@mediamonks/canopy-cli 0.7.8 → 0.7.10

package/dist/{deploy-y75cgauK.mjs → deploy-BKFICJT1.mjs}

@@ -248,7 +248,8 @@ const promoteCommand = defineCommand({
 			throw err;
 		}
 		const backend = result.worker?.serviceUrl ? ` · backend ${result.worker.serviceUrl}` : "";
-		spin.stop(`Live: ${projectUrl(slug)} (v${result.version}, was v${result.previous ?? "?"})${backend}`);
+		const was = result.previous === null ? "" : `, was v${result.previous}`;
+		spin.stop(`Live: ${projectUrl(slug)} (v${result.version}${was})${backend}`);
 		for (const name of result.migrationsApplied) console.log(`  applied ${name}`);
 		if (result.snapshot !== void 0) console.log(`  pre-promote snapshot: ${result.snapshot} (canopy db restore --snapshot …)`);
 	})

package/dist/dev-BYxSHUH6.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-DtoZrexp.mjs";
+export { devCommand };

package/dist/{dev-CxfnHPI4.mjs → dev-DtoZrexp.mjs}

@@ -3,6 +3,7 @@ import { a as ApiError, c as apiRequest, n as reportErrors, u as withContext } f
 import { r as readMigrationFiles } from "./migrations-C-5x6SYf.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/dev.ts
@@ -15,6 +16,56 @@ function rewriteApiPath(path) {
 	return path.slice(5);
 }
 /**
+* What raw SQL through the worker's env.DB speaks (D15): the canopy.json lock
+* wins, then the engine actually answering — PGlite in the --local sandbox
+* (local.ts's default), the site's own database otherwise.
+*/
+function workerDialect(flags) {
+	if (flags.dialect !== void 0) return flags.dialect;
+	if (flags.local) return "postgres";
+	return siteConfig().cloud === "gcp" ? "postgres" : "sqlite";
+}
+/**
+* The project's own backend worker, served by the dev server the way the
+* gateway serves it in production (dev-worker.ts). Returns the plugin plus
+* the notice lines to print, or undefined when the project has no worker.
+*/
+async function workerPlugin(flags, slug) {
+	const entry = tryReadCanopyJson(flags.dir)?.worker;
+	if (entry === void 0) return void 0;
+	if (!existsSync(join(flags.dir, entry))) {
+		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
+		return;
+	}
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-BZgtEM9V.mjs");
+	const secrets = readDevVars(flags.dir);
+	const email = siteConfig().email;
+	const plugin = workerDevPlugin({
+		dir: flags.dir,
+		entry,
+		slug,
+		channel: flags.staging ? "staging" : "live",
+		secrets,
+		user: email ? {
+			sub: "local-dev",
+			email,
+			name: "Local Dev"
+		} : null,
+		dialect: workerDialect(flags)
+	});
+	const notes = [`  /api/* is served by ${entry} (edit and refresh; no build step)`];
+	if (Object.keys(secrets).length > 0) notes.push(`  worker secrets from .dev.vars: ${Object.keys(secrets).sort().join(", ")}`);
+	const missing = missingSecretNames(((await apiRequest("GET", `/projects/${slug}/secrets`).catch(() => void 0))?.secrets ?? []).map((s) => s.key), Object.keys(secrets));
+	if (missing.length > 0) {
+		notes.push(`  set in the dashboard but not in .dev.vars: ${missing.join(", ")}`);
+		notes.push("  (dashboard values are never downloaded — add local ones to .dev.vars)");
+	}
+	return {
+		plugin,
+		notes
+	};
+}
+/**
 * Load Vite's `createServer`, preferring the Vite installed in the *project*
 * over the copy bundled with the CLI. `bundled` reports which one we got.
 *
@@ -43,7 +94,7 @@ async function loadCreateServer(dir) {
 		};
 	}
 }
-async function startVite(flags, serverOverrides) {
+async function startVite(flags, serverOverrides, extraPlugins = []) {
 	const { createServer, bundled } = await loadCreateServer(flags.dir);
 	const plugins = [{
 		name: "canopy-platform-api-external",
@@ -61,7 +112,7 @@ async function startVite(flags, serverOverrides) {
 	});
 	const server = await createServer({
 		root: flags.dir,
-		plugins,
+		plugins: [...plugins, ...extraPlugins],
 		server: {
 			port: flags.port,
 			...serverOverrides
@@ -84,6 +135,7 @@ function devTokenContext(slug) {
 async function devRemote(flags, slug) {
 	const { token, expires_at } = await withContext(apiRequest("POST", `/projects/${slug}/dev-token`), devTokenContext(slug));
 	const { apiUrl } = siteConfig();
+	const worker = await workerPlugin(flags, slug);
 	const server = await startVite(flags, { proxy: { "/_api": {
 		target: apiUrl,
 		changeOrigin: true,
@@ -92,7 +144,7 @@ async function devRemote(flags, slug) {
 			...flags.staging ? { "x-canopy-channel": "staging" } : {}
 		},
 		rewrite: rewriteApiPath
-	} } });
+	} } }, worker ? [worker.plugin] : []);
 	if (flags.staging) {
 		console.log(`\n  ${slug} — remote-first dev against the STAGING channel's data`);
 		console.log("  (live data is untouched; `canopy staging sync` re-clones it from live)");
@@ -105,6 +157,7 @@ async function devRemote(flags, slug) {
 		console.log("  migrations apply on `canopy deploy`, never from dev — use --local");
 		console.log("  while the schema is in flux");
 	}
+	for (const note of worker?.notes ?? []) console.log(note);
 	console.log("");
 	server.printUrls();
 	console.log(`\n  Dev token expires ${expires_at} — restart canopy dev after that.`);
@@ -112,7 +165,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-D-HcDDzL.mjs");
+		const { fetchProjectDump } = await import("./local-C5AhA4GM.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -127,7 +180,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-D-HcDDzL.mjs");
+	const { createSandbox } = await import("./local-C5AhA4GM.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),
@@ -176,6 +229,7 @@ async function devLocal(flags, slug) {
 		headers: { authorization: `Bearer ${remote.token}` },
 		rewrite: rewriteApiPath
 	};
+	const worker = await workerPlugin(flags, slug);
 	const server = await startVite(flags, { proxy: {
 		...remoteEntry && {
 			"/_api/data/v1/ai": remoteEntry,
@@ -185,7 +239,7 @@ async function devLocal(flags, slug) {
 			target: `http://127.0.0.1:${apiAddress.port}`,
 			rewrite: (path) => path
 		}
-	} });
+	} }, worker ? [worker.plugin] : []);
 	server.httpServer?.once("close", () => {
 		apiServer.close();
 		sandbox.dispose();
@@ -197,6 +251,7 @@ async function devLocal(flags, slug) {
 	if (dump === void 0) console.log("  (want prod data? restart with --pull to hydrate from a fresh export)");
 	console.log("  blobs are not pulled — the local blob store starts empty");
 	console.log(remote ? "  ai/services pass through to the platform (metered as usual)" : "  ai/services answer 501 until you log in and restart");
+	for (const note of worker?.notes ?? []) console.log(note);
 	console.log("");
 	server.printUrls();
 }

package/dist/dev-worker-BZgtEM9V.mjs

@@ -0,0 +1,313 @@
+import { readFileSync } from "node:fs";
+import { relative, resolve, sep } from "node:path";
+//#region src/dev-worker.ts
+/**
+* Paths that belong to the worker rather than the SPA — the gateway's rule
+* (apps/gateway/src/backend.ts), kept identical so a route that works in dev
+* is reachable in production.
+*/
+function isWorkerPath(pathname) {
+	return pathname === "/api" || pathname.startsWith("/api/");
+}
+/** The manual schedule tick, mirroring the shim's own path (docs/07). */
+const SCHEDULED_PATH = "/__canopy/scheduled";
+/**
+* `.dev.vars` — local-only worker secrets, the wrangler-shaped file the repo
+* already gitignores.
+*
+* Deliberately NOT "pull the dashboard's secrets": there is no way to read a
+* stored value back (apps/api/src/routes/secrets.ts lists names and
+* timestamps only — values are AES-GCM at rest and injected into the worker
+* runtime, nowhere else), and adding one would put every project's live
+* third-party credentials on every laptop that runs `canopy dev`. North star
+* principle 3, secure by default: a dev secret is a local secret.
+*/
+function parseDevVars(text) {
+	const out = {};
+	for (const raw of text.split(/\r?\n/)) {
+		const line = raw.trim();
+		if (line === "" || line.startsWith("#")) continue;
+		const withoutExport = line.startsWith("export ") ? line.slice(7).trim() : line;
+		const eq = withoutExport.indexOf("=");
+		if (eq <= 0) continue;
+		const key = withoutExport.slice(0, eq).trim();
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+		let value = withoutExport.slice(eq + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"") && value.length >= 2 || value.startsWith("'") && value.endsWith("'") && value.length >= 2) value = value.slice(1, -1);
+		out[key] = value;
+	}
+	return out;
+}
+/** Reads `.dev.vars` from the project dir; {} when there is none. */
+function readDevVars(dir) {
+	try {
+		return parseDevVars(readFileSync(resolve(dir, ".dev.vars"), "utf8"));
+	} catch {
+		return {};
+	}
+}
+/** Dashboard secret names the local `.dev.vars` doesn't define. */
+function missingSecretNames(remote, local) {
+	const have = new Set(local);
+	return remote.filter((name) => !have.has(name)).sort();
+}
+/**
+* Port of the shim's rewriteCanopyUrl: a worker may call
+* `CANOPY.fetch("/db/todos")`, `"/data/v1/db/todos"` or the `/_api/…` form the
+* browser SDK uses — all three land on the same data-plane path.
+*/
+function rewriteCanopyUrl(raw, base) {
+	const root = base.replace(/\/$/, "");
+	let path;
+	let search = "";
+	try {
+		const url = new URL(raw, "http://canopy.local");
+		path = url.pathname;
+		search = url.search;
+	} catch {
+		path = raw.startsWith("/") ? raw : `/${raw}`;
+	}
+	if (path.startsWith("/_api/")) path = path.slice(5);
+	if (!path.startsWith("/data/v1/") && !path.startsWith("/control/v1/")) path = `/data/v1${path.startsWith("/") ? path : `/${path}`}`;
+	return root + path + search;
+}
+/**
+* env.CANOPY.fetch — the same rewriting the shim does, delivered through the
+* dev server's `/_api` mount so the running mode decides what answers.
+* Credentials stay in the proxy; nothing here carries a token.
+*/
+function createCanopyFetch(apiBase, slug, channel, fetchImpl = fetch) {
+	return async (input, init) => {
+		const url = rewriteCanopyUrl(typeof input === "string" ? input : input instanceof URL ? input.href : input.url, apiBase());
+		const headers = new Headers(input instanceof Request ? input.headers : init?.headers);
+		headers.delete("host");
+		headers.delete("x-canopy-user-sub");
+		headers.delete("x-canopy-user-email");
+		headers.delete("x-canopy-user-name");
+		headers.delete("authorization");
+		headers.delete("cookie");
+		headers.set("x-canopy-project", slug);
+		if (channel === "staging") headers.set("x-canopy-channel", "staging");
+		const method = (input instanceof Request ? input.method : init?.method) ?? "GET";
+		const body = input instanceof Request ? input.body : init?.body;
+		const outbound = {
+			method,
+			headers,
+			body: body ?? void 0,
+			redirect: input instanceof Request ? input.redirect : init?.redirect
+		};
+		if (body) outbound.duplex = "half";
+		return fetchImpl(url, outbound);
+	};
+}
+/**
+* env.DB over the data plane's raw-SQL escape hatch — the deployed worker
+* holds a direct D1/Postgres handle, which a laptop has no credential for, so
+* dev routes the same statements through `/db/sql` (the legacy uncapped shape
+* the SDK uses). Reads are identical; writes report `rowCount: 0` because that
+* shape returns rows, not a change count.
+*/
+function createDevDb(canopyFetch, dialect) {
+	return {
+		dialect,
+		query: async (text, params = []) => {
+			const response = await canopyFetch("/data/v1/db/sql", {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					query: text,
+					params
+				})
+			});
+			if (!response.ok) {
+				const detail = await response.text();
+				throw new Error(`env.DB query failed (HTTP ${response.status}): ${detail.slice(0, 300)}`);
+			}
+			const rows = await response.json();
+			return {
+				rows,
+				rowCount: rows.length
+			};
+		}
+	};
+}
+/** env.BLOB over the data plane's blob routes, for the same reason as env.DB. */
+function createDevBlob(canopyFetch, prefix) {
+	const path = (key) => `/data/v1/blob/${encodeURIComponent(key)}`;
+	return {
+		prefix,
+		put: async (key, body, contentType) => {
+			const response = await canopyFetch(path(key), {
+				method: "PUT",
+				headers: { "content-type": contentType ?? "application/octet-stream" },
+				body
+			});
+			if (!response.ok) throw new Error(`env.BLOB put failed (HTTP ${response.status})`);
+		},
+		get: async (key) => {
+			const response = await canopyFetch(path(key));
+			if (response.status === 404) return null;
+			if (!response.ok) throw new Error(`env.BLOB get failed (HTTP ${response.status})`);
+			const contentType = response.headers.get("content-type") ?? void 0;
+			const bytes = new Uint8Array(await response.arrayBuffer());
+			return contentType ? {
+				body: bytes,
+				contentType
+			} : { body: bytes };
+		},
+		list: async (sub) => {
+			const response = await canopyFetch(`/data/v1/blob${sub ? `?prefix=${encodeURIComponent(sub)}` : ""}`);
+			if (!response.ok) throw new Error(`env.BLOB list failed (HTTP ${response.status})`);
+			return (await response.json()).map(({ key, size }) => ({
+				key,
+				size
+			}));
+		},
+		delete: async (key) => {
+			const response = await canopyFetch(path(key), { method: "DELETE" });
+			if (!response.ok) throw new Error(`env.BLOB delete failed (HTTP ${response.status})`);
+		}
+	};
+}
+/** Gateway-stamped identity, honored in dev too so a request can pose as one. */
+function userFromHeaders(headers, fallback) {
+	const sub = (headers.get("x-canopy-user-sub") ?? "").trim();
+	if (!sub) return fallback;
+	return {
+		sub,
+		email: (headers.get("x-canopy-user-email") ?? "").trim(),
+		name: (headers.get("x-canopy-user-name") ?? "").trim()
+	};
+}
+/**
+* The env object the worker sees, in the shim's own key order: secrets first,
+* platform keys after, so a stray `.dev.vars` entry can never shadow
+* `CANOPY`/`DB`/`USER` (the dashboard rejects those names outright —
+* apps/api/src/secrets.ts isReservedSecretKey).
+*/
+function buildWorkerEnv(options, request, parts) {
+	const blobPrefix = `projects/${options.slug}/`;
+	return {
+		...options.secrets,
+		CANOPY: { fetch: parts.canopyFetch },
+		DB: parts.db,
+		BLOB: parts.blob,
+		USER: userFromHeaders(request.headers, options.user),
+		PROJECT_SLUG: options.slug,
+		BLOB_PREFIX: blobPrefix,
+		CANOPY_CHANNEL: options.channel
+	};
+}
+/**
+* Host to reach the dev server on from inside this process. Vite's default
+* bind is `localhost`, which on this machine is IPv6-only — a hardcoded
+* 127.0.0.1 gets ECONNREFUSED — so the bound address decides.
+*/
+function loopbackHost(bound) {
+	if (bound === "" || bound === "::" || bound === "0.0.0.0") return "127.0.0.1";
+	return bound.includes(":") ? `[${bound}]` : bound;
+}
+/** Vite-root-relative URL for ssrLoadModule ("worker/index.ts" → "/worker/index.ts"). */
+function entryModuleId(dir, entry) {
+	return `/${relative(resolve(dir), resolve(dir, entry)).split(sep).join("/")}`;
+}
+async function toRequest(req, origin) {
+	const headers = new Headers();
+	for (const [name, value] of Object.entries(req.headers)) {
+		if (value === void 0) continue;
+		for (const one of Array.isArray(value) ? value : [value]) headers.append(name, one);
+	}
+	const method = req.method ?? "GET";
+	let body;
+	if (method !== "GET" && method !== "HEAD") {
+		const chunks = [];
+		for await (const chunk of req) chunks.push(chunk);
+		const buffer = Buffer.concat(chunks);
+		if (buffer.length > 0) body = new Uint8Array(buffer);
+	}
+	return new Request(`${origin}${req.url ?? "/"}`, {
+		method,
+		headers,
+		body
+	});
+}
+async function sendResponse(res, response) {
+	const headers = {};
+	for (const [name, value] of response.headers) headers[name] = value;
+	res.writeHead(response.status, headers);
+	res.end(Buffer.from(await response.arrayBuffer()));
+}
+/**
+* Serves the project's worker from the Vite dev server. Installed `pre` so
+* `/api/*` is answered before Vite's SPA fallback claims it — the same
+* precedence the gateway gives the worker over static assets.
+*/
+function workerDevPlugin(options) {
+	const moduleId = entryModuleId(options.dir, options.entry);
+	let apiBase = "";
+	const canopyFetch = createCanopyFetch(() => apiBase, options.slug, options.channel);
+	return {
+		name: "canopy-project-worker",
+		configureServer(server) {
+			const load = async () => {
+				const handler = (await server.ssrLoadModule(moduleId)).default;
+				if (!handler || typeof handler.fetch !== "function") throw new Error(`${options.entry} must default-export an object with fetch() (Workers shape).`);
+				return handler;
+			};
+			server.middlewares.use((req, res, next) => {
+				const path = (req.url ?? "/").split("?")[0] ?? "/";
+				const scheduled = path === SCHEDULED_PATH;
+				if (!isWorkerPath(path) && !scheduled) return next();
+				(async () => {
+					const address = server.httpServer?.address();
+					if (apiBase === "" && address != null && typeof address === "object") apiBase = `http://${loopbackHost(address.address)}:${address.port}/_api`;
+					const request = await toRequest(req, `http://${req.headers.host ?? "localhost"}`);
+					const worker = await load();
+					const env = buildWorkerEnv(options, request, {
+						canopyFetch,
+						db: createDevDb(canopyFetch, options.dialect),
+						blob: createDevBlob(canopyFetch, `projects/${options.slug}/`)
+					});
+					if (scheduled) {
+						if (req.method !== "POST") return next();
+						if (typeof worker.scheduled !== "function") {
+							await sendResponse(res, Response.json({
+								error: "no_scheduled_handler",
+								detail: "export scheduled() next to fetch"
+							}, { status: 501 }));
+							return;
+						}
+						const body = await request.json().catch(() => ({}));
+						const name = typeof body.name === "string" ? body.name : "";
+						if (!name) {
+							await sendResponse(res, Response.json({ error: "missing_name" }, { status: 400 }));
+							return;
+						}
+						env.USER = null;
+						await worker.scheduled({
+							name,
+							cron: typeof body.cron === "string" ? body.cron : "",
+							scheduledTime: typeof body.scheduledTime === "number" ? body.scheduledTime : Date.now(),
+							type: "scheduled"
+						}, env);
+						await sendResponse(res, Response.json({
+							ok: true,
+							name
+						}));
+						return;
+					}
+					await sendResponse(res, await worker.fetch(request, env));
+				})().catch((err) => {
+					if (err instanceof Error) server.ssrFixStacktrace(err);
+					console.error("worker request failed", err);
+					sendResponse(res, Response.json({
+						error: "worker_error",
+						detail: err instanceof Error ? err.message : String(err)
+					}, { status: 500 })).catch(() => res.end());
+				});
+			});
+		}
+	};
+}
+//#endregion
+export { missingSecretNames, readDevVars, workerDevPlugin };

package/dist/docs/cli-dev.md

@@ -37,6 +37,25 @@ canopy dev --local --pull       # sandbox hydrated from a fresh prod export
 
 With the lock in place, `--local` runs on an embedded SQLite engine instead — the same raw SQL, full-text search behavior, and `--pull` dumps as your deployed site. `"dialect": "postgres"` makes today's default explicit. Each engine keeps its own state under `.canopy/local/`, so switching the lock never corrupts data. The SQLite engine uses Node's built-in database and needs **Node 24+** (older Node builds lack full-text search); the CLI says so plainly if yours is older.
 
+**Your backend worker.** If `canopy.json` names a `worker` entry (the worker scaffold does), `canopy dev` serves it too: requests to `/api/*` go to your worker, everything else to the SPA — the same split the platform makes once you deploy. There's no build step; save the file and the next request runs the new code.
+
+Your worker gets the same `env` it gets in production: `env.CANOPY.fetch` for the SDK, `env.DB` and `env.BLOB` for raw database and file access, `env.USER` for the signed-in person, `env.PROJECT_SLUG`. They all follow the mode you're in — live project data by default, your sandbox under `--local`. Two differences worth knowing: `env.USER` is you (the account you logged in with), since there's no company login in front of a local server, and a write through `env.DB` reports no row count locally.
+
+To tick a schedule by hand, post its name to the same path the platform uses:
+
+```bash
+curl -X POST localhost:5173/__canopy/scheduled -d '{"name":"nightly-digest"}'
+```
+
+**Worker secrets.** Secrets you set in the dashboard are never downloaded — the platform can't hand a stored value back, and your laptop is not where a live API key belongs. Put local values in a `.dev.vars` file next to `canopy.json` instead:
+
+```
+STRIPE_KEY=sk_test_local
+SLACK_WEBHOOK="https://hooks.slack.com/services/…"
+```
+
+Your worker reads them exactly as it reads dashboard secrets (`c.env.STRIPE_KEY`). Keep `.dev.vars` out of git — the scaffolds already ignore it. At startup `canopy dev` lists the dashboard secret names your `.dev.vars` doesn't define, so you know what's still missing (names only, never values).
+
 **`--pull`.** Before the sandbox boots, the CLI requests a fresh SQL export of the project's production database and applies it locally. Sync is pull-only — nothing ever pushes back. Blobs are not pulled; the local blob store starts empty.
 
 **Schema migrations.** When `canopy.json` configures a `"migrations"` directory (see the [migrations guide](https://docs.canopy.website/guides/migrations)), the `--local` sandbox applies pending migrations on boot, so the local schema always matches the repo. Remote-first dev **never** applies migrations — it points at production, and schema changes ship with `canopy deploy`. While a schema change is in flux, work in `--local`.

package/dist/docs/cli-feedback.md

@@ -10,9 +10,11 @@ ones.
 ## Usage
 
 ```bash
-canopy feedback list --status accepted
+canopy feedback list --status investigate
 canopy feedback show <id>
 canopy feedback comment <id> "root cause: the upload grant expires too early"
+canopy feedback status <id> investigated --comment "root cause: the grant expires too early"
+canopy feedback list --status accepted
 canopy feedback status <id> resolved --comment "fixed in v42"
 canopy feedback mine
 canopy feedback report "canopy deploy exits 1 after upload" --command "canopy deploy"
@@ -28,8 +30,9 @@ require project membership. `list` and `show` take `--json` for
 machine-readable output.
 
 - `list [--status <s>] [--kind <k>]` — the project's inbox. Statuses:
-  `new`, `accepted`, `in_progress`, `resolved`, `declined`; kinds: `bug`,
-  `feedback`, `docs`.
+  `investigate`, `investigated`, `accepted`, `in_progress`, `resolved`,
+  `declined`; kinds: `bug`, `feedback`, `docs`. (Reports filed before triage
+  statuses existed sit in `new`, which you can still filter for.)
 - `show <id> [--download <dir>]` — full detail: body, captured context (page
   URL, deploy version, console errors — or CLI context), the screenshots on
   the report, and the comment trail. `--download` saves the screenshots into
@@ -40,20 +43,33 @@ machine-readable output.
   posted first and the screenshots hang off that trail entry — how you show
   "here's what it looks like after the fix".
 - `status <id> <new-status> [--comment <note>]` — move the ticket; the
-  transition is recorded on the trail.
+  transition is recorded on the trail. Moving to `investigated` needs the
+  findings: pass `--comment`, or comment first.
 - `mine [--project <slug>] [--json]` — your own reports across all projects,
   with current statuses.
 - `report <text> [--kind bug|feedback] [--project <slug>] [--command <cmd>] [--error <output>] [--attach <file>] [--caption <text>]` —
   file a new report. **Without `--project` it goes to the platform inbox**
   (Canopy itself) — the right target when a `canopy` command misbehaves. The
   CLI attaches its version, the active site, your platform, and the project
-  you were working in.
+  you were working in. Reports open as `investigate`; a project member may
+  pass `--status` to open one further along — `investigated` when the report
+  itself is the write-up of what you found, `accepted` when the person you are
+  working with asked for it.
 
 ## For agents
 
-The intended loop: a human marks items `accepted` on the dashboard; the agent
-runs `list --status accepted`, reproduces using the context in `show`
-(including the deploy version that served the page), comments findings, and
-resolves — or declines with a comment saying why. When a `canopy` command
-itself fails: rule out user error, check `canopy feedback mine` for a
-duplicate, then `report` with the exact command and error output.
+Two loops.
+
+**Investigate:** `list --status investigate` is everything nobody has looked at
+yet. Reproduce with the context in `show` (including the deploy version that
+served the page), then `status <id> investigated --comment "<what you found>"`.
+Stop there — say what it would take to fix and let the person decide.
+
+**Build:** `list --status accepted` is what a person has asked for. Do the
+work, then `resolve` with a note, or `declined` if it turns out to be a bad
+idea. Set `accepted` yourself only when the person you are working with told
+you to.
+
+When a `canopy` command itself fails: rule out user error, check
+`canopy feedback mine` for a duplicate, then `report` with the exact command
+and error output.

package/dist/docs/dev.md

@@ -46,6 +46,25 @@ dialect in `canopy.json` (`"dialect": "sqlite"`) and the sandbox runs an
 embedded SQLite engine instead, so the same SQL works locally and deployed —
 see [canopy dev](https://docs.canopy.website/cli/dev).
 
+## Backend worker
+
+Projects with a `worker` entry in `canopy.json` get their backend locally too:
+`/api/*` is served by your worker in both modes, with the same `env` it has in
+production (`env.CANOPY`, `env.DB`, `env.BLOB`, `env.USER`). Edit and refresh —
+there's no build step.
+
+Secrets are the one thing that doesn't come from the dashboard. Stored values
+are never downloadable, so put local ones in a `.dev.vars` file next to
+`canopy.json`:
+
+```
+STRIPE_KEY=sk_test_local
+```
+
+Your worker reads them the same way it reads dashboard secrets
+(`c.env.STRIPE_KEY`). `canopy dev` prints which dashboard secret names your
+`.dev.vars` is missing. Keep the file out of git — the scaffolds ignore it.
+
 ## Which mode should an agent use?
 
 - Iterating on UI or read-only features → `canopy dev` (live data, realistic).

package/dist/docs/overview-how-it-works.md

@@ -29,7 +29,8 @@ address exists as soon as the project does.
 Visitors to your project's URL hit OneLogin before they see anything. By
 default any Monk can open it. From the project's Settings you can tighten that
 to collaborators only, or add a shared client password so people outside Monks
-can view it. There is no "make it public" switch — that's by design.
+can view it. The password stays visible in Settings, so you can look it up and
+share it again later. There is no "make it public" switch — that's by design.
 
 ## Deploys create versions
 

package/dist/docs/platform-client-access.md

@@ -28,7 +28,8 @@ The unlock is deliberately narrow:
 
 ## Enabling it
 
-Open the project's **Settings** tab and use the **Client access** card:
+Open the project's **Settings** tab and use the **Who outside Monks can open
+it** card:
 
 1. Set a password. Pick something you're comfortable saying out loud on a
    call — it's a shared secret, not a personal credential.

package/dist/docs/platform-feedback.md

@@ -55,8 +55,15 @@ report itself, and are deleted with it.
 
 Project members triage reports on the **Feedback tab**:
 
-- Statuses: `new → accepted → in_progress → resolved`, plus `declined`.
-  **`accepted` means "this is valid — an agent may pick it up."**
+- Statuses: `investigate → investigated → accepted → in_progress → resolved`,
+  plus `declined`.
+- Everything arrives as **investigate** — nobody has looked at it yet. An agent
+  can pick those up, work out what is actually going on, and write the findings
+  on the report as **investigated**.
+- **`accepted` means a person said "build this."** It is the one status an
+  agent should never reach for on its own.
+- The order is a suggestion, not a track. Accept something straight away, skip
+  the investigation, or decline it at any point.
 - Every status change and comment is recorded on the item's trail.
 - Reporters follow their submissions on the **Reports page** (dashboard
   header) and can comment on or withdraw their own items; only project
@@ -64,21 +71,27 @@ Project members triage reports on the **Feedback tab**:
 
 ## Working the backlog with an agent
 
-Because the CLI exposes the inbox, "work through the accepted feedback" is a
-prompt, not a process:
+Because the CLI exposes the inbox, "look into the new reports" and "work
+through the accepted feedback" are both prompts, not processes:
 
 ```bash
-canopy feedback list --status accepted        # what a human marked valid
-canopy feedback show <id>                     # body + captured context + trail
-canopy feedback comment <id> "root cause: …"  # append findings
+canopy feedback list --status investigate      # what nobody has looked at yet
+canopy feedback show <id>                      # body + captured context + trail
+canopy feedback status <id> investigated \
+  --comment "root cause: the upload grant expires too early"
+canopy feedback list --status accepted         # what a person asked for
 canopy feedback status <id> resolved --comment "fixed in v42"
 ```
 
+`investigated` always carries the findings — the note is required, because a
+report that claims someone looked into it and shows nothing is worse than an
+untouched one. Then it waits: **accepting is the person's call**, so an agent
+sets `accepted` only when the person it is working with says to build the
+thing.
+
 `show` includes the deploy version that served the page when the bug was
-reported — reproduce against that, not whatever is live now. An agent that
-investigates but can't fix should `comment` its findings and leave the status
-for a human; one that pushes back should `status <id> declined` with a comment
-saying why.
+reported — reproduce against that, not whatever is live now. A report worth
+pushing back on gets `status <id> declined` with a comment saying why.
 
 ## Reporting problems with Canopy itself
 

package/dist/docs/platform-members-and-access.md

@@ -44,8 +44,8 @@ from the same card.
 
 Sometimes "any Monk can look" is too open — payroll prototypes, sensitive
 client work, unfinished things you'd rather not demo by accident. Flip on
-**Settings → Collaborators only** and the live app is limited to the
-project's roster:
+**Settings → Who at Monks can open it → Restrict to collaborators** and the
+live app is limited to the project's roster:
 
 - Other Monks who open the URL get a clear "limited to its collaborators"
   page instead of the app.

package/dist/{docs-59NjixYd.mjs → docs-Ck9xogEV.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-27IYBxoU.mjs";
+import { t as version } from "./package-DRp7sI6i.mjs";
 import { n as siteConfig } from "./site-BUlQR117.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { n as reportErrors } from "./ui-2mrJcjYC.mjs";

package/dist/{feedback-B7QOyMau.mjs → feedback-BpiCvItH.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-27IYBxoU.mjs";
+import { t as version } from "./package-DRp7sI6i.mjs";
 import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
 import { c as apiRequest, l as apiUpload, n as reportErrors, s as apiDownload } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
@@ -9,19 +9,22 @@ import { readFile, writeFile } from "node:fs/promises";
 * canopy feedback — the ticket-lite feedback system (docs/19, docs topic
 * `platform-feedback`). Two jobs:
 *
-*  - Work a project's inbox: `list`, `show`, `comment`, `status` — the loop an
-*    agent runs over items a human marked `accepted`.
+*  - Work a project's inbox: `list`, `show`, `comment`, `status` — investigate
+*    what came in (`investigate` → comment the findings → `investigated`), and
+*    build what a human marked `accepted`.
 *  - File reports: `report` sends a bug/feedback item. With no `--project` it
 *    lands on the **platform inbox** (canopy itself) — the right target when a
 *    canopy command misbehaves while you're building something else.
 */
 const STATUSES = [
-	"new",
+	"investigate",
+	"investigated",
 	"accepted",
 	"in_progress",
 	"resolved",
 	"declined"
 ];
+const FILTER_STATUSES = [...STATUSES, "new"];
 const KINDS = [
 	"bug",
 	"feedback",
@@ -94,7 +97,7 @@ const listCommand = defineCommand({
 		...jsonArg,
 		status: {
 			type: "string",
-			description: `Filter: ${STATUSES.join(" | ")}`
+			description: `Filter: ${FILTER_STATUSES.join(" | ")}`
 		},
 		kind: {
 			type: "string",
@@ -219,7 +222,7 @@ const statusCommand = defineCommand({
 		},
 		comment: {
 			type: "string",
-			description: "Optional note recorded with the change"
+			description: "Note recorded with the change (required for `investigated`)"
 		},
 		...projectDirArgs
 	},

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-27IYBxoU.mjs";
+import { t as version } from "./package-DRp7sI6i.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BUlQR117.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,28 +60,28 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-Cxbj3F46.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-Cxbj3F46.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-Cxbj3F46.mjs").then((m) => m.logoutCommand),
+		login: () => import("./login-D7dI8D9N.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-D7dI8D9N.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-D7dI8D9N.mjs").then((m) => m.logoutCommand),
 		create: () => import("./projects-C6JQjVqg.mjs").then((m) => m.createCommand),
 		init: () => import("./projects-C6JQjVqg.mjs").then((m) => m.initCommand),
 		projects: () => import("./projects-C6JQjVqg.mjs").then((m) => m.projectsCommand),
 		delete: () => import("./projects-C6JQjVqg.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-CQq2uzSz.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-y75cgauK.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-y75cgauK.mjs").then((m) => m.promoteCommand),
+		dev: () => import("./dev-BYxSHUH6.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-BKFICJT1.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-BKFICJT1.mjs").then((m) => m.promoteCommand),
 		staging: () => import("./staging-Bw1D_J8M.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-y75cgauK.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-y75cgauK.mjs").then((m) => m.downloadCommand),
+		rollback: () => import("./deploy-BKFICJT1.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-BKFICJT1.mjs").then((m) => m.downloadCommand),
 		token: () => import("./token-D7zrIF8G.mjs").then((m) => m.tokenCommand),
 		egress: () => import("./egress-CN_axsAN.mjs").then((m) => m.egressCommand),
-		feedback: () => import("./feedback-B7QOyMau.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-BpiCvItH.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-8Etjmzxh.mjs").then((m) => m.dbCommand),
 		usage: () => import("./usage-CX1Izj_l.mjs").then((m) => m.usageCommand),
 		open: () => import("./open-DRPp4QJg.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-59NjixYd.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-7K_P-5oN.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-CqADJbUX.mjs").then((m) => m.upgradeCommand),
+		docs: () => import("./docs-Ck9xogEV.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-B2sDMAmv.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-tOfSmAcc.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-DNiZquki.mjs").then((m) => m.logsCommand)
 	}
 });

package/dist/{local-D-HcDDzL.mjs → local-C5AhA4GM.mjs}

@@ -1,5 +1,5 @@
 import { o as apiDataRequest } from "./ui-2mrJcjYC.mjs";
-import { n as rewriteApiPath } from "./dev-CxfnHPI4.mjs";
+import { n as rewriteApiPath } from "./dev-DtoZrexp.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{login-Cxbj3F46.mjs → login-D7dI8D9N.mjs}

@@ -19,27 +19,43 @@ function loginCallbackPage(ok) {
 <title>${title} · Canopy</title>
 <style>
   :root {
-    color-scheme: light;
+    color-scheme: light dark;
     --ink: #14201a;
     --muted: #4a5c52;
     --line: #d5ddd7;
     --panel: rgba(255, 255, 255, 0.82);
+    --field: rgba(255, 255, 255, 0.7);
     --accent: #2f6b4f;
-    --bg0: #e8f0ea;
-    --bg1: #f7f5f0;
-    --bg2: #dfece3;
+    --mark-ink: #f4faf6;
+    --shadow: 0 18px 40px -28px rgba(20, 32, 26, 0.45);
+    --bg: radial-gradient(900px 480px at 12% -10%, #dfece3, transparent 60%),
+      radial-gradient(700px 420px at 100% 0%, #e7efe4, transparent 55%),
+      linear-gradient(165deg, #e8f0ea, #f7f5f0 55%, #eef2ef);
     --mark-bg: ${ok ? "var(--accent)" : "#8a4b3a"};
   }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --ink: #e9f0ec;
+      --muted: #a2b3aa;
+      --line: rgba(233, 240, 236, 0.14);
+      --panel: rgba(24, 31, 27, 0.72);
+      --field: rgba(233, 240, 236, 0.06);
+      --accent: #7cc39d;
+      --mark-ink: #0d1410;
+      --shadow: 0 18px 44px -26px rgba(0, 0, 0, 0.7);
+      --bg: radial-gradient(900px 480px at 12% -10%, #16261d, transparent 60%),
+        radial-gradient(700px 420px at 100% 0%, #16221c, transparent 55%),
+        linear-gradient(165deg, #0e1512, #121a15 55%, #0d130f);
+      --mark-bg: ${ok ? "var(--accent)" : "#e0a292"};
+    }
+  }
   * { box-sizing: border-box; }
   body {
     margin: 0;
     min-height: 100vh;
     font-family: "Segoe UI", "Helvetica Neue", ui-sans-serif, system-ui, sans-serif;
     color: var(--ink);
-    background:
-      radial-gradient(900px 480px at 12% -10%, var(--bg2), transparent 60%),
-      radial-gradient(700px 420px at 100% 0%, #e7efe4, transparent 55%),
-      linear-gradient(165deg, var(--bg0), var(--bg1) 55%, #eef2ef);
+    background: var(--bg);
     display: grid;
     place-items: center;
     padding: 1.5rem;
@@ -51,7 +67,7 @@ function loginCallbackPage(ok) {
     border-radius: 1.25rem;
     padding: 2rem 1.75rem 1.75rem;
     backdrop-filter: blur(10px);
-    box-shadow: 0 18px 40px -28px rgba(20, 32, 26, 0.45);
+    box-shadow: var(--shadow);
   }
   .mark {
     width: 2.75rem;
@@ -60,7 +76,7 @@ function loginCallbackPage(ok) {
     display: grid;
     place-items: center;
     background: var(--mark-bg);
-    color: #f4faf6;
+    color: var(--mark-ink);
     margin-bottom: 1.25rem;
   }
   .mark svg { width: 1.4rem; height: 1.4rem; display: block; }
@@ -98,7 +114,7 @@ function loginCallbackPage(ok) {
     padding: 0.1em 0.35em;
     border: 1px solid var(--line);
     border-radius: 0.35rem;
-    background: rgba(255, 255, 255, 0.7);
+    background: var(--field);
   }
 </style>
 </head>

package/dist/{package-27IYBxoU.mjs → package-DRp7sI6i.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.8";
+var version = "0.7.10";
 //#endregion
 export { version as t };

package/dist/{skill-7K_P-5oN.mjs → skill-B2sDMAmv.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-27IYBxoU.mjs";
+import { t as version } from "./package-DRp7sI6i.mjs";
 import { n as reportErrors } from "./ui-2mrJcjYC.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/templates/worker/.dev.vars.example

@@ -0,0 +1,9 @@
+# Local worker secrets for `canopy dev` — copy to .dev.vars (gitignored).
+#
+# Dashboard secrets (Settings → Secrets) are never downloaded: the platform
+# can't hand a stored value back, and live keys don't belong on a laptop. Set
+# local stand-ins here; the worker reads them as c.env.NAME, exactly as it
+# reads the dashboard's in production. `canopy dev` prints which dashboard
+# secret names this file is missing.
+#
+# MY_API_KEY=local-test-key

package/dist/templates/worker/AGENTS.md

@@ -28,6 +28,10 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   `event.name`). It runs behind the Canopy gateway (HTTP requests arrive
   authenticated) and reaches the platform through a service binding — same
   SDK, same budgets and data isolation as the browser.
+- `canopy dev` serves the worker as well: `/api/*` goes to
+  `worker/index.ts` with the same `env` it gets deployed, no build step. Tick a
+  schedule by hand with
+  `curl -X POST localhost:5173/__canopy/scheduled -d '{"name":"<schedule>"}'`.
 - The SDK comes from npm (`@mediamonks/canopy`) — the browser's shared
   instance lives in `src/canopy.ts`.
 - `canopy dev` uses LIVE project data: read freely, but take a
@@ -50,7 +54,9 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   reaches this app or the Worker.
 - Do not store secrets in the repo or SPA. Set them in the Canopy dashboard
   (Settings → Secrets); the Worker reads them as `c.env.SECRET_NAME`
-  (Workers-shaped bindings — not `process.env`). Platform access still goes
+  (Workers-shaped bindings — not `process.env`). Locally, put stand-in values
+  in `.dev.vars` (gitignored, see `.dev.vars.example`) — dashboard values are
+  never downloaded, and `canopy dev` prints which names are still missing. Platform access still goes
   through the Canopy SDK (`canopy.auth`, `canopy.db`, `canopy.blob`,
   `canopy.ai`) in both the browser and the Worker.
 - The Worker is the only backend: no SSR, no long-running processes, no

package/dist/templates/worker/README.md

@@ -5,7 +5,10 @@ backend Worker (`worker/`). Live (behind company login) at
 https://{{slug}}.thanarie.dev after the first `canopy deploy`.
 
 - `npm install` — once, then:
-- `canopy dev` — develop locally against the live platform (real data!)
+- `canopy dev` — develop locally against the live platform (real data!);
+  `/api/*` is served by `worker/index.ts`, everything else by the SPA
+- `.dev.vars` — local values for the worker's secrets (copy
+  `.dev.vars.example`); dashboard secrets are never downloaded
 - `canopy dev --local [--pull]` — offline sandbox with local data instead
 - `canopy deploy` — build and publish the frontend and the `worker/` backend
 - `AGENTS.md` — project guardrails and skill setup for coding agents

package/dist/templates/worker/_gitignore

@@ -1,4 +1,5 @@
 node_modules/
 dist/
 .canopy/
+.dev.vars
 .DS_Store

package/dist/{upgrade-CqADJbUX.mjs → upgrade-tOfSmAcc.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-7K_P-5oN.mjs");
+		const { skillInstalled } = await import("./skill-B2sDMAmv.mjs");
 		const refreshSkill = skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-CQq2uzSz.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-CxfnHPI4.mjs";
-export { devCommand };