shiply-cli 0.7.1 → 0.12.0

package/dist/framework.js

@@ -1,10 +1,31 @@
 import { readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 const exists = async (p) => stat(p).then((s) => s.isFile() || s.isDirectory(), () => false);
+const SSG_SIGNATURES = [
+    { files: ['config.toml', 'hugo.toml', 'config.yaml', 'hugo.yaml'], framework: 'Hugo', outputDir: 'public', buildCommand: 'hugo' },
+    { files: ['_config.yml', '_config.yaml'], framework: 'Jekyll', outputDir: '_site', buildCommand: 'bundle exec jekyll build' },
+    { files: ['.eleventy.js', 'eleventy.config.js', 'eleventy.config.mjs', 'eleventy.config.cjs'], framework: 'Eleventy', outputDir: '_site', buildCommand: 'npx @11ty/eleventy' },
+    { files: ['mkdocs.yml', 'mkdocs.yaml'], framework: 'MkDocs', outputDir: 'site', buildCommand: 'mkdocs build' },
+];
+async function detectStaticSiteGenerator(dir) {
+    for (const sig of SSG_SIGNATURES) {
+        for (const f of sig.files) {
+            if (await exists(join(dir, f))) {
+                return { framework: sig.framework, outputDir: sig.outputDir, spa: false, buildCommand: sig.buildCommand };
+            }
+        }
+    }
+    return null;
+}
 /** Detect a framework *source* directory (package.json, no root index.html)
  *  so `shiply publish .` on a React/Vue/etc project can do the right thing:
  *  publish the build output with SPA mode instead of raw source files. */
 export async function detectFramework(dir) {
+    // SSG configs win over package.json-based detection (a Hugo site might
+    // have a package.json for tooling but isn't a JS-framework build).
+    const ssg = await detectStaticSiteGenerator(dir);
+    if (ssg)
+        return ssg;
     if (await exists(join(dir, 'index.html'))) {
         // Vite keeps index.html at the root of the *source* too — only treat it as
         // a source dir when a vite config is present alongside it.
@@ -31,6 +52,24 @@ export async function detectFramework(dir) {
     if (has('next')) {
         return { framework: 'Next.js', outputDir: 'out', spa: false, buildCommand: 'npm run build  (needs `output: "export"` in next.config)' };
     }
+    if (has('nuxt')) {
+        return { framework: 'Nuxt', outputDir: '.output/public', spa: false, buildCommand: 'npm run generate  (or `npm run build` with nitro preset "static")' };
+    }
+    if (has('@remix-run/react')) {
+        return { framework: 'Remix', outputDir: 'build/client', spa: true, buildCommand: 'npm run build' };
+    }
+    if (has('@docusaurus/core')) {
+        return { framework: 'Docusaurus', outputDir: 'build', spa: false, buildCommand: 'npm run build' };
+    }
+    if (has('hexo')) {
+        return { framework: 'Hexo', outputDir: 'public', spa: false, buildCommand: 'npx hexo generate' };
+    }
+    if (has('@solidjs/start')) {
+        return { framework: 'SolidStart', outputDir: 'dist/public', spa: false, buildCommand: 'npm run build  (use static preset in app.config)' };
+    }
+    if (has('@builder.io/qwik-city')) {
+        return { framework: 'Qwik City', outputDir: 'dist', spa: false, buildCommand: 'npm run build.static  (or use static adapter)' };
+    }
     if (has('astro'))
         return { framework: 'Astro', outputDir: 'dist', spa: false, buildCommand: 'npm run build' };
     if (has('@sveltejs/kit')) {
@@ -50,3 +89,74 @@ export async function findBuildOutput(dir, hint) {
     const out = join(dir, hint.outputDir);
     return (await exists(join(out, 'index.html'))) ? out : null;
 }
+/** Common output directories, in priority order. First match wins. */
+const BUILT_OUTPUT_DIRS = ['dist', 'build', 'out', '_site', 'public', '.output/public'];
+/** Named framework hints for `--framework=<name>` override. Lowercase keys; aliases allowed. */
+const NAMED_FRAMEWORKS = {
+    'next.js': { framework: 'Next.js', outputDir: 'out', spa: false, buildCommand: 'npm run build  (needs `output: "export"` in next.config)' },
+    next: { framework: 'Next.js', outputDir: 'out', spa: false, buildCommand: 'npm run build  (needs `output: "export"` in next.config)' },
+    nuxt: { framework: 'Nuxt', outputDir: '.output/public', spa: false, buildCommand: 'npm run generate' },
+    astro: { framework: 'Astro', outputDir: 'dist', spa: false, buildCommand: 'npm run build' },
+    sveltekit: { framework: 'SvelteKit', outputDir: 'build', spa: true, buildCommand: 'npm run build  (use adapter-static)' },
+    vite: { framework: 'Vite', outputDir: 'dist', spa: true, buildCommand: 'npm run build' },
+    remix: { framework: 'Remix', outputDir: 'build/client', spa: true, buildCommand: 'npm run build' },
+    cra: { framework: 'Create React App', outputDir: 'build', spa: true, buildCommand: 'npm run build' },
+    docusaurus: { framework: 'Docusaurus', outputDir: 'build', spa: false, buildCommand: 'npm run build' },
+    hexo: { framework: 'Hexo', outputDir: 'public', spa: false, buildCommand: 'npx hexo generate' },
+    solidstart: { framework: 'SolidStart', outputDir: 'dist/public', spa: false, buildCommand: 'npm run build' },
+    qwik: { framework: 'Qwik City', outputDir: 'dist', spa: false, buildCommand: 'npm run build.static' },
+    hugo: { framework: 'Hugo', outputDir: 'public', spa: false, buildCommand: 'hugo' },
+    jekyll: { framework: 'Jekyll', outputDir: '_site', spa: false, buildCommand: 'bundle exec jekyll build' },
+    eleventy: { framework: 'Eleventy', outputDir: '_site', spa: false, buildCommand: 'npx @11ty/eleventy' },
+    '11ty': { framework: 'Eleventy', outputDir: '_site', spa: false, buildCommand: 'npx @11ty/eleventy' },
+    mkdocs: { framework: 'MkDocs', outputDir: 'site', spa: false, buildCommand: 'mkdocs build' },
+};
+/** Look up a framework hint by name (case-insensitive). Used by `--framework=<name>` override. */
+export function frameworkByName(name) {
+    return NAMED_FRAMEWORKS[name.toLowerCase()] ?? null;
+}
+/** Detect a pre-built static output the user has already produced. Used when
+ *  no framework signature matched the source dir, as a last resort before
+ *  treating the dir itself as the static payload. */
+export async function detectBuiltOutput(dir) {
+    for (const out of BUILT_OUTPUT_DIRS) {
+        if (await exists(join(dir, out, 'index.html'))) {
+            return { framework: 'pre-built', outputDir: out, spa: false, buildCommand: `(skipped — ${out}/ already present)` };
+        }
+    }
+    return null;
+}
+/** Decide which directory to publish:
+ *  0. If `override.framework` is set → trust it, build-or-throw.
+ *  1. If a framework matched and its outputDir has index.html → that.
+ *  2. Else if a framework matched but the outputDir is missing → throw (user needs to build).
+ *  3. Else if a pre-built output dir exists → that.
+ *  4. Else → the source dir as-is. */
+export async function resolvePayloadDir(sourceDir, override) {
+    if (override?.framework) {
+        const hint = frameworkByName(override.framework);
+        if (!hint) {
+            throw new Error(`Unknown framework "${override.framework}". Try one of: ${Object.keys(NAMED_FRAMEWORKS).join(', ')}`);
+        }
+        const built = await findBuildOutput(sourceDir, hint);
+        if (!built) {
+            throw new Error(`--framework=${override.framework} expects ${hint.outputDir}/index.html — build first:\n` +
+                `    ${hint.buildCommand}\n` +
+                `    then: shiply publish ./${hint.outputDir}${hint.spa ? ' --spa' : ''}`);
+        }
+        return { dir: built, hint };
+    }
+    const framework = await detectFramework(sourceDir);
+    if (framework) {
+        const built = await findBuildOutput(sourceDir, framework);
+        if (built)
+            return { dir: built, hint: framework };
+        throw new Error(`Detected ${framework.framework}, but ${framework.outputDir}/index.html is missing — build first:\n` +
+            `    ${framework.buildCommand}\n` +
+            `    then: shiply publish ./${framework.outputDir}${framework.spa ? ' --spa' : ''}`);
+    }
+    const fallback = await detectBuiltOutput(sourceDir);
+    if (fallback)
+        return { dir: join(sourceDir, fallback.outputDir), hint: fallback };
+    return { dir: sourceDir, hint: null };
+}

package/dist/index.js

@@ -1,46 +1,86 @@
 #!/usr/bin/env node
 import { createInterface } from 'node:readline/promises';
-import { join } from 'node:path';
 import { parseArgs } from 'node:util';
 import { confetti } from './confetti.js';
-import { detectFramework, findBuildOutput } from './framework.js';
+import { runDetect } from './detect.js';
+import { resolvePayloadDir } from './framework.js';
+import { runClaimVerify } from './claim.js';
+import { dbAttach, dbBranch, dbBranches, dbCreate, dbDelete, dbDeleteBranch, dbLs, dbMerge, dbMigrate, dbSql, } from './db.js';
 import { driveGet, driveLs, drivePublish, drivePut, driveRm } from './drive.js';
+import { domainAdd, domainConnect, domainLs, domainSubAdd, domainSync } from './domain.js';
 import { loadApiKey, saveApiKey } from './config.js';
-import { api, DEFAULT_BASE, publish, resolveBase } from './publish.js';
+import { loginViaDeviceFlow } from './login.js';
+import { api, ApiError, DEFAULT_BASE, publish, resolveBase } from './publish.js';
 import { installSkill } from './skill.js';
 import { readState, writeState } from './state.js';
 import { checkReadiness, targetToHostname } from './status.js';
-const HELP = `shiply — instant static hosting for agents (https://shiply.now)
-
-Usage:
-  shiply publish <dir> [options]              Publish a directory, print the live URL.
-                                              Re-running UPDATES the same site (state in .shiply.json)
-  shiply update <dir>                         Same as publish when .shiply.json exists
-  shiply status <slug-or-domain> [--wait]     SSL + readiness check (agent-friendly output)
-  shiply duplicate <slug>                     Server-side copy of an owned site → new URL
-  shiply drive <ls|put|get|rm|publish>        Private cloud storage (drive publish → live site)
-  shiply skill [--project]                    Install the shiply skill for your AI agent
-                                              (global ~/.claude/skills, or ./.claude/skills with --project)
-  shiply login [--email <address>]            Email a 6-digit code, mint + save an API key
-  shiply help
-
-Options:
-  --spa                  Single-page app mode (unknown paths fall back to index.html)
-  --claim-token <tok>    Update a specific anonymous site (overrides .shiply.json)
-  --new-site             Ignore .shiply.json and create a fresh site
-  --key <key>            API key (default: $SHIPLY_API_KEY, then ~/.shiply/credentials)
-  --anonymous            Publish without an API key even if one is saved
-  --base <url>           API origin (default: ${DEFAULT_BASE})
-  --wait                 (status) poll until the site is ready
-  --timeout <seconds>    (status --wait) give up after this long (default 300)
-  --no-confetti          Celebrate quietly
-
-\`shiply status\` prints stable machine-readable markers for agents:
-SSL_READY and SITE_READY on success (exit 0); ✖ lines and exit 1 otherwise.
-
-With an API key the site is permanent and owned by your account. Without one
-it expires in 24 hours — save the printed claimToken/claimUrl to update or
-claim it later.
+const HELP = `shiply — instant static hosting for agents (https://shiply.now)
+
+Usage:
+  shiply publish <dir> [options]              Publish a directory, print the live URL.
+                                              Re-running UPDATES the same site (state in .shiply.json)
+  shiply update <dir>                         Same as publish when .shiply.json exists
+  shiply status <slug-or-domain> [--wait]     SSL + readiness check (agent-friendly output)
+  shiply duplicate <slug>                     Server-side copy of an owned site → new URL
+  shiply detect [dir]                         Diagnose: print framework + dir that would upload
+                                              (no upload — use --framework=<name> to test an override)
+  shiply drive <ls|put|get|rm|publish>        Private cloud storage (drive publish → live site)
+  shiply db <create|ls|sql|migrate|delete|attach>
+                                              Per-site SQL databases (Cloudflare D1 or Neon Postgres)
+  shiply db create <name> [--postgres] [--site <slug>]
+                                              D1 by default — pass --postgres for Neon
+  shiply db branch <db> <branch-name>          Branch a Neon database (developer plan)
+  shiply db branches <db>                      List branches of a Neon database
+  shiply db delete-branch <branch-or-id> --yes Delete a Neon branch
+  shiply db merge <branch>                     No-op alias — prints the pg_dump migration tip
+  shiply domain ls                            List custom domains on your account
+  shiply domain add <domain>                  Register a custom domain
+  shiply domain connect <domain>              One-click OAuth DNS setup (Cloudflare/Domain Connect)
+  shiply domain sub add <host> --site <slug>  Map a subdomain (e.g. app.example.com) to a slug
+  shiply domain sync <domain>                 Re-sync DNS records for a connected domain
+  shiply data init [dir]                      Scaffold a starter .shiply/data.json in <dir> (default cwd)
+  shiply data list <slug>                     List collections on a site with counts
+  shiply data query <slug> <coll> [--limit N] [--cursor C] [--where '<json>']
+                                              Read records (default 50)
+  shiply data insert <slug> <coll> --json '<body>'
+                                              Insert one record via the public endpoint
+  shiply data export <slug> <coll> [--out file.ndjson]
+                                              Stream every record as NDJSON
+  shiply data wipe-collection <slug> <coll> --yes
+                                              Delete every record in a collection
+  shiply claim verify <code>                  Confirm a pairing code from /claim/<slug>?pair=1
+                                              (uses .shiply.json from CWD)
+  shiply skill [--project]                    Install the shiply skill for your AI agent
+                                              (global ~/.claude/skills, or ./.claude/skills with --project)
+  shiply login [--name <label>]               Open a browser, click Allow → key saved
+                                              (--email <addr> falls back to legacy 6-digit code)
+  shiply help
+
+Options:
+  --spa                  Single-page app mode (unknown paths fall back to index.html)
+  --framework <name>     Force the detector (e.g. hugo, nuxt, vite) for non-standard layouts
+  --claim-token <tok>    Update a specific anonymous site (overrides .shiply.json)
+  --new-site             Ignore .shiply.json and create a fresh site
+  --preview-branch <id>  (publish) bind this version to a Neon branch's DATABASE_URL
+                         (id = the branch row's site_databases.id; off by default)
+  --key <key>            API key (default: $SHIPLY_API_KEY, then ~/.shiply/credentials)
+  --anonymous            Publish without an API key even if one is saved
+  --base <url>           API origin (default: ${DEFAULT_BASE})
+  --wait                 (status) poll until the site is ready
+  --timeout <seconds>    (status --wait) give up after this long (default 300)
+  --json <body>          (data insert) JSON object to insert
+  --limit <N>            (data query) max records to return (default 50)
+  --cursor <iso>         (data query) pagination cursor from previous response
+  --where <json>         (data query) client-side filter, e.g. '{"email":"a@b.co"}'
+  --yes                  (data wipe-collection) skip the safety prompt
+  --no-confetti          Celebrate quietly
+
+\`shiply status\` prints stable machine-readable markers for agents:
+SSL_READY and SITE_READY on success (exit 0); ✖ lines and exit 1 otherwise.
+
+With an API key the site is permanent and owned by your account. Without one
+it expires in 24 hours — save the printed claimToken/claimUrl to update or
+claim it later.
 `;
 async function reportReadiness(host, celebrate) {
     const r = await checkReadiness(host);
@@ -70,17 +110,29 @@ async function main() {
         allowPositionals: true,
         options: {
             spa: { type: 'boolean' },
+            framework: { type: 'string' },
             'claim-token': { type: 'string' },
             key: { type: 'string' },
             anonymous: { type: 'boolean' },
             base: { type: 'string' },
             email: { type: 'string' },
+            name: { type: 'string' },
             wait: { type: 'boolean' },
             'new-site': { type: 'boolean' },
             project: { type: 'boolean' },
             timeout: { type: 'string' },
             out: { type: 'string', short: 'o' },
+            site: { type: 'string' },
+            binding: { type: 'string' },
+            params: { type: 'string' },
+            postgres: { type: 'boolean' },
+            'preview-branch': { type: 'string' },
+            yes: { type: 'boolean' },
             'no-confetti': { type: 'boolean' },
+            json: { type: 'string' },
+            limit: { type: 'string' },
+            cursor: { type: 'string' },
+            where: { type: 'string' },
             help: { type: 'boolean', short: 'h' },
         },
     });
@@ -95,26 +147,14 @@ async function main() {
             if (!dir)
                 throw new Error(`usage: shiply ${cmd} <dir>`);
             const apiKey = values.anonymous ? undefined : (values.key ?? (await loadApiKey()));
-            // Full React/Vue/etc apps work great — but you publish the BUILD OUTPUT,
-            // not the source. Detect source dirs and do the right thing.
-            let publishDir = dir;
-            let spa = values.spa;
-            const hint = await detectFramework(dir);
-            if (hint) {
-                const out = await findBuildOutput(dir, hint);
-                if (out) {
-                    publishDir = out;
-                    if (hint.spa && spa === undefined)
-                        spa = true;
-                    console.log(`✔ ${hint.framework} project detected — publishing ${out}${hint.spa ? ' with SPA mode' : ''}`);
-                }
-                else {
-                    throw new Error(`this looks like a ${hint.framework} project (source code, not a built site).\n` +
-                        `  Build it first, then publish the output:\n` +
-                        `    ${hint.buildCommand}\n` +
-                        `    shiply ${cmd} ${join(dir, hint.outputDir)}${hint.spa ? ' --spa' : ''}\n` +
-                        `  (or pass the built folder directly if it lives elsewhere)`);
-                }
+            // Any static site works — React/Vue/Astro/Hugo/Jekyll/etc — but you
+            // publish the BUILD OUTPUT, not the source. resolvePayloadDir picks the
+            // right dir (source as-is, a matched framework's build output, or a
+            // pre-built fallback like dist/).
+            const { dir: publishDir, hint } = await resolvePayloadDir(dir, { framework: values.framework });
+            const spa = values.spa ?? (hint?.spa ? true : undefined);
+            if (hint && publishDir !== dir) {
+                console.log(`✔ ${hint.framework} project detected — publishing ${publishDir}${hint.spa ? ' with SPA mode' : ''}`);
             }
             // same command, same URL: reuse this directory's site automatically
             const state = await readState(publishDir);
@@ -128,18 +168,28 @@ async function main() {
                 throw new Error('nothing to update here — publish first (shiply remembers the site in .shiply.json), or pass --claim-token');
             }
             const updating = Boolean(claimToken || slug);
+            // Auto-attach a previously-created database on publish. Anonymous
+            // publishes can't attach (no auth subject) — silently skipped server-side.
+            const attachDatabaseId = state?.databaseId && apiKey ? state.databaseId : undefined;
+            // Opt-in: bind THIS publish version to a Neon branch's URI. Server
+            // validates ownership + that the branch lives under a project attached
+            // to this site; a bogus/foreign id silently falls back to the parent URI.
+            const previewBranchDbId = values['preview-branch'];
             const res = await publish(publishDir, {
                 apiKey,
                 base: values.base,
                 spaMode: spa,
                 claimToken,
                 slug,
+                attachDatabaseId,
+                previewBranchDbId,
             });
             await writeState(publishDir, {
                 slug: res.slug,
                 siteUrl: res.siteUrl,
                 ...(res.claimToken ? { claimToken: res.claimToken } : state?.claimToken && updating ? { claimToken: state.claimToken } : {}),
                 owned: !res.anonymous,
+                ...(state?.databaseId ? { databaseId: state.databaseId } : {}),
             });
             const skipped = res.skipped > 0 ? ` (${res.skipped} unchanged, skipped)` : '';
             console.log(`✔ ${updating ? `updated ${res.slug} in place` : 'published'} — ${res.uploaded} file${res.uploaded === 1 ? '' : 's'}${skipped}`);
@@ -212,6 +262,10 @@ async function main() {
             console.log(`\n  ${out.siteUrl}\n`);
             return;
         }
+        case 'detect': {
+            await runDetect(dir ?? '.', { framework: values.framework });
+            return;
+        }
         case 'drive': {
             const apiKey = values.key ?? (await loadApiKey());
             if (!apiKey)
@@ -246,6 +300,200 @@ async function main() {
                     throw new Error('usage: shiply drive <ls|put|get|rm|publish>');
             }
         }
+        case 'data': {
+            const sub = dir; // positionals[1]
+            // `data init` is local-only (no network, no API key) — handle before the key check.
+            if (sub === 'init') {
+                const { dataInit } = await import('./data-init.js');
+                const target = await dataInit(positionals[2] ?? '.');
+                console.log(`✔ wrote ${target}`);
+                console.log('  edit collections, then `shiply publish` to enable site data');
+                return;
+            }
+            const apiKey = values.key ?? (await loadApiKey());
+            if (!apiKey)
+                throw new Error('data commands need an API key — run `shiply login` first');
+            const dctx = { base: values.base, apiKey };
+            const slug = positionals[2];
+            const collection = positionals[3];
+            switch (sub) {
+                case 'list': {
+                    if (!slug)
+                        throw new Error('usage: shiply data list <slug>');
+                    const { dataList } = await import('./data.js');
+                    await dataList(dctx, slug);
+                    return;
+                }
+                case 'query': {
+                    if (!slug || !collection)
+                        throw new Error("usage: shiply data query <slug> <collection> [--limit N] [--cursor C] [--where '<json>']");
+                    const { dataQuery } = await import('./data.js');
+                    await dataQuery(dctx, slug, collection, {
+                        limit: values.limit ? Number(values.limit) : undefined,
+                        cursor: values.cursor,
+                        where: values.where,
+                    });
+                    return;
+                }
+                case 'insert': {
+                    if (!slug || !collection)
+                        throw new Error("usage: shiply data insert <slug> <collection> --json '<body>'");
+                    if (!values.json)
+                        throw new Error('--json <body> is required');
+                    let body;
+                    try {
+                        body = JSON.parse(values.json);
+                    }
+                    catch {
+                        throw new Error('--json must be a valid JSON object');
+                    }
+                    const { dataInsert } = await import('./data.js');
+                    await dataInsert(dctx, slug, collection, body);
+                    return;
+                }
+                case 'export': {
+                    if (!slug || !collection)
+                        throw new Error('usage: shiply data export <slug> <collection> [--out file.ndjson]  (omit --out to stream to stdout)');
+                    const { dataExport } = await import('./data.js');
+                    await dataExport(dctx, slug, collection, { out: values.out });
+                    return;
+                }
+                case 'wipe-collection': {
+                    if (!slug || !collection)
+                        throw new Error('usage: shiply data wipe-collection <slug> <collection> --yes');
+                    const { dataWipeCollection } = await import('./data.js');
+                    await dataWipeCollection(dctx, slug, collection, { yes: Boolean(values.yes) });
+                    return;
+                }
+                default:
+                    throw new Error('usage: shiply data <init|list|query|insert|export|wipe-collection>');
+            }
+        }
+        case 'domain': {
+            const apiKey = values.key ?? (await loadApiKey());
+            if (!apiKey)
+                throw new Error('domain commands need an API key — run `shiply login` first');
+            const dctx = { base: values.base, apiKey };
+            const sub = dir; // positionals[1]
+            const arg = positionals[2];
+            const arg2 = positionals[3];
+            switch (sub) {
+                case 'ls':
+                    await domainLs(dctx);
+                    return;
+                case 'add':
+                    if (!arg)
+                        throw new Error('usage: shiply domain add <domain>');
+                    await domainAdd(dctx, arg);
+                    return;
+                case 'connect':
+                    if (!arg)
+                        throw new Error('usage: shiply domain connect <domain>');
+                    await domainConnect(dctx, arg);
+                    return;
+                case 'sub': {
+                    if (arg !== 'add')
+                        throw new Error('usage: shiply domain sub add <host> --site <slug>');
+                    const hostname = arg2;
+                    const slug = values.site;
+                    if (!hostname)
+                        throw new Error('usage: shiply domain sub add <host> --site <slug>');
+                    if (!slug)
+                        throw new Error('--site <slug> is required for `shiply domain sub add`');
+                    await domainSubAdd(dctx, hostname, slug);
+                    return;
+                }
+                case 'sync':
+                    if (!arg)
+                        throw new Error('usage: shiply domain sync <domain>');
+                    await domainSync(dctx, arg);
+                    return;
+                default:
+                    throw new Error('usage: shiply domain <ls|add|connect|sub|sync>');
+            }
+        }
+        case 'db': {
+            const apiKey = values.key ?? (await loadApiKey());
+            if (!apiKey)
+                throw new Error('db commands need an API key — run `shiply login` first');
+            const dctx = { base: values.base, apiKey };
+            const sub = dir; // positionals[1]
+            const arg = positionals[2];
+            const arg2 = positionals[3];
+            switch (sub) {
+                case 'create':
+                    if (!arg)
+                        throw new Error('usage: shiply db create <name> [--postgres] [--site <slug>] [--binding <NAME>]');
+                    await dbCreate(dctx, arg, {
+                        site: values.site,
+                        binding: values.binding,
+                        cwd: process.cwd(),
+                        postgres: Boolean(values.postgres),
+                    });
+                    return;
+                case 'ls':
+                    await dbLs(dctx);
+                    return;
+                case 'sql':
+                    if (!arg || !arg2)
+                        throw new Error('usage: shiply db sql <name-or-id> "<query>" [--params <json>]');
+                    await dbSql(dctx, arg, arg2, values.params);
+                    return;
+                case 'migrate':
+                    if (!arg || !arg2)
+                        throw new Error('usage: shiply db migrate <name-or-id> <dir>');
+                    await dbMigrate(dctx, arg, arg2);
+                    return;
+                case 'delete':
+                    if (!arg)
+                        throw new Error('usage: shiply db delete <name-or-id> [--yes]');
+                    await dbDelete(dctx, arg, { yes: Boolean(values.yes) });
+                    return;
+                case 'attach':
+                    if (!arg)
+                        throw new Error('usage: shiply db attach <name-or-id> --site <slug>');
+                    if (!values.site)
+                        throw new Error('--site <slug> is required for `shiply db attach`');
+                    await dbAttach(dctx, arg, values.site);
+                    return;
+                case 'branch':
+                    if (!arg || !arg2)
+                        throw new Error('usage: shiply db branch <db-name-or-id> <branch-name>');
+                    await dbBranch(dctx, arg, arg2);
+                    return;
+                case 'branches':
+                    if (!arg)
+                        throw new Error('usage: shiply db branches <db-name-or-id>');
+                    await dbBranches(dctx, arg);
+                    return;
+                case 'delete-branch':
+                    if (!arg)
+                        throw new Error('usage: shiply db delete-branch <branch-name-or-id> [--yes]');
+                    await dbDeleteBranch(dctx, arg, { yes: Boolean(values.yes) });
+                    return;
+                case 'merge':
+                    if (!arg)
+                        throw new Error('usage: shiply db merge <branch-name>');
+                    await dbMerge(dctx, arg);
+                    return;
+                default:
+                    throw new Error('usage: shiply db <create|ls|sql|migrate|delete|attach|branch|branches|delete-branch|merge>');
+            }
+        }
+        case 'claim': {
+            if (dir !== 'verify') {
+                console.error('Usage: shiply claim verify <SHIPLY-XXXXXXXX>');
+                process.exit(2);
+            }
+            const code = positionals[2];
+            if (!code) {
+                console.error('Usage: shiply claim verify <SHIPLY-XXXXXXXX>');
+                process.exit(2);
+            }
+            const r = await runClaimVerify({ code });
+            console.log(r.message);
+            process.exit(r.ok ? 0 : 1);
+        }
         case 'skill': {
             const written = await installSkill(Boolean(values.project));
             for (const w of written)
@@ -256,9 +504,25 @@ async function main() {
         }
         case 'login': {
             const base = resolveBase(values.base);
+            // Default path: device flow. One click in the browser, no email round-trip.
+            // The --email flag opts into the legacy code-by-email path (useful for
+            // scripted/non-interactive runs that can't open a browser).
+            if (!values.email) {
+                const result = await loginViaDeviceFlow(base, values.name);
+                if (!result.ok) {
+                    console.error(`✗ login failed: ${result.reason}`);
+                    process.exit(1);
+                }
+                const path = await saveApiKey(result.apiKey);
+                console.log(`✔ key saved to ${path}`);
+                if (result.slug)
+                    console.log(`  also: site ${result.slug} attached to your account`);
+                console.log('  publishes are now permanent and owned by your account');
+                return;
+            }
             const rl = createInterface({ input: process.stdin, output: process.stdout });
             try {
-                const email = values.email ?? (await rl.question('Email address: '));
+                const email = values.email;
                 await api(`${base}/api/auth/agent/request-code`, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
@@ -284,6 +548,14 @@ async function main() {
     }
 }
 main().catch((e) => {
+    // Plan-gate refusals (server returns 402 + code 'payment_required'): surface
+    // the server's human message and ALWAYS append a no-confusion upgrade pointer,
+    // even if the server message already embeds the URL. Quiet exit (no stack).
+    if (e instanceof ApiError && e.code === 'payment_required') {
+        console.error(`✖ ${e.message}`);
+        console.error(`  upgrade: https://shiply.now/dashboard/plan`);
+        process.exit(1);
+    }
     const msg = e instanceof Error ? e.message : String(e);
     console.error(`✖ ${msg}`);
     process.exit(1);