---
name: rapadura
description: Publish and manage static hotsites on rapadura.net / phpcomrapadura.org and WordPress subsites on rapadura.net through the rapadura CLI or MCP tools. Use when asked to publish, host, update, roll back or inspect a hotsite, landing page, event page or WordPress site for PHP Com Rapadura.
---

# rapadura

rapadura hosts static hotsites at `https://<slug>.rapadura.net` or
`https://<slug>.phpcomrapadura.org`. Every publish is a version; rollback is
one call. Nothing server-side runs: HTML, CSS, JS, images, fonts, JSON only.

## Choose the lane

- **CLI available** (`rapadura --version` works): use it, always with `--json`.
- **MCP tools available** (`publish_site`, `list_sites`, …): use them. On the
  hosted lane pass files inline; on the local lane pass `path`.
- **Neither:** install with `curl -fsSL https://agents.rapadura.net/install.sh | sh`
  and run `rapadura login` (the person completes GitHub's device page).

## Publish a new hotsite

1. Build or write the site into one directory with `index.html` at its root.
2. Run `rapadura publish ./dir --site <slug> --create --title "<title>" --json`
   or call `publish_site` with `create=true`.
3. Read the receipt: `live_url`, `version.num`, `warnings`, `next_steps`.
   Report the live URL and version to the person. Mention that the first HTTPS
   visit may take a few seconds.

Update: same command without `--create`. Roll back: `rapadura rollback <slug> <n>`.
Inspect: `rapadura sites show <slug>`, `rapadura versions <slug>`, `rapadura logs <slug>`.

## Rules

- Slugs: lowercase letters, digits, single hyphens; no `--`. Reserved names
  (www, mail, panel, agents, …) are refused; pick another.
- Never include `.env`, keys, `.ssh`, `wp-config.php` or any `.php` file in
  the publish directory. The upload is refused with the list of offending
  files; fix the directory, do not look for a workaround.
- Do not call `delete_site` or `rapadura sites delete` without the person's
  explicit confirmation. Deletion is soft, but it takes the site offline now.
- WordPress lane: `rapadura wp create <slug> --blueprint event|meetup|course|blank
  --title "..." [--email ...]` (or `create_wp_site`) returns the live URL and an
  application password shown once. Then `rapadura wp <site> -- <wp-cli args>`
  (or `wp_cli`) for content, pinned to that site; or the REST API with the
  application password. No `--url/--path/--user`; eval/db/core/plugin install
  are refused by policy. WordPress sites have no versions or rollback.
- Report from receipts, not from intent. If a call fails, relay `error.code`,
  `error.message` and `error.hint` verbatim.
- Tokens are secrets. Never print `RAPADURA_TOKEN`, the credentials file, or
  a bootstrap token into chat or logs.

## Errors

Stable codes: see https://agents.rapadura.net/docs/errors.md. The common ones:
`unauthorized` → run `rapadura login`; `slug_taken` / `slug_reserved` /
`invalid_slug` → choose another slug; `archive_forbidden_file` → remove the
listed files; `publish_failed` → the previous version is still live, retry or
report.