shiply-cli 0.21.0 → 0.23.0

package/dist/bundle.js

@@ -18,8 +18,10 @@ const WORKER_EXTERNALS = [
     ...builtinModules.flatMap((m) => [m, `${m}/*`]),
 ];
 /** esbuild-bundle a worker entry into one self-contained ESM module, optionally
- *  wrapping it (named-fetch → default, and/or asset-first) via a synthetic entry. */
-async function bundleWorker(entryAbs, opts = {}) {
+ *  wrapping it (named-fetch → default, and/or asset-first) via a synthetic entry.
+ *  Also used by `function deploy` to compile worker.ts → JS and inline npm deps
+ *  (e.g. `@neondatabase/serverless`) before upload. */
+export async function bundleWorker(entryAbs, opts = {}) {
     const common = {
         bundle: true,
         format: 'esm',

package/dist/functions.js

@@ -5,6 +5,7 @@
  *  `parseArgs` in index.ts doesn't have to know about each one. */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { bundleWorker } from './bundle.js';
 import { loadApiKey } from './config.js';
 import { api, resolveBase } from './publish.js';
 const headers = (apiKey) => ({
@@ -96,19 +97,48 @@ async function deployCmd(argv, inherited) {
     }
     const apiKey = await getApiKey(flags, 'function');
     const base = resolveBase(flags.base);
-    const lang = flags.ts ? 'ts' : 'js';
-    const filename = lang === 'ts' ? 'worker.ts' : 'worker.js';
-    let source;
+    // Collect repeatable `--secret NAME=VALUE` — set on the worker as part of this
+    // deploy so first-time setup doesn't hit "deploy a function first".
+    const secrets = [];
+    for (let i = 0; i < argv.length; i++) {
+        let pair;
+        if (argv[i] === '--secret') {
+            pair = argv[i + 1];
+            i++;
+        }
+        else if (argv[i].startsWith('--secret=')) {
+            pair = argv[i].slice('--secret='.length);
+        }
+        if (pair) {
+            const eq = pair.indexOf('=');
+            if (eq < 1)
+                throw new Error(`--secret must be NAME=VALUE (got "${pair}")`);
+            secrets.push({ name: pair.slice(0, eq), value: pair.slice(eq + 1) });
+        }
+    }
+    const filename = flags.ts ? 'worker.ts' : 'worker.js';
+    const entryAbs = join(process.cwd(), filename);
+    // Pre-read for a friendly "file not found" message (esbuild's is cryptic).
     try {
-        source = await readFile(join(process.cwd(), filename), 'utf8');
+        await readFile(entryAbs, 'utf8');
     }
     catch (e) {
         throw new Error(`couldn't read ${filename} from ${process.cwd()} — ${e.message}\n  hint: cd into the directory containing your ${filename}, or pass --ts if the file is worker.ts`);
     }
+    // Compile (TS→JS) + bundle npm deps client-side via esbuild so imports like
+    // `@neondatabase/serverless` work; cloudflare:*/node:* stay external. We then
+    // upload plain JS — the platform can't run esbuild on workerd.
+    let source;
+    try {
+        source = await bundleWorker(entryAbs);
+    }
+    catch (e) {
+        throw new Error(`couldn't bundle ${filename}: ${e.message}`);
+    }
     const row = await api(`${base}/api/v1/sites/${slug}/function`, {
         method: 'POST',
         headers: headers(apiKey),
-        body: JSON.stringify({ source, lang }),
+        body: JSON.stringify({ source, lang: 'js', ...(secrets.length ? { secrets } : {}) }),
     });
     if (flags.json) {
         console.log(JSON.stringify(row, null, 2));
@@ -117,7 +147,9 @@ async function deployCmd(argv, inherited) {
     console.log(`✔ deployed worker for ${slug}`);
     console.log(`  script: ${row.cfScriptName}`);
     console.log(`  version: ${row.version.slice(0, 12)}`);
-    console.log(`  source: ${filename} (${lang})`);
+    console.log(`  source: ${filename} (bundled → js)`);
+    if (secrets.length)
+        console.log(`  secrets: set ${secrets.map((s) => s.name).join(', ')}`);
     console.log(`  routes: requests to https://${slug}.shiply.now/* now hit your worker first`);
 }
 async function getFnCmd(argv, inherited) {

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
@@ -318,6 +318,17 @@ async function main() {
                 if (resolved.hint && publishDir !== dir && !bareJsonFlag) {
                     console.log(`✔ ${resolved.hint.framework} project detected — publishing ${publishDir}${resolved.hint.spa ? ' with SPA mode' : ''}`);
                 }
+                // A bare worker.{ts,js} at the publish root ships as a STATIC asset here
+                // (downloadable source, never runs). Warn — it deploys separately as a
+                // per-site Worker via `shiply function deploy`.
+                if (!bareJsonFlag) {
+                    for (const wf of ['worker.ts', 'worker.js']) {
+                        if (existsSync(join(publishDir, wf))) {
+                            console.log(`⚠ ${wf} will be uploaded as a STATIC file (its source is downloadable) and will NOT run as a worker.\n` +
+                                `  Deploy it as a per-site Worker instead:  shiply function deploy <slug>${wf.endsWith('.ts') ? ' --ts' : ''}`);
+                        }
+                    }
+                }
             }
             try {
                 // same command, same URL: reuse this directory's site automatically
@@ -337,6 +348,10 @@ async function main() {
                     throw new Error('nothing to update here — publish first (shiply remembers the site in .shiply.json), or pass --claim-token');
                 }
                 const updating = Boolean(claimToken || slug);
+                // Send the stable siteId so a publish self-heals after a handle rename
+                // left state.slug stale. Only for the normal state-based update path —
+                // never with --as (alias has its own slug) or --new-site.
+                const siteId = !aliasName && !values['new-site'] && state?.owned && apiKey ? state?.siteId : undefined;
                 // Auto-attach a previously-created database on publish. Anonymous
                 // publishes can't attach (no auth subject) — silently skipped server-side.
                 const attachDatabaseId = state?.databaseId && apiKey ? state.databaseId : undefined;
@@ -350,6 +365,7 @@ async function main() {
                     spaMode: spa,
                     claimToken,
                     slug,
+                    siteId,
                     attachDatabaseId,
                     previewBranchDbId,
                     // Group under a client (owned publishes only). --client "<name|email>"

package/dist/publish.js

@@ -40,6 +40,7 @@ export async function publish(dir, opts = {}) {
             ...(opts.spaMode ? { spaMode: true } : {}),
             ...(opts.claimToken ? { claimToken: opts.claimToken } : {}),
             ...(opts.slug ? { slug: opts.slug } : {}),
+            ...(opts.siteId ? { siteId: opts.siteId } : {}),
             ...(opts.attachDatabaseId ? { attachDatabaseId: opts.attachDatabaseId } : {}),
             ...(opts.previewBranchDbId ? { previewBranchDbId: opts.previewBranchDbId } : {}),
             ...(opts.client ? { client: opts.client } : {}),

package/package.json

@@ -1,42 +1,42 @@
-{
-  "name": "shiply-cli",
-  "version": "0.21.0",
-  "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "shiply": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "skill",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "pnpm build",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "shiply",
-    "hosting",
-    "static",
-    "deploy",
-    "agents",
-    "publish"
-  ],
-  "homepage": "https://shiply.now",
-  "devDependencies": {
-    "@types/node": "^22.15.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.1.0"
-  },
-  "dependencies": {
-    "esbuild": "^0.25.12",
-    "smol-toml": "^1.7.0"
-  }
-}
+{
+  "name": "shiply-cli",
+  "version": "0.23.0",
+  "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "shiply": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "skill",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "pnpm build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "shiply",
+    "hosting",
+    "static",
+    "deploy",
+    "agents",
+    "publish"
+  ],
+  "homepage": "https://shiply.now",
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.1.0"
+  },
+  "dependencies": {
+    "esbuild": "^0.25.12",
+    "smol-toml": "^1.7.0"
+  }
+}

package/skill/SKILL.md

@@ -26,7 +26,7 @@ description: "shiply is the production backend for anything an agent builds —
 
 **What it is.** Not static hosting. shiply takes whatever you build — a static page or a full-stack app in any framework — and gives it a live URL, a custom domain, a SQL database, server functions, email (send + receive), and a marketplace to sell it. One call. No account needed to start: anonymous sites are live immediately, last 24 hours, and can be claimed to keep.
 
-**Why use it.** Ship a complete, working product without stitching together a host + database + email + registrar + payments — it's one agent-native platform (MCP / CLI / REST parity). Hard-ceiling pricing ($0/$8/$24, no usage meter), so a spike or DDoS can never become a surprise bill for the owner.
+**Why use it.** Ship a complete, working product without stitching together a host + database + email + registrar + payments — it's one agent-native platform (MCP / CLI / REST parity). Hard-ceiling pricing ($0/$8/$24, plus a $49 Studio tier for client delivery — no usage meter on any tier), so a spike or DDoS can never become a surprise bill for the owner.
 
 **How (quickstart).** `shiply publish ./dir` (CLI) — or POST /api/v1/publish → PUT each file → POST finalize — returns a live URL + claimToken.