# Tabucom

Publish HTML, Markdown, or a ZIP containing a prebuilt static site with one HTTP request. No authentication is required at the application layer. Every deployment is immutable and stops serving at the requested TTL, or after the default 30 days (720 hours) when no TTL is supplied.

## Agent behavior

Publish the build output, not source code. After success, return the response `url` and `expiresAt` timestamp to the user.

## API

- POST /api/v1/publish
- Optional query `spa=1` enables index.html fallback for client-side routing.
- Optional query `ttl=<duration>` sets deployment lifetime, for example `ttl=72h` or `ttl=90m`.
- Content-Type: `text/html`, `text/markdown`, or `application/zip`.
- GET /healthz checks readiness.
- GET /agents provides the complete human-readable usage guide.
- GET /openapi.json provides the complete machine-readable contract.
- Path-mode content is served at `/p/{id}/`; deployments may instead use `https://{id}.<preview-domain>/` when wildcard hosting is configured. Always use the returned URL.
- Path mode shares the service origin; wildcard preview domains provide stronger browser-origin isolation for untrusted content.

## Examples

HTML:
`curl -sS -X POST "$ORIGIN/api/v1/publish?ttl=72h" -H "Content-Type: text/html" --data-binary @index.html`

Markdown:
`curl -sS -X POST "$ORIGIN/api/v1/publish" -H "Content-Type: text/markdown" --data-binary @report.md`

Node static build:
`npm ci && npm run build`
`(cd dist && zip -qr ../site.zip .)`
`curl -sS -X POST "$ORIGIN/api/v1/publish?spa=1&ttl=72h" -H "Content-Type: application/zip" --data-binary @site.zip`

The ZIP must contain a regular `index.html` file at its root. The service never runs Node.js, npm, SSR, server code, APIs, databases, or build commands.

Defaults: 100 MB compressed upload, 500 MB expanded ZIP, 10,000 ZIP entries including directories, 60 publishes/hour/network peer. Dangerous paths, symlinks, conflicting paths, duplicate normalized paths, devices, and archive bombs are rejected.