shiply-cli 0.25.2 → 0.26.1

package/dist/bundle.js

@@ -1,5 +1,6 @@
 import { spawnSync } from 'node:child_process';
-import { cp, mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
 import { builtinModules } from 'node:module';
 import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative } from 'node:path';
@@ -93,27 +94,109 @@ export async function prepareBundle(sourceDir, ssr, extras = {}) {
     });
     return out;
 }
+/** Fingerprint everything the wrangler dry-run bundle depends on: the build
+ *  output tree (path/size/mtime — content changes always touch these), the
+ *  wrangler config, and the project's wrangler version. Returns null when any
+ *  part can't be read — callers then skip the cache, never the bundle. */
+async function wranglerBundleCacheKey(sourceDir, ssr) {
+    try {
+        const h = createHash('sha256');
+        let wranglerVersion = '?';
+        try {
+            const pkg = JSON.parse(await readFile(join(sourceDir, 'node_modules', 'wrangler', 'package.json'), 'utf8'));
+            wranglerVersion = pkg.version ?? '?';
+        }
+        catch {
+            return null; // no local wrangler pin → can't trust a cached bundle
+        }
+        h.update(`wrangler@${wranglerVersion}\n`);
+        for (const cfg of ['wrangler.toml', 'wrangler.json', 'wrangler.jsonc']) {
+            try {
+                h.update(`${cfg}\n`).update(await readFile(join(sourceDir, cfg)));
+            }
+            catch {
+                /* absent config files simply don't contribute */
+            }
+        }
+        // Walk the build-output tree the worker entry lives in (e.g. .open-next/),
+        // excluding the static assets subtree — assets don't feed the bundle.
+        const root = join(sourceDir, dirname(ssr.workerEntry));
+        const excludeAbs = ssr.assetsDir ? join(sourceDir, ssr.assetsDir) : null;
+        const walk = async (dir) => {
+            const entries = await readdir(dir, { withFileTypes: true });
+            entries.sort((a, b) => (a.name < b.name ? -1 : 1));
+            for (const e of entries) {
+                const abs = join(dir, e.name);
+                if (excludeAbs && (abs === excludeAbs || abs.startsWith(excludeAbs + '\\') || abs.startsWith(excludeAbs + '/')))
+                    continue;
+                if (e.isDirectory()) {
+                    await walk(abs);
+                }
+                else if (e.isFile()) {
+                    const s = await stat(abs);
+                    h.update(`${relative(root, abs)}\0${s.size}\0${Math.round(s.mtimeMs)}\n`);
+                }
+            }
+        };
+        await walk(root);
+        return h.digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
 /** Next.js (OpenNext) path: let wrangler bundle the worker (its nodejs-compat
  *  bundler converts dynamic require('node:*') to top-level imports — esbuild
  *  can't), then deploy that worker multi-module with a hand-written asset-first
- *  entry. Two modules: index.js (entry) imports ./worker.js (wrangler's bundle). */
+ *  entry. Two modules: index.js (entry) imports ./worker.js (wrangler's bundle).
+ *
+ *  The wrangler bundle is CACHED per project (node_modules/.cache/shiply),
+ *  keyed on the build-output tree + wrangler config/version: the dry-run takes
+ *  ~20s on a real Next app, and a republish without a rebuild (retry, config
+ *  or content-elsewhere change) shouldn't pay it again. */
 async function stageWranglerBundle(sourceDir, ssr, out, bundleDir, extras = {}) {
-    const wtmp = await mkdtemp(join(tmpdir(), 'shiply-wrangler-'));
-    // `--dry-run` bundles without deploying (no CF auth needed). Local wrangler
-    // (OpenNext projects depend on it) is preferred via npx. shell:true → npx.cmd on Windows.
-    const res = spawnSync('npx', ['wrangler', 'deploy', '--dry-run', '--outdir', wtmp], {
-        cwd: sourceDir,
-        encoding: 'utf8',
-        shell: true,
-        env: { ...process.env, CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN ?? 'dry-run' },
-    });
-    const workerPath = join(wtmp, 'worker.js');
-    const built = await stat(workerPath).then((s) => s.isFile(), () => false);
-    if (!built) {
-        throw new Error(`wrangler could not bundle the ${ssr.framework} worker (is wrangler installed in the project?).\n` +
-            `${(res.stderr || res.stdout || '').slice(0, 1200)}`);
+    const cacheKey = await wranglerBundleCacheKey(sourceDir, ssr);
+    const cacheDir = join(sourceDir, 'node_modules', '.cache', 'shiply');
+    const cachedWorker = join(cacheDir, 'wrangler-worker.js');
+    const cachedKeyFile = join(cacheDir, 'wrangler-worker.key');
+    const cacheHit = cacheKey !== null &&
+        (await readFile(cachedKeyFile, 'utf8').then((k) => k === cacheKey, () => false)) &&
+        (await stat(cachedWorker).then((s) => s.isFile(), () => false));
+    if (cacheHit) {
+        await cp(cachedWorker, join(bundleDir, 'worker.js'));
+    }
+    else {
+        const wtmp = await mkdtemp(join(tmpdir(), 'shiply-wrangler-'));
+        // `--dry-run` bundles without deploying (no CF auth needed). Local wrangler
+        // (OpenNext projects depend on it) is preferred via npx. shell:true → npx.cmd on Windows.
+        const res = spawnSync('npx', ['wrangler', 'deploy', '--dry-run', '--outdir', wtmp], {
+            cwd: sourceDir,
+            encoding: 'utf8',
+            shell: true,
+            env: { ...process.env, CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN ?? 'dry-run' },
+        });
+        const workerPath = join(wtmp, 'worker.js');
+        const built = await stat(workerPath).then((s) => s.isFile(), () => false);
+        if (!built) {
+            throw new Error(`wrangler could not bundle the ${ssr.framework} worker (is wrangler installed in the project?).\n` +
+                `${(res.stderr || res.stdout || '').slice(0, 1200)}`);
+        }
+        await cp(workerPath, join(bundleDir, 'worker.js'));
+        if (cacheKey !== null) {
+            // Best-effort: populate the cache for the next publish. Write the worker
+            // FIRST so a torn write can only produce a stale-key miss, never a hit
+            // on a half-written worker.
+            try {
+                await mkdir(cacheDir, { recursive: true });
+                await cp(workerPath, cachedWorker);
+                await writeFile(cachedKeyFile, cacheKey);
+            }
+            catch {
+                /* cache is an optimization — never fail the publish over it */
+            }
+        }
+        await rm(wtmp, { recursive: true, force: true });
     }
-    await cp(workerPath, join(bundleDir, 'worker.js'));
     // Asset-first entry that defers to wrangler's worker. Hand-written (not
     // esbuild) so we never re-process wrangler's correctly-bundled output.
     // OpenNext's worker ALSO calls env.ASSETS itself and treats any non-404 as an
@@ -150,7 +233,6 @@ async function stageWranglerBundle(sourceDir, ssr, out, bundleDir, extras = {})
         compatibilityFlags: ssr.compatibilityFlags,
         isr: extras.isr,
     });
-    await rm(wtmp, { recursive: true, force: true });
 }
 async function writeManifest(out, m) {
     // Drop an undefined `isr` so static/non-Next bundles keep a clean manifest.

package/dist/framework.js

@@ -8,9 +8,14 @@ const SSG_SIGNATURES = [
     { files: ['mkdocs.yml', 'mkdocs.yaml'], framework: 'MkDocs', outputDir: 'site', buildCommand: 'mkdocs build' },
 ];
 async function detectStaticSiteGenerator(dir) {
+    // Check every signature file in parallel, then pick the first match in the
+    // original priority order — same result as the serial version, faster I/O.
+    const flatFiles = SSG_SIGNATURES.flatMap((sig) => sig.files);
+    const hits = await Promise.all(flatFiles.map((f) => exists(join(dir, f))));
+    let i = 0;
     for (const sig of SSG_SIGNATURES) {
         for (const f of sig.files) {
-            if (await exists(join(dir, f))) {
+            if (hits[i++]) {
                 return { framework: sig.framework, outputDir: sig.outputDir, spa: false, buildCommand: sig.buildCommand };
             }
         }

package/dist/index.js

@@ -422,6 +422,10 @@ async function main() {
                     console.error(`\n✖ function deploy FAILED — the site's worker is NOT live:`);
                     for (const err of res.function.errors)
                         console.error(`    ${err}`);
+                    // A worker source was present but did not deploy: the site is not what
+                    // the user shipped, so exit non-zero. Static files DID go live, hence
+                    // we still print the URL below — but automation/CI must see the failure.
+                    process.exitCode = 1;
                 }
                 else if (res.function?.deployed) {
                     const crons = res.function.cronCount ? ` (${res.function.cronCount} cron${res.function.cronCount === 1 ? '' : 's'})` : '';

package/dist/manifest.js

@@ -35,14 +35,32 @@ const MIME = {
 };
 export const contentTypeFor = (path) => MIME[extname(path).toLowerCase()] ?? 'application/octet-stream';
 const SKIP_DIRS = new Set(['node_modules']);
+/** Reads+hashes run concurrently — hashing a large build serially left ~1-3s
+ *  on the table for a few hundred files. */
+const HASH_CONCURRENCY = 8;
 /** Walk a directory into the publish manifest: posix-relative paths, byte
  *  sizes, sha256 hex hashes (server hash-skips unchanged files on update).
  *  Dot entries and node_modules are never published — except the .shiply/
  *  config directory (proxy.json, data.json), which the server consumes. */
 export async function buildManifest(dir) {
-    const out = [];
+    const targets = [];
     const ignore = await loadIgnore(dir);
-    await walk(dir, '', out, ignore);
+    await walk(dir, '', targets, ignore);
+    const out = new Array(targets.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < targets.length) {
+            const i = next++;
+            const buf = await readFile(targets[i].abs);
+            out[i] = {
+                path: targets[i].rel,
+                size: buf.length,
+                contentType: contentTypeFor(targets[i].rel),
+                hash: createHash('sha256').update(buf).digest('hex'),
+            };
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(HASH_CONCURRENCY, targets.length) }, worker));
     return out.sort((a, b) => a.path.localeCompare(b.path));
 }
 async function walk(abs, rel, out, ignore) {
@@ -67,13 +85,7 @@ async function walk(abs, rel, out, ignore) {
             await walk(childAbs, childRel, out, ignore);
         }
         else if (e.isFile()) {
-            const buf = await readFile(childAbs);
-            out.push({
-                path: childRel,
-                size: buf.length,
-                contentType: contentTypeFor(e.name),
-                hash: createHash('sha256').update(buf).digest('hex'),
-            });
+            out.push({ abs: childAbs, rel: childRel });
         }
     }
 }

package/dist/publish.js

@@ -92,6 +92,9 @@ export async function publish(dir, opts = {}) {
     // whole publish with "already finalized" even though the deploy succeeded.
     // Give it room, and treat that conflict as the success it is (an earlier
     // attempt completed after the client gave up on it).
+    // Say what's happening — finalize is one server-side call (file verification
+    // + worker deploy) and used to be a silent multi-minute gap for big bundles.
+    process.stderr.write('  ⋯ finalizing — server is verifying files and deploying the worker…\n');
     let finalized;
     try {
         finalized = await api(created.upload.finalizeUrl, {
@@ -129,8 +132,14 @@ async function uploadAll(dir, targets) {
             const t = targets[next++];
             const body = await readFile(join(dir, t.path));
             const res = await fetchWithRetry(t.url, { method: t.method, headers: t.headers, body }, { label: `upload ${t.path}` });
-            if (!res.ok)
+            if (!res.ok) {
+                if (res.status === 403) {
+                    throw new Error(`upload failed for ${t.path}: HTTP 403 — presigned URLs likely expired ` +
+                        `(they're short-lived). Re-run \`shiply publish\` to mint fresh ones — ` +
+                        `unchanged files are hash-skipped, so the retry is cheap.`);
+                }
                 throw new Error(`upload failed for ${t.path}: HTTP ${res.status}`);
+            }
         }
     };
     await Promise.all(Array.from({ length: Math.min(CONCURRENCY, targets.length) }, worker));

package/package.json

@@ -1,42 +1,42 @@
-{
-  "name": "shiply-cli",
-  "version": "0.25.2",
-  "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "shiply": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "skill",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "pnpm build",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "shiply",
-    "hosting",
-    "static",
-    "deploy",
-    "agents",
-    "publish"
-  ],
-  "homepage": "https://shiply.now",
-  "devDependencies": {
-    "@types/node": "^22.15.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.1.0"
-  },
-  "dependencies": {
-    "esbuild": "^0.25.12",
-    "smol-toml": "^1.7.0"
-  }
-}
+{
+  "name": "shiply-cli",
+  "version": "0.26.1",
+  "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "shiply": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "skill",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "pnpm build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "shiply",
+    "hosting",
+    "static",
+    "deploy",
+    "agents",
+    "publish"
+  ],
+  "homepage": "https://shiply.now",
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.1.0"
+  },
+  "dependencies": {
+    "esbuild": "^0.25.12",
+    "smol-toml": "^1.7.0"
+  }
+}

package/skill/CHANGELOG.md

@@ -6,6 +6,17 @@ entry here, that capability may be missing from your copy — re-install with
 (This is the agent-facing capability log; the CLI's own release notes live in
 the npm package changelog.)
 
+## 2026-07-08
+
+- **Fix** — re-publishing an unchanged large SSR site (e.g. a 171-file
+  Next.js build) used to take 6+ minutes (serial hash-skip HEAD checks, a
+  serial worker-bundle re-read/re-upload even with no changes, plus a
+  finalize retry after a client-side timeout). Finalize is now: concurrent
+  hash-skip checks, a fingerprinted worker-bundle deploy that's skipped
+  entirely when nothing changed, and an idempotent replay on retry. A
+  zero-change publish now finishes in seconds. No action needed — always
+  re-publish to the same site (slug/claimToken); it's cheap.
+
 ## 2026-07-07
 
 - **Fix** — custom domains attached to SSR/function sites no longer 404: the

package/skill/SKILL.md

@@ -13,7 +13,7 @@ description: "shiply is the production backend for anything an agent builds —
 > the npm package name.
 
 > **Skill freshness check.** Shiply ships new capabilities weekly.
-> **This skill: version 0.25.0, last updated 2026-07-04.**
+> **This skill: version 0.25.0, last updated 2026-07-08.**
 > To see what changed since your copy was written, fetch
 > `https://shiply.now/changelog.md` (date-grouped, newest first) — if it lists
 > capabilities newer than the date above, re-install with
@@ -31,7 +31,14 @@ description: "shiply is the production backend for anything an agent builds —
 **How (quickstart).** `shiply publish ./dir` (CLI) — or POST /api/v1/publish → PUT each file → POST finalize — returns a live URL + claimToken.
 
 **NEVER create a new site to update an existing one. Always re-publish to the
-same site** — otherwise you litter subdomains and lose the user's URL.
+same site** (same slug/claimToken) — otherwise you litter subdomains and lose
+the user's URL.
+
+**Re-publishing the same site is cheap — always prefer it over a new site.**
+Unchanged files are hash-skipped, and an unchanged SSR worker bundle skips
+redeploy entirely (fingerprinted against what's already live). A zero-change
+`shiply publish` on the same site completes in seconds, even for large SSR
+apps — so iterate freely by re-publishing, never by spinning up a fresh site.
 
 This file covers the core path: publish → authorize → update → claim → verify.
 Everything else (databases, domains, SSR, email, functions, client work) lives