@drop2run/mcp 0.5.1 → 0.7.0

package/README.md

@@ -1,7 +1,8 @@
 # @drop2run/mcp
 
-An MCP server that lets Claude — or any MCP client — publish a static site to
-[Drop2Run](https://dropto.run). Give it a folder or an HTML document; it returns a live HTTPS URL.
+An MCP server that lets Claude — or any MCP client — publish what it made to
+[Drop2Run](https://dropto.run): an HTML page, a markdown note, a folder of documents or a built site. It
+returns a live HTTPS URL.
 
 Full documentation at [dropto.run/docs/mcp](https://dropto.run/docs/mcp).
 
@@ -66,6 +67,7 @@ lose it.
 | `publish_files` | Publishes files Claude wrote — a page, a markdown note, several files together |
 | `publish_dir` | Publishes a folder, given its absolute path |
 | `list_sites` | Lists the sites on the account |
+| `list_folders` | Lists the account's folders, each with the path `folder` accepts |
 | `delete_site` | Deletes a site permanently, subdomain included — requires the subdomain repeated as `confirm` |
 
 Both publish tools take an optional `site` — a subdomain or site id to publish over. Leave it out and a
@@ -77,6 +79,11 @@ afterwards, and a site made under a guessed one has to be deleted by hand. `site
 opposites — one publishes over a site that exists, the other creates one that does not — so passing both
 is refused rather than resolved.
 
+And both take an optional `folder`, which files the new site in one of the account's dashboard folders —
+by path such as `Clients/Acme`, or by the id `list_folders` shows. Like `subdomain` it only describes a new
+site, so it cannot be combined with `site`. It never creates a folder: one that does not exist is refused
+with the list of those that do, and nothing is published.
+
 Both sign-in tools answer "not approved yet" rather than failing while they wait, and calling them
 again keeps waiting on the same sign-in. Neither replaces a token that is already stored unless asked
 to with `replace`.
@@ -89,8 +96,9 @@ it as `subdomain`; say nothing and the name is generated, which is the right def
 nobody is going to link to.
 
 **A site can be documents instead of a built site.** A publish needs an `index.html` at the top level,
-or at least one `.md`, `.markdown` or `.pdf` file — those are served through the reader. So a single
-note is a whole site, and Claude does not have to wrap it in HTML to publish it.
+or at least one document — `.md`, `.markdown`, `.pdf`, `.docx`, `.xlsx` or `.epub` — and those are
+served through the reader. So a single note is a whole site, and Claude does not have to wrap it in HTML
+to publish it.
 
 **`publish_files` is text.** A PDF or an image has to come off a disk with `publish_dir`, because these
 files arrive as JSON strings.

package/dist/index.js

@@ -8,59 +8,6 @@ import { createServer as createServer$1 } from "node:http";
 import { realpath, readdir, stat, readFile } from "node:fs/promises";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-async function call(credentials, path, init = {}) {
-  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
-    ...init,
-    headers: {
-      ...init.headers,
-      Authorization: `Bearer ${credentials.token}`,
-      ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
-    }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-  return await response.json();
-}
-async function findSite(credentials, site) {
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
-  if (found === void 0) {
-    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
-  }
-  return found;
-}
-async function deleteSite(credentials, siteId) {
-  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
-    method: "DELETE",
-    headers: { Authorization: `Bearer ${credentials.token}` }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-}
-async function listSites(credentials) {
-  const body = await call(credentials, "sites");
-  return body.sites;
-}
-async function createSite(credentials, subdomain) {
-  const created = await call(
-    credentials,
-    "sites",
-    {
-      method: "POST",
-      // An absent field rather than a null one, because the API reads null, empty and missing the
-      // same way and a body carrying only what was asked for is the one that reads correctly in a
-      // log.
-      body: JSON.stringify(subdomain === void 0 ? {} : { subdomain })
-    }
-  );
-  return { ...created, name: null };
-}
 const TOKEN_VARIABLE = "DROP2RUN_TOKEN";
 function configPath() {
   return join(homedir(), ".config", "drop2run", "config.json");
@@ -137,6 +84,131 @@ function missingCredentialsMessage(surface = "cli") {
     "The token is shown once when it is created and cannot be recovered afterwards."
   ].join("\n");
 }
+async function call(credentials, path, init = {}) {
+  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
+    ...init,
+    headers: {
+      ...init.headers,
+      Authorization: `Bearer ${credentials.token}`,
+      ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
+    }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  return await response.json();
+}
+async function findSite(credentials, site) {
+  const found = await lookUpSite(credentials, site);
+  if (found === void 0) {
+    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+  }
+  return found;
+}
+const SITE_ID_SHAPE = /^[0-9a-z]{26}$/i;
+async function lookUpSite(credentials, site) {
+  const wanted = site.trim().toLowerCase();
+  if (wanted === "") return void 0;
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(wanted)}`
+  );
+  const bySubdomain = sites.find((candidate) => candidate.subdomain.toLowerCase() === wanted);
+  if (bySubdomain !== void 0) return bySubdomain;
+  if (!SITE_ID_SHAPE.test(wanted)) return void 0;
+  const response = await fetch(
+    `${credentials.apiBaseUrl}/sites/${encodeURIComponent(wanted.toUpperCase())}`,
+    { headers: { Authorization: `Bearer ${credentials.token}` } }
+  );
+  if (response.status === 404) return void 0;
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  const detail = await response.json();
+  return { siteId: detail.siteId, subdomain: detail.subdomain, url: detail.url, name: detail.name };
+}
+async function deleteSite(credentials, siteId) {
+  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${credentials.token}` }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+}
+const SITES_PER_REQUEST = 100;
+async function listSites(credentials) {
+  const body = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}`
+  );
+  return { sites: body.sites, total: body.total };
+}
+async function createSite(credentials, subdomain, folderId) {
+  const created = await call(
+    credentials,
+    "sites",
+    {
+      method: "POST",
+      // Absent fields rather than null ones, because the API reads null, empty and missing the same
+      // way and a body carrying only what was asked for is the one that reads correctly in a log.
+      body: JSON.stringify({
+        ...subdomain === void 0 ? {} : { subdomain },
+        ...folderId === void 0 ? {} : { folderId }
+      })
+    }
+  );
+  return { ...created, name: null };
+}
+async function listFolders(credentials) {
+  const body = await call(credentials, "site-folders");
+  const byId = new Map(body.folders.map((folder) => [folder.folderId, folder]));
+  const pathOf = (folderId) => {
+    const names = [];
+    let cursor = byId.get(folderId);
+    while (cursor !== void 0 && names.length <= byId.size) {
+      names.unshift(cursor.name);
+      cursor = cursor.parentId === null ? void 0 : byId.get(cursor.parentId);
+    }
+    return names.join("/");
+  };
+  return body.folders.map((folder) => ({ folderId: folder.folderId, path: pathOf(folder.folderId) })).sort((a, b) => a.path.localeCompare(b.path));
+}
+function comparablePath(path) {
+  return path.split("/").map((name) => name.trim()).filter((name) => name !== "").join("/").toLowerCase();
+}
+const FOLDERS_LISTED_ON_MISS = 20;
+async function resolveFolder(credentials, folder) {
+  const wanted = comparablePath(folder);
+  if (wanted === "") {
+    throw new Error(
+      `"${folder}" does not name a folder. Leave the folder out to put the site at the top level.`
+    );
+  }
+  const folders = await listFolders(credentials);
+  const byId = folders.find((candidate) => candidate.folderId.toLowerCase() === wanted);
+  if (byId !== void 0) return byId.folderId;
+  const matches = folders.filter((candidate) => comparablePath(candidate.path) === wanted);
+  if (matches.length === 1 && matches[0] !== void 0) return matches[0].folderId;
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one folder is at "${folder}", because a folder name can contain "/". Name it by id instead: ${matches.map((match) => match.folderId).join(", ")}.`
+    );
+  }
+  if (folders.length === 0) {
+    throw new Error(
+      `No folder of yours is called "${folder}" — this account has no folders yet. Make one in the dashboard at ${dashboardUrlFor(credentials.apiBaseUrl)}, or leave the folder out.`
+    );
+  }
+  const listed = folders.slice(0, FOLDERS_LISTED_ON_MISS).map((candidate) => candidate.path);
+  const more = folders.length - listed.length;
+  throw new Error(
+    `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
+  );
+}
 function newAttempt() {
   const verifier = randomBytes(32).toString("base64url");
   return {
@@ -374,6 +446,485 @@ async function problemToError(response) {
   const message = typeof problem.detail === "string" ? problem.detail : typeof problem.title === "string" ? problem.title : `The server responded with ${response.status}.`;
   return new DeployError(code, message, problem);
 }
+const FILE_TYPES = [
+  // Documents. The three extensions that make a folder a documents site.
+  {
+    ext: ".md",
+    mime: "text/markdown; charset=utf-8",
+    kind: "markdown",
+    document: true,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".markdown",
+    mime: "text/markdown; charset=utf-8",
+    kind: "markdown",
+    document: true,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".pdf",
+    mime: "application/pdf",
+    kind: "pdf",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  // Office documents and ebooks. Each has its own kind because each needs its own renderer, loaded
+  // only when one is opened — `.docx` through mammoth, `.xlsx` through read-excel-file, `.epub`
+  // through foliate-js.
+  {
+    ext: ".docx",
+    mime: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    kind: "docx",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  {
+    ext: ".xlsx",
+    mime: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    kind: "xlsx",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  {
+    ext: ".epub",
+    mime: "application/epub+zip",
+    kind: "epub",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  // Prose the reader shows preformatted.
+  {
+    ext: ".txt",
+    mime: "text/plain; charset=utf-8",
+    kind: "text",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".log",
+    mime: "text/plain; charset=utf-8",
+    kind: "text",
+    document: false,
+    reader: true,
+    editable: false
+  },
+  {
+    ext: ".csv",
+    mime: "text/csv; charset=utf-8",
+    kind: "text",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  // Structured text. Read through the reader inside a folder of notes, which is why these carry
+  // `reader: true` while the source formats below do not.
+  {
+    ext: ".json",
+    mime: "application/json",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".yaml",
+    mime: "text/yaml; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".yml",
+    mime: "text/yaml; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    // No registered media type, so it takes text/plain rather than an invented one. The point is
+    // only that a browser shows it instead of downloading it.
+    ext: ".toml",
+    mime: "text/plain; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  // Source the viewer highlights. A link straight to one of these hands over the file.
+  {
+    ext: ".css",
+    mime: "text/css; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".js",
+    mime: "text/javascript; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".ts",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".tsx",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".jsx",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".sh",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  // The languages an assistant writes most, beyond the web's own. Same row as `.ts`: shown as source
+  // when somebody opens one in the reader or publishes it on its own, handed over as a file when a
+  // link names it directly, and no media type — adding one changes what a browser does with a
+  // published file, which I10 makes a decision of its own rather than a side effect of this list.
+  {
+    ext: ".py",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".sql",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".go",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".rs",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".java",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".kt",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".swift",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".rb",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".php",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".c",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".h",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".cpp",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".cs",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".r",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".xml",
+    mime: "application/xml",
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  // Pictures, shown with an img element.
+  {
+    ext: ".png",
+    mime: "image/png",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".jpg",
+    mime: "image/jpeg",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".jpeg",
+    mime: "image/jpeg",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".gif",
+    mime: "image/gif",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".webp",
+    mime: "image/webp",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".avif",
+    mime: "image/avif",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    // Text, hand-edited in practice, and script-carrying. Editable anyway: the Worker derives the
+    // type at serve time (I10) and already serves whatever was uploaded, so withholding the edit
+    // would withhold nothing else.
+    ext: ".svg",
+    mime: "image/svg+xml",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".ico",
+    mime: "image/x-icon",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  // A customer's own pages. Never rendered inside the reader.
+  {
+    ext: ".html",
+    mime: "text/html; charset=utf-8",
+    kind: "html",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    // ⚠️ No media type, and that is the state of the code rather than a decision: `TYPES` in
+    // `headers.ts` has never held `htm`, so a published `.htm` is served as octet-stream and
+    // downloads instead of rendering. Recorded here rather than fixed, because this table was
+    // introduced as a refactor and a refactor that changes what a URL answers is not one.
+    ext: ".htm",
+    mime: null,
+    kind: "html",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  // Everything below renders as nothing — the viewer offers a download — but still needs a media
+  // type, because these are the files a static site is built out of.
+  {
+    ext: ".mjs",
+    mime: "text/javascript; charset=utf-8",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".cjs",
+    mime: null,
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".map",
+    mime: "application/json",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".wasm",
+    mime: "application/wasm",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".woff2",
+    mime: "font/woff2",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".woff",
+    mime: "font/woff",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".ttf",
+    mime: "font/ttf",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".mp4",
+    mime: "video/mp4",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".webm",
+    mime: "video/webm",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  }
+];
+function extensionsWhere(include) {
+  return FILE_TYPES.filter(include).map((type) => type.ext);
+}
+const DOCUMENT_EXTENSIONS$1 = extensionsWhere((type) => type.document);
+const VIEWABLE_EXTENSIONS$1 = extensionsWhere(
+  (type) => type.kind !== "binary"
+);
+extensionsWhere((type) => type.reader);
+extensionsWhere((type) => type.editable);
+const WEB_ASSET_EXTENSIONS = [
+  ".html",
+  ".htm",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".css"
+];
+const GALLERY_EXTENSIONS = extensionsWhere(
+  (type) => type.kind === "image"
+);
+Object.fromEntries(
+  FILE_TYPES.filter((type) => type.mime !== null).map((type) => [type.ext, type.mime])
+);
+function extensionOf(path) {
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  return dot <= 0 ? "" : name.slice(dot).toLowerCase();
+}
 async function sha256Hex(bytes) {
   const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
@@ -405,52 +956,29 @@ function shouldIgnore(path) {
   return segments.some((segment) => IGNORED_DIRECTORIES.includes(segment));
 }
 const REQUIRED_INDEX = "index.html";
-const DOCUMENT_EXTENSIONS = [".md", ".markdown", ".pdf"];
+const DOCUMENT_EXTENSIONS = DOCUMENT_EXTENSIONS$1;
 function isDocumentPath(path) {
   const lower = path.toLowerCase();
   return DOCUMENT_EXTENSIONS.some((extension) => lower.endsWith(extension));
 }
-const VIEWABLE_EXTENSIONS = [
-  // Documents — these also count at any depth, via DOCUMENT_EXTENSIONS.
-  ".md",
-  ".markdown",
-  ".pdf",
-  // Prose the reader shows preformatted.
-  ".txt",
-  ".log",
-  ".csv",
-  // Source the reader shows with highlighting.
-  ".json",
-  ".yaml",
-  ".yml",
-  ".toml",
-  ".css",
-  ".js",
-  ".ts",
-  ".tsx",
-  ".jsx",
-  ".sh",
-  ".xml",
-  // Pictures the reader shows with an img element.
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".gif",
-  ".webp",
-  ".avif",
-  ".svg",
-  ".ico",
-  // See the note above: a floor for a caller that did not rename it.
-  ".html",
-  ".htm"
-];
+const VIEWABLE_EXTENSIONS = VIEWABLE_EXTENSIONS$1;
 function isViewablePath(path) {
   const lower = path.toLowerCase();
   return VIEWABLE_EXTENSIONS.some((extension) => lower.endsWith(extension));
 }
+function isImageFolder(paths) {
+  let pictures = false;
+  for (const path of paths) {
+    const ext = extensionOf(path);
+    if (WEB_ASSET_EXTENSIONS.includes(ext)) return false;
+    if (GALLERY_EXTENSIONS.includes(ext)) pictures = true;
+  }
+  return pictures;
+}
 function canPublish(paths) {
   if (paths.some((path) => path === REQUIRED_INDEX)) return true;
   if (paths.some(isDocumentPath)) return true;
+  if (isImageFolder(paths)) return true;
   return paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0]);
 }
 function renameOfLoneHtmlPage(paths) {
@@ -479,37 +1007,42 @@ function checkLimits(files, limits) {
       `A site needs an ${REQUIRED_INDEX} at its top level, or at least one .md or .pdf file to publish as a documents site — or be a single file that can be displayed on its own, such as a note, a PDF, a page or an image. Drop the folder that contains it, not the folder above.`
     );
   }
-  if (!limits) return;
+  const refusal = sizeRefusal(
+    files.map((file) => ({ path: file.path, size: file.bytes.length })),
+    limits
+  );
+  if (refusal) throw refusal;
+}
+function sizeRefusal(files, limits) {
+  if (!limits) return null;
   if (files.length > limits.maxFiles) {
-    throw new DeployError(
+    return new DeployError(
       ClientErrorCode.TooManyFiles,
       `That is ${files.length} files, and this plan allows ${limits.maxFiles}.`,
       { limit: limits.maxFiles, actual: files.length }
     );
   }
-  const oversized = files.find((file) => file.bytes.length > limits.maxFileBytes);
+  const oversized = files.find((file) => file.size > limits.maxFileBytes);
   if (oversized) {
-    throw new DeployError(
+    return new DeployError(
       ClientErrorCode.FileTooLarge,
-      `${oversized.path} is ${formatBytes(oversized.bytes.length)}, and this plan allows ${formatBytes(limits.maxFileBytes)} per file.`,
+      `${oversized.path} is ${formatBytes(oversized.size)}, and this plan allows ${formatBytes(limits.maxFileBytes)} per file.`,
       {
         path: oversized.path,
         limit: limits.maxFileBytes,
-        actual: oversized.bytes.length
+        actual: oversized.size
       }
     );
   }
-  const total = totalBytes(files);
+  const total = files.reduce((sum, file) => sum + file.size, 0);
   if (limits.maxSiteBytes !== null && total > limits.maxSiteBytes) {
-    throw new DeployError(
+    return new DeployError(
       ClientErrorCode.TooLarge,
       `That drop is ${formatBytes(total)}, and this plan allows ${formatBytes(limits.maxSiteBytes)}.`,
       { limit: limits.maxSiteBytes, actual: total }
     );
   }
-}
-function totalBytes(files) {
-  return files.reduce((sum, file) => sum + file.bytes.length, 0);
+  return null;
 }
 const MAX_NAME_LENGTH = 60;
 const HEAD_BYTES = 64 * 1024;
@@ -808,20 +1341,23 @@ function escapesRoot(root, candidate) {
   const inside = relative(root, candidate);
   return inside === "" || inside.startsWith("..");
 }
-async function resolveSite(credentials, site, subdomain) {
-  if (subdomain !== void 0) {
-    if (site !== void 0) {
-      throw new Error(
-        "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
-      );
-    }
-    return await createSite(credentials, subdomain);
+async function resolveSite(credentials, site, newSite) {
+  const { subdomain, folder } = newSite;
+  if (site !== void 0 && subdomain !== void 0) {
+    throw new Error(
+      "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
+    );
   }
-  if (site === void 0) return await createSite(credentials);
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
+  if (site !== void 0 && folder !== void 0) {
+    throw new Error(
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site from the dashboard."
+    );
+  }
+  if (site === void 0) {
+    const folderId = folder === void 0 ? void 0 : await resolveFolder(credentials, folder);
+    return await createSite(credentials, subdomain, folderId);
+  }
+  const found = await lookUpSite(credentials, site);
   if (found === void 0) {
     throw new Error(
       `No site of yours is called "${site}". Leave the site out to publish to a new one, or list your sites to see what exists.`
@@ -829,8 +1365,8 @@ async function resolveSite(credentials, site, subdomain) {
   }
   return found;
 }
-async function publish(credentials, source, site, onProgress, subdomain) {
-  const target = await resolveSite(credentials, site, subdomain);
+async function publish(credentials, source, site, onProgress, newSite = {}) {
+  const target = await resolveSite(credentials, site, newSite);
   let files = 0;
   let url = target.url;
   let unchanged = false;
@@ -860,11 +1396,11 @@ async function publish(credentials, source, site, onProgress, subdomain) {
   });
   return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
 }
-async function publishDirectory(credentials, directory, site, onProgress, subdomain) {
+async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
   const found = await stat(directory).catch(() => null);
   if (found === null) throw new Error(`There is no folder at ${directory}.`);
   if (!found.isDirectory()) throw new Error(`${directory} is a file, not a folder to publish.`);
-  return await publish(credentials, directorySource(directory), site, onProgress, subdomain);
+  return await publish(credentials, directorySource(directory), site, onProgress, newSite);
 }
 function cleanPath(path) {
   const cleaned = path.trim().replaceAll("\\", "/").replace(/^\.?\//, "");
@@ -878,7 +1414,7 @@ function cleanPath(path) {
   }
   return cleaned;
 }
-async function publishFiles(credentials, files, site, subdomain) {
+async function publishFiles(credentials, files, site, newSite = {}) {
   const encoder = new TextEncoder();
   const collected = files.map((file) => ({
     path: cleanPath(file.path),
@@ -889,7 +1425,7 @@ async function publishFiles(credentials, files, site, subdomain) {
     if (seen.has(file.path)) throw new Error(`Two files were given the same path: ${file.path}`);
     seen.add(file.path);
   }
-  return publish(credentials, async () => collected, site, void 0, subdomain);
+  return publish(credentials, async () => collected, site, void 0, newSite);
 }
 const DEFAULT_WAIT_SECONDS = 120;
 const MAX_WAIT_SECONDS = 240;
@@ -1067,7 +1603,7 @@ async function signInWithCode(waitSeconds, replace = false) {
     "Call this tool again to keep waiting. Nothing has been changed yet."
   ].join("\n");
 }
-const SERVER_VERSION = "0.5.1";
+const SERVER_VERSION = "0.7.0";
 const CREDENTIAL_WRITE = {
   readOnlyHint: false,
   destructiveHint: false,
@@ -1105,6 +1641,15 @@ const SITE_OUTPUT = z.object({
   url: z.string().describe("Its live URL."),
   name: z.string().nullable().describe("What it is called, or null when it has no name.")
 });
+const FOLDER_OUTPUT = z.object({
+  folderId: z.string().describe("Identifier of the folder, which `folder` accepts."),
+  path: z.string().describe(
+    "Every name from the top level down to it, joined with /, which `folder` accepts too."
+  )
+});
+const FOLDER_INPUT = z.string().optional().describe(
+  "Folder to file the new site in, when the person asked for one: its path of names such as Clients/Acme, or its id from list_folders. Only for a new site — do not pass it together with `site`; moving an existing site is done in the dashboard. It never creates a folder: a folder that does not exist is refused with the list of those that do, and nothing is published."
+);
 function say(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
@@ -1139,7 +1684,7 @@ function createServer() {
     { name: "drop2run", version: SERVER_VERSION },
     {
       instructions: [
-        "Publishes static sites to Drop2Run.",
+        "Publishes pages, documents and static sites to Drop2Run, and returns a URL.",
         "",
         "Use publish_files for anything you wrote here — a page, a markdown note, several files",
         "together — and publish_dir for a folder that already exists on disk. Leave `site` unset to",
@@ -1152,9 +1697,14 @@ function createServer() {
         "be deleted by hand. `site` and `subdomain` are opposites: one publishes over a site that",
         "exists, the other creates one that does not. Never pass both.",
         "",
-        "A site needs an index.html at its top level, or at least one .md, .markdown or .pdf file,",
-        "which publishes as a documents site and is read through a viewer. So one page goes at",
-        "index.html, and a single note is a whole publish that needs no wrapping in HTML.",
+        "A new site goes at the top level of the dashboard unless `folder` files it somewhere. Pass",
+        "it when the person named a folder, as its path (Clients/Acme) or its id; list_folders shows",
+        "what exists. Like `subdomain`, it only describes a new site, so never pass it with `site`.",
+        "",
+        "A site needs an index.html at its top level, or at least one document (.md, .markdown,",
+        ".pdf, .docx, .xlsx or .epub), which publishes as a documents site and is read through a",
+        "viewer. So one page goes at index.html, and a single note is a whole publish that needs",
+        "no wrapping in HTML.",
         "",
         "Publishing needs an access token. If there is none, call login — it opens a browser and",
         "stores one, and no command line or manual token is involved. Where no browser can be",
@@ -1212,13 +1762,14 @@ function createServer() {
         site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site."),
         subdomain: z.string().optional().describe(
           "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand."
-        )
+        ),
+        folder: FOLDER_INPUT
       },
       outputSchema: PUBLISH_OUTPUT,
       annotations: REPLACES_A_SITE
     },
-    ({ files, site, subdomain }) => withCredentials(async (credentials) => {
-      const result = await publishFiles(credentials, files, site, subdomain);
+    ({ files, site, subdomain, folder }) => withCredentials(async (credentials) => {
+      const result = await publishFiles(credentials, files, site, { subdomain, folder });
       return report(describe(result), { ...result });
     })
   );
@@ -1226,19 +1777,23 @@ function createServer() {
     "publish_dir",
     {
       title: "Publish a folder",
-      description: "Publishes a folder of static files and returns its URL. The folder needs an index.html at its root, or .md and .pdf files, which are served through the reader.",
+      description: "Publishes a folder from disk and returns its URL. The folder needs an index.html at its root, or documents (.md, .pdf, .docx, .xlsx, .epub), which are served through the reader.",
       inputSchema: {
         path: z.string().min(1).describe("Absolute path of the folder to publish."),
         site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site."),
         subdomain: z.string().optional().describe(
           "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand."
-        )
+        ),
+        folder: FOLDER_INPUT
       },
       outputSchema: PUBLISH_OUTPUT,
       annotations: REPLACES_A_SITE
     },
-    ({ path, site, subdomain }) => withCredentials(async (credentials) => {
-      const result = await publishDirectory(credentials, path, site, void 0, subdomain);
+    ({ path, site, subdomain, folder }) => withCredentials(async (credentials) => {
+      const result = await publishDirectory(credentials, path, site, void 0, {
+        subdomain,
+        folder
+      });
       return report(describe(result), { ...result });
     })
   );
@@ -1279,15 +1834,36 @@ function createServer() {
       title: "List sites",
       description: "Lists the sites on this account, so a publish can go to one of them.",
       inputSchema: {},
-      outputSchema: { sites: z.array(SITE_OUTPUT).describe("Every site on this account.") },
+      outputSchema: {
+        sites: z.array(SITE_OUTPUT).describe("The account's sites, newest first — every one unless `total` is larger."),
+        total: z.number().int().describe("How many sites the account holds. Larger than `sites` only past 100.")
+      },
       annotations: READS_ONLY
     },
     () => withCredentials(async (credentials) => {
-      const sites = await listSites(credentials);
+      const { sites, total } = await listSites(credentials);
       const text = sites.length === 0 ? "No sites on this account yet. Publishing without a `site` creates one." : sites.map(
         (site) => `${site.subdomain} — ${site.url}${site.name ? ` — ${site.name}` : ""}`
-      ).join("\n");
-      return report(text, { sites: sites.map((site) => ({ ...site })) });
+      ).join("\n") + (total > sites.length ? `
+… and ${total - sites.length} more; these are the newest ${sites.length} of ${total}.` : "");
+      return report(text, { sites: sites.map((site) => ({ ...site })), total });
+    })
+  );
+  server.registerTool(
+    "list_folders",
+    {
+      title: "List folders",
+      description: "Lists the folders on this account, each with the path a publish's `folder` accepts. Folders are made and rearranged in the dashboard; no tool here creates one.",
+      inputSchema: {},
+      outputSchema: {
+        folders: z.array(FOLDER_OUTPUT).describe("Every folder on this account, ordered by path.")
+      },
+      annotations: READS_ONLY
+    },
+    () => withCredentials(async (credentials) => {
+      const folders = await listFolders(credentials);
+      const text = folders.length === 0 ? "No folders on this account. A new site goes at the top level; folders are made in the dashboard." : folders.map((folder) => `${folder.path} — ${folder.folderId}`).join("\n");
+      return report(text, { folders: folders.map((folder) => ({ ...folder })) });
     })
   );
   return server;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@drop2run/mcp",
-	"version": "0.5.1",
-	"description": "MCP server that publishes a folder or an HTML page to Drop2Run and returns a live URL.",
+	"version": "0.7.0",
+	"description": "MCP server that publishes what an AI made — a page, a document or a whole site — to Drop2Run and returns a live URL.",
 	"mcpName": "run.dropto/drop2run",
 	"license": "MIT",
 	"type": "module",