@mediamonks/canopy-cli 0.7.30 → 0.7.32

package/dist/mcp-RcN17Z2v.mjs

@@ -0,0 +1,457 @@
+import { t as version } from "./package-YGjjin4p.mjs";
+import { d as tryResolveProject, l as stagingUrl, n as siteConfig, s as projectUrl } from "./site-DM2J10CB.mjs";
+import { i as apiRequest, t as ApiError } from "./api-C4rMhE7i.mjs";
+import { t as liveDevServer } from "./dev-server-file-Dk9pk4AR.mjs";
+import { defineCommand } from "citty";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { Server } from "@modelcontextprotocol/server";
+import { Client, StreamableHTTPClientTransport, isInputRequiredResult } from "@modelcontextprotocol/client";
+//#region src/mcp-bridge.ts
+/**
+* The agent side of `canopy mcp serve` (docs/49): an MCP server on stdio that
+* re-exposes a project's tools, and nothing else. Not a byte pipe — each
+* side negotiates its own protocol revision, only `tools/list` and
+* `tools/call` cross, and both are bounded:
+*
+*  - descriptions over 2,048 characters or input schemas over 16 KB are
+*    withheld, and at most 64 tools are shown;
+*  - a result over 512 KB becomes an error, and a call is cut off at 60 s.
+*
+* The tool list is live: fetched whenever the agent lists tools and again
+* after each call, with a list-changed notification when it moved, so a
+* redeploy reaches a running session without any Canopy command.
+*/
+const MAX_DESCRIPTION_CHARS = 2048;
+const MAX_SCHEMA_BYTES = 16 * 1024;
+const MAX_RESULT_BYTES = 512 * 1024;
+const byteLength = (value) => new TextEncoder().encode(JSON.stringify(value) ?? "").length;
+/** Apply the caps; returns the tools to show and why the rest were held back. */
+function boundTools(tools) {
+	const shown = [];
+	const withheld = [];
+	for (const tool of tools) if ((tool.description?.length ?? 0) > 2048) withheld.push(`${tool.name}: description over ${MAX_DESCRIPTION_CHARS} characters`);
+	else if (byteLength(tool.inputSchema) > 16384) withheld.push(`${tool.name}: input schema over ${MAX_SCHEMA_BYTES / 1024} KB`);
+	else if (shown.length >= 64) withheld.push(`${tool.name}: over the limit of 64 tools`);
+	else shown.push(tool);
+	return {
+		shown,
+		withheld
+	};
+}
+function toolError(text) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		isError: true
+	};
+}
+/** A stable fingerprint of what the agent was shown, to spot a changed list. */
+const fingerprint = (tools) => JSON.stringify(tools.map((t) => [t.name, t]));
+function createBridgeServer(upstream, options = {}) {
+	const log = options.log ?? ((line) => process.stderr.write(`${line}\n`));
+	const timeoutMs = options.callTimeoutMs ?? 6e4;
+	let shownPrint = null;
+	let shownNames = /* @__PURE__ */ new Set();
+	let reported = /* @__PURE__ */ new Set();
+	const server = new Server({
+		name: "canopy",
+		version: options.version ?? "1"
+	}, { capabilities: { tools: { listChanged: true } } });
+	async function currentTools() {
+		const { shown, withheld } = boundTools(await upstream.listTools());
+		const now = new Set(withheld);
+		for (const line of withheld) if (!reported.has(line)) log(`canopy mcp: withheld ${line}`);
+		reported = now;
+		return shown;
+	}
+	/** Re-read the project's list; tell the agent when it moved. */
+	async function refresh() {
+		try {
+			const tools = await currentTools();
+			const print = fingerprint(tools);
+			if (shownPrint !== null && print !== shownPrint) {
+				shownPrint = print;
+				shownNames = new Set(tools.map((t) => t.name));
+				await server.sendToolListChanged().catch(() => {});
+			}
+		} catch {}
+	}
+	server.setRequestHandler("tools/list", async () => {
+		const tools = await currentTools();
+		shownPrint = fingerprint(tools);
+		shownNames = new Set(tools.map((t) => t.name));
+		return { tools };
+	});
+	server.setRequestHandler("tools/call", async (request) => {
+		const { name, arguments: args } = request.params;
+		if (!shownNames.has(name)) {
+			const tools = await currentTools().catch(() => []);
+			shownNames = new Set(tools.map((t) => t.name));
+			if (!shownNames.has(name)) return toolError(`The tool "${name}" is no longer offered by this project.`);
+		}
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		let result;
+		try {
+			result = await Promise.race([upstream.callTool(name, args, controller.signal), new Promise((_, reject) => controller.signal.addEventListener("abort", () => reject(/* @__PURE__ */ new Error(`timed out after ${Math.round(timeoutMs / 1e3)} seconds`))))]);
+		} catch (err) {
+			const tools = await currentTools().catch(() => null);
+			if (tools && !tools.some((t) => t.name === name)) {
+				refresh();
+				return toolError(`The tool "${name}" is no longer offered by this project.`);
+			}
+			return toolError(`The tool "${name}" failed: ${err instanceof Error ? err.message : String(err)}`);
+		} finally {
+			clearTimeout(timer);
+		}
+		refresh();
+		if (byteLength(result) > 524288) return toolError(`The tool "${name}" returned more than ${MAX_RESULT_BYTES / 1024} KB, which Canopy does not pass to agents.`);
+		return result;
+	});
+	return server;
+}
+//#endregion
+//#region src/mcp-token.ts
+/** Renew when less than this is left, so no call goes out on a dying token. */
+const RENEW_BEFORE_MS = 300 * 1e3;
+var AgentTokenSource = class {
+	mint;
+	now;
+	current = null;
+	inflight = null;
+	constructor(mint, now = Date.now) {
+		this.mint = mint;
+		this.now = now;
+	}
+	/** A token with at least RENEW_BEFORE_MS left, minting one when needed. */
+	async token() {
+		if (this.current && this.current.expiresAt - this.now() > 3e5) return this.current.token;
+		this.inflight ??= this.mint().then((minted) => {
+			const expiresAt = Date.parse(minted.expires_at);
+			this.current = {
+				token: minted.token,
+				expiresAt: Number.isNaN(expiresAt) ? this.now() + RENEW_BEFORE_MS * 2 : expiresAt
+			};
+			return minted.token;
+		}).finally(() => {
+			this.inflight = null;
+		});
+		return this.inflight;
+	}
+	/** Forget the current token (the gateway said it is no longer valid). */
+	invalidate(token) {
+		if (!token || this.current?.token === token) this.current = null;
+	}
+};
+//#endregion
+//#region src/mcp-upstream.ts
+/**
+* The project side of `canopy mcp serve` (docs/49): an MCP client over HTTP to
+* the project's `/__canopy/mcp`, authenticated with an agent token. It
+* declares no client capabilities (no roots, sampling or elicitation), so a
+* project can never ask the user's agent for anything — requests it sends
+* anyway are answered method-not-found by the client and never forwarded.
+*/
+/** A refusal the platform or the project answered with, in words for stderr. */
+var UpstreamRefusal = class extends Error {
+	status;
+	code;
+	name = "UpstreamRefusal";
+	constructor(status, code, message) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+};
+/** What each refusal means to the person who started the agent. */
+function explainRefusal(status, body, project) {
+	switch (body.error) {
+		case "agent_token_required":
+		case "agent_token_invalid": return "Canopy refused the sign-in for this agent session — run `canopy login` and restart the MCP server.";
+		case "agent_token_scope": return `The agent credential does not cover ${project} on this channel.`;
+		case "members_only": return `${project} is limited to its collaborators — ask the owner to add you.`;
+		case "project_not_found": return `There is no project ${project} on this site — check the slug and --profile.`;
+		case "project_paused": return `${project} is paused.`;
+		case "project_moved": return `${project} has moved${body.moved_to ? ` to ${body.moved_to}` : ""}.`;
+		case "no_backend": return `${project} has no backend on this channel, so it has no tools.`;
+		case "redeploy_required": return `${project}'s backend was deployed before tools support — redeploy it (\`canopy deploy\`).`;
+		case "invalid_tools": return `${project}'s tool definitions are invalid: ${body.detail ?? "see the project's logs"}`;
+		case "cli_session_required": return "Agent sessions need your own CLI sign-in (not a deploy token) — run `canopy login`.";
+		case "local_tools_forbidden": return "The local dev server refused the tools request.";
+		default:
+			if (status === 404 || status === 405) return `${project} serves no tools — mount them with mountMcpTools (@mediamonks/canopy/mcp) and redeploy.`;
+			return `${project}'s tools endpoint answered HTTP ${status}${body.error ? ` (${body.error})` : ""}.`;
+	}
+}
+async function connectUpstream(options) {
+	const baseFetch = options.fetch ?? fetch;
+	let refusal = null;
+	const authedFetch = async (url, init) => {
+		const send = async (token) => {
+			const headers = new Headers(init?.headers);
+			if (token) headers.set("authorization", `Bearer ${token}`);
+			return baseFetch(url, {
+				...init,
+				headers
+			});
+		};
+		let token = await options.tokens?.token();
+		let res = await send(token);
+		if (res.status === 401 && options.tokens) {
+			options.tokens.invalidate(token);
+			token = await options.tokens.token();
+			res = await send(token);
+		}
+		if (res.ok || res.status === 202) {
+			refusal = null;
+			return res;
+		}
+		const body = await res.clone().json().catch(() => ({}));
+		refusal = new UpstreamRefusal(res.status, body.error ?? `http_${res.status}`, explainRefusal(res.status, body, options.project));
+		return res;
+	};
+	const client = new Client({
+		name: "canopy-cli",
+		version: "1"
+	}, {
+		capabilities: {},
+		versionNegotiation: { mode: "auto" }
+	});
+	const transport = new StreamableHTTPClientTransport(new URL(options.url), { fetch: authedFetch });
+	const explain = (err) => refusal ?? (err instanceof Error ? err : new Error(String(err)));
+	try {
+		await client.connect(transport);
+	} catch (err) {
+		throw explain(err);
+	}
+	return {
+		async listTools() {
+			try {
+				const tools = [];
+				let cursor;
+				do {
+					const page = await client.listTools(cursor ? { cursor } : {});
+					tools.push(...page.tools);
+					cursor = page.nextCursor;
+				} while (cursor);
+				return tools;
+			} catch (err) {
+				throw explain(err);
+			}
+		},
+		async callTool(name, args, signal) {
+			try {
+				const result = await client.callTool({
+					name,
+					arguments: args ?? {}
+				}, { signal });
+				if (isInputRequiredResult(result)) return {
+					content: [{
+						type: "text",
+						text: "This tool asked for interactive input, which Canopy does not pass to agents."
+					}],
+					isError: true
+				};
+				return result;
+			} catch (err) {
+				throw explain(err);
+			}
+		},
+		close: () => client.close()
+	};
+}
+//#endregion
+//#region src/mcp.ts
+/**
+* `canopy mcp` — let AI agents use a project's backend as MCP tools
+* (docs/49).
+*
+*   canopy mcp add [slug]     check access, print the config line for your client
+*   canopy mcp serve [slug]   the stdio MCP server an agent client launches
+*
+* The agent always acts as the signed-in Monk running it: `serve` exchanges
+* the stored CLI sign-in for short-lived agent tokens (one project and
+* channel, an hour each), holds them in memory only, and re-exposes the
+* project's tools and nothing else (mcp-bridge.ts).
+*/
+/** The reserved backend path a project's tools live on (MCP_PATH in the SDK). */
+const MCP_PATH = "/__canopy/mcp";
+const sharedArgs = {
+	slug: {
+		type: "positional",
+		description: "Project slug (defaults to canopy.json in the current directory)",
+		required: false
+	},
+	channel: {
+		type: "string",
+		description: "live (default) or staging"
+	}
+};
+var McpCommandError = class extends Error {
+	name = "McpCommandError";
+};
+function parseChannel(value) {
+	if (value === void 0 || value === "live") return "live";
+	if (value === "staging") return "staging";
+	throw new McpCommandError(`--channel must be "live" or "staging", not "${value}".`);
+}
+function resolveSlug(slug) {
+	const resolved = tryResolveProject({ project: slug });
+	if (!resolved.slug) throw new McpCommandError("No project named — pass a slug (`canopy mcp serve <slug>`) or run from a project directory.");
+	return {
+		dir: resolved.dir,
+		slug: resolved.slug
+	};
+}
+function requireSignIn() {
+	if (process.env["CANOPY_DEPLOY_TOKEN"]) throw new McpCommandError("Agent sessions use your own sign-in, not a deploy token — unset CANOPY_DEPLOY_TOKEN and run `canopy login`.");
+	if (!siteConfig().token) throw new McpCommandError("Not signed in to this site — run `canopy login` first.");
+}
+/** Mint through the control plane; refusals in the same words as the gateway's. */
+function agentTokens(slug, channel) {
+	return new AgentTokenSource(async () => {
+		try {
+			return await apiRequest("POST", `/projects/${slug}/agent-token`, { channel });
+		} catch (err) {
+			if (err instanceof ApiError) throw new UpstreamRefusal(err.status, err.code, explainRefusal(err.status, {
+				error: err.code,
+				detail: err.detail
+			}, slug));
+			throw err;
+		}
+	});
+}
+async function connect(args) {
+	const channel = parseChannel(args.channel);
+	const { dir, slug } = resolveSlug(args.slug);
+	if (args.local) {
+		const server = liveDevServer(dir);
+		if (!server) throw new McpCommandError(`No \`canopy dev\` is running for ${slug} in ${dir} — start it there first, then restart this.`);
+		return {
+			upstream: await connectUpstream({
+				url: `${server.url}${MCP_PATH}`,
+				project: slug
+			}),
+			slug,
+			channel,
+			where: `local dev server ${server.url}`
+		};
+	}
+	requireSignIn();
+	const tokens = agentTokens(slug, channel);
+	await tokens.token();
+	const upstream = await connectUpstream({
+		url: `${channel === "staging" ? stagingUrl(slug) : projectUrl(slug)}${MCP_PATH}`,
+		project: slug,
+		tokens
+	});
+	const config = siteConfig();
+	return {
+		upstream,
+		slug,
+		channel,
+		where: `${config.profileId ?? config.apiUrl}, ${channel}`
+	};
+}
+function fail(err) {
+	const message = err instanceof McpCommandError || err instanceof UpstreamRefusal ? err.message : err instanceof Error ? err.message : String(err);
+	process.stderr.write(`canopy mcp: ${message}\n`);
+	process.exitCode = 1;
+}
+const serveCommand = defineCommand({
+	meta: {
+		name: "serve",
+		description: "Run the MCP server an agent client launches (stdio) for a project's tools"
+	},
+	args: {
+		...sharedArgs,
+		local: {
+			type: "boolean",
+			description: "Use the tools of the `canopy dev` running in this directory"
+		}
+	},
+	async run({ args }) {
+		console.log = console.error;
+		console.info = console.error;
+		let connection;
+		try {
+			connection = await connect(args);
+			const tools = await connection.upstream.listTools();
+			process.stderr.write(`canopy mcp: serving ${tools.length} tool${tools.length === 1 ? "" : "s"} from ${connection.slug} (${connection.where})\n`);
+		} catch (err) {
+			fail(err);
+			return;
+		}
+		const { upstream } = connection;
+		serveStdio(() => createBridgeServer(upstream, { version }), {
+			onerror: (err) => process.stderr.write(`canopy mcp: ${err.message}\n`),
+			maxSubscriptions: 0
+		});
+	}
+});
+/** The command an MCP client should run, with the site and channel spelled out. */
+function serveInvocation(slug, channel, profile) {
+	return [
+		"mcp",
+		"serve",
+		slug,
+		...profile ? ["--profile", profile] : [],
+		...channel === "staging" ? ["--channel", "staging"] : []
+	];
+}
+function clientConfigLines(slug, channel, profile) {
+	const name = channel === "staging" ? `canopy-${slug}-staging` : `canopy-${slug}`;
+	const args = serveInvocation(slug, channel, profile);
+	const json = JSON.stringify({ mcpServers: { [name]: {
+		command: "canopy",
+		args
+	} } }, null, 2);
+	return [
+		"Claude Code:",
+		`  claude mcp add ${name} -- canopy ${args.join(" ")}`,
+		"",
+		"Claude Desktop, Cursor and other clients (mcpServers JSON):",
+		...json.split("\n").map((line) => `  ${line}`),
+		"",
+		"The configuration holds no credentials: `canopy mcp serve` uses your `canopy login`.",
+		"If the client can't find `canopy`, use the full path from `which canopy` as the command."
+	];
+}
+const mcpCommand = defineCommand({
+	meta: {
+		name: "mcp",
+		description: "Let AI agents use a project's backend as MCP tools"
+	},
+	subCommands: {
+		add: defineCommand({
+			meta: {
+				name: "add",
+				description: "Check you can use a project's tools and print the config for your MCP client"
+			},
+			args: sharedArgs,
+			async run({ args }) {
+				let connection;
+				let count;
+				try {
+					connection = await connect(args);
+					count = (await connection.upstream.listTools()).length;
+					await connection.upstream.close().catch(() => {});
+				} catch (err) {
+					fail(err);
+					return;
+				}
+				const config = siteConfig();
+				const profile = config.envOverride ? void 0 : config.profileId;
+				console.log(`\n  ${connection.slug} serves ${count} tool${count === 1 ? "" : "s"} (${connection.where}).\n`);
+				for (const line of clientConfigLines(connection.slug, connection.channel, profile)) console.log(`  ${line}`);
+				if (!profile) console.log("\n  note: this site comes from environment overrides, so the command names no --profile.");
+				console.log("");
+			}
+		}),
+		serve: serveCommand
+	}
+});
+//#endregion
+export { mcpCommand };

package/dist/{migrations-C8yRPJIX.mjs → migrations-Czlcddyz.mjs}

@@ -1,5 +1,5 @@
 import { u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { s as apiDataRequest } from "./ui-CeupNHNa.mjs";
+import { n as apiDataRequest } from "./api-C4rMhE7i.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-BJgd0R61.mjs → open-DcaQKi1v.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CeupNHNa.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-CnS450Yc.mjs → package-YGjjin4p.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.30";
+var version = "0.7.32";
 //#endregion
 export { version as t };

package/dist/{projects-BG7Injpb.mjs → projects-CN2YhCZn.mjs}

@@ -1,5 +1,6 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui-CeupNHNa.mjs";
+import { i as apiRequest } from "./api-C4rMhE7i.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{schedule-CLuksxSM.mjs → schedule-C5lMf3ny.mjs}

@@ -1,5 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CeupNHNa.mjs";
+import { i as apiRequest, o as withContext } from "./api-C4rMhE7i.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**

package/dist/{secrets-Bl3uOx4l.mjs → secrets-BSEjZnxg.mjs}

@@ -1,5 +1,6 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { a as unwrap, d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CeupNHNa.mjs";
+import { i as apiRequest, o as withContext } from "./api-C4rMhE7i.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/secrets.ts

package/dist/skill/canopy/SKILL.md

@@ -171,6 +171,13 @@ external API with a secret the browser can't hold, or running scheduled jobs.
 It's `spa` plus Hono-style handlers in `worker/`; `canopy deploy` publishes
 the frontend and the worker together.
 
+**Agent tools (MCP).** A project with a `worker/` can offer its backend to
+AI agents: `mountMcpTools(app, [...])` from `@mediamonks/canopy/mcp` wraps
+existing routes (`route: "GET /api/notes"`) or handlers as MCP tools, and
+people connect with `canopy mcp add <slug>` (`canopy docs agent-tools`). Mark
+read-only tools with `annotations: { readOnlyHint: true }`; never add auth —
+the agent already acts as the signed-in user.
+
 Non-interactive: `canopy create "My App" --template spa`. **When unsure between
 `static` and `spa`, pick `spa`.**
 

package/dist/{skill-CuES7kPj.mjs → skill-CM7R-4Bq.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-CnS450Yc.mjs";
-import { r as reportErrors } from "./ui-CeupNHNa.mjs";
+import { t as version } from "./package-YGjjin4p.mjs";
+import { r as reportErrors } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{src-C7zPhbxi.mjs → src-BkACMkol.mjs}

@@ -843,6 +843,19 @@ const IDENTITY_STAMP_HEADERS = [
 	"x-canopy-user-email",
 	"x-canopy-user-name"
 ];
+/**
+* Header the gateway attaches to a project tools call (`/__canopy/mcp`,
+* docs/49): the caller's agent token. A credential like the session cookie —
+* the host keeps it for `env.CANOPY.fetch` and redacts it from the bundle.
+* It travels in its own header because on Cloud Run `Authorization` carries
+* the Google ID token that let the gateway in.
+*/
+const AGENT_CREDENTIAL_HEADER = "x-canopy-agent-credential";
+/**
+* Gateway-stamped marker on a tools call: `agent`. Never a credential, but
+* only the gateway may set it — it strips client copies on every dispatch.
+*/
+const CALLER_HEADER = "x-canopy-caller";
 /** Cookies that authenticate to Canopy itself — the monk session and the client-page session. */
 const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_client"]);
 /**
@@ -874,6 +887,7 @@ function redactCanopyCredentials(headers) {
 		else headers.set("cookie", kept);
 	}
 	if (headers.get("authorization")?.startsWith("Bearer cnpy_")) headers.delete("authorization");
+	headers.delete(AGENT_CREDENTIAL_HEADER);
 	return headers;
 }
 /**
@@ -889,4 +903,4 @@ function stampWorkerHeaders(headers, ctx) {
 	return headers;
 }
 //#endregion
-export { META_COLUMNS as a, dbRouter as i, stampWorkerHeaders as n, blobRouter as o, realtimeRouter as r, redactCanopyCredentials as t };
+export { dbRouter as a, realtimeRouter as i, redactCanopyCredentials as n, META_COLUMNS as o, stampWorkerHeaders as r, blobRouter as s, CALLER_HEADER as t };

package/dist/{staging-D06zobnf.mjs → staging-BZVty57b.mjs}

@@ -1,5 +1,6 @@
 import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CeupNHNa.mjs";
+import { i as apiRequest, o as withContext } from "./api-C4rMhE7i.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/templates/spa/package.json

@@ -7,7 +7,7 @@
     "build": "tsc && vite build"
   },
   "dependencies": {
-    "@mediamonks/canopy": "^0.0.6",
+    "@mediamonks/canopy": "^0.0.11",
     "react": "^19.1.0",
     "react-dom": "^19.1.0"
   },

package/dist/templates/worker/package.json

@@ -7,7 +7,7 @@
     "build": "tsc && vite build"
   },
   "dependencies": {
-    "@mediamonks/canopy": "^0.0.6",
+    "@mediamonks/canopy": "^0.0.11",
     "hono": "^4.8.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0"

package/dist/templates/worker/worker/index.ts

@@ -53,6 +53,23 @@ app.get("/api/notes", async (c) => {
   return c.json({ notes });
 });
 
+// Let AI agents (Claude Code, Cursor…) use this backend as MCP tools, through
+// `canopy mcp serve`. They always act as the signed-in Monk running it. Route
+// tools wrap the routes above; uncomment to try it, then redeploy:
+//
+// import { mountMcpTools } from "@mediamonks/canopy/mcp";
+//
+// mountMcpTools(app, [
+//   {
+//     name: "list_notes",
+//     description: "List all notes in this project",
+//     route: "GET /api/notes",
+//     annotations: { readOnlyHint: true },
+//   },
+// ]);
+//
+// Guide: https://docs.canopy.website/guides/agent-tools
+
 export default {
   fetch: app.fetch.bind(app),
 

package/dist/{token-C_PFNqcv.mjs → token-HHlUR0CF.mjs}

@@ -1,5 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-CeupNHNa.mjs";
+import { i as apiRequest } from "./api-C4rMhE7i.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {