@mediamonks/canopy-cli 0.7.21 → 0.7.23

package/dist/docs/sdk-ai.md

@@ -4,8 +4,8 @@ description: Metered LLM access through the project's budget-capped gateway key
 ---
 
 `canopy.ai` gives your project LLM access without any API keys in your code.
-Every request authenticates as the project and is metered against a hard
-per-project daily budget — spend, limits, and how prompts are handled by the
+Every request authenticates as the project and is metered against hard
+per-project budgets — spend, limits, and how prompts are handled by the
 model providers are covered in [AI access & usage](https://docs.canopy.website/platform/ai-usage).
 
 ## ai.chat(options)
@@ -32,16 +32,65 @@ res.usage; // { inputTokens: number, outputTokens: number }
 **`ChatOptions`:**
 
 - `messages` — required, non-empty array of `{ role, content }`. `role` is
-  `"system" | "user" | "assistant"`; `content` is a non-empty string.
+  `"system" | "user" | "assistant"`; `content` is a non-empty string, or an
+  array of content parts to attach documents and images (below).
 - `model` — optional `"{provider}/{model}"` id. Omit it and the platform's
   default model answers. Ask for a model whose provider isn't enabled and the
   call fails with a message listing what _is_ available; `ai.endpoint()`
   returns the full curated list.
-- `temperature` — optional number between 0 and 2.
-- `maxTokens` — optional integer, at least 1.
+- `temperature` — optional number between 0 and 2. Reasoning models (the
+  GPT-5 family) only accept their default temperature, so the platform drops
+  this setting for them rather than failing the call — it has effect on
+  Claude models.
+- `maxTokens` — optional integer, at least 1. On reasoning models the budget
+  also covers the model's internal reasoning, so a very small value can
+  return an empty answer — leave headroom.
+- `effort` — optional `"low" | "medium" | "high"`: how hard a reasoning model
+  should think. Lowered onto each provider's own dial; models without an
+  effort dial (Claude Haiku, for one) simply ignore it. Lower effort is
+  faster and cheaper, higher is more thorough.
+
+**`ChatResponse`:** `{ message, model, usage: { inputTokens, outputTokens } }`.
+`message.role` is `"assistant"` and `message.content` is always a plain
+string, whatever went in.
+
+## Attaching documents and images
+
+A message's `content` can be an array of parts instead of a string. The
+easiest way to send a file is to upload it to [blob storage](https://docs.canopy.website/sdk/blob) once
+and reference it by key — the platform fetches it server-side and picks the
+best way to hand it to the model:
 
-**`ChatResponse`:** `{ message: ChatMessage, model: string, usage: { inputTokens, outputTokens } }`.
-`message.role` is `"assistant"`.
+```ts
+await canopy.blob.put("briefs/q3.pdf", file); // once
+
+const res = await canopy.ai.chat({
+  messages: [
+    {
+      role: "user",
+      content: [
+        { type: "text", text: "Summarize this briefing." },
+        { type: "blob", key: "briefs/q3.pdf" },
+      ],
+    },
+  ],
+});
+```
+
+The part types:
+
+- `{ type: "text", text }` — plain text.
+- `{ type: "blob", key, mediaType? }` — a file already in the project's blob
+  storage, by key. `mediaType` overrides the stored content type if needed.
+  **Prefer this** for anything you'd otherwise base64 by hand.
+- `{ type: "file", data, mediaType, filename? }` — an inline file;
+  `data` is base64 (no `data:` prefix), `mediaType` e.g. `"application/pdf"`.
+- `{ type: "image", data, mediaType }` — an inline image, same encoding.
+
+Pick a model that can read what you attach — document and image understanding
+varies per model. The whole request (inline base64 and referenced blobs
+together) must stay under the 8 MB request limit — see
+[AI access & usage](https://docs.canopy.website/platform/ai-usage).
 
 ## ai.chatStream(options)
 
@@ -70,9 +119,10 @@ let an ecosystem client handle streaming for you.
 Returns the project's OpenAI-compatible endpoint info:
 
 ```ts
-const { baseUrl, models } = await canopy.ai.endpoint();
+const { baseUrl, models, native } = await canopy.ai.endpoint();
 // baseUrl — an OpenAI-compatible base URL
 // models  — the curated model list, "{provider}/{model}" ids; models[0] is the default
+// native  — provider-native base URLs: { anthropic, openai }
 ```
 
 Point any OpenAI-compatible client — the Vercel AI SDK, an OpenAI SDK, a
@@ -87,15 +137,56 @@ const openai = createOpenAI({ baseURL: baseUrl, apiKey: "unused" });
 const model = openai(models[0]);
 ```
 
+## Provider-native endpoints
+
+The compat endpoint speaks OpenAI's chat-completions dialect to every model —
+portable, but the lowest common denominator. When you want a provider's own
+protocol — Anthropic prompt caching, PDFs with citations, or OpenAI's
+Responses API — use the native base URLs from `endpoint()`. Requests pass
+through to the provider unchanged; auth, the model allowlist, the daily
+budget, and metering all still apply.
+
+```ts
+import Anthropic from "@anthropic-ai/sdk";
+
+const { native } = await canopy.ai.endpoint();
+const anthropic = new Anthropic({ baseURL: native.anthropic, apiKey: "unused" });
+const msg = await anthropic.messages.create({
+  model: "claude-haiku-4-5", // bare or "anthropic/…" — must be on the curated list
+  max_tokens: 1024,
+  messages: [{ role: "user", content: "Hello" }],
+});
+```
+
+A base URL is just a prefix — the client library appends the endpoint path
+itself, based on which method you call. Both values point at the platform,
+which forwards each path to the provider:
+
+- `native.anthropic` — hand it to `@anthropic-ai/sdk` or `@ai-sdk/anthropic`.
+  Calling `anthropic.messages.create(...)` makes the SDK request
+  `POST {native.anthropic}/v1/messages` — the Messages API.
+- `native.openai` — hand it to the `openai` package or `@ai-sdk/openai`. It
+  already ends in `/v1`, matching OpenAI's own base URL convention; the
+  method you call picks the endpoint: `client.responses.create(...)` requests
+  `POST {native.openai}/responses` (the Responses API) and
+  `client.chat.completions.create(...)` requests
+  `POST {native.openai}/chat/completions`. Both are supported.
+
+Pick the surface by what you need: `ai.chat()` for plain text (and simple
+attachments), the compat endpoint for portable multi-model apps and ecosystem
+tooling, a native endpoint for provider-specific capabilities. Moving between
+them never changes auth, budgets, or what the Usage tab shows.
+
 ## Errors
 
 Failed calls throw `CanopyError` with the HTTP `status` and the response body
 as the `message`. Two worth handling:
 
 - **Budget exhausted** — status `429`, body contains
-  `"ai_budget_exceeded"`. The project hit its daily AI cap; AI calls resume
-  the next day (or after a maintainer raises the budget). Everything else in
-  your app keeps working.
+  `"ai_budget_exceeded"` and names which budget tripped: the daily limit
+  (calls resume the next day) or the monthly cap (calls resume next month —
+  or after a maintainer raises it). Everything else in your app keeps
+  working.
 - **Invalid request** — status `400`, body contains `"invalid_chat"` and a
   detail explaining which option was rejected.
 

package/dist/docs/sdk-files.md

@@ -62,6 +62,12 @@ lifetime that isn't a whole number of seconds above zero is rejected. Keep the
 window as short as the job needs — anyone holding the URL can download the
 file until it expires.
 
+What a URL does in the browser depends on the file's content type. Images,
+video, audio, fonts, plain text, CSV, JSON and PDF display; SVG displays in
+an `<img>` but is sandboxed when opened directly; anything a browser would
+treat as a page — HTML, XML, scripts, unknown types — downloads instead of
+rendering. See [Browser security](https://docs.canopy.website/platform/security-headers).
+
 ## Listing and deleting
 
 ```ts

package/dist/docs/sdk-slack.md

@@ -0,0 +1,132 @@
+---
+title: Slack
+description: Handle your bot's events and slash commands in your worker, and post to Slack as the bot — no tokens in project code.
+---
+
+Once your project has a Slack app ([set up on the Services
+tab](https://docs.canopy.website/platform/slack)), the integration is two halves: inbound events arrive
+at a `slack()` export in your worker, and outbound calls go through
+`canopy.slack`. The bot token and signing secret stay with the platform —
+Slack's signatures are verified before anything reaches your code.
+
+## The `slack()` handler
+
+Export it next to `fetch` and `scheduled`:
+
+```ts
+export default {
+  fetch(request, env) {
+    /* … */
+  },
+
+  async slack(event, env) {
+    if (event.kind === "command") {
+      return { response_type: "in_channel", text: `Running ${event.payload.command}…` };
+    }
+    // kind === "event": an @-mention, a DM, …
+  },
+};
+```
+
+**The event object:**
+
+- `kind` — `"event"` (Events API: `app_mention`, `message`, …) or
+  `"command"` (a slash command).
+- `payload` — Slack's payload, verbatim. For events that's the full
+  callback (the interesting part is `payload.event`); for commands it's the
+  command form fields (`command`, `text`, `channel_id`, `user_id`, …).
+- `responseUrl` — commands only: where a late reply can still be sent (see
+  below).
+- `user` — who triggered this, as Slack tells it: `{ id, name? }`. Present
+  whenever Slack names a person.
+- `teamId`, `appId` — which workspace and app this came from.
+- `retry` — set when Slack is redelivering. Delivery is at-least-once, so
+  handlers that create things should tolerate seeing an event twice.
+
+## Who is talking to the bot
+
+Two identities, at two trust levels:
+
+- **`env.USER`** is set when the bot lives in the Monks workspace and the
+  sender has a Canopy account: the same `{ sub, email, name }` your fetch
+  routes see for a signed-in visitor, so user-specific logic works the same
+  way. The mapping rides the corporate directory — Slack accounts and Canopy
+  sign-ins are the same people there.
+- In any other workspace — a client's, say — `env.USER` is `null` and
+  `event.user` is all you get: Slack's own word for who typed, nothing
+  Canopy has verified. Fine for personalising a reply; don't hang
+  authorization on it.
+
+Either way, payload text is written by whoever typed it in Slack — treat it
+as untrusted input. And SDK calls from the handler still run as the project
+itself (`canopy.auth.user()` reports kind `worker`), regardless of
+`env.USER`.
+
+## Answering a slash command
+
+Slack gives a command three seconds. Return quickly and Canopy relays your
+answer as the command's response:
+
+```ts
+async slack(event, env) {
+  if (event.kind === "command") {
+    return { response_type: "ephemeral", text: "Done." };
+  }
+}
+```
+
+Return a Slack message object, or a plain string (sent as ephemeral text).
+Return nothing and the command completes silently.
+
+If your handler needs longer — it queries something slow, calls a model —
+the command is acknowledged for you, and you answer afterwards through the
+`responseUrl`, which stays valid for 30 minutes:
+
+```ts
+if (event.kind === "command") {
+  const answer = await somethingSlow();
+  await canopy.slack.respond(event.responseUrl!, {
+    response_type: "in_channel",
+    text: answer,
+  });
+}
+```
+
+Events (`kind: "event"`) have no response channel — react by calling out,
+usually `chat.postMessage` back into the conversation the event names.
+
+## slack.api(method, args)
+
+Any [Slack Web API method](https://docs.slack.dev/reference/methods), called
+as your project's bot:
+
+```ts
+const result = await canopy.slack.api("chat.postMessage", {
+  channel: "C0123456789",
+  text: "Deploy finished.",
+});
+if (!result.ok) console.warn("slack said no:", result.error);
+```
+
+The response is Slack's own, `ok: false` included — check it for
+method-level outcomes like `channel_not_found` or `not_in_channel` (the bot
+can only post to channels it's been invited to, and to people's DMs).
+Workspace-management method families (`admin.*`, `tooling.*`, `apps.*`,
+`oauth.*`) are refused before Slack is ever contacted; everything else is
+bounded by the permissions the app was installed with.
+
+Backend and `canopy dev` only — pages can't call it, so a visitor can never
+act as your bot.
+
+## slack.respond(responseUrl, message)
+
+The late reply to a slash command, described above. `message` is a Slack
+message object or a plain string.
+
+## Errors
+
+Refusals arrive as thrown errors with stable codes: `slack_not_configured`
+(no app on this project), `slack_not_installed` (created but not installed
+to a workspace), `slack_disabled` (switched off on the Services tab), and
+`slack_method_not_allowed`. A network-level failure reaching Slack is
+`slack_api_error`.

package/dist/{docs-fiC6q9Ce.mjs → docs-BDPL0TI3.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-C_DLlB96.mjs";
+import { t as version } from "./package-C5rZwlw8.mjs";
 import { n as siteConfig } from "./site-BFaWfSVu.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { r as reportErrors } from "./ui--atbZ-TM.mjs";

package/dist/{feedback-CAwUHwWa.mjs → feedback-B3pnUPLf.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-C_DLlB96.mjs";
+import { t as version } from "./package-C5rZwlw8.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
 import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui--atbZ-TM.mjs";
 import { defineCommand } from "citty";
@@ -89,6 +89,10 @@ function firstLine(body) {
 	const line = body.split("\n")[0] ?? "";
 	return line.length > 72 ? `${line.slice(0, 71)}…` : line;
 }
+/** List label: the AI-written title when there is one, else the first line. */
+function itemLabel(item) {
+	return firstLine(item.title || item.body);
+}
 function printItems(items) {
 	if (items.length === 0) {
 		console.log("No matching feedback items.");
@@ -97,7 +101,7 @@ function printItems(items) {
 	for (const item of items) {
 		const comments = item.comment_count ? `  💬${item.comment_count}` : "";
 		const shots = item.attachment_count ? `  📎${item.attachment_count}` : "";
-		console.log(`${item.id}  ${item.status}  ${item.kind}  ${firstLine(item.body)}${comments}${shots}`);
+		console.log(`${item.id}  ${item.status}  ${item.kind}  ${itemLabel(item)}${comments}${shots}`);
 	}
 }
 const listCommand = defineCommand({
@@ -153,6 +157,7 @@ const showCommand = defineCommand({
 			return;
 		}
 		const { item, comments } = detail;
+		if (item.title) console.log(item.title);
 		console.log(`${item.kind} · ${item.status} · via ${item.source} · ${formatDateTime(item.created_at)}`);
 		console.log(`reported by ${item.reporter_name || item.reporter_email || "unknown"}` + (item.deployment_id ? ` on ${item.deployment_id}` : "") + (item.channel === "staging" ? " (staging)" : ""));
 		console.log(`\n${item.body}\n`);
@@ -276,7 +281,7 @@ const mineCommand = defineCommand({
 			console.log("You haven't filed any reports.");
 			return;
 		}
-		for (const item of items) console.log(`${item.id}  ${item.status}  ${item.kind}  [${item.project_slug}]  ${firstLine(item.body)}`);
+		for (const item of items) console.log(`${item.id}  ${item.status}  ${item.kind}  [${item.project_slug}]  ${itemLabel(item)}`);
 	})
 });
 const reportCommand = defineCommand({

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-C_DLlB96.mjs";
+import { t as version } from "./package-C5rZwlw8.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BFaWfSVu.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,14 +60,14 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-DRYaJcfT.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-DRYaJcfT.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-DRYaJcfT.mjs").then((m) => m.logoutCommand),
+		login: () => import("./login-By4y5O5-.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-By4y5O5-.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-By4y5O5-.mjs").then((m) => m.logoutCommand),
 		create: () => import("./projects-1r5387ui.mjs").then((m) => m.createCommand),
 		init: () => import("./projects-1r5387ui.mjs").then((m) => m.initCommand),
 		projects: () => import("./projects-1r5387ui.mjs").then((m) => m.projectsCommand),
 		delete: () => import("./projects-1r5387ui.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-D7v7WK9O.mjs").then((m) => m.devCommand),
+		dev: () => import("./dev-BFPlhkzp.mjs").then((m) => m.devCommand),
 		deploy: () => import("./deploy-DCggsLD7.mjs").then((m) => m.deployCommand),
 		promote: () => import("./deploy-DCggsLD7.mjs").then((m) => m.promoteCommand),
 		staging: () => import("./staging-CdpV2YHB.mjs").then((m) => m.stagingCommand),
@@ -76,13 +76,13 @@ const main = defineCommand({
 		token: () => import("./token-C8Bmzwfl.mjs").then((m) => m.tokenCommand),
 		egress: () => import("./egress-BhbQfjjV.mjs").then((m) => m.egressCommand),
 		schedule: () => import("./schedule-DK_Cv6Xf.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-CAwUHwWa.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-B3pnUPLf.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-TaSLpQZ5.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-CRpVLLi6.mjs").then((m) => m.usageCommand),
+		usage: () => import("./usage-C1-cvS2-.mjs").then((m) => m.usageCommand),
 		open: () => import("./open-D7f1wNn3.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-fiC6q9Ce.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-CmgMU2Iq.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-D1j0WV4l.mjs").then((m) => m.upgradeCommand),
+		docs: () => import("./docs-BDPL0TI3.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-CgToW_Ac.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-Bl_NJ_m5.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-Beqz--Df.mjs").then((m) => m.logsCommand)
 	}
 });

package/dist/{local-CsSP4Vpt.mjs → local-BjsuI1IB.mjs}

@@ -1,6 +1,6 @@
 import { s as apiDataRequest } from "./ui--atbZ-TM.mjs";
-import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BKKAEkbH.mjs";
-import { n as rewriteApiPath } from "./dev-CNqx_53I.mjs";
+import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BPKfY9IN.mjs";
+import { n as rewriteApiPath } from "./dev-XULukupE.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
@@ -15,19 +15,48 @@ import { Hono } from "hono";
 *  - `fts: false` — search() is an ILIKE substring fallback: different
 *    matches, no ranking (results order by created_at). Surfaced to clients
 *    as `capabilities.fts` rather than papered over.
-*  - patch() is a shallow jsonb merge (`||`): top-level keys replace rather
-*    than deep-merge, and a null value stores null instead of removing the
-*    key.
+*  - patch() has the SAME RFC 7386 semantics as SQLite's json_patch (nested
+*    objects merge, null removes a key), but Postgres has no built-in for it,
+*    so it goes through `public._canopy_merge_patch(jsonb, jsonb)` — a small
+*    recursive plpgsql function declared in the DDL below. It lives in
+*    `public` (not the per-project schema) so one CREATE OR REPLACE covers
+*    every project schema in the database, existing ones included.
 */
 const DOC_COLUMNS$1 = "id, data, created_at, updated_at";
-const DOC_STORE_DDL_PG = [`CREATE TABLE IF NOT EXISTS _canopy_docs (
+const DOC_STORE_DDL_PG = [
+	`CREATE TABLE IF NOT EXISTS _canopy_docs (
     collection TEXT NOT NULL,
     id TEXT NOT NULL,
     data TEXT NOT NULL,
     created_at TEXT NOT NULL,
     updated_at TEXT NOT NULL,
     PRIMARY KEY (collection, id)
-  )`, `CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`];
+  )`,
+	`CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`,
+	`CREATE OR REPLACE FUNCTION public._canopy_merge_patch(target jsonb, patch jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $fn$
+BEGIN
+  IF jsonb_typeof(patch) IS DISTINCT FROM 'object' THEN
+    RETURN patch;
+  END IF;
+  IF jsonb_typeof(target) IS DISTINCT FROM 'object' THEN
+    target := '{}'::jsonb;
+  END IF;
+  RETURN COALESCE((
+    SELECT jsonb_object_agg(m.key, m.value) FROM (
+      SELECT t.key, t.value FROM jsonb_each(target) t WHERE NOT (patch ? t.key)
+      UNION ALL
+      SELECT p.key,
+             CASE WHEN jsonb_typeof(p.value) = 'object'
+                  THEN public._canopy_merge_patch(target -> p.key, p.value)
+                  ELSE p.value END
+        FROM jsonb_each(patch) p
+       WHERE jsonb_typeof(p.value) <> 'null'
+    ) m
+  ), '{}'::jsonb);
+END
+$fn$`
+];
 /** `data`'s JSON value at a `$.a.b` path param, as jsonb. */
 const jsonAt = (column, pathParam) => `(${column}::jsonb #> string_to_array(trim(leading '$.' from ${pathParam}::text), '.'))`;
 /**
@@ -124,7 +153,7 @@ const postgresDialect = {
 	},
 	patch(collection, id, patchJson, now) {
 		return {
-			sql: `UPDATE _canopy_docs SET data = (data::jsonb || $1::jsonb)::text, updated_at = $2
+			sql: `UPDATE _canopy_docs SET data = public._canopy_merge_patch(data::jsonb, $1::jsonb)::text, updated_at = $2
         WHERE collection = $3 AND id = $4
         RETURNING ${DOC_COLUMNS$1}`,
 			params: [