shiply-cli 0.14.3 → 0.14.5

package/README.md

@@ -3,9 +3,17 @@
 Publish static sites to [shiply.now](https://shiply.now) from the command line —
 instant web hosting built for agents.
 
+> **The npm package is `shiply-cli`, not `shiply`.** A different npm package
+> named `shiply` (an unrelated auto-commit watcher) is published by someone
+> else — installing it does NOT give you the shiply.now CLI. Always use
+> `shiply-cli`. The binary on PATH is still named `shiply` after install;
+> the warning is only about the npm package name.
+
 ```bash
 npm install -g shiply-cli
-# or
+# or, no install:
+npx -y shiply-cli@latest publish ./dist
+# or, install script:
 curl -fsSL https://shiply.now/install.sh | bash
 ```
 

package/dist/claim.js

@@ -13,20 +13,32 @@ export async function runClaimVerify(args) {
             message: 'No .shiply.json in current directory. Run from the directory where you published, or rerun `shiply publish`.',
         };
     }
-    if (!mf.siteId || !mf.claimToken) {
-        return { ok: false, message: '.shiply.json is missing siteId or claimToken.' };
+    if (!mf.claimToken) {
+        return { ok: false, message: '.shiply.json is missing claimToken.' };
+    }
+    // Anonymous publishes prior to 0.14.4 didn't write siteId to .shiply.json,
+    // and the publish API didn't return it either. The server now accepts EITHER
+    // {siteId, claimToken} or {slug, claimToken} — fall back to slug when the
+    // local state file came from an older CLI.
+    if (!mf.siteId && !mf.slug) {
+        return { ok: false, message: '.shiply.json is missing siteId or slug.' };
     }
     if (!/^SHIPLY-[A-Z2-7]{8}$/.test(args.code)) {
         return { ok: false, message: 'Invalid code format. Expected SHIPLY-XXXXXXXX.' };
     }
+    const body = { claimToken: mf.claimToken };
+    if (mf.siteId)
+        body.siteId = mf.siteId;
+    else if (mf.slug)
+        body.slug = mf.slug;
     const res = await fetch(`${origin}/api/v1/claim/pair/${encodeURIComponent(args.code)}/verify`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ siteId: mf.siteId, claimToken: mf.claimToken }),
+        body: JSON.stringify(body),
     });
     if (!res.ok) {
-        const body = (await res.json().catch(() => ({})));
-        return { ok: false, message: `verify failed: ${body.error?.message ?? res.status}` };
+        const errBody = (await res.json().catch(() => ({})));
+        return { ok: false, message: `verify failed: ${errBody.error?.message ?? res.status}` };
     }
     return { ok: true, message: 'Verified — switch back to your browser to finish claiming.' };
 }

package/dist/domain.js

@@ -1,4 +1,5 @@
 import { api, resolveBase } from './publish.js';
+import { PSL_RULES } from './psl.data.js';
 const headers = (apiKey) => ({ 'content-type': 'application/json', authorization: `Bearer ${apiKey}` });
 const enc = (d) => encodeURIComponent(d);
 export async function domainLs(ctx) {
@@ -24,40 +25,72 @@ export async function domainConnect(ctx, domain) {
     const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}/connect`, { method: 'POST', headers: headers(ctx.apiKey), body: '{}' });
     console.log(`Open this link in your browser to connect ${domain}:\n  ${r.url}`);
 }
-/** Common 2-label public suffixes. Not exhaustive — but covers the registrar
- *  ccTLDs we've seen in the wild (au, uk, nz, za, br, in, jp, kr, mx, co...).
- *  For anything else we fall back to the last-two-labels heuristic, which is
- *  correct for the vast majority of TLDs. A future improvement is to ship the
- *  Public Suffix List as data; this keeps the CLI bundle tiny. */
-const TWO_LABEL_SUFFIXES = new Set([
-    'com.au', 'net.au', 'org.au', 'edu.au', 'gov.au', 'id.au',
-    'co.uk', 'org.uk', 'me.uk', 'gov.uk', 'ac.uk', 'net.uk',
-    'co.nz', 'net.nz', 'org.nz', 'govt.nz',
-    'co.za', 'org.za', 'web.za',
-    'com.br', 'net.br', 'org.br', 'gov.br',
-    'co.in', 'net.in', 'org.in', 'gov.in',
-    'co.jp', 'or.jp', 'ne.jp', 'go.jp', 'ac.jp',
-    'co.kr', 'or.kr', 'ne.kr', 'go.kr',
-    'com.mx', 'org.mx', 'gob.mx',
-    'co.id', 'or.id', 'ac.id', 'go.id',
-    'com.sg', 'org.sg', 'edu.sg', 'gov.sg',
-    'com.hk', 'org.hk', 'edu.hk', 'gov.hk',
-    'com.tw', 'org.tw', 'gov.tw',
-]);
-/** Split hostname into (parent, subdomain) using a small Public Suffix List.
- *  parts.slice(-2).join('.') is wrong for `paidsooner.com.au` (treats `com.au`
- *  as the parent — that bug shipped phantom state to prod). */
+/** Index the PSL into three buckets for O(1) lookup. Exception rules ('!foo')
+ *  win over wildcard rules ('*.foo') which win over plain rules ('foo'). */
+const PSL_EXACT = new Set();
+const PSL_WILDCARD = new Set();
+const PSL_EXCEPTION = new Set();
+for (const rule of PSL_RULES) {
+    if (rule.startsWith('!'))
+        PSL_EXCEPTION.add(rule.slice(1));
+    else if (rule.startsWith('*.'))
+        PSL_WILDCARD.add(rule.slice(2));
+    else
+        PSL_EXACT.add(rule);
+}
+/** Find the longest matching public suffix for a hostname, applying the full
+ *  PSL algorithm: exception rules win, then wildcards, then longest exact
+ *  match. Returns the suffix as a dotted string (e.g. 'com.au', 'co.uk').
+ *  Returns null if no rule matches (hostname has only a single label, or it's
+ *  IDN/punycode outside the ICANN list). */
+export function findPublicSuffix(hostname) {
+    const labels = hostname.toLowerCase().split('.');
+    // Walk from most-specific (full hostname) to least-specific (TLD).
+    for (let i = 0; i < labels.length; i++) {
+        const candidate = labels.slice(i).join('.');
+        // 1. Exception rule wins → suffix is candidate minus its first label.
+        if (PSL_EXCEPTION.has(candidate)) {
+            return labels.slice(i + 1).join('.') || null;
+        }
+    }
+    for (let i = 0; i < labels.length; i++) {
+        const candidate = labels.slice(i).join('.');
+        // 2. Exact match.
+        if (PSL_EXACT.has(candidate))
+            return candidate;
+        // 3. Wildcard: parent of candidate (everything after candidate's first
+        //    label) is in the wildcard set.
+        if (i + 1 < labels.length) {
+            const parent = labels.slice(i + 1).join('.');
+            if (PSL_WILDCARD.has(parent))
+                return candidate;
+        }
+    }
+    return null;
+}
+/** Split hostname into (registrable domain, subdomain) using the full PSL.
+ *  The registrable domain is the public suffix plus one extra label.
+ *  E.g. `www.example.co.uk` → suffix `co.uk`, domain `example.co.uk`, sub `www`.
+ *  `foo.city.kawasaki.jp` → exception `!city.kawasaki.jp` makes the suffix
+ *  `kawasaki.jp`, so domain is `city.kawasaki.jp` and sub is `foo`.
+ *  Falls back to the last-two-labels heuristic if the hostname is below the
+ *  PSL coverage (no matching rule). */
 export function splitRegistrable(hostname) {
-    const parts = hostname.toLowerCase().split('.');
-    // Try a 2-label public suffix first (e.g. com.au, co.uk).
-    if (parts.length >= 3) {
-        const twoLabel = parts.slice(-2).join('.');
-        if (TWO_LABEL_SUFFIXES.has(twoLabel)) {
-            const domain = parts.slice(-3).join('.');
-            const subdomain = parts.slice(0, -3).join('.') || '@';
-            return { domain, subdomain };
+    const host = hostname.toLowerCase().replace(/\.$/, '');
+    const parts = host.split('.');
+    const suffix = findPublicSuffix(host);
+    if (suffix) {
+        const suffixLabels = suffix.split('.').length;
+        // Registrable domain = public suffix + one more label.
+        if (parts.length <= suffixLabels) {
+            // Hostname IS the public suffix — not registrable on its own.
+            return { domain: host, subdomain: '@' };
         }
+        const domain = parts.slice(-(suffixLabels + 1)).join('.');
+        const subdomain = parts.slice(0, -(suffixLabels + 1)).join('.') || '@';
+        return { domain, subdomain };
     }
+    // No PSL hit — fall back to last-two-labels.
     const domain = parts.slice(-2).join('.');
     const subdomain = parts.slice(0, -2).join('.') || '@';
     return { domain, subdomain };

package/dist/index.js

@@ -256,6 +256,9 @@ async function main() {
             await writeState(publishDir, {
                 slug: res.slug,
                 siteUrl: res.siteUrl,
+                // siteId only present on 0.14.4+ servers — prefer the new response,
+                // fall back to a prior state file so re-publishes don't drop it.
+                ...(res.siteId ? { siteId: res.siteId } : state?.siteId ? { siteId: state.siteId } : {}),
                 ...(res.claimToken ? { claimToken: res.claimToken } : state?.claimToken && updating ? { claimToken: state.claimToken } : {}),
                 owned: !res.anonymous,
                 ...(state?.databaseId ? { databaseId: state.databaseId } : {}),