shiply-cli 0.22.0 → 0.24.0

package/dist/functions.js

@@ -97,6 +97,25 @@ async function deployCmd(argv, inherited) {
     }
     const apiKey = await getApiKey(flags, 'function');
     const base = resolveBase(flags.base);
+    // Collect repeatable `--secret NAME=VALUE` — set on the worker as part of this
+    // deploy so first-time setup doesn't hit "deploy a function first".
+    const secrets = [];
+    for (let i = 0; i < argv.length; i++) {
+        let pair;
+        if (argv[i] === '--secret') {
+            pair = argv[i + 1];
+            i++;
+        }
+        else if (argv[i].startsWith('--secret=')) {
+            pair = argv[i].slice('--secret='.length);
+        }
+        if (pair) {
+            const eq = pair.indexOf('=');
+            if (eq < 1)
+                throw new Error(`--secret must be NAME=VALUE (got "${pair}")`);
+            secrets.push({ name: pair.slice(0, eq), value: pair.slice(eq + 1) });
+        }
+    }
     const filename = flags.ts ? 'worker.ts' : 'worker.js';
     const entryAbs = join(process.cwd(), filename);
     // Pre-read for a friendly "file not found" message (esbuild's is cryptic).
@@ -119,7 +138,7 @@ async function deployCmd(argv, inherited) {
     const row = await api(`${base}/api/v1/sites/${slug}/function`, {
         method: 'POST',
         headers: headers(apiKey),
-        body: JSON.stringify({ source, lang: 'js' }),
+        body: JSON.stringify({ source, lang: 'js', ...(secrets.length ? { secrets } : {}) }),
     });
     if (flags.json) {
         console.log(JSON.stringify(row, null, 2));
@@ -129,6 +148,8 @@ async function deployCmd(argv, inherited) {
     console.log(`  script: ${row.cfScriptName}`);
     console.log(`  version: ${row.version.slice(0, 12)}`);
     console.log(`  source: ${filename} (bundled → js)`);
+    if (secrets.length)
+        console.log(`  secrets: set ${secrets.map((s) => s.name).join(', ')}`);
     console.log(`  routes: requests to https://${slug}.shiply.now/* now hit your worker first`);
 }
 async function getFnCmd(argv, inherited) {

package/dist/index.js

@@ -348,6 +348,10 @@ async function main() {
                     throw new Error('nothing to update here — publish first (shiply remembers the site in .shiply.json), or pass --claim-token');
                 }
                 const updating = Boolean(claimToken || slug);
+                // Send the stable siteId so a publish self-heals after a handle rename
+                // left state.slug stale. Only for the normal state-based update path —
+                // never with --as (alias has its own slug) or --new-site.
+                const siteId = !aliasName && !values['new-site'] && state?.owned && apiKey ? state?.siteId : undefined;
                 // Auto-attach a previously-created database on publish. Anonymous
                 // publishes can't attach (no auth subject) — silently skipped server-side.
                 const attachDatabaseId = state?.databaseId && apiKey ? state.databaseId : undefined;
@@ -361,6 +365,7 @@ async function main() {
                     spaMode: spa,
                     claimToken,
                     slug,
+                    siteId,
                     attachDatabaseId,
                     previewBranchDbId,
                     // Group under a client (owned publishes only). --client "<name|email>"

package/dist/publish.js

@@ -12,8 +12,48 @@ export class ApiError extends Error {
         this.name = 'ApiError';
     }
 }
+// Transient statuses worth retrying: gateway/timeout/rate-limit. NOT 500 — a
+// deterministic server bug shouldn't be hammered (and retrying a non-idempotent
+// create on a 500 risks duplicate work; a 502/503/504 means the origin likely
+// never processed the request, so a retry is safe).
+const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504]);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const backoffMs = (attempt) => Math.min(8000, 500 * 2 ** attempt) + Math.floor(Math.random() * 250);
+/** fetch() with a per-attempt timeout + retry-with-backoff on transient failures
+ *  (network errors, aborts/timeouts, and 5xx gateway statuses). Bodies here are
+ *  strings/Buffers, so re-sending on retry is safe. */
+export async function fetchWithRetry(url, init, opts = {}) {
+    const attempts = opts.attempts ?? 4;
+    const timeoutMs = opts.timeoutMs ?? 60_000;
+    const label = opts.label ?? url;
+    let lastErr;
+    for (let i = 0; i < attempts; i++) {
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), timeoutMs);
+        try {
+            const res = await fetch(url, { ...init, signal: ac.signal });
+            clearTimeout(timer);
+            if (TRANSIENT_STATUS.has(res.status) && i < attempts - 1) {
+                process.stderr.write(`  ↻ ${label} returned ${res.status} — retrying (${i + 2}/${attempts})…\n`);
+                await sleep(backoffMs(i));
+                continue;
+            }
+            return res;
+        }
+        catch (e) {
+            clearTimeout(timer);
+            lastErr = e;
+            if (i < attempts - 1) {
+                process.stderr.write(`  ↻ ${label} failed (${e.message}) — retrying (${i + 2}/${attempts})…\n`);
+                await sleep(backoffMs(i));
+                continue;
+            }
+        }
+    }
+    throw new Error(`request to ${label} failed after ${attempts} attempts: ${lastErr?.message ?? 'unknown error'}`);
+}
 export async function api(url, init) {
-    const res = await fetch(url, init);
+    const res = await fetchWithRetry(url, init, { label: `${init.method ?? 'GET'} ${url}` });
     const body = await res.json().catch(() => ({}));
     if (!res.ok) {
         const err = body.error;
@@ -40,6 +80,7 @@ export async function publish(dir, opts = {}) {
             ...(opts.spaMode ? { spaMode: true } : {}),
             ...(opts.claimToken ? { claimToken: opts.claimToken } : {}),
             ...(opts.slug ? { slug: opts.slug } : {}),
+            ...(opts.siteId ? { siteId: opts.siteId } : {}),
             ...(opts.attachDatabaseId ? { attachDatabaseId: opts.attachDatabaseId } : {}),
             ...(opts.previewBranchDbId ? { previewBranchDbId: opts.previewBranchDbId } : {}),
             ...(opts.client ? { client: opts.client } : {}),
@@ -70,7 +111,7 @@ async function uploadAll(dir, targets) {
         while (next < targets.length) {
             const t = targets[next++];
             const body = await readFile(join(dir, t.path));
-            const res = await fetch(t.url, { method: t.method, headers: t.headers, body });
+            const res = await fetchWithRetry(t.url, { method: t.method, headers: t.headers, body }, { label: `upload ${t.path}` });
             if (!res.ok)
                 throw new Error(`upload failed for ${t.path}: HTTP ${res.status}`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shiply-cli",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
   "license": "MIT",
   "type": "module",

package/skill/SKILL.md

@@ -26,7 +26,7 @@ description: "shiply is the production backend for anything an agent builds —
 
 **What it is.** Not static hosting. shiply takes whatever you build — a static page or a full-stack app in any framework — and gives it a live URL, a custom domain, a SQL database, server functions, email (send + receive), and a marketplace to sell it. One call. No account needed to start: anonymous sites are live immediately, last 24 hours, and can be claimed to keep.
 
-**Why use it.** Ship a complete, working product without stitching together a host + database + email + registrar + payments — it's one agent-native platform (MCP / CLI / REST parity). Hard-ceiling pricing ($0/$8/$24, no usage meter), so a spike or DDoS can never become a surprise bill for the owner.
+**Why use it.** Ship a complete, working product without stitching together a host + database + email + registrar + payments — it's one agent-native platform (MCP / CLI / REST parity). Hard-ceiling pricing ($0/$8/$24, plus a $49 Studio tier for client delivery — no usage meter on any tier), so a spike or DDoS can never become a surprise bill for the owner.
 
 **How (quickstart).** `shiply publish ./dir` (CLI) — or POST /api/v1/publish → PUT each file → POST finalize — returns a live URL + claimToken.