v0.8.0

Highlights

• Ship reusable site types. A platform admin uploads a type once: a viewer page, its assets, an optional SKILL.md for agents, and a type.json that declares which data paths an instance may hold. Every site built on the type then deploys only its data, and the viewer stays fixed. Versions are immutable, can be yanked and un-yanked, and are listed with their instructions and a preview package through /api/types. #27
• Pin a viewer version, or follow a major. A typed site serves an exact version by default. A manager can switch it to follow new releases within its major, and following only moves forward: yanking a broken release stops new pins, and a fixed patch moves followers on. PUT /api/sites/{name}/type repins, and a deploy can repin and migrate its data in one step with type_target. #27
• Edit typed sites safely. Deploys name the type version they were written for, so an edit prepared against an older viewer cannot silently undo a repin. Source downloads report the version in X-Spot-Type, and deploy events carry site_type so open pages reload after a repin. #27
• Manage types from the CLI. spot deploy --type name@version, with --type-target, --follow major or --pinned, plus spot types list|show|skill|pull|upload|yank|unyank|repin. The gallery and My spots show each site's type, and examples/types/card is a small type to start from. #27

See docs/site-types.md for the package format, the API, caching rules and viewer conventions.

Breaking change

Every site, typed or not, now answers 400 for request paths that contain an empty segment (//), a . or .. segment, an encoded separator (%2F, %5C), a backslash or a control character. Before, // and dot segments redirected to the cleaned path, %2F was decoded and served as /, and %5C answered 404. Browsers resolve dot segments before sending a request, so this mostly affects raw HTTP clients and pages that build URLs with a double slash.

Upgrade notes

• The schema change is additive and applied at startup: SQLite gains the site_type_versions table and three sites columns, and existing sites stay untyped. Type packages are stored under a new _types/ root in the sites bucket or the local sites directory. Back up the database and site storage together, including _types/.
• Rolling back to 0.7.0 is not a binary swap once typed sites exist: 0.7.0 starts and serves ordinary sites, but typed sites lose their viewer, and a deploy made under 0.7.0 is hidden again after re-upgrading. Restore a pre-upgrade backup instead. See Upgrade and rollback.
• Typed sites cannot be published to Cloudflare Pages. Unpublish a site before converting it to a typed site.
• Type uploads, yanks and repins share the deploy rate limit. Proxies that prove the forward-auth secret are exempt, as for deploys.

Images

docker pull ghcr.io/melonamin/spot-api:0.8.0
docker pull ghcr.io/melonamin/spot-caddy:0.8.0

See the full changelog or compare v0.7.0...v0.8.0.