@mediamonks/canopy-cli 0.7.41 → 0.7.43

package/dist/{ai-PXXMv7kO.mjs → ai-FBHTSCLZ.mjs}

@@ -1,5 +1,5 @@
-import { a as apiRequest, l as withContext } from "./api-BHzCvDcY.mjs";
-import { r as reportErrors } from "./ui-SBUdC9rX.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { r as reportErrors } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 //#region src/ai.ts
 /**

package/dist/{api-BHzCvDcY.mjs → api-Bl6SG8Oq.mjs}

@@ -1,4 +1,4 @@
-import { n as siteConfig } from "./site-DM2J10CB.mjs";
+import { r as siteConfig, t as projectDir, u as rewriteCanopyJsonSlug } from "./site-0i7wAJqg.mjs";
 //#region src/api.ts
 /**
 * Authenticated requests to the Canopy control plane. Credentials, in order:
@@ -29,7 +29,7 @@ const ERROR_COPY = {
 		fix: "Choose a different slug."
 	},
 	invalid_slug: {
-		why: "the slug is not a valid format",
+		why: "the slug breaks one of the naming rules",
 		fix: "Use lowercase letters, digits and hyphens only (e.g. my-project)."
 	},
 	project_paused: {
@@ -57,11 +57,11 @@ const ERROR_COPY = {
 		fix: "Per-project workers, schedules and secrets are capability-gated per target — remove the unsupported part (e.g. the worker bundle) or run against a target that supports it."
 	},
 	deploy_too_large: {
-		why: "the deploy bundle exceeds the 25 MB limit",
+		why: "the deploy bundle exceeds the 50 MB limit",
 		fix: "Trim large assets from the build output (or move them to blob storage), then redeploy."
 	},
 	too_many_files: {
-		why: "the deploy has more than 500 files",
+		why: "the deploy has more than 1000 files",
 		fix: "Reduce the file count — bundle/minify assets or drop what isn't served — then redeploy."
 	},
 	empty_deploy: {
@@ -191,6 +191,26 @@ const ERROR_COPY = {
 	worker_secret_sync_failed: {
 		why: "the secret was saved but redeploying the running worker with it failed",
 		fix: "Retry, or redeploy the project (`canopy deploy`) to apply it."
+	},
+	slug_unchanged: {
+		why: "the project already has that slug",
+		fix: "Pass the new slug you want, e.g. `canopy rename my-new-name`."
+	},
+	rename_not_allowed: {
+		why: "Canopy's own projects (dashboard, www, docs) keep their names",
+		fix: "Nothing to do — those addresses are fixed."
+	},
+	rename_too_soon: {
+		why: "a project can be renamed once a day",
+		fix: "Try again after the time shown, or ask a Canopy admin if it can't wait."
+	},
+	too_many_old_slugs: {
+		why: "a project keeps at most 5 old slugs, and each one stays reserved for it",
+		fix: "Rename back to one of its old slugs instead (`canopy projects` shows them in the dashboard's Settings), or ask a Canopy admin."
+	},
+	rename_conflict: {
+		why: "the project changed while the rename ran",
+		fix: "Run the command again."
 	}
 };
 /** Generic explanation for a status code when we have no per-code copy. */
@@ -260,6 +280,40 @@ function commonHeaders() {
 		...agentHeaders()
 	};
 }
+/**
+* Renamed projects (OpenSpec project-slug-rename). A request that names an
+* old slug still reaches the project, and the answer carries its current
+* slug in `Canopy-Project-Slug`. By default the CLI then points canopy.json
+* at it (when that file named the old slug) and says so once; `canopy mcp
+* serve` and the git credential helper only say so, because what names the
+* slug there is the user's own configuration, not ours to edit.
+*/
+const RENAMED_HEADER = "canopy-project-slug";
+const renames = /* @__PURE__ */ new Map();
+let renameHandling = "rewrite";
+/** Report renames without editing files (mcp serve, the git credential helper). */
+function noticeRenamesOnly() {
+	renameHandling = "notice";
+}
+/** The current slug of a project this process saw renamed; `slug` when it saw none. */
+function currentSlug(slug) {
+	return renames.get(slug) ?? slug;
+}
+/** Act on a response that says `named` is an old slug. Exported for the credential helper. */
+function followRename(response, named) {
+	const current = response.headers.get(RENAMED_HEADER);
+	if (!named || !current || current === named || renames.has(named)) return;
+	renames.set(named, current);
+	if (renameHandling === "rewrite" && rewriteCanopyJsonSlug(projectDir(), named, current)) {
+		console.error(`canopy: project "${named}" is now "${current}" — updated canopy.json.`);
+		return;
+	}
+	console.error(`canopy: project "${named}" is now "${current}" — use "${current}" where you name it (MCP client config, scripts); the old name keeps working for now.`);
+}
+/** The slug a control-plane path names (`/projects/<slug>/…`), if any. */
+function slugInPath(path) {
+	return /^\/projects\/([^/?#]+)/.exec(path)?.[1];
+}
 var ApiError = class extends Error {
 	status;
 	code;
@@ -351,6 +405,7 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 		},
 		body: body === void 0 ? void 0 : isForm ? body : rawContentType !== void 0 ? body : JSON.stringify(body)
 	});
+	followRename(response, slugInPath(path));
 	if (!response.ok) return fail(response, isDeployToken, method, path);
 	if (response.status === 204) return void 0;
 	return await response.json();
@@ -370,6 +425,7 @@ async function apiUpload(path, bytes, contentType) {
 		},
 		body: bytes
 	});
+	followRename(response, slugInPath(path));
 	if (!response.ok) return fail(response, isDeployToken, "POST", path);
 	return await response.json();
 }
@@ -380,6 +436,7 @@ async function apiDownload(path) {
 		...commonHeaders(),
 		authorization: `Bearer ${token}`
 	} });
+	followRename(response, slugInPath(path));
 	if (!response.ok) return fail(response, isDeployToken, "GET", path);
 	return Buffer.from(await response.arrayBuffer());
 }
@@ -401,9 +458,10 @@ async function apiDataRequest(method, path, projectSlug, body, rawContentType, c
 		},
 		body: body === void 0 ? void 0 : rawContentType !== void 0 ? body : JSON.stringify(body)
 	});
+	followRename(response, projectSlug);
 	if (!response.ok) return fail(response, isDeployToken, method, path);
 	if (response.status === 204) return void 0;
 	return await response.json();
 }
 //#endregion
-export { apiRequest as a, credentials as c, apiDownload as i, withContext as l, agentHeaders as n, apiUpload as o, apiDataRequest as r, commonHeaders as s, ApiError as t };
+export { apiRequest as a, credentials as c, noticeRenamesOnly as d, withContext as f, apiDownload as i, currentSlug as l, agentHeaders as n, apiUpload as o, apiDataRequest as r, commonHeaders as s, ApiError as t, followRename as u };

package/dist/{browse-DRz1DowL.mjs → browse-dyOThTyf.mjs}

@@ -1,5 +1,5 @@
-import { d as tryResolveProject, n as siteConfig } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, t as ApiError } from "./api-BHzCvDcY.mjs";
+import { p as tryResolveProject, r as siteConfig } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, t as ApiError } from "./api-Bl6SG8Oq.mjs";
 import { defineCommand } from "citty";
 //#region src/browse.ts
 /**

package/dist/{db-5LfBG6N7.mjs → db-BJJGydgL.mjs}

@@ -1,7 +1,7 @@
-import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext, r as apiDataRequest } from "./api-BHzCvDcY.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-SBUdC9rX.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-DDJ5JJqj.mjs";
+import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext, r as apiDataRequest } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-D8NqjC5I.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-6rYq1Iq8.mjs → deploy-ExrIeX_m.mjs}

@@ -1,7 +1,7 @@
-import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, i as apiDownload, l as withContext, r as apiDataRequest } from "./api-BHzCvDcY.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-SBUdC9rX.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-DDJ5JJqj.mjs";
+import { c as projectUrl, d as stagingUrl, f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, r as siteConfig, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext, i as apiDownload, l as currentSlug, r as apiDataRequest } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-D8NqjC5I.mjs";
 import { builtinModules } from "node:module";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -290,6 +290,11 @@ const deployCommand = defineCommand({
 				channel
 			}, void 0, source), { action: `deploy "${slug}"` });
 			stagingCreated = upload.stagingCreated === true;
+			const overLimit = bundleLimitError(files, upload);
+			if (overLimit) {
+				spin.error("Deploy refused — nothing was uploaded.");
+				throw new Error(overLimit);
+			}
 			const uploads = [...files, ...workerBytes ? [{
 				path: WORKER_BUNDLE_PATH,
 				data: workerBytes
@@ -314,10 +319,10 @@ const deployCommand = defineCommand({
 		}
 		const backend = result.worker?.serviceUrl ? ` · backend ${result.worker.serviceUrl}` : "";
 		if (channel === "staging") {
-			spin.stop(`Staging: ${stagingUrl(slug)} (v${result.version})${backend}`);
+			spin.stop(`Staging: ${stagingUrl(currentSlug(slug))} (v${result.version})${backend}`);
 			if (stagingCreated) console.log("  staging channel created — database cloned from live");
 			console.log(`  happy with it? \`canopy promote\` makes v${result.version} live`);
-		} else spin.stop(`Live: ${projectUrl(slug)} (v${result.version})${backend}`);
+		} else spin.stop(`Live: ${projectUrl(currentSlug(slug))} (v${result.version})${backend}`);
 		if (migrateResult !== void 0) for (const line of describeMigrateResult(migrateResult)) console.log(`  ${line}`);
 	})
 });
@@ -371,12 +376,26 @@ const promoteCommand = defineCommand({
 		}
 		const backend = result.worker?.serviceUrl ? ` · backend ${result.worker.serviceUrl}` : "";
 		const was = result.previous === null ? "" : `, was v${result.previous}`;
-		spin.stop(`Live: ${projectUrl(slug)} (v${result.version}${was})${backend}`);
+		spin.stop(`Live: ${projectUrl(currentSlug(slug))} (v${result.version}${was})${backend}`);
 		for (const name of result.migrationsApplied) console.log(`  applied ${name}`);
 		if (result.snapshot !== void 0) console.log(`  pre-promote snapshot: ${result.snapshot} (canopy db restore --snapshot …)`);
 	})
 });
 const UPLOAD_CONCURRENCY = 8;
+/**
+* Why the asset files exceed the limits the platform stated, or null. The
+* worker bundle has its own key and isn't counted, as on the server. A server
+* that states no limits isn't checked here; completion still enforces them.
+*/
+function bundleLimitError(files, limits) {
+	if (limits.maxFiles !== void 0 && files.length > limits.maxFiles) return `This deploy has ${files.length} files; the limit is ${limits.maxFiles}. Bundle/minify assets or drop what isn't served, then redeploy.`;
+	const bytes = files.reduce((sum, f) => sum + f.data.byteLength, 0);
+	if (limits.maxTotalBytes !== void 0 && bytes > limits.maxTotalBytes) {
+		const mb = (n) => `${(n / 1024 / 1024).toFixed(1)} MB`;
+		return `This deploy is ${mb(bytes)}; the limit is ${mb(limits.maxTotalBytes)}. Move large images or fonts to file storage, then redeploy.`;
+	}
+	return null;
+}
 /** PUT each file to /data/v1/uploads/<grant> — the grant is the credential. */
 async function uploadFiles(grant, files) {
 	const { apiUrl } = siteConfig();
@@ -445,7 +464,7 @@ const rollbackCommand = defineCommand({
 		console.log(`Rolling back ${slug} to v${target}`);
 		const { live: result } = await apiRequest("POST", `/projects/${slug}/deploys/${target}/rollback`);
 		const worker = result.worker ? ` · worker v${result.worker.version}` : "";
-		console.log(`Live: ${projectUrl(slug)} (v${result.version}, was v${result.previous ?? "?"})${worker}`);
+		console.log(`Live: ${projectUrl(currentSlug(slug))} (v${result.version}, was v${result.previous ?? "?"})${worker}`);
 	})
 });
 const downloadCommand = defineCommand({

package/dist/dev-BmI5kwoG.mjs

@@ -0,0 +1,2 @@
+import { n as devCommand } from "./dev-adLLSY1F.mjs";
+export { devCommand };

package/dist/{dev-D_gyIeUq.mjs → dev-adLLSY1F.mjs}

@@ -1,8 +1,8 @@
-import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext, t as ApiError } from "./api-BHzCvDcY.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-SBUdC9rX.mjs";
-import { r as readMigrationFiles } from "./migrations-DDJ5JJqj.mjs";
-import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-RUf3Gfuh.mjs";
+import { a as projectDialect, f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, r as siteConfig } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext, t as ApiError } from "./api-Bl6SG8Oq.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { r as readMigrationFiles } from "./migrations-D8NqjC5I.mjs";
+import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-CScXotBB.mjs";
 import { n as writeDevServerRecord } from "./dev-server-file-Dk9pk4AR.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
@@ -41,7 +41,7 @@ async function workerPlugin(flags, slug, workerAttest, remoteUser) {
 		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
 		return;
 	}
-	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-D78leKBJ.mjs");
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-DJekKSdb.mjs");
 	const secrets = readDevVars(flags.dir);
 	const email = siteConfig().email;
 	const user = await remoteUser?.() ?? (email ? {
@@ -251,7 +251,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-Dshy0NsJ.mjs");
+		const { fetchProjectDump } = await import("./local-2xtxtoUd.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -267,7 +267,7 @@ async function devLocal(flags, slug) {
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
 	const workerAttest = randomBytes(24).toString("base64url");
-	const { createSandbox } = await import("./local-Dshy0NsJ.mjs");
+	const { createSandbox } = await import("./local-2xtxtoUd.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/{dev-worker-D78leKBJ.mjs → dev-worker-DJekKSdb.mjs}

@@ -1,4 +1,4 @@
-import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER, r as redactCanopyCredentials, t as CALLER_HEADER } from "./src-RUf3Gfuh.mjs";
+import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER, r as redactCanopyCredentials, t as CALLER_HEADER } from "./src-CScXotBB.mjs";
 import { readFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
 //#region src/dev-worker.ts

package/dist/docs/ci.md

@@ -1,8 +1,26 @@
 ---
 title: CI and deploy tokens
-description: Push-to-main deploys using a project-scoped deploy token.
+description: Push-to-main deploys using a project-scoped deploy token, and why we recommend deploying from your own machine instead.
 ---
 
+## Our recommendation: deploy manually
+
+Most Canopy users don't have a GitHub Enterprise seat, so they can't see or
+interact with GitHub Actions. That is why Canopy repositories are created with
+Actions turned **off**: pushing a workflow file works, but nothing runs, and
+there is no Actions tab for you to look at. Turning Actions on for a repository
+is something only a GitHub administrator can do, and you would still not see
+the runs.
+
+Deploy from your machine (or let your coding agent do it): run
+`canopy deploy --staging`, check the result, then `canopy promote`. It is
+usually quicker than waiting for a pipeline, and your agent can verify the
+deploy right afterwards. Run your typecheck, lint and tests locally before you
+deploy.
+
+The rest of this page is for teams that run their own CI somewhere they can
+see it.
+
 Interactive `canopy login` is for humans at a terminal. For automated deploys
 (GitHub Actions, etc.) use a **deploy token**: a project-scoped credential that
 can deploy that one project and nothing else.

package/dist/docs/cli-rename.md

@@ -0,0 +1,51 @@
+---
+title: canopy rename
+description: Change a project's slug — its address — and update canopy.json.
+---
+
+`canopy rename` gives a project a new slug, and with it a new address. The old
+slug stays with the project: old links redirect, and everything that still
+names it keeps working. See [Rename a project](https://docs.canopy.website/guides/rename) for what changes
+and what doesn't.
+
+## Usage
+
+```bash
+canopy rename my-new-name                      # in the project's folder
+canopy rename my-new-name --project old-name   # name the project yourself
+canopy rename my-new-name --yes                # skip the confirmation
+```
+
+## Arguments & flags
+
+- `<slug>` — the new slug. Same rules as `canopy create`: 2–40 lowercase letters,
+  digits and dashes, starting with a letter.
+- `--project <slug>` — the project to rename. Defaults to the `slug` in
+  `canopy.json`.
+- `[dir]` — the project folder (defaults to the current directory). Its
+  `canopy.json` is updated after the rename.
+- `--yes` — rename without asking. Required on non-interactive runs.
+- `--json` — print the result as JSON: the project, its old slugs, and whether
+  the backend refresh and Slack app update are still to come.
+
+## Details
+
+Before renaming, the CLI lists what changes for people: the address, the email
+sender, client-password visitors signing in again, and visitors' browser storage
+starting empty. Only the owner or a Canopy admin can rename. A project can be
+renamed once a day and keeps at most 5 old slugs; renaming back to one of them
+is always allowed.
+
+Other commands notice a rename too. When `canopy.json` still names the old
+slug, the next command that talks to the project updates it and says so in one
+line. `canopy mcp serve` and the git credential helper only print a notice,
+since they're started from your own configuration.
+
+## Examples
+
+```bash
+canopy rename q4-dashboard
+```
+
+Shows what changes, asks to confirm, renames, and points `canopy.json` at
+`q4-dashboard`.

package/dist/docs/developers-architecture.md

@@ -103,6 +103,18 @@ else is still static serving. A few things to know:
   `process.env`); dashboard Schedules invoke an exported
   `scheduled(event, env)` — switch on `event.name`.
 
+- **Backends run as Workers, on every site.** Your worker runs in its own
+  isolated runtime, with the rules Workers have everywhere:
+  - no file system to write to, and no child processes;
+  - `eval` and `new Function` don't work;
+  - a connection or stream belongs to the request that opened it;
+  - work you start but don't await stops when the response is sent. Hand it to
+    `c.executionCtx.waitUntil(...)` if it has to finish.
+
+  Node built-ins from the `nodejs_compat` set work (`node:crypto`,
+  `node:buffer`, `node:https`, …). `process.env` holds your secrets and the
+  project's own names, never the platform's.
+
 > **Note:** Backends run on the `main` and `gcp-pilot` sites. On a site without backend support, a deploy that
 > includes one answers with a clear "not supported here" rather than failing obscurely;
 > frontend-only projects deploy everywhere.

package/dist/docs/git.md

@@ -79,6 +79,11 @@ sign in to a Canopy repository; use the terminal for those.
 - **Deleting is for good.** `canopy repo delete` (owner only) removes the
   repository and all its history. Deleting the project deletes its repository
   too.
+- **No CI on the repository.** GitHub Actions are turned off on Canopy
+  repositories, so workflow files you push don't run, and you can't see
+  Actions runs without a GitHub seat. Run your checks locally and deploy with
+  `canopy deploy --staging` then `canopy promote` (see
+  [CI and deploy tokens](https://docs.canopy.website/guides/ci)).
 - **Moving to your own GitHub later** is ordinary git: create an empty
   repository there, then `git remote add github <its url>` and
   `git push github --all`.

package/dist/docs/index.json

@@ -65,7 +65,7 @@
         {
           "slug": "ci",
           "title": "CI and deploy tokens",
-          "summary": "Push-to-main deploys using a project-scoped deploy token."
+          "summary": "Push-to-main deploys using a project-scoped deploy token, and why we recommend deploying from your own machine instead."
         },
         {
           "slug": "git",
@@ -77,6 +77,11 @@
           "title": "Start from a template",
           "summary": "Begin a project from someone else's working one — a copy of their code and setup, never their data."
         },
+        {
+          "slug": "rename",
+          "title": "Rename a project",
+          "summary": "Change a project's slug — its address — without breaking links, checkouts or integrations."
+        },
         {
           "slug": "agent-tools",
           "title": "Agent tools (MCP)",
@@ -231,6 +236,11 @@
           "title": "canopy delete",
           "summary": "Permanently delete a Canopy project — its deploys, database, and files."
         },
+        {
+          "slug": "cli-rename",
+          "title": "canopy rename",
+          "summary": "Change a project's slug — its address — and update canopy.json."
+        },
         {
           "slug": "cli-dev",
           "title": "canopy dev",

package/dist/docs/platform-egress.md

@@ -3,11 +3,11 @@ title: Outbound requests
 description: Which external hosts your project's backend may fetch — a per-project allowlist you manage yourself, or open mode for apps that fetch arbitrary URLs.
 ---
 
-Outbound `fetch` from a project's backend worker is **deny-by-default**: the
-platform only lets requests through to platform infrastructure (your database,
-files, AI, the Canopy API) and to the hosts on your project's own
-**egress allowlist**. Anything else is answered locally with a 403
-`egress_denied` — the request never leaves the runtime.
+Outbound requests from a project's backend worker are **deny-by-default**,
+whatever the code uses to make them: `fetch`, `node:https`, or a raw socket.
+The platform only lets them through to platform infrastructure (your
+database, files, AI, the Canopy API) and to the hosts on your project's own
+**egress allowlist**. Anything else is stopped before it leaves the runtime.
 
 That default is deliberate: a thousand idle vibecoded projects should not be
 able to call arbitrary internet hosts. When your project genuinely needs an
@@ -48,8 +48,8 @@ punycode form. A project can list up to **32** hosts.
 
 Everything you reach through the SDK — `canopy.db`, `canopy.blob`,
 `canopy.ai`, and `env.CANOPY.fetch` — goes through the platform and is always
-allowed. The allowlist only governs direct `fetch` calls from your worker code
-to the outside world. (Frontend code in the browser is unaffected — this is
+allowed. The allowlist governs every connection your worker code opens to the
+outside world. (Frontend code in the browser is unaffected — this is
 about the worker.)
 
 ## When a request is denied
@@ -64,6 +64,13 @@ body:
 Allow the host and retry — see the
 [troubleshooting entry](https://docs.canopy.website/guides/troubleshooting#egress_denied-403).
 
+That answer is for `fetch` and the libraries built on it. Other clients get a
+plain connection failure instead: a `node:http` or `node:https` request, or a
+raw TCP socket (`connect()` from `cloudflare:sockets`, `node:net`). Raw sockets
+to allowed hosts work on sites that support them and fail on the rest. A host
+on your list that resolves to a private or internal address is refused too,
+so an allowed name can't lead your worker into the platform's own network.
+
 ## Recently blocked hosts
 
 You don't have to guess what got denied: the runtime reports every blocked

package/dist/docs/rename.md

@@ -0,0 +1,65 @@
+---
+title: Rename a project
+description: Change a project's slug — its address — without breaking links, checkouts or integrations.
+---
+
+A project's **slug** is its address: `<slug>.canopy.website`. You can change it
+from the dashboard or the CLI. Nothing needs to be redeployed, and everything
+that still uses the old slug keeps reaching the project.
+
+## How to rename
+
+In the dashboard, open the project's **Settings** and use **Rename address**
+on the _Project address_ card. Type the new slug, read what changes, and type
+it again to confirm.
+
+From the CLI, run it inside the project's folder:
+
+```bash
+canopy rename my-new-name
+```
+
+The CLI shows what changes and asks before it renames. It also updates
+`canopy.json` in that folder. See [`canopy rename`](https://docs.canopy.website/cli/rename) for the flags.
+
+Only the project's **owner** (or a Canopy admin) can rename it.
+
+## What changes
+
+- **The address.** The project is now at `my-new-name.canopy.website`. The old
+  address sends visitors there, keeping the rest of the link
+  (`old-name.canopy.website/reports/42` opens `my-new-name.canopy.website/reports/42`).
+  The same goes for `staging-dot-` and pinned `v12-dot-` addresses.
+- **The email sender.** Mail your project sends comes from `my-new-name@` instead
+  of `old-name@`.
+- **Client-password visitors sign in again** on the new address. Their sign-in
+  belonged to the old one.
+- **Browser storage starts empty** on the new address. Anything your app keeps
+  in the visitor's browser (localStorage, IndexedDB) stays with the old one.
+- **New report keys** use the new slug: `my-new-name-18`.
+
+## What keeps working
+
+The old slug stays with your project. Nobody else can create a project with it.
+
+- Old links and bookmarks redirect, as above. Pages that were already open keep
+  working until they're reloaded.
+- `canopy.json` files, CI deploy tokens, scripts and MCP client configs that
+  still say the old slug keep working. The CLI updates a `canopy.json` it finds
+  with the old slug, and tells you when anything else should be updated.
+- Your backend keeps running, and the rename updates the `PROJECT_SLUG` it
+  sees. If that update fails, Settings says so and has a retry button; Canopy
+  also retries on its own, and the next deploy updates it too.
+- Report keys with the old slug (`old-name-17`) still open the report.
+- Your Slack app keeps receiving events and slash commands.
+- `git push` and `git pull` keep working. The repository itself keeps its name.
+- Database, files, deploys, schedules, secrets and members don't change.
+
+## Limits
+
+- A project can be renamed **once a day**.
+- A project keeps at most **5 old slugs**. Renaming back to one of them is always
+  allowed, and doesn't count as a new one.
+- The new slug follows the same rules as a new project: 2–40 lowercase letters,
+  digits and dashes, starting with a letter.
+- Canopy's own projects (`dashboard`, `www`, `docs`) can't be renamed.

package/dist/docs/static-serving.md

@@ -22,8 +22,16 @@ in [members and access](https://docs.canopy.website/platform/members-and-access)
 
 ## Deep links work — routing is yours
 
-When a path doesn't match a file, Canopy serves your `index.html` instead of a 404. That's what makes client-side routing work: someone can bookmark
-`/reports/42`, reload it, and your app boots and handles the route.
+A path is looked up in this order:
+
+1. **The exact file.** `/logo.svg` serves `logo.svg`.
+2. **A folder's `index.html`.** `/widgets/foo/` serves `widgets/foo/index.html`,
+   and `/widgets/foo` redirects to `/widgets/foo/` first. This is how
+   prerendered and multi-page builds work: every page is its own file, and
+   reloading any of them gets that page, not your homepage.
+3. **Your root `index.html`.** Anything else gets the app's entry point instead
+   of a 404. That's what makes client-side routing work: someone can bookmark
+   `/reports/42`, reload it, and your app boots and handles the route.
 
 The trade-off is that a **typo'd asset also gets `index.html`** rather than an
 error. If a script or image comes back as your homepage HTML, you're looking at
@@ -57,12 +65,13 @@ without deploying anything.
 
 ## What a deploy may contain
 
-- Up to **500 files** and **25 MB** in total.
+- Up to **1000 files** and **50 MB** in total.
 - An `index.html` — a bundle without one is rejected.
 - Each file's type is fixed at deploy time from its extension. Unknown
   extensions are sent as a download rather than run as code.
 
-If you're over the file count, it's almost always un-bundled assets that a build
+`canopy deploy` checks both limits before it uploads anything. If you're over
+the file count, it's almost always un-bundled assets that a build
 step would combine; over the size limit, it's usually images or fonts that
 belong in [file storage](https://docs.canopy.website/sdk/files) instead of the bundle.
 

package/dist/{docs-B9xGnLSR.mjs → docs-CaAgJWK3.mjs}

@@ -1,8 +1,8 @@
-import { t as version } from "./package-SWgTmctH.mjs";
-import { n as siteConfig } from "./site-DM2J10CB.mjs";
+import { t as version } from "./package-XOtqboS1.mjs";
+import { r as siteConfig } from "./site-0i7wAJqg.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { n as agentHeaders } from "./api-BHzCvDcY.mjs";
-import { r as reportErrors } from "./ui-SBUdC9rX.mjs";
+import { n as agentHeaders } from "./api-Bl6SG8Oq.mjs";
+import { r as reportErrors } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{egress-CCpOsYpS.mjs → egress-C2amvqmE.mjs}

@@ -1,6 +1,6 @@
-import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, l as withContext } from "./api-BHzCvDcY.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-SBUdC9rX.mjs";
+import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts

package/dist/{feedback-CdjtPumG.mjs → feedback-CMnG2Zvs.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-SWgTmctH.mjs";
-import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as apiRequest, c as credentials, i as apiDownload, o as apiUpload, s as commonHeaders } from "./api-BHzCvDcY.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-SBUdC9rX.mjs";
+import { t as version } from "./package-XOtqboS1.mjs";
+import { f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, p as tryResolveProject, r as siteConfig } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, c as credentials, i as apiDownload, o as apiUpload, s as commonHeaders } from "./api-Bl6SG8Oq.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";