@mediamonks/canopy-cli 0.7.22 → 0.7.24

package/dist/docs/platform-members-and-access.md

@@ -61,11 +61,34 @@ Turning it off again is the same toggle.
 > **Note:** Collaborators-only gates the **live app**. Management access (settings, data, deploys) is always
 > members-only, regardless of this toggle.
 
-## Platform admins and the Users page
-
-Platform admins get an extra **Users** page in the dashboard listing everyone
-on Canopy — name, email, and when they first signed in — with a one-click way
-to grant or remove admin. Accounts are created automatically on first
-OneLogin sign-in; there is nothing to provision.
+## Platform admins and the Admin page
+
+Platform admins get an extra **Admin** page in the dashboard. Its **Users**
+tab lists everyone on Canopy — name, email, when they first and last signed
+in — with a one-click way to grant or remove admin and to sign someone out
+everywhere. Its **Sessions** tab lists every live CLI sign-in on the site:
+who, from which machine, and when it was last used, each revocable on the
+spot. Accounts are created automatically on first OneLogin sign-in; there is
+nothing to provision.
+
+## Your sign-ins, and signing out everywhere
+
+A Canopy sign-in lives in two places: the browser session from OneLogin, and
+the CLI tokens `canopy login` stores on each machine (one per site). Your
+**Account** page — open the avatar menu in the dashboard header — lists the
+machines you have signed in from, with when each token was last used, and lets
+you revoke any of them. Revoking a token is what `canopy logout` does for the
+machine it runs on.
+
+**Sign out everywhere** on the same page ends every browser session and every
+CLI sign-in of yours on that site at once, this one included. Reach for it
+when a laptop goes missing or you signed in somewhere you shouldn't have; the
+next request from any of those places meets the sign-in page. Deploy tokens
+used by CI belong to their projects, not to you, and keep working — revoke
+those from the project's Deploys tab if they were on the lost machine too.
+
+Platform admins have the same button for any user on the **Admin** page, which
+is how someone who leaves the company is signed out of Canopy before their
+open sessions would have expired on their own.
 
 - [Client access](https://docs.canopy.website/platform/client-access) — Share work-in-progress with clients who don't have a Monks account.

package/dist/docs/platform-project-data.md

@@ -60,6 +60,7 @@ canopy db pull        # download a fresh SQL dump
 canopy db snapshot    # store a dump server-side
 canopy db snapshots   # list stored snapshots
 canopy db restore     # replace project data with a snapshot
+canopy db access      # what the app's own pages may do with the database
 ```
 
 `canopy db pull` is also how you develop against realistic data: pull a dump,

package/dist/docs/platform-security-headers.md

@@ -0,0 +1,53 @@
+---
+title: Browser security
+description: The security headers the platform adds to your app's pages and files, what they block, and the two switches in Settings.
+---
+
+Every project on Canopy shares one sign-in, so a script that manages to run
+inside one app is a script running next to every other app a visitor can open.
+To keep that from mattering, the platform adds a small set of browser security
+headers to the pages and files it serves for you. You don't configure anything
+to get them, and most projects never notice they're there.
+
+## What your pages get
+
+- **A Content-Security-Policy.** Scripts may load from your own app and from
+  any `https://` address, so CDNs and hosted libraries keep working. Inline
+  `<script>` blocks that are part of your deployed HTML keep working too — the
+  platform reads them at serve time and allows exactly those. What's blocked:
+  inline event handlers such as `onclick="…"`, `javascript:` links, plugins
+  (`<object>`, `<embed>`), scripts loaded over plain `http://`, and inline
+  scripts that were _not_ in your deploy — which is what an injected script
+  usually is.
+- **No embedding by other sites.** Your pages can only be shown in an iframe by
+  your own app.
+- **A referrer policy and HTTPS pinning.** Other sites see your origin but not
+  your full URLs, and browsers remember to always use HTTPS.
+
+## The two switches
+
+Both live on the project's **Settings → Security** page, and both take effect
+on the next page load — no redeploy.
+
+- **Content-Security-Policy** — on by default. Turn it off if your app depends
+  on something the policy blocks and you can't change it: an inline `onclick`,
+  a `javascript:` link, a library that writes `<script>` tags into the page at
+  runtime, or a backend route that renders HTML with its own inline scripts.
+  Check the browser console first — a blocked script shows up there with the
+  directive that stopped it.
+- **Allow embedding in other sites** — off by default. Turn it on when another
+  site needs to show this app in an iframe.
+
+Backend-rendered pages (a worker route that returns HTML) receive the framing
+and referrer headers but no script policy, because the platform only hashes
+inline scripts it knows came from a deploy.
+
+## Files you store
+
+Files saved with `canopy.blob` are served from your app's address, with the
+content type you gave them. Images, video, audio, fonts, plain text, CSV, JSON
+and PDF display normally. SVGs display too, but sandboxed — fine in an
+`<img>`, and harmless if someone opens the URL directly. Anything a browser
+would treat as a page — HTML, XML, scripts, or files with an unknown type —
+downloads instead of rendering. If you want to show user-uploaded HTML, render
+it inside your own page rather than linking to the stored file.

package/dist/docs/platform-slack.md

@@ -56,7 +56,9 @@ own screen. Click **Install to workspace** and follow it through.
 
 If your workspace requires admin approval for new apps, the first attempt
 becomes an approval request instead. Once the admin approves (Slack DMs you
-about it), come back and click install again.
+about it), either come back and click install again, or use the install
+link Slack itself offers — both complete the same way. A Slack-side install
+only works into the workspace the app already belongs to.
 
 The same button reappears whenever you change features in a way that needs
 new permissions — the card shows a clear warning when saved changes are

package/dist/docs/sdk-ai.md

@@ -4,8 +4,8 @@ description: Metered LLM access through the project's budget-capped gateway key
 ---
 
 `canopy.ai` gives your project LLM access without any API keys in your code.
-Every request authenticates as the project and is metered against a hard
-per-project daily budget — spend, limits, and how prompts are handled by the
+Every request authenticates as the project and is metered against hard
+per-project budgets — spend, limits, and how prompts are handled by the
 model providers are covered in [AI access & usage](https://docs.canopy.website/platform/ai-usage).
 
 ## ai.chat(options)
@@ -32,16 +32,65 @@ res.usage; // { inputTokens: number, outputTokens: number }
 **`ChatOptions`:**
 
 - `messages` — required, non-empty array of `{ role, content }`. `role` is
-  `"system" | "user" | "assistant"`; `content` is a non-empty string.
+  `"system" | "user" | "assistant"`; `content` is a non-empty string, or an
+  array of content parts to attach documents and images (below).
 - `model` — optional `"{provider}/{model}"` id. Omit it and the platform's
   default model answers. Ask for a model whose provider isn't enabled and the
   call fails with a message listing what _is_ available; `ai.endpoint()`
   returns the full curated list.
-- `temperature` — optional number between 0 and 2.
-- `maxTokens` — optional integer, at least 1.
+- `temperature` — optional number between 0 and 2. Reasoning models (the
+  GPT-5 family) only accept their default temperature, so the platform drops
+  this setting for them rather than failing the call — it has effect on
+  Claude models.
+- `maxTokens` — optional integer, at least 1. On reasoning models the budget
+  also covers the model's internal reasoning, so a very small value can
+  return an empty answer — leave headroom.
+- `effort` — optional `"low" | "medium" | "high"`: how hard a reasoning model
+  should think. Lowered onto each provider's own dial; models without an
+  effort dial (Claude Haiku, for one) simply ignore it. Lower effort is
+  faster and cheaper, higher is more thorough.
+
+**`ChatResponse`:** `{ message, model, usage: { inputTokens, outputTokens } }`.
+`message.role` is `"assistant"` and `message.content` is always a plain
+string, whatever went in.
+
+## Attaching documents and images
+
+A message's `content` can be an array of parts instead of a string. The
+easiest way to send a file is to upload it to [blob storage](https://docs.canopy.website/sdk/blob) once
+and reference it by key — the platform fetches it server-side and picks the
+best way to hand it to the model:
 
-**`ChatResponse`:** `{ message: ChatMessage, model: string, usage: { inputTokens, outputTokens } }`.
-`message.role` is `"assistant"`.
+```ts
+await canopy.blob.put("briefs/q3.pdf", file); // once
+
+const res = await canopy.ai.chat({
+  messages: [
+    {
+      role: "user",
+      content: [
+        { type: "text", text: "Summarize this briefing." },
+        { type: "blob", key: "briefs/q3.pdf" },
+      ],
+    },
+  ],
+});
+```
+
+The part types:
+
+- `{ type: "text", text }` — plain text.
+- `{ type: "blob", key, mediaType? }` — a file already in the project's blob
+  storage, by key. `mediaType` overrides the stored content type if needed.
+  **Prefer this** for anything you'd otherwise base64 by hand.
+- `{ type: "file", data, mediaType, filename? }` — an inline file;
+  `data` is base64 (no `data:` prefix), `mediaType` e.g. `"application/pdf"`.
+- `{ type: "image", data, mediaType }` — an inline image, same encoding.
+
+Pick a model that can read what you attach — document and image understanding
+varies per model. The whole request (inline base64 and referenced blobs
+together) must stay under the 8 MB request limit — see
+[AI access & usage](https://docs.canopy.website/platform/ai-usage).
 
 ## ai.chatStream(options)
 
@@ -70,9 +119,10 @@ let an ecosystem client handle streaming for you.
 Returns the project's OpenAI-compatible endpoint info:
 
 ```ts
-const { baseUrl, models } = await canopy.ai.endpoint();
+const { baseUrl, models, native } = await canopy.ai.endpoint();
 // baseUrl — an OpenAI-compatible base URL
 // models  — the curated model list, "{provider}/{model}" ids; models[0] is the default
+// native  — provider-native base URLs: { anthropic, openai }
 ```
 
 Point any OpenAI-compatible client — the Vercel AI SDK, an OpenAI SDK, a
@@ -87,15 +137,56 @@ const openai = createOpenAI({ baseURL: baseUrl, apiKey: "unused" });
 const model = openai(models[0]);
 ```
 
+## Provider-native endpoints
+
+The compat endpoint speaks OpenAI's chat-completions dialect to every model —
+portable, but the lowest common denominator. When you want a provider's own
+protocol — Anthropic prompt caching, PDFs with citations, or OpenAI's
+Responses API — use the native base URLs from `endpoint()`. Requests pass
+through to the provider unchanged; auth, the model allowlist, the daily
+budget, and metering all still apply.
+
+```ts
+import Anthropic from "@anthropic-ai/sdk";
+
+const { native } = await canopy.ai.endpoint();
+const anthropic = new Anthropic({ baseURL: native.anthropic, apiKey: "unused" });
+const msg = await anthropic.messages.create({
+  model: "claude-haiku-4-5", // bare or "anthropic/…" — must be on the curated list
+  max_tokens: 1024,
+  messages: [{ role: "user", content: "Hello" }],
+});
+```
+
+A base URL is just a prefix — the client library appends the endpoint path
+itself, based on which method you call. Both values point at the platform,
+which forwards each path to the provider:
+
+- `native.anthropic` — hand it to `@anthropic-ai/sdk` or `@ai-sdk/anthropic`.
+  Calling `anthropic.messages.create(...)` makes the SDK request
+  `POST {native.anthropic}/v1/messages` — the Messages API.
+- `native.openai` — hand it to the `openai` package or `@ai-sdk/openai`. It
+  already ends in `/v1`, matching OpenAI's own base URL convention; the
+  method you call picks the endpoint: `client.responses.create(...)` requests
+  `POST {native.openai}/responses` (the Responses API) and
+  `client.chat.completions.create(...)` requests
+  `POST {native.openai}/chat/completions`. Both are supported.
+
+Pick the surface by what you need: `ai.chat()` for plain text (and simple
+attachments), the compat endpoint for portable multi-model apps and ecosystem
+tooling, a native endpoint for provider-specific capabilities. Moving between
+them never changes auth, budgets, or what the Usage tab shows.
+
 ## Errors
 
 Failed calls throw `CanopyError` with the HTTP `status` and the response body
 as the `message`. Two worth handling:
 
 - **Budget exhausted** — status `429`, body contains
-  `"ai_budget_exceeded"`. The project hit its daily AI cap; AI calls resume
-  the next day (or after a maintainer raises the budget). Everything else in
-  your app keeps working.
+  `"ai_budget_exceeded"` and names which budget tripped: the daily limit
+  (calls resume the next day) or the monthly cap (calls resume next month —
+  or after a maintainer raises it). Everything else in your app keeps
+  working.
 - **Invalid request** — status `400`, body contains `"invalid_chat"` and a
   detail explaining which option was rejected.
 

package/dist/docs/sdk-database.md

@@ -122,5 +122,35 @@ per SDK instance, so calling it often is free.
 > `db.sql()` only when you genuinely need SQL (aggregates, joins, bulk updates), and branch on
 > `db.dialect()` whenever the syntax differs.
 
+## Who can call this from the browser
+
+Everything above works from a page as well as from your worker — that is the
+point of `canopy.db`: a form, a guestbook or an internal tool needs no backend
+at all. But once a project _has_ a worker with tables the page must not touch,
+you want a say. Two things give you that, both on the project's **Data** tab in
+the dashboard (or `canopy db access` from the terminal):
+
+- **Browser access** — one setting for what the app's own pages may do with the
+  database. **Read and write** is the default and how every project starts.
+  **Read only** lets pages read collections and run SQL that only reads, so
+  writes have to come from the worker. **Off** means pages cannot touch the
+  database at all. Your worker, the CLI and the dashboard's data explorer keep
+  full access whatever you pick.
+- **`private_` names** — a collection or table whose name starts with
+  `private_` is only reachable from the worker, at every level. Pages calling
+  `collection("private_notes")` get a 403. Raw SQL cannot be checked table by
+  table, so while your database holds any `private_` name, `db.sql()` from a
+  page is refused too; use collections there, or run the SQL in the worker.
+
+Everyone who opens the app gets the same rule — colleagues signed in with
+OneLogin and, if you turned on [client access](https://docs.canopy.website/platform/client-access),
+visitors with the password. Read only protects your data from being changed,
+not from being seen: anyone who can open the app can read every table that is
+not `private_`. To hide data, name it `private_` or turn browser access off
+and serve it through a worker route.
+
+A refused call throws a `CanopyError` with status 403 and a one-line
+explanation that names the setting, so the fix is never a guess.
+
 Where the data lives, snapshots, and how to inspect it from the dashboard are
 covered in [Project data](https://docs.canopy.website/platform/project-data).

package/dist/docs/sdk-files.md

@@ -62,6 +62,12 @@ lifetime that isn't a whole number of seconds above zero is rejected. Keep the
 window as short as the job needs — anyone holding the URL can download the
 file until it expires.
 
+What a URL does in the browser depends on the file's content type. Images,
+video, audio, fonts, plain text, CSV, JSON and PDF display; SVG displays in
+an `<img>` but is sandboxed when opened directly; anything a browser would
+treat as a page — HTML, XML, scripts, unknown types — downloads instead of
+rendering. See [Browser security](https://docs.canopy.website/platform/security-headers).
+
 ## Listing and deleting
 
 ```ts

package/dist/{docs-c0CdeBxh.mjs → docs-BLWio_65.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-BuwV_mje.mjs";
-import { n as siteConfig } from "./site-BFaWfSVu.mjs";
+import { t as version } from "./package-DTm0EzxR.mjs";
+import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{egress-BhbQfjjV.mjs → egress-BjN-7vil.mjs}

@@ -1,5 +1,5 @@
-import { a as projectDirArgs, c as resolveProject } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui--atbZ-TM.mjs";
+import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts
@@ -152,7 +152,10 @@ const egressCommand = defineCommand({
 						}
 					}
 				}
-				const updated = await apiRequest("PUT", `/projects/${slug}/egress`, { mode: wanted });
+				const updated = await withContext(apiRequest("PUT", `/projects/${slug}/egress`, { mode: wanted }), {
+					action: `switch ${slug} to ${wanted} egress mode`,
+					fixes: { owner_only: "Only the project owner can switch egress to open mode — ask them to run this command or flip it in the dashboard." }
+				});
 				if (wanted === "open") {
 					console.log(`Open egress mode is ON for ${slug} — running workers pick it up now.`);
 					console.log(`Switch back anytime with \`canopy egress mode allowlist\`.`);

package/dist/{feedback-QhD8k6Ph.mjs → feedback-Bnmi1Ukv.mjs}

@@ -1,6 +1,6 @@
-import { t as version } from "./package-BuwV_mje.mjs";
-import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui--atbZ-TM.mjs";
+import { t as version } from "./package-DTm0EzxR.mjs";
+import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";

package/dist/index.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "./package-BuwV_mje.mjs";
-import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BFaWfSVu.mjs";
+import { t as version } from "./package-DTm0EzxR.mjs";
+import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
 //#region src/index.ts
@@ -60,30 +60,30 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-BrEDKrb3.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-BrEDKrb3.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-BrEDKrb3.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-1r5387ui.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-1r5387ui.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-1r5387ui.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-1r5387ui.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-D7v7WK9O.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-DCggsLD7.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-DCggsLD7.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-CdpV2YHB.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-DCggsLD7.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-DCggsLD7.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-C8Bmzwfl.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-BhbQfjjV.mjs").then((m) => m.egressCommand),
-		schedule: () => import("./schedule-DK_Cv6Xf.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-QhD8k6Ph.mjs").then((m) => m.feedbackCommand),
-		db: () => import("./db-TaSLpQZ5.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-C1-cvS2-.mjs").then((m) => m.usageCommand),
-		open: () => import("./open-D7f1wNn3.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-c0CdeBxh.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-BvoYCIKk.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-0lmdjvom.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-Beqz--Df.mjs").then((m) => m.logsCommand)
+		login: () => import("./login-COZ7Xcm0.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-COZ7Xcm0.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-COZ7Xcm0.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-CLs6MEF7.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-CLs6MEF7.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-CLs6MEF7.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-CLs6MEF7.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-C5BmSJo1.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-pZpdZuj_.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-CYKiBnrg.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-BKwGa10J.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-BjN-7vil.mjs").then((m) => m.egressCommand),
+		schedule: () => import("./schedule-B8zA8WlG.mjs").then((m) => m.scheduleCommand),
+		feedback: () => import("./feedback-Bnmi1Ukv.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-jmYaum8F.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-UmzU6sGp.mjs").then((m) => m.usageCommand),
+		open: () => import("./open-D2hH933K.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-BLWio_65.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-Dt49jdUT.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-Cf81feok.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-B_YoflCq.mjs").then((m) => m.logsCommand)
 	}
 });
 if (process.argv[2] !== "upgrade") notifyOfUpdate(version);

package/dist/{local-CsSP4Vpt.mjs → local-CNPBZ89U.mjs}

@@ -1,6 +1,6 @@
-import { s as apiDataRequest } from "./ui--atbZ-TM.mjs";
-import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BKKAEkbH.mjs";
-import { n as rewriteApiPath } from "./dev-CNqx_53I.mjs";
+import { s as apiDataRequest } from "./ui-CUNkis89.mjs";
+import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-BK0Hiwsn.mjs";
+import { n as rewriteApiPath } from "./dev-DVUEJ80c.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
@@ -15,19 +15,48 @@ import { Hono } from "hono";
 *  - `fts: false` — search() is an ILIKE substring fallback: different
 *    matches, no ranking (results order by created_at). Surfaced to clients
 *    as `capabilities.fts` rather than papered over.
-*  - patch() is a shallow jsonb merge (`||`): top-level keys replace rather
-*    than deep-merge, and a null value stores null instead of removing the
-*    key.
+*  - patch() has the SAME RFC 7386 semantics as SQLite's json_patch (nested
+*    objects merge, null removes a key), but Postgres has no built-in for it,
+*    so it goes through `public._canopy_merge_patch(jsonb, jsonb)` — a small
+*    recursive plpgsql function declared in the DDL below. It lives in
+*    `public` (not the per-project schema) so one CREATE OR REPLACE covers
+*    every project schema in the database, existing ones included.
 */
 const DOC_COLUMNS$1 = "id, data, created_at, updated_at";
-const DOC_STORE_DDL_PG = [`CREATE TABLE IF NOT EXISTS _canopy_docs (
+const DOC_STORE_DDL_PG = [
+	`CREATE TABLE IF NOT EXISTS _canopy_docs (
     collection TEXT NOT NULL,
     id TEXT NOT NULL,
     data TEXT NOT NULL,
     created_at TEXT NOT NULL,
     updated_at TEXT NOT NULL,
     PRIMARY KEY (collection, id)
-  )`, `CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`];
+  )`,
+	`CREATE INDEX IF NOT EXISTS _canopy_docs_created ON _canopy_docs (collection, created_at)`,
+	`CREATE OR REPLACE FUNCTION public._canopy_merge_patch(target jsonb, patch jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $fn$
+BEGIN
+  IF jsonb_typeof(patch) IS DISTINCT FROM 'object' THEN
+    RETURN patch;
+  END IF;
+  IF jsonb_typeof(target) IS DISTINCT FROM 'object' THEN
+    target := '{}'::jsonb;
+  END IF;
+  RETURN COALESCE((
+    SELECT jsonb_object_agg(m.key, m.value) FROM (
+      SELECT t.key, t.value FROM jsonb_each(target) t WHERE NOT (patch ? t.key)
+      UNION ALL
+      SELECT p.key,
+             CASE WHEN jsonb_typeof(p.value) = 'object'
+                  THEN public._canopy_merge_patch(target -> p.key, p.value)
+                  ELSE p.value END
+        FROM jsonb_each(patch) p
+       WHERE jsonb_typeof(p.value) <> 'null'
+    ) m
+  ), '{}'::jsonb);
+END
+$fn$`
+];
 /** `data`'s JSON value at a `$.a.b` path param, as jsonb. */
 const jsonAt = (column, pathParam) => `(${column}::jsonb #> string_to_array(trim(leading '$.' from ${pathParam}::text), '.'))`;
 /**
@@ -124,7 +153,7 @@ const postgresDialect = {
 	},
 	patch(collection, id, patchJson, now) {
 		return {
-			sql: `UPDATE _canopy_docs SET data = (data::jsonb || $1::jsonb)::text, updated_at = $2
+			sql: `UPDATE _canopy_docs SET data = public._canopy_merge_patch(data::jsonb, $1::jsonb)::text, updated_at = $2
         WHERE collection = $3 AND id = $4
         RETURNING ${DOC_COLUMNS$1}`,
 			params: [

package/dist/{login-BrEDKrb3.mjs → login-COZ7Xcm0.mjs}

@@ -1,6 +1,7 @@
-import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-BFaWfSVu.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-DM2J10CB.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
+import { hostname } from "node:os";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
@@ -47,19 +48,66 @@ const whoamiCommand = defineCommand({
 		}
 	})
 });
+/**
+* Revoke one site's CLI token on the server (DELETE /control/v1/account/token —
+* the token authenticates and names itself). Best-effort: an unreachable or
+* already-expired token is still forgotten locally, the caller just hears
+* about it. A 401 means the platform no longer knows the token — nothing left
+* to revoke, so that counts as done.
+*/
+async function revokeRemote(apiUrl, token) {
+	try {
+		const res = await fetch(`${apiUrl}/control/v1/account/token`, {
+			method: "DELETE",
+			headers: { authorization: `Bearer ${token}` }
+		});
+		if (res.ok || res.status === 401) return { ok: true };
+		return {
+			ok: false,
+			error: `${res.status} ${await res.text().catch(() => "")}`.trim()
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
 const logoutCommand = defineCommand({
 	meta: {
 		name: "logout",
-		description: "Sign out: forget all local CLI tokens"
+		description: "Sign out: revoke and forget all CLI tokens"
 	},
-	run: reportErrors("logout", async () => {
+	args: { local: {
+		type: "boolean",
+		default: false,
+		description: "Only forget the tokens on this machine; do not revoke them on the platform"
+	} },
+	run: reportErrors("logout", async ({ args }) => {
 		const file = readConfigFile();
-		if (!Object.values(file.profiles ?? {}).some((p) => p?.token)) {
+		const held = Object.entries(file.profiles ?? {}).filter(([, p]) => p?.token);
+		if (held.length === 0) {
 			console.log("Not logged in.");
 			return;
 		}
+		const failed = [];
+		if (!args.local) for (const [id, prof] of held) {
+			const baked = isProfileId(id) ? getBakedProfile(id) : void 0;
+			if (!baked) continue;
+			const result = await revokeRemote(baked.apiUrl, prof.token);
+			if (!result.ok) failed.push(`${id} (${result.error})`);
+		}
 		clearAllProfileTokens();
+		if (args.local) {
+			console.log("Logged out locally — tokens removed from ~/.canopy/config.json but still valid on the platform until they expire. Revoke them from the dashboard's Account page.");
+			return;
+		}
+		if (failed.length === 0) {
+			console.log("Logged out — all site tokens revoked and removed from ~/.canopy/config.json.");
+			return;
+		}
 		console.log("Logged out — all site tokens removed from ~/.canopy/config.json.");
+		console.log(`Could not revoke on: ${failed.join(", ")}. Those tokens stay valid until they expire; revoke them from the dashboard's Account page.`);
 	})
 });
 /** Wait for OneLogin to redirect back to the local loopback server. */
@@ -125,7 +173,10 @@ async function mintForProfile(id, idToken) {
 		const cliTokenRes = await fetch(`${baked.apiUrl}/control/v1/auth/cli-token`, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
-			body: JSON.stringify({ id_token: idToken })
+			body: JSON.stringify({
+				id_token: idToken,
+				name: hostname()
+			})
 		});
 		if (!cliTokenRes.ok) return {
 			ok: false,

package/dist/{logs-Beqz--Df.mjs → logs-B_YoflCq.mjs}

@@ -1,5 +1,5 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-BFaWfSVu.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{migrations-Bg9FEGFh.mjs → migrations-Btzr9_q7.mjs}

@@ -1,5 +1,5 @@
-import { u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { s as apiDataRequest } from "./ui--atbZ-TM.mjs";
+import { u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { s as apiDataRequest } from "./ui-CUNkis89.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-D7f1wNn3.mjs → open-D2hH933K.mjs}

@@ -1,5 +1,5 @@
-import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-BFaWfSVu.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-DM2J10CB.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-BuwV_mje.mjs → package-DTm0EzxR.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.22";
+var version = "0.7.24";
 //#endregion
 export { version as t };

package/dist/{projects-1r5387ui.mjs → projects-CLs6MEF7.mjs}

@@ -1,5 +1,5 @@
-import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
-import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui--atbZ-TM.mjs";
+import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui-CUNkis89.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";