shiply-cli 0.24.0 → 0.25.1

package/dist/connect.js

@@ -0,0 +1,189 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { parse as parseToml, stringify as stringifyToml } from 'smol-toml';
+/** The public MCP server package. `npx shiply-mcp` boots a local stdio server
+ *  that talks to shiply's REST API: anonymous publish works with no key; a
+ *  saved SHIPLY_API_KEY (shp_…) unlocks owned site/db/domain ops. */
+export const MCP_SERVER_NAME = 'shiply';
+export const MCP_COMMAND = 'npx';
+/** `-y` so the first run installs shiply-mcp without an interactive prompt —
+ *  the agent spawns this non-interactively. */
+export const MCP_ARGS = ['-y', 'shiply-mcp'];
+/** Where each agent keeps its (global) MCP config. Kept in one place so the
+ *  detector and the writer never drift. Project-local variants (./.cursor,
+ *  ./.mcp.json) are intentionally out of scope — `connect` wires the agent
+ *  once for the whole machine, matching `shiply skill`'s global default. */
+export function knownTargets(home = homedir()) {
+    const claudeFile = join(home, '.claude.json');
+    const cursorFile = join(home, '.cursor', 'mcp.json');
+    const codexFile = join(home, '.codex', 'config.toml');
+    return [
+        {
+            id: 'claude',
+            label: 'Claude Code',
+            file: claudeFile,
+            format: 'claude-json',
+            // ~/.claude.json is created on first Claude Code run; ~/.claude/ is the
+            // adjacent skills/data dir. Either presence means "Claude Code is here".
+            detected: existsSync(claudeFile) || existsSync(join(home, '.claude')),
+        },
+        {
+            id: 'cursor',
+            label: 'Cursor',
+            file: cursorFile,
+            format: 'mcp-json',
+            detected: existsSync(cursorFile) || existsSync(join(home, '.cursor')),
+        },
+        {
+            id: 'codex',
+            label: 'Codex',
+            file: codexFile,
+            format: 'codex-toml',
+            detected: existsSync(codexFile) || existsSync(join(home, '.codex')),
+        },
+    ];
+}
+/** Decide which targets to act on given the flags. Exported for testing. */
+export function selectTargets(targets, opts) {
+    let chosen = targets;
+    if (opts.only && opts.only.length > 0) {
+        const want = new Set(opts.only.map((s) => s.trim().toLowerCase()));
+        chosen = chosen.filter((t) => want.has(t.id));
+    }
+    else if (!opts.all) {
+        chosen = chosen.filter((t) => t.detected);
+    }
+    return chosen;
+}
+/** The server entry we want present, in the JSON agents' shape. */
+function desiredJsonEntry() {
+    return { command: MCP_COMMAND, args: [...MCP_ARGS] };
+}
+/** Shallow structural equality for a server entry we previously wrote. Only
+ *  compares the fields we manage (command + args) so a user who hand-added
+ *  `env` on top of our entry isn't treated as "different" and re-clobbered. */
+function entryMatches(existing) {
+    if (!existing || typeof existing !== 'object')
+        return false;
+    const e = existing;
+    if (e.command !== MCP_COMMAND)
+        return false;
+    if (!Array.isArray(e.args))
+        return false;
+    return e.args.length === MCP_ARGS.length && e.args.every((a, i) => a === MCP_ARGS[i]);
+}
+/** Read a file if present; undefined if missing. Any other error propagates. */
+async function readIfExists(file) {
+    try {
+        return await readFile(file, 'utf8');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw e;
+    }
+}
+/** Compute + optionally apply the change for a single JSON-shaped agent
+ *  (Claude Code / Cursor). Both use `{ mcpServers: { <name>: entry } }`. */
+async function applyJsonTarget(t, opts) {
+    const raw = await readIfExists(t.file);
+    let doc = {};
+    if (raw && raw.trim()) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                doc = parsed;
+            }
+            else {
+                return { ...base(t), action: 'error', detail: 'config is not a JSON object — left untouched' };
+            }
+        }
+        catch {
+            return { ...base(t), action: 'error', detail: 'config is not valid JSON — left untouched' };
+        }
+    }
+    const servers = doc.mcpServers && typeof doc.mcpServers === 'object' && !Array.isArray(doc.mcpServers)
+        ? doc.mcpServers
+        : undefined;
+    const existing = servers?.[MCP_SERVER_NAME];
+    if (existing !== undefined) {
+        if (entryMatches(existing))
+            return { ...base(t), action: 'unchanged', detail: 'already configured' };
+        if (!opts.force)
+            return {
+                ...base(t),
+                action: 'skipped-exists',
+                detail: 'a different `shiply` MCP entry exists — re-run with --force to overwrite',
+            };
+    }
+    const nextServers = { ...(servers ?? {}), [MCP_SERVER_NAME]: desiredJsonEntry() };
+    const nextDoc = { ...doc, mcpServers: nextServers };
+    const action = existing !== undefined ? 'updated' : 'added';
+    if (!opts.dryRun) {
+        await mkdir(dirname(t.file), { recursive: true });
+        // Preserve 2-space indentation like the rest of the CLI's JSON writers.
+        await writeFile(t.file, `${JSON.stringify(nextDoc, null, 2)}\n`);
+    }
+    return { ...base(t), action };
+}
+/** Codex reads TOML: `[mcp_servers.shiply]\ncommand=…\nargs=[…]`. We parse the
+ *  whole doc, merge our table, and re-stringify — smol-toml round-trips the
+ *  rest of the user's config unharmed. */
+async function applyCodexTarget(t, opts) {
+    const raw = await readIfExists(t.file);
+    let doc = {};
+    if (raw && raw.trim()) {
+        try {
+            doc = parseToml(raw);
+        }
+        catch {
+            return { ...base(t), action: 'error', detail: 'config is not valid TOML — left untouched' };
+        }
+    }
+    const servers = doc.mcp_servers && typeof doc.mcp_servers === 'object' && !Array.isArray(doc.mcp_servers)
+        ? doc.mcp_servers
+        : undefined;
+    const existing = servers?.[MCP_SERVER_NAME];
+    if (existing !== undefined) {
+        if (entryMatches(existing))
+            return { ...base(t), action: 'unchanged', detail: 'already configured' };
+        if (!opts.force)
+            return {
+                ...base(t),
+                action: 'skipped-exists',
+                detail: 'a different `shiply` MCP entry exists — re-run with --force to overwrite',
+            };
+    }
+    const nextServers = { ...(servers ?? {}), [MCP_SERVER_NAME]: desiredJsonEntry() };
+    const nextDoc = { ...doc, mcp_servers: nextServers };
+    const action = existing !== undefined ? 'updated' : 'added';
+    if (!opts.dryRun) {
+        await mkdir(dirname(t.file), { recursive: true });
+        await writeFile(t.file, stringifyToml(nextDoc));
+    }
+    return { ...base(t), action };
+}
+function base(t) {
+    return { id: t.id, label: t.label, file: t.file };
+}
+async function applyTarget(t, opts) {
+    try {
+        return t.format === 'codex-toml' ? await applyCodexTarget(t, opts) : await applyJsonTarget(t, opts);
+    }
+    catch (e) {
+        return { ...base(t), action: 'error', detail: e.message };
+    }
+}
+/** Install the shiply MCP entry into every selected agent config. Idempotent:
+ *  an identical entry is left as-is; a foreign `shiply` entry is preserved
+ *  unless --force. Returns one result per selected target (empty if none). */
+export async function runConnect(opts = {}) {
+    const targets = knownTargets(opts.home);
+    const selected = selectTargets(targets, opts);
+    const results = [];
+    for (const t of selected)
+        results.push(await applyTarget(t, opts));
+    return { results, targets };
+}

package/dist/data.js

@@ -49,10 +49,24 @@ export async function dataQuery(ctx, slug, collection, opts) {
         console.log(`\n  more — re-run with --cursor=${page.nextCursor}`);
     }
 }
-export async function dataInsert(ctx, slug, collection, body, sitesDomain = 'shiply.now') {
+export async function dataInsert(ctx, slug, collection, body, sitesDomain) {
     // Inserts hit the PUBLIC visitor endpoint at the live site host. We don't
     // send the Bearer key here — manifest's `access.insert` decides.
-    const url = `https://${slug}.${sitesDomain}/.shiply/data/${encodeURIComponent(collection)}`;
+    //
+    // The site host is NOT the API base, but it lives on the same domain as it:
+    // for the default base https://shiply.now the site host is
+    // <slug>.shiply.now. Derive scheme + host from the resolved base so that
+    // --base / SHIPLY_BASE_URL (staging, self-host, local) is honored, matching
+    // every other data subcommand. An explicit sitesDomain arg still wins.
+    let origin;
+    if (sitesDomain) {
+        origin = `https://${slug}.${sitesDomain}`;
+    }
+    else {
+        const baseUrl = new URL(resolveBase(ctx.base));
+        origin = `${baseUrl.protocol}//${slug}.${baseUrl.host}`;
+    }
+    const url = `${origin}/.shiply/data/${encodeURIComponent(collection)}`;
     const res = await fetch(url, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -60,7 +74,7 @@ export async function dataInsert(ctx, slug, collection, body, sitesDomain = 'shi
     });
     const json = (await res.json().catch(() => ({})));
     if (!res.ok)
-        throw new Error(json.message ?? `HTTP ${res.status}`);
+        throw new Error(json.error?.message ?? json.message ?? `HTTP ${res.status}`);
     console.log(`✔ inserted ${json.id ?? ''} at ${json.createdAt ?? ''}`);
 }
 export async function dataExport(ctx, slug, collection, opts) {

package/dist/index.js

@@ -27,6 +27,7 @@ import { loadApiKey, saveApiKey } from './config.js';
 import { loginViaDeviceFlow } from './login.js';
 import { api, ApiError, DEFAULT_BASE, publish, resolveBase } from './publish.js';
 import { installSkill } from './skill.js';
+import { runConnect } from './connect.js';
 import { readState, writeState } from './state.js';
 import { readPreview, writePreview } from './previews.js';
 import { checkReadiness, targetToHostname } from './status.js';
@@ -140,6 +141,9 @@ Usage:
   shiply skill [--project] [--force]          Install the shiply skill for your AI agent
                                               (global ~/.claude/skills, or ./.claude/skills with --project)
                                               (--force overwrites an existing skill — recommended weekly)
+  shiply connect [--all] [--only <ids>]       Wire the shiply MCP server into your agent(s)
+                                              (auto-detects Claude Code, Cursor, Codex; idempotent)
+                                              (--all writes even undetected agents; --dry-run previews)
   shiply login [--name <label>]               Open a browser, click Allow → key saved
                                               (--email <addr> falls back to legacy 6-digit code)
   shiply help
@@ -203,11 +207,13 @@ async function main() {
     // token so the parser doesn't complain about a missing string value.
     const rawArgv = process.argv.slice(2);
     // `--json` is a STRING option (data-insert body). For commands where it's a
-    // boolean flag (status/publish/update), detect a BARE --json (no following
-    // value) in raw argv and strip it before parseArgs sees it.
+    // boolean flag (status/publish/update/logs), `--json` NEVER takes a value, so
+    // treat it as a bare flag regardless of what follows and strip it before
+    // parseArgs sees it. (A prior lookahead that cancelled the flag when a
+    // positional followed made `shiply publish --json ./dist` swallow the dir as
+    // the --json value, leaving no <dir>.)
     const BARE_JSON_CMDS = new Set(['status', 'publish', 'update', 'logs']);
-    const bareJsonFlag = BARE_JSON_CMDS.has(rawArgv[0]) && rawArgv.includes('--json') &&
-        !rawArgv.some((a, i) => a === '--json' && typeof rawArgv[i + 1] === 'string' && !rawArgv[i + 1].startsWith('-'));
+    const bareJsonFlag = BARE_JSON_CMDS.has(rawArgv[0]) && rawArgv.includes('--json');
     if (bareJsonFlag) {
         const idx = rawArgv.indexOf('--json');
         rawArgv.splice(idx, 1);
@@ -231,6 +237,9 @@ async function main() {
             'new-site': { type: 'boolean' },
             project: { type: 'boolean' },
             force: { type: 'boolean' },
+            all: { type: 'boolean' },
+            only: { type: 'string' },
+            'dry-run': { type: 'boolean' },
             timeout: { type: 'string' },
             out: { type: 'string', short: 'o' },
             site: { type: 'string' },
@@ -477,7 +486,7 @@ async function main() {
             if (!apiKey)
                 throw new Error('duplicate needs an API key — run `shiply login` first');
             const base = resolveBase(values.base);
-            const out = await api(`${base}/api/v1/publishes/${dir}/duplicate`, {
+            const out = await api(`${base}/api/v1/publishes/${encodeURIComponent(dir)}/duplicate`, {
                 method: 'POST',
                 headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
                 body: JSON.stringify({}),
@@ -916,6 +925,70 @@ async function main() {
             console.log('\nThe skill instructs your agent how to publish, manage sites, query databases, run demand tests, drive customer-intake projects, list/sell sites in the marketplace, manage inbox + sending domains, and more.');
             break;
         }
+        case 'connect': {
+            const only = values.only
+                ? String(values.only)
+                    .split(',')
+                    .map((s) => s.trim())
+                    .filter(Boolean)
+                : undefined;
+            const dryRun = Boolean(values['dry-run']);
+            const { results, targets } = await runConnect({
+                all: Boolean(values.all),
+                only,
+                force: Boolean(values.force),
+                dryRun,
+            });
+            if (results.length === 0) {
+                // Nothing selected: either no agents detected, or --only matched none.
+                if (only && only.length > 0) {
+                    console.error(`✖ no known agent matched --only ${only.join(',')}`);
+                    console.error(`  known ids: ${targets.map((t) => t.id).join(', ')}`);
+                    process.exit(2);
+                }
+                console.log('No agent config detected (looked for Claude Code, Cursor, Codex).');
+                console.log('  Re-run with --all to write configs for all of them anyway,');
+                console.log('  or --only claude,cursor,codex to target specific ones.');
+                break;
+            }
+            let wrote = false;
+            let blocked = false;
+            for (const r of results) {
+                switch (r.action) {
+                    case 'added':
+                    case 'updated':
+                        wrote = true;
+                        console.log(`✔ ${r.label} — shiply MCP ${dryRun ? 'would be ' + r.action : r.action} (${r.file})`);
+                        break;
+                    case 'unchanged':
+                        console.log(`• ${r.label} — already configured (${r.file})`);
+                        break;
+                    case 'skipped-exists':
+                        blocked = true;
+                        console.log(`• ${r.label} — ${r.detail} (${r.file})`);
+                        break;
+                    case 'error':
+                        blocked = true;
+                        console.error(`✖ ${r.label} — ${r.detail} (${r.file})`);
+                        break;
+                }
+            }
+            if (wrote && !dryRun) {
+                console.log('');
+                console.log('The shiply MCP is now wired in. Next steps:');
+                console.log('  1. Restart your agent (or reload its MCP servers) to pick up the change.');
+                console.log('  2. Ask it to "publish this to shiply" — it can now deploy, check status,');
+                console.log('     roll back, and manage custom domains directly.');
+                console.log('  3. Optional: run `shiply login` so owned-site tools work (anonymous publish');
+                console.log('     already works with no key).');
+            }
+            else if (dryRun && wrote) {
+                console.log('\n(dry run — nothing was written; re-run without --dry-run to apply)');
+            }
+            if (blocked)
+                process.exitCode = 1;
+            break;
+        }
         case 'login': {
             const base = resolveBase(values.base);
             // Default path: device flow. One click in the browser, no email round-trip.

package/dist/skill.js

@@ -1,15 +1,19 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { cp, mkdir, readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-/** The SKILL.md ships inside the npm package (skill/SKILL.md next to dist/). */
-export async function bundledSkill() {
+/** The skill bundle ships inside the npm package (skill/ next to dist/):
+ *  SKILL.md (core) + references/*.md (per-topic) + CHANGELOG.md. */
+function bundledSkillDir() {
     const here = dirname(fileURLToPath(import.meta.url)); // <pkg>/dist
-    return readFile(join(here, '..', 'skill', 'SKILL.md'), 'utf8');
+    return join(here, '..', 'skill');
+}
+export async function bundledSkill() {
+    return readFile(join(bundledSkillDir(), 'SKILL.md'), 'utf8');
 }
 /** Where agents look for skills. Claude Code is the reference layout
- *  (~/.claude/skills/<name>/SKILL.md); several other agents read the same
- *  format from their own folders. */
+ *  (~/.claude/skills/<name>/SKILL.md + sibling reference files); several
+ *  other agents read the same format from their own folders. */
 export function installTargets(project) {
     if (project) {
         return [{ agent: 'this project (Claude Code & compatible)', dir: join(process.cwd(), '.claude', 'skills', 'shiply') }];
@@ -17,17 +21,16 @@ export function installTargets(project) {
     return [{ agent: 'Claude Code (all projects)', dir: join(homedir(), '.claude', 'skills', 'shiply') }];
 }
 export async function installSkill(project, force = false) {
-    const content = await bundledSkill();
+    const src = bundledSkillDir();
     const written = [];
     for (const t of installTargets(project)) {
         await mkdir(t.dir, { recursive: true });
-        const file = join(t.dir, 'SKILL.md');
-        // writeFile always overwrites; --force is an explicit signal of intent
-        // (and matches what users type from the AGENT_PROMPT). Without --force we
-        // still overwrite — but a future version may add a sanity check.
+        // cp always overwrites; --force is an explicit signal of intent (and
+        // matches what users type from the AGENT_PROMPT). A stale references/
+        // file that no longer ships is harmless — SKILL.md only links current ones.
         void force;
-        await writeFile(file, content);
-        written.push(`${t.agent}: ${file}`);
+        await cp(src, t.dir, { recursive: true });
+        written.push(`${t.agent}: ${join(t.dir, 'SKILL.md')} (+ references/ + CHANGELOG.md)`);
     }
     return written;
 }

package/package.json

@@ -1,42 +1,42 @@
-{
-  "name": "shiply-cli",
-  "version": "0.24.0",
-  "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "shiply": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "skill",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "pnpm build",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "shiply",
-    "hosting",
-    "static",
-    "deploy",
-    "agents",
-    "publish"
-  ],
-  "homepage": "https://shiply.now",
-  "devDependencies": {
-    "@types/node": "^22.15.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.1.0"
-  },
-  "dependencies": {
-    "esbuild": "^0.25.12",
-    "smol-toml": "^1.7.0"
-  }
-}
+{
+  "name": "shiply-cli",
+  "version": "0.25.1",
+  "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "shiply": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "skill",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "pnpm build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "shiply",
+    "hosting",
+    "static",
+    "deploy",
+    "agents",
+    "publish"
+  ],
+  "homepage": "https://shiply.now",
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.1.0"
+  },
+  "dependencies": {
+    "esbuild": "^0.25.12",
+    "smol-toml": "^1.7.0"
+  }
+}

package/skill/CHANGELOG.md

@@ -0,0 +1,90 @@
+# shiply — what's new for agents
+
+Newest first. If your installed skill's "last updated" date is older than an
+entry here, that capability may be missing from your copy — re-install with
+`npx -y shiply-cli@latest skill --force` or read https://shiply.now/skill.md.
+(This is the agent-facing capability log; the CLI's own release notes live in
+the npm package changelog.)
+
+## 2026-07-04
+
+- **Update** — the site-relative endpoints (`POST /.shiply/data/<collection>`,
+  `POST /.shiply/email`) now return the same nested error envelope as
+  `/api/v1/*`: `{"error":{"code","message"}}` (previously a flat
+  `{"error":"<code>","message":"..."}`). A top-level `message` mirror is kept
+  for older inline JS — read `body.error.code` / `body.error.message` going
+  forward. Codes `data_requires_account` / `email_requires_account` (403 on
+  unclaimed sites) are now in the documented error list.
+- **Update** — the skill was restructured for progressive disclosure: a slim
+  core `SKILL.md` (publish → authorize → update → claim → verify) plus
+  per-topic files under `references/` (publishing, ssr-frameworks,
+  custom-domains, databases, functions, email, site-features, client-work).
+  `shiply skill` installs the whole bundle. Hosted copies:
+  `https://shiply.now/skill/references/<file>`. `https://shiply.now/llms.txt`
+  is now an index; the single-file everything version moved to
+  `https://shiply.now/llms-full.txt`. This log is served at
+  `https://shiply.now/changelog.md`.
+
+## 2026-06-28
+
+- **New** — group work by client: optional `client` (name or email) on
+  `publish_site` / `create_drive` / `create_project`, `--client` on the CLI,
+  `shiply client ls|show`, and `clientId` filters on list calls. The client
+  record self-assembles — no CRM step. (CLI 0.21.0)
+
+## 2026-06-27
+
+- **Update** — one-Allow-forever guidance: persist the device-flow API key to
+  `~/.shiply/credentials` (`{"apiKey":"shp_..."}`) so every future publish in
+  any session is owned automatically.
+
+## 2026-06-26
+
+- **New** — `shiply logs <slug>` + `GET /api/v1/sites/<slug>/logs`: real
+  per-site Worker runtime logs (7-day retention, newest-first). The MCP
+  `get_function_logs` tool returns the same real logs. (CLI 0.20.0)
+
+## 2026-06-25
+
+- **New** — the SSR lane is complete: SvelteKit, Astro, Qwik City, the Nitro
+  family (Nuxt, SolidStart, Analog, TanStack Start), React Router v7, and
+  Next.js (via OpenNext) all deploy server-side rendered with
+  `shiply publish .` after a build. (CLI 0.18.x–0.19.0)
+
+## 2026-06-23
+
+- **New** — site management batch: `shiply ls` / `rm` / `rollback` /
+  `verify` (stable `VERIFY status=…` marker) / `promote <preview> --to
+  <prod>` / `publish --as <name>` stable previews / `--json` machine output /
+  `.shiplyignore`. (CLI 0.17.0)
+
+## 2026-06-22
+
+- **New** — Agent Email: every owned site captures signups
+  (`POST /.shiply/email`), sends (`/api/v1/email/send`), reads its inbox, and
+  broadcasts to double-opt-in audiences.
+- **Update** — raw HTTP publish + finalize responses now include the
+  `toUpdate` string (the exact next-update call), matching MCP.
+
+## 2026-06-21
+
+- **New** — Contracts: draft from a project brief, customer e-signs in the
+  portal, amend after signing. MCP `contract_draft/send/amend/status/pdf`.
+
+## 2026-06-20
+
+- **New** — Functions (Workers Lite): `worker.js`/`worker.ts` at the publish
+  root deploys as a per-site Worker — webhooks, crons, secrets.
+- **New** — Projects (customer intake + AI brief), Marketplace (sell sites via
+  Stripe Connect), and Sending domains (BYO verified outbound domain) CLI +
+  MCP + REST surfaces.
+- **New** — custom domains: primary-subdomain selection with sibling 301s
+  (SEO); bring-your-own-auth pattern documented (Clerk/Auth.js/Supabase).
+
+## Earlier
+
+- Databases (free D1 + Neon Postgres with branching), Site Data
+  (zero-backend forms), proxy routes (server-side secret injection), access
+  control (password / invite-only), Drives (private storage), email demand
+  tests, device-flow auth (`agentName` on anonymous publish), anonymous
+  claim / pairing codes.