@mediamonks/canopy-cli 0.7.39 → 0.7.40

package/dist/{dev-BMWj4NDZ.mjs → dev-03LA_Etx.mjs}

@@ -2,7 +2,7 @@ import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as sit
 import { a as apiRequest, l as withContext, t as ApiError } from "./api-ArfD6-t5.mjs";
 import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { r as readMigrationFiles } from "./migrations-CG_O5Ghw.mjs";
-import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-CxzGOEhP.mjs";
+import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-RUf3Gfuh.mjs";
 import { n as writeDevServerRecord } from "./dev-server-file-Dk9pk4AR.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
@@ -41,7 +41,7 @@ async function workerPlugin(flags, slug, workerAttest, remoteUser) {
 		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
 		return;
 	}
-	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-CpSB_Okh.mjs");
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-D78leKBJ.mjs");
 	const secrets = readDevVars(flags.dir);
 	const email = siteConfig().email;
 	const user = await remoteUser?.() ?? (email ? {
@@ -251,7 +251,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-BnfAEwso.mjs");
+		const { fetchProjectDump } = await import("./local-CkS1XhRu.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -267,7 +267,7 @@ async function devLocal(flags, slug) {
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
 	const workerAttest = randomBytes(24).toString("base64url");
-	const { createSandbox } = await import("./local-BnfAEwso.mjs");
+	const { createSandbox } = await import("./local-CkS1XhRu.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-dJ88L73Y.mjs

@@ -0,0 +1,2 @@
+import { n as devCommand } from "./dev-03LA_Etx.mjs";
+export { devCommand };

package/dist/{dev-worker-CpSB_Okh.mjs → dev-worker-D78leKBJ.mjs}

@@ -1,4 +1,4 @@
-import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER, r as redactCanopyCredentials, t as CALLER_HEADER } from "./src-CxzGOEhP.mjs";
+import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER, r as redactCanopyCredentials, t as CALLER_HEADER } from "./src-RUf3Gfuh.mjs";
 import { readFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
 //#region src/dev-worker.ts
@@ -200,6 +200,31 @@ function userFromHeaders(headers, fallback) {
 	};
 }
 /**
+* The caller in dev: stamped caller headers when a request poses as one
+* (a client-password visitor, say), else the same monk env.USER resolves to —
+* the developer, since no company login fronts a local server.
+*/
+function callerFromHeaders(headers, fallback) {
+	const kind = (headers.get("x-canopy-identity-kind") ?? "").trim();
+	const id = (headers.get("x-canopy-identity-id") ?? "").trim();
+	const agent = headers.get("x-canopy-caller") === "agent";
+	if ((kind === "monk" || kind === "external") && id) return {
+		kind,
+		id,
+		email: (headers.get("x-canopy-identity-email") ?? "").trim(),
+		name: (headers.get("x-canopy-identity-name") ?? "").trim(),
+		agent
+	};
+	const user = userFromHeaders(headers, fallback);
+	return user ? {
+		kind: "monk",
+		id: user.sub,
+		email: user.email,
+		name: user.name,
+		agent
+	} : null;
+}
+/**
 * The env object the worker sees, in the shim's own key order: secrets first,
 * platform keys after, so a stray `.dev.vars` entry can never shadow
 * `CANOPY`/`DB`/`USER` (the dashboard rejects those names outright —
@@ -207,12 +232,14 @@ function userFromHeaders(headers, fallback) {
 */
 function buildWorkerEnv(options, request, parts) {
 	const blobPrefix = `projects/${options.slug}/`;
+	const caller = callerFromHeaders(request.headers, options.user);
 	return {
 		...options.secrets,
 		CANOPY: { fetch: parts.canopyFetch },
 		DB: parts.db,
 		BLOB: parts.blob,
-		USER: userFromHeaders(request.headers, options.user),
+		USER: caller?.kind === "external" ? null : userFromHeaders(request.headers, options.user),
+		CALLER: caller,
 		PROJECT_SLUG: options.slug,
 		BLOB_PREFIX: blobPrefix,
 		CANOPY_CHANNEL: options.channel
@@ -316,6 +343,7 @@ function workerDevPlugin(options) {
 							return;
 						}
 						env.USER = null;
+						env.CALLER = null;
 						await worker.scheduled({
 							name,
 							cron: typeof body.cron === "string" ? body.cron : "",

package/dist/docs/cli-dev.md

@@ -39,7 +39,7 @@ With the lock in place, `--local` runs on an embedded SQLite engine instead —
 
 **Your backend worker.** If `canopy.json` names a `worker` entry (the worker scaffold does), `canopy dev` serves it too: requests to `/api/*` go to your worker, everything else to the SPA — the same split the platform makes once you deploy. There's no build step; save the file and the next request runs the new code.
 
-Your worker gets the same `env` it gets in production: `env.CANOPY.fetch` for the SDK, `env.DB` and `env.BLOB` for raw database and file access, `env.USER` for the signed-in person, `env.PROJECT_SLUG`. They all follow the mode you're in — live project data by default, your sandbox under `--local`. Two differences worth knowing: `env.USER` is you (the account you logged in with), since there's no company login in front of a local server, and a write through `env.DB` reports no row count locally.
+Your worker gets the same `env` it gets in production: `env.CANOPY.fetch` for the SDK, `env.DB` and `env.BLOB` for raw database and file access, `env.CALLER` and `env.USER` for whoever is calling, `env.PROJECT_SLUG`. They all follow the mode you're in — live project data by default, your sandbox under `--local`. Two differences worth knowing: `env.CALLER` and `env.USER` are you (the account you logged in with), since there's no company login in front of a local server, and a write through `env.DB` reports no row count locally.
 
 To tick a schedule by hand, post its name to the same path the platform uses:
 

package/dist/docs/cli-feedback.md

@@ -17,6 +17,7 @@ canopy feedback note <id> "stack trace and table names for the team"
 canopy feedback status <id> investigated --comment "root cause: the grant expires too early"
 canopy feedback list --status accepted
 canopy feedback status <id> resolved --comment "fixed in v42"
+canopy feedback status <id> declined --comment "works as intended: drafts are private"
 canopy feedback mine
 canopy feedback watch --project my-project
 canopy feedback report "canopy deploy exits 1 after upload" --command "canopy deploy"
@@ -107,9 +108,10 @@ queries — goes in `note <id> "<detail>"`, which only project
 members see. An internal note counts as findings for `investigated`.
 
 **Build:** `list --status accepted` is what a person has asked for. Do the
-work, then `resolve` with a note, or `declined` if it turns out to be a bad
-idea. Set `accepted` yourself only when the person you are working with told
-you to.
+work, then `status <id> resolved --comment "<what changed>"`, or
+`status <id> declined --comment "<why>"` if it turns out to be a bad idea.
+Set `accepted` yourself only when the person you are working with told you
+to.
 
 When a `canopy` command itself fails: rule out user error, check
 `canopy feedback mine` for a duplicate, then `report` with the exact command

package/dist/docs/developers-architecture.md

@@ -67,17 +67,29 @@ else is still static serving. A few things to know:
 
 - **Requests arrive authenticated.** The worker sits behind the same gateway
   wall as the frontend.
-- **The caller is already identified.** `c.env.USER` is the signed-in person
-  (`null` during a scheduled run) — no round-trip needed:
+- **The caller is already identified.** `c.env.CALLER` is whoever the
+  platform let in, with no round-trip needed: a signed-in Monk
+  (`kind: "monk"`) or a visitor who used the project's
+  [client password](https://docs.canopy.website/platform/client-access) (`kind: "external"`). It is
+  `null` only when nobody called, such as during a scheduled run:
 
   ```ts
   app.get("/api/hello", (c) => {
-    const user = c.env.USER;
-    if (!user) return c.json({ error: "unauthenticated" }, 401);
-    return c.json({ message: `Hello, ${user.name}!` });
+    const caller = c.env.CALLER;
+    if (!caller) return c.json({ error: "no caller" }, 400); // a scheduled run
+    if (caller.kind === "external") return c.json({ message: "Hello!" });
+    return c.json({ message: `Hello, ${caller.name}!` });
   });
   ```
 
+  `c.env.USER` is the shorter Monk-only form: the signed-in Monk, or `null`
+  for client-password visitors and scheduled runs. Use it when a route is for
+  Monks only, and don't read a `null` `USER` as "nobody is here".
+
+  A backend gets `CALLER` from its next deploy. One deployed before then can
+  ask the platform instead: `await canopy.auth.user()` through the `CANOPY`
+  binding (below) answers for every visitor.
+
 - **Platform access goes through the same SDK**, via the `CANOPY` service
   binding — same budgets, same data isolation as the browser:
 

package/dist/docs/platform-client-access.md

@@ -46,6 +46,14 @@ immediately, unlocked browsers included.
 > wrong for anything sensitive. Anyone who has it can view the app and share it further, so rotate
 > it when a review round ends.
 
+## Clients and your backend
+
+A client who unlocks the project with the password can use its backend
+routes too, as an anonymous visitor. The worker sees them on `env.CALLER`
+with `kind: "external"`, while `env.USER` (Monks only) is `null` for them. So a
+route that should serve clients checks `env.CALLER`, not `env.USER`. See
+[Auth](https://docs.canopy.website/sdk/auth#in-a-backend-worker).
+
 ## Playing well with other access controls
 
 Client access is independent of

package/dist/docs/porting-nextjs.md

@@ -69,7 +69,7 @@ three buckets:
 | Route handlers (`app/api/*/route.ts`)           | Worker endpoints under `/api/*`                                                                 |
 | Server actions                                  | Explicit worker endpoints, called with `fetch` from the client                                  |
 | Middleware                                      | Usually deleted (auth is platform-provided); anything else moves into the worker                |
-| NextAuth / auth middleware                      | Deleted — use `canopy.auth.user()` (client) or `env.USER` (worker)                              |
+| NextAuth / auth middleware                      | Deleted — use `canopy.auth.user()` (client) or `env.CALLER` (worker)                            |
 | Database (Prisma, Postgres, …)                  | `canopy.db` — per-project database, document API + SQL escape hatch                             |
 | File uploads (S3, …)                            | `canopy.blob` — per-project file storage with signed downloads                                  |
 | AI SDK / OpenAI client                          | `canopy.ai.chat()`, or point the Vercel AI SDK at `canopy.ai.endpoint()`                        |
@@ -117,12 +117,14 @@ Route handlers and server actions become endpoints in one fetch handler.
 
 ```ts
 // worker/index.ts
-import { createCanopy } from "@mediamonks/canopy";
+import { type CanopyCaller, createCanopy } from "@mediamonks/canopy";
 import { Hono } from "hono";
 
 type Env = {
   CANOPY: { fetch: typeof fetch };
-  /** Signed-in monk, verified by the platform; null for cron. */
+  /** Whoever the platform let in, client-password visitors included; null for cron. */
+  CALLER: CanopyCaller | null;
+  /** The signed-in monk only; null for cron and client-password visitors. */
   USER: { sub: string; email: string; name: string } | null;
   /** Project secrets from dashboard Settings appear as plain keys. */
   MY_API_KEY?: string;
@@ -132,8 +134,10 @@ const app = new Hono<{ Bindings: Env }>();
 
 // was: app/api/report/route.ts
 app.post("/api/report", async (c) => {
+  // Reports belong to a Monk's email, so this route is Monks-only. A
+  // client-password visitor is still let in, as env.CALLER with no email.
   const user = c.env.USER;
-  if (!user) return c.json({ error: "unauthenticated" }, 401);
+  if (!user) return c.json({ error: "monks_only" }, 403);
 
   // The SDK works inside the worker through the CANOPY binding —
   // same database and files the frontend sees, caller's identity attached.
@@ -184,8 +188,8 @@ egress allowlist, and even an allowed hop would arrive without your session.
 The platform recognizes this shape and short-circuits it: a fetch to the
 project's **own hostname** (or to `localhost` on any port — the common
 `BASE_URL` fallback) with a path under `/api/` re-enters your worker directly,
-in-process. No network hop, no allowlist entry, and `env.USER` is the same
-caller who made the original request. Two things to know:
+in-process. No network hop, no allowlist entry, and `env.CALLER` and
+`env.USER` are the same caller who made the original request. Two things to know:
 
 - The loopback covers `/api/*` only. A self-fetch to any other path fails
   like any other non-allowlisted host.
@@ -222,7 +226,8 @@ runs, so the ported app removes sign-in pages, session handling, and auth
 middleware entirely:
 
 - **Client:** `canopy.auth.user()` returns the signed-in monk.
-- **Worker:** `env.USER` carries the verified identity (no round-trip).
+- **Worker:** `env.CALLER` carries the verified caller (no round-trip),
+  client-password visitors included; `env.USER` is the Monk-only form.
 - Client-facing access without OneLogin is a per-project
   [password](https://docs.canopy.website/platform/client-access), configured in Settings — not code.
 
@@ -252,7 +257,7 @@ past greenhouse size (see [Use cases](https://docs.canopy.website/overview/use-c
 - [ ] Frontend: `output: 'export'` or Vite SPA; fix dynamic segments and `next/image`
 - [ ] Worker: route handlers + server actions → `/api/*` endpoints in `worker/index.ts`
 - [ ] Data: ORM → `canopy.db`; uploads → `canopy.blob`; AI clients → `canopy.ai`
-- [ ] Delete NextAuth/middleware; read identity from `canopy.auth.user()` / `env.USER`
+- [ ] Delete NextAuth/middleware; read identity from `canopy.auth.user()` / `env.CALLER`
 - [ ] Secrets via `canopy secrets set` (or dashboard Settings); `NEXT_PUBLIC_*` into your CI build
 - [ ] Crons into Settings → Schedules, handled in `scheduled()`
 - [ ] `canopy.json` with `build`, `dist`, `worker` — then `canopy deploy`

package/dist/docs/sdk-auth.md

@@ -43,6 +43,38 @@ if (user.kind === "external") {
 > **Warning:** Branching on `kind` in the browser is presentation, not security — anything your page can fetch, a
 > visitor can fetch. The platform's access rules are what actually protect data.
 
+### In a backend worker
+
+A worker route already knows who is calling, without asking: `env.CALLER`
+holds the same `id`, `email`, `name` and `kind` that `auth.user()` returns,
+plus `agent`, which is `true` when an AI agent is acting for a Monk.
+
+```ts
+import type { CanopyCaller } from "@mediamonks/canopy";
+
+app.get("/api/me", (c) => {
+  const caller: CanopyCaller | null = c.env.CALLER;
+  if (!caller) return c.json({ error: "no caller" }, 400); // a scheduled run
+  return c.json({ kind: caller.kind, name: caller.name });
+});
+```
+
+`env.CALLER` is `null` only when nobody called, such as during a scheduled
+run. `env.USER` is the Monk-only form: the signed-in Monk, or `null` for a
+client-password visitor.
+
+A client-password visitor has no email address and is named `"Client"`. Its
+`id` changes with every password unlock, so don't key data on it that has to
+last.
+
+A backend gets `env.CALLER` from its next deploy. Until it is redeployed,
+`auth.user()` through the `CANOPY` binding gives the same answer:
+
+```ts
+const canopy = createCanopy({ fetch: c.env.CANOPY.fetch.bind(c.env.CANOPY) });
+const user = await canopy.auth.user();
+```
+
 ## auth.logout()
 
 Ends the platform session for the current visitor. Their next request hits the

package/dist/docs/sdk-mcp.md

@@ -66,8 +66,8 @@ export default {
 ```
 
 **Returns** `(request, env?, executionCtx?) => Promise<Response>`. Pass the
-backend's `env` so handlers and route tools see `env.USER`, `env.CANOPY` and
-your secrets.
+backend's `env` so handlers and route tools see `env.USER`, `env.CALLER`,
+`env.CANOPY` and your secrets.
 
 **Options:** `{ app?, name?, version? }`. `app` is required when the list has
 route tools: they run its routes.
@@ -197,8 +197,9 @@ app.get("/api/notes", (c) => {
 ```
 
 **Returns** `McpCaller`: `{ user: McpUser | null, agent: boolean }`.
-`user` comes from `env.USER`. Without `env`, it falls back to the identity the
-platform attached to the request.
+`user` comes from `env.USER`, and `agent` from `env.CALLER` when the backend
+has it. Without `env`, both fall back to what the platform attached to the
+request.
 
 ## When the tool list is wrong
 

package/dist/{docs-Bplp4sOY.mjs → docs-B0-IEPjd.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CJJpjVh_.mjs";
+import { t as version } from "./package-C1xCnyOB.mjs";
 import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { n as agentHeaders } from "./api-ArfD6-t5.mjs";

package/dist/{feedback-DFK0TXlt.mjs → feedback-BsJ_6ke2.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CJJpjVh_.mjs";
+import { t as version } from "./package-C1xCnyOB.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
 import { a as apiRequest, c as credentials, i as apiDownload, o as apiUpload, s as commonHeaders } from "./api-ArfD6-t5.mjs";
 import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
@@ -307,7 +307,7 @@ function repeatedFlag(flag, value) {
 		}
 		return arg.startsWith(`${flag}=`) ? [arg.slice(flag.length + 1)] : [];
 	});
-	return (repeated.length > 0 ? repeated : value === void 0 ? [] : [String(value)]).flatMap((entry) => entry.split(",")).map((path) => path.trim()).filter((path) => path !== "");
+	return (repeated.length > 0 ? repeated : typeof value === "string" ? [value] : []).flatMap((entry) => entry.split(",")).map((path) => path.trim()).filter((path) => path !== "");
 }
 /** Upload each file to a report that already exists (docs/21 create-then-attach). */
 async function attachFiles(slug, itemId, paths, caption, commentId) {
@@ -316,7 +316,7 @@ async function attachFiles(slug, itemId, paths, caption, commentId) {
 		const params = new URLSearchParams({ filename: basename(path) });
 		if (caption) params.set("caption", paths.length > 1 ? `${caption} (${index + 1})` : caption);
 		if (commentId) params.set("comment_id", commentId);
-		await apiUpload(`/projects/${slug}/feedback/${encodeURIComponent(itemId)}/attachments?${params}`, bytes, IMAGE_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream");
+		await apiUpload(`/projects/${slug}/feedback/${encodeURIComponent(itemId)}/attachments?${params.toString()}`, bytes, IMAGE_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream");
 		console.log(`Attached ${basename(path)}.`);
 	}
 }
@@ -400,7 +400,7 @@ const listCommand = defineCommand({
 		const params = new URLSearchParams();
 		if (args.status) params.set("status", args.status);
 		if (args.kind) params.set("kind", args.kind);
-		const { items } = await apiRequest("GET", `/projects/${slug}/feedback${params.size > 0 ? `?${params}` : ""}`);
+		const { items } = await apiRequest("GET", `/projects/${slug}/feedback${params.size > 0 ? `?${params.toString()}` : ""}`);
 		if (args.json) console.log(JSON.stringify(items, null, 2));
 		else printItems(items);
 	})

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-CJJpjVh_.mjs";
+import { t as version } from "./package-C1xCnyOB.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -70,7 +70,7 @@ const main = defineCommand({
 		init: () => import("./projects-B3Wi01lw.mjs").then((m) => m.initCommand),
 		projects: () => import("./projects-B3Wi01lw.mjs").then((m) => m.projectsCommand),
 		delete: () => import("./projects-B3Wi01lw.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-BdSq6CGD.mjs").then((m) => m.devCommand),
+		dev: () => import("./dev-dJ88L73Y.mjs").then((m) => m.devCommand),
 		deploy: () => import("./deploy-B7KItUnh.mjs").then((m) => m.deployCommand),
 		promote: () => import("./deploy-B7KItUnh.mjs").then((m) => m.promoteCommand),
 		staging: () => import("./staging-ypR79MlD.mjs").then((m) => m.stagingCommand),
@@ -80,17 +80,17 @@ const main = defineCommand({
 		egress: () => import("./egress-CzxRD6Tp.mjs").then((m) => m.egressCommand),
 		secrets: () => import("./secrets-CmY4dUHz.mjs").then((m) => m.secretsCommand),
 		schedule: () => import("./schedule-CbaDIJXr.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-DFK0TXlt.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-BsJ_6ke2.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-DGrCgj-R.mjs").then((m) => m.dbCommand),
 		usage: () => import("./usage-CP8rBVZi.mjs").then((m) => m.usageCommand),
 		ai: () => import("./ai-EyrXJC5z.mjs").then((m) => m.aiCommand),
 		open: () => import("./open-COFMburt.mjs").then((m) => m.openCommand),
 		browse: () => import("./browse-DEhnJAPT.mjs").then((m) => m.browseCommand),
-		docs: () => import("./docs-Bplp4sOY.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-C2lGGz9n.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-Caj1RsA7.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-aJwWWaMx.mjs").then((m) => m.logsCommand),
-		mcp: () => import("./mcp-DuT6_wei.mjs").then((m) => m.mcpCommand),
+		docs: () => import("./docs-B0-IEPjd.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-AqZYYsE6.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-DSjmifH_.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-wSKh_FmL.mjs").then((m) => m.logsCommand),
+		mcp: () => import("./mcp-DtRIDtaL.mjs").then((m) => m.mcpCommand),
 		repo: () => import("./repo-CmbakFVi.mjs").then((m) => m.repoCommand),
 		template: () => import("./project-template-DlzMx8Oj.mjs").then((m) => m.templateCommand)
 	}

package/dist/{local-BnfAEwso.mjs → local-CkS1XhRu.mjs}

@@ -1,6 +1,6 @@
 import { r as apiDataRequest } from "./api-ArfD6-t5.mjs";
-import { a as realtimeRouter, c as META_COLUMNS, l as blobRouter, n as WORKER_ATTEST_HEADER, o as dbRouter, s as hasPrivateNames } from "./src-CxzGOEhP.mjs";
-import { a as rewriteApiPath } from "./dev-BMWj4NDZ.mjs";
+import { a as realtimeRouter, c as META_COLUMNS, l as blobRouter, n as WORKER_ATTEST_HEADER, o as dbRouter, s as hasPrivateNames } from "./src-RUf3Gfuh.mjs";
+import { a as rewriteApiPath } from "./dev-03LA_Etx.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{logs-aJwWWaMx.mjs → logs-wSKh_FmL.mjs}

@@ -33,7 +33,7 @@ async function fetchLogs(slug, params) {
 	const query = new URLSearchParams({ channel: params.channel });
 	if (params.since) query.set("since", params.since);
 	if (params.limit) query.set("limit", String(params.limit));
-	return withContext(apiRequest("GET", `/projects/${slug}/logs?${query}`), {
+	return withContext(apiRequest("GET", `/projects/${slug}/logs?${query.toString()}`), {
 		action: `read worker logs for "${slug}"`,
 		fixes: { not_supported_on_target: "Worker logs aren't available on this site yet." }
 	});

package/dist/{mcp-DuT6_wei.mjs → mcp-DtRIDtaL.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CJJpjVh_.mjs";
+import { t as version } from "./package-C1xCnyOB.mjs";
 import { d as tryResolveProject, l as stagingUrl, n as siteConfig, s as projectUrl } from "./site-DM2J10CB.mjs";
 import { a as apiRequest, t as ApiError } from "./api-ArfD6-t5.mjs";
 import { t as liveDevServer } from "./dev-server-file-Dk9pk4AR.mjs";

package/dist/{package-CJJpjVh_.mjs → package-C1xCnyOB.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.39";
+var version = "0.7.40";
 //#endregion
 export { version as t };

package/dist/{skill-C2lGGz9n.mjs → skill-AqZYYsE6.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CJJpjVh_.mjs";
+import { t as version } from "./package-C1xCnyOB.mjs";
 import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/{src-CxzGOEhP.mjs → src-RUf3Gfuh.mjs}

@@ -852,11 +852,15 @@ function realtimeRouter(config) {
 * `worker-request.cases.ts` alongside this implementation, so the two cannot
 * drift silently.
 */
-/** Gateway-stamped identity, for the worker's own `env.USER` — never relayed. */
+/** Gateway-stamped identity, for the worker's own `env.USER` / `env.CALLER` — never relayed. */
 const IDENTITY_STAMP_HEADERS = [
 	"x-canopy-user-sub",
 	"x-canopy-user-email",
-	"x-canopy-user-name"
+	"x-canopy-user-name",
+	"x-canopy-identity-kind",
+	"x-canopy-identity-id",
+	"x-canopy-identity-email",
+	"x-canopy-identity-name"
 ];
 /**
 * Header carrying the project's worker token as runtime-origin proof (docs/35).

package/dist/templates/spa/package.json

@@ -7,7 +7,7 @@
     "build": "tsc && vite build"
   },
   "dependencies": {
-    "@mediamonks/canopy": "^0.0.11",
+    "@mediamonks/canopy": "^0.0.12",
     "react": "^19.1.0",
     "react-dom": "^19.1.0"
   },

package/dist/templates/worker/package.json

@@ -7,7 +7,7 @@
     "build": "tsc && vite build"
   },
   "dependencies": {
-    "@mediamonks/canopy": "^0.0.11",
+    "@mediamonks/canopy": "^0.0.12",
     "hono": "^4.8.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0"

package/dist/{upgrade-Caj1RsA7.mjs → upgrade-DSjmifH_.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-C2lGGz9n.mjs");
+		const { skillInstalled } = await import("./skill-AqZYYsE6.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.39",
+  "version": "0.7.40",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -22,7 +22,7 @@
     "esbuild": "^0.28.1",
     "hono": "^4.8.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy": "0.0.11",
+    "@mediamonks/canopy": "0.0.12",
     "@mediamonks/canopy-data-plane": "0.0.4"
   },
   "devDependencies": {

package/dist/dev-BdSq6CGD.mjs

@@ -1,2 +0,0 @@
-import { n as devCommand } from "./dev-BMWj4NDZ.mjs";
-export { devCommand };