dev-CxfnHPI4.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { a as ApiError, c as apiRequest, l as withContext, n as reportErrors } from "./ui-CpdtK7mt.mjs";
-import { r as readMigrationFiles } from "./migrations-DpWHuqkQ.mjs";
+import { a as ApiError, c as apiRequest, n as reportErrors, u as withContext } from "./ui-2mrJcjYC.mjs";
+import { r as readMigrationFiles } from "./migrations-C-5x6SYf.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { join } from "node:path";
@@ -112,7 +112,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-BHxSZwUT.mjs");
+		const { fetchProjectDump } = await import("./local-D-HcDDzL.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -127,7 +127,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-BHxSZwUT.mjs");
+	const { createSandbox } = await import("./local-D-HcDDzL.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/docs/cli-feedback.md

@@ -0,0 +1,59 @@
+---
+title: canopy feedback
+description: Read and triage a project's feedback inbox, or file a bug/feedback report — against a project or against Canopy itself.
+---
+
+`canopy feedback` is the CLI side of [Feedback & bug reports](https://docs.canopy.website/platform/feedback):
+agents (and humans) pull reports, append findings, move statuses, and file new
+ones.
+
+## Usage
+
+```bash
+canopy feedback list --status accepted
+canopy feedback show <id>
+canopy feedback comment <id> "root cause: the upload grant expires too early"
+canopy feedback status <id> resolved --comment "fixed in v42"
+canopy feedback mine
+canopy feedback report "canopy deploy exits 1 after upload" --command "canopy deploy"
+canopy feedback report "the header overlaps the logo" --attach ./shot.png
+canopy feedback attach <id> ./after-fix.png --comment "fixed — see the shot"
+```
+
+## Subcommands
+
+Inbox commands (`list`, `show`, `comment`, `status`) resolve the project the
+usual way — `canopy.json` in the target directory, or `--project <slug>` — and
+require project membership. `list` and `show` take `--json` for
+machine-readable output.
+
+- `list [--status <s>] [--kind <k>]` — the project's inbox. Statuses:
+  `new`, `accepted`, `in_progress`, `resolved`, `declined`; kinds: `bug`,
+  `feedback`, `docs`.
+- `show <id> [--download <dir>]` — full detail: body, captured context (page
+  URL, deploy version, console errors — or CLI context), the screenshots on
+  the report, and the comment trail. `--download` saves the screenshots into
+  a directory so you can actually look at them.
+- `comment <id> <text>` — append a comment (findings, questions, updates).
+- `attach <id> <file> [--attach <more>] [--caption <text>] [--comment <text>]` —
+  add screenshots to an existing report. With `--comment`, the comment is
+  posted first and the screenshots hang off that trail entry — how you show
+  "here's what it looks like after the fix".
+- `status <id> <new-status> [--comment <note>]` — move the ticket; the
+  transition is recorded on the trail.
+- `mine [--project <slug>] [--json]` — your own reports across all projects,
+  with current statuses.
+- `report <text> [--kind bug|feedback] [--project <slug>] [--command <cmd>] [--error <output>] [--attach <file>] [--caption <text>]` —
+  file a new report. **Without `--project` it goes to the platform inbox**
+  (Canopy itself) — the right target when a `canopy` command misbehaves. The
+  CLI attaches its version, the active site, your platform, and the project
+  you were working in.
+
+## For agents
+
+The intended loop: a human marks items `accepted` on the dashboard; the agent
+runs `list --status accepted`, reproduces using the context in `show`
+(including the deploy version that served the page), comments findings, and
+resolves — or declines with a comment saying why. When a `canopy` command
+itself fails: rule out user error, check `canopy feedback mine` for a
+duplicate, then `report` with the exact command and error output.

package/dist/docs/index.json

@@ -129,6 +129,11 @@
           "title": "Members & access",
           "summary": "Everything on Canopy sits behind Monks sign-in. Collaborators manage a project; other Monks can view the live app — unless you tighten it."
         },
+        {
+          "slug": "platform-feedback",
+          "title": "Feedback & bug reports",
+          "summary": "A built-in feedback widget on every project, a ticket-lite inbox behind it, and a CLI that lets agents work the backlog."
+        },
         {
           "slug": "platform-client-access",
           "title": "Client access",
@@ -241,6 +246,11 @@
           "title": "canopy usage",
           "summary": "Show a project's AI spend, storage footprint, and deploy count from the terminal."
         },
+        {
+          "slug": "cli-feedback",
+          "title": "canopy feedback",
+          "summary": "Read and triage a project's feedback inbox, or file a bug/feedback report — against a project or against Canopy itself."
+        },
         {
           "slug": "cli-open",
           "title": "canopy open",

package/dist/docs/platform-feedback.md

@@ -0,0 +1,101 @@
+---
+title: Feedback & bug reports
+description: A built-in feedback widget on every project, a ticket-lite inbox behind it, and a CLI that lets agents work the backlog.
+---
+
+Every Canopy project gets an in-app feedback channel without writing a line of
+code: signed-in Monks see a small floating button on the live app, pick **Bug**
+or **Feedback**, type what happened, and send. The report lands in the
+project's **Feedback tab** on the dashboard, with everything an investigator
+needs captured automatically — page URL, the deploy version that served it,
+viewport, and recent console errors.
+
+It is deliberately **not** a ticketing product: an item has a status, an
+append-only comment trail, and nothing else. No assignees, priorities, or
+boards.
+
+## The widget
+
+- Appears only for **signed-in Monks**. Client-password visitors never see it —
+  the platform doesn't even send them the script.
+- On by default for every project. Turn it off per project in
+  **Settings → Feedback widget**; the change applies on the next page load.
+- Submissions are always identified (your company sign-in), so there's no
+  anonymous spam and no reporter field to fill in.
+- The widget also shows your own previous reports for that project with their
+  current status.
+- A page can reshape the chooser with meta tags — this docs site does exactly
+  that: `<meta name="canopy-feedback-kinds" content="docs,feedback">` swaps
+  "Bug" for "Docs issue", and `canopy-feedback-prompt` replaces the textarea
+  placeholder. Kinds are limited to `bug`, `feedback`, `docs`.
+
+## Screenshots
+
+A screenshot is often the whole report, so you can attach up to six to any
+report:
+
+- **In the widget:** click **Attach screenshot**, or paste one straight from
+  the clipboard into the message box, or drop an image on the panel. Thumbnails
+  show what will be sent, and each one can be removed before you hit Send.
+- **On the dashboard:** the same three ways, from the report itself — so you can
+  add a picture to a report after filing it, or to a comment as you write it
+  ("here's what it looks like after the fix"). Click any thumbnail for the full
+  image, then use the arrow keys to page through the rest.
+- **From the CLI:** `canopy feedback report "…" --attach ./shot.png`, or
+  `canopy feedback attach <id> ./after-fix.png` for a report that already
+  exists. `canopy feedback show <id> --download <dir>` saves a report's
+  screenshots so an agent can look at them.
+
+PNG, JPEG, WebP and GIF, up to 5 MB each. Large screenshots are scaled down in
+your browser before they're sent, so a full-screen retina capture goes up small
+without you doing anything. Screenshots are visible to the same people as the
+report itself, and are deleted with it.
+
+## The inbox
+
+Project members triage reports on the **Feedback tab**:
+
+- Statuses: `new → accepted → in_progress → resolved`, plus `declined`.
+  **`accepted` means "this is valid — an agent may pick it up."**
+- Every status change and comment is recorded on the item's trail.
+- Reporters follow their submissions on the **Reports page** (dashboard
+  header) and can comment on or withdraw their own items; only project
+  members change statuses.
+
+## Working the backlog with an agent
+
+Because the CLI exposes the inbox, "work through the accepted feedback" is a
+prompt, not a process:
+
+```bash
+canopy feedback list --status accepted        # what a human marked valid
+canopy feedback show <id>                     # body + captured context + trail
+canopy feedback comment <id> "root cause: …"  # append findings
+canopy feedback status <id> resolved --comment "fixed in v42"
+```
+
+`show` includes the deploy version that served the page when the bug was
+reported — reproduce against that, not whatever is live now. An agent that
+investigates but can't fix should `comment` its findings and leave the status
+for a human; one that pushes back should `status <id> declined` with a comment
+saying why.
+
+## Reporting problems with Canopy itself
+
+When a `canopy` command fails while you (or your agent) are building a
+project, file it against the **platform inbox** — not your own project:
+
+```bash
+canopy feedback report "deploy failed after upload" \
+  --command "canopy deploy --staging" --error "upload_grant_expired …"
+```
+
+With no `--project`, the report goes to the platform team automatically, with
+your CLI version, site, and the project you were working on attached. Before
+filing: rule out user error first (`canopy docs troubleshooting`,
+`vp env doctor` for toolchain issues), and skim `canopy feedback mine` to
+avoid filing the same issue twice.
+
+## CLI reference
+
+See [canopy feedback](https://docs.canopy.website/cli/feedback) for every subcommand and flag.

package/dist/docs/platform-project-data.md

@@ -8,17 +8,27 @@ created automatically the moment the project exists. There are no connection
 strings to configure and no servers to run — your app reads and writes through
 the Canopy SDK, and no other project can ever see your data.
 
-## The Data tab
+## The Data tab and the data explorer
 
 Open a project in the dashboard and the **Data** tab shows what your app has
-stored:
-
-- **Collections** — the document-style data your app writes with
-  `canopy.db.collection(...)`. Pick a collection and page through its rows.
-- **Tables** — a browser for the underlying database tables, for when your
-  app uses raw SQL or you want to see exactly what's on disk.
-- **SQL console** — run a query directly against the project's database from
-  the browser. Useful for quick checks and one-off fixes.
+stored — every collection and table at a glance — plus the door into the
+**data explorer**, a full-page workspace for actually digging in:
+
+- **Schema sidebar** — collections and tables, each expandable to its
+  columns (types, primary keys) and indexes.
+- **Browse** — click any table or collection to page through it with real
+  totals, sort by any column, and stack filters (equals, contains,
+  comparisons, null checks) without writing SQL. Click a row for the full
+  record, JSON pretty-printed. Export the current page as CSV or JSON.
+- **SQL console** — a real editor with syntax highlighting and autocomplete
+  fed by your schema. Run with <kbd>⌘⏎</kbd>, see row counts and timing,
+  recall earlier queries from history, and hit **Explain** to see the query
+  plan.
+
+The console is **read-only by default** — the platform rejects anything but
+reads until you flip the writes toggle, so exploring production data is safe
+by design. The explorer is fixed to the channel (live or staging) you opened
+it from; to look at the other one, go back to the Data tab and switch there.
 
 The **Files** tab next to it lists the project's blob storage — the uploads
 and files your app has saved.

package/dist/{docs-DhAz6QWS.mjs → docs-59NjixYd.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-CPXtNnfc.mjs";
+import { t as version } from "./package-27IYBxoU.mjs";
 import { n as siteConfig } from "./site-BUlQR117.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { n as reportErrors } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{egress-BkkG9Jzs.mjs → egress-CN_axsAN.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { c as apiRequest, n as reportErrors } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 //#region src/egress.ts
 /**

package/dist/feedback-B7QOyMau.mjs

@@ -0,0 +1,387 @@
+import { t as version } from "./package-27IYBxoU.mjs";
+import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
+import { c as apiRequest, l as apiUpload, n as reportErrors, s as apiDownload } from "./ui-2mrJcjYC.mjs";
+import { defineCommand } from "citty";
+import { basename, extname, join } from "node:path";
+import { readFile, writeFile } from "node:fs/promises";
+//#region src/feedback.ts
+/**
+* canopy feedback — the ticket-lite feedback system (docs/19, docs topic
+* `platform-feedback`). Two jobs:
+*
+*  - Work a project's inbox: `list`, `show`, `comment`, `status` — the loop an
+*    agent runs over items a human marked `accepted`.
+*  - File reports: `report` sends a bug/feedback item. With no `--project` it
+*    lands on the **platform inbox** (canopy itself) — the right target when a
+*    canopy command misbehaves while you're building something else.
+*/
+const STATUSES = [
+	"new",
+	"accepted",
+	"in_progress",
+	"resolved",
+	"declined"
+];
+const KINDS = [
+	"bug",
+	"feedback",
+	"docs"
+];
+/** Content-type hint from the extension; the server types the bytes itself. */
+const IMAGE_TYPES = {
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".webp": "image/webp",
+	".gif": "image/gif"
+};
+/**
+* Every `--attach` on the command line. citty 0.2.2 has no array arg type and
+* keeps only the last occurrence, so repeats are read straight from argv;
+* `--attach a.png,b.png` works as well, since agents write it both ways.
+*/
+function attachedPaths(value) {
+	const flag = "--attach";
+	const repeated = process.argv.flatMap((arg, index) => {
+		if (arg === flag) {
+			const next = process.argv[index + 1];
+			return next && !next.startsWith("-") ? [next] : [];
+		}
+		return arg.startsWith(`${flag}=`) ? [arg.slice(9)] : [];
+	});
+	return (repeated.length > 0 ? repeated : value === void 0 ? [] : [String(value)]).flatMap((entry) => entry.split(",")).map((path) => path.trim()).filter((path) => path !== "");
+}
+/** Upload each file to a report that already exists (docs/21 create-then-attach). */
+async function attachFiles(slug, itemId, paths, caption, commentId) {
+	for (const [index, path] of paths.entries()) {
+		const bytes = await readFile(path);
+		const params = new URLSearchParams({ filename: basename(path) });
+		if (caption) params.set("caption", paths.length > 1 ? `${caption} (${index + 1})` : caption);
+		if (commentId) params.set("comment_id", commentId);
+		await apiUpload(`/projects/${slug}/feedback/${encodeURIComponent(itemId)}/attachments?${params}`, bytes, IMAGE_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream");
+		console.log(`Attached ${basename(path)}.`);
+	}
+}
+function sizeLabel(bytes) {
+	return bytes >= 1024 * 1024 ? `${(bytes / (1024 * 1024)).toFixed(1)} MB` : `${Math.max(1, Math.round(bytes / 1024))} KB`;
+}
+const jsonArg = { json: {
+	type: "boolean",
+	description: "Machine-readable JSON output"
+} };
+function firstLine(body) {
+	const line = body.split("\n")[0] ?? "";
+	return line.length > 72 ? `${line.slice(0, 71)}…` : line;
+}
+function printItems(items) {
+	if (items.length === 0) {
+		console.log("No matching feedback items.");
+		return;
+	}
+	for (const item of items) {
+		const comments = item.comment_count ? `  💬${item.comment_count}` : "";
+		const shots = item.attachment_count ? `  📎${item.attachment_count}` : "";
+		console.log(`${item.id}  ${item.status}  ${item.kind}  ${firstLine(item.body)}${comments}${shots}`);
+	}
+}
+const listCommand = defineCommand({
+	meta: {
+		name: "list",
+		description: "List the project's feedback inbox (members only)"
+	},
+	args: {
+		...projectDirArgs,
+		...jsonArg,
+		status: {
+			type: "string",
+			description: `Filter: ${STATUSES.join(" | ")}`
+		},
+		kind: {
+			type: "string",
+			description: `Filter: ${KINDS.join(" | ")}`
+		}
+	},
+	run: reportErrors("feedback list", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const params = new URLSearchParams();
+		if (args.status) params.set("status", args.status);
+		if (args.kind) params.set("kind", args.kind);
+		const { items } = await apiRequest("GET", `/projects/${slug}/feedback${params.size > 0 ? `?${params}` : ""}`);
+		if (args.json) console.log(JSON.stringify(items, null, 2));
+		else printItems(items);
+	})
+});
+const showCommand = defineCommand({
+	meta: {
+		name: "show",
+		description: "Full detail of one item: body, context, comment trail"
+	},
+	args: {
+		id: {
+			type: "positional",
+			description: "Item id (from `canopy feedback list`)",
+			required: true
+		},
+		...projectDirArgs,
+		...jsonArg,
+		download: {
+			type: "string",
+			description: "Save the report's screenshots into this directory"
+		}
+	},
+	run: reportErrors("feedback show", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const detail = await apiRequest("GET", `/projects/${slug}/feedback/${encodeURIComponent(args.id)}`);
+		if (args.json) {
+			console.log(JSON.stringify(detail, null, 2));
+			return;
+		}
+		const { item, comments } = detail;
+		console.log(`${item.kind} · ${item.status} · via ${item.source} · ${item.created_at}`);
+		console.log(`reported by ${item.reporter_name || item.reporter_email || "unknown"}` + (item.deployment_id ? ` on ${item.deployment_id}` : "") + (item.channel === "staging" ? " (staging)" : ""));
+		console.log(`\n${item.body}\n`);
+		if (item.context) {
+			console.log("context:");
+			try {
+				console.log(JSON.stringify(JSON.parse(item.context), null, 2));
+			} catch {
+				console.log(item.context);
+			}
+			console.log("");
+		}
+		const shots = detail.attachments;
+		if (shots.length > 0) {
+			console.log("screenshots:");
+			for (const shot of shots) {
+				const label = shot.caption ? ` — ${shot.caption}` : "";
+				console.log(`  ${shot.id}  ${shot.filename ?? "screenshot"}  ${sizeLabel(shot.size_bytes)}${label}`);
+			}
+			if (!args.download) console.log("  (save them with --download <dir> to look at them)");
+			console.log("");
+		}
+		for (const entry of comments) {
+			const author = entry.author_name || entry.author_email || "unknown";
+			const move = entry.status_to ? `  [${entry.status_from} → ${entry.status_to}]` : "";
+			console.log(`--- ${author} · ${entry.created_at}${move}`);
+			if (entry.body) console.log(entry.body);
+		}
+		if (args.download && shots.length > 0) {
+			console.log("");
+			for (const shot of shots) {
+				const bytes = await apiDownload(`/projects/${slug}/feedback/${encodeURIComponent(item.id)}/attachments/${shot.id}`);
+				const name = shot.filename ? `${shot.id}-${basename(shot.filename)}` : `${shot.id}.png`;
+				const target = join(args.download, name);
+				await writeFile(target, bytes);
+				console.log(`Saved ${target}`);
+			}
+		}
+	})
+});
+const commentCommand = defineCommand({
+	meta: {
+		name: "comment",
+		description: "Append a comment to an item (e.g. debug findings)"
+	},
+	args: {
+		id: {
+			type: "positional",
+			description: "Item id",
+			required: true
+		},
+		text: {
+			type: "positional",
+			description: "Comment text",
+			required: true
+		},
+		...projectDirArgs
+	},
+	run: reportErrors("feedback comment", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		await apiRequest("POST", `/projects/${slug}/feedback/${encodeURIComponent(args.id)}/comments`, { body: args.text });
+		console.log("Comment added.");
+	})
+});
+const statusCommand = defineCommand({
+	meta: {
+		name: "status",
+		description: "Move an item to a new status (members only)"
+	},
+	args: {
+		id: {
+			type: "positional",
+			description: "Item id",
+			required: true
+		},
+		to: {
+			type: "positional",
+			description: STATUSES.join(" | "),
+			required: true
+		},
+		comment: {
+			type: "string",
+			description: "Optional note recorded with the change"
+		},
+		...projectDirArgs
+	},
+	run: reportErrors("feedback status", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		await apiRequest("POST", `/projects/${slug}/feedback/${encodeURIComponent(args.id)}/status`, {
+			status: args.to,
+			...args.comment ? { comment: args.comment } : {}
+		});
+		console.log(`Marked ${args.id} as ${args.to}.`);
+	})
+});
+const mineCommand = defineCommand({
+	meta: {
+		name: "mine",
+		description: "Your own reports across all projects"
+	},
+	args: {
+		...jsonArg,
+		project: {
+			type: "string",
+			description: "Only reports on this project slug"
+		}
+	},
+	run: reportErrors("feedback mine", async ({ args }) => {
+		const { items } = await apiRequest("GET", `/feedback/mine${args.project ? `?project=${encodeURIComponent(args.project)}` : ""}`);
+		if (args.json) {
+			console.log(JSON.stringify(items, null, 2));
+			return;
+		}
+		if (items.length === 0) {
+			console.log("You haven't filed any reports.");
+			return;
+		}
+		for (const item of items) console.log(`${item.id}  ${item.status}  ${item.kind}  [${item.project_slug}]  ${firstLine(item.body)}`);
+	})
+});
+const reportCommand = defineCommand({
+	meta: {
+		name: "report",
+		description: "File a report. Default target is the platform inbox (canopy itself); use --project for a specific project"
+	},
+	args: {
+		text: {
+			type: "positional",
+			description: "What happened / what you suggest",
+			required: true
+		},
+		kind: {
+			type: "string",
+			description: "bug | feedback (default: bug)"
+		},
+		project: {
+			type: "string",
+			description: "Project slug to file against (default: the platform inbox)"
+		},
+		command: {
+			type: "string",
+			description: "The canopy command that failed (goes in context)"
+		},
+		error: {
+			type: "string",
+			description: "The error output you saw (goes in context)"
+		},
+		attach: {
+			type: "string",
+			description: "Screenshot to attach (PNG/JPEG/WebP/GIF); repeat for several"
+		},
+		caption: {
+			type: "string",
+			description: "One line describing the screenshot(s)"
+		},
+		status: {
+			type: "string",
+			description: `Initial status, project members only: ${STATUSES.join(" | ")}`
+		}
+	},
+	run: reportErrors("feedback report", async ({ args }) => {
+		const kind = args.kind ?? "bug";
+		if (kind !== "bug" && kind !== "feedback") {
+			console.error(`--kind must be bug or feedback (got "${kind}")`);
+			process.exit(1);
+		}
+		const context = {
+			cli_version: version,
+			site: siteConfig().profileId ?? siteConfig().apiUrl,
+			platform: `${process.platform} node ${process.versions.node}`
+		};
+		const workingOn = tryReadCanopyJson(".")?.slug;
+		if (workingOn) context["working_on"] = workingOn;
+		if (args.command) context["command"] = args.command;
+		if (args.error) context["error"] = args.error;
+		const paths = attachedPaths(args.attach);
+		for (const path of paths) await readFile(path);
+		const { item } = await apiRequest("POST", "/feedback", {
+			kind,
+			body: args.text,
+			...args.project ? { project: args.project } : {},
+			...args.status ? { status: args.status } : {},
+			context
+		});
+		console.log(`Filed ${kind} ${item.id} on ${item.project} as ${item.status}.`);
+		if (paths.length > 0) await attachFiles(item.project, item.id, paths, args.caption);
+		console.log(`Follow it with \`canopy feedback mine\` or on the dashboard's Reports page.`);
+	})
+});
+const feedbackCommand = defineCommand({
+	meta: {
+		name: "feedback",
+		description: "Work a project's feedback inbox, or file a report (see docs: platform-feedback)"
+	},
+	subCommands: {
+		list: listCommand,
+		show: showCommand,
+		comment: commentCommand,
+		attach: defineCommand({
+			meta: {
+				name: "attach",
+				description: "Attach screenshots to an existing item (e.g. proof that a fix works)"
+			},
+			args: {
+				id: {
+					type: "positional",
+					description: "Item id",
+					required: true
+				},
+				file: {
+					type: "positional",
+					description: "Image file (repeat --attach for more)",
+					required: true
+				},
+				attach: {
+					type: "string",
+					description: "Another image file; repeat for several"
+				},
+				caption: {
+					type: "string",
+					description: "One line describing the screenshot(s)"
+				},
+				comment: {
+					type: "string",
+					description: "Post this comment first and hang the screenshots off it"
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("feedback attach", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const paths = [args.file, ...attachedPaths(args.attach)];
+				for (const path of paths) await readFile(path);
+				let commentId;
+				if (args.comment) {
+					const { comment } = await apiRequest("POST", `/projects/${slug}/feedback/${encodeURIComponent(args.id)}/comments`, { body: args.comment });
+					commentId = comment.id;
+					console.log("Comment added.");
+				}
+				await attachFiles(slug, args.id, paths, args.caption, commentId);
+			})
+		}),
+		status: statusCommand,
+		mine: mineCommand,
+		report: reportCommand
+	}
+});
+//#endregion
+export { feedbackCommand };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-CPXtNnfc.mjs";
+import { t as version } from "./package-27IYBxoU.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BUlQR117.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,28 +60,29 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-C1x1l3qg.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-C1x1l3qg.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-C1x1l3qg.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-C9TBoiW7.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-C9TBoiW7.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-C9TBoiW7.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-C9TBoiW7.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-D6Sy15Wv.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-95xeXyZN.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-ClioT9ZC.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-BjlqT2Xj.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-BkkG9Jzs.mjs").then((m) => m.egressCommand),
-		db: () => import("./db-D3RKaLVU.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-wpew0a2M.mjs").then((m) => m.usageCommand),
-		open: () => import("./open-CLSh6oez.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-DhAz6QWS.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-BCX4cUeP.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-jLu7jI0r.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-DuzM-_Rn.mjs").then((m) => m.logsCommand)
+		login: () => import("./login-Cxbj3F46.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-Cxbj3F46.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-Cxbj3F46.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-C6JQjVqg.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-C6JQjVqg.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-C6JQjVqg.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-C6JQjVqg.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-CQq2uzSz.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-y75cgauK.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-y75cgauK.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-Bw1D_J8M.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-y75cgauK.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-y75cgauK.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-D7zrIF8G.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-CN_axsAN.mjs").then((m) => m.egressCommand),
+		feedback: () => import("./feedback-B7QOyMau.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-8Etjmzxh.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-CX1Izj_l.mjs").then((m) => m.usageCommand),
+		open: () => import("./open-DRPp4QJg.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-59NjixYd.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-7K_P-5oN.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-CqADJbUX.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-DNiZquki.mjs").then((m) => m.logsCommand)
 	}
 });
 if (process.argv[2] !== "upgrade") notifyOfUpdate(version);

package/dist/{local-BHxSZwUT.mjs → local-D-HcDDzL.mjs}

@@ -1,5 +1,5 @@
-import { o as apiDataRequest } from "./ui-CpdtK7mt.mjs";
-import { n as rewriteApiPath } from "./dev-BbAVZcAR.mjs";
+import { o as apiDataRequest } from "./ui-2mrJcjYC.mjs";
+import { n as rewriteApiPath } from "./dev-CxfnHPI4.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
@@ -126,6 +126,105 @@ const META_COLUMNS = {
 	_updatedAt: "updated_at"
 };
 //#endregion
+//#region ../data-plane/src/schema.ts
+/** Platform/system tables never shown to users. */
+const RESERVED = /^(_canopy_|_cf_|sqlite_|pg_)/;
+/** Single-quoted SQL string literal (introspection args ride inline, not bound). */
+const lit = (value) => `'${value.replaceAll("'", "''")}'`;
+async function sqliteSchema(store) {
+	const names = (await store.query(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`)).results.map((r) => String(r.name)).filter((n) => !RESERVED.test(n));
+	return Promise.all(names.map(async (name) => {
+		const [cols, idxList] = await Promise.all([store.query(`SELECT name, type, "notnull" AS not_null, pk FROM pragma_table_info(${lit(name)})`), store.query(`SELECT name, "unique" AS is_unique FROM pragma_index_list(${lit(name)})`)]);
+		const indexes = await Promise.all(idxList.results.filter((idx) => !RESERVED.test(String(idx.name))).map(async (idx) => ({
+			name: String(idx.name),
+			unique: Boolean(Number(idx.is_unique)),
+			columns: (await store.query(`SELECT name FROM pragma_index_info(${lit(String(idx.name))})`)).results.map((r) => String(r.name))
+		})));
+		return {
+			name,
+			columns: cols.results.map((col) => ({
+				name: String(col.name),
+				type: String(col.type),
+				nullable: !Number(col.not_null),
+				pk: Number(col.pk) > 0
+			})),
+			indexes
+		};
+	}));
+}
+async function postgresSchema(store) {
+	const [tables, columns, pks, indexes] = await Promise.all([
+		store.query(`SELECT table_name AS name FROM information_schema.tables
+        WHERE table_schema = current_schema() AND table_type = 'BASE TABLE'
+        ORDER BY table_name`),
+		store.query(`SELECT table_name, column_name, data_type, is_nullable
+         FROM information_schema.columns
+        WHERE table_schema = current_schema()
+        ORDER BY table_name, ordinal_position`),
+		store.query(`SELECT tc.table_name, kcu.column_name
+         FROM information_schema.table_constraints tc
+         JOIN information_schema.key_column_usage kcu
+           ON kcu.constraint_name = tc.constraint_name
+          AND kcu.table_schema = tc.table_schema
+        WHERE tc.constraint_type = 'PRIMARY KEY' AND tc.table_schema = current_schema()`),
+		store.query(`SELECT t.relname AS table_name, i.relname AS index_name,
+              ix.indisunique AS is_unique, a.attname AS column_name
+         FROM pg_index ix
+         JOIN pg_class i ON i.oid = ix.indexrelid
+         JOIN pg_class t ON t.oid = ix.indrelid
+         JOIN pg_namespace n ON n.oid = t.relnamespace
+         JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = ANY(ix.indkey)
+        WHERE n.nspname = current_schema() AND NOT ix.indisprimary`)
+	]);
+	const pkSet = new Set(pks.results.map((r) => `${String(r.table_name)}.${String(r.column_name)}`));
+	const byTable = /* @__PURE__ */ new Map();
+	for (const row of tables.results) {
+		const name = String(row.name);
+		if (!RESERVED.test(name)) byTable.set(name, {
+			name,
+			columns: [],
+			indexes: []
+		});
+	}
+	for (const col of columns.results) {
+		const table = byTable.get(String(col.table_name));
+		if (!table) continue;
+		table.columns.push({
+			name: String(col.column_name),
+			type: String(col.data_type),
+			nullable: col.is_nullable === "YES",
+			pk: pkSet.has(`${String(col.table_name)}.${String(col.column_name)}`)
+		});
+	}
+	for (const idx of indexes.results) {
+		const table = byTable.get(String(idx.table_name));
+		if (!table) continue;
+		const name = String(idx.index_name);
+		let index = table.indexes.find((i) => i.name === name);
+		if (!index) {
+			index = {
+				name,
+				unique: Boolean(idx.is_unique),
+				columns: []
+			};
+			table.indexes.push(index);
+		}
+		index.columns.push(String(idx.column_name));
+	}
+	return [...byTable.values()];
+}
+async function introspectSchema(store, dialect) {
+	const [tables, collections] = await Promise.all([dialect === "postgres" ? postgresSchema(store) : sqliteSchema(store), store.query("SELECT collection, COUNT(*) AS docs FROM _canopy_docs GROUP BY collection ORDER BY collection").then((r) => r.results.map((row) => ({
+		name: String(row.collection),
+		docs: Number(row.docs)
+	}))).catch(() => [])]);
+	return {
+		dialect,
+		collections,
+		tables
+	};
+}
+//#endregion
 //#region ../data-plane/src/db.ts
 /**
 * /db — the SDK's document API + raw-SQL escape hatch, over an injectable
@@ -143,6 +242,29 @@ const COLLECTION_RE = /^[a-z][a-z0-9_]{0,63}$/;
 const FIELD_RE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
 const MAX_DOC_BYTES = 256 * 1024;
 const MAX_LIMIT = 1e3;
+/** Row cap for versioned /db/sql responses (the legacy shape is uncapped). */
+const MAX_SQL_ROWS = 1e3;
+/**
+* Statement classifier for read-only /db/sql runs. First keyword must be a
+* read; WITH additionally may not smuggle DML in a CTE (impossible on SQLite,
+* possible on Postgres — where hosts also enforce `SET TRANSACTION READ ONLY`
+* at the engine, making this the belt to that suspender).
+*/
+function readOnlySqlViolation(query) {
+	const bare = query.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/'(?:[^']|'')*'/g, "''").replace(/"(?:[^"]|"")*"/g, "\"\"");
+	const first = /^\s*([A-Za-z]+)/.exec(bare)?.[1]?.toUpperCase();
+	if (first === void 0) return "empty statement";
+	if (![
+		"SELECT",
+		"EXPLAIN",
+		"VALUES",
+		"WITH"
+	].includes(first)) return `${first} is not allowed in read-only mode`;
+	const dml = /\b(INSERT|UPDATE|DELETE|MERGE|REPLACE|CREATE|ALTER|DROP|TRUNCATE|GRANT|REVOKE|VACUUM|ATTACH|REINDEX)\b/i.exec(bare);
+	if (first === "WITH" && dml) return `${dml[1].toUpperCase()} is not allowed in read-only mode`;
+	if (first === "EXPLAIN" && dml && /\bANALYZE\b/i.test(bare)) return "EXPLAIN ANALYZE on a write is not allowed in read-only mode";
+	return null;
+}
 function toDoc(row) {
 	return {
 		...JSON.parse(row.data),
@@ -188,16 +310,48 @@ function dbRouter(config) {
 		const { store } = resolved;
 		const body = await c.req.json().catch(() => ({}));
 		const params = body.params ?? [];
-		if (typeof body.query !== "string" || body.query.trim() === "" || !Array.isArray(params) || !params.every(isScalar)) return c.json({
+		if (typeof body.query !== "string" || body.query.trim() === "" || !Array.isArray(params) || !params.every(isScalar) || !(body.readonly === void 0 || typeof body.readonly === "boolean")) return c.json({
 			error: "invalid_query",
-			detail: "expected { query: string, params?: (string|number|boolean|null)[] }"
+			detail: "expected { query: string, params?: (string|number|boolean|null)[], readonly?: boolean }"
 		}, 400);
-		const result = await store.query(body.query, params).catch((err) => err);
+		if (body.readonly === void 0) {
+			const result = await store.query(body.query, params).catch((err) => err);
+			if (result instanceof Error) return c.json({
+				error: "sql_error",
+				detail: result.message
+			}, 400);
+			return c.json(result.results);
+		}
+		if (body.readonly) {
+			const violation = readOnlySqlViolation(body.query);
+			if (violation) return c.json({
+				error: "read_only",
+				detail: violation
+			}, 400);
+		}
+		const result = await store.query(body.query, params, { readonly: body.readonly }).catch((err) => err);
 		if (result instanceof Error) return c.json({
 			error: "sql_error",
 			detail: result.message
 		}, 400);
-		return c.json(result.results);
+		if (!body.readonly) await config.onSqlWrite?.(c, body.query);
+		const truncated = result.results.length > MAX_SQL_ROWS;
+		const rows = truncated ? result.results.slice(0, MAX_SQL_ROWS) : result.results;
+		return c.json({
+			rows,
+			rowCount: rows.length,
+			truncated
+		});
+	});
+	db.get("/db/schema", async (c) => {
+		const resolved = await resolve(c);
+		if (resolved instanceof Response) return resolved;
+		const schema = await introspectSchema(resolved.store, resolved.dialect.name).catch((err) => err);
+		if (schema instanceof Error) return c.json({
+			error: "sql_error",
+			detail: schema.message
+		}, 400);
+		return c.json(schema);
 	});
 	db.post("/db/:collection", async (c) => {
 		const resolved = await resolve(c);

package/dist/{login-C1x1l3qg.mjs → login-Cxbj3F46.mjs}

@@ -1,5 +1,5 @@
 import { _ as getBakedProfile, d as clearAllProfileTokens, f as listBakedProfiles, g as writeConfigFile, h as upsertProfileAuth, m as setActiveProfile, n as siteConfig, p as readConfigFile, v as isProfileId } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-CpdtK7mt.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";

package/dist/{logs-DuzM-_Rn.mjs → logs-DNiZquki.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, l as withContext, n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{migrations-DpWHuqkQ.mjs → migrations-C-5x6SYf.mjs}

@@ -1,5 +1,5 @@
 import { u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { o as apiDataRequest } from "./ui-CpdtK7mt.mjs";
+import { o as apiDataRequest } from "./ui-2mrJcjYC.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-CLSh6oez.mjs → open-DRPp4QJg.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-CpdtK7mt.mjs";
+import { n as reportErrors, t as openBrowser } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-CPXtNnfc.mjs → package-27IYBxoU.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.6";
+var version = "0.7.8";
 //#endregion
 export { version as t };

package/dist/{projects-C9TBoiW7.mjs → projects-C6JQjVqg.mjs}

@@ -1,5 +1,5 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-CpdtK7mt.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/skill/canopy/SKILL.md

@@ -96,6 +96,8 @@ and never go stale.
 - Roll back: `canopy rollback`
 - Open the live site: `canopy open`
 - Manage data: `canopy db pull | snapshot | snapshots | restore | migrate`
+- Work bug reports & feedback: `canopy feedback list | show | comment | status | report`
+  — see `canopy docs platform-feedback` for the triage and reporting loops
 - CI credentials: `canopy token create | list | revoke`
 
 ## Custom tables & migrations (devs; Drizzle recommended)
@@ -151,3 +153,8 @@ Non-interactive: `canopy create "My App" --template spa`. **When unsure between
 - **Deploys are public.** `canopy deploy` makes a version live. Confirm before
   deploying unless the user clearly asked you to.
 - Keep the CLI current: `canopy upgrade` (this also refreshes this skill).
+- **A `canopy` command itself failing?** First rule out user error (re-read
+  `canopy docs troubleshooting` and the command's `--help`). If the platform
+  really misbehaved, check `canopy feedback mine` for a duplicate, then file it:
+  `canopy feedback report "<what happened>" --command "<the command>" --error "<output>"`
+  — it reaches the platform team directly (no `--project` needed).

package/dist/{skill-BCX4cUeP.mjs → skill-7K_P-5oN.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-CPXtNnfc.mjs";
-import { n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { t as version } from "./package-27IYBxoU.mjs";
+import { n as reportErrors } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";

package/dist/{staging-95xeXyZN.mjs → staging-Bw1D_J8M.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, l as withContext, n as reportErrors, r as requireTty } from "./ui-CpdtK7mt.mjs";
+import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty, u as withContext } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/{token-BjlqT2Xj.mjs → token-D7zrIF8G.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { c as apiRequest, n as reportErrors } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/{ui-CpdtK7mt.mjs → ui-2mrJcjYC.mjs}

@@ -102,6 +102,18 @@ const ERROR_COPY = {
 		why: "the allowlist is at its 32-entry limit",
 		fix: "Remove hosts you no longer need (`canopy egress list` / `canopy egress remove`), or cover several subdomains with one *. wildcard."
 	},
+	unsupported_image: {
+		why: "the file isn't an image Canopy stores (PNG, JPEG, WebP or GIF)",
+		fix: "Attach a screenshot in one of those formats — the file's real contents are what count, not its extension."
+	},
+	attachment_too_large: {
+		why: "the screenshot is over the 5 MB limit",
+		fix: "Scale the image down (or export it as JPEG/WebP) and attach it again."
+	},
+	too_many_attachments: {
+		why: "the report already has the maximum number of screenshots",
+		fix: "Remove one from the report on the dashboard before attaching another."
+	},
 	worker_egress_sync_failed: {
 		why: "the list was saved but redeploying the running worker with it failed",
 		fix: "Retry, or redeploy the project (`canopy deploy`) to apply the new allowlist."
@@ -211,6 +223,23 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 	if (!response.ok) return fail(response, isDeployToken, method, path);
 	return await response.json();
 }
+/**
+* Authenticated POST of raw bytes (a screenshot attachment). The server types
+* the bytes itself, so `contentType` is a hint, not a claim it trusts.
+*/
+async function apiUpload(path, bytes, contentType) {
+	const { apiUrl, token, isDeployToken } = credentials();
+	const response = await fetch(`${apiUrl}/control/v1${path}`, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${token}`,
+			"content-type": contentType
+		},
+		body: bytes
+	});
+	if (!response.ok) return fail(response, isDeployToken, "POST", path);
+	return await response.json();
+}
 /** Authenticated GET returning raw bytes (e.g. a deploy zip). */
 async function apiDownload(path) {
 	const { apiUrl, token, isDeployToken } = credentials();
@@ -346,4 +375,4 @@ function openBrowser(url) {
 	}).on("error", () => {}).unref();
 }
 //#endregion
-export { ApiError as a, apiRequest as c, unwrap as i, withContext as l, reportErrors as n, apiDataRequest as o, requireTty as r, apiDownload as s, openBrowser as t };
+export { ApiError as a, apiRequest as c, unwrap as i, apiUpload as l, reportErrors as n, apiDataRequest as o, requireTty as r, apiDownload as s, openBrowser as t, withContext as u };

package/dist/{upgrade-jLu7jI0r.mjs → upgrade-CqADJbUX.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { n as reportErrors } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-BCX4cUeP.mjs");
+		const { skillInstalled } = await import("./skill-7K_P-5oN.mjs");
 		const refreshSkill = skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);

package/dist/{usage-wpew0a2M.mjs → usage-CX1Izj_l.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, l as withContext, n as reportErrors } from "./ui-CpdtK7mt.mjs";
+import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -20,8 +20,8 @@
     "esbuild": "^0.28.1",
     "hono": "^4.8.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy-data-plane": "0.0.2",
-    "@mediamonks/canopy": "0.0.4"
+    "@mediamonks/canopy": "0.0.4",
+    "@mediamonks/canopy-data-plane": "0.0.2"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/dev-D6Sy15Wv.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-BbAVZcAR.mjs";
-export { devCommand };