# wzrrd.sh

wzrrd.sh publishes static Sites and signed-in Pro videos on Cloudflare. Command output is JSON with `next_actions`.

## Start here

- Install skill: npx skills add wzrrd-sh/wzrrd-cli --skill wzrrd-publish -g
- Install CLI: curl -fsSL https://wzrrd.sh/install.sh | bash
- Contract: https://wzrrd.sh/openapi.json
- Generated API catalog: https://wzrrd.sh/.well-known/api-catalog
- Hosted skill: https://wzrrd.sh/.well-known/agent-skills/wzrrd-publish/SKILL.md

## Static publish: no login needed

```bash
wzrrd publish --file ./site --slug demo
```

Return the live `url`. If the receipt contains `claimUrl`, return that too and say the anonymous Site expires in 24 hours unless claimed. Sites are `noindex` by default. Do not run login just to publish an ephemeral static artifact.

## Authentication: never spin on human approval

```bash
wzrrd auth-status
# Human terminal only when no live session exists:
wzrrd login
```

Owned Site mutations and Pro video require a saved Better Auth session. Device login requires one human GitHub approval and an interactive CLI process that remains alive to exchange the approved device code for a saved session. Ask the human to run `wzrrd login` in their terminal and wait for completion, then rerun `wzrrd auth-status`. An unattended run exits with `status: "awaiting_human_approval"` and cannot finish or resume that exchange; `--no-open` does not save a session.

## Pro video

```bash
wzrrd video upload ./demo.mp4 --title "My demo"
wzrrd video status <slug>
wzrrd video trace <slug>
wzrrd video revoke <slug>
```

The CLI streams directly to an insert-only R2 presigned PUT, explicitly completes verification, and follows the durable cloud Workflow. Never forward the wzrrd bearer token or cookies to R2. Final stdout contains `watchUrl`, `shareSlug`, and `next_actions`; phase progress is stderr. Use `--no-wait` when the caller does not need to block. A Pro 403 is a real entitlement refusal; surface it.

The Workflow owns Stream encoding, Deepgram transcription, and en, es, pt, fr, de, ja captions. Inspect runtime plus phase history with `video status`; inspect Analytics Engine wide events with `video trace`; restart terminal transcription with `video transcribe --force <slug>`; revoke disposable uploads. Watch pages use https://wzrrd.sh/v/<slug>; captions use `/v/<slug>/captions.vtt` and `/v/<slug>/captions.<lang>.vtt`.

Raw upload API order: `POST /api/videos/uploads`, PUT to the top-level `uploadUrl` using only `upload.headers` and no wzrrd credentials, `POST /api/videos/uploads/{shareSlug}/complete`, then `GET /api/videos/{shareSlug}/status`. Cleanup uses `POST /api/videos/{shareSlug}/revoke`.

## Site and profile management

```bash
wzrrd site status --slug <slug>
wzrrd site set --slug <slug> --title "Title" --indexing index
wzrrd org profile enable --handle <handle>
wzrrd site profile --slug <slug> --listed true
```

Public API reads are sanitized. Organization Profiles are opt-in. Current SSR deploy commands are receipt scaffolding, not live deploy.

## Diagnose

- wzrrd doctor && wzrrd auth-status

## MCP

- Transport: Streamable HTTP at `https://wzrrd.sh/mcp`
- Auth: mandatory wzrrd bearer credential; protected-resource metadata at https://wzrrd.sh/.well-known/oauth-protected-resource; Pro gates still apply
- POST carries JSON-RPC; GET returns 405 because there is no SSE listener; OPTIONS handles CORS preflight. The server is stateless.
- Tools: `listSites`, `publishSite`, `createVideoUpload`, `getVideoStatus`, `transcribeVideo`, `revokeVideo`
- Local files cannot cross the remote MCP boundary. Use the CLI for local video upload; MCP can use a public `sourceUrl`.

## Discovery

- OpenAPI JSON: https://wzrrd.sh/openapi.json
- OpenAPI YAML: https://wzrrd.sh/openapi.yaml
- Generated API catalog: https://wzrrd.sh/.well-known/api-catalog
- Agent Auth discovery: https://wzrrd.sh/.well-known/agent-configuration
- OAuth protected-resource discovery: https://wzrrd.sh/.well-known/oauth-protected-resource
- Agent skills index: https://wzrrd.sh/.well-known/agent-skills/index.json
- Hosted publish/video skill: https://wzrrd.sh/.well-known/agent-skills/wzrrd-publish/SKILL.md
- Agent card: https://wzrrd.sh/.well-known/agent-card.json
- MCP server card: https://wzrrd.sh/.well-known/mcp/server-card.json

## HTTP operations (generated from OpenAPI)

- `GET /mcp` — Open the optional MCP server message stream (bearerSession | agentGrantBearer | bootstrapOperatorBearer | videoServiceBearer)
- `POST /mcp` — MCP server (Streamable HTTP transport) (bearerSession | agentGrantBearer | bootstrapOperatorBearer | videoServiceBearer)
- `OPTIONS /mcp` — Read MCP transport method and header support (anonymous allowed)
- `GET /openapi.json` — Read the OpenAPI contract as JSON (anonymous allowed)
- `GET /openapi.yaml` — Read the canonical OpenAPI contract as YAML (anonymous allowed)
- `POST /api/agent-grants/request` — Request a capability-scoped agent grant (anonymous allowed)
- `GET /api/agent-grants/status` — Poll an agent grant (anonymous allowed)
- `POST /api/agent-grants/approve` — Approve an agent grant (anonymous allowed; operator-only)
- `GET /api/auth/{all}` — Delegated Better Auth GET operation (anonymous allowed)
- `POST /api/auth/{all}` — Delegated Better Auth POST operation (anonymous allowed)
- `PUT /api/auth/{all}` — Delegated Better Auth PUT operation (bearerSession | betterAuthCookie)
- `PATCH /api/auth/{all}` — Delegated Better Auth PATCH operation (bearerSession | betterAuthCookie)
- `DELETE /api/auth/{all}` — Delegated Better Auth DELETE operation (bearerSession | betterAuthCookie)
- `GET /api/auth/github` — Redirect to the Better Auth GitHub callback (anonymous allowed)
- `GET /api/sites` — List Sites (anonymous allowed)
- `POST /api/sites` — Publish a static Site (anonymous allowed)
- `GET /api/sites/{slug}` — Read a Site record (anonymous allowed)
- `PATCH /api/sites/{slug}` — Update Site metadata or lifecycle (bearerSession | betterAuthCookie | agentGrantBearer | bootstrapOperatorBearer)
- `DELETE /api/sites/{slug}` — Delete a Site (bearerSession | betterAuthCookie | agentGrantBearer | bootstrapOperatorBearer)
- `POST /api/sites/{slug}/profile` — List or unlist a Site on its Organization Profile (bearerSession | betterAuthCookie)
- `GET /claim/{slug}` — Claim an anonymous Site through the browser session flow (betterAuthCookie | bearerSession)
- `GET /api/org/profile` — Read the active user's Organization Profile (bearerSession | betterAuthCookie)
- `PUT /api/org/profile` — Enable, update, or disable the active user's Organization Profile (bearerSession | betterAuthCookie)
- `GET /api/ssr-sites` — List registered prototype SSR Sites (anonymous allowed)
- `POST /api/ssr-sites` — Register a prototype SSR Site (bearerSession | betterAuthCookie | agentGrantBearer | bootstrapOperatorBearer)
- `GET /api/webhooks` — List Pro outbound webhook registrations (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `POST /api/webhooks` — Register a Pro outbound webhook (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `DELETE /api/webhooks/{id}` — Remove a Pro outbound webhook (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `POST /api/videos` — Register an existing provider video (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `POST /api/videos/uploads` — Create a direct R2 upload session or mirror a source URL (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `POST /api/videos/uploads/{shareSlug}/complete` — Verify a direct R2 upload and start its Workflow (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `GET /api/videos/{shareSlug}/status` — Read video and Workflow status (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `POST /api/videos/{shareSlug}/transcribe` — Start or restart transcription (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `PATCH /api/videos/{shareSlug}/transcript` — Store an inline transcript or attach transcript artifacts (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `POST /api/videos/{shareSlug}/revoke` — Revoke a video and its original (videoServiceBearer | bootstrapOperatorBearer | bearerSession | betterAuthCookie)
- `GET /v/{slug}/poster.jpg` — Read the visibility-gated progressive JPEG poster (anonymous allowed)
- `GET /v/{slug}/captions.vtt` — Read English WebVTT captions (anonymous allowed)
- `GET /v/{slug}/captions.{lang}.vtt` — Read translated WebVTT captions (anonymous allowed)
- `POST /api/webhooks/stream` — Receive a Cloudflare Stream provider callback (streamWebhookSignature; provider callback)
- `POST /api/webhooks/deepgram` — Receive a Deepgram transcription callback (deepgramCallbackToken; provider callback)
- `POST /api/testing/pro-session` — Mint a deterministic Better Auth testing session (bootstrapOperatorBearer; operator-only)
- `PUT /api/testing/pro-entitlement` — Enable the fixed Pro test identity entitlement (bootstrapOperatorBearer; operator-only)
- `DELETE /api/testing/pro-entitlement` — Disable the fixed Pro test identity entitlement (bootstrapOperatorBearer; operator-only)

## Raw agent prompt

Publish this artifact with wzrrd.sh.

AGENT RULES:
1. For a static file or directory, publish immediately without login:
   wzrrd publish --file <path> --slug <slug>
2. Return the JSON receipt's live url. If it includes claimUrl, return that too and say the anonymous Site expires in 24 hours unless claimed.
3. For video, first run wzrrd auth-status. If no live session exists, ask the human to run wzrrd login in their own interactive terminal and wait for completion. An agent cannot finish device approval or save the resulting session by itself.
4. Upload video with: wzrrd video upload <file> --title "<title>"
5. Follow JSON next_actions. Revoke disposable test videos when finished.
6. If wzrrd is missing: curl -fsSL https://wzrrd.sh/install.sh | bash