shiply-cli 0.12.1 → 0.14.1

package/skill/SKILL.md

@@ -3,6 +3,18 @@ name: shiply
 description: Publish static sites to the web instantly with shiply.now and manage them (updates, SSL checks, custom domains, variables). Use when the user asks to publish, host, deploy, share, or update a website/page/demo/report, or wants a live URL for generated files. Triggers - "publish this", "host this", "put this online", "give me a link", "update the site", shiply.
 ---
 
+---
+
+> **Skill freshness check.** Shiply ships new capabilities weekly. If this
+> file's "Last updated" below is more than 7 days old, re-install it with
+> `npx -y shiply-cli@latest skill --force` OR fetch `https://shiply.now/skill.md`
+> fresh — your cached copy may be missing features like databases, projects,
+> marketplace, or sending domains.
+>
+> **Last updated: 2026-06-20**
+
+---
+
 # shiply — instant web hosting for agents
 
 shiply.now puts files on the web in seconds. No account needed to start:
@@ -251,7 +263,7 @@ rest and surfaced to the site's Worker as `env.DATABASE_URL`.
 
 ### D1 (default)
 ```bash
-shiply db create app                      # provision a D1 (binding APP_DB)
+shiply db create app                      # provision a D1 (binding SITE_DB)
 shiply db ls                              # list (name, provider, size, attached site)
 shiply db sql app "SELECT 1"              # one-shot query against your account
 shiply db sql app "SELECT * FROM t WHERE id=?1" --params '[42]'
@@ -265,7 +277,7 @@ Run `shiply db create` inside a publish directory: it records the new
 it. Site code then calls the shim:
 
 ```js
-fetch('/_shiply/db/APP_DB/query', {
+fetch('/_shiply/db/SITE_DB/query', {
   method: 'POST',
   headers: { 'content-type': 'application/json' },
   body: JSON.stringify({ sql: 'SELECT * FROM posts', params: [] }),
@@ -330,6 +342,180 @@ providers; `db_schema` introspects `sqlite_master` (D1) or
 `information_schema` (Neon). Full docs:
 https://shiply.now/docs/databases
 
+## Functions (Workers Lite) — webhooks, cron, secrets, full backend (Developer plan)
+
+shiply Workers Lite lets a published site include server-side code that runs
+on every request. Use when the user needs:
+- A webhook receiver (Stripe, GitHub, etc.) with raw body + signature verification
+- A cron job (daily reminders, periodic sync, retention emails)
+- A privileged API call using secrets (Stripe key, OpenAI key) without exposing them to the browser
+- An authenticated mutation on D1 / Neon (do the auth check in the function before writing)
+
+### How it works
+
+Author `worker.js` (or `worker.ts`) at the publish root. On `shiply publish`,
+shiply compiles (TS) + deploys it as a per-site Cloudflare Worker bound to
+the site's hostname. The worker handles every request; pass static asset
+requests through `env.ASSETS.fetch(request)`.
+
+```ts
+import { verifyStripeSig, json } from 'shiply-runtime'
+
+export default {
+  async fetch(req: Request, env: Env): Promise<Response> {
+    const url = new URL(req.url)
+    if (url.pathname === '/api/webhooks/stripe' && req.method === 'POST') {
+      const body = await req.text()
+      if (!await verifyStripeSig(body, req.headers.get('stripe-signature'), env.STRIPE_WEBHOOK_SECRET)) {
+        return new Response('bad sig', { status: 400 })
+      }
+      // ... handle event, write to env.SITE_DB
+      return new Response('ok')
+    }
+    return env.ASSETS.fetch(req)
+  },
+  async scheduled(event: ScheduledEvent, env: Env) {
+    if (event.cron === '0 9 * * *') { /* daily job */ }
+  }
+}
+```
+
+`.shiply/crons.json` declares cron schedules. `.shiply/secrets.json` declares
+secret names (values set via CLI/MCP, never reach the publish payload).
+
+### Bindings available in `env`
+
+- `env.ASSETS` — fall through to static (`env.ASSETS.fetch(request)`)
+- `env.SITE_DB` — attached D1 (if `shiply db attach` was run)
+- `env.<NAME>` — each shiply Variable becomes a plain-text env var
+- `env.<NAME>` — each secret set via `set_secret` is encrypted, accessible as env var
+
+### MCP tools
+
+| Tool | Purpose |
+|---|---|
+| `deploy_function` | Deploy a Worker function (alternative to publish auto-detection) |
+| `get_function` | Read the deployed source + metadata |
+| `remove_function` | Strip function + secrets + crons; fall back to static |
+| `set_secret` / `list_secrets` / `remove_secret` | Manage CF Worker secrets |
+| `set_cron` / `list_crons` / `remove_cron` | Manage cron triggers |
+| `get_function_logs` | Deep-link to CF dashboard for live tail |
+
+### CLI
+
+```bash
+shiply publish .                            # auto-detects worker.js + crons.json + secrets.json
+shiply function deploy <slug>               # alternative: upload worker.js without re-publishing
+shiply function deploy <slug> --ts          # uploads worker.ts (server-side compile)
+shiply secret set <slug> STRIPE_KEY sk_xxx  # set secret value
+shiply cron set <slug> /api/daily "0 9 * * *"
+```
+
+### REST
+
+`POST/GET/DELETE /api/v1/sites/{slug}/function` · `POST/GET /api/v1/sites/{slug}/secrets` · `DELETE /api/v1/sites/{slug}/secrets/{name}` · `GET/POST/DELETE /api/v1/sites/{slug}/crons`
+
+### Limits + plan
+
+- 1 MB compiled script size, 30s CPU per request, V8 isolate runtime (no Node APIs)
+- 50 secrets, 20 cron triggers per site
+- Plan-gated to Developer: Founder/Hobby see `402 payment_required`. Upgrade: shiply.now/dashboard/plan
+
+Docs: https://shiply.now/docs/functions
+
+## Projects — customer intake + AI brief
+
+When a dev needs to capture a real client brief, they spin up a **project**:
+the dashboard (or `shiply project create`) mints a one-URL intake form to
+share with the customer. The customer fills a 10-step wizard, attaches
+files, hits submit. An AI brief generator (MiniMax-M2 with Anthropic
+fallback) turns the answers into a structured brief the dev reviews and
+edits inline. All files flow into a per-project drive folder.
+
+MCP tools:
+```
+list_projects       — your projects (filter status/q)
+create_project      — start a new intake; pass customerName/customerEmail to email them the link
+get_project         — full project + brief
+update_brief        — patch brief jsonb (after AI generation)
+regenerate_brief    — re-run AI from current intake responses
+archive_project / restore_project — lifecycle
+list_project_files  — files uploaded by the customer
+resend_intake_invite — re-email the customer their intake link (requires customerEmail on project)
+```
+
+REST: `POST/GET /api/v1/projects · GET/PATCH /api/v1/projects/{id} · POST /api/v1/projects/{id}/regenerate-brief`
+(archive: `PATCH /api/v1/projects/{id}` with `{"status":"archived"}` — no
+dedicated `/archive` route).
+
+CLI: `shiply project ls · shiply project create <label> [--customer-email <e>] [--customer-name <n>] · shiply project get <id> · shiply project archive <id>`
+
+Docs: https://shiply.now/docs/projects
+
+## Marketplace — sell built sites
+
+Devs can list any owned site for sale: set a price + short pitch, choose
+standard or custom terms, pick a jurisdiction. Stripe Connect Express
+handles seller payouts — sellers complete a one-time onboarding before
+listing (`get_connect_status` returns the onboarding URL when needed).
+Buyers pay via Stripe Checkout; on `checkout.session.completed` the
+webhook flips the order to `paid` and transfers site ownership
+atomically. Refunds are available within the order's refund window
+(`refundExpiresAt`); a refund reverts ownership to the seller.
+
+Prices are passed as `priceCents` (whole-dollar cents between 100 and
+999900). `termsMode='standard'` uses shiply's template; `'custom'`
+requires `termsCustom` ≥50 chars.
+
+MCP tools:
+```
+list_listings    — my listings
+create_listing   — list a site (siteSlug, priceCents, pitch?, termsMode, jurisdiction, ...)
+update_listing   — change price/pitch/status (draft|live|paused)
+delete_listing   — pulls off marketplace (sets status=draft)
+list_my_sales    — orders where I'm the seller
+list_my_orders   — orders where I'm the buyer
+refund_order     — issue Stripe refund (within refund window; goes back to buyer)
+get_connect_status — Stripe Connect onboarding state + actionable URL
+```
+
+REST: `POST /api/v1/listings · PATCH /api/v1/listings/{id} · POST /api/v1/listings/{id}/checkout · POST /api/v1/orders/{id}/refund · GET /api/v1/connect/status`
+(no GET listing index over REST yet — use the MCP `list_listings` /
+`list_my_sales` / `list_my_orders` tools for machine output, or the
+dashboard `/dashboard/sales` page for humans.)
+
+CLI: `shiply listing ls · shiply listing create <site-slug> --price <cents> --jurisdiction "<region>" · shiply listing rm <slug> --id <listing-id>`
+
+**Stripe Connect note:** Sellers must complete one-time Stripe Connect
+onboarding before listing. Call `get_connect_status` first — when status
+isn't `'ready'` it returns an `onboardingUrl` you should hand to the
+user as a clickable link.
+
+Docs: https://shiply.now/docs/marketplace
+
+## Sending domains — outbound email on your domain
+
+For agents that want shiply to send emails (demand-test broadcasts,
+project intake invites, transactional notifications) from a custom
+verified domain instead of the shared shiply pool. Backed by Resend —
+add the DNS records they return at your registrar, then call
+`verify_sending_domain` to re-check.
+
+MCP tools:
+```
+list_sending_domains   — all your sending domains
+add_sending_domain     — start: returns DNS records to add at your registrar
+verify_sending_domain  — re-check DNS after adding records
+remove_sending_domain  — tear down
+```
+
+REST: `GET/POST /api/v1/sending-domains · POST /api/v1/sending-domains/{id}/verify · DELETE /api/v1/sending-domains/{id}`
+
+CLI: `shiply sending-domain ls · shiply sending-domain add <domain> · shiply sending-domain verify <id> · shiply sending-domain rm <id> --yes`
+
+Cannot be a `shiply.now` subdomain. Verified status flips once SPF +
+DKIM (+ MX for inbound) all check out.
+
 ## Make a site private (paid plans)
 To password-protect or restrict a site: PATCH /api/v1/publishes/<slug>/access
 with {"mode":"password","password":"..."} or {"mode":"restricted",