shiply-cli 0.14.2 → 0.14.4

package/README.md

@@ -3,9 +3,17 @@
 Publish static sites to [shiply.now](https://shiply.now) from the command line —
 instant web hosting built for agents.
 
+> **The npm package is `shiply-cli`, not `shiply`.** A different npm package
+> named `shiply` (an unrelated auto-commit watcher) is published by someone
+> else — installing it does NOT give you the shiply.now CLI. Always use
+> `shiply-cli`. The binary on PATH is still named `shiply` after install;
+> the warning is only about the npm package name.
+
 ```bash
 npm install -g shiply-cli
-# or
+# or, no install:
+npx -y shiply-cli@latest publish ./dist
+# or, install script:
 curl -fsSL https://shiply.now/install.sh | bash
 ```
 

package/dist/claim.js

@@ -13,20 +13,32 @@ export async function runClaimVerify(args) {
             message: 'No .shiply.json in current directory. Run from the directory where you published, or rerun `shiply publish`.',
         };
     }
-    if (!mf.siteId || !mf.claimToken) {
-        return { ok: false, message: '.shiply.json is missing siteId or claimToken.' };
+    if (!mf.claimToken) {
+        return { ok: false, message: '.shiply.json is missing claimToken.' };
+    }
+    // Anonymous publishes prior to 0.14.4 didn't write siteId to .shiply.json,
+    // and the publish API didn't return it either. The server now accepts EITHER
+    // {siteId, claimToken} or {slug, claimToken} — fall back to slug when the
+    // local state file came from an older CLI.
+    if (!mf.siteId && !mf.slug) {
+        return { ok: false, message: '.shiply.json is missing siteId or slug.' };
     }
     if (!/^SHIPLY-[A-Z2-7]{8}$/.test(args.code)) {
         return { ok: false, message: 'Invalid code format. Expected SHIPLY-XXXXXXXX.' };
     }
+    const body = { claimToken: mf.claimToken };
+    if (mf.siteId)
+        body.siteId = mf.siteId;
+    else if (mf.slug)
+        body.slug = mf.slug;
     const res = await fetch(`${origin}/api/v1/claim/pair/${encodeURIComponent(args.code)}/verify`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ siteId: mf.siteId, claimToken: mf.claimToken }),
+        body: JSON.stringify(body),
     });
     if (!res.ok) {
-        const body = (await res.json().catch(() => ({})));
-        return { ok: false, message: `verify failed: ${body.error?.message ?? res.status}` };
+        const errBody = (await res.json().catch(() => ({})));
+        return { ok: false, message: `verify failed: ${errBody.error?.message ?? res.status}` };
     }
     return { ok: true, message: 'Verified — switch back to your browser to finish claiming.' };
 }

package/dist/domain.js

@@ -75,6 +75,41 @@ export async function domainSubAdd(ctx, hostname, slug) {
             console.log(`  ${d.type}  ${d.host}  →  ${d.value}`);
     }
 }
+/** Mark a hostname as the primary (canonical) URL for its site. Sibling
+ *  hostnames (same site) start 301-redirecting to it. Fixes duplicate-content
+ *  SEO when both apex and www serve the same site. */
+export async function domainPrimary(ctx, domain, hostname) {
+    const base = resolveBase(ctx.base);
+    // Fetch the list to resolve hostname → id.
+    const list = await api(`${base}/api/v1/custom-domains`, { headers: headers(ctx.apiKey) });
+    const h = hostname.trim().toLowerCase().replace(/\.$/, '');
+    let targetId = null;
+    for (const d of list.domains) {
+        for (const s of d.subdomains) {
+            if (s.hostname === h) {
+                targetId = s.id;
+                break;
+            }
+        }
+        if (targetId)
+            break;
+    }
+    if (!targetId) {
+        throw new Error(`no subdomain mapping for ${h} — add it first with: shiply domain sub add ${h} --site <slug>`);
+    }
+    const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}/subdomains/${targetId}/primary`, {
+        method: 'POST',
+        headers: headers(ctx.apiKey),
+        body: '{}',
+    });
+    console.log(`✔ ${r.hostname} is now the primary URL`);
+    const redirected = r.siblings.filter((s) => !s.isPrimary);
+    if (redirected.length) {
+        console.log('  301-redirects to it:');
+        for (const s of redirected)
+            console.log(`    ${s.hostname}`);
+    }
+}
 export async function domainSync(ctx, domain) {
     const base = resolveBase(ctx.base);
     const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}/sync-dns`, { method: 'POST', headers: headers(ctx.apiKey), body: '{}' });

package/dist/index.js

@@ -10,7 +10,7 @@ import { resolvePayloadDir } from './framework.js';
 import { runClaimVerify } from './claim.js';
 import { dbAttach, dbBranch, dbBranches, dbCreate, dbDelete, dbDeleteBranch, dbLs, dbMerge, dbMigrate, dbSql, } from './db.js';
 import { driveGet, driveLs, drivePublish, drivePut, driveRm } from './drive.js';
-import { domainAdd, domainConnect, domainLs, domainSubAdd, domainSync } from './domain.js';
+import { domainAdd, domainConnect, domainLs, domainPrimary, domainSubAdd, domainSync } from './domain.js';
 import { runProject } from './projects.js';
 import { runListing } from './listings.js';
 import { runSendingDomain } from './sending-domains.js';
@@ -64,6 +64,7 @@ Usage:
   shiply domain connect <domain>              One-click OAuth DNS setup (Cloudflare/Domain Connect)
   shiply domain sub add <host> --site <slug>  Map a subdomain (e.g. app.example.com) to a slug
   shiply domain sync <domain>                 Re-sync DNS records for a connected domain
+  shiply domain primary <domain> <hostname>   Mark hostname as primary; siblings 301-redirect (SEO)
   shiply project <ls|create|get|archive|restore>
                                               Customer-intake projects + AI brief generator
   shiply project create <label> [--customer-email <e>] [--customer-name <n>]
@@ -255,6 +256,9 @@ async function main() {
             await writeState(publishDir, {
                 slug: res.slug,
                 siteUrl: res.siteUrl,
+                // siteId only present on 0.14.4+ servers — prefer the new response,
+                // fall back to a prior state file so re-publishes don't drop it.
+                ...(res.siteId ? { siteId: res.siteId } : state?.siteId ? { siteId: state.siteId } : {}),
                 ...(res.claimToken ? { claimToken: res.claimToken } : state?.claimToken && updating ? { claimToken: state.claimToken } : {}),
                 owned: !res.anonymous,
                 ...(state?.databaseId ? { databaseId: state.databaseId } : {}),
@@ -483,8 +487,13 @@ async function main() {
                         throw new Error('usage: shiply domain sync <domain>');
                     await domainSync(dctx, arg);
                     return;
+                case 'primary':
+                    if (!arg || !arg2)
+                        throw new Error('usage: shiply domain primary <domain> <hostname>');
+                    await domainPrimary(dctx, arg, arg2);
+                    return;
                 default:
-                    throw new Error('usage: shiply domain <ls|add|connect|sub|sync>');
+                    throw new Error('usage: shiply domain <ls|add|connect|sub|sync|primary>');
             }
         }
         case 'db': {

package/dist/publish.js

@@ -51,6 +51,7 @@ export async function publish(dir, opts = {}) {
         body: JSON.stringify({ versionId: created.upload.versionId }),
     });
     return {
+        siteId: created.siteId,
         slug: created.slug,
         siteUrl: created.siteUrl,
         claimToken: created.claimToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shiply-cli",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
   "license": "MIT",
   "type": "module",

package/skill/SKILL.md

@@ -5,6 +5,13 @@ description: Publish static sites to the web instantly with shiply.now and manag
 
 ---
 
+> **IMPORTANT — npm package name is `shiply-cli`, NOT `shiply`.** A different
+> npm package named `shiply` (an auto-commit watcher) is published by someone
+> else — installing it does NOT give you the shiply.now CLI. Always use
+> `npx -y shiply-cli@latest …` or `npm install -g shiply-cli`. The CLI binary
+> on PATH is still named `shiply` once installed; the warning is only about
+> the npm package name.
+
 > **Skill freshness check.** Shiply ships new capabilities weekly. If this
 > file's "Last updated" below is more than 7 days old, re-install it with
 > `npx -y shiply-cli@latest skill --force` OR fetch `https://shiply.now/skill.md`
@@ -103,8 +110,8 @@ If the `shiply` MCP server is connected (https://shiply.now/mcp), use
 call for updates — follow it, and a `shareSuggestion` you can relay to the user.
 Other tools: `site_status`, `list_sites`, `get_site`, `set_handle`,
 `duplicate_site`, `set_variable`, `get_analytics`, `delete_site`, `whoami`,
-`add_custom_domain`, `connect_provider`, `add_subdomain`, `check_custom_domain`,
-`sync_dns`, `list_custom_domains`, `remove_custom_domain`
+`add_custom_domain`, `connect_provider`, `add_subdomain`, `set_primary_subdomain`,
+`check_custom_domain`, `sync_dns`, `list_custom_domains`, `remove_custom_domain`
 (auto-DNS via OAuth provider connections — see **Custom domains** section below).
 
 Newer capabilities (use when relevant):
@@ -122,7 +129,9 @@ Newer capabilities (use when relevant):
 
 ### 2. CLI
 ```bash
-npm i -g shiply-cli        # or: curl -fsSL https://shiply.now/install.sh | bash
+# IMPORTANT: the npm package is `shiply-cli`, not `shiply` (different package).
+npm i -g shiply-cli        # or: npx -y shiply-cli@latest <command>
+                           # or: curl -fsSL https://shiply.now/install.sh | bash
 shiply publish ./dir       # live URL + confetti
 shiply publish ./dir       # run AGAIN after edits → updates the SAME site
 shiply status <slug> --wait  # SSL + readiness; prints SSL_READY / SITE_READY
@@ -198,6 +207,7 @@ shiply status www.example.com --wait   # polls until SSL_READY + SITE_READY; exi
 | `add_custom_domain` | Add a root domain and detect the provider |
 | `connect_provider` | Start OAuth → returns `{ url }` (show to user to authorize) |
 | `add_subdomain` | Map a subdomain to a site slug |
+| `set_primary_subdomain` | Pick the canonical URL; siblings 301-redirect (SEO fix) |
 | `check_custom_domain` | Live CNAME + SSL + readiness probe |
 | `sync_dns` | Re-push DNS records to a connected provider |
 | `list_custom_domains` | List all domains and their subdomain mappings |
@@ -210,6 +220,7 @@ GET    /api/v1/custom-domains                          list domains
 POST   /api/v1/custom-domains                         add domain { domain }
 DELETE /api/v1/custom-domains/{domain}                remove domain
 POST   /api/v1/custom-domains/{domain}/subdomains     add subdomain { subdomain, slug }
+POST   /api/v1/custom-domains/{domain}/subdomains/{id}/primary   mark hostname canonical (siblings 301)
 POST   /api/v1/custom-domains/{domain}/connect        start OAuth → { url }
 POST   /api/v1/custom-domains/{domain}/sync-dns       re-sync DNS
 POST   /api/v1/custom-domains/{domain}/check          live status
@@ -423,6 +434,36 @@ shiply cron set <slug> /api/daily "0 9 * * *"
 
 Docs: https://shiply.now/docs/functions
 
+## Authentication — bring your own Clerk (or Auth.js / Lucia / Supabase Auth)
+
+shiply does **not** host customer auth. If the user's app needs sign-in, you
+(the agent) set up their auth provider yourself — Clerk is the fastest path.
+
+**One-time human step:** ask the user to create a Clerk app at
+`dashboard.clerk.com` (~2 min). They paste you the publishable key (`pk_…`) and
+secret key (`sk_…`).
+
+**Wire it:**
+\`\`\`bash
+shiply secret set <slug> CLERK_SECRET_KEY sk_live_xxxxxxxxxx
+# The publishable key can be embedded in the JS build — it's safe in the browser.
+\`\`\`
+
+**In `worker.ts`:** verify the session JWT against `env.CLERK_SECRET_KEY` on
+every API request, scope D1 rows by `payload.sub` (the Clerk user id).
+
+**In the SPA:** add `@clerk/clerk-react` to the build, wrap with `<ClerkProvider>`,
+attach `Authorization: Bearer <token>` to every authenticated fetch.
+
+Why not auto-integrate? shiply's own Clerk instance signs in **agents** to the
+shiply dashboard — it's not multi-tenant for someone else's app's users.
+Customers owning their own Clerk is the only correct shape.
+
+Same pattern works for Auth.js, Lucia, Supabase Auth, Firebase Auth — store the
+provider secret via `shiply secret set`, verify the JWT in the worker.
+
+Docs: https://shiply.now/docs/auth
+
 ## Projects — customer intake + AI brief
 
 When a dev needs to capture a real client brief, they spin up a **project**: