@drop2run/mcp 0.10.0 → 0.12.0

package/README.md

@@ -88,7 +88,10 @@ lose it.
 | `list_folders` | Lists the account's folders, each with the path `folder` accepts |
 | `delete_site` | Deletes a site permanently, subdomain included — requires the subdomain repeated as `confirm` |
 | `get_site` | Reads a site's settings, whether it is paused, and its versions with the live one marked |
-| `update_site` | Changes a site's name, serving mode, password, forms, scheduled takedown or folder |
+| `update_site` | Changes a site's name, serving mode, password, invite-only, comments, forms, scheduled takedown or folder |
+| `list_people` | Lists who a site is shared with, what each may do, and whether only they can open it |
+| `invite_people` | Invites addresses the person gave — to view, or to view and comment — and emails each one |
+| `remove_person` | Takes one address off a site's list |
 | `pause_site` | Takes a site off the air, keeping its files, versions and subdomain |
 | `resume_site` | Puts a paused site back on the air |
 | `rollback_site` | Serves an earlier version again, by its id from `get_site` |
@@ -117,6 +120,12 @@ default; `expiryAction: "delete"` removes it instead, and asks for the subdomain
 `delete_site` does. Settings your plan does not include are refused with the reason, and `get_site` says
 which ones those are.
 
+To share a site for review, `invite_people` puts the addresses the person gave on its list and emails each
+one; `update_site` with `invitedOnly: true` makes the list the only way in, and `comments` decides who may
+comment — `invited` for the people invited with the comment role, `anyone` for anybody signed in. Both are
+plan features, refused with the reason where the plan lacks them. The tool description tells the model never
+to invite an address the person did not give it.
+
 The comment tools close the loop on a site somebody is reviewing: `list_comments` gives each thread's page
 and the words or element it points at, so the source can be found; after the fix is published,
 `reply_comment` answers on the page. Publish first and reply second, or the commenter opens the old

package/dist/index.js

@@ -177,10 +177,7 @@ async function folderFromListing(credentials, siteId, subdomain) {
 }
 async function getSite(credentials, siteId) {
   const [site, invitedOnly] = await Promise.all([
-    call(
-      credentials,
-      `sites/${encodeURIComponent(siteId)}`
-    ),
+    call(credentials, `sites/${encodeURIComponent(siteId)}`),
     readInvitedOnly(credentials, siteId)
   ]);
   const folderId = site.folderId !== void 0 ? site.folderId : await folderFromListing(credentials, site.siteId, site.subdomain);
@@ -202,6 +199,8 @@ async function getSite(credentials, siteId) {
     expiresAt: site.expiresAt,
     expiryAction: actionOf(site.expiresAt, site.expiryAction ?? ""),
     scheduledExpiryAvailable: site.scheduledExpiryAvailable,
+    comments: audienceOf(site.commentAudience),
+    commentsAvailable: site.feedbackAvailable === true,
     folderId,
     deploys: site.deploys.map((deploy2) => ({
       deployId: deploy2.deployId,
@@ -226,9 +225,11 @@ async function updateSiteSettings(credentials, siteId, change) {
   if (change.expiryAction !== void 0) body.expiryAction = change.expiryAction;
   if (change.formsEnabled !== void 0) body.formsEnabled = change.formsEnabled;
   if (change.folderId !== void 0) body.folderId = change.folderId;
+  if (change.invitedOnly !== void 0) body.invitedOnly = change.invitedOnly;
+  if (change.comments !== void 0) body.commentAudience = API_AUDIENCE[change.comments];
   if (Object.keys(body).length === 0) throw new Error("Nothing to change — name a setting.");
   const wasInvitedOnly = change.password !== void 0 && change.password !== "" ? await readInvitedOnly(credentials, siteId) : null;
-  const settings = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
+  const { commentAudience, ...settings } = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
     method: "PATCH",
     body: JSON.stringify(body)
   });
@@ -237,9 +238,19 @@ async function updateSiteSettings(credentials, siteId, change) {
     ...settings,
     expiryAction: actionOf(settings.expiresAt, settings.expiryAction ?? ""),
     invitedOnly,
+    comments: audienceOf(commentAudience),
     replacedInviteOnly: wasInvitedOnly === true && invitedOnly === false
   };
 }
+const API_AUDIENCE = {
+  off: "Off",
+  invited: "Invited",
+  anyone: "Anyone"
+};
+function audienceOf(value) {
+  const lower = value?.toLowerCase();
+  return lower === "off" || lower === "invited" || lower === "anyone" ? lower : null;
+}
 async function setSitePaused(credentials, siteId, action) {
   const state = await call(
     credentials,
@@ -354,6 +365,34 @@ async function setCommentResolved(credentials, siteId, threadId, resolved) {
     { method: "POST" }
   );
 }
+const PEOPLE_PER_REQUEST = 50;
+async function listPeople(credentials, siteId) {
+  const page = await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers?pageSize=${PEOPLE_PER_REQUEST}`);
+  return {
+    invitedOnly: page.invitedOnly,
+    total: page.total,
+    limit: page.limit,
+    people: page.viewers.map((row) => ({
+      email: row.email,
+      role: enumName(row.role),
+      owner: row.owner,
+      status: enumName(row.status)
+    }))
+  };
+}
+async function invitePeople(credentials, siteId, emails, role) {
+  return await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers`, {
+    method: "POST",
+    body: JSON.stringify({ emails, role: role === "comment" ? "Comment" : "View", notify: true })
+  });
+}
+async function removePerson(credentials, siteId, email) {
+  await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/viewers?email=${encodeURIComponent(email)}`,
+    { method: "DELETE" }
+  );
+}
 const VERSIONS_LISTED = 10;
 function servingModeOf$1(site) {
   if (site.spaMode) return "spa";
@@ -382,6 +421,7 @@ function describeSite(site, folderPath) {
     `  mode      ${servingModeOf$1(site)}${site.modeIsManual ? "" : " (detected on each publish)"}`,
     `  password  ${site.passwordProtected ? "on" : "off"}${unavailable(site.passwordProtectionAvailable)}`,
     `  forms     ${site.formsEnabled ? "on" : "off"}${unavailable(site.formsAvailable)}`,
+    `  comments  ${site.comments ?? "unknown"}${unavailable(site.commentsAvailable)}`,
     `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
     `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
     "",
@@ -613,7 +653,9 @@ async function prepareDeploy(siteId, files, options, signal) {
   }));
   const prepared = await request(
     `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
-    { files: manifest },
+    // `batches` asks for batch permits; an API that predates them ignores the field, and one that
+    // knows them answers with single permits until they are switched on.
+    { files: manifest, batches: true },
     options,
     signal
   );
@@ -702,6 +744,47 @@ async function problemToError(response) {
   const message = typeof problem.detail === "string" ? problem.detail : typeof problem.title === "string" ? problem.title : `The server responded with ${response.status}.`;
   return new DeployError(code, message, problem);
 }
+function batchLayout(members) {
+  return members.map((member) => `${member.sha256} ${member.size}
+`).join("");
+}
+function isBatch(target) {
+  return "files" in target;
+}
+function parseBatchResult(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed === null || typeof parsed !== "object") return null;
+    const { stored, present, failed } = parsed;
+    if (typeof stored !== "number" || typeof present !== "number" || !Array.isArray(failed))
+      return null;
+    return { stored, present, failed };
+  } catch {
+    return null;
+  }
+}
+async function mapInOrder(items, limit, fn, signal) {
+  const results = new Array(items.length);
+  let next = 0;
+  let failure = null;
+  const lane = async () => {
+    for (; ; ) {
+      if (failure !== null) return;
+      const index = next++;
+      if (index >= items.length) return;
+      try {
+        results[index] = await fn(items[index], index);
+      } catch (error) {
+        failure ??= { error };
+        return;
+      }
+    }
+  };
+  const lanes = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, lane);
+  await Promise.all(lanes);
+  if (failure !== null) throw failure.error;
+  return results;
+}
 const FILE_TYPES = [
   // Documents. The three extensions that make a folder a documents site.
   {
@@ -816,13 +899,14 @@ const FILE_TYPES = [
     reader: true,
     editable: true
   },
-  // Source the viewer highlights. A link straight to one of these hands over the file.
+  // Source the viewer highlights. Inside a documents site a link straight to one opens it in the
+  // reader; on an ordinary site, and with `?raw`, it hands over the file.
   {
     ext: ".css",
     mime: "text/css; charset=utf-8",
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   {
@@ -830,7 +914,7 @@ const FILE_TYPES = [
     mime: "text/javascript; charset=utf-8",
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   {
@@ -838,7 +922,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -846,7 +930,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -854,7 +938,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -862,19 +946,18 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   // The languages an assistant writes most, beyond the web's own. Same row as `.ts`: shown as source
-  // when somebody opens one in the reader or publishes it on its own, handed over as a file when a
-  // link names it directly, and no media type — adding one changes what a browser does with a
+  // in the reader, handed over as a file with `?raw` or on an ordinary site, and no media type — adding one changes what a browser does with a
   // published file, which I10 makes a decision of its own rather than a side effect of this list.
   {
     ext: ".py",
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -882,7 +965,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -890,7 +973,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -898,7 +981,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -906,7 +989,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -914,7 +997,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -922,7 +1005,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -930,7 +1013,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -938,7 +1021,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -946,7 +1029,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -954,7 +1037,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -962,7 +1045,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -970,7 +1053,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -978,7 +1061,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -986,7 +1069,7 @@ const FILE_TYPES = [
     mime: "application/xml",
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   // Pictures, shown with an img element.
@@ -1057,25 +1140,25 @@ const FILE_TYPES = [
     reader: false,
     editable: false
   },
-  // A customer's own pages. Never rendered inside the reader.
+  // A customer's own pages. Inside a documents site a navigation opens the reader, which frames the
+  // page; `?raw` and every ordinary site serve the page itself.
   {
     ext: ".html",
     mime: "text/html; charset=utf-8",
     kind: "html",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   {
-    // ⚠️ No media type, and that is the state of the code rather than a decision: `TYPES` in
-    // `headers.ts` has never held `htm`, so a published `.htm` is served as octet-stream and
-    // downloads instead of rendering. Recorded here rather than fixed, because this table was
-    // introduced as a refactor and a refactor that changes what a URL answers is not one.
+    // An HTML page in every respect the Worker decides by extension: media type, the revalidated
+    // cache policy invariant I7 requires, and the badge's `isHtml`. Missing from `TYPES` it used to
+    // download, which inside the reader meant a frame that downloaded instead of showing a page.
     ext: ".htm",
-    mime: null,
+    mime: "text/html; charset=utf-8",
     kind: "html",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   // Everything below renders as nothing — the viewer offers a download — but still needs a media
@@ -1185,13 +1268,46 @@ async function sha256Hex(bytes) {
   const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
+const HASH_CONCURRENCY = 4;
+const HASH_BYTES_IN_FLIGHT = 16 * 1024 * 1024;
 async function hashAll(files, onProgress, signal) {
-  const hashed = [];
-  for (const [index, file] of files.entries()) {
-    hashed.push({ ...file, sha256: await sha256Hex(await readForHash(file)) });
-    onProgress?.(index + 1, files.length);
-  }
-  return hashed;
+  const budget = byteBudget(HASH_BYTES_IN_FLIGHT);
+  let done = 0;
+  return mapInOrder(
+    files,
+    HASH_CONCURRENCY,
+    async (file) => {
+      const size = sizeOf(file.bytes);
+      await budget.acquire(size);
+      try {
+        signal?.throwIfAborted();
+        const hashed = { ...file, sha256: await sha256Hex(await readForHash(file)) };
+        done += 1;
+        onProgress?.(done, files.length);
+        return hashed;
+      } finally {
+        budget.release(size);
+      }
+    }
+  );
+}
+function byteBudget(limit) {
+  let held = 0;
+  let waiting = [];
+  return {
+    async acquire(size) {
+      while (held > 0 && held + size > limit) {
+        await new Promise((resolve) => waiting.push(resolve));
+      }
+      held += size;
+    },
+    release(size) {
+      held -= size;
+      const woken = waiting;
+      waiting = [];
+      for (const wake of woken) wake();
+    }
+  };
 }
 async function readForHash(file) {
   try {
@@ -1220,10 +1336,13 @@ const IGNORED_DIRECTORIES = [
   ".codex",
   ".gemini"
 ];
+function isEnvironmentFile(name) {
+  return name === ".env" || name === ".envrc" || name.startsWith(".env.");
+}
 function shouldIgnore(path) {
   const segments = path.split("/");
   const name = segments.at(-1) ?? "";
-  if (name === "" || IGNORED_EXACT.has(name)) return true;
+  if (name === "" || IGNORED_EXACT.has(name) || isEnvironmentFile(name)) return true;
   if (name.startsWith("._")) return true;
   return segments.some((segment) => IGNORED_DIRECTORIES.includes(segment));
 }
@@ -1358,9 +1477,7 @@ async function readSiteName(files) {
   }
 }
 function decodeHead(bytes) {
-  return new TextDecoder("utf-8", { fatal: false }).decode(
-    bytes.subarray(0, HEAD_BYTES)
-  );
+  return new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, HEAD_BYTES));
 }
 function nameFromHtml(html) {
   const document = parse(html);
@@ -1385,9 +1502,7 @@ function parse(html) {
   }
 }
 function matchTag(html, tag) {
-  const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(
-    html
-  );
+  const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(html);
   return match?.[1] === void 0 ? null : decodeEntities(match[1]);
 }
 function matchOgSiteName(html) {
@@ -1488,6 +1603,7 @@ function trimSuffix(title) {
   return title;
 }
 const DEFAULT_CONCURRENCY = 8;
+const MAX_BATCH_CONCURRENCY = 64;
 const DEFAULT_BYTES_IN_FLIGHT = 64 * 1024 * 1024;
 const DEFAULT_RETRIES = 3;
 const BACKOFF_MS = [1e3, 2e3, 4e3];
@@ -1504,14 +1620,31 @@ async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {
   const put = deps.put ?? defaultTransport(deps.fetch);
   const delay = deps.delay ?? defaultDelay;
   const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
+  const batchConcurrency = Math.max(
+    1,
+    Math.min(MAX_BATCH_CONCURRENCY, Math.floor(deps.batchConcurrency ?? concurrency))
+  );
   const retries = deps.retries ?? DEFAULT_RETRIES;
   const stallMs = deps.stallMs ?? DEFAULT_STALL_MS;
   const now = deps.now ?? Date.now;
   const maxBytesInFlight = deps.maxBytesInFlight ?? DEFAULT_BYTES_IN_FLIGHT;
   const byPath = new Map(files.map((file) => [file.path, file]));
+  const fileCount = targets.reduce(
+    (sum, target) => sum + (isBatch(target) ? target.files.length : 1),
+    0
+  );
   let nextIndex = 0;
   let done = 0;
   let failed = false;
+  let firstFailure;
+  const local = new AbortController();
+  const inner = local.signal;
+  const fail = (error) => {
+    if (failed) return;
+    failed = true;
+    firstFailure = error;
+    local.abort();
+  };
   let reserved = 0;
   let waiting = [];
   const acquire = async (size) => {
@@ -1526,17 +1659,32 @@ async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {
     waiting = [];
     for (const wake of woken) wake();
   };
+  const running = { single: 0, batch: 0 };
+  const limit = { single: concurrency, batch: batchConcurrency };
+  let slotWaiting = [];
+  const takeSlot = async (kind) => {
+    while (running[kind] >= limit[kind]) {
+      await new Promise((resolve) => slotWaiting.push(resolve));
+    }
+    running[kind] += 1;
+  };
+  const freeSlot = (kind) => {
+    running[kind] -= 1;
+    const woken = slotWaiting;
+    slotWaiting = [];
+    for (const wake of woken) wake();
+  };
   let landedBytes = 0;
   const inFlight = /* @__PURE__ */ new Map();
   let lastReport = Number.NEGATIVE_INFINITY;
   const report2 = (path) => {
-    if (onProgress === void 0) return;
+    if (onProgress === void 0 || failed) return;
     const at = now();
     if (path === void 0 && at - lastReport < PROGRESS_INTERVAL_MS) return;
     lastReport = at;
     let bytes = landedBytes;
     for (const sent of inFlight.values()) bytes += sent;
-    onProgress(done, targets.length, bytes, path);
+    onProgress(done, fileCount, bytes, path);
   };
   const worker = async () => {
     for (; ; ) {
@@ -1544,25 +1692,49 @@ async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {
       const index = nextIndex++;
       const target = targets[index];
       if (target === void 0) return;
-      const file = byPath.get(target.path);
-      if (file === void 0) {
-        failed = true;
-        throw new DeployError(
-          ClientErrorCode.UploadFailed,
-          `The server asked for ${target.path}, which is not in the manifest.`,
-          { path: target.path }
-        );
+      inner.throwIfAborted();
+      const refs = isBatch(target) ? target.files : [target];
+      const members = [];
+      for (const ref of refs) {
+        const file = byPath.get(ref.path);
+        if (file === void 0) {
+          const missing = new DeployError(
+            ClientErrorCode.UploadFailed,
+            `The server asked for ${ref.path}, which is not in the manifest.`,
+            { path: ref.path }
+          );
+          fail(missing);
+          throw missing;
+        }
+        members.push(file);
       }
-      const size = sizeOf(file.bytes);
-      await acquire(size);
+      const layout = isBatch(target) ? new TextEncoder().encode(
+        batchLayout(
+          target.files.map((ref, i) => ({
+            sha256: ref.sha256,
+            size: sizeOf(members[i].bytes)
+          }))
+        )
+      ) : null;
+      const size = members.reduce((sum, file) => sum + sizeOf(file.bytes), layout?.length ?? 0);
+      const copied = isBatch(target) ? members.reduce(
+        (sum, file) => sum + (file.bytes instanceof Blob ? 0 : sizeOf(file.bytes)),
+        0
+      ) : 0;
+      const reservation = size + copied;
+      const first = members[0].path;
+      const label = members.length === 1 ? first : `${first} and ${members.length - 1} more`;
+      const kind = isBatch(target) ? "batch" : "single";
+      await takeSlot(kind);
+      await acquire(reservation);
       try {
         if (failed) return;
-        signal?.throwIfAborted();
-        await uploadOne(target, file, {
+        inner.throwIfAborted();
+        const context = {
           put,
           delay,
           retries,
-          signal,
+          signal: inner,
           uploadUrl,
           stallMs,
           onSent: (sent) => {
@@ -1571,26 +1743,34 @@ async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {
           },
           onRetry: (attempt2, stalled) => {
             inFlight.set(index, 0);
-            onRetry?.(target.path, attempt2, retries + 1, stalled);
+            onRetry?.(label, attempt2, retries + 1, stalled);
           }
-        });
+        };
+        if (isBatch(target) && layout !== null)
+          await uploadBatchOne(target, members, layout, context);
+        else await uploadOne(target, members[0], context);
       } catch (error) {
-        failed = true;
+        fail(error);
         throw error;
       } finally {
-        release(size);
+        release(reservation);
+        freeSlot(kind);
       }
       inFlight.delete(index);
-      done += 1;
+      done += members.length;
       landedBytes += size;
-      report2(file.path);
+      report2(members.at(-1).path);
     }
   };
-  const workers = Array.from({ length: Math.min(concurrency, targets.length) }, worker);
+  const workers = Array.from(
+    { length: Math.min(Math.max(concurrency, batchConcurrency), targets.length) },
+    worker
+  );
   try {
     await Promise.all(workers);
   } catch (error) {
-    throw asDeployError(error);
+    throw asDeployError(firstFailure ?? error);
+  } finally {
   }
 }
 async function uploadOne(target, file, context) {
@@ -1603,7 +1783,7 @@ async function uploadOne(target, file, context) {
       context.signal?.throwIfAborted();
     }
     try {
-      const status = await context.put({
+      const answer = await context.put({
         url: context.uploadUrl,
         token: target.token,
         body: untyped(file.bytes),
@@ -1611,6 +1791,7 @@ async function uploadOne(target, file, context) {
         onSent: context.onSent,
         stallMs: context.stallMs
       });
+      const status = typeof answer === "number" ? answer : answer.status;
       if (status >= 200 && status < 300) return;
       if (status === 401 || status === 403 || status === 429) {
         throw new DeployError(
@@ -1639,6 +1820,85 @@ async function uploadOne(target, file, context) {
     cause: describeError(lastError)
   });
 }
+async function uploadBatchOne(batch, members, layout, context) {
+  const first = members[0].path;
+  const label = members.length === 1 ? first : `${first} and ${members.length - 1} more`;
+  let lastError;
+  for (let attempt2 = 0; attempt2 <= context.retries; attempt2++) {
+    context.signal?.throwIfAborted();
+    if (attempt2 > 0) {
+      context.onRetry(attempt2 + 1, lastError instanceof StalledError);
+      await context.delay(BACKOFF_MS[attempt2 - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
+      context.signal?.throwIfAborted();
+    }
+    try {
+      const body = new Blob([layout, ...members.map((file) => file.bytes)]);
+      const answer = await context.put({
+        url: context.uploadUrl,
+        token: batch.token,
+        body,
+        signal: context.signal,
+        onSent: context.onSent,
+        stallMs: context.stallMs,
+        wantsBody: true
+      });
+      const status = typeof answer === "number" ? answer : answer.status;
+      if (status >= 200 && status < 300) {
+        const result = typeof answer === "number" ? null : parseBatchResult(answer.body);
+        if (result === null) {
+          lastError = new Error(
+            "The upload service answered with something that is not a batch result."
+          );
+          continue;
+        }
+        if (result.failed.length === 0) return;
+        const changed = result.failed.find((failure) => failure.reason === "hash_mismatch");
+        if (changed !== void 0) {
+          const path = members[changed.i]?.path ?? first;
+          throw new DeployError(
+            ClientErrorCode.ReadFailed,
+            `${path} changed after it was read, so it no longer matches what was checked. Drop the folder again.`,
+            { path }
+          );
+        }
+        lastError = new Error(
+          `${result.failed.length} of ${members.length} files were not stored.`
+        );
+        continue;
+      }
+      if ([400, 401, 403, 411, 413, 429].includes(status)) {
+        throw new DeployError(ClientErrorCode.UploadFailed, refusalMessage(status, label), {
+          path: first,
+          status
+        });
+      }
+      lastError = new Error(`HTTP ${status}`);
+    } catch (error) {
+      if (error instanceof DeployError) throw error;
+      if (isAbort(error)) throw cancelled();
+      lastError = error;
+    }
+  }
+  const message = lastError instanceof StalledError ? `Upload of ${label} stopped moving and did not recover after ${context.retries + 1} attempts. Check your connection and try again.` : `Could not upload ${label} after ${context.retries + 1} attempts.`;
+  throw new DeployError(ClientErrorCode.UploadFailed, message, {
+    path: first,
+    cause: describeError(lastError)
+  });
+}
+function refusalMessage(status, label) {
+  switch (status) {
+    case 401:
+      return `Upload of ${label} was refused because its upload window expired. Try deploying again.`;
+    case 429:
+      return `Upload of ${label} was refused: this deploy has used every upload it was given. Try deploying again.`;
+    case 400:
+    case 411:
+    case 413:
+      return `Upload of ${label} was refused because it no longer matches what was checked — a file may have changed since you dropped it. Drop the folder again.`;
+    default:
+      return `Upload of ${label} was refused by the upload service. Try deploying again.`;
+  }
+}
 function untyped(content) {
   if (ArrayBuffer.isView(content) || content.type === "") return content;
   return content.slice(0, content.size);
@@ -1649,7 +1909,8 @@ function defaultTransport(doFetch) {
   return Xhr === void 0 ? fetchTransport(globalFetch()) : xhrTransport(Xhr);
 }
 function fetchTransport(doFetch) {
-  return async ({ url, token, body, signal }) => {
+  return async (request2) => {
+    const { url, token, body, signal } = request2;
     const response = await doFetch(url, {
       method: "PUT",
       // The view, not a copy. Wrapping it in `new Blob([body.slice().buffer])` made two extra
@@ -1664,11 +1925,11 @@ function fetchTransport(doFetch) {
       headers: { Authorization: `Bearer ${token}` },
       ...signal ? { signal } : {}
     });
-    return response.status;
+    return request2.wantsBody === true ? { status: response.status, body: await response.text() } : response.status;
   };
 }
 function xhrTransport(Xhr) {
-  return ({ url, token, body, signal, onSent, stallMs }) => new Promise((resolve, reject) => {
+  return ({ url, token, body, signal, onSent, stallMs, wantsBody }) => new Promise((resolve, reject) => {
     const xhr = new Xhr();
     let settled = false;
     let timer;
@@ -1702,7 +1963,11 @@ function xhrTransport(Xhr) {
       onSent(event.loaded);
     };
     xhr.onprogress = arm;
-    xhr.onload = () => settle(() => resolve(xhr.status));
+    xhr.onload = () => settle(
+      () => resolve(
+        wantsBody === true ? { status: xhr.status, body: xhr.responseText ?? "" } : xhr.status
+      )
+    );
     xhr.onerror = () => settle(() => reject(new TypeError("Network error during upload.")));
     arm();
     xhr.send(body);
@@ -1767,11 +2032,16 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       return;
     }
     const sizes = new Map(hashed.map((file) => [file.path, sizeOf(file.bytes)]));
-    const totalBytes = prepared.upload.reduce(
-      (sum, target) => sum + (sizes.get(target.path) ?? 0),
-      0
-    );
-    if (prepared.upload.length > 0) {
+    const batches = prepared.batches ?? [];
+    const targets = [...prepared.upload, ...batches];
+    const totalBytes = prepared.upload.reduce((sum, target) => sum + (sizes.get(target.path) ?? 0), 0) + batches.reduce((sum, batch) => {
+      const members = batch.files.map((ref) => ({
+        sha256: ref.sha256,
+        size: sizes.get(ref.path) ?? 0
+      }));
+      return sum + batchLayout(members).length + members.reduce((n, member) => n + member.size, 0);
+    }, 0);
+    if (targets.length > 0) {
       onProgress({
         type: "uploading",
         done: prepared.reused,
@@ -1782,7 +2052,7 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       });
     }
     await uploadAll(
-      prepared.upload,
+      targets,
       prepared.uploadUrl,
       hashed,
       (done, _total, bytes, path) => onProgress({
@@ -1795,7 +2065,9 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
         ...path === void 0 ? {} : { path }
       }),
       signal,
-      options.upload,
+      // The server's number unless the caller set one: it is tuned on the server so a deploy of many
+      // small files speeds up without a CLI or MCP release.
+      typeof prepared.batchConcurrency === "number" && options.upload?.batchConcurrency === void 0 ? { ...options.upload, batchConcurrency: prepared.batchConcurrency } : options.upload,
       (path, attempt2, attempts, stalled) => onProgress({ type: "retrying", path, attempt: attempt2, attempts, stalled })
     );
     onProgress({ type: "completing", reused: prepared.reused });
@@ -2154,7 +2426,7 @@ async function signInWithCode(waitSeconds, replace = false) {
     "Call this tool again to keep waiting. Nothing has been changed yet."
   ].join("\n");
 }
-const SERVER_VERSION = "0.10.0";
+const SERVER_VERSION = "0.12.0";
 const CREDENTIAL_WRITE = {
   readOnlyHint: false,
   destructiveHint: false,
@@ -2204,6 +2476,12 @@ const ANSWERS_A_COMMENT = {
   idempotentHint: false,
   openWorldHint: true
 };
+const INVITES_PEOPLE = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
 const MARKS_A_THREAD = {
   readOnlyHint: false,
   destructiveHint: false,
@@ -2292,6 +2570,9 @@ const SETTINGS_OUTPUT = {
     "Whether only invited people can open it, or null when that could not be read. Null does not mean public."
   ),
   formsEnabled: z.boolean().describe("Whether it accepts form submissions."),
+  comments: z.enum(["off", "invited", "anyone"]).nullable().describe(
+    "Who may comment on its pages: nobody, the people invited to comment (only while it is invite-only), or anybody signed in. Null when that could not be read."
+  ),
   expiresAt: z.string().nullable().describe("When it is scheduled to come down, or null."),
   expiryAction: z.string().nullable().describe("What the takedown does: `pause` or `delete`, or null when none is scheduled."),
   folderId: z.string().nullable().describe("The folder it is filed in, or null at the top level.")
@@ -2320,10 +2601,12 @@ function structuredSite(site) {
     expiresAt: site.expiresAt,
     expiryAction: site.expiryAction,
     folderId: site.folderId,
+    comments: site.comments,
     available: {
       password: site.passwordProtectionAvailable,
       forms: site.formsAvailable,
-      scheduledTakedown: site.scheduledExpiryAvailable
+      scheduledTakedown: site.scheduledExpiryAvailable,
+      comments: site.commentsAvailable
     },
     versions: site.deploys.map((deploy2) => ({
       deployId: deploy2.deployId,
@@ -2426,6 +2709,12 @@ function createServer() {
         "a password or a date only when the person gave one, and scheduling a deletion asks for",
         "`confirm` the way delete_site does.",
         "",
+        "To share a site for review: invite_people with the addresses the person gave (each is",
+        "emailed), update_site `invitedOnly: true` so only they can open it, and `comments` to let",
+        "them comment — `invited` for the people invited with the comment role, `anyone` for",
+        "anybody signed in. list_people shows the list; remove_person takes someone off it.",
+        "Never invite an address the person did not give you.",
+        "",
         "People viewing a site can leave comments pinned to its pages. list_comments reads them,",
         "with the page and the words each one points at, so the source can be found and changed.",
         'After changing it, publish first and reply second — a reply that says "fixed" before the',
@@ -2597,7 +2886,8 @@ function createServer() {
         available: z.object({
           password: z.boolean(),
           forms: z.boolean(),
-          scheduledTakedown: z.boolean()
+          scheduledTakedown: z.boolean(),
+          comments: z.boolean()
         }).describe("Which settings the account's plan includes."),
         versions: z.array(VERSION_OUTPUT).describe("Its versions, newest first.")
       },
@@ -2636,6 +2926,12 @@ function createServer() {
         folder: z.string().optional().describe(
           "Folder to move the site to — a path such as Clients/Acme or an id from list_folders — or `root` for the top level. Never creates a folder."
         ),
+        invitedOnly: z.boolean().optional().describe(
+          "True: only the people on the site's list (invite_people) can open it, each signed in. It replaces a password. False: anybody with the link can open it again. Change it only when the person asked who should see the site."
+        ),
+        comments: z.enum(["off", "invited", "anyone"]).optional().describe(
+          "Who may comment on the site's pages: `off`; `invited` — the people invited with the comment role, on an invite-only site; or `anyone` signed in. Only on plans that include comments."
+        ),
         confirm: z.string().optional().describe(
           "Required only with `expiryAction: delete`: the site's subdomain, repeated exactly as the person said it. Ask for it rather than filling it in."
         )
@@ -2643,7 +2939,19 @@ function createServer() {
       outputSchema: SETTINGS_OUTPUT,
       annotations: CHANGES_A_SITE
     },
-    ({ site, name, mode, password, forms, expiresAt, expiryAction, folder, confirm }) => withCredentials(async (credentials) => {
+    ({
+      site,
+      name,
+      mode,
+      password,
+      forms,
+      expiresAt,
+      expiryAction,
+      folder,
+      invitedOnly,
+      comments,
+      confirm
+    }) => withCredentials(async (credentials) => {
       const found = await findSite(credentials, site);
       if (expiryAction !== void 0 && expiresAt === void 0) {
         throw new Error("`expiryAction` only applies with `expiresAt` — send the date too.");
@@ -2662,7 +2970,9 @@ function createServer() {
         // `delete` alongside an empty date would still run its owner-only check for nothing.
         expiryAction: expiresAt === "" ? void 0 : expiryAction,
         formsEnabled: forms,
-        folderId: folder === void 0 ? void 0 : await resolveFolderTarget(credentials, folder)
+        folderId: folder === void 0 ? void 0 : await resolveFolderTarget(credentials, folder),
+        invitedOnly,
+        comments
       };
       const settings = await updateSiteSettings(credentials, found.siteId, change);
       const lines = [
@@ -2670,9 +2980,15 @@ function createServer() {
         `  access    ${accessOf(settings)}`,
         `  mode      ${servingModeOf$1(settings)}`,
         `  forms     ${settings.formsEnabled ? "on" : "off"}`,
+        `  comments  ${settings.comments ?? "unknown"}`,
+        // The one combination that reads as on and does nothing: invited commenters on a site anybody
+        // can open, which the API keeps (it is the owner's choice for when the site goes private).
+        ...settings.comments === "invited" && settings.invitedOnly === false ? [
+          "Comments are set to invited people, but the site is not invite-only, so nobody can comment yet. Set `invitedOnly: true`, or `comments: anyone`."
+        ] : [],
         `  takedown  ${settings.expiresAt === null ? "none" : `${settings.expiresAt} (${settings.expiryAction})`}`,
         ...settings.replacedInviteOnly ? [
-          "The password replaced invite-only: the people on its list can no longer get in without it. The list is kept for switching back in the dashboard."
+          "The password replaced invite-only: the people on its list can no longer get in without it. The list is kept; `invitedOnly: true` switches back."
         ] : [],
         ...settings.live ? ["Reaching every edge takes up to about a minute."] : ["Nothing is published yet, so this applies from the first publish."]
       ];
@@ -2683,6 +2999,7 @@ function createServer() {
         passwordProtected: settings.passwordProtected,
         invitedOnly: settings.invitedOnly,
         formsEnabled: settings.formsEnabled,
+        comments: settings.comments,
         expiresAt: settings.expiresAt,
         expiryAction: settings.expiryAction,
         folderId: settings.folderId
@@ -2748,6 +3065,94 @@ ${promoted.url}`,
       );
     })
   );
+  server.registerTool(
+    "list_people",
+    {
+      title: "List who a site is shared with",
+      description: "Lists the people on a site's list — the ones invite_people added — with what each may do (`view` or `comment`) and whether they have opened it yet. Says whether the list decides who can open the site, which it does only while the site is invite-only.",
+      inputSchema: { site: SITE_INPUT },
+      outputSchema: {
+        invitedOnly: z.boolean().describe("Whether only the people on the list can open the site now."),
+        total: z.number().int().describe("How many are on the list."),
+        limit: z.number().int().describe("The most the plan allows on one site's list."),
+        people: z.array(
+          z.object({
+            email: z.string(),
+            role: z.string().describe("`view` or `comment`."),
+            owner: z.boolean().describe("Whether this is the site's owner."),
+            status: z.string().describe("`opened` or `not-opened`.")
+          })
+        )
+      },
+      annotations: READS_ONLY
+    },
+    ({ site }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      const list = await listPeople(credentials, found.siteId);
+      const rows = list.people.map(
+        (person) => `  ${person.email}  ${person.role}${person.owner ? ", owner" : ""}, ${person.status}`
+      );
+      return report(
+        [
+          `${list.total} of ${list.limit} on ${found.subdomain}'s list. ` + (list.invitedOnly ? "Only they can open it." : "It is not invite-only, so anybody with the link can open it."),
+          ...rows,
+          ...list.total > list.people.length ? [`  … and ${list.total - list.people.length} more, in the dashboard`] : []
+        ].join("\n"),
+        { ...list }
+      );
+    })
+  );
+  server.registerTool(
+    "invite_people",
+    {
+      title: "Invite people to a site",
+      description: "Adds email addresses to a site's list and emails each new one an invitation from the account. Use only addresses the person gave you — never guess, infer or look one up. `comment` lets them comment as well as open it. Inviting does not make the site private; update_site's `invitedOnly: true` does. On plans with private sharing; all or nothing — one bad address, or a list past the plan's limit, adds nobody.",
+      inputSchema: {
+        site: SITE_INPUT,
+        emails: z.array(z.string().min(3)).min(1).max(50).describe("The addresses, exactly as the person gave them."),
+        role: z.enum(["view", "comment"]).optional().describe("`view` (the default) to open the site, `comment` to open it and comment.")
+      },
+      outputSchema: {
+        added: z.array(z.string()).describe("Addresses added and emailed."),
+        alreadyListed: z.array(z.string()).describe("Addresses already on the list, left as they were and not emailed again."),
+        total: z.number().int().describe("How many are on the list now.")
+      },
+      annotations: INVITES_PEOPLE
+    },
+    ({ site, emails, role }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      const invited = await invitePeople(credentials, found.siteId, emails, role ?? "view");
+      const detail = await getSite(credentials, found.siteId);
+      return report(
+        [
+          invited.added.length === 0 ? `Nobody new on ${found.subdomain}'s list.` : `Invited ${invited.added.join(", ")} to ${found.subdomain} — each was emailed.`,
+          ...invited.alreadyListed.length === 0 ? [] : [`Already on the list, not emailed again: ${invited.alreadyListed.join(", ")}.`],
+          ...detail.invitedOnly === false ? [
+            "The site is not invite-only yet, so the list does not decide who opens it. update_site with `invitedOnly: true` does."
+          ] : []
+        ].join("\n"),
+        { ...invited }
+      );
+    })
+  );
+  server.registerTool(
+    "remove_person",
+    {
+      title: "Remove someone from a site's list",
+      description: "Takes one address off a site's list. On an invite-only site their access ends within a minute; putting them back is another invitation, with another email.",
+      inputSchema: {
+        site: SITE_INPUT,
+        email: z.string().min(3).describe("The address to remove, from list_people.")
+      },
+      outputSchema: { email: z.string().describe("The address removed.") },
+      annotations: CHANGES_A_SITE
+    },
+    ({ site, email }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      await removePerson(credentials, found.siteId, email);
+      return report(`Removed ${email} from ${found.subdomain}'s list.`, { email });
+    })
+  );
   server.registerTool(
     "list_comments",
     {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@drop2run/mcp",
-	"version": "0.10.0",
+	"version": "0.12.0",
 	"description": "MCP server that publishes what an AI made — a page, a document or a whole site — to Drop2Run and returns a live URL.",
 	"mcpName": "run.dropto/drop2run",
 	"license": "MIT",