shiply-cli 0.27.2 → 0.29.0

package/dist/access.js

@@ -0,0 +1,54 @@
+import { api, resolveBase } from './publish.js';
+const headers = (apiKey) => ({
+    'content-type': 'application/json',
+    authorization: `Bearer ${apiKey}`,
+});
+/** Stable machine marker (mirrors SITE_READY / VERIFY) so agents can parse the
+ *  policy without scraping the human lines. Counts, not values — emails can
+ *  contain characters that would break k=v tokenizing. */
+function marker(slug, p) {
+    return `ACCESS slug=${slug} mode=${p.mode} password=${p.hasPassword ? 'set' : 'none'} emails=${p.allowedEmails.length} domains=${p.allowedDomains.length}`;
+}
+function printPolicy(slug, p) {
+    if (p.mode === 'public') {
+        console.log(`  ${slug} is public — anyone with the URL can view it`);
+    }
+    else if (p.mode === 'password') {
+        console.log(`  ${slug} is password-protected${p.hasPassword ? '' : ' (no password set yet — visitors are locked out)'}`);
+    }
+    else {
+        console.log(`  ${slug} is invite-only (restricted)`);
+        for (const e of p.allowedEmails)
+            console.log(`    email:  ${e}`);
+        for (const d of p.allowedDomains)
+            console.log(`    domain: @${d.replace(/^@/, '')}`);
+        if (p.allowedEmails.length === 0 && p.allowedDomains.length === 0) {
+            console.log('    (no emails or domains allowed — only the owner can view)');
+        }
+    }
+    console.log(marker(slug, p));
+}
+export async function accessShow(ctx, slug) {
+    const base = resolveBase(ctx.base);
+    const p = await api(`${base}/api/v1/publishes/${encodeURIComponent(slug)}/access`, {
+        headers: headers(ctx.apiKey),
+    });
+    printPolicy(slug, p);
+}
+export async function accessSet(ctx, slug, input) {
+    const base = resolveBase(ctx.base);
+    const body = { mode: input.mode };
+    if (input.mode === 'password')
+        body.password = input.password;
+    if (input.mode === 'restricted') {
+        body.allowedEmails = input.allowedEmails ?? [];
+        body.allowedDomains = input.allowedDomains ?? [];
+    }
+    const p = await api(`${base}/api/v1/publishes/${encodeURIComponent(slug)}/access`, {
+        method: 'PATCH',
+        headers: headers(ctx.apiKey),
+        body: JSON.stringify(body),
+    });
+    console.log(`✔ access updated — existing visitor cookies are now invalid`);
+    printPolicy(slug, p);
+}

package/dist/data.js

@@ -105,6 +105,7 @@ export async function dataExport(ctx, slug, collection, opts) {
 export async function dataWipeCollection(ctx, slug, collection, opts) {
     if (!opts.yes) {
         console.error(`  refusing — wipe-collection deletes EVERY record in "${collection}" on ${slug}. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/db.js

@@ -144,6 +144,7 @@ export async function dbMigrate(ctx, idOrName, dir) {
 export async function dbDelete(ctx, idOrName, opts) {
     if (!opts.yes) {
         console.log(`  refusing — \`db delete\` drops the database "${idOrName}" and every row in it. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const id = await resolveId(ctx, idOrName);
@@ -195,6 +196,7 @@ export async function dbBranches(ctx, parentNameOrId) {
 export async function dbDeleteBranch(ctx, branchIdOrName, opts) {
     if (!opts.yes) {
         console.log(`  refusing — \`db delete-branch\` drops the branch "${branchIdOrName}" and its Neon endpoint. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/domain.js

@@ -143,6 +143,36 @@ export async function domainPrimary(ctx, domain, hostname) {
             console.log(`    ${s.hostname}`);
     }
 }
+export async function domainRm(ctx, domain, opts = {}) {
+    if (!opts.yes) {
+        throw new Error(`refusing to remove ${domain} without --yes (subdomains mapped to it stop resolving)`);
+    }
+    const base = resolveBase(ctx.base);
+    const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}`, {
+        method: 'DELETE',
+        headers: headers(ctx.apiKey),
+    });
+    console.log(`✔ removed ${r.removed}`);
+}
+/** Re-poll CF cert status + live TLS/HTTPS probe for all subdomains of a
+ *  registered custom domain. Run this after `domain connect` / `domain sub add`
+ *  until every subdomain reports ready=true. */
+export async function domainCheck(ctx, domain) {
+    const base = resolveBase(ctx.base);
+    const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}/check`, {
+        method: 'POST',
+        headers: headers(ctx.apiKey),
+        body: '{}',
+    });
+    if (!r.subdomains?.length) {
+        console.log(`No subdomains mapped under ${domain} yet. shiply domain sub add <host> --site <slug>`);
+        return;
+    }
+    for (const s of r.subdomains) {
+        console.log(`  ${s.hostname}  ${s.ready ? '✔ ready' : '✖ not ready'}`);
+        console.log(`DOMAIN_CHECK hostname=${s.hostname} ready=${s.ready}`);
+    }
+}
 export async function domainSync(ctx, domain) {
     const base = resolveBase(ctx.base);
     const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}/sync-dns`, { method: 'POST', headers: headers(ctx.apiKey), body: '{}' });

package/dist/drive.js

@@ -30,8 +30,12 @@ export async function drivePut(ctx, file, asPath) {
     const stage = await api(`${base}/api/v1/drives/${id}/files/uploads`, { method: 'POST', headers: headers(ctx.apiKey), body: JSON.stringify({ files: [meta] }) });
     for (const u of stage.uploads) {
         const res = await fetch(u.url, { method: 'PUT', body: new Uint8Array(body) });
-        if (!res.ok)
-            throw new Error(`upload failed for ${u.path}`);
+        if (!res.ok) {
+            if (res.status === 401 || res.status === 403) {
+                throw new Error(`upload failed for ${u.path}: HTTP ${res.status} — the upload URL is not authorized. Re-run \`shiply drive put\` to mint a fresh one.`);
+            }
+            throw new Error(`upload failed for ${u.path}: HTTP ${res.status} — the object store rejected the file. Re-run \`shiply drive put\`; if it keeps failing, check the file size/name.`);
+        }
     }
     await api(`${base}/api/v1/drives/${id}/files/finalize`, {
         method: 'POST',
@@ -45,8 +49,15 @@ export async function driveGet(ctx, path, out) {
     const id = await defaultDrive(ctx);
     const { url } = await api(`${base}/api/v1/drives/${id}/files/${path.split('/').map(encodeURIComponent).join('/')}`, { headers: headers(ctx.apiKey) });
     const res = await fetch(url);
-    if (!res.ok)
-        throw new Error(`download failed (${res.status})`);
+    if (!res.ok) {
+        if (res.status === 404) {
+            throw new Error(`download failed: HTTP 404 — no file at "${path}" in this drive. Check the path with \`shiply drive ls\`.`);
+        }
+        if (res.status === 401 || res.status === 403) {
+            throw new Error(`download failed: HTTP ${res.status} — the download URL is not authorized. Re-run \`shiply drive get\` to mint a fresh one.`);
+        }
+        throw new Error(`download failed: HTTP ${res.status} for "${path}" — re-run \`shiply drive get\`; if it keeps failing, the object may be corrupted.`);
+    }
     const buf = Buffer.from(await res.arrayBuffer());
     if (out) {
         await writeFile(out, buf);

package/dist/index.js

@@ -15,7 +15,7 @@ import { detectIsr } from './isr.js';
 import { runClaimVerify } from './claim.js';
 import { dbAttach, dbBranch, dbBranches, dbCreate, dbDelete, dbDeleteBranch, dbLs, dbMerge, dbMigrate, dbSql, } from './db.js';
 import { driveGet, driveLs, drivePublish, drivePut, driveRm } from './drive.js';
-import { domainAdd, domainConnect, domainLs, domainPrimary, domainSubAdd, domainSync } from './domain.js';
+import { domainAdd, domainCheck, domainConnect, domainLs, domainPrimary, domainRm, domainSubAdd, domainSync } from './domain.js';
 import { runProject } from './projects.js';
 import { runClient, parseClientArg } from './clients.js';
 import { runListing } from './listings.js';
@@ -33,8 +33,10 @@ import { readState, writeState } from './state.js';
 import { readPreview, writePreview } from './previews.js';
 import { checkReadiness, targetToHostname } from './status.js';
 import { runStatus } from './status-cmd.js';
+import { accessSet, accessShow } from './access.js';
 import { sitesLs, sitesPromote, sitesRm, sitesRollback } from './sites.js';
 import { verifySite } from './verify.js';
+import { variableAttach, variableDetach, variableLs, variableRm, variableSet } from './variable.js';
 // Resolve the package.json beside the compiled dist/ so `shiply --version`
 // can print the running CLI version (works in dev tsc output + npm install).
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -62,6 +64,10 @@ Usage:
   shiply status <slug-or-domain> [--wait]     SSL + readiness check (agent-friendly output)
                                               (no arg → account/plan status, see below)
   shiply duplicate <slug>                     Server-side copy of an owned site → new URL
+  shiply ls                                   List sites in your account
+  shiply rm <slug> --yes                      Permanently delete an owned site
+  shiply rollback <slug> [versionId]          Re-point a site to a prior finalized deploy
+                                              (omit versionId to list deploys and pick one)
   shiply promote <preview-slug> --to <dest-slug>
                                               Copy the exact previewed bytes into a production site (no rebuild)
   shiply detect [dir]                         Diagnose: print framework + dir that would upload
@@ -75,12 +81,26 @@ Usage:
   shiply db branches <db>                      List branches of a Neon database
   shiply db delete-branch <branch-or-id> --yes Delete a Neon branch
   shiply db merge <branch>                     No-op alias — prints the pg_dump migration tip
+  shiply access <slug>                        Show who can view the site (public/password/restricted)
+  shiply access <slug> --public               Open the site to everyone
+  shiply access <slug> --password <pw>        Password-protect the site (paid plan)
+  shiply access <slug> --restricted --email a@b.com --domain example.com
+                                              Invite-only: only listed emails / email domains
+                                              (--email/--domain repeatable; replaces the previous lists)
   shiply domain ls                            List custom domains on your account
   shiply domain add <domain>                  Register a custom domain
   shiply domain connect <domain>              One-click OAuth DNS setup (Cloudflare/Domain Connect)
   shiply domain sub add <host> --site <slug>  Map a subdomain (e.g. app.example.com) to a slug
   shiply domain sync <domain>                 Re-sync DNS records for a connected domain
   shiply domain primary <domain> <hostname>   Mark hostname as primary; siblings 301-redirect (SEO)
+  shiply domain check <domain>                Re-poll cert/DNS/HTTPS readiness for every subdomain
+  shiply domain rm <domain> --yes             Remove a custom domain (its subdomains stop resolving)
+  shiply variable <ls|set|rm|attach|detach>   Account-level encrypted variables (e.g. API keys for sites)
+  shiply variable set <NAME> <value>          Save/update a variable (or: --stdin to read the value)
+  shiply variable ls [--reveal]               List variables (masked by default)
+  shiply variable rm <NAME> --yes             Delete a variable
+  shiply variable attach <NAME> --site <slug> Expose a saved variable to one site's Worker env
+  shiply variable detach <NAME> --site <slug> Stop exposing a variable to a site's Worker env
   shiply project <ls|create|get|archive|restore>
                                               Customer-intake projects + AI brief generator
   shiply project create <label> [--customer-email <e>] [--customer-name <n>]
@@ -213,7 +233,7 @@ async function main() {
     // parseArgs sees it. (A prior lookahead that cancelled the flag when a
     // positional followed made `shiply publish --json ./dist` swallow the dir as
     // the --json value, leaving no <dir>.)
-    const BARE_JSON_CMDS = new Set(['status', 'publish', 'update', 'logs']);
+    const BARE_JSON_CMDS = new Set(['status', 'publish', 'update', 'logs', 'variable']);
     const bareJsonFlag = BARE_JSON_CMDS.has(rawArgv[0]) && rawArgv.includes('--json');
     if (bareJsonFlag) {
         const idx = rawArgv.indexOf('--json');
@@ -231,7 +251,13 @@ async function main() {
             key: { type: 'string' },
             anonymous: { type: 'boolean' },
             base: { type: 'string' },
-            email: { type: 'string' },
+            // `--email` is repeatable for `access --restricted`; `login --email` uses
+            // the last value. `--domain` is the access counterpart for whole domains.
+            email: { type: 'string', multiple: true },
+            domain: { type: 'string', multiple: true },
+            public: { type: 'boolean' },
+            password: { type: 'string' },
+            restricted: { type: 'boolean' },
             name: { type: 'string' },
             as: { type: 'string' },
             wait: { type: 'boolean' },
@@ -250,6 +276,8 @@ async function main() {
             ts: { type: 'boolean' },
             'preview-branch': { type: 'string' },
             yes: { type: 'boolean' },
+            reveal: { type: 'boolean' },
+            stdin: { type: 'boolean' },
             'no-confetti': { type: 'boolean' },
             json: { type: 'string' },
             limit: { type: 'string' },
@@ -617,6 +645,47 @@ async function main() {
             process.exitCode = ready ? 0 : 1;
             return;
         }
+        case 'access': {
+            const usage = 'usage: shiply access <slug> [--public | --password <pw> | --restricted --email a@b.com --domain example.com]';
+            if (!dir)
+                throw new Error(usage);
+            const apiKey = values.key ?? (await loadApiKey());
+            if (!apiKey)
+                throw new Error('access needs an API key — run `shiply login` first');
+            const actx = { base: values.base, apiKey };
+            const modes = [
+                values.public ? 'public' : null,
+                values.password !== undefined ? 'password' : null,
+                values.restricted ? 'restricted' : null,
+            ].filter(Boolean);
+            if (modes.length === 0) {
+                // No mode flag → read-only: print the current policy.
+                await accessShow(actx, dir);
+                return;
+            }
+            if (modes.length > 1)
+                throw new Error(`pick ONE mode — ${usage}`);
+            const mode = modes[0];
+            // --email/--domain are repeatable and accept comma-separated lists.
+            const split = (vals) => (vals ?? []).flatMap((v) => v.split(',')).map((s) => s.trim()).filter(Boolean);
+            const allowedEmails = split(values.email);
+            const allowedDomains = split(values.domain);
+            if (mode === 'password' && !values.password?.trim()) {
+                throw new Error('--password needs a value, e.g. shiply access <slug> --password "s3cret-phrase"');
+            }
+            if (mode !== 'restricted' && (allowedEmails.length > 0 || allowedDomains.length > 0)) {
+                throw new Error('--email/--domain only apply with --restricted');
+            }
+            if (mode === 'restricted' && allowedEmails.length === 0 && allowedDomains.length === 0) {
+                throw new Error('--restricted needs at least one --email or --domain (otherwise only you could view the site)');
+            }
+            await accessSet(actx, dir, {
+                mode,
+                ...(mode === 'password' ? { password: values.password.trim() } : {}),
+                ...(mode === 'restricted' ? { allowedEmails, allowedDomains } : {}),
+            });
+            return;
+        }
         case 'promote': {
             const dest = values.to;
             if (!dir || !dest)
@@ -778,8 +847,18 @@ async function main() {
                         throw new Error('usage: shiply domain primary <domain> <hostname>');
                     await domainPrimary(dctx, arg, arg2);
                     return;
+                case 'rm':
+                    if (!arg)
+                        throw new Error('usage: shiply domain rm <domain> --yes');
+                    await domainRm(dctx, arg, { yes: Boolean(values.yes) });
+                    return;
+                case 'check':
+                    if (!arg)
+                        throw new Error('usage: shiply domain check <domain>');
+                    await domainCheck(dctx, arg);
+                    return;
                 default:
-                    throw new Error('usage: shiply domain <ls|add|connect|sub|sync|primary>');
+                    throw new Error('usage: shiply domain <ls|add|connect|sub|sync|primary|rm|check>');
             }
         }
         case 'db': {
@@ -850,6 +929,55 @@ async function main() {
                     throw new Error('usage: shiply db <create|ls|sql|migrate|delete|attach|branch|branches|delete-branch|merge>');
             }
         }
+        case 'variable': {
+            const apiKey = values.key ?? (await loadApiKey());
+            if (!apiKey)
+                throw new Error('variable commands need an API key — run `shiply login` first');
+            const vctx = { base: values.base, apiKey };
+            const jsonOut = bareJsonFlag;
+            const sub = dir; // positionals[1]
+            const arg = positionals[2]; // name
+            const arg2 = positionals[3]; // value (set) — unused for others
+            switch (sub) {
+                case 'ls':
+                    await variableLs(vctx, { reveal: Boolean(values.reveal), json: jsonOut });
+                    return;
+                case 'set': {
+                    if (!arg)
+                        throw new Error("usage: shiply variable set <NAME> <value>  (or: shiply variable set <NAME> --stdin)");
+                    let value = arg2;
+                    if (values.stdin) {
+                        const { readFileSync } = await import('node:fs');
+                        value = readFileSync(0, 'utf8').replace(/\n$/, '');
+                    }
+                    if (value === undefined)
+                        throw new Error("usage: shiply variable set <NAME> <value>  (or: shiply variable set <NAME> --stdin)");
+                    await variableSet(vctx, arg, value, { json: jsonOut });
+                    return;
+                }
+                case 'rm':
+                    if (!arg)
+                        throw new Error('usage: shiply variable rm <NAME> --yes');
+                    await variableRm(vctx, arg, { yes: Boolean(values.yes), json: jsonOut });
+                    return;
+                case 'attach':
+                    if (!arg)
+                        throw new Error('usage: shiply variable attach <NAME> --site <slug>');
+                    if (!values.site)
+                        throw new Error('--site <slug> is required for `shiply variable attach`');
+                    await variableAttach(vctx, arg, values.site, { json: jsonOut });
+                    return;
+                case 'detach':
+                    if (!arg)
+                        throw new Error('usage: shiply variable detach <NAME> --site <slug>');
+                    if (!values.site)
+                        throw new Error('--site <slug> is required for `shiply variable detach`');
+                    await variableDetach(vctx, arg, values.site, { json: jsonOut });
+                    return;
+                default:
+                    throw new Error('usage: shiply variable <ls|set|rm|attach|detach>');
+            }
+        }
         case 'project': {
             await runProject(positionals.slice(1));
             break;
@@ -993,14 +1121,17 @@ async function main() {
             break;
         }
         case 'claim': {
+            // Normalized to exit 1 (was 2) — every other usage error in this CLI
+            // exits 1, and automation that checks `exit !== 0` shouldn't need a
+            // special case for this one command.
             if (dir !== 'verify') {
                 console.error('Usage: shiply claim verify <SHIPLY-XXXXXXXX>');
-                process.exit(2);
+                process.exit(1);
             }
             const code = positionals[2];
             if (!code) {
                 console.error('Usage: shiply claim verify <SHIPLY-XXXXXXXX>');
-                process.exit(2);
+                process.exit(1);
             }
             const r = await runClaimVerify({ code });
             console.log(r.message);
@@ -1082,7 +1213,7 @@ async function main() {
             // Default path: device flow. One click in the browser, no email round-trip.
             // The --email flag opts into the legacy code-by-email path (useful for
             // scripted/non-interactive runs that can't open a browser).
-            if (!values.email) {
+            if (!values.email?.length) {
                 const result = await loginViaDeviceFlow(base, values.name);
                 if (!result.ok) {
                     console.error(`✗ login failed: ${result.reason}`);
@@ -1097,7 +1228,7 @@ async function main() {
             }
             const rl = createInterface({ input: process.stdin, output: process.stdout });
             try {
-                const email = values.email;
+                const email = values.email[values.email.length - 1];
                 await api(`${base}/api/auth/agent/request-code`, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
@@ -1131,6 +1262,18 @@ main().catch((e) => {
         console.error(`  upgrade: https://shiply.now/dashboard/plan`);
         process.exit(1);
     }
+    // Auth refusals (server returns 401/403): a bare "sign in" tells an agent
+    // nothing about HOW, and a revoked key vs a plan/ownership limit need
+    // different next actions — branch on the code instead of printing raw text.
+    if (e instanceof ApiError && e.code === 'unauthorized') {
+        console.error(`✖ API key missing, invalid, or revoked — run \`shiply login\` for a fresh key (or check ~/.shiply/credentials)`);
+        process.exit(1);
+    }
+    if (e instanceof ApiError && e.code === 'forbidden') {
+        console.error(`✖ ${e.message}`);
+        console.error(`  if this is a plan limit: https://shiply.now/dashboard/plan`);
+        process.exit(1);
+    }
     const msg = e instanceof Error ? e.message : String(e);
     console.error(`✖ ${msg}`);
     process.exit(1);

package/dist/login.js

@@ -36,9 +36,15 @@ export async function loginViaDeviceFlow(base, agentNameOverride) {
         }
         catch (e) {
             // Transient network blip — don't kill the whole flow, the user has time.
-            if (e instanceof ApiError && e.status >= 500)
-                continue;
-            throw e;
+            // Covers both server-side 5xx (ApiError) AND transport failures (DNS
+            // hiccup, connection reset, timeout) that never make it to an ApiError —
+            // those used to abort the whole device-flow wait on one dropped packet.
+            if (e instanceof ApiError) {
+                if (e.status >= 500)
+                    continue;
+                throw e;
+            }
+            continue;
         }
         if (poll.status === 'approved' && poll.api_key) {
             return { ok: true, apiKey: poll.api_key, slug: poll.slug_claimed ?? null };

package/dist/publish.js

@@ -251,7 +251,12 @@ async function uploadAll(dir, targets) {
                         `(they're short-lived). Re-run \`shiply publish\` to mint fresh ones — ` +
                         `unchanged files are hash-skipped, so the retry is cheap.`);
                 }
-                throw new Error(`upload failed for ${t.path}: HTTP ${res.status}`);
+                if (res.status === 401 || res.status === 403) {
+                    throw new Error(`upload failed for ${t.path}: HTTP ${res.status} — the upload URL is not authorized. ` +
+                        `Re-run \`shiply publish\` to mint fresh presigned URLs (unchanged files are hash-skipped, so the retry is cheap).`);
+                }
+                throw new Error(`upload failed for ${t.path}: HTTP ${res.status} — the object store rejected the file. ` +
+                    `Re-run \`shiply publish\`; if it keeps failing on this file, check its size/name for anything unusual.`);
             }
         }
     };

package/dist/sending-domains.js

@@ -104,6 +104,7 @@ async function verifyAction(ctx, id, flags) {
 async function removeAction(ctx, id, flags) {
     if (!flags.yes) {
         console.log(`  refusing — \`sending-domain rm\` deletes the domain and forces existing demand tests to fall back to the shared shiply sender. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/sites.js

@@ -20,6 +20,7 @@ export async function sitesLs(ctx) {
 export async function sitesRm(ctx, slug, opts) {
     if (!opts.yes) {
         console.error(`  refusing — \`shiply rm\` PERMANENTLY deletes ${slug} and its files. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/variable.js

@@ -0,0 +1,80 @@
+import { api, resolveBase } from './publish.js';
+const headers = (apiKey) => ({
+    'content-type': 'application/json',
+    authorization: `Bearer ${apiKey}`,
+});
+export async function variableLs(ctx, opts = {}) {
+    const base = resolveBase(ctx.base);
+    const reveal = Boolean(opts.reveal);
+    const r = await api(`${base}/api/v1/variables${reveal ? '?reveal=1' : ''}`, { headers: headers(ctx.apiKey) });
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(r.variables)}\n`);
+        return;
+    }
+    if (r.variables.length === 0) {
+        console.log('No variables saved. shiply variable set <NAME> <value>');
+        return;
+    }
+    for (const v of r.variables) {
+        console.log(`  ${v.name}  ${reveal ? (v.value ?? '') : (v.masked ?? '')}`);
+        console.log(`VARIABLE name=${v.name} value=${reveal ? (v.value ?? '') : (v.masked ?? '')}`);
+    }
+}
+export async function variableSet(ctx, name, value, opts = {}) {
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables`, {
+        method: 'PUT',
+        headers: headers(ctx.apiKey),
+        body: JSON.stringify({ name, value }),
+    });
+    const upper = name.trim().toUpperCase();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: upper, set: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${upper} saved`);
+    console.log('  not exposed to any site yet — attach it: shiply variable attach ' + upper + ' --site <slug>');
+}
+export async function variableRm(ctx, name, opts = {}) {
+    if (!opts.yes) {
+        throw new Error(`refusing to delete ${name} without --yes (this cannot be undone)`);
+    }
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables/${encodeURIComponent(name)}`, {
+        method: 'DELETE',
+        headers: headers(ctx.apiKey),
+    });
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: name.trim().toUpperCase(), removed: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${name.trim().toUpperCase()} removed`);
+}
+export async function variableAttach(ctx, name, slug, opts = {}) {
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables/${encodeURIComponent(name)}/attach`, {
+        method: 'POST',
+        headers: headers(ctx.apiKey),
+        body: JSON.stringify({ slug }),
+    });
+    const upper = name.trim().toUpperCase();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: upper, slug, attached: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${upper} attached to ${slug} — takes effect on the site's next function deploy`);
+}
+export async function variableDetach(ctx, name, slug, opts = {}) {
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables/${encodeURIComponent(name)}/detach`, {
+        method: 'POST',
+        headers: headers(ctx.apiKey),
+        body: JSON.stringify({ slug }),
+    });
+    const upper = name.trim().toUpperCase();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: upper, slug, detached: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${upper} detached from ${slug} — takes effect on the site's next function deploy`);
+}

package/package.json

@@ -1,42 +1,42 @@
-{
-  "name": "shiply-cli",
-  "version": "0.27.2",
-  "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "shiply": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "skill",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "pnpm build",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "shiply",
-    "hosting",
-    "static",
-    "deploy",
-    "agents",
-    "publish"
-  ],
-  "homepage": "https://shiply.now",
-  "devDependencies": {
-    "@types/node": "^22.15.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.1.0"
-  },
-  "dependencies": {
-    "esbuild": "^0.25.12",
-    "smol-toml": "^1.7.0"
-  }
-}
+{
+  "name": "shiply-cli",
+  "version": "0.29.0",
+  "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "shiply": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "skill",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "pnpm build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "shiply",
+    "hosting",
+    "static",
+    "deploy",
+    "agents",
+    "publish"
+  ],
+  "homepage": "https://shiply.now",
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.1.0"
+  },
+  "dependencies": {
+    "esbuild": "^0.25.12",
+    "smol-toml": "^1.7.0"
+  }
+}

package/skill/CHANGELOG.md

@@ -6,6 +6,16 @@ entry here, that capability may be missing from your copy — re-install with
 (This is the agent-facing capability log; the CLI's own release notes live in
 the npm package changelog.)
 
+## 2026-07-14
+
+- **New** — `shiply access <slug>` manages site privacy without raw REST:
+  no flags prints the current policy (with a stable `ACCESS slug=… mode=…`
+  marker line), `--password <pw>` password-protects, `--restricted
+  --email a@b.com --domain example.com` makes it invite-only (flags
+  repeatable; each set replaces the previous lists), `--public` opens it
+  back up. Password/restricted modes need a paid plan. Details in
+  references/site-features.md.
+
 ## 2026-07-08
 
 - **Fix** — re-publishing an unchanged large SSR site (e.g. a 171-file