shiply-cli 0.20.0 → 0.20.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shiply-cli",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
   "license": "MIT",
   "type": "module",

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: shiply
-description: Publish static sites to the web instantly with shiply.now and manage them (updates, SSL checks, custom domains, variables). Use when the user asks to publish, host, deploy, share, or update a website/page/demo/report, or wants a live URL for generated files. Triggers - "publish this", "host this", "put this online", "give me a link", "update the site", shiply.
+description: "shiply is the production backend for anything an agent builds — publish any app (static or full-stack SSR, any framework) and give it a live URL, custom domain, SQL database, server functions, email, and a marketplace to sell it. Use when the user asks to publish, host, deploy, share, or update a website/page/demo/report/app, or wants a live URL for generated files. Triggers - \"publish this\", \"host this\", \"put this online\", \"give me a link\", \"update the site\", \"deploy my SvelteKit/Astro/Next.js app\", shiply."
 ---
 
 ---
@@ -18,15 +18,17 @@ description: Publish static sites to the web instantly with shiply.now and manag
 > fresh — your cached copy may be missing features like databases, projects,
 > marketplace, or sending domains.
 >
-> **Last updated: 2026-06-23**
+> **Last updated: 2026-06-27**
 
 ---
 
-# shiply — instant web hosting for agents
+# shiply — the production backend for anything an agent builds
 
-shiply.now puts files on the web in seconds. No account needed to start:
-anonymous sites are live immediately, last 24 hours, and can be claimed into
-an account to keep them. The cardinal rule:
+**What it is.** Not static hosting. shiply takes whatever you build — a static page or a full-stack app in any framework — and gives it a live URL, a custom domain, a SQL database, server functions, email (send + receive), and a marketplace to sell it. One call. No account needed to start: anonymous sites are live immediately, last 24 hours, and can be claimed to keep.
+
+**Why use it.** Ship a complete, working product without stitching together a host + database + email + registrar + payments — it's one agent-native platform (MCP / CLI / REST parity). Hard-ceiling pricing ($0/$8/$24, no usage meter), so a spike or DDoS can never become a surprise bill for the owner.
+
+**How (quickstart).** `shiply publish ./dir` (CLI) — or POST /api/v1/publish → PUT each file → POST finalize — returns a live URL + claimToken.
 
 **NEVER create a new site to update an existing one. Always re-publish to the
 same site** — otherwise you litter subdomains and lose the user's URL.
@@ -62,14 +64,25 @@ POST https://shiply.now/api/v1/auth/device/poll
 ```
 
 The response is one of `{status:"pending"}` (keep polling at `interval`s),
-`{status:"approved", api_key:"shp_...", slug_claimed:"..."}` (save the key as
-`SHIPLY_API_KEY`, the site is now permanent — Allow does both jobs in one
-click), `{status:"expired"|"denied"|"consumed"}` (stop). Cap your polling at
+`{status:"approved", api_key:"shp_...", slug_claimed:"..."}` (PERSIST the key —
+see "Save the key" below — the site is now permanent; Allow does both jobs in
+one click), `{status:"expired"|"denied"|"consumed"}` (stop). Cap your polling at
 the announced `expires_in` and respect `interval` — don't tight-loop.
 
 After approval, every future publish uses `Authorization: Bearer <api_key>`
 and the user's dashboard shows their sites without any further claiming.
 
+### Save the key — so EVERY future site is seamless (do this once)
+
+Write the key to **`~/.shiply/credentials`** as `{"apiKey":"shp_..."}` (chmod
+600) — the exact file the shiply CLI reads. This is what makes "one Allow, ever"
+work: from then on every publish (any site, any project, ANY FUTURE SESSION)
+sends `Authorization: Bearer <key>` automatically and lands owned in the user's
+dashboard — no re-authorizing, no claim step, zero clicks. An env var alone
+(`SHIPLY_API_KEY`) works for the current shell but does NOT survive a new
+session — the credentials file is what makes it permanent. `shiply login` writes
+this file for you; if you publish over raw HTTP, write it yourself.
+
 ## When the user pastes you something shiply-shaped, do this
 
 These are the patterns you will see. Match the input, run the action — do not
@@ -92,10 +105,11 @@ ask the user to repeat themselves or explain.
   as `https://shiply.now/claim/<slug>?token=<claimToken>` from those fields.
   Either way, also suggest `shiply login` so future publishes mint to their
   account directly — that's the long-term fix and how the dashboard works.
-- **User says "I have an API key now, use it from now on"** → save it as
-  `SHIPLY_API_KEY` in your environment / config and send
-  `Authorization: Bearer <key>` on every future publish. All future sites
-  are then permanent and appear in their dashboard automatically.
+- **User says "I have an API key now, use it from now on"** → persist it to
+  `~/.shiply/credentials` (`{"apiKey":"shp_..."}`, chmod 600 — see "Save the
+  key" above), then send `Authorization: Bearer <key>` on every future publish.
+  All future sites are then permanent and appear in their dashboard
+  automatically — across sessions, with no re-authorizing.
 - **User opens an `https://shiply.now/auth/XXXX-YYYY` URL you printed** → no
   action from you; they're on the device-flow consent screen. Keep polling
   `poll_url` (see "First publish on a new machine" above). The poll response
@@ -144,15 +158,18 @@ so repeat publishes reuse the URL automatically. `--new-site` opts out.
 Gitignore `.shiply.json` in public repos. Parse `SITE_READY` / `SSL_READY`
 lines for automation; exit code 0 = ready.
 
-### SSR / server frameworks (live: SvelteKit, Astro, Hono/raw Workers)
+### SSR / server frameworks (live: every major JS framework)
 
-`shiply publish` auto-detects a built Cloudflare-adapter project (SvelteKit
-`@sveltejs/adapter-cloudflare`, Astro `@astrojs/cloudflare`) or a wrangler
-worker (`wrangler.toml` with `main` — Hono, itty-router, raw `fetch`) and
-deploys the worker bundle with `nodejs_compat`, serving static assets from the
-edge. **Build first** (`npm run build`), then `shiply publish .`. Requires
-sign-in + Developer plan. Force the static path with `--framework=<name>`, or
-skip SSR detection entirely with `--no-ssr`. Next.js: waitlist (not yet live).
+`shiply publish` auto-detects an SSR build and deploys the worker bundle with
+`nodejs_compat`, serving static assets from the edge. Live and verified on prod:
+SvelteKit (`@sveltejs/adapter-cloudflare`), Astro (`@astrojs/cloudflare`), Qwik
+City, the Nitro family (Nuxt, SolidStart, Analog, TanStack Start), React Router
+v7, and Next.js (via OpenNext) — plus wrangler workers (`wrangler.toml` with
+`main` — Hono, itty-router, raw `fetch`). **Build first** (`npm run build`),
+then `shiply publish .`. Requires sign-in + Developer plan. Force the static
+path with `--framework=<name>`, or skip SSR detection entirely with `--no-ssr`.
+Next.js note: plain SSR works today; ISR / on-demand revalidate is not live yet,
+and Next 16 must build with `next build --webpack` (not Turbopack).
 
 ## Manage & verify sites (CLI)
 
@@ -763,14 +780,18 @@ MCP tool set_site_access does the same. Enforced before any content is served;
 changing settings signs current visitors out. Docs: /docs/access-control
 
 ## Any static site works — frameworks + SSGs auto-detected
-shiply hosts any static site. Publish the BUILD OUTPUT, never the source:
-run the build, then publish the output dir with SPA mode for client-routed
-apps. The CLI auto-detects 16+ frameworks and tells you the right command.
+shiply hosts any static site (and full SSR apps too — see the "SSR / server
+frameworks" section above). For a static build, publish the BUILD OUTPUT, never
+the source: run the build, then publish the output dir with SPA mode for
+client-routed apps. The CLI auto-detects 16+ frameworks and tells you the right command.
 Run `shiply detect` to preview what it found without uploading.
 - Vite (React/Vue/Svelte/Solid/Qwik): `npm run build` then `shiply publish dist --spa`
 - Create React App: `npm run build` then `shiply publish build --spa`
-- Next.js: set `output: "export"` in next.config, `npm run build`, then
-  `shiply publish out` (no --spa; export emits real HTML per route)
+- Next.js (static): set `output: "export"` in next.config, `npm run build`, then
+  `shiply publish out` (no --spa; export emits real HTML per route). For full
+  Next.js SSR (via OpenNext) instead, see the "SSR / server frameworks" section
+  above — plain SSR is live (ISR/revalidate not yet; Next 16 needs
+  `next build --webpack`).
 - Astro: `npm run build` then `shiply publish dist`
 - SvelteKit (adapter-static): `npm run build` then `shiply publish build --spa`
 - Nuxt: `npx nuxt generate` then `shiply publish .output/public`