@mediamonks/canopy-cli 0.7.22 → 0.7.24

package/dist/db-jmYaum8F.mjs

@@ -0,0 +1,251 @@
+import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, s as apiDataRequest } from "./ui-CUNkis89.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Btzr9_q7.mjs";
+import { defineCommand } from "citty";
+import { readFileSync, writeFileSync } from "node:fs";
+import * as p from "@clack/prompts";
+//#region src/db.ts
+/**
+* canopy db pull | snapshot | snapshots | restore — data safety from the
+* terminal (docs/04-roadmap.md Phase 2 item 4, pulled forward).
+*
+* pull      download a fresh SQL dump of the project database
+* snapshot  store a dump server-side (restorable from CLI or dashboard)
+* snapshots list stored snapshots
+* restore   replace ALL project data from a snapshot or a local .sql file
+* migrate   apply pending schema migrations (docs/13-migrations-and-drizzle.md)
+* access    show or set what the app's pages may do with the database (docs/35)
+*
+* The project comes from canopy.json in the current directory, or
+* --project <slug>.
+*/
+/** Shared flag: operate on the staging channel's database (docs/14). */
+const stagingFlagArgs = { staging: {
+	type: "boolean",
+	default: false,
+	description: "Target the staging channel's database instead of live"
+} };
+const channelOf = (args) => args.staging ? "staging" : "live";
+const channelNote = (args) => args.staging ? " [staging]" : "";
+const formatSize = (bytes) => bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)} kB` : `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+const pullCommand = defineCommand({
+	meta: {
+		name: "pull",
+		description: "Download a fresh SQL dump of the project database"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs,
+		out: {
+			type: "string",
+			description: "Output file (defaults to <slug>-<timestamp>.sql)"
+		}
+	},
+	run: reportErrors("db pull", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const out = args.out ?? `${slug}-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replaceAll(/[:T]/g, "-")}.sql`;
+		const spin = p.spinner();
+		spin.start(`Exporting ${slug}${channelNote(args)}…`);
+		try {
+			const { url } = await apiDataRequest("POST", "/db/export", slug, void 0, void 0, channelOf(args));
+			const download = await fetch(url);
+			if (!download.ok) throw new Error(`Download failed (HTTP ${download.status}).`);
+			const sql = Buffer.from(await download.arrayBuffer());
+			writeFileSync(out, sql);
+			spin.stop(`Wrote ${out} (${formatSize(sql.byteLength)}).`);
+		} catch (err) {
+			spin.error("Export failed.");
+			throw err;
+		}
+	})
+});
+const snapshotCommand = defineCommand({
+	meta: {
+		name: "snapshot",
+		description: "Store a dump server-side (restorable anytime)"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs
+	},
+	run: reportErrors("db snapshot", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const spin = p.spinner();
+		spin.start(`Snapshotting ${slug}${channelNote(args)}…`);
+		let created;
+		try {
+			({snapshot: created} = await apiDataRequest("POST", "/db/snapshots", slug, void 0, void 0, channelOf(args)));
+		} catch (err) {
+			spin.error("Snapshot failed.");
+			throw err;
+		}
+		spin.stop(`Stored ${created.key} (${formatSize(created.size)}).`);
+		console.log(`Restore anytime with \`canopy db restore --snapshot ${created.key}\`.`);
+	})
+});
+const snapshotsCommand = defineCommand({
+	meta: {
+		name: "snapshots",
+		description: "List stored snapshots"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs
+	},
+	run: reportErrors("db snapshots", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const { snapshots } = await apiDataRequest("GET", "/db/snapshots", slug, void 0, void 0, channelOf(args));
+		if (snapshots.length === 0) {
+			console.log(`No snapshots for ${slug} yet — run \`canopy db snapshot\`.`);
+			return;
+		}
+		for (const snapshot of snapshots) console.log(`${snapshot.key}  ${formatSize(snapshot.size).padStart(9)}  ${snapshot.createdAt}`);
+	})
+});
+const restoreCommand = defineCommand({
+	meta: {
+		name: "restore",
+		description: "Replace ALL project data from a snapshot or a local .sql file"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs,
+		file: {
+			type: "positional",
+			description: "Local .sql dump to restore from",
+			required: false
+		},
+		snapshot: {
+			type: "string",
+			description: "Server-side snapshot key to restore from"
+		},
+		yes: {
+			type: "boolean",
+			default: false,
+			description: "Skip the type-the-slug confirmation"
+		}
+	},
+	run: reportErrors("db restore", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const { file } = args;
+		let snapshotKey = args.snapshot;
+		if (!snapshotKey && !file) {
+			requireTty("pass a local .sql dump or --snapshot <key>.");
+			const { snapshots } = await apiDataRequest("GET", "/db/snapshots", slug, void 0, void 0, channelOf(args));
+			if (snapshots.length === 0) throw new Error(`No snapshots for ${slug} — run \`canopy db snapshot\` first, or pass a local .sql dump.`);
+			snapshotKey = unwrap(await p.select({
+				message: `Snapshot to restore into ${slug}`,
+				options: snapshots.map((snapshot) => ({
+					value: snapshot.key,
+					label: snapshot.key,
+					hint: `${formatSize(snapshot.size)} · ${snapshot.createdAt}`
+				}))
+			}));
+		}
+		if (!args.yes) {
+			requireTty("pass --yes to restore without confirmation.");
+			if (unwrap(await p.text({ message: `Restore will REPLACE all current data in "${slug}"${channelNote(args)} with ${snapshotKey ?? file}. Type the slug to confirm.` })).trim() !== slug) {
+				p.cancel("Aborted.");
+				return;
+			}
+		}
+		const restoreContext = { action: `restore "${slug}" from ${snapshotKey ?? file}` };
+		if (snapshotKey) await withContext(apiDataRequest("POST", "/db/restore", slug, { snapshot: snapshotKey }, void 0, channelOf(args)), restoreContext);
+		else if (file) await withContext(apiDataRequest("POST", "/db/restore", slug, readFileSync(file, "utf8"), "application/sql", channelOf(args)), restoreContext);
+		p.log.success(`Restored ${slug}${channelNote(args)}.`);
+	})
+});
+const migrateCommand = defineCommand({
+	meta: {
+		name: "migrate",
+		description: "Apply pending schema migrations to the project database"
+	},
+	args: {
+		...projectFlagArgs,
+		...stagingFlagArgs,
+		plan: {
+			type: "boolean",
+			default: false,
+			description: "Dry run: list pending migrations without applying anything"
+		}
+	},
+	run: reportErrors("db migrate", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const files = readMigrationFiles(dir);
+		if (files === void 0) throw new Error("No migrations directory configured — set \"migrations\" in canopy.json (e.g. {\"migrations\": \"./migrations\"}, pointing at your drizzle-kit output).");
+		if (args.plan) {
+			const result = await withContext(migrateProject(slug, files, true, channelOf(args)), { action: `plan migrations for "${slug}"${channelNote(args)}` });
+			if (result.pending.length === 0) console.log(`Nothing pending (${result.applied.length} applied previously).`);
+			else for (const name of result.pending) console.log(`pending ${name}`);
+			for (const line of describeMigrateResult(result)) console.log(line);
+			return;
+		}
+		const spin = p.spinner();
+		spin.start(`Migrating ${slug}${channelNote(args)}…`);
+		let result;
+		try {
+			result = await withContext(migrateProject(slug, files, false, channelOf(args)), { action: `migrate "${slug}"${channelNote(args)}` });
+		} catch (err) {
+			spin.error("Migrate failed.");
+			throw err;
+		}
+		spin.stop(result.appliedNow.length === 0 ? `Nothing pending for ${slug}.` : `Applied ${result.appliedNow.length} migration(s) to ${slug}.`);
+		for (const line of describeMigrateResult(result)) console.log(`  ${line}`);
+	})
+});
+const LEVEL_MEANING = {
+	full: "pages can read and write the database (collections and raw SQL)",
+	readonly: "pages can read; SQL that writes and collection writes are refused",
+	off: "pages cannot touch the database — only the worker and the CLI can"
+};
+function printAccess(slug, access) {
+	console.log(`${slug}: browser access is ${access.level} — ${LEVEL_MEANING[access.level]}.`);
+	console.log("Tables and collections named private_… are worker-only at every level.");
+	if (access.clientAccess && access.level !== "off") {
+		console.log("");
+		console.log(`  ! Client access is on: visitors who know the password can ${access.level === "full" ? "read and change" : "read"} this data from their browser.`);
+		console.log("    Name tables private_… to keep them worker-only, or `canopy db access off`.");
+	}
+}
+const dbCommand = defineCommand({
+	meta: {
+		name: "db",
+		description: "Data tools: pull, snapshot, snapshots, restore, migrate, access"
+	},
+	subCommands: {
+		pull: pullCommand,
+		snapshot: snapshotCommand,
+		snapshots: snapshotsCommand,
+		restore: restoreCommand,
+		migrate: migrateCommand,
+		access: defineCommand({
+			meta: {
+				name: "access",
+				description: "Show or set what the app's own pages may do with the database (full | readonly | off)"
+			},
+			args: {
+				...projectFlagArgs,
+				level: {
+					type: "positional",
+					description: "full | readonly | off (omit to show)",
+					required: false
+				}
+			},
+			run: reportErrors("db access", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const wanted = args.level?.trim().toLowerCase();
+				if (!wanted) {
+					printAccess(slug, await apiRequest("GET", `/projects/${slug}/db-access`));
+					return;
+				}
+				if (wanted !== "full" && wanted !== "readonly" && wanted !== "off") {
+					console.error(`unknown level "${wanted}" — expected full, readonly or off.`);
+					process.exit(1);
+				}
+				printAccess(slug, await apiRequest("PUT", `/projects/${slug}/db-access`, { level: wanted }));
+			})
+		})
+	}
+});
+//#endregion
+export { dbCommand };

package/dist/{deploy-DCggsLD7.mjs → deploy-CYKiBnrg.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, c as apiDownload, d as withContext, l as apiRequest, r as reportErrors, s as apiDataRequest, t as formatDateTime } from "./ui--atbZ-TM.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Bg9FEGFh.mjs";
+import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { a as unwrap, c as apiDownload, d as withContext, l as apiRequest, r as reportErrors, s as apiDataRequest, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Btzr9_q7.mjs";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";

package/dist/dev-C5BmSJo1.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-DVUEJ80c.mjs";
+export { devCommand };

package/dist/{dev-CNqx_53I.mjs → dev-DVUEJ80c.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui--atbZ-TM.mjs";
-import { r as readMigrationFiles } from "./migrations-Bg9FEGFh.mjs";
+import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
+import { r as readMigrationFiles } from "./migrations-Btzr9_q7.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { existsSync } from "node:fs";
@@ -37,7 +37,7 @@ async function workerPlugin(flags, slug) {
 		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
 		return;
 	}
-	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-Bij9OUMk.mjs");
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-CWU6XFe_.mjs");
 	const secrets = readDevVars(flags.dir);
 	const email = siteConfig().email;
 	const plugin = workerDevPlugin({
@@ -165,7 +165,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-CsSP4Vpt.mjs");
+		const { fetchProjectDump } = await import("./local-CNPBZ89U.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -180,7 +180,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-CsSP4Vpt.mjs");
+	const { createSandbox } = await import("./local-CNPBZ89U.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/{dev-worker-Bij9OUMk.mjs → dev-worker-CWU6XFe_.mjs}

@@ -1,4 +1,4 @@
-import "./src-BKKAEkbH.mjs";
+import "./src-BK0Hiwsn.mjs";
 import { readFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
 //#region ../data-plane/src/worker-request.ts
@@ -25,6 +25,39 @@ const IDENTITY_STAMP_HEADERS = [
 	"x-canopy-user-email",
 	"x-canopy-user-name"
 ];
+/** Cookies that authenticate to Canopy itself — the monk session and the client-page session. */
+const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_client"]);
+/**
+* Strip Canopy's own credentials from a request before untrusted project code
+* sees it (R-01).
+*
+* The visitor's session cookie arrives with every request the gateway
+* dispatches, and a bundle that can read it can replay it against the platform
+* as that person — against the control plane, and against other projects' data
+* on the api host. It is a credential, so the host keeps it in closure scope
+* like the raw DB and blob handles, and hands the bundle a redacted request.
+*
+* Redaction is surgical on purpose: an app's own cookies and its own
+* Authorization scheme survive, because those belong to the app. Only
+* `canopy_session` / `canopy_client` and a `cnpy_` bearer are removed.
+*
+* `env.CANOPY.fetch` still authenticates as the visitor — the host passes it
+* the unredacted headers — so nothing about the platform-facing behaviour
+* changes; the credential simply stops being reachable from bundle code.
+*/
+function redactCanopyCredentials(headers) {
+	const cookie = headers.get("cookie");
+	if (cookie !== null) {
+		const kept = cookie.split(";").filter((part) => {
+			const name = part.split("=")[0]?.trim() ?? "";
+			return name !== "" && !CANOPY_COOKIE_NAMES.has(name);
+		}).join(";").trim();
+		if (kept === "") headers.delete("cookie");
+		else headers.set("cookie", kept);
+	}
+	if (headers.get("authorization")?.startsWith("Bearer cnpy_")) headers.delete("authorization");
+	return headers;
+}
 /**
 * Strip what must never travel upstream and stamp who is calling. Common to
 * every host; says nothing about credentials.
@@ -331,6 +364,7 @@ function workerDevPlugin(options) {
 						}));
 						return;
 					}
+					redactCanopyCredentials(request.headers);
 					await sendResponse(res, await worker.fetch(request, env));
 				})().catch((err) => {
 					if (err instanceof Error) server.ssrFixStacktrace(err);

package/dist/docs/ci.md

@@ -9,7 +9,8 @@ can deploy that one project and nothing else.
 
 ## Create a token
 
-From inside the project directory:
+Only the project owner can create a deploy token (any collaborator can list
+and revoke them). From inside the project directory:
 
 ```bash
 canopy token create --name "GitHub Actions"
@@ -47,4 +48,10 @@ No `canopy login` step is needed — the token is the credential.
 - A deploy token can only deploy its own project — it reaches that project's
   deploy endpoints and upload grants and nothing else. If it strays to another
   project's resources, the platform rejects it.
+- The token belongs to the project, not to the person who created it. It keeps
+  working when they leave the project or the company; deploys it makes show up
+  in the history under the token's name.
+- A token that goes 90 days without a deploy stops working. Active pipelines
+  never notice; a forgotten one dies on its own. The token list shows when each
+  was last used.
 - Revoke a token the moment it might be exposed; create a fresh one to replace it.

package/dist/docs/cli-egress.md

@@ -32,7 +32,8 @@ target directory, or `--project <slug>` to override — and honor the global
 - `mode [allowlist|open]` — show or switch the
   [egress mode](https://docs.canopy.website/platform/egress#open-mode). Switching to `open` prints a risk
   summary and asks you to type the project slug; pass `--accept-risk` to
-  acknowledge it non-interactively. Switching back needs no ceremony.
+  acknowledge it non-interactively. Only the project owner can switch to
+  `open`; switching back needs no ceremony and any member can do it.
 - `log` — print the [outbound traffic log](https://docs.canopy.website/platform/egress#the-outbound-traffic-log):
   hosts the worker actually fetched, with counts and last-seen times.
 

package/dist/docs/cli-login.md

@@ -24,6 +24,8 @@ canopy login --json                # machine-readable status for agents/CI
 2. You finish signing in **in the browser** — your password never passes through the CLI. When OneLogin hands control back, the browser shows a small "You're signed in" page and you can return to the terminal. The sign-in waits up to 5 minutes; the hand-back uses local port `8976`, so if another program holds that port the login fails with a clear message.
 3. The CLI stores a token for **every** site (`main`, `staging`, `gcp-pilot`), not just the one you picked, in `~/.canopy/config.json` — readable only by your user account.
 
+Each token is labelled with your machine's hostname and expires after 30 days. The dashboard's **Account** page (your avatar → Account) lists every machine you have signed in from and lets you revoke any of them; `canopy logout` revokes this machine's tokens for you.
+
 One login therefore covers all sites; `--profile` only decides which one commands target by default. If minting fails for a non-active site you get a warning but login still succeeds; if it fails for your **active** profile the command errors and asks you to re-run.
 
 ## Examples

package/dist/docs/cli-logout.md

@@ -1,25 +1,28 @@
 ---
 title: canopy logout
-description: Sign out of Canopy by removing all locally stored CLI tokens.
+description: Sign out of Canopy — revoke your CLI tokens on every site and forget them locally.
 ---
 
-`canopy logout` signs you out on this machine by forgetting every stored CLI token. Use it on a shared machine, or when you want a clean slate before logging in as someone else.
+`canopy logout` signs you out on this machine: it revokes the CLI token stored for every site on the platform, then forgets them in `~/.canopy/config.json`. Use it on a shared machine, or when you want a clean slate before logging in as someone else.
 
 ## Usage
 
 ```bash
 canopy logout
+canopy logout --local     # forget the tokens here, but leave them valid on the platform
 ```
 
 ## Arguments & flags
 
-None. Logout is deliberately all-or-nothing: it clears the tokens for **every** site (`main`, `staging`, `gcp-pilot`) at once — there is no per-profile logout, so the global `--profile` flag has no effect here.
+- `--local` — only remove the tokens from this machine; nothing is called on the server. The tokens stay valid until they expire (30 days after login), and you can still revoke them from the dashboard's **Account** page.
+
+Logout is deliberately all-or-nothing: it signs out of **every** site (`main`, `staging`, `gcp-pilot`) at once — there is no per-profile logout, so the global `--profile` flag has no effect here.
 
 ## Details
 
-The command is local-only: it removes every stored token from `~/.canopy/config.json` and prints a confirmation. Nothing is called on the server, so the tokens themselves aren't revoked — they simply age out at their normal expiry. Your active-site choice stays in the file, so the next `canopy login` picks up where you left off.
+For each site with a stored token, the command asks the platform to revoke that token, so it stops working everywhere immediately — not just on this machine. Then the file is cleaned up. If a site cannot be reached, the local copy is still removed and the command tells you which tokens it could not revoke; those keep working until they expire, or until you revoke them from the dashboard's **Account** page (your avatar → Account), which lists every machine you have signed in from.
 
-If no token was stored to begin with, it prints `Not logged in.` and exits successfully.
+Your active-site choice stays in the file, so the next `canopy login` picks up where you left off. If no token was stored to begin with, it prints `Not logged in.` and exits successfully.
 
 ## Examples
 
@@ -27,6 +30,6 @@ If no token was stored to begin with, it prints `Not logged in.` and exits succe
 canopy logout
 ```
 
-Removes all site tokens from `~/.canopy/config.json`; subsequent commands that need the API will ask you to run `canopy login`.
+Revokes all site tokens on the platform and removes them from `~/.canopy/config.json`; subsequent commands that need the API will ask you to run `canopy login`.
 
 See also [canopy login](https://docs.canopy.website/cli/login) and [canopy whoami](https://docs.canopy.website/cli/whoami).

package/dist/docs/cli-token.md

@@ -17,15 +17,17 @@ canopy token revoke <id>
 
 All subcommands resolve the project the usual way — `canopy.json` in the target directory, or `--project <slug>` to override — and honor the global `--profile <site>` / `CANOPY_PROFILE` for which site the token belongs to.
 
-- `create` — mint a new deploy token for the project.
+- `create` — mint a new deploy token for the project. Owner only: collaborators get a clear error and should ask the owner.
   - `--name <label>` — a label shown in the dashboard, e.g. `"GitHub Actions"`. Optional but recommended so you can tell tokens apart later.
-- `list` — show the project's deploy tokens: id, name, creation time, and who created them. Token values are never shown here.
+- `list` — show the project's deploy tokens: id, name, creation time, who created them, and when each was last used. Token values are never shown here.
 - `revoke <id>` — delete a token by its id (from `canopy token list`). Deploys using it stop working immediately.
 
 ## How it works
 
 `create` prints the token plaintext **exactly once** — the platform stores only a hash, so copy it right away. The token is scoped to a single project on a single site: it can deploy that project and nothing else, which makes it safe to hand to a CI system.
 
+The token belongs to the project rather than to whoever created it, so CI keeps working when that person leaves. It has no fixed expiry but stops working after 90 days without a deploy; `list` shows when each token was last used.
+
 To use it in CI, put the value in the `CANOPY_DEPLOY_TOKEN` environment variable — the CLI checks it before the login token, so `canopy deploy` works on a runner with no `canopy login`. For GitHub Actions, add it as the repo secret `CANOPY_DEPLOY_TOKEN` (`gh secret set CANOPY_DEPLOY_TOKEN`, or Settings → Secrets); pushes to main then deploy via the project's `canopy-deploy.yml` workflow.
 
 If a deploy fails with a rejected token, it was likely revoked — create a fresh one here or in the dashboard (Settings → Deploy tokens) and update the secret. Losing a token is never a problem: revoke the old id and mint a new one.

package/dist/docs/index.json

@@ -117,7 +117,7 @@
         {
           "slug": "platform-ai-usage",
           "title": "AI access & usage",
-          "summary": "Projects talk to AI models through the platform — no API keys to manage, a hard daily budget per project, and full visibility of spend."
+          "summary": "Projects talk to AI models through the platform — no API keys to manage, hard per-project budgets, and full visibility of spend."
         },
         {
           "slug": "platform-google",
@@ -154,6 +154,11 @@
           "title": "Client access",
           "summary": "Share a project with clients who have no Monks account — a shared password unlocks that one project's URL and nothing else."
         },
+        {
+          "slug": "platform-security-headers",
+          "title": "Browser security",
+          "summary": "The security headers the platform adds to your app's pages and files, what they block, and the two switches in Settings."
+        },
         {
           "slug": "platform-sites-and-profiles",
           "title": "Sites & profiles",
@@ -184,7 +189,7 @@
         {
           "slug": "cli-logout",
           "title": "canopy logout",
-          "summary": "Sign out of Canopy by removing all locally stored CLI tokens."
+          "summary": "Sign out of Canopy — revoke your CLI tokens on every site and forget them locally."
         },
         {
           "slug": "cli-create",

package/dist/docs/platform-ai-usage.md

@@ -1,11 +1,11 @@
 ---
 title: AI access & usage
-description: Projects talk to AI models through the platform — no API keys to manage, a hard daily budget per project, and full visibility of spend.
+description: Projects talk to AI models through the platform — no API keys to manage, hard per-project budgets, and full visibility of spend.
 ---
 
 Canopy projects can call AI models without you ever handling an API key. The
 platform routes every request through its own metered gateway, tracks what
-each project spends, and enforces a hard daily budget — so a runaway loop in
+each project spends, and enforces hard budgets — so a runaway loop in
 a vibecoded app becomes a capped bill and a visible chart, not a surprise
 invoice.
 
@@ -26,9 +26,26 @@ const reply = await canopy.ai.chat({
   default — ask for a model outside the list and the API tells you what _is_
   available.
 - **Streaming** via `canopy.ai.chatStream()` for chat-style UIs.
+- **Documents and images.** Messages can attach files — reference something
+  in the project's [blob storage](https://docs.canopy.website/sdk/blob) by key, or inline base64 — see
+  [the AI SDK page](https://docs.canopy.website/sdk/ai). Models that read PDFs and images get the real
+  document, not a text extraction.
 - **An OpenAI-compatible endpoint.** `canopy.ai.endpoint()` returns a base
   URL and model list you can plug into ecosystem tools (like the Vercel AI
   SDK) — same key handling, same budget, same tracking.
+- **Provider-native endpoints.** For provider-specific capabilities —
+  Anthropic prompt caching and PDF citations, OpenAI's Responses API — point
+  an official SDK at the native base URLs from `canopy.ai.endpoint()`. Same
+  budget and tracking as everything else; see [the AI SDK page](https://docs.canopy.website/sdk/ai).
+
+## Request size
+
+A single chat request — prompt, inline base64 attachments, and referenced
+blobs together — can be up to **8 MB**. Base64 makes files about a third
+larger than they are on disk, so that fits roughly a 6 MB document per
+request. Bigger requests answer with a `chat_too_large` error (HTTP 413)
+before anything is sent to a model. Providers also have their own per-file
+limits, which are typically above this.
 
 ## Your data and the model providers
 
@@ -41,16 +58,25 @@ This applies to every way your project reaches AI — `canopy.ai.chat()`,
 streaming, and the OpenAI-compatible endpoint all go through the same gateway
 to the same accounts.
 
-## The daily budget
+## Budgets: a daily limit and a monthly cap
+
+Every project has two AI budgets in USD, enforced from the same spend ledger
+the dashboard displays — so what you see and what's enforced can never
+disagree:
+
+- **A daily limit** (default $5) catches runaway loops. Cross it and AI
+  calls answer `ai_budget_exceeded` until midnight UTC; everything resets
+  the next day.
+- **A monthly cap** (default $20) is the real spending ceiling. Cross it and
+  AI calls pause until the calendar month rolls over.
 
-Every project has a daily AI budget in USD. When a project's spend for the
-day crosses it, further AI calls answer with an `ai_budget_exceeded` error
-until the day rolls over. The budget is enforced from the same spend ledger
-the dashboard displays, so what you see and what's enforced can never
-disagree.
+The error names which one tripped. The Usage tab shows spend against both.
+If a project genuinely needs more headroom, a Canopy admin can raise either
+budget from that same tab — ask in the project's feedback or reach out to
+the platform team.
 
-> **Note:** Hitting the cap doesn't break the rest of your app — pages, data, and files keep working. Only AI
-> calls pause until the next day.
+> **Note:** Hitting a budget doesn't break the rest of your app — pages, data, and files keep working. Only AI
+> calls pause until the window rolls over.
 
 ## The Usage tab
 

package/dist/docs/platform-client-access.md

@@ -36,8 +36,11 @@ it** card:
 2. Send the client the project URL and the password.
 
 To change the password, set a new one — previously handed-out passwords stop
-working for new sign-ins. To turn client access off entirely, remove the
-password from the same card; visitors are back to Monks-only immediately.
+working, and every browser that unlocked the project with the old one is
+signed out on its next visit and asked for the new password. To turn client
+access off entirely, remove the password from the same card, or switch the
+mode back to Monks only; either way, visitors are back to Monks-only
+immediately, unlocked browsers included.
 
 > **Warning:** A shared password is deliberately lightweight protection — right for work-in-progress previews,
 > wrong for anything sensitive. Anyone who has it can view the app and share it further, so rotate
@@ -51,4 +54,13 @@ the app down for Monks outside the team while a client with the password
 still gets in. That combination — "the client and the project team, nobody
 else" — is a common setup during a review phase.
 
+The password opens the app's data the same way it opens the app. Whatever a
+page may do with the project database under **Browser access** on the Data
+tab — read and write by default — a visitor who knows the password may do
+too, from their own browser. The dashboard points this out wherever the two
+settings meet. If the project has tables the client should not see or change,
+name them `private_…` so only the worker can reach them, or set browser
+access to read only or off. See
+[Who can call this from the browser](https://docs.canopy.website/sdk/database#who-can-call-this-from-the-browser).
+
 - [Members & access](https://docs.canopy.website/platform/members-and-access) — Who can view and who can manage a project, and how to tighten it.

package/dist/docs/platform-egress.md

@@ -102,9 +102,11 @@ allowlist:
 Because open mode means _users of your app can decide where it connects_,
 enabling it is a deliberate act: the dashboard asks you to type the project
 slug under a plain-language risk summary, and the CLI wants an interactive
-confirmation or the explicit `--accept-risk` flag. Extra care applies if the
-project has [client access](https://docs.canopy.website/platform/client-access) enabled — then untrusted
-visitors drive the fetches.
+confirmation or the explicit `--accept-risk` flag. Only the **project owner**
+can switch open mode on; other members can still manage the allowlist and
+switch back. Extra care applies if the project has
+[client access](https://docs.canopy.website/platform/client-access) enabled — then untrusted visitors
+drive the fetches.
 
 Switching back is one command (`canopy egress mode allowlist`), and the
 dashboard offers to **seed the allowlist from the observed hosts** so