@mediamonks/canopy-cli 0.7.45 → 0.7.47

package/dist/docs/ci.md

@@ -1,75 +1,137 @@
 ---
-title: CI and deploy tokens
-description: Push-to-main deploys using a project-scoped deploy token, and why we recommend deploying from your own machine instead.
+title: CI deploys
+description: Deploy on every push from GitHub Actions with no secret — link the repository once. Deploy tokens for other CI.
 ---
 
-## Our recommendation: deploy manually
+## Link, push, done
+
+A project can deploy itself from GitHub Actions. Link the repository once, and
+every push to its main branch deploys the project. There is no secret to create,
+paste or rotate: the run proves which repository and branch it comes from with
+GitHub's own sign-in, and Canopy only accepts runs from the repository you
+linked.
+
+Only the project owner (or a platform admin) can link a repository. In the
+project's folder:
+
+```bash
+canopy repo link
+```
+
+With no argument it links the repository the folder's `origin` remote points
+at, on github.com or the Monks GitHub Enterprise (`monks.ghe.com`). Name it
+yourself if needed:
+
+```bash
+canopy repo link monks/my-tool                  # on this site's GitHub Enterprise
+canopy repo link github.com/monks/my-tool       # on github.com
+```
+
+`canopy create` scaffolds `.github/workflows/canopy-deploy.yml`, which deploys
+on every push to `main`. If you write your own workflow, it needs the
+`id-token: write` permission and nothing else:
+
+```yaml
+on:
+  push:
+    branches: [main]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - run: npm ci
+      - run: npm exec --yes @mediamonks/canopy-cli deploy
+```
 
-Most Canopy users don't have a GitHub Enterprise seat, so they can't see or
-interact with GitHub Actions. That is why Canopy repositories are created with
-Actions turned **off**: pushing a workflow file works, but nothing runs, and
-there is no Actions tab for you to look at. Turning Actions on for a repository
-is something only a GitHub administrator can do, and you would still not see
-the runs.
+A run from any other branch, a pull request or a fork deploys nothing. Until a
+repository is linked, runs skip the deploy with a warning instead of failing.
 
-Deploy from your machine (or let your coding agent do it): run
-`canopy deploy --staging`, check the result, then `canopy promote`. It is
-usually quicker than waiting for a pipeline, and your agent can verify the
-deploy right afterwards. Run your typecheck, lint and tests locally before you
-deploy.
+Deploys from CI show up in the history under the repository and branch, e.g.
+`monks/my-tool @ main`.
 
-The rest of this page is for teams that run their own CI somewhere they can
-see it.
+A project with a Canopy repository needs no link: CI deploys from it already.
+GitHub Actions are off on Canopy repositories until a platform administrator
+turns them on for one.
+
+## Our recommendation: deploy manually
 
-Interactive `canopy login` is for humans at a terminal. For automated deploys
-(GitHub Actions, etc.) use a **deploy token**: a project-scoped credential that
-can deploy that one project and nothing else.
+Most Canopy users don't have a GitHub Enterprise seat, so they can't see the
+runs. Deploying from your machine (or letting your coding agent do it) is
+usually quicker: run `canopy deploy --staging`, check the result, then
+`canopy promote`. Run your typecheck, lint and tests locally before you deploy.
 
-## Create a token
+## A staging branch
 
-Only the project owner can create a deploy token (any editor can list
-and revoke them). From inside the project directory:
+Pushes to a second branch can deploy to the project's
+[staging channel](https://docs.canopy.website/guides/staging) only. They can never change what is live:
+no live deploy, promote or rollback.
 
 ```bash
-canopy token create --name "GitHub Actions"
+canopy repo branches --staging-ref develop
 ```
 
-This prints the token **once** — copy it immediately and store it as a CI secret
-(e.g. `CANOPY_DEPLOY_TOKEN`). It is not shown again.
+Then add the branch to the workflow's trigger so its pushes run it:
 
-Manage tokens:
+```yaml
+on:
+  push:
+    branches: [main, develop]
+```
+
+The same workflow deploys `main` live and `develop` to staging. Promote from
+staging to live by hand with `canopy promote`.
+
+## Pausing CI deploys
+
+Turn CI deploys off without unlinking or editing the workflow:
 
 ```bash
-canopy token list
-canopy token revoke <id>
+canopy repo deploys off
+canopy repo deploys on
 ```
 
-## Use it in CI
+While they are off, runs skip the deploy with a warning. The link and branches
+stay as they were. You can also flip the switch on the project's Deploys tab.
 
-The CLI picks up `CANOPY_DEPLOY_TOKEN` from the environment and uses it instead
-of an interactive login. A minimal GitHub Actions step:
+`canopy repo show` prints the repository, both branches and whether CI deploys
+are on. `canopy repo unlink` removes the link.
 
-```yaml
-- run: npm install -g @mediamonks/canopy-cli
-- run: canopy deploy
-  env:
-    CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
+## Other CI: deploy tokens
+
+For CI that isn't GitHub Actions, or a repository you can't link, use a
+**deploy token**: a project-scoped credential that can deploy that one project
+and nothing else.
+
+Only the project owner can create one (any editor can list and revoke them).
+From inside the project directory:
+
+```bash
+canopy token create --name "Buildkite"
 ```
 
-(`canopy deploy` runs the project's `canopy.json` build command by default;
-pass `--no-build` if CI already built the output directory.)
+This prints the token **once** — store it as a CI secret right away. It is not
+shown again.
 
-No `canopy login` step is needed — the token is the credential.
+```bash
+canopy token list
+canopy token revoke <id>
+```
 
-## Notes
+Set it as `CANOPY_DEPLOY_TOKEN` in the CI environment and run `canopy deploy`.
+No `canopy login` is needed. A deploy token also works in GitHub Actions, and
+wins over the linked repository when both are there.
 
-- A deploy token can only deploy its own project — it reaches that project's
-  deploy endpoints and upload grants and nothing else. If it strays to another
-  project's resources, the platform rejects it.
-- The token belongs to the project, not to the person who created it. It keeps
-  working when they leave the project or the company; deploys it makes show up
-  in the history under the token's name.
-- A token that goes 90 days without a deploy stops working. Active pipelines
-  never notice; a forgotten one dies on its own. The token list shows when each
-  was last used.
-- Revoke a token the moment it might be exposed; create a fresh one to replace it.
+- A deploy token can only deploy its own project.
+- It belongs to the project, not to the person who created it, and keeps
+  working when they leave.
+- A token that goes 90 days without a deploy stops working.
+- Turning CI deploys off does not stop a deploy token. Revoke it for that.

package/dist/docs/cli-audience.md

@@ -0,0 +1,47 @@
+---
+title: canopy audience
+description: Say who a project is for and whether it's still a draft.
+---
+
+`canopy audience` sets the labels people see on the dashboard's project list:
+who the project was made for, and whether it's still a draft. They never
+change who can open the project. Read
+[Saying who it's for](https://docs.canopy.website/platform/members-and-access#saying-who-its-for).
+
+## Usage
+
+```bash
+canopy audience show
+canopy audience set <everyone|personal>
+canopy audience set <client|department> <name>
+canopy audience draft
+canopy audience ready
+```
+
+## Arguments & flags
+
+Each subcommand works on the project in the current folder (`canopy.json`),
+or the one you name with `--project <slug>`. All of them honour the global
+`--profile <site>` / `CANOPY_PROFILE`. Owners, managers and editors can change
+them.
+
+- `show` — who the project is for, and whether it's a draft.
+- `set <kind> [name]` — `everyone` (the default), `personal`, or `client` /
+  `department` with a name of up to 40 characters. Quote names with spaces.
+- `draft` — mark it as not ready yet. It shows greyed out on the project list
+  but stays listed and usable.
+- `ready` — it's no longer a draft.
+
+## Examples
+
+```bash
+canopy audience set client "Uniqlo"
+```
+
+Marks the project as made for the Uniqlo client team.
+
+```bash
+canopy audience draft --project retro-board
+```
+
+Marks `retro-board` as a draft without being in its folder.

package/dist/docs/cli-create.md

@@ -40,6 +40,8 @@ canopy create
 
 Walks you through name, slug, and template, registers the project, and scaffolds a ready-to-run starter with next steps printed.
 
+The starter includes `.github/workflows/canopy-deploy.yml`, which deploys on every push to `main` once the repository is linked. `create` never links a repository itself; the next steps print the exact [`canopy repo link`](https://docs.canopy.website/cli/repo) command for the folder's GitHub `origin`. See [CI deploys](https://docs.canopy.website/guides/ci).
+
 ```bash
 canopy create "Team Retro Board" --slug retro-board --template spa
 ```

package/dist/docs/cli-deploy.md

@@ -33,7 +33,7 @@ canopy deploy --project my-app ./out
 
 Deploys are versioned and immutable: nothing overwrites an old version, so [canopy rollback](https://docs.canopy.website/cli/rollback) can always take you back.
 
-**CI.** Set the `CANOPY_DEPLOY_TOKEN` environment variable to a project-scoped deploy token (from [canopy token create](https://docs.canopy.website/cli/token)) and `canopy deploy` works with no `canopy login` — the token can deploy exactly one project and nothing else. Deploys from GitHub Actions are tagged with their source in the deploy history.
+**CI.** In GitHub Actions, `canopy deploy` needs no secret and no `canopy login`: with `permissions: id-token: write` in the workflow, it proves which repository and branch the run comes from and deploys a project [linked](https://docs.canopy.website/cli/repo) to that repository. A run on the project's staging branch deploys to staging without `--staging`. An unlinked project, or one whose CI deploys are off, skips the deploy with a warning instead of failing. Elsewhere, set `CANOPY_DEPLOY_TOKEN` to a project-scoped deploy token (from [canopy token create](https://docs.canopy.website/cli/token)); it wins over the linked repository when both are there. Deploys from GitHub Actions are tagged with their source in the deploy history. See [CI deploys](https://docs.canopy.website/guides/ci).
 
 ## Examples
 

package/dist/docs/cli-repo.md

@@ -1,6 +1,6 @@
 ---
 title: canopy repo
-description: Create, clone and set up the project's git repository on Canopy.
+description: Create, clone and set up the project's git repository on Canopy, or link a GitHub repository so its pushes deploy.
 ---
 
 `canopy repo` manages the project's git repository. A project has at most one: a
@@ -16,6 +16,10 @@ canopy repo create
 canopy repo clone <slug> [folder]
 canopy repo connect
 canopy repo delete [--yes]
+canopy repo link [<host>/<owner/name>] [--ref <branch>] [--staging-ref <branch>]
+canopy repo branches [--ref <branch>] [--staging-ref <branch>|none]
+canopy repo deploys on|off
+canopy repo unlink
 ```
 
 ## Arguments & flags
@@ -41,6 +45,25 @@ the global `--profile <site>` / `CANOPY_PROFILE`.
   type the slug.
   - `--yes` — skip that question.
 
+These set up [CI deploys](https://docs.canopy.website/guides/ci) from GitHub Actions. All of them are
+owner only (or a platform admin):
+
+- `link [<host>/<owner/name>]` — link a GitHub repository outside Canopy, so a
+  push to its live branch deploys the project. With no argument it links the
+  folder's `origin` remote. The host is github.com or this site's GitHub
+  Enterprise (`monks.ghe.com`), which is the default.
+  - `--ref <branch>` — the live branch (default `main`).
+  - `--staging-ref <branch>` — a staging branch, whose pushes deploy to the
+    staging channel only.
+- `branches` — change the live or staging branch, for a linked repository or a
+  Canopy one. `--staging-ref none` removes the staging branch.
+- `deploys on|off` — turn CI deploys on or off without unlinking. Off makes
+  runs skip the deploy with a warning. Deploy tokens are not affected.
+- `unlink` — remove the link.
+
+`show` also prints the repository CI deploys from, both branches and whether
+CI deploys are on.
+
 ## How it works
 
 Setting up a folder (`create`, `clone`, `connect`) does two things:
@@ -54,7 +77,9 @@ for a short-lived token that only works for this repository, keeps it in
 `~/.canopy` for up to an hour, and gets a new one when needed. `canopy logout`
 throws them away.
 
-Pushing doesn't deploy. Run `canopy deploy` for that.
+Pushing doesn't deploy by itself. Run `canopy deploy`, or set up
+[CI deploys](https://docs.canopy.website/guides/ci): a Canopy repository needs no link, but GitHub Actions
+are off on it until a platform administrator turns them on.
 
 ## Examples
 
@@ -84,4 +109,11 @@ canopy repo show --json
 }
 ```
 
+```bash
+canopy repo link --staging-ref develop
+```
+
+Links the GitHub repository this folder's `origin` points at: pushes to `main`
+deploy live, pushes to `develop` deploy to staging.
+
 Read the [git guide](https://docs.canopy.website/guides/git) for the bigger picture.

package/dist/docs/cli-token.md

@@ -3,12 +3,14 @@ title: canopy token
 description: Create, list, and revoke project-scoped deploy tokens for CI and push-to-main deploys.
 ---
 
-`canopy token` manages deploy tokens: standing `cnpy_` bearer credentials that can do exactly one thing — deploy one specific project. You reach for it when setting up CI (typically GitHub Actions deploying on every push to main) so the runner never needs a personal login.
+`canopy token` manages deploy tokens: standing `cnpy_` bearer credentials that can do exactly one thing — deploy one specific project. You reach for it when setting up CI other than GitHub Actions, so the runner never needs a personal login.
+
+GitHub Actions doesn't need a token: link the repository with [`canopy repo link`](https://docs.canopy.website/cli/repo) and pushes deploy with no secret. See [CI deploys](https://docs.canopy.website/guides/ci).
 
 ## Usage
 
 ```bash
-canopy token create --name "GitHub Actions"
+canopy token create --name "Buildkite"
 canopy token list
 canopy token revoke <id>
 ```
@@ -18,7 +20,7 @@ canopy token revoke <id>
 All subcommands resolve the project the usual way — `canopy.json` in the target directory, or `--project <slug>` to override — and honor the global `--profile <site>` / `CANOPY_PROFILE` for which site the token belongs to.
 
 - `create` — mint a new deploy token for the project. Owner only: editors get a clear error and should ask the owner.
-  - `--name <label>` — a label shown in the dashboard, e.g. `"GitHub Actions"`. Optional but recommended so you can tell tokens apart later.
+  - `--name <label>` — a label shown in the dashboard, e.g. `"Buildkite"`. Optional but recommended so you can tell tokens apart later.
 - `list` — show the project's deploy tokens: id, name, creation time, who created them, and when each was last used. Token values are never shown here.
 - `revoke <id>` — delete a token by its id (from `canopy token list`). Deploys using it stop working immediately.
 
@@ -28,17 +30,17 @@ All subcommands resolve the project the usual way — `canopy.json` in the targe
 
 The token belongs to the project rather than to whoever created it, so CI keeps working when that person leaves. It has no fixed expiry but stops working after 90 days without a deploy; `list` shows when each token was last used.
 
-To use it in CI, put the value in the `CANOPY_DEPLOY_TOKEN` environment variable — the CLI checks it before the login token, so `canopy deploy` works on a runner with no `canopy login`. For GitHub Actions, add it as the repo secret `CANOPY_DEPLOY_TOKEN` (`gh secret set CANOPY_DEPLOY_TOKEN`, or Settings → Secrets); pushes to main then deploy via the project's `canopy-deploy.yml` workflow.
+To use it in CI, put the value in the `CANOPY_DEPLOY_TOKEN` environment variable — the CLI checks it first, so `canopy deploy` works on a runner with no `canopy login`. In GitHub Actions a token wins over the linked repository, and keeps working while CI deploys are switched off.
 
 If a deploy fails with a rejected token, it was likely revoked — create a fresh one here or in the dashboard (Settings → Deploy tokens) and update the secret. Losing a token is never a problem: revoke the old id and mint a new one.
 
 ## Examples
 
 ```bash
-canopy token create --name "GitHub Actions"
+canopy token create --name "Buildkite"
 ```
 
-Prints a new `cnpy_` token once, with instructions for storing it as the `CANOPY_DEPLOY_TOKEN` repo secret.
+Prints a new `cnpy_` token once, to store as the CI's `CANOPY_DEPLOY_TOKEN` secret.
 
 ```bash
 canopy token list --project my-app

package/dist/docs/cli.md

@@ -63,9 +63,13 @@ has a full page per command.
 - `canopy ai models` — the AI models and `auto/*` aliases this site offers,
   with prices. Works from any directory; `--json` for agents.
 
-## CI / deploy tokens
+## CI deploys
 
-- `canopy token create` — create a project-scoped deploy token for CI.
+- `canopy repo link` — link the folder's GitHub repository (owner only): pushes
+  to `main` then deploy from GitHub Actions with no secret.
+  `--staging-ref <branch>` adds a branch that deploys to staging only.
+- `canopy repo deploys on|off` — pause or resume CI deploys without unlinking.
+- `canopy token create` — create a project-scoped deploy token for other CI.
   `--name "<label>"` to label it.
 - `canopy token list` — list the project's deploy tokens.
 - `canopy token revoke <id>` — revoke a token.

package/dist/docs/deploy.md

@@ -77,5 +77,6 @@ canopy open
 
 ## Deploying from CI
 
-For automated push-to-main deploys, use a deploy token instead of an interactive
-login — see `canopy docs ci`.
+For automated push-to-main deploys from GitHub Actions, link the repository with
+`canopy repo link` — no secret needed. Other CI uses a deploy token. See
+`canopy docs ci`.

package/dist/docs/index.json

@@ -69,8 +69,8 @@
         },
         {
           "slug": "ci",
-          "title": "CI and deploy tokens",
-          "summary": "Push-to-main deploys using a project-scoped deploy token, and why we recommend deploying from your own machine instead."
+          "title": "CI deploys",
+          "summary": "Deploy on every push from GitHub Actions with no secret — link the repository once. Deploy tokens for other CI."
         },
         {
           "slug": "git",
@@ -246,6 +246,11 @@
           "title": "canopy rename",
           "summary": "Change a project's slug — its address — and update canopy.json."
         },
+        {
+          "slug": "cli-audience",
+          "title": "canopy audience",
+          "summary": "Say who a project is for and whether it's still a draft."
+        },
         {
           "slug": "cli-dev",
           "title": "canopy dev",
@@ -284,7 +289,7 @@
         {
           "slug": "cli-repo",
           "title": "canopy repo",
-          "summary": "Create, clone and set up the project's git repository on Canopy."
+          "summary": "Create, clone and set up the project's git repository on Canopy, or link a GitHub repository so its pushes deploy."
         },
         {
           "slug": "cli-template",

package/dist/docs/platform-deploys-and-rollbacks.md

@@ -27,9 +27,9 @@ the previous version keeps serving until the new one is complete.
   [deploy guide](https://docs.canopy.website/guides/deploy) for details.
 - **From the dashboard** — on the project's Overview tab, upload a new version
   by dragging in a zip, a folder, or loose files. No command line required.
-- **Automatically from CI** — create a project-scoped deploy token, add it to
-  your repository's secrets, and merging to `main` ships a new version on its
-  own. See [CI and deploy tokens](https://docs.canopy.website/guides/ci).
+- **Automatically from CI** — link the project's GitHub repository once
+  (`canopy repo link`), and every push to `main` ships a new version on its own,
+  with no secret. Other CI uses a deploy token. See [CI deploys](https://docs.canopy.website/guides/ci).
 
 The dashboard's deploy history shows every version with who published it and
 where it came from (CLI, dashboard, or CI).
@@ -90,4 +90,4 @@ Downloads are limited to the project's members; the deploy bundle is your
 source, not the public site.
 
 - [Deploying](https://docs.canopy.website/guides/deploy) — Build commands, canopy.json, and what canopy deploy does step by step.
-- [CI and deploy tokens](https://docs.canopy.website/guides/ci) — Ship a new version automatically on every push to main.
+- [CI deploys](https://docs.canopy.website/guides/ci) — Ship a new version automatically on every push to main.

package/dist/docs/platform-members-and-access.md

@@ -113,6 +113,26 @@ Turning it off again is the same toggle.
 > **Note:** Members-only gates the **live app**. Management pages (settings, data, deploys) are always for the
 > owner, managers and editors only, whatever this toggle says.
 
+## Saying who it's for
+
+Not every project is meant for everyone who scrolls past it. In **Settings →
+Audience** you can say who it was made for:
+
+- **Everyone**, the default. Nothing extra shows on the project list.
+- **Just me**, for a personal tool or experiment.
+- **A client team** or **a department**, with its name (up to 40 characters).
+
+Other people see the audience as a small badge next to **Visit** on the
+project list, and personal projects sort below the ones meant for everyone.
+Every Monk can read the name, the same as the project's name and description.
+
+Turn on **Still a draft** while it isn't ready. The project shows greyed out
+and sorts lower, but it stays listed and anyone who could open it still can.
+
+Both are labels only. They never change who can open the project; that's
+what members-only and the client password are for. From the CLI, use
+[`canopy audience`](https://docs.canopy.website/cli/audience).
+
 ## Platform admins and the Admin page
 
 Platform admins get an extra **Admin** page in the dashboard. Its **Users**

package/dist/{docs-Cpky2XNP.mjs → docs-D5gmZRJk.mjs}

@@ -1,8 +1,8 @@
-import { t as version } from "./package-Dph4v1Cq.mjs";
-import { r as siteConfig } from "./site-0i7wAJqg.mjs";
+import { t as version } from "./package-BksVeJZB.mjs";
+import { r as siteConfig } from "./site-BL5Ik-yj.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { n as agentHeaders } from "./api-Bl6SG8Oq.mjs";
-import { r as reportErrors } from "./ui-CLnICOne.mjs";
+import { n as agentHeaders } from "./api-DmJrIsE7.mjs";
+import { r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{egress-C2amvqmE.mjs → egress-BM4EpLBh.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { c as projectDirArgs, d as resolveProject } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts

package/dist/{feedback-CTV6inRg.mjs → feedback-C6kiYRro.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-Dph4v1Cq.mjs";
-import { f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, p as tryResolveProject, r as siteConfig } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, c as credentials, i as apiDownload, o as apiUpload, s as commonHeaders } from "./api-Bl6SG8Oq.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { t as version } from "./package-BksVeJZB.mjs";
+import { c as projectDirArgs, d as resolveProject, h as tryResolveProject, m as tryReadCanopyJson, r as siteConfig } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, c as credentials, i as apiDownload, o as apiUpload, s as commonHeaders } from "./api-DmJrIsE7.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";
@@ -562,7 +562,7 @@ const watchCommand = defineCommand({
 		} else tryResolveProject({});
 		if (args.since && args.after) throw new Error("Pass --since or --after, not both (--after already says where to resume).");
 		if (args.since && Number.isNaN(Date.parse(args.since))) throw new Error(`--since must be an ISO time such as 2026-10-23T09:00:00Z (got "${args.since}").`);
-		const { apiUrl, token } = credentials();
+		const { apiUrl, token } = await credentials();
 		const controller = new AbortController();
 		const stop = () => controller.abort();
 		process.once("SIGINT", stop);

package/dist/index.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "./package-Dph4v1Cq.mjs";
-import { i as siteHeaderLine, n as setInvocationProfile } from "./site-0i7wAJqg.mjs";
+import { t as version } from "./package-BksVeJZB.mjs";
+import { i as siteHeaderLine, n as setInvocationProfile } from "./site-BL5Ik-yj.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
 //#region src/index.ts
@@ -63,39 +63,40 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-CREcZfLH.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-CREcZfLH.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-CREcZfLH.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-BRG2HnBs.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-BRG2HnBs.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-BRG2HnBs.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-BRG2HnBs.mjs").then((m) => m.deleteCommand),
-		rename: () => import("./rename-BGKa25Rq.mjs").then((m) => m.renameCommand),
-		dev: () => import("./dev-CSimnUP3.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-ExrIeX_m.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-ExrIeX_m.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-_2Js0Fkc.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-ExrIeX_m.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-ExrIeX_m.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-7vSNuz-X.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-C2amvqmE.mjs").then((m) => m.egressCommand),
-		secrets: () => import("./secrets-BjbIi7Gp.mjs").then((m) => m.secretsCommand),
-		roles: () => import("./roles-C7pq9bIx.mjs").then((m) => m.rolesCommand),
-		members: () => import("./roles-C7pq9bIx.mjs").then((m) => m.membersCommand),
-		schedule: () => import("./schedule-BcqBspn3.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-CTV6inRg.mjs").then((m) => m.feedbackCommand),
-		db: () => import("./db-BJJGydgL.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-DGGmTwjJ.mjs").then((m) => m.usageCommand),
-		ai: () => import("./ai-FBHTSCLZ.mjs").then((m) => m.aiCommand),
-		open: () => import("./open-Bpz4C2Sr.mjs").then((m) => m.openCommand),
-		browse: () => import("./browse-B8-0dweq.mjs").then((m) => m.browseCommand),
-		docs: () => import("./docs-Cpky2XNP.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-Zj19RNo2.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-B9tCAbre.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-BnrNZvLc.mjs").then((m) => m.logsCommand),
-		mcp: () => import("./mcp-Cy8EwhhD.mjs").then((m) => m.mcpCommand),
-		repo: () => import("./repo-DmFs6H9m.mjs").then((m) => m.repoCommand),
-		template: () => import("./project-template-715H_lnu.mjs").then((m) => m.templateCommand)
+		login: () => import("./login-2MW9sGJO.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-2MW9sGJO.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-2MW9sGJO.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-CnU3194_.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-CnU3194_.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-CnU3194_.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-CnU3194_.mjs").then((m) => m.deleteCommand),
+		rename: () => import("./rename-BWvERJgA.mjs").then((m) => m.renameCommand),
+		dev: () => import("./dev-BvVlq9np.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-BnRQusjJ.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-BnRQusjJ.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-Dn8kH9cK.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-BnRQusjJ.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-BnRQusjJ.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-DMCj88A-.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-BM4EpLBh.mjs").then((m) => m.egressCommand),
+		secrets: () => import("./secrets-BIn2RPoe.mjs").then((m) => m.secretsCommand),
+		roles: () => import("./roles-CrYf_8wk.mjs").then((m) => m.rolesCommand),
+		members: () => import("./roles-CrYf_8wk.mjs").then((m) => m.membersCommand),
+		schedule: () => import("./schedule-DvHSSzfR.mjs").then((m) => m.scheduleCommand),
+		feedback: () => import("./feedback-C6kiYRro.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-DpCMc0uz.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-Bpz5B1N1.mjs").then((m) => m.usageCommand),
+		ai: () => import("./ai-CWPQiUft.mjs").then((m) => m.aiCommand),
+		open: () => import("./open-DcQSdfx5.mjs").then((m) => m.openCommand),
+		browse: () => import("./browse-BPLWhoFI.mjs").then((m) => m.browseCommand),
+		docs: () => import("./docs-D5gmZRJk.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-Bz39NhTN.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-BjDaghNf.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-dZMPTJLu.mjs").then((m) => m.logsCommand),
+		mcp: () => import("./mcp-DuCxfb85.mjs").then((m) => m.mcpCommand),
+		repo: () => import("./repo-C7AXDtFZ.mjs").then((m) => m.repoCommand),
+		template: () => import("./project-template-Dw11151p.mjs").then((m) => m.templateCommand),
+		audience: () => import("./audience-B68YZBGy.mjs").then((m) => m.audienceCommand)
 	}
 });
 const quiet = process.argv[2] === "mcp" && process.argv[3] === "serve" || process.argv[2] === "repo" && process.argv[3] === "credential";

package/dist/{local-BThs382Y.mjs → local-C9Bi9f3y.mjs}

@@ -1,6 +1,6 @@
-import { r as apiDataRequest } from "./api-Bl6SG8Oq.mjs";
+import { r as apiDataRequest } from "./api-DmJrIsE7.mjs";
 import { a as realtimeRouter, c as META_COLUMNS, l as blobRouter, n as WORKER_ATTEST_HEADER, o as dbRouter, s as hasPrivateNames } from "./src-8vxOBOxW.mjs";
-import { a as rewriteApiPath } from "./dev-D-vwE8G-.mjs";
+import { a as rewriteApiPath } from "./dev-BmKeIdMi.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";