shiply-cli 0.28.0 → 0.29.0

package/dist/data.js

@@ -105,6 +105,7 @@ export async function dataExport(ctx, slug, collection, opts) {
 export async function dataWipeCollection(ctx, slug, collection, opts) {
     if (!opts.yes) {
         console.error(`  refusing — wipe-collection deletes EVERY record in "${collection}" on ${slug}. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/db.js

@@ -144,6 +144,7 @@ export async function dbMigrate(ctx, idOrName, dir) {
 export async function dbDelete(ctx, idOrName, opts) {
     if (!opts.yes) {
         console.log(`  refusing — \`db delete\` drops the database "${idOrName}" and every row in it. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const id = await resolveId(ctx, idOrName);
@@ -195,6 +196,7 @@ export async function dbBranches(ctx, parentNameOrId) {
 export async function dbDeleteBranch(ctx, branchIdOrName, opts) {
     if (!opts.yes) {
         console.log(`  refusing — \`db delete-branch\` drops the branch "${branchIdOrName}" and its Neon endpoint. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/domain.js

@@ -143,6 +143,36 @@ export async function domainPrimary(ctx, domain, hostname) {
             console.log(`    ${s.hostname}`);
     }
 }
+export async function domainRm(ctx, domain, opts = {}) {
+    if (!opts.yes) {
+        throw new Error(`refusing to remove ${domain} without --yes (subdomains mapped to it stop resolving)`);
+    }
+    const base = resolveBase(ctx.base);
+    const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}`, {
+        method: 'DELETE',
+        headers: headers(ctx.apiKey),
+    });
+    console.log(`✔ removed ${r.removed}`);
+}
+/** Re-poll CF cert status + live TLS/HTTPS probe for all subdomains of a
+ *  registered custom domain. Run this after `domain connect` / `domain sub add`
+ *  until every subdomain reports ready=true. */
+export async function domainCheck(ctx, domain) {
+    const base = resolveBase(ctx.base);
+    const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}/check`, {
+        method: 'POST',
+        headers: headers(ctx.apiKey),
+        body: '{}',
+    });
+    if (!r.subdomains?.length) {
+        console.log(`No subdomains mapped under ${domain} yet. shiply domain sub add <host> --site <slug>`);
+        return;
+    }
+    for (const s of r.subdomains) {
+        console.log(`  ${s.hostname}  ${s.ready ? '✔ ready' : '✖ not ready'}`);
+        console.log(`DOMAIN_CHECK hostname=${s.hostname} ready=${s.ready}`);
+    }
+}
 export async function domainSync(ctx, domain) {
     const base = resolveBase(ctx.base);
     const r = await api(`${base}/api/v1/custom-domains/${enc(domain)}/sync-dns`, { method: 'POST', headers: headers(ctx.apiKey), body: '{}' });

package/dist/drive.js

@@ -30,8 +30,12 @@ export async function drivePut(ctx, file, asPath) {
     const stage = await api(`${base}/api/v1/drives/${id}/files/uploads`, { method: 'POST', headers: headers(ctx.apiKey), body: JSON.stringify({ files: [meta] }) });
     for (const u of stage.uploads) {
         const res = await fetch(u.url, { method: 'PUT', body: new Uint8Array(body) });
-        if (!res.ok)
-            throw new Error(`upload failed for ${u.path}`);
+        if (!res.ok) {
+            if (res.status === 401 || res.status === 403) {
+                throw new Error(`upload failed for ${u.path}: HTTP ${res.status} — the upload URL is not authorized. Re-run \`shiply drive put\` to mint a fresh one.`);
+            }
+            throw new Error(`upload failed for ${u.path}: HTTP ${res.status} — the object store rejected the file. Re-run \`shiply drive put\`; if it keeps failing, check the file size/name.`);
+        }
     }
     await api(`${base}/api/v1/drives/${id}/files/finalize`, {
         method: 'POST',
@@ -45,8 +49,15 @@ export async function driveGet(ctx, path, out) {
     const id = await defaultDrive(ctx);
     const { url } = await api(`${base}/api/v1/drives/${id}/files/${path.split('/').map(encodeURIComponent).join('/')}`, { headers: headers(ctx.apiKey) });
     const res = await fetch(url);
-    if (!res.ok)
-        throw new Error(`download failed (${res.status})`);
+    if (!res.ok) {
+        if (res.status === 404) {
+            throw new Error(`download failed: HTTP 404 — no file at "${path}" in this drive. Check the path with \`shiply drive ls\`.`);
+        }
+        if (res.status === 401 || res.status === 403) {
+            throw new Error(`download failed: HTTP ${res.status} — the download URL is not authorized. Re-run \`shiply drive get\` to mint a fresh one.`);
+        }
+        throw new Error(`download failed: HTTP ${res.status} for "${path}" — re-run \`shiply drive get\`; if it keeps failing, the object may be corrupted.`);
+    }
     const buf = Buffer.from(await res.arrayBuffer());
     if (out) {
         await writeFile(out, buf);

package/dist/index.js

@@ -15,7 +15,7 @@ import { detectIsr } from './isr.js';
 import { runClaimVerify } from './claim.js';
 import { dbAttach, dbBranch, dbBranches, dbCreate, dbDelete, dbDeleteBranch, dbLs, dbMerge, dbMigrate, dbSql, } from './db.js';
 import { driveGet, driveLs, drivePublish, drivePut, driveRm } from './drive.js';
-import { domainAdd, domainConnect, domainLs, domainPrimary, domainSubAdd, domainSync } from './domain.js';
+import { domainAdd, domainCheck, domainConnect, domainLs, domainPrimary, domainRm, domainSubAdd, domainSync } from './domain.js';
 import { runProject } from './projects.js';
 import { runClient, parseClientArg } from './clients.js';
 import { runListing } from './listings.js';
@@ -36,6 +36,7 @@ import { runStatus } from './status-cmd.js';
 import { accessSet, accessShow } from './access.js';
 import { sitesLs, sitesPromote, sitesRm, sitesRollback } from './sites.js';
 import { verifySite } from './verify.js';
+import { variableAttach, variableDetach, variableLs, variableRm, variableSet } from './variable.js';
 // Resolve the package.json beside the compiled dist/ so `shiply --version`
 // can print the running CLI version (works in dev tsc output + npm install).
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -63,6 +64,10 @@ Usage:
   shiply status <slug-or-domain> [--wait]     SSL + readiness check (agent-friendly output)
                                               (no arg → account/plan status, see below)
   shiply duplicate <slug>                     Server-side copy of an owned site → new URL
+  shiply ls                                   List sites in your account
+  shiply rm <slug> --yes                      Permanently delete an owned site
+  shiply rollback <slug> [versionId]          Re-point a site to a prior finalized deploy
+                                              (omit versionId to list deploys and pick one)
   shiply promote <preview-slug> --to <dest-slug>
                                               Copy the exact previewed bytes into a production site (no rebuild)
   shiply detect [dir]                         Diagnose: print framework + dir that would upload
@@ -88,6 +93,14 @@ Usage:
   shiply domain sub add <host> --site <slug>  Map a subdomain (e.g. app.example.com) to a slug
   shiply domain sync <domain>                 Re-sync DNS records for a connected domain
   shiply domain primary <domain> <hostname>   Mark hostname as primary; siblings 301-redirect (SEO)
+  shiply domain check <domain>                Re-poll cert/DNS/HTTPS readiness for every subdomain
+  shiply domain rm <domain> --yes             Remove a custom domain (its subdomains stop resolving)
+  shiply variable <ls|set|rm|attach|detach>   Account-level encrypted variables (e.g. API keys for sites)
+  shiply variable set <NAME> <value>          Save/update a variable (or: --stdin to read the value)
+  shiply variable ls [--reveal]               List variables (masked by default)
+  shiply variable rm <NAME> --yes             Delete a variable
+  shiply variable attach <NAME> --site <slug> Expose a saved variable to one site's Worker env
+  shiply variable detach <NAME> --site <slug> Stop exposing a variable to a site's Worker env
   shiply project <ls|create|get|archive|restore>
                                               Customer-intake projects + AI brief generator
   shiply project create <label> [--customer-email <e>] [--customer-name <n>]
@@ -220,7 +233,7 @@ async function main() {
     // parseArgs sees it. (A prior lookahead that cancelled the flag when a
     // positional followed made `shiply publish --json ./dist` swallow the dir as
     // the --json value, leaving no <dir>.)
-    const BARE_JSON_CMDS = new Set(['status', 'publish', 'update', 'logs']);
+    const BARE_JSON_CMDS = new Set(['status', 'publish', 'update', 'logs', 'variable']);
     const bareJsonFlag = BARE_JSON_CMDS.has(rawArgv[0]) && rawArgv.includes('--json');
     if (bareJsonFlag) {
         const idx = rawArgv.indexOf('--json');
@@ -263,6 +276,8 @@ async function main() {
             ts: { type: 'boolean' },
             'preview-branch': { type: 'string' },
             yes: { type: 'boolean' },
+            reveal: { type: 'boolean' },
+            stdin: { type: 'boolean' },
             'no-confetti': { type: 'boolean' },
             json: { type: 'string' },
             limit: { type: 'string' },
@@ -832,8 +847,18 @@ async function main() {
                         throw new Error('usage: shiply domain primary <domain> <hostname>');
                     await domainPrimary(dctx, arg, arg2);
                     return;
+                case 'rm':
+                    if (!arg)
+                        throw new Error('usage: shiply domain rm <domain> --yes');
+                    await domainRm(dctx, arg, { yes: Boolean(values.yes) });
+                    return;
+                case 'check':
+                    if (!arg)
+                        throw new Error('usage: shiply domain check <domain>');
+                    await domainCheck(dctx, arg);
+                    return;
                 default:
-                    throw new Error('usage: shiply domain <ls|add|connect|sub|sync|primary>');
+                    throw new Error('usage: shiply domain <ls|add|connect|sub|sync|primary|rm|check>');
             }
         }
         case 'db': {
@@ -904,6 +929,55 @@ async function main() {
                     throw new Error('usage: shiply db <create|ls|sql|migrate|delete|attach|branch|branches|delete-branch|merge>');
             }
         }
+        case 'variable': {
+            const apiKey = values.key ?? (await loadApiKey());
+            if (!apiKey)
+                throw new Error('variable commands need an API key — run `shiply login` first');
+            const vctx = { base: values.base, apiKey };
+            const jsonOut = bareJsonFlag;
+            const sub = dir; // positionals[1]
+            const arg = positionals[2]; // name
+            const arg2 = positionals[3]; // value (set) — unused for others
+            switch (sub) {
+                case 'ls':
+                    await variableLs(vctx, { reveal: Boolean(values.reveal), json: jsonOut });
+                    return;
+                case 'set': {
+                    if (!arg)
+                        throw new Error("usage: shiply variable set <NAME> <value>  (or: shiply variable set <NAME> --stdin)");
+                    let value = arg2;
+                    if (values.stdin) {
+                        const { readFileSync } = await import('node:fs');
+                        value = readFileSync(0, 'utf8').replace(/\n$/, '');
+                    }
+                    if (value === undefined)
+                        throw new Error("usage: shiply variable set <NAME> <value>  (or: shiply variable set <NAME> --stdin)");
+                    await variableSet(vctx, arg, value, { json: jsonOut });
+                    return;
+                }
+                case 'rm':
+                    if (!arg)
+                        throw new Error('usage: shiply variable rm <NAME> --yes');
+                    await variableRm(vctx, arg, { yes: Boolean(values.yes), json: jsonOut });
+                    return;
+                case 'attach':
+                    if (!arg)
+                        throw new Error('usage: shiply variable attach <NAME> --site <slug>');
+                    if (!values.site)
+                        throw new Error('--site <slug> is required for `shiply variable attach`');
+                    await variableAttach(vctx, arg, values.site, { json: jsonOut });
+                    return;
+                case 'detach':
+                    if (!arg)
+                        throw new Error('usage: shiply variable detach <NAME> --site <slug>');
+                    if (!values.site)
+                        throw new Error('--site <slug> is required for `shiply variable detach`');
+                    await variableDetach(vctx, arg, values.site, { json: jsonOut });
+                    return;
+                default:
+                    throw new Error('usage: shiply variable <ls|set|rm|attach|detach>');
+            }
+        }
         case 'project': {
             await runProject(positionals.slice(1));
             break;
@@ -1047,14 +1121,17 @@ async function main() {
             break;
         }
         case 'claim': {
+            // Normalized to exit 1 (was 2) — every other usage error in this CLI
+            // exits 1, and automation that checks `exit !== 0` shouldn't need a
+            // special case for this one command.
             if (dir !== 'verify') {
                 console.error('Usage: shiply claim verify <SHIPLY-XXXXXXXX>');
-                process.exit(2);
+                process.exit(1);
             }
             const code = positionals[2];
             if (!code) {
                 console.error('Usage: shiply claim verify <SHIPLY-XXXXXXXX>');
-                process.exit(2);
+                process.exit(1);
             }
             const r = await runClaimVerify({ code });
             console.log(r.message);
@@ -1185,6 +1262,18 @@ main().catch((e) => {
         console.error(`  upgrade: https://shiply.now/dashboard/plan`);
         process.exit(1);
     }
+    // Auth refusals (server returns 401/403): a bare "sign in" tells an agent
+    // nothing about HOW, and a revoked key vs a plan/ownership limit need
+    // different next actions — branch on the code instead of printing raw text.
+    if (e instanceof ApiError && e.code === 'unauthorized') {
+        console.error(`✖ API key missing, invalid, or revoked — run \`shiply login\` for a fresh key (or check ~/.shiply/credentials)`);
+        process.exit(1);
+    }
+    if (e instanceof ApiError && e.code === 'forbidden') {
+        console.error(`✖ ${e.message}`);
+        console.error(`  if this is a plan limit: https://shiply.now/dashboard/plan`);
+        process.exit(1);
+    }
     const msg = e instanceof Error ? e.message : String(e);
     console.error(`✖ ${msg}`);
     process.exit(1);

package/dist/login.js

@@ -36,9 +36,15 @@ export async function loginViaDeviceFlow(base, agentNameOverride) {
         }
         catch (e) {
             // Transient network blip — don't kill the whole flow, the user has time.
-            if (e instanceof ApiError && e.status >= 500)
-                continue;
-            throw e;
+            // Covers both server-side 5xx (ApiError) AND transport failures (DNS
+            // hiccup, connection reset, timeout) that never make it to an ApiError —
+            // those used to abort the whole device-flow wait on one dropped packet.
+            if (e instanceof ApiError) {
+                if (e.status >= 500)
+                    continue;
+                throw e;
+            }
+            continue;
         }
         if (poll.status === 'approved' && poll.api_key) {
             return { ok: true, apiKey: poll.api_key, slug: poll.slug_claimed ?? null };

package/dist/publish.js

@@ -251,7 +251,12 @@ async function uploadAll(dir, targets) {
                         `(they're short-lived). Re-run \`shiply publish\` to mint fresh ones — ` +
                         `unchanged files are hash-skipped, so the retry is cheap.`);
                 }
-                throw new Error(`upload failed for ${t.path}: HTTP ${res.status}`);
+                if (res.status === 401 || res.status === 403) {
+                    throw new Error(`upload failed for ${t.path}: HTTP ${res.status} — the upload URL is not authorized. ` +
+                        `Re-run \`shiply publish\` to mint fresh presigned URLs (unchanged files are hash-skipped, so the retry is cheap).`);
+                }
+                throw new Error(`upload failed for ${t.path}: HTTP ${res.status} — the object store rejected the file. ` +
+                    `Re-run \`shiply publish\`; if it keeps failing on this file, check its size/name for anything unusual.`);
             }
         }
     };

package/dist/sending-domains.js

@@ -104,6 +104,7 @@ async function verifyAction(ctx, id, flags) {
 async function removeAction(ctx, id, flags) {
     if (!flags.yes) {
         console.log(`  refusing — \`sending-domain rm\` deletes the domain and forces existing demand tests to fall back to the shared shiply sender. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/sites.js

@@ -20,6 +20,7 @@ export async function sitesLs(ctx) {
 export async function sitesRm(ctx, slug, opts) {
     if (!opts.yes) {
         console.error(`  refusing — \`shiply rm\` PERMANENTLY deletes ${slug} and its files. Re-run with --yes to confirm.`);
+        process.exitCode = 1; // refusal is not success — scripts must see a non-zero exit
         return;
     }
     const base = resolveBase(ctx.base);

package/dist/variable.js

@@ -0,0 +1,80 @@
+import { api, resolveBase } from './publish.js';
+const headers = (apiKey) => ({
+    'content-type': 'application/json',
+    authorization: `Bearer ${apiKey}`,
+});
+export async function variableLs(ctx, opts = {}) {
+    const base = resolveBase(ctx.base);
+    const reveal = Boolean(opts.reveal);
+    const r = await api(`${base}/api/v1/variables${reveal ? '?reveal=1' : ''}`, { headers: headers(ctx.apiKey) });
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(r.variables)}\n`);
+        return;
+    }
+    if (r.variables.length === 0) {
+        console.log('No variables saved. shiply variable set <NAME> <value>');
+        return;
+    }
+    for (const v of r.variables) {
+        console.log(`  ${v.name}  ${reveal ? (v.value ?? '') : (v.masked ?? '')}`);
+        console.log(`VARIABLE name=${v.name} value=${reveal ? (v.value ?? '') : (v.masked ?? '')}`);
+    }
+}
+export async function variableSet(ctx, name, value, opts = {}) {
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables`, {
+        method: 'PUT',
+        headers: headers(ctx.apiKey),
+        body: JSON.stringify({ name, value }),
+    });
+    const upper = name.trim().toUpperCase();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: upper, set: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${upper} saved`);
+    console.log('  not exposed to any site yet — attach it: shiply variable attach ' + upper + ' --site <slug>');
+}
+export async function variableRm(ctx, name, opts = {}) {
+    if (!opts.yes) {
+        throw new Error(`refusing to delete ${name} without --yes (this cannot be undone)`);
+    }
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables/${encodeURIComponent(name)}`, {
+        method: 'DELETE',
+        headers: headers(ctx.apiKey),
+    });
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: name.trim().toUpperCase(), removed: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${name.trim().toUpperCase()} removed`);
+}
+export async function variableAttach(ctx, name, slug, opts = {}) {
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables/${encodeURIComponent(name)}/attach`, {
+        method: 'POST',
+        headers: headers(ctx.apiKey),
+        body: JSON.stringify({ slug }),
+    });
+    const upper = name.trim().toUpperCase();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: upper, slug, attached: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${upper} attached to ${slug} — takes effect on the site's next function deploy`);
+}
+export async function variableDetach(ctx, name, slug, opts = {}) {
+    const base = resolveBase(ctx.base);
+    await api(`${base}/api/v1/variables/${encodeURIComponent(name)}/detach`, {
+        method: 'POST',
+        headers: headers(ctx.apiKey),
+        body: JSON.stringify({ slug }),
+    });
+    const upper = name.trim().toUpperCase();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ name: upper, slug, detached: true })}\n`);
+        return;
+    }
+    console.log(`✔ ${upper} detached from ${slug} — takes effect on the site's next function deploy`);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "shiply-cli",
-  "version": "0.28.0",
-  "description": "Publish static sites to shiply.now from the command line \u00e2\u20ac\u201d instant web hosting for agents.",
+  "version": "0.29.0",
+  "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
   "license": "MIT",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -243,6 +243,8 @@ covers its CLI commands, MCP tools, AND REST endpoints.
 * [Client work](references/client-work.md) — freelancer delivery: customer
   intake projects + AI briefs, group work by client, e-sign contracts,
   sell sites on the marketplace.
+* [Drives](references/drives.md) — private cloud storage: staged uploads,
+  sharing links, client assignment, publish-from-drive, REST + CLI + MCP.
 * [Authentication for the user's app](references/site-features.md) — shiply
   does NOT host end-user auth; bring the user's own Clerk/Auth.js/Supabase
   (pattern in Site features → "Bring your own auth").

package/skill/references/client-work.md

@@ -31,16 +31,49 @@ list_project_files  — files uploaded by the customer
 resend_intake_invite — re-email the customer their intake link (requires customerEmail on project)
 ```
 
-REST: `POST/GET /api/v1/projects · GET/PATCH /api/v1/projects/{id} ·
-POST /api/v1/projects/{id}/regenerate-brief`
-(archive: `PATCH /api/v1/projects/{id}` with `{"status":"archived"}` — no
-dedicated `/archive` route).
+REST:
+
+| Endpoint | Action |
+|---|---|
+| `POST/GET /api/v1/projects` | create / list |
+| `GET/PATCH /api/v1/projects/{id}` | read / update brief or metadata |
+| `POST /api/v1/projects/{id}/regenerate-brief` | re-run AI from current intake responses |
+| `POST /api/v1/projects/{id}/archive` `{reason?}` | dedicated archive route — mirrors `archive_project` (`PATCH .../{id}` `{"status":"archived"}` still works too, back-compat) |
+| `GET /api/v1/projects/{id}/files/zip` | download every customer-uploaded file as one .zip |
+| `GET /api/v1/projects/{id}/files/{fileId}/download` | 302-redirect to a short-lived signed URL for one file |
+| `POST /api/v1/projects/{id}/upload` | dev sends the customer a file (multipart `file` field, ≤25 MB) |
+| `PATCH /api/v1/projects/{id}/status-note` `{note}` | short customer-facing status line shown in the portal header (`note:null` clears it) |
+| `POST /api/v1/projects/{id}/resend-portal-link` | dev re-sends the customer's **portal** link — different from `resend_intake_invite`/`resend-invite` below, which re-sends the original **intake** invite |
 
 CLI: `shiply project ls · shiply project create <label> [--customer-email <e>]
 [--customer-name <n>] · shiply project get <id> · shiply project archive <id>`
 
 Docs: https://shiply.now/docs/projects
 
+### Intake — the customer-facing side (token auth, not Bearer)
+
+The intake URL a customer opens is token-scoped, not account-scoped — no
+Bearer key. These routes power the wizard, portal chat, and dev-side nudges:
+
+| Endpoint | Action |
+|---|---|
+| `GET /api/v1/intake/{token}/state` | current status + saved wizard responses + project label |
+| `PATCH /api/v1/intake/{token}` `{stepKey, data}` | save one wizard step (auto-save as the customer types) |
+| `POST /api/v1/intake/{token}/submit` | run AI brief generation from the saved responses |
+| `GET /api/v1/intake/{token}/contract` | the project's contract, if one has been sent to this token |
+| `GET/POST /api/v1/intake/{token}/files` | list / upload customer attachments |
+| `DELETE /api/v1/intake/{token}/files/{fileId}` | remove an uploaded attachment |
+| `GET/POST /api/v1/intake/{token}/messages` `{body}` (POST) | portal chat thread with the dev, oldest-first, `?before=` cursor |
+| `POST /api/v1/intake/{token}/nudge` | dev-triggered reminder ping to the customer |
+| `POST /api/v1/intake/{token}/email-link` | re-email the customer their intake link |
+| `POST /api/v1/intake/{token}/cookie` | set the portal session cookie for this token |
+| `GET /api/v1/intake/{token}/activity` | activity/audit log for this intake |
+| `POST /api/v1/intake/{token}/suggest` | AI suggestion helper for a wizard field |
+
+Dev-side equivalent for re-sending the invite email is `resend_intake_invite`
+(MCP) / `POST /api/v1/projects/{id}/resend-invite` — different from the
+customer-token `email-link` route above.
+
 ## Group work by client (optional, for freelancers)
 
 Building sites for clients? Pass an optional `client` (a name or email) on any
@@ -56,7 +89,28 @@ drive/intake/contract all land under the same client. List calls take an
 optional `clientId` filter (`list_sites`/`list_drives`/`list_projects`).
 Omit `client` for personal projects; shiply works identically.
 CLI: `--client "<name-or-email>"` on publish/drive/project, plus
-`shiply client ls|show`.
+`shiply client ls|show`. Re-assign (or clear) a client on an already-published
+site directly: `PATCH /api/v1/publish/{slug}/client` `{clientId}`
+(`clientId: null` clears it) — no MCP tool for this yet, REST only.
+
+REST (Bearer; Studio plan — `assertStudioEntitled` gates `POST`):
+
+| Endpoint | Action |
+|---|---|
+| `GET /api/v1/clients` | list your clients → `{clients}` |
+| `POST /api/v1/clients` `{name, email?, phone?, company?, notes?}` | create a client explicitly (usually unnecessary — clients self-assemble from `client`/`customerEmail`) |
+| `GET /api/v1/clients/{id}` | rollup view: sites, drives, projects, contracts, invoices under this client |
+| `GET /api/v1/clients/{id}/invoices` | list invoices for this client |
+| `POST /api/v1/clients/{id}/invoices` `{description, amountCents, currency?, dueDate?, projectId?}` | create an invoice |
+| `POST /api/v1/invoices/{id}/send` | email the invoice to the client |
+| `POST /api/v1/invoices/{id}/void` | void an unpaid invoice |
+| `POST /api/v1/clients/{id}/portal` | enable the client's public portal (idempotent) → `{portalUrl}` |
+| `DELETE /api/v1/clients/{id}/portal` | disable the portal — the link dies immediately |
+| `POST /api/v1/clients/{id}/portal/rotate` | mint a fresh portal token (old link dies instantly) |
+
+No `list_clients`/`get_client`/portal-management MCP tools exist yet — this
+is REST + CLI (`shiply client ls|show`) only; an MCP agent reads client data
+indirectly via `list_sites`/`list_drives`/`list_projects` with `clientId`.
 
 ## Contracts — draft, sign, amend (extends Projects)
 
@@ -91,7 +145,7 @@ Example agent flow (draft → tweak fee → send → poll → amend):
 6. `contract_send({contractId: amendment.id})` (no PATCH needed if the amend fields are right)
 
 REST (Bearer for dev, portal cookie for customer):
-`POST /api/v1/projects/{id}/contracts` (draft) ·
+`POST /api/v1/projects/{id}/contract` (draft — singular; the plural `/contracts` is a GET-only read bundle) ·
 `GET/PATCH /api/v1/contracts/{id}` (read either-party / dev edit) ·
 `POST /api/v1/contracts/{id}/send` (dev) ·
 `POST /api/v1/contracts/{id}/view` (customer ping) ·
@@ -141,12 +195,13 @@ refund_order     — issue Stripe refund (within refund window; goes back to buy
 get_connect_status — Stripe Connect onboarding state + actionable URL
 ```
 
-REST: `POST /api/v1/listings · PATCH /api/v1/listings/{id} ·
-POST /api/v1/listings/{id}/checkout · POST /api/v1/orders/{id}/refund ·
-GET /api/v1/connect/status`
-(no GET listing index over REST yet — use the MCP `list_listings` /
-`list_my_sales` / `list_my_orders` tools for machine output, or the
-dashboard `/dashboard/sales` page for humans.)
+REST: `GET/POST /api/v1/listings · PATCH /api/v1/listings/{id} ·
+POST /api/v1/listings/{id}/checkout · GET /api/v1/orders ·
+POST /api/v1/orders/{id}/refund · GET /api/v1/connect/status`
+(`GET /api/v1/listings` and `GET /api/v1/orders` list your own listings/
+orders — `?limit=` supported; MCP mirrors are `list_listings` /
+`list_my_orders`. Sales specifically: `GET /api/v1/listings/sales` /
+`list_my_sales`.)
 
 CLI: `shiply listing ls · shiply listing create <site-slug> --price <cents>
 --jurisdiction "<region>" · shiply listing rm <slug> --id <listing-id>`
@@ -157,3 +212,29 @@ isn't `'ready'` it returns an `onboardingUrl` you should hand to the
 user as a clickable link.
 
 Docs: https://shiply.now/docs/marketplace
+
+## Inbox threads — reply, forward, archive, summarize, AI draft
+
+The account-wide inbox (replies, unsubscribes, complaints, bounces across
+every site) beyond the read-only MCP tools in [email.md](email.md):
+
+MCP tools: `list_inbox` (filtered list + counts in one call — filters
+`all|unread|replies|unsubscribes|complaints|bounces|archived`), `read_thread`
+(marks read implicitly), `mark_thread_read`, `summarize_thread`,
+`reply_to_thread`, `forward_thread`, `archive_thread`, `unarchive_thread`.
+
+REST (Bearer):
+
+| Endpoint | Action |
+|---|---|
+| `GET /api/v1/inbox/threads?filter=&limit=&offset=` | atomic snapshot: `{threads, counts}` |
+| `GET /api/v1/inbox/threads/{id}` | one thread (also marks read) |
+| `PATCH /api/v1/inbox/threads/{id}` `{action:"mark_read"\|"archive"\|"unarchive"}` | thread lifecycle |
+| `POST /api/v1/inbox/threads/{id}/reply` `{body, subject?}` | reply from the original recipient alias, threaded via In-Reply-To |
+| `POST /api/v1/inbox/threads/{id}/forward` `{to, messageId?, subject?, note?}` | forward one message to a new address |
+| `POST /api/v1/inbox/threads/{id}/summarize` | AI summary of the thread |
+| `POST /api/v1/inbox/threads/{id}/ai-reply` | AI-drafted reply body (review before sending — no matching MCP tool yet) |
+
+**Gap (intentional, tracked):** the CLI has no `shiply inbox` thread-action
+subcommands (reply/forward/archive/summarize) — use MCP or REST for those;
+`shiply email inbox` only reads.

package/skill/references/custom-domains.md

@@ -40,6 +40,8 @@ shiply domain sub add www.example.com --site my-site   # map a subdomain → sit
 shiply domain ls                            # list all domains + subdomains + status
 shiply domain sync example.com              # re-sync DNS records with a connected provider
 shiply domain primary <hostname>            # mark hostname canonical (siblings 301)
+shiply domain check example.com             # re-poll cert/DNS/HTTPS readiness per subdomain
+shiply domain rm example.com --yes          # remove a domain (its subdomains stop resolving)
 ```
 
 For one-click connect (`shiply domain connect`), the CLI prints an

package/skill/references/databases.md

@@ -95,6 +95,11 @@ for D1 and Neon), `POST .../attach` to bind, `DELETE` to drop. Neon-only:
 `POST/GET/DELETE /api/v1/databases/{id}/branches[/{branchId}]` (400 on
 D1 rows).
 
+Main MCP server (account-wide lifecycle — start here to discover a
+databaseId): `list_databases`, `create_database`, `delete_database`,
+`attach_database`. Then, to query/introspect one database, connect the
+per-DB MCP server below with that id.
+
 Per-DB MCP server (so an agent can be scoped to one DB):
 `https://shiply.now/api/mcp/db/<id>/sse` (or `/mcp` for streamable-http),
 Bearer `shp_…` — tools: `db_query`, `db_list_tables`, `db_schema`. The same

package/skill/references/drives.md

@@ -0,0 +1,70 @@
+---
+type: reference
+title: Drives (private storage — REST, CLI, MCP)
+description: Full reference for Drives — private cloud storage for agent memory, notes, and assets. Staged uploads, sharing links, client assignment, and publish-from-drive.
+timestamp: 2026-07-14
+---
+
+# Drives — private cloud storage
+
+Part of the shiply skill (see SKILL.md for publish basics). A Drive is
+private storage — files, notes, context — that is **not** served publicly
+like a published site. Every account gets a `default` drive on first use;
+you can also create named drives (e.g. one per client).
+
+## REST (Bearer `shp_...`)
+
+| Endpoint | Action |
+|---|---|
+| `GET /api/v1/drives?clientId=` | list your drives (optional client filter) → `{drives}` |
+| `POST /api/v1/drives` `{name, client?}` | create a named drive. `client` is the same optional `{clientId?, clientEmail?, clientName?, clientCompany?}` shape used on publish/create_project |
+| `GET /api/v1/drives/default` | the account's auto-provisioned default drive (creates it on first call) |
+| `GET /api/v1/drives/{id}` | drive detail |
+| `DELETE /api/v1/drives/{id}` | delete a drive and its files |
+| `GET /api/v1/drives/{id}/files?prefix=&cursor=` | list files (optional path-prefix filter, pagination cursor) |
+| `POST /api/v1/drives/{id}/files/uploads` `{files:[{path,size,contentType?,hash}]}` | stage up to 1000 files → presigned PUT URLs (same 3-step flow as site publish) |
+| `POST /api/v1/drives/{id}/files/finalize` `{files:[{path,size,contentType?,hash}]}` | confirm uploads landed — same `files` array as the uploads call |
+| `GET /api/v1/drives/{id}/files/{...path}` | `{url}` — a presigned, time-limited download URL for one file |
+| `DELETE /api/v1/drives/{id}/files/{...path}` | delete one file (optional `If-Match` header for optimistic concurrency) |
+| `POST /api/v1/drives/{id}/assign-client` `{clientId}` | file this drive under a client (`clientId: null` clears it) |
+| `POST /api/v1/drives/{id}/share` `{instructions?}` | enable a public share link for the drive |
+| `DELETE /api/v1/drives/{id}/share` | disable the share link |
+| `POST /api/v1/drives/{id}/share/rotate` | mint a fresh share token — the old link dies instantly |
+| `POST /api/v1/drives/{id}/share/invite` `{emails:[...max 50], message?}` | email the share link to a list of addresses |
+
+`{id}` is the drive's public id (`drv_...`), or the literal string
+`default` where the endpoint supports it (only `GET /api/v1/drives/default`
+resolves the alias itself — everywhere else, resolve `default` to a real
+`drv_...` id first via that call).
+
+## CLI
+
+The CLI only operates on the account's **default** drive — for named/
+per-client drives, use REST or MCP.
+
+```bash
+shiply drive ls [prefix]                # list files (optionally under a prefix)
+shiply drive put <file> [as-path]       # stage + finalize a file into the default drive
+shiply drive get <path> [out-file]      # download; omit out-file to print to stdout
+shiply drive rm <path>                  # delete a file
+shiply drive publish [prefix]           # snapshot the default drive (or a prefix) as a new live site
+```
+
+## MCP tools
+
+| Tool | Purpose |
+|---|---|
+| `list_drives` | your drives (optional `clientId` filter) |
+| `create_drive` | create a named drive (`name`, optional `client`) |
+| `drive_list_files` | list files in a drive (`driveId` = `drv_...` or `"default"`, optional `prefix`) |
+| `drive_put_file` | write a file inline (utf8 or base64, ≤2 MB — use the REST staged-upload flow above for bigger files) |
+| `drive_delete_file` | delete a file from a drive |
+| `publish_from_drive` | snapshot a drive (or a path prefix within it) into a new live site |
+
+**Gap (intentional, tracked):** file download, drive delete, and the
+share/assign-client family (`share`, `share/rotate`, `share/invite`,
+`assign-client`) are REST-only today — there is no `drive_download`,
+`delete_drive`, or share-management MCP tool yet. Use the REST endpoints
+above from an MCP-only agent until parity lands.
+
+Docs: https://shiply.now/docs/drives

package/skill/references/email.md

@@ -127,6 +127,22 @@ the confirmed audience (unsubscribe link auto-added). `list_tests()` — all
 tests for this key. `resend_confirmation({ testId, email })` — re-send the
 opt-in to one address.
 
+REST (Bearer, mirrors the MCP tools above):
+
+| Endpoint | Action |
+|---|---|
+| `GET /api/v1/tests` | list your demand tests → `{tests}` |
+| `POST /api/v1/tests` `{idea, copy:{headline, sub?, cta?}, price?, captureFields?, sendingDomainId?}` | create a test — deploys the capture page + provisions the confirmed-subscriber segment |
+| `GET /api/v1/tests/{id}` | merged status object — same shape as `get_test_status` |
+| `PATCH /api/v1/tests/{id}/branding` `{brandName?, logoUrl?, brandColor?, accentColor?, footerText?, replyTo?}` | customize the capture page's branding |
+| `POST /api/v1/tests/{id}/broadcasts` `{subject, html, text?}` | email the confirmed audience — same as `send_broadcast` |
+| `POST /api/v1/tests/suggest-copy` `{idea}` | AI-drafted `{headline, sub, cta}` from a one-line idea (MiniMax; 503 `service_unavailable` if no AI provider is configured) |
+
+`list_tests` maps to `GET /api/v1/tests` above. `resend_confirmation` (re-send
+the opt-in email to one address) is **MCP-only today** — no REST route exists
+yet; use the MCP tool from a REST-only agent by proxying through an MCP
+client, or ask for the confirmation link to be resent from the dashboard.
+
 ## Sending domains — outbound email on your domain
 
 For agents that want shiply to send emails (demand-test broadcasts, project
@@ -140,6 +156,14 @@ to add), `verify_sending_domain`, `remove_sending_domain`.
 REST: `GET/POST /api/v1/sending-domains ·
 POST /api/v1/sending-domains/{id}/verify · DELETE /api/v1/sending-domains/{id}`
 
+Auto-DNS shortcuts (skip the "copy these records to your registrar" step —
+user supplies a scoped, never-stored Cloudflare API token for the domain's
+zone): `POST /api/v1/sending-domains/{id}/auto-dns` `{provider:"cloudflare",
+token}` adds the SPF/DKIM records automatically; `POST
+/api/v1/sending-domains/{id}/email-routing` `{provider:"cloudflare", token}`
+additionally turns on inbound Email Routing and binds the catch-all to
+shiply's inbound worker. No MCP tools for either yet — REST only.
+
 CLI: `shiply sending-domain ls · shiply sending-domain add <domain> ·
 shiply sending-domain verify <id> · shiply sending-domain rm <id> --yes`
 

package/skill/references/publishing.md

@@ -70,7 +70,9 @@ shiply publish <dir> --json                 # one machine-readable JSON line, no
 - **`shiply verify <slug>`** prints a human report PLUS a stable machine marker
   line `VERIFY status=LIVE http=200 ssl=valid thumb=…` (or `status=PENDING`).
   Headless agents should parse that `VERIFY status=…` line — it's the
-  contract, like `SITE_READY` in `status`.
+  contract, like `SITE_READY` in `status`. REST: `GET /api/v1/sites/{slug}/verify`
+  (public, no auth — mirrors `site_status`) → `{status, ssl, http, thumbnailUrl,
+  consoleErrorsDeepLink}`. MCP: `verify_site`.
 - **`shiply publish <dir> --as <name>`** gives a stable preview URL that the
   next publish with the same `--as <name>` reuses — no more changing URLs or
   orphaned scratch sites across iterations, independent of the source dir.

package/skill/references/site-features.md

@@ -52,18 +52,28 @@ lists), or `--public` to open it up.
 REST: PATCH /api/v1/publishes/<slug>/access
 with {"mode":"password","password":"..."} or {"mode":"restricted",
 "allowedEmails":[...],"allowedDomains":[...]}, or set mode "public" to open it.
-GET returns the policy (never the hash). MCP tool: `set_site_access`. Enforced
+GET returns the policy (never the hash). MCP tools: `get_site_access` (read),
+`set_site_access` (write). Enforced
 at the edge before any content/proxy/data is served; visitors get a 7-day
 signed cookie; changing any setting signs current visitors out.
 Docs: /docs/access-control
 
 ## Variables — encrypted per-user KV
 
-For API keys the user's sites need: GET/PUT /api/v1/variables
-{"name","value"}, DELETE /api/v1/variables/{NAME}; GET ?reveal=1 returns
-plaintext values. MCP: `set_variable`. Referenced by proxy routes (`${VAR}`)
-and injected into Workers as `env.<NAME>`. Supabase can be connected from the
-dashboard and lands here as SUPABASE_URL + SUPABASE_ANON_KEY.
+CLI (preferred): `shiply variable ls [--reveal]`, `shiply variable set <NAME>
+<value>` (or `--stdin`), `shiply variable rm <NAME> --yes`.
+REST: GET/PUT /api/v1/variables {"name","value"}, DELETE
+/api/v1/variables/{NAME}; GET ?reveal=1 returns plaintext values.
+MCP: `list_variables`, `set_variable`, `delete_variable`. Referenced by proxy
+routes (`${VAR}`) and injected into Workers as `env.<NAME>`. Supabase can be
+connected from the dashboard and lands here as SUPABASE_URL + SUPABASE_ANON_KEY.
+
+Expose (or stop exposing) a saved account variable to one specific site's
+Worker env, independent of proxy routes: CLI `shiply variable attach <NAME>
+--site <slug>` / `shiply variable detach <NAME> --site <slug>` (both
+idempotent). REST: `POST /api/v1/variables/{name}/attach` `{slug}` / `POST
+/api/v1/variables/{name}/detach` `{slug}`. MCP: `attach_variable`,
+`detach_variable`, `list_site_variables`.
 
 ## Drives — private cloud storage (agent memory + assets)
 
@@ -71,6 +81,8 @@ Private storage for files/notes/context you don't want on a public site.
 MCP tools: `list_drives`, `create_drive`, `drive_put_file` (driveId
 "default", utf8/base64, ≤2 MB), `drive_list_files`, `drive_delete_file`,
 `publish_from_drive` (snapshot a drive into a live site).
+Full reference (REST staged uploads, sharing, client assignment, CLI):
+[drives.md](drives.md).
 
 ## Path-mounting + public profile
 
@@ -78,7 +90,8 @@ MCP tools: `list_drives`, `create_drive`, `drive_put_file` (driveId
   (host/docs → target).
 - `set_profile` / `feature_site` (MCP) — stand up the user's public portfolio
   at <handle>.shiply.now and feature a public site on shiply.now/explore.
-- `export_account` (MCP) — JSON bundle of the user's data (no secrets).
+- `export_account` (MCP) / `GET /api/v1/account/export` (REST) — JSON bundle
+  of the user's data (no secrets).
 - Site metadata: `PATCH /api/v1/publish/<slug>/metadata`
   {"title?","spaMode?","addedToProfile?"}.