@mediamonks/canopy-cli 0.7.40 → 0.7.42

package/dist/{ai-EyrXJC5z.mjs → ai-DpQ1nLka.mjs}

@@ -1,5 +1,5 @@
-import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
-import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
+import { r as reportErrors } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 //#region src/ai.ts
 /**

package/dist/{api-ArfD6-t5.mjs → api-Do9c8tZ_.mjs}

@@ -1,4 +1,4 @@
-import { n as siteConfig } from "./site-DM2J10CB.mjs";
+import { r as siteConfig, t as projectDir, u as rewriteCanopyJsonSlug } from "./site-0i7wAJqg.mjs";
 //#region src/api.ts
 /**
 * Authenticated requests to the Canopy control plane. Credentials, in order:
@@ -29,7 +29,7 @@ const ERROR_COPY = {
 		fix: "Choose a different slug."
 	},
 	invalid_slug: {
-		why: "the slug is not a valid format",
+		why: "the slug breaks one of the naming rules",
 		fix: "Use lowercase letters, digits and hyphens only (e.g. my-project)."
 	},
 	project_paused: {
@@ -156,6 +156,18 @@ const ERROR_COPY = {
 		why: "the schedule was saved but syncing it to the platform scheduler failed",
 		fix: "Retry the same command — it re-syncs the saved schedule."
 	},
+	fixed_ip_hosts_required: {
+		why: "routing listed hosts through the fixed addresses needs at least one host",
+		fix: "Add a host with `canopy egress fixed-ip add <host>`, or turn it off with `canopy egress fixed-ip off`."
+	},
+	fixed_ip_not_optional: {
+		why: "every request on this site already leaves from the fixed addresses",
+		fix: "There is nothing to set here — `canopy egress fixed-ip` shows the addresses to register."
+	},
+	invalid_fixed_ip_mode: {
+		why: "the fixed outbound address mode must be off, hosts or all",
+		fix: "Use `canopy egress fixed-ip add <host>`, `canopy egress fixed-ip all` or `canopy egress fixed-ip off`."
+	},
 	worker_egress_sync_failed: {
 		why: "the list was saved but redeploying the running worker with it failed",
 		fix: "Retry, or redeploy the project (`canopy deploy`) to apply the new allowlist."
@@ -179,6 +191,26 @@ const ERROR_COPY = {
 	worker_secret_sync_failed: {
 		why: "the secret was saved but redeploying the running worker with it failed",
 		fix: "Retry, or redeploy the project (`canopy deploy`) to apply it."
+	},
+	slug_unchanged: {
+		why: "the project already has that slug",
+		fix: "Pass the new slug you want, e.g. `canopy rename my-new-name`."
+	},
+	rename_not_allowed: {
+		why: "Canopy's own projects (dashboard, www, docs) keep their names",
+		fix: "Nothing to do — those addresses are fixed."
+	},
+	rename_too_soon: {
+		why: "a project can be renamed once a day",
+		fix: "Try again after the time shown, or ask a Canopy admin if it can't wait."
+	},
+	too_many_old_slugs: {
+		why: "a project keeps at most 5 old slugs, and each one stays reserved for it",
+		fix: "Rename back to one of its old slugs instead (`canopy projects` shows them in the dashboard's Settings), or ask a Canopy admin."
+	},
+	rename_conflict: {
+		why: "the project changed while the rename ran",
+		fix: "Run the command again."
 	}
 };
 /** Generic explanation for a status code when we have no per-code copy. */
@@ -248,6 +280,40 @@ function commonHeaders() {
 		...agentHeaders()
 	};
 }
+/**
+* Renamed projects (OpenSpec project-slug-rename). A request that names an
+* old slug still reaches the project, and the answer carries its current
+* slug in `Canopy-Project-Slug`. By default the CLI then points canopy.json
+* at it (when that file named the old slug) and says so once; `canopy mcp
+* serve` and the git credential helper only say so, because what names the
+* slug there is the user's own configuration, not ours to edit.
+*/
+const RENAMED_HEADER = "canopy-project-slug";
+const renames = /* @__PURE__ */ new Map();
+let renameHandling = "rewrite";
+/** Report renames without editing files (mcp serve, the git credential helper). */
+function noticeRenamesOnly() {
+	renameHandling = "notice";
+}
+/** The current slug of a project this process saw renamed; `slug` when it saw none. */
+function currentSlug(slug) {
+	return renames.get(slug) ?? slug;
+}
+/** Act on a response that says `named` is an old slug. Exported for the credential helper. */
+function followRename(response, named) {
+	const current = response.headers.get(RENAMED_HEADER);
+	if (!named || !current || current === named || renames.has(named)) return;
+	renames.set(named, current);
+	if (renameHandling === "rewrite" && rewriteCanopyJsonSlug(projectDir(), named, current)) {
+		console.error(`canopy: project "${named}" is now "${current}" — updated canopy.json.`);
+		return;
+	}
+	console.error(`canopy: project "${named}" is now "${current}" — use "${current}" where you name it (MCP client config, scripts); the old name keeps working for now.`);
+}
+/** The slug a control-plane path names (`/projects/<slug>/…`), if any. */
+function slugInPath(path) {
+	return /^\/projects\/([^/?#]+)/.exec(path)?.[1];
+}
 var ApiError = class extends Error {
 	status;
 	code;
@@ -339,6 +405,7 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 		},
 		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
 	});
+	followRename(response, slugInPath(path));
 	if (!response.ok) return fail(response, isDeployToken, method, path);
 	if (response.status === 204) return void 0;
 	return await response.json();
@@ -358,6 +425,7 @@ async function apiUpload(path, bytes, contentType) {
 		},
 		body: bytes
 	});
+	followRename(response, slugInPath(path));
 	if (!response.ok) return fail(response, isDeployToken, "POST", path);
 	return await response.json();
 }
@@ -368,6 +436,7 @@ async function apiDownload(path) {
 		...commonHeaders(),
 		authorization: `Bearer ${token}`
 	} });
+	followRename(response, slugInPath(path));
 	if (!response.ok) return fail(response, isDeployToken, "GET", path);
 	return Buffer.from(await response.arrayBuffer());
 }
@@ -389,9 +458,10 @@ async function apiDataRequest(method, path, projectSlug, body, rawContentType, c
 		},
 		body: body === void 0 ? void 0 : rawContentType !== void 0 ? body : JSON.stringify(body)
 	});
+	followRename(response, projectSlug);
 	if (!response.ok) return fail(response, isDeployToken, method, path);
 	if (response.status === 204) return void 0;
 	return await response.json();
 }
 //#endregion
-export { apiRequest as a, credentials as c, apiDownload as i, withContext as l, agentHeaders as n, apiUpload as o, apiDataRequest as r, commonHeaders as s, ApiError as t };
+export { apiRequest as a, credentials as c, noticeRenamesOnly as d, withContext as f, apiDownload as i, currentSlug as l, agentHeaders as n, apiUpload as o, apiDataRequest as r, commonHeaders as s, ApiError as t, followRename as u };

package/dist/{browse-DEhnJAPT.mjs → browse-Dp5HytqK.mjs}

@@ -1,5 +1,5 @@
-import { d as tryResolveProject, n as siteConfig } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, t as ApiError } from "./api-ArfD6-t5.mjs";
+import { p as tryResolveProject, r as siteConfig } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, t as ApiError } from "./api-Do9c8tZ_.mjs";
 import { defineCommand } from "citty";
 //#region src/browse.ts
 /**

package/dist/{db-DGrCgj-R.mjs → db-BNsX7sXo.mjs}

@@ -1,7 +1,7 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext, r as apiDataRequest } from "./api-ArfD6-t5.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CaHgvvkJ.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CG_O5Ghw.mjs";
+import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext, r as apiDataRequest } from "./api-Do9c8tZ_.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CDUJq-X-.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Bsu4quya.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-B7KItUnh.mjs → deploy-CXMLABvH.mjs}

@@ -1,7 +1,7 @@
-import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, i as apiDownload, l as withContext, r as apiDataRequest } from "./api-ArfD6-t5.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CG_O5Ghw.mjs";
+import { c as projectUrl, d as stagingUrl, f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, r as siteConfig, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext, i as apiDownload, l as currentSlug, r as apiDataRequest } from "./api-Do9c8tZ_.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-Bsu4quya.mjs";
 import { builtinModules } from "node:module";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -314,10 +314,10 @@ const deployCommand = defineCommand({
 		}
 		const backend = result.worker?.serviceUrl ? ` · backend ${result.worker.serviceUrl}` : "";
 		if (channel === "staging") {
-			spin.stop(`Staging: ${stagingUrl(slug)} (v${result.version})${backend}`);
+			spin.stop(`Staging: ${stagingUrl(currentSlug(slug))} (v${result.version})${backend}`);
 			if (stagingCreated) console.log("  staging channel created — database cloned from live");
 			console.log(`  happy with it? \`canopy promote\` makes v${result.version} live`);
-		} else spin.stop(`Live: ${projectUrl(slug)} (v${result.version})${backend}`);
+		} else spin.stop(`Live: ${projectUrl(currentSlug(slug))} (v${result.version})${backend}`);
 		if (migrateResult !== void 0) for (const line of describeMigrateResult(migrateResult)) console.log(`  ${line}`);
 	})
 });
@@ -371,7 +371,7 @@ const promoteCommand = defineCommand({
 		}
 		const backend = result.worker?.serviceUrl ? ` · backend ${result.worker.serviceUrl}` : "";
 		const was = result.previous === null ? "" : `, was v${result.previous}`;
-		spin.stop(`Live: ${projectUrl(slug)} (v${result.version}${was})${backend}`);
+		spin.stop(`Live: ${projectUrl(currentSlug(slug))} (v${result.version}${was})${backend}`);
 		for (const name of result.migrationsApplied) console.log(`  applied ${name}`);
 		if (result.snapshot !== void 0) console.log(`  pre-promote snapshot: ${result.snapshot} (canopy db restore --snapshot …)`);
 	})
@@ -445,7 +445,7 @@ const rollbackCommand = defineCommand({
 		console.log(`Rolling back ${slug} to v${target}`);
 		const { live: result } = await apiRequest("POST", `/projects/${slug}/deploys/${target}/rollback`);
 		const worker = result.worker ? ` · worker v${result.worker.version}` : "";
-		console.log(`Live: ${projectUrl(slug)} (v${result.version}, was v${result.previous ?? "?"})${worker}`);
+		console.log(`Live: ${projectUrl(currentSlug(slug))} (v${result.version}, was v${result.previous ?? "?"})${worker}`);
 	})
 });
 const downloadCommand = defineCommand({

package/dist/{dev-03LA_Etx.mjs → dev-CPR-9slK.mjs}

@@ -1,7 +1,7 @@
-import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext, t as ApiError } from "./api-ArfD6-t5.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
-import { r as readMigrationFiles } from "./migrations-CG_O5Ghw.mjs";
+import { a as projectDialect, f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, r as siteConfig } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext, t as ApiError } from "./api-Do9c8tZ_.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
+import { r as readMigrationFiles } from "./migrations-Bsu4quya.mjs";
 import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-RUf3Gfuh.mjs";
 import { n as writeDevServerRecord } from "./dev-server-file-Dk9pk4AR.mjs";
 import { createRequire } from "node:module";
@@ -251,7 +251,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-CkS1XhRu.mjs");
+		const { fetchProjectDump } = await import("./local-w2wXfE1d.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -267,7 +267,7 @@ async function devLocal(flags, slug) {
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
 	const workerAttest = randomBytes(24).toString("base64url");
-	const { createSandbox } = await import("./local-CkS1XhRu.mjs");
+	const { createSandbox } = await import("./local-w2wXfE1d.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-Dj3wFKHe.mjs

@@ -0,0 +1,2 @@
+import { n as devCommand } from "./dev-CPR-9slK.mjs";
+export { devCommand };

package/dist/docs/ci.md

@@ -1,8 +1,26 @@
 ---
 title: CI and deploy tokens
-description: Push-to-main deploys using a project-scoped deploy token.
+description: Push-to-main deploys using a project-scoped deploy token, and why we recommend deploying from your own machine instead.
 ---
 
+## Our recommendation: deploy manually
+
+Most Canopy users don't have a GitHub Enterprise seat, so they can't see or
+interact with GitHub Actions. That is why Canopy repositories are created with
+Actions turned **off**: pushing a workflow file works, but nothing runs, and
+there is no Actions tab for you to look at. Turning Actions on for a repository
+is something only a GitHub administrator can do, and you would still not see
+the runs.
+
+Deploy from your machine (or let your coding agent do it): run
+`canopy deploy --staging`, check the result, then `canopy promote`. It is
+usually quicker than waiting for a pipeline, and your agent can verify the
+deploy right afterwards. Run your typecheck, lint and tests locally before you
+deploy.
+
+The rest of this page is for teams that run their own CI somewhere they can
+see it.
+
 Interactive `canopy login` is for humans at a terminal. For automated deploys
 (GitHub Actions, etc.) use a **deploy token**: a project-scoped credential that
 can deploy that one project and nothing else.

package/dist/docs/cli-rename.md

@@ -0,0 +1,51 @@
+---
+title: canopy rename
+description: Change a project's slug — its address — and update canopy.json.
+---
+
+`canopy rename` gives a project a new slug, and with it a new address. The old
+slug stays with the project: old links redirect, and everything that still
+names it keeps working. See [Rename a project](https://docs.canopy.website/guides/rename) for what changes
+and what doesn't.
+
+## Usage
+
+```bash
+canopy rename my-new-name                      # in the project's folder
+canopy rename my-new-name --project old-name   # name the project yourself
+canopy rename my-new-name --yes                # skip the confirmation
+```
+
+## Arguments & flags
+
+- `<slug>` — the new slug. Same rules as `canopy create`: 2–40 lowercase letters,
+  digits and dashes, starting with a letter.
+- `--project <slug>` — the project to rename. Defaults to the `slug` in
+  `canopy.json`.
+- `[dir]` — the project folder (defaults to the current directory). Its
+  `canopy.json` is updated after the rename.
+- `--yes` — rename without asking. Required on non-interactive runs.
+- `--json` — print the result as JSON: the project, its old slugs, and whether
+  the backend refresh and Slack app update are still to come.
+
+## Details
+
+Before renaming, the CLI lists what changes for people: the address, the email
+sender, client-password visitors signing in again, and visitors' browser storage
+starting empty. Only the owner or a Canopy admin can rename. A project can be
+renamed once a day and keeps at most 5 old slugs; renaming back to one of them
+is always allowed.
+
+Other commands notice a rename too. When `canopy.json` still names the old
+slug, the next command that talks to the project updates it and says so in one
+line. `canopy mcp serve` and the git credential helper only print a notice,
+since they're started from your own configuration.
+
+## Examples
+
+```bash
+canopy rename q4-dashboard
+```
+
+Shows what changes, asks to confirm, renames, and points `canopy.json` at
+`q4-dashboard`.

package/dist/docs/git.md

@@ -79,6 +79,11 @@ sign in to a Canopy repository; use the terminal for those.
 - **Deleting is for good.** `canopy repo delete` (owner only) removes the
   repository and all its history. Deleting the project deletes its repository
   too.
+- **No CI on the repository.** GitHub Actions are turned off on Canopy
+  repositories, so workflow files you push don't run, and you can't see
+  Actions runs without a GitHub seat. Run your checks locally and deploy with
+  `canopy deploy --staging` then `canopy promote` (see
+  [CI and deploy tokens](https://docs.canopy.website/guides/ci)).
 - **Moving to your own GitHub later** is ordinary git: create an empty
   repository there, then `git remote add github <its url>` and
   `git push github --all`.

package/dist/docs/index.json

@@ -65,7 +65,7 @@
         {
           "slug": "ci",
           "title": "CI and deploy tokens",
-          "summary": "Push-to-main deploys using a project-scoped deploy token."
+          "summary": "Push-to-main deploys using a project-scoped deploy token, and why we recommend deploying from your own machine instead."
         },
         {
           "slug": "git",
@@ -77,6 +77,11 @@
           "title": "Start from a template",
           "summary": "Begin a project from someone else's working one — a copy of their code and setup, never their data."
         },
+        {
+          "slug": "rename",
+          "title": "Rename a project",
+          "summary": "Change a project's slug — its address — without breaking links, checkouts or integrations."
+        },
         {
           "slug": "agent-tools",
           "title": "Agent tools (MCP)",
@@ -231,6 +236,11 @@
           "title": "canopy delete",
           "summary": "Permanently delete a Canopy project — its deploys, database, and files."
         },
+        {
+          "slug": "cli-rename",
+          "title": "canopy rename",
+          "summary": "Change a project's slug — its address — and update canopy.json."
+        },
         {
           "slug": "cli-dev",
           "title": "canopy dev",

package/dist/docs/platform-egress.md

@@ -112,12 +112,11 @@ Switching back is one command (`canopy egress mode allowlist`), and the
 dashboard offers to **seed the allowlist from the observed hosts** so
 tightening up later doesn't break the app.
 
-## Allowlisting Canopy on the other side
+## Fixed outbound addresses
 
 Some external services only accept calls from IP addresses you register with
-them first — a partner API, a corporate database, a payment provider's
-allowlist. Projects hosted on **Google Cloud** (the `gcp-pilot` site,
-`canopy.monks.zone`) make every outbound request from a fixed pair of
+them first: a partner API, a corporate database, a payment provider's
+allowlist. Canopy can send your backend's requests from a fixed pair of
 addresses, so you can hand them over:
 
 | Address          |
@@ -126,16 +125,74 @@ addresses, so you can hand them over:
 | `34.158.168.43`  |
 
 Register **both**. Traffic may leave from either one, and the second gives the
-platform room to grow without asking you to update your allowlist. These
-addresses are shared by every project on that site, so registering them lets
-any Canopy project on Google Cloud reach the service — the other service's own
-authentication (API keys, tokens) still decides who gets in.
+platform room to grow without asking you to update the other side. These
+addresses are shared by every project that uses them, so registering them lets
+any Canopy project reach the service. The other service's own authentication
+(API keys, tokens) still decides who gets in.
 
 The addresses are a platform commitment: they will not change without notice
-and a migration period. Projects hosted on Cloudflare have **no** fixed
-outbound address (requests leave from Cloudflare's shared edge), so if a
-service you depend on insists on IP allowlisting, run that project on the
-Google Cloud site.
+and a migration period.
+
+### Route a partner's host
+
+By default requests leave normally, not from these addresses. Route the hosts
+that need them:
+
+```bash
+canopy egress fixed-ip add api.partner.com
+canopy egress fixed-ip              # show the setting and the addresses
+canopy egress fixed-ip remove api.partner.com
+canopy egress fixed-ip off
+```
+
+or in the dashboard: **Backend → Outbound hosts → Fixed outbound addresses**.
+Entries follow the same rules as the allowlist (a bare host or a `*.`
+subdomain wildcard, up to 32). Each request is routed by its own host, so if
+the partner redirects you to a CDN that isn't listed, that second request
+leaves normally. The setting applies to the running worker right away, to
+both channels, and to scheduled runs as well as HTTP requests.
+
+Only the **project owner** can turn the setting on or route all traffic. Any
+member can change the listed hosts or turn it off.
+
+**Routing a host doesn't allow it.** In allowlist mode the host still has to be
+on the allowlist, or requests to it are denied as usual. The dashboard and
+`canopy egress fixed-ip` flag routed hosts that aren't allowed and offer to
+allow them. The setting works in open mode too.
+
+### All traffic
+
+`canopy egress fixed-ip all` sends **every** outbound request from the fixed
+addresses. It's there for apps that can't list their partners up front, but
+it's rarely the better choice: every request takes the slower route, counts
+toward the daily quota, and leaves from addresses shared with other projects.
+List the hosts that need it instead when you can.
+
+### What to expect
+
+- **A little latency.** A routed request makes an extra hop, usually tens of
+  milliseconds. The first routed request after a quiet spell (about 15
+  minutes) can take a second or two longer while the route wakes up. Give
+  tight partner timeouts some slack.
+- **A daily transfer quota.** What a project sends and receives through the
+  fixed addresses counts toward 1 GB a day, shown on the **Usage** tab. Once
+  it's used up, routed requests are refused until 00:00 UTC; everything else
+  keeps working. Ask the platform team if you need more.
+- **`fetch` only.** Raw socket connections (`connect()`) and outbound
+  WebSockets don't leave from the fixed addresses.
+- **Uploads up to 32 MB.** A larger request body to a routed host is refused.
+
+On some sites every request of every project already leaves from these
+addresses. There the setting shows as always on and there is nothing to set.
+
+### Errors from routed requests
+
+| Status | `error`                          | What it means                                                                                    |
+| ------ | -------------------------------- | ------------------------------------------------------------------------------------------------ |
+| 429    | `egress_fixed_ip_quota_exceeded` | Today's fixed-address quota is used up. Routed requests work again at 00:00 UTC.                 |
+| 502    | `egress_fixed_ip_unavailable`    | The fixed-address route couldn't send the request. Nothing went out from another address; retry. |
+| 413    | `egress_fixed_ip_body_too_large` | The request body is over 32 MB.                                                                  |
+| 403    | `egress_denied`                  | As always: the host isn't allowed, or it resolves to a private address.                          |
 
 ## The outbound traffic log
 

package/dist/docs/rename.md

@@ -0,0 +1,65 @@
+---
+title: Rename a project
+description: Change a project's slug — its address — without breaking links, checkouts or integrations.
+---
+
+A project's **slug** is its address: `<slug>.canopy.website`. You can change it
+from the dashboard or the CLI. Nothing needs to be redeployed, and everything
+that still uses the old slug keeps reaching the project.
+
+## How to rename
+
+In the dashboard, open the project's **Settings** and use **Rename address**
+on the _Project address_ card. Type the new slug, read what changes, and type
+it again to confirm.
+
+From the CLI, run it inside the project's folder:
+
+```bash
+canopy rename my-new-name
+```
+
+The CLI shows what changes and asks before it renames. It also updates
+`canopy.json` in that folder. See [`canopy rename`](https://docs.canopy.website/cli/rename) for the flags.
+
+Only the project's **owner** (or a Canopy admin) can rename it.
+
+## What changes
+
+- **The address.** The project is now at `my-new-name.canopy.website`. The old
+  address sends visitors there, keeping the rest of the link
+  (`old-name.canopy.website/reports/42` opens `my-new-name.canopy.website/reports/42`).
+  The same goes for `staging-dot-` and pinned `v12-dot-` addresses.
+- **The email sender.** Mail your project sends comes from `my-new-name@` instead
+  of `old-name@`.
+- **Client-password visitors sign in again** on the new address. Their sign-in
+  belonged to the old one.
+- **Browser storage starts empty** on the new address. Anything your app keeps
+  in the visitor's browser (localStorage, IndexedDB) stays with the old one.
+- **New report keys** use the new slug: `my-new-name-18`.
+
+## What keeps working
+
+The old slug stays with your project. Nobody else can create a project with it.
+
+- Old links and bookmarks redirect, as above. Pages that were already open keep
+  working until they're reloaded.
+- `canopy.json` files, CI deploy tokens, scripts and MCP client configs that
+  still say the old slug keep working. The CLI updates a `canopy.json` it finds
+  with the old slug, and tells you when anything else should be updated.
+- Your backend keeps running, and the rename updates the `PROJECT_SLUG` it
+  sees. If that update fails, Settings says so and has a retry button; Canopy
+  also retries on its own, and the next deploy updates it too.
+- Report keys with the old slug (`old-name-17`) still open the report.
+- Your Slack app keeps receiving events and slash commands.
+- `git push` and `git pull` keep working. The repository itself keeps its name.
+- Database, files, deploys, schedules, secrets and members don't change.
+
+## Limits
+
+- A project can be renamed **once a day**.
+- A project keeps at most **5 old slugs**. Renaming back to one of them is always
+  allowed, and doesn't count as a new one.
+- The new slug follows the same rules as a new project: 2–40 lowercase letters,
+  digits and dashes, starting with a letter.
+- Canopy's own projects (`dashboard`, `www`, `docs`) can't be renamed.

package/dist/docs/troubleshooting.md

@@ -75,6 +75,22 @@ or use dashboard Settings → Outbound hosts. Details and entry rules:
 [Outbound requests](https://docs.canopy.website/platform/egress). Calls made through the SDK /
 `env.CANOPY.fetch` don't count as egress and are unaffected.
 
+## `egress_fixed_ip_quota_exceeded` (429)
+
+The project used up today's transfer through the
+[fixed outbound addresses](https://docs.canopy.website/platform/egress#fixed-outbound-addresses). Routed
+requests are refused until 00:00 UTC; requests to other hosts keep working.
+`canopy usage` and the dashboard's Usage tab show how much was sent. If routing
+all traffic used it up, list only the hosts that need a fixed address
+(`canopy egress fixed-ip add <host>`).
+
+## `egress_fixed_ip_unavailable` (502)
+
+A request to a host routed through the fixed outbound addresses couldn't be
+sent that way. It never went out from another address, so the partner didn't
+see it. Retry; if it keeps happening, the detail says why (and the platform
+team hears about it).
+
 ## The worker returns errors and you can't see why
 
 Read its console output instead of adding diagnostic endpoints:

package/dist/{docs-B0-IEPjd.mjs → docs-CkJGcCpR.mjs}

@@ -1,8 +1,8 @@
-import { t as version } from "./package-C1xCnyOB.mjs";
-import { n as siteConfig } from "./site-DM2J10CB.mjs";
+import { t as version } from "./package-CVDpzGgA.mjs";
+import { r as siteConfig } from "./site-0i7wAJqg.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { n as agentHeaders } from "./api-ArfD6-t5.mjs";
-import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { n as agentHeaders } from "./api-Do9c8tZ_.mjs";
+import { r as reportErrors } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";