git:20261013.072c478 to git:20261014.6429511

- argument-hint: "<text|file_path|directory_path|zip_path> [--ttl N] [--entry filename] [--delivery-mode path|subdomain]"

- allowed-tools: Read, Bash, AskUserQuestion, Glob

- - Remaining text → `content_arg`

- | Input | Type | API |

- |-------|------|-----|

- | `content_arg` is a directory (`test -d`) | SITE | `POST /api/sites` (dir auto-zipped — primary path) |

- | `content_arg` ends with `.zip` AND file exists (`test -f`) | SITE | `POST /api/sites` (pre-built archive upload) |

- | `content_arg` is a file path AND file exists (`test -f`) | FILE | `POST /api/files` (multipart) |

- | `content_arg` starts with `{` or `[` | JSON | `POST /api/json` |

- | Anything else | HTML | `POST /api/html` (format=markdown) |

- Mode rule: directory/ZIP → SITE. Single file → FILE. `POST /api/sites` accepts a multipart `archive=@file.zip` or repeated `files` and matching `paths` fields. This skill auto-zips directories to preserve relative paths. Stats per type — SITE (dir): HTML count, total size, entry file. SITE (ZIP): file size, entry override. FILE: size + MIME via `file --mime-type -b`. TEXT/JSON: char count.

- For SITE: detect entry file using priority: 1) `--entry` flag, 2) `index.html` exists, 3) first `.html` file alphabetically.

- **Built-static guard (run BEFORE zipping).** Publish BUILT output, never project sources:

- - If the directory contains no `.html` file at all → **FAIL** with an explicit error: "No `.html` found — build the site first, then point at the build output directory." Do not guess an entry.

- - If the directory looks like un-built sources (has `package.json` + `src/` but no top-level `.html`) → **warn and ask** the user to point at the build output instead (`dist/`, `build/`, `out/`, `_site/`, or `public/`). Do not zip the source tree.

- Resolution:

- - `2`, `4`, or empty → suggested slug

- - `1` → `public`

- - `3` or any other string → use as-is

- 2) Random: {generated 6-char password, e.g. "kx7p2m"}

- 3) Enter custom password (min 4 chars)

- 4) Skip → no password

-

- Reply with a number or your custom password.

- ```

- Generate random password **EXECUTE** using Bash tool:

- ```bash

- LC_ALL=C tr -dc 'a-z0-9' < /dev/urandom | head -c6 2>/dev/null

- Resolution:

- - `1`, `4`, or empty → no password

- - `2` → use generated random password

- - `3` or custom text → use as-is

- NEW sites and non-public namespaces require Dedicated subdomain (`subdomain`); explicit `path` is rejected.

- NEW public non-sites default to Promotion (`path`) and may select `subdomain`, including password-protected uploads.

- Set `DELIVERY_MODE` to the validated flag value or empty when omitted; send only `X-Delivery-Mode`, never authored-body fields.

- Deduplication may return an OLD or NEW winner: retain its identity, cohort, mode and exact server `link`, even when the requested mode differs.

- Missing/null OLD routing metadata means Existing link; never infer mode from its URL.

-

- For SITE blocks, replace `{entry_shell_quoted}` with one single-quoted shell literal

- for the resolved entry path, including its surrounding quotes. Escape each apostrophe

- as `'\''` (for example, `'pages/A & B.html'`). Never insert it raw or inside double

- quotes: `jq @uri` encodes that literal before it enters the request query.

-

- > **SECURITY:** The ownerToken MUST NEVER appear in conversation output. The bash blocks below handle curl + token parsing + history save atomically; the LLM sees only the URL. Each block sets `PASS_H` first (empty array when no password) and uses `"${PASS_H[@]}"` quoted — passwords are never string-interpolated into the command. The site-dir zip excludes (`.git/`, `.env*`, etc.) are also a secret-leak safeguard — they keep credentials and VCS data out of the published archive.

- **6a. Init history file (run once, before the publish block)** — **EXECUTE** using Bash tool:

- ```bash

- HISTORY_FILE=".claude/brewpage-history.md"

- if [ ! -f "$HISTORY_FILE" ]; then

- mkdir -p "$(dirname "$HISTORY_FILE")"

- cat > "$HISTORY_FILE" <<'HEADER'

- # brewpage.app — Published Pages

- > PRIVATE FILE — keep this out of version control and never share it.

- > Owner tokens allow delete and in-place republish (html/json/kv/sites all support PUT).

- > Delete: `curl -s -X DELETE "<Owner API>" -H "X-Owner-Token: TOKEN"`; rows without one: `https://brewpage.app/api/{type}/{ns}/{id}`, type = html|json|files|kv|sites.

- > Update site (keep same URL): `PUT /api/sites/{ns}/{id}` with `X-Owner-Token: TOKEN` + the new bundle — the uploaded bundle fully replaces the file set (adds new files, removes absent ones, overwrites matching). The link never changes.

- | Date | URL | Owner Token | TTL | Type | Owner API | Identity |

- |------|-----|-------------|-----|------|-----------|----------|

- HEADER

- fi

- ```

- Then run ONE of the following publish blocks based on detected type. Each assumes `HISTORY_FILE` already exists from 6a.

- **HTML/Markdown text** — **EXECUTE** using Bash tool:

- HISTORY_FILE=".claude/brewpage-history.md"

- CONTENT=$(cat <<'BREWPAGE_EOF'

- {content}

- BREWPAGE_EOF

- )

- PAYLOAD=$(jq -n --arg c "$CONTENT" '{content: $c}')

- DELIVERY_H=()

- case "${DELIVERY_MODE:-}" in

- '') : ;;

- path|subdomain) DELIVERY_H=(-H "X-Delivery-Mode: $DELIVERY_MODE") ;;

- *) echo "FAILED: delivery mode must be path or subdomain"; exit 1 ;;

- esac

- PASS_H=()

- [ -n "$PASSWORD" ] && PASS_H=(-H "X-Password: $PASSWORD")

- RESPONSE=$(curl -s -X POST "https://brewpage.app/api/html?ns={ns}&ttl={days}&format=markdown" \

- -H "Content-Type: application/json" \

- "${PASS_H[@]}" "${DELIVERY_H[@]}" \

- -d "$PAYLOAD")

-

- URL=$(echo "$RESPONSE" | jq -r '.link // empty')

- TOKEN=$(echo "$RESPONSE" | jq -r '.ownerToken // empty')

- OWNER_API=$(echo "$RESPONSE" | jq -r '.ownerLink // empty')

- IDENTITY=$(echo "$RESPONSE" | jq -c '{id, namespace, type, routingCohort, deliveryMode, modeLocked, hostingVersion, managementLink, createdAt, expiresAt}')

-

- if [ -n "$URL" ]; then

- [ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | html | $OWNER_API | \`$IDENTITY\` |" >> "$HISTORY_FILE"

- echo "OK $URL"

- else

- echo "FAILED: publish rejected (no .link in response)"

- fi

- **JSON** — **EXECUTE** using Bash tool:

- HISTORY_FILE=".claude/brewpage-history.md"

- DELIVERY_H=()

- case "${DELIVERY_MODE:-}" in

- '') : ;;

- path|subdomain) DELIVERY_H=(-H "X-Delivery-Mode: $DELIVERY_MODE") ;;

- *) echo "FAILED: delivery mode must be path or subdomain"; exit 1 ;;

- esac

- PASS_H=()

- [ -n "$PASSWORD" ] && PASS_H=(-H "X-Password: $PASSWORD")

- RESPONSE=$(curl -s -X POST "https://brewpage.app/api/json?ns={ns}&ttl={days}" \

- -H "Content-Type: application/json" \

- "${PASS_H[@]}" "${DELIVERY_H[@]}" \

- -d '{original_json}')

-

- URL=$(echo "$RESPONSE" | jq -r '.link // empty')

- TOKEN=$(echo "$RESPONSE" | jq -r '.ownerToken // empty')

- OWNER_API=$(echo "$RESPONSE" | jq -r '.ownerLink // empty')

- IDENTITY=$(echo "$RESPONSE" | jq -c '{id, namespace, type, routingCohort, deliveryMode, modeLocked, hostingVersion, managementLink, createdAt, expiresAt}')

-

- if [ -n "$URL" ]; then

- [ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | json | $OWNER_API | \`$IDENTITY\` |" >> "$HISTORY_FILE"

- echo "OK $URL"

- else

- echo "FAILED: publish rejected (no .link in response)"

- fi

- **File** — **EXECUTE** using Bash tool:

- HISTORY_FILE=".claude/brewpage-history.md"

- DELIVERY_H=()

- case "${DELIVERY_MODE:-}" in

- '') : ;;

- path|subdomain) DELIVERY_H=(-H "X-Delivery-Mode: $DELIVERY_MODE") ;;

- *) echo "FAILED: delivery mode must be path or subdomain"; exit 1 ;;

- esac

- PASS_H=()

- [ -n "$PASSWORD" ] && PASS_H=(-H "X-Password: $PASSWORD")

- RESPONSE=$(curl -s -X POST "https://brewpage.app/api/files?ns={ns}&ttl={days}" \

- "${PASS_H[@]}" "${DELIVERY_H[@]}" \

- -F "file=@/absolute/path/to/file")

-

- URL=$(echo "$RESPONSE" | jq -r '.link // empty')

- TOKEN=$(echo "$RESPONSE" | jq -r '.ownerToken // empty')

- OWNER_API=$(echo "$RESPONSE" | jq -r '.ownerLink // empty')

- IDENTITY=$(echo "$RESPONSE" | jq -c '{id, namespace, type, routingCohort, deliveryMode, modeLocked, hostingVersion, managementLink, createdAt, expiresAt}')

-

- if [ -n "$URL" ]; then

- [ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | file | $OWNER_API | \`$IDENTITY\` |" >> "$HISTORY_FILE"

- echo "OK $URL"

- else

- echo "FAILED: publish rejected (no .link in response)"

- fi

-

- **Site (directory)** — **EXECUTE** using Bash tool:

- HISTORY_FILE=".claude/brewpage-history.md"

- DELIVERY_H=()

- case "${DELIVERY_MODE:-}" in

- '') : ;;

- path|subdomain) DELIVERY_H=(-H "X-Delivery-Mode: $DELIVERY_MODE") ;;

- *) echo "FAILED: delivery mode must be path or subdomain"; exit 1 ;;

- esac

- PASS_H=()

- [ -n "$PASSWORD" ] && PASS_H=(-H "X-Password: $PASSWORD")

- TMPZIP=$(mktemp /tmp/brewpage-site-XXXXXX.zip) || { echo "FAILED: cannot allocate site archive"; exit 1; }

- rm -f "$TMPZIP" || { echo "FAILED: cannot prepare site archive"; exit 1; }

- # Exclude VCS, secrets, deps, editor + OS junk and sourcemaps — publish only built static assets.

- if ! (cd "{directory_path}" && zip -r "$TMPZIP" . -x '.git/*' '*/.git/*' '.env' '.env.*' '*/.env' '*/.env.*' 'node_modules/*' '*/node_modules/*' '.DS_Store' '*/.DS_Store' 'Thumbs.db' '.idea/*' '*/.idea/*' '.vscode/*' '*/.vscode/*' '.cache/*' '*/.cache/*' '*.map' '*.log') ||

- [ ! -s "$TMPZIP" ] || ! unzip -tq "$TMPZIP" >/dev/null; then

- rm -f "$TMPZIP"

- echo "FAILED: site archive creation or verification failed"

- exit 1

- fi

- ENTRY_ENCODED=$(printf '%s' {entry_shell_quoted} | jq -sRr @uri)

- RESPONSE=$(curl -s -X POST "https://brewpage.app/api/sites?ns={ns}&ttl={days}&entry=$ENTRY_ENCODED" \

- -H "User-Agent: ClaudeCode/1.0" \

- "${PASS_H[@]}" "${DELIVERY_H[@]}" \

- -F "archive=@$TMPZIP")

- rm -f "$TMPZIP"

-

- URL=$(echo "$RESPONSE" | jq -r '.link // empty')

- TOKEN=$(echo "$RESPONSE" | jq -r '.ownerToken // empty')

- OWNER_API=$(echo "$RESPONSE" | jq -r '.ownerLink // empty')

- IDENTITY=$(echo "$RESPONSE" | jq -c '{id, namespace, type, routingCohort, deliveryMode, modeLocked, hostingVersion, managementLink, createdAt, expiresAt}')

- FCOUNT=$(echo "$RESPONSE" | jq -r '.fileCount // "?"')

-

- if [ -n "$URL" ]; then

- [ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | site ($FCOUNT files) | $OWNER_API | \`$IDENTITY\` |" >> "$HISTORY_FILE"

- echo "OK $URL | Files: $FCOUNT"

- else

- echo "FAILED: publish rejected (no .link in response)"

- fi

-

- **Site (ZIP file)** — **EXECUTE** using Bash tool:

- HISTORY_FILE=".claude/brewpage-history.md"

- DELIVERY_H=()

- case "${DELIVERY_MODE:-}" in

- '') : ;;

- path|subdomain) DELIVERY_H=(-H "X-Delivery-Mode: $DELIVERY_MODE") ;;

- *) echo "FAILED: delivery mode must be path or subdomain"; exit 1 ;;

- esac

- PASS_H=()

- [ -n "$PASSWORD" ] && PASS_H=(-H "X-Password: $PASSWORD")

- ENTRY_ENCODED=$(printf '%s' {entry_shell_quoted} | jq -sRr @uri)

- RESPONSE=$(curl -s -X POST "https://brewpage.app/api/sites?ns={ns}&ttl={days}&entry=$ENTRY_ENCODED" \

- -H "User-Agent: ClaudeCode/1.0" \

- "${PASS_H[@]}" "${DELIVERY_H[@]}" \

- -F "archive=@{zip_file_path}")

-

- URL=$(echo "$RESPONSE" | jq -r '.link // empty')

- TOKEN=$(echo "$RESPONSE" | jq -r '.ownerToken // empty')

- OWNER_API=$(echo "$RESPONSE" | jq -r '.ownerLink // empty')

- IDENTITY=$(echo "$RESPONSE" | jq -c '{id, namespace, type, routingCohort, deliveryMode, modeLocked, hostingVersion, managementLink, createdAt, expiresAt}')

- FCOUNT=$(echo "$RESPONSE" | jq -r '.fileCount // "?"')

-

- if [ -n "$URL" ]; then

- [ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | site ($FCOUNT files) | $OWNER_API | \`$IDENTITY\` |" >> "$HISTORY_FILE"

- echo "OK $URL | Files: $FCOUNT"

- else

- echo "FAILED: publish rejected (no .link in response)"

- fi

- **Success** (bash printed `OK {url}`):

- Owner token saved to .claude/brewpage-history.md

- **Success for SITE** (bash printed `OK {url} | Files: {count}`):

- Owner token saved to .claude/brewpage-history.md

- **Error** (bash printed `FAILED: ...`):

- Publish failed.

- - Always use absolute file paths with curl `-F "file=@..."`.

- - Use `jq -n --arg c "$CONTENT" '{content: $c}'` to safely encode text content. **`format` is a query param**, not a body field — `/api/html` ignores any `format` key inside the JSON body and reads only `?format=` from the URL. Wrong location = server applies default `html` and stores your markdown as raw text.

- - TTL default is `15` days. Namespace must match `^[a-z0-9-]{1,32}$`, default: suggested (private) namespace.

- - To **delete** a published page, find the owner token in `.claude/brewpage-history.md` and use the delete command shown in that file's header.

- - To **update a published site**, `PUT` the replacement bundle to its apex owner API with `X-Owner-Token`; retain the host and omit `X-Delivery-Mode` on ordinary PUT/update.

- - NEW password-protected links stay clean: never generate or append `?p=`. API requests still use `X-Password`; OLD password behavior remains unchanged.

- - **Sites: directory is the primary input** — this skill auto-zips it to preserve relative paths. The API also accepts repeated `files`/`paths` fields. A pre-built `.zip` is the alternative input, uploaded as-is. Always publish BUILT output (`dist/`, `build/`, `out/`, `_site/`, `public/`), never project sources.

- - The auto-zip excludes `.git/`, `.env`/`.env.*`, `node_modules/`, editor/OS junk, sourcemaps and logs — a deliberate secret-leak safeguard so credentials and VCS history never reach the public archive.

- - Entry file detection: `--entry` override > `index.html` > first `.html` alphabetically.