@mediamonks/canopy-cli 0.7.40 → 0.7.42

package/dist/rename-BdIFrqvG.mjs

@@ -0,0 +1,81 @@
+import { c as projectUrl, l as resolveProject, o as projectDirArgs, u as rewriteCanopyJsonSlug } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CDUJq-X-.mjs";
+import { defineCommand } from "citty";
+import * as p from "@clack/prompts";
+//#region src/rename.ts
+/**
+* canopy rename <new-slug> — change a project's slug, its address on the
+* site (OpenSpec project-slug-rename). The old slug stays the project's: its
+* hostnames redirect, and everything that still names it (canopy.json
+* elsewhere, CI, MCP configs, git remotes, report keys) keeps reaching the
+* project. The canopy.json in this directory is pointed at the new slug.
+*/
+/** What changes for people outside the platform — said before anything happens. */
+function renameConsequences(from, to) {
+	return [
+		`The address becomes ${projectUrl(to)}; ${projectUrl(from)} redirects there.`,
+		`Email your project sends comes from ${to}@ instead of ${from}@.`,
+		"Visitors who signed in with the client password sign in again on the new address.",
+		"Visitors' browser storage for the project (localStorage, IndexedDB) starts empty on the new address.",
+		`Scripts, CI, MCP client configs and git remotes that say "${from}" keep working; update them when convenient.`
+	];
+}
+const renameCommand = defineCommand({
+	meta: {
+		name: "rename",
+		description: "Change a project's slug (its address)"
+	},
+	args: {
+		slug: {
+			type: "positional",
+			description: "The new slug",
+			required: true
+		},
+		...projectDirArgs,
+		yes: {
+			type: "boolean",
+			default: false,
+			description: "Skip the confirmation"
+		},
+		json: {
+			type: "boolean",
+			default: false,
+			description: "Print the result as JSON"
+		}
+	},
+	run: reportErrors("rename", async ({ args }) => {
+		const { dir, slug: from } = resolveProject(args);
+		const to = String(args.slug).trim().toLowerCase();
+		if (!args.yes) {
+			requireTty("pass --yes to rename without confirmation.");
+			p.note(renameConsequences(from, to).join("\n"), `Rename ${from} → ${to}`);
+			if (!unwrap(await p.confirm({ message: `Rename "${from}" to "${to}"?` }))) {
+				p.cancel("Aborted.");
+				return;
+			}
+		}
+		const result = await withContext(apiRequest("POST", `/projects/${from}/rename`, { slug: to }), {
+			action: `rename "${from}"`,
+			fixes: {
+				forbidden: "Only the project's owner or a Canopy admin can rename it — ask the owner.",
+				invalid_slug: "Use 2–40 lowercase letters, digits and dashes, starting with a letter — not a name Canopy reserves (www, docs, api, …).",
+				slug_taken: "Pick another slug: this one belongs to another project, now or in the past."
+			}
+		});
+		const updated = rewriteCanopyJsonSlug(dir, from, result.project.slug);
+		if (args.json) {
+			console.log(JSON.stringify({
+				...result,
+				canopy_json_updated: updated
+			}, null, 2));
+			return;
+		}
+		p.log.success(`Renamed to ${result.project.slug}: ${projectUrl(result.project.slug)}`);
+		if (updated) p.log.info("Updated canopy.json.");
+		if (result.refresh.pending) p.log.warn("The backend still reports the old slug as PROJECT_SLUG (it keeps working). Canopy retries; `canopy deploy` or Settings → Retry refreshes it now.");
+		if (result.slack === "no_config_token" || result.slack === "rejected") p.log.info("The project's Slack app keeps its old URLs, which still work. They move on its next manifest update.");
+	})
+});
+//#endregion
+export { renameCommand };

package/dist/repo-JBKJqyoS.mjs

@@ -0,0 +1,2 @@
+import { a as repoCommand } from "./repo-LSOxnmUk.mjs";
+export { repoCommand };

package/dist/{repo-4x-CJwCp.mjs → repo-LSOxnmUk.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext, n as agentHeaders } from "./api-ArfD6-t5.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, r as siteConfig } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, d as noticeRenamesOnly, f as withContext, n as agentHeaders, u as followRename } from "./api-Do9c8tZ_.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
 import { a as parseCredentialInput, i as helperCommand, o as runCredentialHelper, r as fileTokenCache, t as RepoCredentialError } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { existsSync, realpathSync } from "node:fs";
@@ -328,6 +328,8 @@ async function mintRepoToken(profile, slug) {
 		}
 	}).catch(() => null);
 	if (!res) throw new RepoCredentialError(`could not reach Canopy (${config.apiUrl}).`);
+	noticeRenamesOnly();
+	followRename(res, slug);
 	if (res.status === 201) return await res.json();
 	const body = await res.json().catch(() => ({}));
 	if (res.status === 401) throw new RepoCredentialError(`your ${profile} sign-in has expired — ${login}.`);

package/dist/{schedule-CbaDIJXr.mjs → schedule-DpMIpCGC.mjs}

@@ -1,6 +1,6 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**

package/dist/{secrets-CmY4dUHz.mjs → secrets-BVx8L0Gj.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/secrets.ts

package/dist/{site-DM2J10CB.mjs → site-0i7wAJqg.mjs}

@@ -198,6 +198,25 @@ function projectDialect(dir) {
 	if (dialect !== "sqlite" && dialect !== "postgres") throw new Error(`canopy.json "dialect" must be "sqlite" or "postgres", not ${JSON.stringify(dialect)}.`);
 	return dialect;
 }
+/**
+* Point canopy.json at a project's new slug after a rename (OpenSpec
+* project-slug-rename) — only when it still names `from`, and changing
+* nothing else in the file. True when it was rewritten.
+*/
+function rewriteCanopyJsonSlug(dir, from, to) {
+	let config;
+	try {
+		config = tryReadCanopyJson(dir);
+	} catch {
+		return false;
+	}
+	if (config?.slug !== from) return false;
+	writeFileSync(join(dir, "canopy.json"), `${JSON.stringify({
+		...config,
+		slug: to
+	}, null, 2)}\n`);
+	return true;
+}
 function readCanopyJson(dir) {
 	const config = tryReadCanopyJson(dir);
 	if (config === void 0) throw new Error(`No canopy.json in ${dir} — run from a project created by \`canopy create\`, add one ({"slug": "<slug>", "dist": "dist"}), or pass --project <slug>.`);
@@ -255,6 +274,10 @@ function setInvocationProfile(profile) {
 function setProjectDirForPin(dir) {
 	projectDirForPin = dir;
 }
+/** The project directory this invocation resolved (cwd when none was named). */
+function projectDir() {
+	return projectDirForPin ?? ".";
+}
 function projectProfileFromCwd() {
 	return tryReadCanopyJson(projectDirForPin ?? ".")?.profile;
 }
@@ -277,4 +300,4 @@ function siteHeaderLine(cliVersion) {
 	return `canopy ${cliVersion} · ${c.envOverride || !c.profileId ? c.apiUrl : `${c.profileId} (${c.projectDomain ?? new URL(c.apiUrl).hostname})`}`;
 }
 //#endregion
-export { writeConfigFile as _, projectDirArgs as a, resolveProject as c, tryResolveProject as d, clearAllProfileTokens as f, upsertProfileAuth as g, setActiveProfile as h, projectDialect as i, stagingUrl as l, readConfigFile as m, siteConfig as n, projectFlagArgs as o, listBakedProfiles as p, siteHeaderLine as r, projectUrl as s, setInvocationProfile as t, tryReadCanopyJson as u, getBakedProfile as v, isProfileId as y };
+export { setActiveProfile as _, projectDialect as a, getBakedProfile as b, projectUrl as c, stagingUrl as d, tryReadCanopyJson as f, readConfigFile as g, listBakedProfiles as h, siteHeaderLine as i, resolveProject as l, clearAllProfileTokens as m, setInvocationProfile as n, projectDirArgs as o, tryResolveProject as p, siteConfig as r, projectFlagArgs as s, projectDir as t, rewriteCanopyJsonSlug as u, upsertProfileAuth as v, isProfileId as x, writeConfigFile as y };

package/dist/{skill-AqZYYsE6.mjs → skill-D58yV6K8.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-C1xCnyOB.mjs";
-import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { t as version } from "./package-CVDpzGgA.mjs";
+import { r as reportErrors } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{staging-ypR79MlD.mjs → staging-ynPlMiHW.mjs}

@@ -1,6 +1,6 @@
-import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { c as projectUrl, d as stagingUrl, l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/{token-CDrHQ5Xb.mjs → token-CxiPrKn_.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { a as apiRequest } from "./api-ArfD6-t5.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { l as resolveProject, o as projectDirArgs, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest } from "./api-Do9c8tZ_.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/{ui-CaHgvvkJ.mjs → ui-CDUJq-X-.mjs}

@@ -1,4 +1,4 @@
-import { t as ApiError } from "./api-ArfD6-t5.mjs";
+import { t as ApiError } from "./api-Do9c8tZ_.mjs";
 import { spawn } from "node:child_process";
 import { cancel, isCancel } from "@clack/prompts";
 //#region src/ui.ts

package/dist/{upgrade-DSjmifH_.mjs → upgrade-Dll5rhOQ.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { r as reportErrors } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-AqZYYsE6.mjs");
+		const { skillInstalled } = await import("./skill-D58yV6K8.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/dist/{usage-CP8rBVZi.mjs → usage-BtPsb7Iu.mjs}

@@ -1,6 +1,6 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
-import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
+import { r as reportErrors } from "./ui-CDUJq-X-.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**
@@ -60,6 +60,13 @@ function renderUsage(slug, usage) {
 	const deploys = usage.deploys.count;
 	const live = usage.deploys.latestVersion != null ? ` · v${usage.deploys.latestVersion} live` : "";
 	lines.push(`  ${pad("deploys")}${deploys}${live}`);
+	const fixed = usage.fixedIp;
+	if (fixed && (fixed.mode !== "off" || fixed.bytesToday > 0)) {
+		lines.push("");
+		lines.push("Fixed outbound addresses");
+		const gb = (n) => `${Number((n / 1e9).toFixed(n < 1e8 ? 3 : 2))} GB`;
+		lines.push(`  ${pad("today")}${gb(fixed.bytesToday)} of ${gb(fixed.dailyQuotaBytes)}`);
+	}
 	return lines.join("\n");
 }
 const usageCommand = defineCommand({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.40",
+  "version": "0.7.42",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-dJ88L73Y.mjs

@@ -1,2 +0,0 @@
-import { n as devCommand } from "./dev-03LA_Etx.mjs";
-export { devCommand };

package/dist/egress-CzxRD6Tp.mjs

@@ -1,188 +0,0 @@
-import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
-import { defineCommand } from "citty";
-import * as p from "@clack/prompts";
-//#region src/egress.ts
-/**
-* canopy egress — manage the project's outbound-host policy: the allowlist
-* (docs/16-egress-allowlist.md) and the egress mode (docs/25-egress-modes.md).
-* In allowlist mode, worker fetches to hosts outside the list are denied
-* (`egress_denied`) on targets that enforce egress control; open mode allows
-* any public hostname behind a built-in blocklist and an outbound rate limit.
-* Policy lives on the platform, not in canopy.json, so a repo file can never
-* widen egress silently on deploy.
-*/
-function printList({ mode, hosts, denied, enforced }, slug) {
-	if (mode === "open") console.log(`${slug} is in OPEN egress mode — the worker may fetch any public host (the allowlist below is kept but not enforced; \`canopy egress mode allowlist\` restores it).`);
-	if (hosts.length === 0) console.log(`No extra egress hosts for ${slug} — the worker can reach platform hosts only.`);
-	else for (const host of hosts) console.log(host);
-	if (denied.length > 0) {
-		console.log(`\nRecently blocked (allow with \`canopy egress allow <host>\`):`);
-		for (const d of denied) {
-			const why = d.reason === "rate_limited" ? "rate limited" : "blocked";
-			console.log(`  ${d.host}  ×${d.count}  ${why}, last ${formatDateTime(d.last_seen)}`);
-		}
-	}
-	if (!enforced) console.error("(note: this site's target does not enforce egress yet — the policy is recorded for when it does)");
-}
-const listCommand = defineCommand({
-	meta: {
-		name: "list",
-		description: "List the project's allowed outbound hosts"
-	},
-	args: { ...projectDirArgs },
-	run: reportErrors("egress list", async ({ args }) => {
-		const { slug } = resolveProject(args);
-		printList(await apiRequest("GET", `/projects/${slug}/egress`), slug);
-	})
-});
-const allowCommand = defineCommand({
-	meta: {
-		name: "allow",
-		description: "Allow the worker to fetch a host (e.g. api.example.com or *.googleapis.com)"
-	},
-	args: {
-		host: {
-			type: "positional",
-			description: "Hostname to allow",
-			required: true
-		},
-		...projectDirArgs
-	},
-	run: reportErrors("egress allow", async ({ args }) => {
-		const { slug } = resolveProject(args);
-		const current = await apiRequest("GET", `/projects/${slug}/egress`);
-		const updated = await apiRequest("PUT", `/projects/${slug}/egress`, { hosts: [...current.hosts, args.host] });
-		console.log(`Allowed ${args.host} for ${slug} — running workers pick it up now.\n`);
-		printList(updated, slug);
-	})
-});
-const removeCommand = defineCommand({
-	meta: {
-		name: "remove",
-		description: "Remove a host from the allowlist"
-	},
-	args: {
-		host: {
-			type: "positional",
-			description: "Hostname to remove",
-			required: true
-		},
-		...projectDirArgs
-	},
-	run: reportErrors("egress remove", async ({ args }) => {
-		const { slug } = resolveProject(args);
-		const current = await apiRequest("GET", `/projects/${slug}/egress`);
-		const wanted = args.host.trim().toLowerCase();
-		if (!current.hosts.includes(wanted)) {
-			console.error(`${wanted} is not on the allowlist for ${slug} (see \`canopy egress list\`).`);
-			process.exit(1);
-		}
-		const updated = await apiRequest("PUT", `/projects/${slug}/egress`, { hosts: current.hosts.filter((h) => h !== wanted) });
-		console.log(`Removed ${wanted} from ${slug} — running workers stop reaching it now.\n`);
-		printList(updated, slug);
-	})
-});
-/** The plain-language risk summary shown before open mode is enabled (docs/25 §2). */
-function openModeRiskSummary(slug, clientAccess) {
-	const lines = [
-		`Open egress mode lets ${slug}'s worker contact ANY public host:`,
-		"",
-		"  - If the URLs it fetches come from user input, users control where it connects.",
-		"  - Abusive outbound traffic can get the project rate-limited or paused.",
-		"  - A built-in blocklist (private IPs, localhost, cloud metadata) and an",
-		"    outbound rate limit still apply, and every visited host is logged",
-		"    (`canopy egress log`)."
-	];
-	if (clientAccess) lines.push("", "  ! This project has client access enabled — untrusted visitors can drive", "    what the worker fetches.");
-	lines.push("", "It's the right choice for apps that fetch arbitrary user-provided URLs", "(link collectors, feed readers, scrapers). Everything else is better served", "by the allowlist.");
-	return lines.join("\n");
-}
-const egressCommand = defineCommand({
-	meta: {
-		name: "egress",
-		description: "Manage which outbound hosts the project's worker may fetch"
-	},
-	subCommands: {
-		list: listCommand,
-		allow: allowCommand,
-		remove: removeCommand,
-		mode: defineCommand({
-			meta: {
-				name: "mode",
-				description: "Show or switch the egress mode (allowlist | open)"
-			},
-			args: {
-				mode: {
-					type: "positional",
-					description: "allowlist | open (omit to show)",
-					required: false
-				},
-				"accept-risk": {
-					type: "boolean",
-					description: "Acknowledge the open-mode risk summary without an interactive prompt"
-				},
-				...projectDirArgs
-			},
-			run: reportErrors("egress mode", async ({ args }) => {
-				const { slug } = resolveProject(args);
-				const current = await apiRequest("GET", `/projects/${slug}/egress`);
-				const wanted = args.mode?.trim().toLowerCase();
-				if (!wanted) {
-					console.log(current.mode);
-					return;
-				}
-				if (wanted !== "allowlist" && wanted !== "open") {
-					console.error(`unknown mode "${wanted}" — expected allowlist or open.`);
-					process.exit(1);
-				}
-				if (wanted === current.mode) {
-					console.log(`${slug} is already in ${wanted} mode.`);
-					return;
-				}
-				if (wanted === "open") {
-					const access = await apiRequest("GET", `/projects/${slug}/client-password`).catch(() => ({ enabled: false }));
-					console.log(openModeRiskSummary(slug, access.enabled));
-					console.log("");
-					if (!args["accept-risk"]) {
-						requireTty("pass --accept-risk to enable open mode without confirmation.");
-						if (unwrap(await p.text({ message: `Type the project slug ("${slug}") to enable open mode.` })).trim() !== slug) {
-							p.cancel("Aborted — egress mode unchanged.");
-							return;
-						}
-					}
-				}
-				const updated = await withContext(apiRequest("PUT", `/projects/${slug}/egress`, { mode: wanted }), {
-					action: `switch ${slug} to ${wanted} egress mode`,
-					fixes: { owner_only: "Only the project owner can switch egress to open mode — ask them to run this command or flip it in the dashboard." }
-				});
-				if (wanted === "open") {
-					console.log(`Open egress mode is ON for ${slug} — running workers pick it up now.`);
-					console.log(`Switch back anytime with \`canopy egress mode allowlist\`.`);
-				} else {
-					console.log(`Allowlist mode restored for ${slug} — only listed hosts are reachable.\n`);
-					printList(updated, slug);
-				}
-			})
-		}),
-		log: defineCommand({
-			meta: {
-				name: "log",
-				description: "Show the outbound traffic log — hosts the worker actually fetched"
-			},
-			args: { ...projectDirArgs },
-			run: reportErrors("egress log", async ({ args }) => {
-				const { slug } = resolveProject(args);
-				const { visits } = await apiRequest("GET", `/projects/${slug}/egress/log`);
-				if (visits.length === 0) {
-					console.log(`No outbound traffic recorded for ${slug} yet.`);
-					return;
-				}
-				for (const v of visits) console.log(`${v.host}  ×${v.count}  last ${formatDateTime(v.last_seen)}`);
-			})
-		})
-	}
-});
-//#endregion
-export { egressCommand };

package/dist/project-template-DlzMx8Oj.mjs

@@ -1,2 +0,0 @@
-import { a as templateCommand } from "./project-template-DtTfXyLI.mjs";
-export { templateCommand };

package/dist/repo-CmbakFVi.mjs

@@ -1,2 +0,0 @@
-import { a as repoCommand } from "./repo-4x-CJwCp.mjs";
-export { repoCommand };