shiply-cli 0.5.0 → 0.6.0

package/dist/index.js

@@ -16,6 +16,7 @@ Usage:
                                               Re-running UPDATES the same site (state in .shiply.json)
   shiply update <dir>                         Same as publish when .shiply.json exists
   shiply status <slug-or-domain> [--wait]     SSL + readiness check (agent-friendly output)
+  shiply duplicate <slug>                     Server-side copy of an owned site → new URL
   shiply skill [--project]                    Install the shiply skill for your AI agent
                                               (global ~/.claude/skills, or ./.claude/skills with --project)
   shiply login [--email <address>]            Email a 6-digit code, mint + save an API key
@@ -192,6 +193,22 @@ async function main() {
                 await new Promise((r) => setTimeout(r, 5000));
             }
         }
+        case 'duplicate': {
+            if (!dir)
+                throw new Error('usage: shiply duplicate <slug>');
+            const apiKey = values.key ?? (await loadApiKey());
+            if (!apiKey)
+                throw new Error('duplicate needs an API key — run `shiply login` first');
+            const base = resolveBase(values.base);
+            const out = await api(`${base}/api/v1/publishes/${dir}/duplicate`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
+                body: JSON.stringify({}),
+            });
+            console.log(`✔ duplicated ${dir} → ${out.slug} (${out.filesCount} files)`);
+            console.log(`\n  ${out.siteUrl}\n`);
+            return;
+        }
         case 'skill': {
             const written = await installSkill(Boolean(values.project));
             for (const w of written)

package/dist/manifest.js

@@ -36,7 +36,8 @@ export const contentTypeFor = (path) => MIME[extname(path).toLowerCase()] ?? 'ap
 const SKIP_DIRS = new Set(['node_modules']);
 /** Walk a directory into the publish manifest: posix-relative paths, byte
  *  sizes, sha256 hex hashes (server hash-skips unchanged files on update).
- *  Dot entries and node_modules are never published. */
+ *  Dot entries and node_modules are never published — except the .shiply/
+ *  config directory (proxy.json, data.json), which the server consumes. */
 export async function buildManifest(dir) {
     const out = [];
     await walk(dir, '', out);
@@ -45,6 +46,10 @@ export async function buildManifest(dir) {
 async function walk(abs, rel, out) {
     const entries = await readdir(abs, { withFileTypes: true });
     for (const e of entries) {
+        if (e.name === '.shiply' && e.isDirectory() && rel === '') {
+            await walk(join(abs, e.name), '.shiply', out);
+            continue;
+        }
         if (e.name.startsWith('.') || SKIP_DIRS.has(e.name))
             continue;
         const childAbs = join(abs, e.name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shiply-cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Publish static sites to shiply.now from the command line — instant web hosting for agents.",
   "license": "MIT",
   "type": "module",

package/skill/SKILL.md

@@ -69,6 +69,33 @@ cheap: unchanged files are skipped server-side.
   finalized version live instantly.
 - **SPA**: pass `"spaMode":true` so deep links serve index.html.
 
+## Proxy routes — AI/API calls WITHOUT exposing keys
+NEVER embed API keys in published HTML/JS. Instead: store the key as a
+Variable (PUT /api/v1/variables), then include `.shiply/proxy.json` in the
+published files declaring routes, e.g. {"proxies":{"/api/chat":{"upstream":
+"https://openrouter.ai/api/v1/chat/completions","method":"POST","headers":
+{"Authorization":"Bearer ${OPENROUTER_API_KEY}"}}}}. The page then calls the
+relative path (fetch('/api/chat')) and shiply injects the secret server-side.
+Prefix routes "/api/db/*" forward subpaths (great for Supabase REST).
+Owned sites only; https public upstreams only. Docs: /docs/proxy-routes
+
+## Site Data — forms/waitlists/guestbooks with ZERO backend
+When the user wants to collect anything from visitors (waitlist, contact
+form, RSVP, guestbook): include `.shiply/data.json` in the published files,
+e.g. {"collections":{"signups":{"fields":{"email":{"type":"email",
+"required":true}},"access":{"read":"owner","insert":"public"}}}}, then have
+the page POST JSON to the relative path /.shiply/data/signups. Records are
+validated server-side; the owner reads them in the dashboard (Data section,
+CSV export) or GET /api/v1/publishes/<slug>/data/<collection> with a Bearer
+key. Owned sites only. Docs: /docs/site-data
+
+## Make a site private (paid plans)
+To password-protect or restrict a site: PATCH /api/v1/publishes/<slug>/access
+with {"mode":"password","password":"..."} or {"mode":"restricted",
+"allowedEmails":[...],"allowedDomains":[...]}, or set mode "public" to open it.
+MCP tool set_site_access does the same. Enforced before any content is served;
+changing settings signs current visitors out. Docs: /docs/access-control
+
 ## Full React / Vue / Svelte / Astro apps — YES, they work
 shiply hosts complete framework apps. Publish the BUILD OUTPUT, never the
 source: run the build, then publish the output dir with SPA mode for