percher 0.5.11 → 0.5.13

package/dist/bin/percher.js

@@ -106091,6 +106091,17 @@ class AppsResource {
   deployLatestCommit(appRef, input) {
     return this.http.post(`/apps/${encodeURIComponent(appRef)}/deploys/from-latest-commit`, input ?? {});
   }
+  publishFromGit(input) {
+    const params = new URLSearchParams;
+    params.set("url", input.url);
+    if (input.name)
+      params.set("name", input.name);
+    if (input.branch)
+      params.set("branch", input.branch);
+    if (input.note)
+      params.set("note", input.note);
+    return this.http.post(`/apps/publish-from-git?${params.toString()}`, {});
+  }
   setCrashAnalysisEnabled(appRef, enabled) {
     return this.http.put(`/apps/${encodeURIComponent(appRef)}/crash-analysis`, {
       crashAnalysisEnabled: enabled
@@ -106395,6 +106406,15 @@ class DataResource {
   getAdminLink(appRef) {
     return this.http.get(`/apps/${encodeURIComponent(appRef)}/data/admin-link`);
   }
+  setOAuthProvider(appRef, body) {
+    return this.http.post(`/apps/${encodeURIComponent(appRef)}/data/oauth`, body);
+  }
+  getOAuthStatus(appRef) {
+    return this.http.get(`/apps/${encodeURIComponent(appRef)}/data/oauth`);
+  }
+  removeOAuthProvider(appRef, provider) {
+    return this.http.delete(`/apps/${encodeURIComponent(appRef)}/data/oauth/${encodeURIComponent(provider)}`);
+  }
 }
 
 // ../client/dist/resources/env.js
@@ -106552,10 +106572,10 @@ class LogsResource {
     const query = buildLogFilterQuery(options ?? {}, { lines: String(lines) });
     return this.http.get(`/apps/${encodeURIComponent(appId)}/logs?${query}`);
   }
-  streamRaw(appRef, options) {
+  streamRaw(appRef, options, signal) {
     const query = buildLogFilterQuery(options ?? {});
     const suffix = query ? `?${query}` : "";
-    return this.http.stream(`/apps/${encodeURIComponent(appRef)}/logs/stream${suffix}`);
+    return this.http.stream(`/apps/${encodeURIComponent(appRef)}/logs/stream${suffix}`, signal);
   }
   async* stream(appId, options) {
     const query = buildLogFilterQuery(options ?? {});
@@ -106995,6 +107015,49 @@ async function dataExport(ctx, input) {
     exportedAt: new Date().toISOString()
   };
 }
+// ../core/dist/commands/data-oauth.js
+var dataOauthInputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  provider: exports_external.string().default("google"),
+  clientId: exports_external.string().optional(),
+  clientSecret: exports_external.string().optional(),
+  remove: exports_external.boolean().optional(),
+  json: exports_external.boolean().optional()
+});
+async function dataOauth(ctx, input = { provider: "google" }) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  const provider = input.provider || "google";
+  if (input.remove) {
+    await ctx.client.data.removeOAuthProvider(name, provider);
+    return { action: "removed", provider };
+  }
+  if (input.clientId && input.clientSecret) {
+    const res = await ctx.client.data.setOAuthProvider(name, {
+      provider,
+      clientId: input.clientId,
+      clientSecret: input.clientSecret
+    });
+    return {
+      action: "set",
+      provider: res.provider,
+      redirectUri: res.redirectUri,
+      note: res.note
+    };
+  }
+  const status = await ctx.client.data.getOAuthStatus(name);
+  return {
+    action: "status",
+    provider,
+    providers: status.providers,
+    redirectUri: status.redirectUri
+  };
+}
 // ../core/dist/commands/delete.js
 var deleteInputSchema = exports_external.object({
   app: exports_external.string().optional().describe("App name to delete (defaults to percher.toml app name)"),
@@ -109928,12 +109991,12 @@ import { basename as basename3, join as join17 } from "node:path";
 // ../core/dist/detect.js
 import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
 import { join as join16 } from "node:path";
-function exists(dir, ...names) {
-  return names.some((n) => existsSync12(join16(dir, n)));
-}
-function readJson(path) {
+function readPackageJson(src) {
+  const raw = src.text("package.json");
+  if (raw === null)
+    return null;
   try {
-    return JSON.parse(readFileSync9(path, "utf8"));
+    return JSON.parse(raw);
   } catch {
     return null;
   }
@@ -109945,8 +110008,8 @@ function hasDependency(pkg, name) {
   const dev2 = pkg.devDependencies ?? {};
   return name in deps || name in dev2;
 }
-function detectDataMode(pkg, cwd) {
-  if (exists(cwd, "convex.json", "convex/_generated")) {
+function detectDataMode(pkg, src) {
+  if (src.has("convex.json", "convex/_generated")) {
     return { mode: "convex" };
   }
   if (hasDependency(pkg, "convex")) {
@@ -109957,36 +110020,35 @@ function detectDataMode(pkg, cwd) {
   }
   return { mode: "none" };
 }
-async function detectFramework(cwd) {
-  const pkgPath = join16(cwd, "package.json");
-  const pkg = existsSync12(pkgPath) ? readJson(pkgPath) : null;
-  if (exists(cwd, "Dockerfile")) {
+function detectFromSource(src) {
+  const pkg = readPackageJson(src);
+  if (src.has("Dockerfile")) {
     return {
       runtime: "docker",
       framework: "docker",
       web: { port: 8080, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
-  if (exists(cwd, "next.config.js", "next.config.ts", "next.config.mjs")) {
+  if (src.has("next.config.js", "next.config.ts", "next.config.mjs")) {
     return {
       runtime: "node",
       framework: "nextjs",
       build: { command: "bun run build", output: ".next" },
       web: { port: 3000, health: "/api/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
-  if (exists(cwd, "svelte.config.js", "svelte.config.ts")) {
+  if (src.has("svelte.config.js", "svelte.config.ts")) {
     return {
       runtime: "node",
       framework: "sveltekit",
       build: { command: "bun run build", output: "build" },
       web: { port: 3000, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
-  if (exists(cwd, "astro.config.mjs", "astro.config.ts", "astro.config.js")) {
+  if (src.has("astro.config.mjs", "astro.config.ts", "astro.config.js")) {
     const ssr = hasDependency(pkg, "@astrojs/node");
     if (ssr) {
       return {
@@ -109994,7 +110056,7 @@ async function detectFramework(cwd) {
         framework: "astro",
         build: { command: "bun run build", output: "dist" },
         web: { port: 4321, health: "/health" },
-        data: detectDataMode(pkg, cwd)
+        data: detectDataMode(pkg, src)
       };
     }
     return {
@@ -110002,25 +110064,25 @@ async function detectFramework(cwd) {
       framework: "astro",
       web: { port: STATIC_DOCKER_PORT, health: "/" },
       staticBuild: { outputDir: "dist", spa: false },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
-  if (exists(cwd, "remix.config.js", "remix.config.ts") || hasDependency(pkg, "@remix-run/node")) {
+  if (src.has("remix.config.js", "remix.config.ts") || hasDependency(pkg, "@remix-run/node")) {
     return {
       runtime: "node",
       framework: "remix",
       build: { command: "bun run build", output: "build" },
       web: { port: 3000, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
-  if (exists(cwd, "vite.config.js", "vite.config.ts")) {
+  if (src.has("vite.config.js", "vite.config.ts")) {
     return {
       runtime: "docker",
       framework: "vite",
       web: { port: STATIC_DOCKER_PORT, health: "/" },
       staticBuild: { outputDir: "dist", spa: true },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
   if (hasDependency(pkg, "express")) {
@@ -110028,7 +110090,7 @@ async function detectFramework(cwd) {
       runtime: "node",
       framework: "express",
       web: { port: 3000, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
   if (hasDependency(pkg, "fastify")) {
@@ -110036,7 +110098,7 @@ async function detectFramework(cwd) {
       runtime: "node",
       framework: "fastify",
       web: { port: 3000, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
   if (hasDependency(pkg, "hono")) {
@@ -110044,14 +110106,14 @@ async function detectFramework(cwd) {
       runtime: "node",
       framework: "hono",
       web: { port: 3000, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
   if (pkg) {
     const detected = {
       runtime: "node",
       web: { port: 3000, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
     const scripts = pkg.scripts ?? {};
     if (scripts.build) {
@@ -110059,65 +110121,64 @@ async function detectFramework(cwd) {
     }
     return detected;
   }
-  const hasPython = exists(cwd, "requirements.txt", "pyproject.toml");
+  const hasPython = src.has("requirements.txt", "pyproject.toml");
   if (hasPython) {
-    if (existsSync12(join16(cwd, "manage.py"))) {
+    if (src.has("manage.py")) {
       return {
         runtime: "python",
         framework: "django",
         web: { port: 8000, health: "/health" },
-        data: detectDataMode(pkg, cwd)
+        data: detectDataMode(pkg, src)
       };
     }
-    const mainPy = existsSync12(join16(cwd, "main.py")) ? readFileSync9(join16(cwd, "main.py"), "utf8") : "";
+    const mainPy = src.text("main.py") ?? "";
     if (/FastAPI\s*\(/.test(mainPy) || /from\s+fastapi/.test(mainPy)) {
       return {
         runtime: "python",
         framework: "fastapi",
         web: { port: 8000, health: "/health" },
-        data: detectDataMode(pkg, cwd)
+        data: detectDataMode(pkg, src)
       };
     }
-    const appPy = existsSync12(join16(cwd, "app.py")) ? readFileSync9(join16(cwd, "app.py"), "utf8") : "";
+    const appPy = src.text("app.py") ?? "";
     if (/Flask\s*\(/.test(appPy) || /from\s+flask/.test(appPy)) {
       return {
         runtime: "python",
         framework: "flask",
         web: { port: 5000, health: "/health" },
-        data: detectDataMode(pkg, cwd)
+        data: detectDataMode(pkg, src)
       };
     }
     return {
       runtime: "python",
       web: { port: 8000, health: "/health" },
-      data: detectDataMode(pkg, cwd)
+      data: detectDataMode(pkg, src)
     };
   }
-  if (existsSync12(join16(cwd, "index.html"))) {
+  if (src.has("index.html")) {
     return { runtime: "static" };
   }
   return null;
 }
+async function detectFramework(cwd) {
+  const src = {
+    has: (...names) => names.some((n) => existsSync12(join16(cwd, n))),
+    text: (name) => {
+      try {
+        return readFileSync9(join16(cwd, name), "utf8");
+      } catch {
+        return null;
+      }
+    }
+  };
+  return detectFromSource(src);
+}
 function refineBunRuntime(detected, cwd) {
-  if (detected.runtime === "node" && exists(cwd, "bun.lockb", "bun.lock")) {
+  if (detected.runtime === "node" && (existsSync12(join16(cwd, "bun.lockb")) || existsSync12(join16(cwd, "bun.lock")))) {
     return { ...detected, runtime: "bun" };
   }
   return detected;
 }
-
-// ../core/dist/commands/init.js
-function isSuspiciousAutoName(name) {
-  if (/-\d{8,}$/.test(name))
-    return true;
-  if (/\d{4}-?\d{2}-?\d{2}/.test(name))
-    return true;
-  if (name.length >= 30)
-    return true;
-  return false;
-}
-function detectInteractive() {
-  return process.stdin?.isTTY === true && process.stdout?.isTTY === true;
-}
 function buildDataConfig(mode) {
   if (mode === "convex") {
     return {
@@ -110133,6 +110194,32 @@ function buildDataConfig(mode) {
   }
   return { mode };
 }
+function configFromDetection(name, detected, dataMode) {
+  return {
+    app: {
+      name,
+      runtime: detected?.runtime ?? "node",
+      ...detected?.framework ? { framework: detected.framework } : {}
+    },
+    ...detected?.build ? { build: detected.build } : {},
+    ...detected?.web ? { web: detected.web } : {},
+    ...detected?.data || dataMode ? { data: buildDataConfig(dataMode ?? detected?.data?.mode ?? "none") } : {}
+  };
+}
+
+// ../core/dist/commands/init.js
+function isSuspiciousAutoName(name) {
+  if (/-\d{8,}$/.test(name))
+    return true;
+  if (/\d{4}-?\d{2}-?\d{2}/.test(name))
+    return true;
+  if (name.length >= 30)
+    return true;
+  return false;
+}
+function detectInteractive() {
+  return process.stdin?.isTTY === true && process.stdout?.isTTY === true;
+}
 var initInputSchema = exports_external.object({
   force: exports_external.boolean().optional(),
   name: exports_external.string().optional(),
@@ -110144,8 +110231,8 @@ function scanEnvVars(_cwd) {
 }
 async function init(ctx, input = {}) {
   const path = join17(ctx.cwd, "percher.toml");
-  const exists2 = existsSync13(path);
-  if (exists2 && !input.force) {
+  const exists = existsSync13(path);
+  if (exists && !input.force) {
     throw new PercherCoreError("percher.toml already exists", {
       code: "init.exists",
       hint: "Run with --force to overwrite."
@@ -110175,18 +110262,7 @@ async function init(ctx, input = {}) {
       name = suggestion;
     }
   }
-  const config2 = {
-    app: {
-      name,
-      runtime: detected?.runtime ?? "node",
-      ...detected?.framework ? { framework: detected.framework } : {}
-    },
-    ...detected?.build ? { build: detected.build } : {},
-    ...detected?.web ? { web: detected.web } : {},
-    ...detected?.data || input.dataMode ? {
-      data: buildDataConfig(input.dataMode ?? detected?.data?.mode ?? "none")
-    } : {}
-  };
+  const config2 = configFromDetection(name, detected, input.dataMode);
   const envVars = scanEnvVars(ctx.cwd);
   if (Object.keys(envVars).length > 0) {
     config2.env = envVars;
@@ -110218,7 +110294,7 @@ async function init(ctx, input = {}) {
     path,
     config: config2,
     detected,
-    overwritten: exists2,
+    overwritten: exists,
     scaffoldedFiles
   };
 }
@@ -114565,6 +114641,27 @@ function tomlErrorToRecoveryProblems(err) {
 // ../core/dist/commands/env-scan.js
 import { readdirSync as readdirSync3, readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
 import { join as join22 } from "node:path";
+function platformInjectedClientEnvKeys(config2) {
+  const data2 = config2.data;
+  if (!data2)
+    return [];
+  switch (data2.mode) {
+    case "pocketbase":
+      return ["VITE_POCKETBASE_URL", "VITE_PERCHER_AI_URL"];
+    case "convex":
+      return data2.convex?.deployment_url ? ["VITE_CONVEX_URL"] : [];
+    case "supabase": {
+      const keys = [];
+      if (data2.supabase?.url)
+        keys.push("VITE_SUPABASE_URL");
+      if (data2.supabase?.anon_key)
+        keys.push("VITE_SUPABASE_ANON_KEY");
+      return keys;
+    }
+    default:
+      return [];
+  }
+}
 var SOURCE_EXTS = new Set([
   ".ts",
   ".tsx",
@@ -115264,6 +115361,8 @@ ${bullets}`,
   let missingBuildEnvKeys = [];
   try {
     const existingEnvKeys = new Set(Object.keys(await ctx.client.env.list(app.id)));
+    for (const k of platformInjectedClientEnvKeys(config2))
+      existingEnvKeys.add(k);
     missingBuildEnvKeys = scanForMissingBuildEnvRefs(ctx.cwd, existingEnvKeys);
   } catch {}
   if (missingBuildEnvKeys.length > 0 && !input.force) {
@@ -115786,13 +115885,22 @@ function emitPreflight(ctx, config2, tarball) {
     ctx.status(line);
   }
 }
+// ../core/dist/commands/publish-from-repo.js
+var publishFromRepoInputSchema = exports_external.object({
+  url: exports_external.string().min(1).describe("Public https git repo URL to clone and deploy (one-shot — no webhook is created)."),
+  name: exports_external.string().optional().describe("App name. Overrides the repo's percher.toml [app].name; required if the repo omits it."),
+  branch: exports_external.string().optional().describe("Branch to deploy. Defaults to main."),
+  note: exports_external.string().optional().describe("Optional note recorded against the deploy."),
+  waitForLive: exports_external.boolean().optional().describe("If false (default on the hosted connector), returns once the deploy is queued — resume with percher_wait_for_deploy. If true, block until live or failed.")
+});
 // ../core/dist/commands/publish-inline.js
 var publishInlineInputSchema = exports_external.object({
-  name: exports_external.string().optional().describe("Override the app name from percher.toml. Optional when percher.toml sets [app].name."),
+  name: exports_external.string().optional().describe("App name. Overrides [app].name when percher.toml is present; REQUIRED when no percher.toml is provided (so the auto-detected app can be named)."),
   files: exports_external.array(exports_external.object({
     path: exports_external.string().min(1).describe("Repo-relative path (no leading / and no ..)."),
-    content: exports_external.string().describe("UTF-8 file contents.")
-  })).min(1).describe("Inline source files. MUST include a percher.toml."),
+    content: exports_external.string().describe("File contents — UTF-8 text, or base64-encoded bytes when encoding is 'base64'."),
+    encoding: exports_external.enum(["utf8", "base64"]).optional().describe("Content encoding. Default 'utf8' (text). Use 'base64' for binary assets (images, fonts).")
+  })).min(1).describe("Inline source files. Include a percher.toml ([app].name + runtime), or omit it and Percher auto-detects the runtime from the files (then `name` is required)."),
   preview: exports_external.boolean().optional().describe("Deploy as a preview (does not replace the live version)."),
   message: exports_external.string().optional().describe("Deploy note (visible in deploy history)."),
   noCache: exports_external.boolean().optional().describe("Skip the image cache and force a fresh build."),
@@ -118187,7 +118295,7 @@ function registerAuthCommands(cli, ctx) {
 // src/commands/data.ts
 var import_picocolors6 = __toESM(require_picocolors(), 1);
 function registerDataCommands(cli, ctx, argv) {
-  cli.command("data [app] [...rest]", "Show app data status and collections").option("--json", "Output as JSON").option("--reveal", "(reset-superuser only) also print the plaintext password once").option("--out <path>", "(export only) Output file (default: ./<app>-pb-<timestamp>.tar.gz)").action(async (app, _rest, options) => {
+  cli.command("data [app] [...rest]", "Show app data status and collections").option("--json", "Output as JSON").option("--reveal", "(reset-superuser only) also print the plaintext password once").option("--out <path>", "(export only) Output file (default: ./<app>-pb-<timestamp>.tar.gz)").option("--provider <name>", "(oauth only) OAuth provider (default: google)").option("--app <name>", "(oauth only) target app (default: read percher.toml)").option("--client-id <id>", "(oauth only) OAuth client id").option("--client-secret <secret>", "(oauth only) OAuth client secret").option("--remove", "(oauth only) remove the provider instead of setting it").action(async (app, _rest, options) => {
     if (app === "reset-superuser") {
       const idx = argv.indexOf("reset-superuser");
       const realApp = idx >= 0 ? firstNonFlagAfter(argv, idx) : undefined;
@@ -118208,6 +118316,37 @@ function registerDataCommands(cli, ctx, argv) {
       await writeLine(ctx, `  Size: ${mb} MB`);
       return;
     }
+    if (app === "oauth") {
+      const idx = argv.indexOf("oauth");
+      const provider = (idx >= 0 ? firstNonFlagAfter(argv, idx) : undefined) ?? options.provider ?? "google";
+      const result2 = await dataOauth(ctx, {
+        app: options.app,
+        provider,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        remove: options.remove
+      });
+      if (result2.action === "removed") {
+        await writeLine(ctx, `${import_picocolors6.default.green("✓")} Removed ${result2.provider} sign-in.`);
+      } else if (result2.action === "set") {
+        await writeLine(ctx, `${import_picocolors6.default.green("✓")} ${result2.provider} sign-in enabled.`);
+        await writeLine(ctx, "");
+        await writeLine(ctx, import_picocolors6.default.bold("One more step — add this redirect URI in the provider console:"));
+        await writeLine(ctx, `  ${result2.redirectUri}`);
+      } else {
+        if (!result2.providers?.length) {
+          await writeLine(ctx, import_picocolors6.default.dim("No OAuth providers configured."));
+        } else {
+          await writeLine(ctx, import_picocolors6.default.bold("Configured providers"));
+          for (const p of result2.providers) {
+            await writeLine(ctx, `  ${p.provider.padEnd(12)} ${import_picocolors6.default.dim(p.clientId)}`);
+          }
+        }
+        await writeLine(ctx, "");
+        await writeLine(ctx, `Redirect URI: ${result2.redirectUri}`);
+      }
+      return;
+    }
     const result = await data(ctx, { app, json: options.json });
     if (options.json) {
       await writeLine(ctx, JSON.stringify(result, null, 2));
@@ -118237,6 +118376,7 @@ function registerDataCommands(cli, ctx, argv) {
     const result = await resetSuperuser(ctx, { app, reveal: options.reveal });
     await printSuperuserResetResult(ctx, result);
   });
+  cli.command("data oauth [provider]", "Configure capsule OAuth sign-in (e.g. `data oauth google --client-id … --client-secret …`)").action(async () => {});
   cli.command("data export [app]", "Download a snapshot of your app's PocketBase data as a .tar.gz").action(async () => {});
   cli.command("backups [app]", "List available backups for an app").action(async (app) => {
     const { backups, skipped } = await listBackups(ctx, { app });
@@ -119191,7 +119331,7 @@ async function renderError(stderr, error48) {
 // package.json
 var package_default = {
   name: "percher",
-  version: "0.5.11",
+  version: "0.5.13",
   description: "CLI for the Percher hosting platform — publish apps with one command",
   type: "module",
   bin: {
@@ -119215,8 +119355,8 @@ var package_default = {
     typecheck: "tsc --noEmit"
   },
   dependencies: {
-    "@percher/client": "^0.2.10",
-    "@percher/core": "^0.4.5",
+    "@percher/client": "^0.2.16",
+    "@percher/core": "^0.4.17",
     "@percher/toml": "^0.1.5",
     cac: "^7.0.0",
     picocolors: "^1.1.1"

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "percher",
-    "version": "0.5.11",
+    "version": "0.5.13",
     "description": "CLI for the Percher hosting platform \u2014 publish apps with one command",
     "type": "module",
     "bin": {
@@ -24,8 +24,8 @@
         "typecheck": "tsc --noEmit"
     },
     "dependencies": {
-        "@percher/client": "^0.2.10",
-        "@percher/core": "^0.4.5",
+        "@percher/client": "^0.2.16",
+        "@percher/core": "^0.4.17",
         "@percher/toml": "^0.1.5",
         "cac": "^7.0.0",
         "picocolors": "^1.1.1"

package/dist/src/commands/data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../../src/commands/data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAI/B,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CA4LjF"}
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../../src/commands/data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAI/B,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAkPjF"}

package/dist/src/commands/data.js

@@ -15,6 +15,11 @@ export function registerDataCommands(cli, ctx, argv) {
         .option("--json", "Output as JSON")
         .option("--reveal", "(reset-superuser only) also print the plaintext password once")
         .option("--out <path>", "(export only) Output file (default: ./<app>-pb-<timestamp>.tar.gz)")
+        .option("--provider <name>", "(oauth only) OAuth provider (default: google)")
+        .option("--app <name>", "(oauth only) target app (default: read percher.toml)")
+        .option("--client-id <id>", "(oauth only) OAuth client id")
+        .option("--client-secret <secret>", "(oauth only) OAuth client secret")
+        .option("--remove", "(oauth only) remove the provider instead of setting it")
         .action(async (app, _rest, options) => {
         // cac matches commands by single first-token equality, so
         // `percher data reset-superuser <app>` would otherwise hit this
@@ -49,6 +54,43 @@ export function registerDataCommands(cli, ctx, argv) {
             await writeLine(ctx, `  Size: ${mb} MB`);
             return;
         }
+        if (app === "oauth") {
+            // The positional after `oauth` is the PROVIDER — `percher data oauth
+            // google` (as advertised), NOT an app name. The app comes from `--app`
+            // or percher.toml (the capsule flow runs from the app dir).
+            const idx = argv.indexOf("oauth");
+            const provider = (idx >= 0 ? firstNonFlagAfter(argv, idx) : undefined) ?? options.provider ?? "google";
+            const result = await core.dataOauth(ctx, {
+                app: options.app,
+                provider,
+                clientId: options.clientId,
+                clientSecret: options.clientSecret,
+                remove: options.remove,
+            });
+            if (result.action === "removed") {
+                await writeLine(ctx, `${pc.green("✓")} Removed ${result.provider} sign-in.`);
+            }
+            else if (result.action === "set") {
+                await writeLine(ctx, `${pc.green("✓")} ${result.provider} sign-in enabled.`);
+                await writeLine(ctx, "");
+                await writeLine(ctx, pc.bold("One more step — add this redirect URI in the provider console:"));
+                await writeLine(ctx, `  ${result.redirectUri}`);
+            }
+            else {
+                if (!result.providers?.length) {
+                    await writeLine(ctx, pc.dim("No OAuth providers configured."));
+                }
+                else {
+                    await writeLine(ctx, pc.bold("Configured providers"));
+                    for (const p of result.providers) {
+                        await writeLine(ctx, `  ${p.provider.padEnd(12)} ${pc.dim(p.clientId)}`);
+                    }
+                }
+                await writeLine(ctx, "");
+                await writeLine(ctx, `Redirect URI: ${result.redirectUri}`);
+            }
+            return;
+        }
         const result = await core.data(ctx, { app, json: options.json });
         if (options.json) {
             await writeLine(ctx, JSON.stringify(result, null, 2));
@@ -85,6 +127,12 @@ export function registerDataCommands(cli, ctx, argv) {
         const result = await core.resetSuperuser(ctx, { app, reveal: options.reveal });
         await printSuperuserResetResult(ctx, result);
     });
+    cli
+        .command("data oauth [provider]", "Configure capsule OAuth sign-in (e.g. `data oauth google --client-id … --client-secret …`)")
+        .action(async () => {
+        // Unreachable in practice — handled by the "data [app] [...rest]" action
+        // above via the `app === "oauth"` branch. Registered here so --help lists it.
+    });
     cli
         .command("data export [app]", "Download a snapshot of your app's PocketBase data as a .tar.gz")
         // --out is registered on the parent `data [app] [...rest]` so cac

package/dist/src/commands/data.js.map

@@ -1 +1 @@
-{"version":3,"file":"data.js","sourceRoot":"","sources":["../../../src/commands/data.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEvF,MAAM,UAAU,oBAAoB,CAAC,GAAQ,EAAE,GAAY,EAAE,IAAc;IACzE,GAAG;QACD,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,gEAAgE;SAC/D,OAAO,CAAC,sBAAsB,EAAE,sCAAsC,CAAC;SACvE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,EAAE,+DAA+D,CAAC;SACnF,MAAM,CAAC,cAAc,EAAE,oEAAoE,CAAC;SAC5F,MAAM,CAAC,KAAK,EAAE,GAAuB,EAAE,KAAe,EAAE,OAAO,EAAE,EAAE;QAClE,0DAA0D;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,+DAA+D;QAC/D,uDAAuD;QACvD,+DAA+D;QAC/D,2DAA2D;QAC3D,0CAA0C;QAC1C,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,8DAA8D;YAC9D,yCAAyC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,MAAM,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAChE,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,MAAM,GAAG,OAAO,EAAE,CAC/E,CAAC;YACF,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAEzB,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3B,CAAC;YAED,MAAM,SAAS,CACb,GAAG,EACH,gBAAgB,MAAM,CAAC,KAAK,CAAC,WAAW,cAAc,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAClF,CAAC;YAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzB,MAAM,SAAS,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,4BAA4B,EAAE,uDAAuD,CAAC;SAC9F,MAAM,CAAC,UAAU,EAAE,0DAA0D,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,GAAuB,EAAE,OAA6B,EAAE,EAAE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,MAAM,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,mBAAmB,EAAE,gEAAgE,CAAC;QAC/F,kEAAkE;QAClE,2EAA2E;QAC3E,sEAAsE;QACtE,gEAAgE;SAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,wBAAwB;IAC1B,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,eAAe,EAAE,mCAAmC,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,GAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,qCAAqC,CAAC,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,IAAI,GACR,CAAC,CAAC,kBAAkB,GAAG,IAAI,GAAG,IAAI;gBAChC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,GAAG,IAAI,CAAC,KAAK;gBACjD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAChE,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,CACb,GAAG,EACH,EAAE,CAAC,MAAM,CACP,KAAK,OAAO,CAAC,MAAM,oEAAoE,CACxF,CACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;SACxE,MAAM,CAAC,qBAAqB,EAAE,qDAAqD,CAAC;SACpF,MAAM,CAAC,WAAW,EAAE,8CAA8C,CAAC;SACnE,MAAM,CACL,KAAK,EACH,MAAc,EACd,GAAuB,EACvB,OAAkD,EAClD,EAAE;QACF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;YACnC,CAAC,CAAE,OAAO,CAAC,UAAU;iBAChB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,YAAY,CAAkC;YAC1F,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACrC,GAAG;YACH,MAAM;YACN,UAAU;YACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;SAChC,CAAC,CAAC;QAEH,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAC9G,CAAC;YACF,MAAM,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACpF,MAAM,SAAS,CACb,GAAG,EACH,gBAAgB,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;YACF,MAAM,SAAS,CACb,GAAG,EACH,EAAE,CAAC,GAAG,CAAC,0EAA0E,CAAC,CACnF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,cAAc,SAAS,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAC1F,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../../src/commands/data.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEvF,MAAM,UAAU,oBAAoB,CAAC,GAAQ,EAAE,GAAY,EAAE,IAAc;IACzE,GAAG;QACD,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,gEAAgE;SAC/D,OAAO,CAAC,sBAAsB,EAAE,sCAAsC,CAAC;SACvE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,EAAE,+DAA+D,CAAC;SACnF,MAAM,CAAC,cAAc,EAAE,oEAAoE,CAAC;SAC5F,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,cAAc,EAAE,sDAAsD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;SAC1D,MAAM,CAAC,0BAA0B,EAAE,kCAAkC,CAAC;SACtE,MAAM,CAAC,UAAU,EAAE,wDAAwD,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,GAAuB,EAAE,KAAe,EAAE,OAAO,EAAE,EAAE;QAClE,0DAA0D;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,+DAA+D;QAC/D,uDAAuD;QACvD,+DAA+D;QAC/D,2DAA2D;QAC3D,0CAA0C;QAC1C,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,8DAA8D;YAC9D,yCAAyC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,MAAM,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAChE,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,qEAAqE;YACrE,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,QAAQ,GACZ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;YACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACvC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;YAC/E,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,mBAAmB,CAAC,CAAC;gBAC7E,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzB,MAAM,SAAS,CACb,GAAG,EACH,EAAE,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAC1E,CAAC;gBACF,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;oBAC9B,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;oBACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;wBACjC,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC3E,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzB,MAAM,SAAS,CAAC,GAAG,EAAE,iBAAiB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,MAAM,GAAG,OAAO,EAAE,CAC/E,CAAC;YACF,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAEzB,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3B,CAAC;YAED,MAAM,SAAS,CACb,GAAG,EACH,gBAAgB,MAAM,CAAC,KAAK,CAAC,WAAW,cAAc,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAClF,CAAC;YAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzB,MAAM,SAAS,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,4BAA4B,EAAE,uDAAuD,CAAC;SAC9F,MAAM,CAAC,UAAU,EAAE,0DAA0D,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,GAAuB,EAAE,OAA6B,EAAE,EAAE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,MAAM,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CACN,uBAAuB,EACvB,4FAA4F,CAC7F;SACA,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,yEAAyE;QACzE,8EAA8E;IAChF,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,mBAAmB,EAAE,gEAAgE,CAAC;QAC/F,kEAAkE;QAClE,2EAA2E;QAC3E,sEAAsE;QACtE,gEAAgE;SAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,wBAAwB;IAC1B,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,eAAe,EAAE,mCAAmC,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,GAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,qCAAqC,CAAC,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,IAAI,GACR,CAAC,CAAC,kBAAkB,GAAG,IAAI,GAAG,IAAI;gBAChC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,GAAG,IAAI,CAAC,KAAK;gBACjD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAChE,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,CACb,GAAG,EACH,EAAE,CAAC,MAAM,CACP,KAAK,OAAO,CAAC,MAAM,oEAAoE,CACxF,CACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;SACxE,MAAM,CAAC,qBAAqB,EAAE,qDAAqD,CAAC;SACpF,MAAM,CAAC,WAAW,EAAE,8CAA8C,CAAC;SACnE,MAAM,CACL,KAAK,EACH,MAAc,EACd,GAAuB,EACvB,OAAkD,EAClD,EAAE;QACF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;YACnC,CAAC,CAAE,OAAO,CAAC,UAAU;iBAChB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,YAAY,CAAkC;YAC1F,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACrC,GAAG;YACH,MAAM;YACN,UAAU;YACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;SAChC,CAAC,CAAC;QAEH,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAC9G,CAAC;YACF,MAAM,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACpF,MAAM,SAAS,CACb,GAAG,EACH,gBAAgB,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;YACF,MAAM,SAAS,CACb,GAAG,EACH,EAAE,CAAC,GAAG,CAAC,0EAA0E,CAAC,CACnF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CACb,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,cAAc,SAAS,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAC1F,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/templates/capsule/Caddyfile

@@ -0,0 +1,7 @@
+:8080 {
+	bind 0.0.0.0
+	root * /srv
+	encode gzip zstd
+	try_files {path} /index.html
+	file_server
+}

package/dist/templates/capsule/Dockerfile

@@ -0,0 +1,39 @@
+# Capsule build: a Bun stage compiles the static Preact bundle, then a minimal
+# Caddy image serves it. runtime = "docker" (not "static") because the static
+# runtime serves pre-built files only — it does not run a build command.
+# Generated by Percher; safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+# Percher injects VITE_POCKETBASE_URL (the app's own pb-<app>.<suffix> origin)
+# as a build-arg. A runtime=docker build only sees it if the Dockerfile DECLARES
+# the ARG before the build — without this, db.ts compiles against `undefined`.
+ARG VITE_POCKETBASE_URL
+ENV VITE_POCKETBASE_URL=$VITE_POCKETBASE_URL
+# Managed inference endpoint (Slice 3) — also a public URL, baked in the same way.
+ARG VITE_PERCHER_AI_URL
+ENV VITE_PERCHER_AI_URL=$VITE_PERCHER_AI_URL
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file caps.
+# Percher runs every container with --security-opt no-new-privileges, which
+# makes execve refuse a cap-bearing binary. Strip the caps with setcap -r —
+# Caddy listens on :8080 (>= 1024) and never needs the cap.
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its XDG state
+# under Percher's read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/capsule/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>__APP_NAME__</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/dist/templates/capsule/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "__APP_NAME__",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "pocketbase": "^0.26.0",
+    "preact": "^10.22.0"
+  },
+  "devDependencies": {
+    "@preact/preset-vite": "^2.9.0",
+    "typescript": "^5.5.0",
+    "vite": "^5.3.0"
+  }
+}

package/dist/templates/capsule/pb/schema.json

@@ -0,0 +1,18 @@
+{
+  "version": 1,
+  "collections": [
+    {
+      "name": "messages",
+      "type": "base",
+      "fields": [
+        { "name": "text", "type": "text", "required": true, "max": 500 },
+        { "name": "author", "type": "text", "required": true }
+      ],
+      "listRule": "",
+      "viewRule": "",
+      "createRule": "@request.auth.id != \"\"",
+      "updateRule": "author = @request.auth.id",
+      "deleteRule": "author = @request.auth.id"
+    }
+  ]
+}

package/dist/templates/capsule/percher.toml

@@ -0,0 +1,13 @@
+[app]
+name = "__APP_NAME__"
+runtime = "docker"
+framework = "vite"
+
+[web]
+port = 8080
+health = "/"
+
+# A capsule auto-provisions a PocketBase sidecar (db + auth + realtime + file
+# storage). Percher applies pb/schema.json before the app goes live.
+[data]
+mode = "pocketbase"

package/dist/templates/capsule/src/App.tsx

@@ -0,0 +1,65 @@
+import { useEffect, useState } from "preact/hooks";
+import { Auth } from "./components/Auth";
+import { db, pb } from "./lib/db";
+import { subscribe } from "./lib/realtime";
+
+interface Message {
+  id: string;
+  text: string;
+  author: string;
+}
+
+// The guestbook demo — email/password sign-in + db + realtime, working the
+// moment `scaffold → publish` finishes (Percher provisions the schema before
+// the app goes live). Only signed-in users can post (pb/schema.json createRule);
+// each row is owner-editable (updateRule/deleteRule key off author).
+export function App() {
+  const [messages, setMessages] = useState<Message[]>([]);
+  const [text, setText] = useState("");
+  // Force a re-render when auth state changes (sign in/out).
+  const [, bump] = useState(0);
+
+  async function load() {
+    setMessages(await db.collection<Message>("messages").getFullList());
+  }
+
+  useEffect(() => {
+    load();
+    const off = subscribe<Message>("messages", () => load());
+    return () => {
+      void off.then((fn) => fn());
+    };
+  }, []);
+
+  async function post() {
+    const author = pb.authStore.record?.id;
+    if (!author || !text.trim()) return;
+    await db.collection("messages").create({ text, author });
+    setText("");
+  }
+
+  return (
+    <main style={{ fontFamily: "system-ui", padding: 40, maxWidth: 640, margin: "0 auto" }}>
+      <h1>__APP_NAME__</h1>
+      <p>A Percher capsule — PocketBase db + auth + realtime, pre-wired.</p>
+      <Auth onChange={() => bump((n) => n + 1)} />
+      {pb.authStore.isValid && (
+        <div style={{ display: "flex", gap: 8, margin: "16px 0" }}>
+          <input
+            value={text}
+            placeholder="Leave a message"
+            onInput={(e) => setText((e.target as HTMLInputElement).value)}
+          />
+          <button type="button" onClick={post}>
+            Post
+          </button>
+        </div>
+      )}
+      <ul>
+        {messages.map((m) => (
+          <li key={m.id}>{m.text}</li>
+        ))}
+      </ul>
+    </main>
+  );
+}

package/dist/templates/capsule/src/components/Auth.tsx

@@ -0,0 +1,75 @@
+import { useState } from "preact/hooks";
+import { pb } from "../lib/db";
+import { SignInWithGoogle } from "./SignInWithGoogle";
+
+/**
+ * Email/password sign-up + sign-in against PocketBase's built-in `users` auth
+ * collection — works on day one with ZERO provider config. Google sign-in is a
+ * convenience added on top (Slice 2), never a prerequisite.
+ */
+export function Auth({ onChange }: { onChange?: () => void }) {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState("");
+
+  async function signIn() {
+    setError("");
+    try {
+      await pb.collection("users").authWithPassword(email, password);
+      onChange?.();
+    } catch (e) {
+      setError((e as Error).message);
+    }
+  }
+  async function signUp() {
+    setError("");
+    try {
+      await pb.collection("users").create({ email, password, passwordConfirm: password });
+      await signIn();
+    } catch (e) {
+      setError((e as Error).message);
+    }
+  }
+  function signOut() {
+    pb.authStore.clear();
+    onChange?.();
+  }
+
+  if (pb.authStore.isValid) {
+    return (
+      <div>
+        <span>Signed in as {pb.authStore.record?.email}</span>{" "}
+        <button type="button" onClick={signOut}>
+          Sign out
+        </button>
+      </div>
+    );
+  }
+
+  return (
+    <div style={{ display: "grid", gap: 8, maxWidth: 280 }}>
+      <input
+        type="email"
+        placeholder="Email"
+        value={email}
+        onInput={(e) => setEmail((e.target as HTMLInputElement).value)}
+      />
+      <input
+        type="password"
+        placeholder="Password"
+        value={password}
+        onInput={(e) => setPassword((e.target as HTMLInputElement).value)}
+      />
+      <div style={{ display: "flex", gap: 8 }}>
+        <button type="button" onClick={signIn}>
+          Sign in
+        </button>
+        <button type="button" onClick={signUp}>
+          Sign up
+        </button>
+      </div>
+      <SignInWithGoogle onChange={onChange} />
+      {error && <p style={{ color: "crimson" }}>{error}</p>}
+    </div>
+  );
+}

package/dist/templates/capsule/src/components/SignInWithGoogle.tsx

@@ -0,0 +1,27 @@
+import { pb } from "../lib/db";
+
+/**
+ * One-click Google sign-in — the bonus path on top of email/password. It lights
+ * up once an operator runs `percher data oauth google` (Slice 2) to configure the
+ * provider in this app's PocketBase. Until then it renders disabled with a hint;
+ * the disabled state never blocks the email/password path.
+ */
+export function SignInWithGoogle({ onChange }: { onChange?: () => void }) {
+  async function signIn() {
+    await pb.collection("users").authWithOAuth2({ provider: "google" });
+    onChange?.();
+  }
+
+  // Flip to true once `percher data oauth google` has configured the provider.
+  const enabled = false;
+  return (
+    <button
+      type="button"
+      disabled={!enabled}
+      onClick={enabled ? signIn : undefined}
+      title="Run `percher data oauth google` to enable Google sign-in"
+    >
+      Sign in with Google
+    </button>
+  );
+}

package/dist/templates/capsule/src/lib/ai.ts

@@ -0,0 +1,32 @@
+import { pb } from "./db";
+
+// Managed inference endpoint, injected at build time (a public URL, not a
+// secret). The Dockerfile declares ARG VITE_PERCHER_AI_URL.
+const AI_URL = import.meta.env.VITE_PERCHER_AI_URL;
+
+/**
+ * Keyless managed inference — NO API key, billed to the app owner's Percher
+ * plan. Only works for SIGNED-IN users (the proxy validates the current PB
+ * session against this app's sidecar). Returns the completion text.
+ *
+ *   const reply = await complete("Summarize: " + text);
+ */
+export async function complete(
+  prompt: string,
+  opts?: { model?: string; maxTokens?: number },
+): Promise<string> {
+  if (!AI_URL) throw new Error("Managed inference isn't configured for this app.");
+  if (!pb.authStore.isValid) throw new Error("Sign in to use AI.");
+  const res = await fetch(AI_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: pb.authStore.token },
+    body: JSON.stringify({
+      model: opts?.model,
+      max_tokens: opts?.maxTokens ?? 512,
+      messages: [{ role: "user", content: prompt }],
+    }),
+  });
+  if (!res.ok) throw new Error(`AI request failed (${res.status})`);
+  const data = (await res.json()) as { choices?: Array<{ message?: { content?: string } }> };
+  return data.choices?.[0]?.message?.content ?? "";
+}

package/dist/templates/capsule/src/lib/db.ts

@@ -0,0 +1,14 @@
+import PocketBase from "pocketbase";
+
+// The app's own PocketBase, injected at build time via the Dockerfile's
+// ARG VITE_POCKETBASE_URL (the pb-<app>.<suffix> origin). Auth state persists in
+// localStorage automatically.
+export const pb = new PocketBase(import.meta.env.VITE_POCKETBASE_URL);
+
+/**
+ * Typed data client. Write `db.collection<Message>("messages").create(...)`
+ * instead of hand-rolling the REST API.
+ */
+export const db = {
+  collection: <T = Record<string, unknown>>(name: string) => pb.collection<T>(name),
+};

package/dist/templates/capsule/src/lib/realtime.ts

@@ -0,0 +1,16 @@
+import { pb } from "./db";
+
+/**
+ * Subscribe to live changes on a collection — one call closes the cross-tab /
+ * cross-user realtime glue. The callback fires on every create/update/delete;
+ * resolves to an unsubscribe function.
+ *
+ *   const off = await subscribe<Message>("messages", (e) => refresh());
+ *   // later: off();
+ */
+export function subscribe<T = Record<string, unknown>>(
+  collection: string,
+  cb: (e: { action: string; record: T }) => void,
+) {
+  return pb.collection<T>(collection).subscribe("*", cb);
+}

package/dist/templates/capsule/src/main.tsx

@@ -0,0 +1,5 @@
+import { render } from "preact";
+import { App } from "./App";
+
+const root = document.getElementById("app");
+if (root) render(<App />, root);

package/dist/templates/capsule/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "jsxImportSource": "preact",
+    "lib": ["ESNext", "DOM", "DOM.Iterable"],
+    "types": ["vite/client"],
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["src"]
+}

package/dist/templates/capsule/vite.config.ts

@@ -0,0 +1,6 @@
+import preact from "@preact/preset-vite";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [preact()],
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "percher",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "description": "CLI for the Percher hosting platform \u2014 publish apps with one command",
   "type": "module",
   "bin": {
@@ -24,8 +24,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@percher/client": "^0.2.10",
-    "@percher/core": "^0.4.5",
+    "@percher/client": "^0.2.16",
+    "@percher/core": "^0.4.17",
     "@percher/toml": "^0.1.5",
     "cac": "^7.0.0",
     "picocolors": "^1.1.1"