rqbazan · Oct 13, 2026 · Oct 13, 2026
diff --git a/CHANGELOG.fork.md b/CHANGELOG.fork.md
@@ -10,7 +10,7 @@ Based on upstream [portless v0.15.6](https://github.com/vercel-labs/portless/rel
 
 ### Added
 
-- **JSON output for scripts and agents**: `--json` on `portless list`, `portless get`, `portless doctor`, and `portless service status`. stdout carries only the JSON document, warnings and errors go to stderr, keys are camelCase, and other commands reject the flag. `list --json` returns the routes the proxy serves (live processes and aliases) with their public URLs, and exits 1 when `routes.json` cannot be read or parsed instead of printing an empty list. See the JSON output section of the README. Added in [#6](https://github.com/variableland/portless/pull/6).
+- **JSON output for scripts and agents**: `--json` on `portless list`, `portless get`, `portless doctor`, and `portless service status`. stdout carries only the JSON document, warnings and errors go to stderr, keys are camelCase, and other commands reject the flag. `list --json` returns the routes the proxy serves (live processes and aliases) with their public URLs, and exits 1 when `routes.json` cannot be read or parsed instead of printing an empty list. See the JSON output section of the README. Added in [#6](https://github.com/withvariablelab/portless/pull/6).
 
 ### Changed
 
@@ -24,7 +24,7 @@ Based on upstream [portless v0.15.6](https://github.com/vercel-labs/portless/rel
 
 ### Fixed
 
-- **Wildcard subdomains go to the closest registered parent**: with `--wildcard`, when several registered hostnames are parents of a request (for example `acme.localhost` and `feat-x.acme.localhost` for `tenant.feat-x.acme.localhost`), the closest one now serves it regardless of registration order, and a longer `--path` prefix on a farther parent no longer takes the request from it. If the closest parent has no route for the path, the proxy answers 404 instead of falling through to a farther parent. Upstream issue [vercel-labs/portless#380](https://github.com/vercel-labs/portless/issues/380), fixed in [#4](https://github.com/variableland/portless/pull/4).
+- **Wildcard subdomains go to the closest registered parent**: with `--wildcard`, when several registered hostnames are parents of a request (for example `acme.localhost` and `feat-x.acme.localhost` for `tenant.feat-x.acme.localhost`), the closest one now serves it regardless of registration order, and a longer `--path` prefix on a farther parent no longer takes the request from it. If the closest parent has no route for the path, the proxy answers 404 instead of falling through to a farther parent. Upstream issue [vercel-labs/portless#380](https://github.com/vercel-labs/portless/issues/380), fixed in [#4](https://github.com/withvariablelab/portless/pull/4).
 
 ## 0.0.2
 

diff --git a/NOTICE b/NOTICE
@@ -1,6 +1,6 @@
 @variablelab/portless
 Fork maintained by Ricardo Q. Bazan (rcrd) <ricardo@variable.land>
-https://github.com/variableland/portless
+https://github.com/withvariablelab/portless
 
 This product is a fork of portless, created by Vercel Labs.
 

diff --git a/docs/RELEASING.md b/docs/RELEASING.md
@@ -10,14 +10,24 @@ Pushing a new version to `main` is what publishes. There is no separate approval
 
 ## One-time setup
 
-- Publishing uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers): the `@variablelab/portless` package on npm trusts the `release.yml` workflow of `variableland/portless` running in the `Release` environment, and the job exchanges its GitHub OIDC token for a short-lived npm token. No long-lived token is stored. To re-create the relationship (interactive 2FA):
+- Publishing uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers): the `@variablelab/portless` package on npm trusts the `release.yml` workflow of `withvariablelab/portless` running in the `Release` environment, and the job exchanges its GitHub OIDC token for a short-lived npm token. No long-lived token is stored.
+- A trusted publisher cannot be edited, only revoked and created again. The old binding names `variableland/portless`, which no longer matches the workflow's OIDC claims, so replace it, revoking first because the `npm trust` docs say a new one fails while another exists (interactive 2FA, npm 11.15.0 or later):
 
   ```bash
-  npm trust github @variablelab/portless --file release.yml --repo variableland/portless --env Release --allow-publish
+  # 1. Find the id of the current binding (it names variableland/portless)
+  npm trust list @variablelab/portless
+
+  # 2. Remove it
+  npm trust revoke --id <id> @variablelab/portless
+
+  # 3. Trust the release workflow of the new repository
+  npm trust github @variablelab/portless --file release.yml --repo withvariablelab/portless --env Release --allow-publish
   ```
 
-- The `Release` GitHub environment exists. Add required reviewers there if you want a manual gate before every publish.
-- The `NPM_TOKEN` secret used for the first release (0.0.1) is no longer read by the workflow. Revoke it on npmjs.com and delete the secret after the first successful OIDC publish.
+  Cut a release right after step 3 (see below) to confirm the new binding works. Use the same three steps if the repository, workflow file, or environment ever changes again.
+
+- The `Release` GitHub environment only accepts deployments from `main` (deployment branches: selected branches, `main`). The trusted publisher is bound to this environment, so a `release.yml` run dispatched from any other branch is rejected before it can request an npm token. Keep that restriction if you recreate the environment, and add required reviewers there if you want a manual gate before every publish.
+- No npm token is stored anywhere. The `NPM_TOKEN` secret used for the first release (0.0.1) is gone from the repository; if a token from that release still exists on npmjs.com, revoke it.
 
 ## Cut a release
 

diff --git a/docs/SYNCING.md b/docs/SYNCING.md
@@ -6,13 +6,14 @@ This fork tracks [vercel-labs/portless](https://github.com/vercel-labs/portless)
 - `fix(proxy): route wildcard subdomains to the closest registered parent` (upstream issue [#380](https://github.com/vercel-labs/portless/issues/380), extended to path prefixes)
 - `chore: rename package to @variablelab/portless` (packaging)
 - fork docs, `CHANGELOG.fork.md`, and the release workflow
+- `chore: move the fork to withvariablelab` (repository URLs)
 
 Everything else should be identical to upstream. Keep it that way: the smaller the fork's diff, the cheaper each sync.
 
 ## One-time setup
 
 ```bash
-git clone git@github.com:variableland/portless.git
+git clone git@github.com:withvariablelab/portless.git
 cd portless
 git remote add upstream https://github.com/vercel-labs/portless.git
 git fetch upstream --tags

diff --git a/packages/portless/package.json b/packages/portless/package.json
@@ -63,12 +63,12 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/variableland/portless.git",
+    "url": "git+https://github.com/withvariablelab/portless.git",
     "directory": "packages/portless"
   },
-  "homepage": "https://github.com/variableland/portless#readme",
+  "homepage": "https://github.com/withvariablelab/portless#readme",
   "bugs": {
-    "url": "https://github.com/variableland/portless/issues"
+    "url": "https://github.com/withvariablelab/portless/issues"
   },
   "devDependencies": {
     "@types/node": "^24.12.4",