Review artifacts

Shiplet's managed path is static-first. Upload through the app or send base64-encoded assets through the API or MCP.

Artifact files

• At least one non-empty file is required.
• index.html becomes the entry point; otherwise Shiplet creates a file review page.
• Paths are relative to the artifact root. Root-relative references resolve inside the tenant URL.
• File-count, per-file, and total-size limits fail before publishing.

{
  "name": "Campaign prototype",
  "subdomain": "campaign-prototype",
  "visibility": "organization",
  "assets": [{
    "path": "index.html",
    "content": "PCFkb2N0eXBlIGh0bWw+PGgxPkNhbXBhaWduPC9oMT4="
  }]
}

Existing URLs

Send external_url instead of assets for a public staging page or PR deployment. Shiplet's trusted parent loads the proxied page in a read-only artifact sandbox. The proxy allows safe GET and HEAD, strips platform cookies and authorization, rejects private-network destinations and unsafe redirects, and leaves origin availability with the owner.

Provide only one of assets, script_content, or external_url.

{
  "name": "PR preview review",
  "subdomain": "pr-preview-review",
  "visibility": "organization",
  "external_url": "https://preview.example.com"
}

Advanced Worker scripts

Managed arbitrary Worker execution requires a revision-aware Workers for Platforms gateway with immutable revision staging, platform-credential stripping, enforced invocation limits, deny-by-default outbound mediation, and exact release attestation. A raw dispatch namespace is not sufficient. If the exact deployment does not satisfy that contract, the request fails closed with managed_dynamic_unavailable; the authenticated ownership and deployment view is authoritative for live readiness. Managed static publishing continues to work.

Legacy browser compatibility

POST /projects is a browser-only compatibility form for existing dashboard flows. It requires the trusted browser session and is not an agent API. New automation uses POST /api/shiplets, Code Mode MCP, or the source-checkout CLI.

Archive, restore, and permanently delete

Archive hides a Shiplet from the active list without removing its package, feedback, revisions, or audit record. Owners and organization administrators can restore it from the archived list; the existing access policy still applies.

Permanent delete is a separate irreversible action for an already archived Shiplet. It requires trusted owner or administrator authority and explicit confirmation. The deleted Shiplet cannot be restored; use archive for routine cleanup.

Next: prepare a managed artifact, then use packages and revisions to change it safely.