shiply-cli 0.25.1 → 0.26.0

package/dist/bundle.js

@@ -1,5 +1,6 @@
 import { spawnSync } from 'node:child_process';
-import { cp, mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
 import { builtinModules } from 'node:module';
 import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative } from 'node:path';
@@ -93,27 +94,109 @@ export async function prepareBundle(sourceDir, ssr, extras = {}) {
     });
     return out;
 }
+/** Fingerprint everything the wrangler dry-run bundle depends on: the build
+ *  output tree (path/size/mtime — content changes always touch these), the
+ *  wrangler config, and the project's wrangler version. Returns null when any
+ *  part can't be read — callers then skip the cache, never the bundle. */
+async function wranglerBundleCacheKey(sourceDir, ssr) {
+    try {
+        const h = createHash('sha256');
+        let wranglerVersion = '?';
+        try {
+            const pkg = JSON.parse(await readFile(join(sourceDir, 'node_modules', 'wrangler', 'package.json'), 'utf8'));
+            wranglerVersion = pkg.version ?? '?';
+        }
+        catch {
+            return null; // no local wrangler pin → can't trust a cached bundle
+        }
+        h.update(`wrangler@${wranglerVersion}\n`);
+        for (const cfg of ['wrangler.toml', 'wrangler.json', 'wrangler.jsonc']) {
+            try {
+                h.update(`${cfg}\n`).update(await readFile(join(sourceDir, cfg)));
+            }
+            catch {
+                /* absent config files simply don't contribute */
+            }
+        }
+        // Walk the build-output tree the worker entry lives in (e.g. .open-next/),
+        // excluding the static assets subtree — assets don't feed the bundle.
+        const root = join(sourceDir, dirname(ssr.workerEntry));
+        const excludeAbs = ssr.assetsDir ? join(sourceDir, ssr.assetsDir) : null;
+        const walk = async (dir) => {
+            const entries = await readdir(dir, { withFileTypes: true });
+            entries.sort((a, b) => (a.name < b.name ? -1 : 1));
+            for (const e of entries) {
+                const abs = join(dir, e.name);
+                if (excludeAbs && (abs === excludeAbs || abs.startsWith(excludeAbs + '\\') || abs.startsWith(excludeAbs + '/')))
+                    continue;
+                if (e.isDirectory()) {
+                    await walk(abs);
+                }
+                else if (e.isFile()) {
+                    const s = await stat(abs);
+                    h.update(`${relative(root, abs)}\0${s.size}\0${Math.round(s.mtimeMs)}\n`);
+                }
+            }
+        };
+        await walk(root);
+        return h.digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
 /** Next.js (OpenNext) path: let wrangler bundle the worker (its nodejs-compat
  *  bundler converts dynamic require('node:*') to top-level imports — esbuild
  *  can't), then deploy that worker multi-module with a hand-written asset-first
- *  entry. Two modules: index.js (entry) imports ./worker.js (wrangler's bundle). */
+ *  entry. Two modules: index.js (entry) imports ./worker.js (wrangler's bundle).
+ *
+ *  The wrangler bundle is CACHED per project (node_modules/.cache/shiply),
+ *  keyed on the build-output tree + wrangler config/version: the dry-run takes
+ *  ~20s on a real Next app, and a republish without a rebuild (retry, config
+ *  or content-elsewhere change) shouldn't pay it again. */
 async function stageWranglerBundle(sourceDir, ssr, out, bundleDir, extras = {}) {
-    const wtmp = await mkdtemp(join(tmpdir(), 'shiply-wrangler-'));
-    // `--dry-run` bundles without deploying (no CF auth needed). Local wrangler
-    // (OpenNext projects depend on it) is preferred via npx. shell:true → npx.cmd on Windows.
-    const res = spawnSync('npx', ['wrangler', 'deploy', '--dry-run', '--outdir', wtmp], {
-        cwd: sourceDir,
-        encoding: 'utf8',
-        shell: true,
-        env: { ...process.env, CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN ?? 'dry-run' },
-    });
-    const workerPath = join(wtmp, 'worker.js');
-    const built = await stat(workerPath).then((s) => s.isFile(), () => false);
-    if (!built) {
-        throw new Error(`wrangler could not bundle the ${ssr.framework} worker (is wrangler installed in the project?).\n` +
-            `${(res.stderr || res.stdout || '').slice(0, 1200)}`);
+    const cacheKey = await wranglerBundleCacheKey(sourceDir, ssr);
+    const cacheDir = join(sourceDir, 'node_modules', '.cache', 'shiply');
+    const cachedWorker = join(cacheDir, 'wrangler-worker.js');
+    const cachedKeyFile = join(cacheDir, 'wrangler-worker.key');
+    const cacheHit = cacheKey !== null &&
+        (await readFile(cachedKeyFile, 'utf8').then((k) => k === cacheKey, () => false)) &&
+        (await stat(cachedWorker).then((s) => s.isFile(), () => false));
+    if (cacheHit) {
+        await cp(cachedWorker, join(bundleDir, 'worker.js'));
+    }
+    else {
+        const wtmp = await mkdtemp(join(tmpdir(), 'shiply-wrangler-'));
+        // `--dry-run` bundles without deploying (no CF auth needed). Local wrangler
+        // (OpenNext projects depend on it) is preferred via npx. shell:true → npx.cmd on Windows.
+        const res = spawnSync('npx', ['wrangler', 'deploy', '--dry-run', '--outdir', wtmp], {
+            cwd: sourceDir,
+            encoding: 'utf8',
+            shell: true,
+            env: { ...process.env, CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN ?? 'dry-run' },
+        });
+        const workerPath = join(wtmp, 'worker.js');
+        const built = await stat(workerPath).then((s) => s.isFile(), () => false);
+        if (!built) {
+            throw new Error(`wrangler could not bundle the ${ssr.framework} worker (is wrangler installed in the project?).\n` +
+                `${(res.stderr || res.stdout || '').slice(0, 1200)}`);
+        }
+        await cp(workerPath, join(bundleDir, 'worker.js'));
+        if (cacheKey !== null) {
+            // Best-effort: populate the cache for the next publish. Write the worker
+            // FIRST so a torn write can only produce a stale-key miss, never a hit
+            // on a half-written worker.
+            try {
+                await mkdir(cacheDir, { recursive: true });
+                await cp(workerPath, cachedWorker);
+                await writeFile(cachedKeyFile, cacheKey);
+            }
+            catch {
+                /* cache is an optimization — never fail the publish over it */
+            }
+        }
+        await rm(wtmp, { recursive: true, force: true });
     }
-    await cp(workerPath, join(bundleDir, 'worker.js'));
     // Asset-first entry that defers to wrangler's worker. Hand-written (not
     // esbuild) so we never re-process wrangler's correctly-bundled output.
     // OpenNext's worker ALSO calls env.ASSETS itself and treats any non-404 as an
@@ -150,7 +233,6 @@ async function stageWranglerBundle(sourceDir, ssr, out, bundleDir, extras = {})
         compatibilityFlags: ssr.compatibilityFlags,
         isr: extras.isr,
     });
-    await rm(wtmp, { recursive: true, force: true });
 }
 async function writeManifest(out, m) {
     // Drop an undefined `isr` so static/non-Next bundles keep a clean manifest.

package/dist/index.js

@@ -409,11 +409,30 @@ async function main() {
                         anonymous: res.anonymous,
                         expiresAt: res.expiresAt,
                         updated: updating,
+                        ...(res.function ? { function: res.function } : {}),
                     })}\n`);
                     return;
                 }
                 const skipped = res.skipped > 0 ? ` (${res.skipped} unchanged, skipped)` : '';
                 console.log(`✔ ${updating ? `updated ${res.slug} in place` : 'published'} — ${res.uploaded} file${res.uploaded === 1 ? '' : 's'}${skipped}`);
+                // A failed function/bundle deploy does NOT fail the publish (static
+                // files still went live) — but a worker-backed site is broken without
+                // its worker, so surface the server's errors instead of swallowing them.
+                if (res.function?.errors?.length) {
+                    console.error(`\n✖ function deploy FAILED — the site's worker is NOT live:`);
+                    for (const err of res.function.errors)
+                        console.error(`    ${err}`);
+                    // A worker source was present but did not deploy: the site is not what
+                    // the user shipped, so exit non-zero. Static files DID go live, hence
+                    // we still print the URL below — but automation/CI must see the failure.
+                    process.exitCode = 1;
+                }
+                else if (res.function?.deployed) {
+                    const crons = res.function.cronCount ? ` (${res.function.cronCount} cron${res.function.cronCount === 1 ? '' : 's'})` : '';
+                    console.log(`  function deployed${crons}`);
+                }
+                for (const hint of res.function?.hints ?? [])
+                    console.log(`    ${hint}`);
                 console.log(`\n  ${res.siteUrl}\n`);
                 // confirm the site actually serves, then celebrate
                 try {

package/dist/manifest.js

@@ -35,14 +35,32 @@ const MIME = {
 };
 export const contentTypeFor = (path) => MIME[extname(path).toLowerCase()] ?? 'application/octet-stream';
 const SKIP_DIRS = new Set(['node_modules']);
+/** Reads+hashes run concurrently — hashing a large build serially left ~1-3s
+ *  on the table for a few hundred files. */
+const HASH_CONCURRENCY = 8;
 /** Walk a directory into the publish manifest: posix-relative paths, byte
  *  sizes, sha256 hex hashes (server hash-skips unchanged files on update).
  *  Dot entries and node_modules are never published — except the .shiply/
  *  config directory (proxy.json, data.json), which the server consumes. */
 export async function buildManifest(dir) {
-    const out = [];
+    const targets = [];
     const ignore = await loadIgnore(dir);
-    await walk(dir, '', out, ignore);
+    await walk(dir, '', targets, ignore);
+    const out = new Array(targets.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < targets.length) {
+            const i = next++;
+            const buf = await readFile(targets[i].abs);
+            out[i] = {
+                path: targets[i].rel,
+                size: buf.length,
+                contentType: contentTypeFor(targets[i].rel),
+                hash: createHash('sha256').update(buf).digest('hex'),
+            };
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(HASH_CONCURRENCY, targets.length) }, worker));
     return out.sort((a, b) => a.path.localeCompare(b.path));
 }
 async function walk(abs, rel, out, ignore) {
@@ -67,13 +85,7 @@ async function walk(abs, rel, out, ignore) {
             await walk(childAbs, childRel, out, ignore);
         }
         else if (e.isFile()) {
-            const buf = await readFile(childAbs);
-            out.push({
-                path: childRel,
-                size: buf.length,
-                contentType: contentTypeFor(e.name),
-                hash: createHash('sha256').update(buf).digest('hex'),
-            });
+            out.push({ abs: childAbs, rel: childRel });
         }
     }
 }

package/dist/publish.js

@@ -52,8 +52,8 @@ export async function fetchWithRetry(url, init, opts = {}) {
     }
     throw new Error(`request to ${label} failed after ${attempts} attempts: ${lastErr?.message ?? 'unknown error'}`);
 }
-export async function api(url, init) {
-    const res = await fetchWithRetry(url, init, { label: `${init.method ?? 'GET'} ${url}` });
+export async function api(url, init, opts = {}) {
+    const res = await fetchWithRetry(url, init, { label: `${init.method ?? 'GET'} ${url}`, ...opts });
     const body = await res.json().catch(() => ({}));
     if (!res.ok) {
         const err = body.error;
@@ -87,12 +87,32 @@ export async function publish(dir, opts = {}) {
         }),
     });
     await uploadAll(dir, created.upload.uploads);
-    await api(created.upload.finalizeUrl, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ versionId: created.upload.versionId }),
-    });
+    // Finalize deploys any worker bundle server-side, which can exceed the
+    // default 60s timeout — an aborted-then-retried finalize used to fail the
+    // whole publish with "already finalized" even though the deploy succeeded.
+    // Give it room, and treat that conflict as the success it is (an earlier
+    // attempt completed after the client gave up on it).
+    // Say what's happening — finalize is one server-side call (file verification
+    // + worker deploy) and used to be a silent multi-minute gap for big bundles.
+    process.stderr.write('  ⋯ finalizing — server is verifying files and deploying the worker…\n');
+    let finalized;
+    try {
+        finalized = await api(created.upload.finalizeUrl, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ versionId: created.upload.versionId }),
+        }, { timeoutMs: 300_000 });
+    }
+    catch (e) {
+        if (e instanceof ApiError && e.code === 'conflict' && /already finalized/.test(e.message)) {
+            finalized = {}; // deployed by the earlier attempt; function info unavailable
+        }
+        else {
+            throw e;
+        }
+    }
     return {
+        ...(finalized.function ? { function: finalized.function } : {}),
         siteId: created.siteId,
         slug: created.slug,
         siteUrl: created.siteUrl,

package/dist/ssr-adapters.js

@@ -77,12 +77,13 @@ export async function detectSsr(dir) {
             // (esbuild shims it). The wrangler path applies asset-first in its own entry.
             bundleWith: 'wrangler',
             compatibilityFlags: ['nodejs_compat', 'global_fetch_strictly_public'],
-            // OpenNext imports `node:http`, which `nodejs_compat` only provides at a
-            // compat date >= ~2025-09 (verified: 2025-03-25 fails "No such module
-            // node:http", 2025-09-01 succeeds). OpenNext's own config bakes an older
-            // date that passes `wrangler --dry-run` (which doesn't validate runtime
-            // modules) but fails the real Workers upload — so we override it here.
-            compatibilityDate: '2025-09-01',
+            // OpenNext needs a modern compat date for its node:* imports: 2025-03-25
+            // fails "No such module node:http"; @opennextjs/cloudflare 1.20.x also
+            // imports `node:fs`, which 2025-09-01 still lacks (real upload fails —
+            // wrangler --dry-run doesn't validate runtime modules, and OpenNext's own
+            // config bakes an even older date). 2026-06-01 verified live with a
+            // Next 15 + OpenNext 1.20 deploy — so we override it here.
+            compatibilityDate: '2026-06-01',
         };
     }
     // Generic Cloudflare Worker via a wrangler config (Hono, itty, raw fetch).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "shiply-cli",
-  "version": "0.25.1",
-  "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
+  "version": "0.26.0",
+  "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
   "license": "MIT",
   "type": "module",
   "bin": {

package/skill/CHANGELOG.md

@@ -6,6 +6,21 @@ entry here, that capability may be missing from your copy — re-install with
 (This is the agent-facing capability log; the CLI's own release notes live in
 the npm package changelog.)
 
+## 2026-07-07
+
+- **Fix** — custom domains attached to SSR/function sites no longer 404: the
+  platform's per-site access gate resolved requests by the wrong hostname on
+  custom-domain dispatch. No action needed; already-deployed sites are fixed
+  server-side, and the next publish bakes in the hardened gate.
+- **Fix** — `shiply publish` now surfaces server-side function/bundle deploy
+  errors and hints (previously discarded — a broken worker deploy looked like
+  a successful publish). Also included in `--json` output as `function`.
+- **Fix** — Next.js (OpenNext) deploys use compatibility date `2026-06-01`
+  (@opennextjs/cloudflare 1.20.x imports `node:fs`; the old date failed the
+  Workers upload with "No such module node:fs").
+- **Fix** — long finalize calls (large worker bundles) no longer abort at 60s
+  and mis-report a successful deploy as "already finalized".
+
 ## 2026-07-04
 
 - **Update** — the site-relative endpoints (`POST /.shiply/data/<collection>`,