@mediamonks/canopy-cli 0.7.22 → 0.7.23

package/dist/dev-BFPlhkzp.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-XULukupE.mjs";
+export { devCommand };

package/dist/{dev-CNqx_53I.mjs → dev-XULukupE.mjs}

@@ -37,7 +37,7 @@ async function workerPlugin(flags, slug) {
 		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
 		return;
 	}
-	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-Bij9OUMk.mjs");
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-BDMjExps.mjs");
 	const secrets = readDevVars(flags.dir);
 	const email = siteConfig().email;
 	const plugin = workerDevPlugin({
@@ -165,7 +165,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-CsSP4Vpt.mjs");
+		const { fetchProjectDump } = await import("./local-BjsuI1IB.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -180,7 +180,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-CsSP4Vpt.mjs");
+	const { createSandbox } = await import("./local-BjsuI1IB.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/{dev-worker-Bij9OUMk.mjs → dev-worker-BDMjExps.mjs}

@@ -1,4 +1,4 @@
-import "./src-BKKAEkbH.mjs";
+import "./src-BPKfY9IN.mjs";
 import { readFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
 //#region ../data-plane/src/worker-request.ts
@@ -25,6 +25,39 @@ const IDENTITY_STAMP_HEADERS = [
 	"x-canopy-user-email",
 	"x-canopy-user-name"
 ];
+/** Cookies that authenticate to Canopy itself — the monk session and the client-page session. */
+const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_client"]);
+/**
+* Strip Canopy's own credentials from a request before untrusted project code
+* sees it (R-01).
+*
+* The visitor's session cookie arrives with every request the gateway
+* dispatches, and a bundle that can read it can replay it against the platform
+* as that person — against the control plane, and against other projects' data
+* on the api host. It is a credential, so the host keeps it in closure scope
+* like the raw DB and blob handles, and hands the bundle a redacted request.
+*
+* Redaction is surgical on purpose: an app's own cookies and its own
+* Authorization scheme survive, because those belong to the app. Only
+* `canopy_session` / `canopy_client` and a `cnpy_` bearer are removed.
+*
+* `env.CANOPY.fetch` still authenticates as the visitor — the host passes it
+* the unredacted headers — so nothing about the platform-facing behaviour
+* changes; the credential simply stops being reachable from bundle code.
+*/
+function redactCanopyCredentials(headers) {
+	const cookie = headers.get("cookie");
+	if (cookie !== null) {
+		const kept = cookie.split(";").filter((part) => {
+			const name = part.split("=")[0]?.trim() ?? "";
+			return name !== "" && !CANOPY_COOKIE_NAMES.has(name);
+		}).join(";").trim();
+		if (kept === "") headers.delete("cookie");
+		else headers.set("cookie", kept);
+	}
+	if (headers.get("authorization")?.startsWith("Bearer cnpy_")) headers.delete("authorization");
+	return headers;
+}
 /**
 * Strip what must never travel upstream and stamp who is calling. Common to
 * every host; says nothing about credentials.
@@ -331,6 +364,7 @@ function workerDevPlugin(options) {
 						}));
 						return;
 					}
+					redactCanopyCredentials(request.headers);
 					await sendResponse(res, await worker.fetch(request, env));
 				})().catch((err) => {
 					if (err instanceof Error) server.ssrFixStacktrace(err);

package/dist/docs/cli-login.md

@@ -24,6 +24,8 @@ canopy login --json                # machine-readable status for agents/CI
 2. You finish signing in **in the browser** — your password never passes through the CLI. When OneLogin hands control back, the browser shows a small "You're signed in" page and you can return to the terminal. The sign-in waits up to 5 minutes; the hand-back uses local port `8976`, so if another program holds that port the login fails with a clear message.
 3. The CLI stores a token for **every** site (`main`, `staging`, `gcp-pilot`), not just the one you picked, in `~/.canopy/config.json` — readable only by your user account.
 
+Each token is labelled with your machine's hostname and expires after 30 days. The dashboard's **Account** page (your avatar → Account) lists every machine you have signed in from and lets you revoke any of them; `canopy logout` revokes this machine's tokens for you.
+
 One login therefore covers all sites; `--profile` only decides which one commands target by default. If minting fails for a non-active site you get a warning but login still succeeds; if it fails for your **active** profile the command errors and asks you to re-run.
 
 ## Examples

package/dist/docs/cli-logout.md

@@ -1,25 +1,28 @@
 ---
 title: canopy logout
-description: Sign out of Canopy by removing all locally stored CLI tokens.
+description: Sign out of Canopy — revoke your CLI tokens on every site and forget them locally.
 ---
 
-`canopy logout` signs you out on this machine by forgetting every stored CLI token. Use it on a shared machine, or when you want a clean slate before logging in as someone else.
+`canopy logout` signs you out on this machine: it revokes the CLI token stored for every site on the platform, then forgets them in `~/.canopy/config.json`. Use it on a shared machine, or when you want a clean slate before logging in as someone else.
 
 ## Usage
 
 ```bash
 canopy logout
+canopy logout --local     # forget the tokens here, but leave them valid on the platform
 ```
 
 ## Arguments & flags
 
-None. Logout is deliberately all-or-nothing: it clears the tokens for **every** site (`main`, `staging`, `gcp-pilot`) at once — there is no per-profile logout, so the global `--profile` flag has no effect here.
+- `--local` — only remove the tokens from this machine; nothing is called on the server. The tokens stay valid until they expire (30 days after login), and you can still revoke them from the dashboard's **Account** page.
+
+Logout is deliberately all-or-nothing: it signs out of **every** site (`main`, `staging`, `gcp-pilot`) at once — there is no per-profile logout, so the global `--profile` flag has no effect here.
 
 ## Details
 
-The command is local-only: it removes every stored token from `~/.canopy/config.json` and prints a confirmation. Nothing is called on the server, so the tokens themselves aren't revoked — they simply age out at their normal expiry. Your active-site choice stays in the file, so the next `canopy login` picks up where you left off.
+For each site with a stored token, the command asks the platform to revoke that token, so it stops working everywhere immediately — not just on this machine. Then the file is cleaned up. If a site cannot be reached, the local copy is still removed and the command tells you which tokens it could not revoke; those keep working until they expire, or until you revoke them from the dashboard's **Account** page (your avatar → Account), which lists every machine you have signed in from.
 
-If no token was stored to begin with, it prints `Not logged in.` and exits successfully.
+Your active-site choice stays in the file, so the next `canopy login` picks up where you left off. If no token was stored to begin with, it prints `Not logged in.` and exits successfully.
 
 ## Examples
 
@@ -27,6 +30,6 @@ If no token was stored to begin with, it prints `Not logged in.` and exits succe
 canopy logout
 ```
 
-Removes all site tokens from `~/.canopy/config.json`; subsequent commands that need the API will ask you to run `canopy login`.
+Revokes all site tokens on the platform and removes them from `~/.canopy/config.json`; subsequent commands that need the API will ask you to run `canopy login`.
 
 See also [canopy login](https://docs.canopy.website/cli/login) and [canopy whoami](https://docs.canopy.website/cli/whoami).

package/dist/docs/index.json

@@ -117,7 +117,7 @@
         {
           "slug": "platform-ai-usage",
           "title": "AI access & usage",
-          "summary": "Projects talk to AI models through the platform — no API keys to manage, a hard daily budget per project, and full visibility of spend."
+          "summary": "Projects talk to AI models through the platform — no API keys to manage, hard per-project budgets, and full visibility of spend."
         },
         {
           "slug": "platform-google",
@@ -154,6 +154,11 @@
           "title": "Client access",
           "summary": "Share a project with clients who have no Monks account — a shared password unlocks that one project's URL and nothing else."
         },
+        {
+          "slug": "platform-security-headers",
+          "title": "Browser security",
+          "summary": "The security headers the platform adds to your app's pages and files, what they block, and the two switches in Settings."
+        },
         {
           "slug": "platform-sites-and-profiles",
           "title": "Sites & profiles",
@@ -184,7 +189,7 @@
         {
           "slug": "cli-logout",
           "title": "canopy logout",
-          "summary": "Sign out of Canopy by removing all locally stored CLI tokens."
+          "summary": "Sign out of Canopy — revoke your CLI tokens on every site and forget them locally."
         },
         {
           "slug": "cli-create",

package/dist/docs/platform-ai-usage.md

@@ -1,11 +1,11 @@
 ---
 title: AI access & usage
-description: Projects talk to AI models through the platform — no API keys to manage, a hard daily budget per project, and full visibility of spend.
+description: Projects talk to AI models through the platform — no API keys to manage, hard per-project budgets, and full visibility of spend.
 ---
 
 Canopy projects can call AI models without you ever handling an API key. The
 platform routes every request through its own metered gateway, tracks what
-each project spends, and enforces a hard daily budget — so a runaway loop in
+each project spends, and enforces hard budgets — so a runaway loop in
 a vibecoded app becomes a capped bill and a visible chart, not a surprise
 invoice.
 
@@ -26,9 +26,26 @@ const reply = await canopy.ai.chat({
   default — ask for a model outside the list and the API tells you what _is_
   available.
 - **Streaming** via `canopy.ai.chatStream()` for chat-style UIs.
+- **Documents and images.** Messages can attach files — reference something
+  in the project's [blob storage](https://docs.canopy.website/sdk/blob) by key, or inline base64 — see
+  [the AI SDK page](https://docs.canopy.website/sdk/ai). Models that read PDFs and images get the real
+  document, not a text extraction.
 - **An OpenAI-compatible endpoint.** `canopy.ai.endpoint()` returns a base
   URL and model list you can plug into ecosystem tools (like the Vercel AI
   SDK) — same key handling, same budget, same tracking.
+- **Provider-native endpoints.** For provider-specific capabilities —
+  Anthropic prompt caching and PDF citations, OpenAI's Responses API — point
+  an official SDK at the native base URLs from `canopy.ai.endpoint()`. Same
+  budget and tracking as everything else; see [the AI SDK page](https://docs.canopy.website/sdk/ai).
+
+## Request size
+
+A single chat request — prompt, inline base64 attachments, and referenced
+blobs together — can be up to **8 MB**. Base64 makes files about a third
+larger than they are on disk, so that fits roughly a 6 MB document per
+request. Bigger requests answer with a `chat_too_large` error (HTTP 413)
+before anything is sent to a model. Providers also have their own per-file
+limits, which are typically above this.
 
 ## Your data and the model providers
 
@@ -41,16 +58,25 @@ This applies to every way your project reaches AI — `canopy.ai.chat()`,
 streaming, and the OpenAI-compatible endpoint all go through the same gateway
 to the same accounts.
 
-## The daily budget
+## Budgets: a daily limit and a monthly cap
+
+Every project has two AI budgets in USD, enforced from the same spend ledger
+the dashboard displays — so what you see and what's enforced can never
+disagree:
+
+- **A daily limit** (default $5) catches runaway loops. Cross it and AI
+  calls answer `ai_budget_exceeded` until midnight UTC; everything resets
+  the next day.
+- **A monthly cap** (default $20) is the real spending ceiling. Cross it and
+  AI calls pause until the calendar month rolls over.
 
-Every project has a daily AI budget in USD. When a project's spend for the
-day crosses it, further AI calls answer with an `ai_budget_exceeded` error
-until the day rolls over. The budget is enforced from the same spend ledger
-the dashboard displays, so what you see and what's enforced can never
-disagree.
+The error names which one tripped. The Usage tab shows spend against both.
+If a project genuinely needs more headroom, a Canopy admin can raise either
+budget from that same tab — ask in the project's feedback or reach out to
+the platform team.
 
-> **Note:** Hitting the cap doesn't break the rest of your app — pages, data, and files keep working. Only AI
-> calls pause until the next day.
+> **Note:** Hitting a budget doesn't break the rest of your app — pages, data, and files keep working. Only AI
+> calls pause until the window rolls over.
 
 ## The Usage tab
 

package/dist/docs/platform-client-access.md

@@ -36,8 +36,11 @@ it** card:
 2. Send the client the project URL and the password.
 
 To change the password, set a new one — previously handed-out passwords stop
-working for new sign-ins. To turn client access off entirely, remove the
-password from the same card; visitors are back to Monks-only immediately.
+working, and every browser that unlocked the project with the old one is
+signed out on its next visit and asked for the new password. To turn client
+access off entirely, remove the password from the same card, or switch the
+mode back to Monks only; either way, visitors are back to Monks-only
+immediately, unlocked browsers included.
 
 > **Warning:** A shared password is deliberately lightweight protection — right for work-in-progress previews,
 > wrong for anything sensitive. Anyone who has it can view the app and share it further, so rotate

package/dist/docs/platform-members-and-access.md

@@ -61,11 +61,34 @@ Turning it off again is the same toggle.
 > **Note:** Collaborators-only gates the **live app**. Management access (settings, data, deploys) is always
 > members-only, regardless of this toggle.
 
-## Platform admins and the Users page
-
-Platform admins get an extra **Users** page in the dashboard listing everyone
-on Canopy — name, email, and when they first signed in — with a one-click way
-to grant or remove admin. Accounts are created automatically on first
-OneLogin sign-in; there is nothing to provision.
+## Platform admins and the Admin page
+
+Platform admins get an extra **Admin** page in the dashboard. Its **Users**
+tab lists everyone on Canopy — name, email, when they first and last signed
+in — with a one-click way to grant or remove admin and to sign someone out
+everywhere. Its **Sessions** tab lists every live CLI sign-in on the site:
+who, from which machine, and when it was last used, each revocable on the
+spot. Accounts are created automatically on first OneLogin sign-in; there is
+nothing to provision.
+
+## Your sign-ins, and signing out everywhere
+
+A Canopy sign-in lives in two places: the browser session from OneLogin, and
+the CLI tokens `canopy login` stores on each machine (one per site). Your
+**Account** page — open the avatar menu in the dashboard header — lists the
+machines you have signed in from, with when each token was last used, and lets
+you revoke any of them. Revoking a token is what `canopy logout` does for the
+machine it runs on.
+
+**Sign out everywhere** on the same page ends every browser session and every
+CLI sign-in of yours on that site at once, this one included. Reach for it
+when a laptop goes missing or you signed in somewhere you shouldn't have; the
+next request from any of those places meets the sign-in page. Deploy tokens
+used by CI belong to their projects, not to you, and keep working — revoke
+those from the project's Deploys tab if they were on the lost machine too.
+
+Platform admins have the same button for any user on the **Admin** page, which
+is how someone who leaves the company is signed out of Canopy before their
+open sessions would have expired on their own.
 
 - [Client access](https://docs.canopy.website/platform/client-access) — Share work-in-progress with clients who don't have a Monks account.

package/dist/docs/platform-security-headers.md

@@ -0,0 +1,53 @@
+---
+title: Browser security
+description: The security headers the platform adds to your app's pages and files, what they block, and the two switches in Settings.
+---
+
+Every project on Canopy shares one sign-in, so a script that manages to run
+inside one app is a script running next to every other app a visitor can open.
+To keep that from mattering, the platform adds a small set of browser security
+headers to the pages and files it serves for you. You don't configure anything
+to get them, and most projects never notice they're there.
+
+## What your pages get
+
+- **A Content-Security-Policy.** Scripts may load from your own app and from
+  any `https://` address, so CDNs and hosted libraries keep working. Inline
+  `<script>` blocks that are part of your deployed HTML keep working too — the
+  platform reads them at serve time and allows exactly those. What's blocked:
+  inline event handlers such as `onclick="…"`, `javascript:` links, plugins
+  (`<object>`, `<embed>`), scripts loaded over plain `http://`, and inline
+  scripts that were _not_ in your deploy — which is what an injected script
+  usually is.
+- **No embedding by other sites.** Your pages can only be shown in an iframe by
+  your own app.
+- **A referrer policy and HTTPS pinning.** Other sites see your origin but not
+  your full URLs, and browsers remember to always use HTTPS.
+
+## The two switches
+
+Both live on the project's **Settings → Security** page, and both take effect
+on the next page load — no redeploy.
+
+- **Content-Security-Policy** — on by default. Turn it off if your app depends
+  on something the policy blocks and you can't change it: an inline `onclick`,
+  a `javascript:` link, a library that writes `<script>` tags into the page at
+  runtime, or a backend route that renders HTML with its own inline scripts.
+  Check the browser console first — a blocked script shows up there with the
+  directive that stopped it.
+- **Allow embedding in other sites** — off by default. Turn it on when another
+  site needs to show this app in an iframe.
+
+Backend-rendered pages (a worker route that returns HTML) receive the framing
+and referrer headers but no script policy, because the platform only hashes
+inline scripts it knows came from a deploy.
+
+## Files you store
+
+Files saved with `canopy.blob` are served from your app's address, with the
+content type you gave them. Images, video, audio, fonts, plain text, CSV, JSON
+and PDF display normally. SVGs display too, but sandboxed — fine in an
+`<img>`, and harmless if someone opens the URL directly. Anything a browser
+would treat as a page — HTML, XML, scripts, or files with an unknown type —
+downloads instead of rendering. If you want to show user-uploaded HTML, render
+it inside your own page rather than linking to the stored file.

package/dist/docs/platform-slack.md

@@ -56,7 +56,9 @@ own screen. Click **Install to workspace** and follow it through.
 
 If your workspace requires admin approval for new apps, the first attempt
 becomes an approval request instead. Once the admin approves (Slack DMs you
-about it), come back and click install again.
+about it), either come back and click install again, or use the install
+link Slack itself offers — both complete the same way. A Slack-side install
+only works into the workspace the app already belongs to.
 
 The same button reappears whenever you change features in a way that needs
 new permissions — the card shows a clear warning when saved changes are

package/dist/docs/sdk-ai.md

@@ -4,8 +4,8 @@ description: Metered LLM access through the project's budget-capped gateway key
 ---
 
 `canopy.ai` gives your project LLM access without any API keys in your code.
-Every request authenticates as the project and is metered against a hard
-per-project daily budget — spend, limits, and how prompts are handled by the
+Every request authenticates as the project and is metered against hard
+per-project budgets — spend, limits, and how prompts are handled by the
 model providers are covered in [AI access & usage](https://docs.canopy.website/platform/ai-usage).
 
 ## ai.chat(options)
@@ -32,16 +32,65 @@ res.usage; // { inputTokens: number, outputTokens: number }
 **`ChatOptions`:**
 
 - `messages` — required, non-empty array of `{ role, content }`. `role` is
-  `"system" | "user" | "assistant"`; `content` is a non-empty string.
+  `"system" | "user" | "assistant"`; `content` is a non-empty string, or an
+  array of content parts to attach documents and images (below).
 - `model` — optional `"{provider}/{model}"` id. Omit it and the platform's
   default model answers. Ask for a model whose provider isn't enabled and the
   call fails with a message listing what _is_ available; `ai.endpoint()`
   returns the full curated list.
-- `temperature` — optional number between 0 and 2.
-- `maxTokens` — optional integer, at least 1.
+- `temperature` — optional number between 0 and 2. Reasoning models (the
+  GPT-5 family) only accept their default temperature, so the platform drops
+  this setting for them rather than failing the call — it has effect on
+  Claude models.
+- `maxTokens` — optional integer, at least 1. On reasoning models the budget
+  also covers the model's internal reasoning, so a very small value can
+  return an empty answer — leave headroom.
+- `effort` — optional `"low" | "medium" | "high"`: how hard a reasoning model
+  should think. Lowered onto each provider's own dial; models without an
+  effort dial (Claude Haiku, for one) simply ignore it. Lower effort is
+  faster and cheaper, higher is more thorough.
+
+**`ChatResponse`:** `{ message, model, usage: { inputTokens, outputTokens } }`.
+`message.role` is `"assistant"` and `message.content` is always a plain
+string, whatever went in.
+
+## Attaching documents and images
+
+A message's `content` can be an array of parts instead of a string. The
+easiest way to send a file is to upload it to [blob storage](https://docs.canopy.website/sdk/blob) once
+and reference it by key — the platform fetches it server-side and picks the
+best way to hand it to the model:
 
-**`ChatResponse`:** `{ message: ChatMessage, model: string, usage: { inputTokens, outputTokens } }`.
-`message.role` is `"assistant"`.
+```ts
+await canopy.blob.put("briefs/q3.pdf", file); // once
+
+const res = await canopy.ai.chat({
+  messages: [
+    {
+      role: "user",
+      content: [
+        { type: "text", text: "Summarize this briefing." },
+        { type: "blob", key: "briefs/q3.pdf" },
+      ],
+    },
+  ],
+});
+```
+
+The part types:
+
+- `{ type: "text", text }` — plain text.
+- `{ type: "blob", key, mediaType? }` — a file already in the project's blob
+  storage, by key. `mediaType` overrides the stored content type if needed.
+  **Prefer this** for anything you'd otherwise base64 by hand.
+- `{ type: "file", data, mediaType, filename? }` — an inline file;
+  `data` is base64 (no `data:` prefix), `mediaType` e.g. `"application/pdf"`.
+- `{ type: "image", data, mediaType }` — an inline image, same encoding.
+
+Pick a model that can read what you attach — document and image understanding
+varies per model. The whole request (inline base64 and referenced blobs
+together) must stay under the 8 MB request limit — see
+[AI access & usage](https://docs.canopy.website/platform/ai-usage).
 
 ## ai.chatStream(options)
 
@@ -70,9 +119,10 @@ let an ecosystem client handle streaming for you.
 Returns the project's OpenAI-compatible endpoint info:
 
 ```ts
-const { baseUrl, models } = await canopy.ai.endpoint();
+const { baseUrl, models, native } = await canopy.ai.endpoint();
 // baseUrl — an OpenAI-compatible base URL
 // models  — the curated model list, "{provider}/{model}" ids; models[0] is the default
+// native  — provider-native base URLs: { anthropic, openai }
 ```
 
 Point any OpenAI-compatible client — the Vercel AI SDK, an OpenAI SDK, a
@@ -87,15 +137,56 @@ const openai = createOpenAI({ baseURL: baseUrl, apiKey: "unused" });
 const model = openai(models[0]);
 ```
 
+## Provider-native endpoints
+
+The compat endpoint speaks OpenAI's chat-completions dialect to every model —
+portable, but the lowest common denominator. When you want a provider's own
+protocol — Anthropic prompt caching, PDFs with citations, or OpenAI's
+Responses API — use the native base URLs from `endpoint()`. Requests pass
+through to the provider unchanged; auth, the model allowlist, the daily
+budget, and metering all still apply.
+
+```ts
+import Anthropic from "@anthropic-ai/sdk";
+
+const { native } = await canopy.ai.endpoint();
+const anthropic = new Anthropic({ baseURL: native.anthropic, apiKey: "unused" });
+const msg = await anthropic.messages.create({
+  model: "claude-haiku-4-5", // bare or "anthropic/…" — must be on the curated list
+  max_tokens: 1024,
+  messages: [{ role: "user", content: "Hello" }],
+});
+```
+
+A base URL is just a prefix — the client library appends the endpoint path
+itself, based on which method you call. Both values point at the platform,
+which forwards each path to the provider:
+
+- `native.anthropic` — hand it to `@anthropic-ai/sdk` or `@ai-sdk/anthropic`.
+  Calling `anthropic.messages.create(...)` makes the SDK request
+  `POST {native.anthropic}/v1/messages` — the Messages API.
+- `native.openai` — hand it to the `openai` package or `@ai-sdk/openai`. It
+  already ends in `/v1`, matching OpenAI's own base URL convention; the
+  method you call picks the endpoint: `client.responses.create(...)` requests
+  `POST {native.openai}/responses` (the Responses API) and
+  `client.chat.completions.create(...)` requests
+  `POST {native.openai}/chat/completions`. Both are supported.
+
+Pick the surface by what you need: `ai.chat()` for plain text (and simple
+attachments), the compat endpoint for portable multi-model apps and ecosystem
+tooling, a native endpoint for provider-specific capabilities. Moving between
+them never changes auth, budgets, or what the Usage tab shows.
+
 ## Errors
 
 Failed calls throw `CanopyError` with the HTTP `status` and the response body
 as the `message`. Two worth handling:
 
 - **Budget exhausted** — status `429`, body contains
-  `"ai_budget_exceeded"`. The project hit its daily AI cap; AI calls resume
-  the next day (or after a maintainer raises the budget). Everything else in
-  your app keeps working.
+  `"ai_budget_exceeded"` and names which budget tripped: the daily limit
+  (calls resume the next day) or the monthly cap (calls resume next month —
+  or after a maintainer raises it). Everything else in your app keeps
+  working.
 - **Invalid request** — status `400`, body contains `"invalid_chat"` and a
   detail explaining which option was rejected.
 

package/dist/docs/sdk-files.md

@@ -62,6 +62,12 @@ lifetime that isn't a whole number of seconds above zero is rejected. Keep the
 window as short as the job needs — anyone holding the URL can download the
 file until it expires.
 
+What a URL does in the browser depends on the file's content type. Images,
+video, audio, fonts, plain text, CSV, JSON and PDF display; SVG displays in
+an `<img>` but is sandboxed when opened directly; anything a browser would
+treat as a page — HTML, XML, scripts, unknown types — downloads instead of
+rendering. See [Browser security](https://docs.canopy.website/platform/security-headers).
+
 ## Listing and deleting
 
 ```ts

package/dist/{docs-c0CdeBxh.mjs → docs-BDPL0TI3.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-BuwV_mje.mjs";
+import { t as version } from "./package-C5rZwlw8.mjs";
 import { n as siteConfig } from "./site-BFaWfSVu.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { r as reportErrors } from "./ui--atbZ-TM.mjs";

package/dist/{feedback-QhD8k6Ph.mjs → feedback-B3pnUPLf.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-BuwV_mje.mjs";
+import { t as version } from "./package-C5rZwlw8.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
 import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui--atbZ-TM.mjs";
 import { defineCommand } from "citty";

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-BuwV_mje.mjs";
+import { t as version } from "./package-C5rZwlw8.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BFaWfSVu.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,14 +60,14 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-BrEDKrb3.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-BrEDKrb3.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-BrEDKrb3.mjs").then((m) => m.logoutCommand),
+		login: () => import("./login-By4y5O5-.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-By4y5O5-.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-By4y5O5-.mjs").then((m) => m.logoutCommand),
 		create: () => import("./projects-1r5387ui.mjs").then((m) => m.createCommand),
 		init: () => import("./projects-1r5387ui.mjs").then((m) => m.initCommand),
 		projects: () => import("./projects-1r5387ui.mjs").then((m) => m.projectsCommand),
 		delete: () => import("./projects-1r5387ui.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-D7v7WK9O.mjs").then((m) => m.devCommand),
+		dev: () => import("./dev-BFPlhkzp.mjs").then((m) => m.devCommand),
 		deploy: () => import("./deploy-DCggsLD7.mjs").then((m) => m.deployCommand),
 		promote: () => import("./deploy-DCggsLD7.mjs").then((m) => m.promoteCommand),
 		staging: () => import("./staging-CdpV2YHB.mjs").then((m) => m.stagingCommand),
@@ -76,13 +76,13 @@ const main = defineCommand({
 		token: () => import("./token-C8Bmzwfl.mjs").then((m) => m.tokenCommand),
 		egress: () => import("./egress-BhbQfjjV.mjs").then((m) => m.egressCommand),
 		schedule: () => import("./schedule-DK_Cv6Xf.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-QhD8k6Ph.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-B3pnUPLf.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-TaSLpQZ5.mjs").then((m) => m.dbCommand),
 		usage: () => import("./usage-C1-cvS2-.mjs").then((m) => m.usageCommand),
 		open: () => import("./open-D7f1wNn3.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-c0CdeBxh.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-BvoYCIKk.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-0lmdjvom.mjs").then((m) => m.upgradeCommand),
+		docs: () => import("./docs-BDPL0TI3.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-CgToW_Ac.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-Bl_NJ_m5.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-Beqz--Df.mjs").then((m) => m.logsCommand)
 	}
 });

package/dist/{local-CsSP4Vpt.mjs → local-BjsuI1IB.mjs}

@@ -1,6 +1,6 @@
 import { s as apiDataRequest } from "./ui--atbZ-TM.mjs";
-import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BKKAEkbH.mjs";
-import { n as rewriteApiPath } from "./dev-CNqx_53I.mjs";
+import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BPKfY9IN.mjs";
+import { n as rewriteApiPath } from "./dev-XULukupE.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
@@ -15,19 +15,48 @@ import { Hono } from "hono";
 *  - `fts: false` — search() is an ILIKE substring fallback: different
 *    matches, no ranking (results order by created_at). Surfaced to clients
 *    as `capabilities.fts` rather than papered over.
-*  - patch() is a shallow jsonb merge (`||`): top-level keys replace rather
-*    than deep-merge, and a null value stores null instead of removing the
-*    key.
+*  - patch() has the SAME RFC 7386 semantics as SQLite's json_patch (nested
+*    objects merge, null removes a key), but Postgres has no built-in for it,
+*    so it goes through `public._canopy_merge_patch(jsonb, jsonb)` — a small
+*    recursive plpgsql function declared in the DDL below. It lives in
+*    `public` (not the per-project schema) so one CREATE OR REPLACE covers
+*    every project schema in the database, existing ones included.
 */
 const DOC_COLUMNS$1 = "id, data, created_at, updated_at";
-const DOC_STORE_DDL_PG = [`CREATE TABLE IF NOT EXISTS _canopy_docs (
+const DOC_STORE_DDL_PG = [
+	`CREATE TABLE IF NOT EXISTS _canopy_docs (
     collection TEXT NOT NULL,
     id TEXT NOT NULL,
     data TEXT NOT NULL,
     created_at TEXT NOT NULL,
     updated_at TEXT NOT NULL,
     PRIMARY KEY (collection, id)
-  )`, `CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`];
+  )`,
+	`CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`,
+	`CREATE OR REPLACE FUNCTION public._canopy_merge_patch(target jsonb, patch jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $fn$
+BEGIN
+  IF jsonb_typeof(patch) IS DISTINCT FROM 'object' THEN
+    RETURN patch;
+  END IF;
+  IF jsonb_typeof(target) IS DISTINCT FROM 'object' THEN
+    target := '{}'::jsonb;
+  END IF;
+  RETURN COALESCE((
+    SELECT jsonb_object_agg(m.key, m.value) FROM (
+      SELECT t.key, t.value FROM jsonb_each(target) t WHERE NOT (patch ? t.key)
+      UNION ALL
+      SELECT p.key,
+             CASE WHEN jsonb_typeof(p.value) = 'object'
+                  THEN public._canopy_merge_patch(target -> p.key, p.value)
+                  ELSE p.value END
+        FROM jsonb_each(patch) p
+       WHERE jsonb_typeof(p.value) <> 'null'
+    ) m
+  ), '{}'::jsonb);
+END
+$fn$`
+];
 /** `data`'s JSON value at a `$.a.b` path param, as jsonb. */
 const jsonAt = (column, pathParam) => `(${column}::jsonb #> string_to_array(trim(leading '$.' from ${pathParam}::text), '.'))`;
 /**
@@ -124,7 +153,7 @@ const postgresDialect = {
 	},
 	patch(collection, id, patchJson, now) {
 		return {
-			sql: `UPDATE _canopy_docs SET data = (data::jsonb || $1::jsonb)::text, updated_at = $2
+			sql: `UPDATE _canopy_docs SET data = public._canopy_merge_patch(data::jsonb, $1::jsonb)::text, updated_at = $2
         WHERE collection = $3 AND id = $4
         RETURNING ${DOC_COLUMNS$1}`,
 			params: [

package/dist/{login-BrEDKrb3.mjs → login-By4y5O5-.mjs}

@@ -1,6 +1,7 @@
 import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-BFaWfSVu.mjs";
 import { n as openBrowser, r as reportErrors } from "./ui--atbZ-TM.mjs";
 import { defineCommand } from "citty";
+import { hostname } from "node:os";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
@@ -47,19 +48,66 @@ const whoamiCommand = defineCommand({
 		}
 	})
 });
+/**
+* Revoke one site's CLI token on the server (DELETE /control/v1/account/token —
+* the token authenticates and names itself). Best-effort: an unreachable or
+* already-expired token is still forgotten locally, the caller just hears
+* about it. A 401 means the platform no longer knows the token — nothing left
+* to revoke, so that counts as done.
+*/
+async function revokeRemote(apiUrl, token) {
+	try {
+		const res = await fetch(`${apiUrl}/control/v1/account/token`, {
+			method: "DELETE",
+			headers: { authorization: `Bearer ${token}` }
+		});
+		if (res.ok || res.status === 401) return { ok: true };
+		return {
+			ok: false,
+			error: `${res.status} ${await res.text().catch(() => "")}`.trim()
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
 const logoutCommand = defineCommand({
 	meta: {
 		name: "logout",
-		description: "Sign out: forget all local CLI tokens"
+		description: "Sign out: revoke and forget all CLI tokens"
 	},
-	run: reportErrors("logout", async () => {
+	args: { local: {
+		type: "boolean",
+		default: false,
+		description: "Only forget the tokens on this machine; do not revoke them on the platform"
+	} },
+	run: reportErrors("logout", async ({ args }) => {
 		const file = readConfigFile();
-		if (!Object.values(file.profiles ?? {}).some((p) => p?.token)) {
+		const held = Object.entries(file.profiles ?? {}).filter(([, p]) => p?.token);
+		if (held.length === 0) {
 			console.log("Not logged in.");
 			return;
 		}
+		const failed = [];
+		if (!args.local) for (const [id, prof] of held) {
+			const baked = isProfileId(id) ? getBakedProfile(id) : void 0;
+			if (!baked) continue;
+			const result = await revokeRemote(baked.apiUrl, prof.token);
+			if (!result.ok) failed.push(`${id} (${result.error})`);
+		}
 		clearAllProfileTokens();
+		if (args.local) {
+			console.log("Logged out locally — tokens removed from ~/.canopy/config.json but still valid on the platform until they expire. Revoke them from the dashboard's Account page.");
+			return;
+		}
+		if (failed.length === 0) {
+			console.log("Logged out — all site tokens revoked and removed from ~/.canopy/config.json.");
+			return;
+		}
 		console.log("Logged out — all site tokens removed from ~/.canopy/config.json.");
+		console.log(`Could not revoke on: ${failed.join(", ")}. Those tokens stay valid until they expire; revoke them from the dashboard's Account page.`);
 	})
 });
 /** Wait for OneLogin to redirect back to the local loopback server. */
@@ -125,7 +173,10 @@ async function mintForProfile(id, idToken) {
 		const cliTokenRes = await fetch(`${baked.apiUrl}/control/v1/auth/cli-token`, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
-			body: JSON.stringify({ id_token: idToken })
+			body: JSON.stringify({
+				id_token: idToken,
+				name: hostname()
+			})
 		});
 		if (!cliTokenRes.ok) return {
 			ok: false,

package/dist/{package-BuwV_mje.mjs → package-C5rZwlw8.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.22";
+var version = "0.7.23";
 //#endregion
 export { version as t };

package/dist/{skill-BvoYCIKk.mjs → skill-CgToW_Ac.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-BuwV_mje.mjs";
+import { t as version } from "./package-C5rZwlw8.mjs";
 import { r as reportErrors } from "./ui--atbZ-TM.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/{src-BKKAEkbH.mjs → src-BPKfY9IN.mjs}

@@ -1,4 +1,54 @@
 import { Hono } from "hono";
+//#region ../data-plane/src/blob-headers.ts
+/**
+* Blob (SDK file store) serving policy. Blobs carry a caller-chosen content
+* type and are served on the project's own origin, so a stored `text/html` or
+* `image/svg+xml` upload would be a stored-XSS page with the project's origin.
+* Types browsers can render harmlessly stay inline; SVG stays inline but is
+* sandboxed (an `<img>` never runs its scripts, and a direct navigation gets an
+* opaque origin); everything else — HTML, XML, scripts, unknown binaries —
+* downloads instead of rendering.
+*/
+const INLINE_SAFE_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp",
+	"image/avif",
+	"image/bmp",
+	"image/x-icon",
+	"image/vnd.microsoft.icon",
+	"text/plain",
+	"text/csv",
+	"application/json",
+	"application/pdf"
+]);
+const INLINE_SAFE_PREFIXES = [
+	"video/",
+	"audio/",
+	"font/"
+];
+const SANDBOX = "sandbox";
+function blobServingHeaders(contentType, key) {
+	const type = contentType.split(";")[0].trim().toLowerCase();
+	const headers = {
+		"content-type": contentType,
+		"x-content-type-options": "nosniff"
+	};
+	if (type === "image/svg+xml") {
+		headers["content-security-policy"] = `default-src 'none'; style-src 'unsafe-inline'; ${SANDBOX}`;
+		return headers;
+	}
+	if (type === "application/pdf") {
+		headers["content-security-policy"] = SANDBOX;
+		return headers;
+	}
+	if (INLINE_SAFE_TYPES.has(type) || INLINE_SAFE_PREFIXES.some((p) => type.startsWith(p))) return headers;
+	headers["content-disposition"] = `attachment; filename="${(key.split("/").at(-1) ?? "download").replace(/["\r\n\\]/g, "_")}"`;
+	headers["content-security-policy"] = SANDBOX;
+	return headers;
+}
+//#endregion
 //#region ../data-plane/src/blob.ts
 /**
 * /blob — the SDK's file storage over an injectable BlobStore (a bucket
@@ -118,7 +168,7 @@ function blobRouter(config) {
 		const object = await store.bucket.get(store.prefix + key);
 		if (!object) return c.json({ error: "not_found" }, 404);
 		return new Response(object.body, { headers: {
-			"content-type": object.httpMetadata?.contentType ?? "application/octet-stream",
+			...blobServingHeaders(object.httpMetadata?.contentType ?? "application/octet-stream", key),
 			"cache-control": "private, no-store"
 		} });
 	});
@@ -270,6 +320,8 @@ const MAX_SQL_ROWS = 1e3;
 */
 function readOnlySqlViolation(query) {
 	const bare = query.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/'(?:[^']|'')*'/g, "''").replace(/"(?:[^"]|"")*"/g, "\"\"");
+	const semicolon = bare.indexOf(";");
+	if (semicolon !== -1 && bare.slice(semicolon + 1).trim() !== "") return "multiple statements are not allowed in read-only mode";
 	const first = /^\s*([A-Za-z]+)/.exec(bare)?.[1]?.toUpperCase();
 	if (first === void 0) return "empty statement";
 	if (![

package/dist/{upgrade-0lmdjvom.mjs → upgrade-Bl_NJ_m5.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-BvoYCIKk.mjs");
+		const { skillInstalled } = await import("./skill-CgToW_Ac.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.22",
+  "version": "0.7.23",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -20,8 +20,8 @@
     "esbuild": "^0.28.1",
     "hono": "^4.8.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy-data-plane": "0.0.4",
-    "@mediamonks/canopy": "0.0.6"
+    "@mediamonks/canopy": "0.0.7",
+    "@mediamonks/canopy-data-plane": "0.0.4"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/dev-D7v7WK9O.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-CNqx_53I.mjs";
-export { devCommand };