@dropthis/cli 0.23.0 → 0.24.1

package/node_modules/@dropthis/node/README.md

@@ -1,3 +1,5 @@
+<p align="center"><img src="https://dropthis.app/icon-512.png" width="76" height="76" alt="dropthis" /></p>
+
 # @dropthis/node
 
 Official Node.js SDK for [dropthis](https://dropthis.app) -- the publish layer between AI and the internet. One API call in, one URL out.
@@ -275,6 +277,15 @@ if (result.error) {
 
 Local input validation errors (e.g. `file_not_found`) are also returned as `{ error: { code: "file_not_found", ... } }` rather than thrown -- except for `prepare()`, which throws `PublishInputError`.
 
+`error.retryable` tells an agent whether retrying is worthwhile. The SDK marks its own
+transient failures `retryable: true` only when retrying is safe: a `GET` `timeout` /
+`network_error`, any request you sent with an `idempotencyKey`, or a signed-upload `5xx`.
+A bare (non-idempotent) `POST`/`PATCH`/`DELETE` timeout is left unmarked because the
+server may have applied it before the connection dropped. Server-side errors carry
+whatever `retryable` the API returns (the SDK never overrides it). `publish()` and
+`updateContent()` are always safe to retry — each derives a stable idempotency key, so a
+retried publish never creates a duplicate drop.
+
 ## Configuration
 
 ```typescript
@@ -313,14 +324,21 @@ List results support auto-pagination:
 
 ```typescript
 const page = await dropthis.drops.list();
-const allDrops = await page.data.autoPagingToArray({ limit: 100 });
-
-// Or iterate
-for await (const drop of page.data) {
-  console.log(drop.url);
+const all = await page.data.autoPagingToArray({ limit: 100 });
+if (all.error) {
+  // a later page failed to fetch — inspect all.error.code / statusCode / requestId
+} else {
+  for (const drop of all.data) console.log(drop.url);
 }
 ```
 
+Like every call in this SDK, `autoPagingToArray()` **never throws** for an API error — it
+returns the same `{ data, error }` result shape. On success you get `{ data: items, error: null }`;
+if fetching a later page fails you get `{ data: null, error }` carrying the underlying
+`code` / `statusCode` / `retryable` / `requestId`. So you can never be handed a silently
+truncated list, and you never have to wrap pagination in `try/catch`. (For manual control,
+loop on `dropthis.drops.list({ cursor })` and check each result's `.error`.)
+
 > To change a drop's content, use `client.drops.updateContent(dropId, newInput)`. `drops.updateSettings()` is for settings only (title, visibility, password, noindex, expiresAt, metadata).
 
 ### deployments
@@ -352,6 +370,8 @@ await dropthis.auth.verifyEmailOtp({ email: "you@example.com", code: "123456" })
 await dropthis.auth.logout(); // 204 No Content — data is null
 ```
 
+> On a failed verify the error `code` is `otp_expired` (no active code — request a new one) or `otp_invalid` (wrong digits — re-check, don't auto-resend). 401 on either.
+
 ### apiKeys
 
 ```typescript
@@ -464,11 +484,20 @@ import type {
   PublishInput,
   PublishFileInput,
   ListPage,
+  KeyType,
+  RevokeImpact,
   CreateUploadSessionRequest,
   CreateUploadSessionResponse,
 } from "@dropthis/node";
 ```
 
+`PublishInputError` (thrown only for programmer errors when building a publish input,
+never for API failures) is a runtime export:
+
+```typescript
+import { PublishInputError } from "@dropthis/node";
+```
+
 ## Agent skills
 
 For AI coding agents (Cursor, Claude Code, Windsurf, etc.), install the [dropthis-skills](https://github.com/dropthis-dev/dropthis-skills) package:

package/node_modules/@dropthis/node/dist/{drops-DNwOp7g_.d.cts → drops-BVoN5MaZ.d.cts}

@@ -77,6 +77,10 @@ type DropResponse = {
     noindex: boolean;
     passwordProtected: boolean;
     metadata: Record<string, unknown>;
+    /** When the drop was last updated (content or settings), ISO 8601. */
+    updatedAt: string;
+    /** Origin that created the drop (e.g. "api", "cli", "mcp"); null/omitted when unattributed. */
+    source?: string | null;
     object: string;
     accessible: boolean;
     persistent: boolean;
@@ -131,8 +135,7 @@ type ListPage<T> = {
     nextCursor: string | null;
     autoPagingToArray(options?: {
         limit?: number;
-    }): Promise<T[]>;
-    [Symbol.asyncIterator](): AsyncIterableIterator<T>;
+    }): Promise<DropthisResult<T[]>>;
 };
 type Action = {
     code: string;
@@ -142,7 +145,8 @@ type Action = {
     message: string;
 };
 type EmailOtpResponse = {
-    ok: true;
+    /** Always `true` on success; optional because the server defaults it. */
+    ok?: true;
     expiresIn: number;
     nextAction?: Action | null;
 };
@@ -152,12 +156,35 @@ type SessionResponse = {
     accountId: string;
     isNewAccount: boolean;
     expiresIn: number;
+    /**
+     * Rotating refresh token for a console browser session. Present when a session is
+     * started (email/verify, refresh); `null`/omitted for non-session token issuance.
+     */
+    refreshToken?: string | null;
 };
+/**
+ * Why an API key exists. `standard` keys are created by the user (CLI/SDK/manual);
+ * `mcp_oauth` keys are minted per connected client by the MCP OAuth flow and carry a
+ * more generous quota.
+ */
+type KeyType = "standard" | "mcp_oauth";
+/** What breaks when a key is revoked. */
+type RevokeImpact = "disconnects_app" | "breaks_automation";
 type ApiKeyResponse = {
     object: "api_key";
     id: string;
     keyLast4: string;
     label: string;
+    /** Human-facing credential name: the user's label for `standard` keys, the connected client name for `mcp_oauth` keys. */
+    appName: string;
+    /** Why the key exists (drives quota accounting). */
+    keyType: KeyType;
+    /** Scopes granted to this key. */
+    scopes: string[];
+    /** When the key was last used to authenticate, ISO 8601; null/omitted if never used. */
+    lastUsedAt?: string | null;
+    /** What breaks if this key is revoked. */
+    revokeImpact: RevokeImpact;
     createdAt: string;
 };
 type ApiKeyCreatedResponse = ApiKeyResponse & {
@@ -252,9 +279,17 @@ type CreateUploadSessionFileResponse = {
 type UploadSessionFileResponse = {
     fileId: string;
     path: string;
-    contentType: string;
-    sizeBytes: number;
+    /** Declared MIME type; `null`/omitted for remote-fetch files until ingested. */
+    contentType?: string | null;
+    /** Declared byte size; `null`/omitted for remote-fetch files until ingested. */
+    sizeBytes?: number | null;
     objectKey: string;
+    /** How the file enters staging: "client_put" (client PUTs bytes) or "remote_fetch" (server fetches sourceUrl). */
+    origin: "client_put" | "remote_fetch";
+    /** Ingest lifecycle state for remote-fetch files (e.g. "pending" | "fetching" | "fetched" | "failed"). */
+    state: string;
+    /** Public http(s) URL the server fetches into staging; `null`/omitted for client-put files. */
+    sourceUrl?: string | null;
     verified: boolean;
 };
 type UploadSessionResponse = {
@@ -696,17 +731,29 @@ declare class CursorPage<T> implements ListPage<T> {
     readonly data: T[];
     readonly hasMore: boolean;
     readonly nextCursor: string | null;
+    /** Response headers from the fetch that produced this page. */
+    readonly headers: Record<string, string>;
     private readonly fetchNextPage;
     constructor(input: {
         data: T[];
         hasMore: boolean;
         nextCursor: string | null;
+        headers?: Record<string, string>;
         fetchNextPage?: (() => Promise<DropthisResult<CursorPage<T>>>) | undefined;
     });
+    /**
+     * Collect items across every page into a single array.
+     *
+     * No-throw, consistent with the rest of the SDK's {@link DropthisResult}
+     * contract: returns `{ data: items, error: null }` on success, or
+     * `{ data: null, error }` if fetching a later page fails — never a thrown
+     * exception, and never a silently truncated list. Inspect `.error`
+     * (`code`/`statusCode`/`retryable`/`requestId`) exactly as you would for any
+     * other call. Pass `limit` to stop once that many items are collected.
+     */
     autoPagingToArray(options?: {
         limit?: number;
-    }): Promise<T[]>;
-    [Symbol.asyncIterator](): AsyncIterableIterator<T>;
+    }): Promise<DropthisResult<T[]>>;
 }
 
 /**
@@ -794,4 +841,4 @@ declare class DropsResource<TInput = PublishInput> {
     delete(dropId: string): Promise<DropthisResult<null>>;
 }
 
-export { type AccountLimits as A, type PreparedUploadFile as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PublishFileInput as F, type GetContentOptions as G, type PublishInput as H, type InMemoryPublishInput as I, type PublishOptions as J, type RequestOptions as K, type Limitations as L, type SessionResponse as M, type NextHint as N, Transport as O, type PrepareOptions as P, type UploadManifestFile as Q, type RequestControls as R, SHARED_POOL as S, type TierInfo as T, type UpdateContentOptions as U, type UploadSessionFileResponse as V, type UploadSessionResponse as W, type UploadTarget as X, AccountResource as a, type AccountResponse as b, type ActionResolve as c, ApiKeysResource as d, type CreateUploadSessionResponse as e, CursorPage as f, type DeploymentContentManifest as g, DeploymentsResource as h, type DnsRecord as i, type DomainDeletedResponse as j, type DomainListResponse as k, type DomainResponse as l, DomainsResource as m, type DropAction as n, type DropContentFile as o, type DropDeploymentResponse as p, type DropOptions as q, type DropResponse as r, DropsResource as s, type DropthisClientOptions as t, type DropthisErrorResponse as u, type DropthisResult as v, type ListDeploymentsParams as w, type ListDeploymentsResponse as x, type ListPage as y, type PreparedPublishRequest as z };
+export { type AccountLimits as A, type PreparedUploadFile as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PublishFileInput as F, type GetContentOptions as G, type PublishInput as H, type InMemoryPublishInput as I, type PublishOptions as J, type KeyType as K, type Limitations as L, type RequestOptions as M, type NextHint as N, type RevokeImpact as O, type PrepareOptions as P, type SessionResponse as Q, type RequestControls as R, SHARED_POOL as S, type TierInfo as T, Transport as U, type UpdateContentOptions as V, type UploadManifestFile as W, type UploadSessionFileResponse as X, type UploadSessionResponse as Y, type UploadTarget as Z, AccountResource as a, type AccountResponse as b, type ActionResolve as c, ApiKeysResource as d, type CreateUploadSessionResponse as e, CursorPage as f, type DeploymentContentManifest as g, DeploymentsResource as h, type DnsRecord as i, type DomainDeletedResponse as j, type DomainListResponse as k, type DomainResponse as l, DomainsResource as m, type DropAction as n, type DropContentFile as o, type DropDeploymentResponse as p, type DropOptions as q, type DropResponse as r, DropsResource as s, type DropthisClientOptions as t, type DropthisErrorResponse as u, type DropthisResult as v, type ListDeploymentsParams as w, type ListDeploymentsResponse as x, type ListPage as y, type PreparedPublishRequest as z };

package/node_modules/@dropthis/node/dist/{drops-DNwOp7g_.d.ts → drops-BVoN5MaZ.d.ts}

@@ -77,6 +77,10 @@ type DropResponse = {
     noindex: boolean;
     passwordProtected: boolean;
     metadata: Record<string, unknown>;
+    /** When the drop was last updated (content or settings), ISO 8601. */
+    updatedAt: string;
+    /** Origin that created the drop (e.g. "api", "cli", "mcp"); null/omitted when unattributed. */
+    source?: string | null;
     object: string;
     accessible: boolean;
     persistent: boolean;
@@ -131,8 +135,7 @@ type ListPage<T> = {
     nextCursor: string | null;
     autoPagingToArray(options?: {
         limit?: number;
-    }): Promise<T[]>;
-    [Symbol.asyncIterator](): AsyncIterableIterator<T>;
+    }): Promise<DropthisResult<T[]>>;
 };
 type Action = {
     code: string;
@@ -142,7 +145,8 @@ type Action = {
     message: string;
 };
 type EmailOtpResponse = {
-    ok: true;
+    /** Always `true` on success; optional because the server defaults it. */
+    ok?: true;
     expiresIn: number;
     nextAction?: Action | null;
 };
@@ -152,12 +156,35 @@ type SessionResponse = {
     accountId: string;
     isNewAccount: boolean;
     expiresIn: number;
+    /**
+     * Rotating refresh token for a console browser session. Present when a session is
+     * started (email/verify, refresh); `null`/omitted for non-session token issuance.
+     */
+    refreshToken?: string | null;
 };
+/**
+ * Why an API key exists. `standard` keys are created by the user (CLI/SDK/manual);
+ * `mcp_oauth` keys are minted per connected client by the MCP OAuth flow and carry a
+ * more generous quota.
+ */
+type KeyType = "standard" | "mcp_oauth";
+/** What breaks when a key is revoked. */
+type RevokeImpact = "disconnects_app" | "breaks_automation";
 type ApiKeyResponse = {
     object: "api_key";
     id: string;
     keyLast4: string;
     label: string;
+    /** Human-facing credential name: the user's label for `standard` keys, the connected client name for `mcp_oauth` keys. */
+    appName: string;
+    /** Why the key exists (drives quota accounting). */
+    keyType: KeyType;
+    /** Scopes granted to this key. */
+    scopes: string[];
+    /** When the key was last used to authenticate, ISO 8601; null/omitted if never used. */
+    lastUsedAt?: string | null;
+    /** What breaks if this key is revoked. */
+    revokeImpact: RevokeImpact;
     createdAt: string;
 };
 type ApiKeyCreatedResponse = ApiKeyResponse & {
@@ -252,9 +279,17 @@ type CreateUploadSessionFileResponse = {
 type UploadSessionFileResponse = {
     fileId: string;
     path: string;
-    contentType: string;
-    sizeBytes: number;
+    /** Declared MIME type; `null`/omitted for remote-fetch files until ingested. */
+    contentType?: string | null;
+    /** Declared byte size; `null`/omitted for remote-fetch files until ingested. */
+    sizeBytes?: number | null;
     objectKey: string;
+    /** How the file enters staging: "client_put" (client PUTs bytes) or "remote_fetch" (server fetches sourceUrl). */
+    origin: "client_put" | "remote_fetch";
+    /** Ingest lifecycle state for remote-fetch files (e.g. "pending" | "fetching" | "fetched" | "failed"). */
+    state: string;
+    /** Public http(s) URL the server fetches into staging; `null`/omitted for client-put files. */
+    sourceUrl?: string | null;
     verified: boolean;
 };
 type UploadSessionResponse = {
@@ -696,17 +731,29 @@ declare class CursorPage<T> implements ListPage<T> {
     readonly data: T[];
     readonly hasMore: boolean;
     readonly nextCursor: string | null;
+    /** Response headers from the fetch that produced this page. */
+    readonly headers: Record<string, string>;
     private readonly fetchNextPage;
     constructor(input: {
         data: T[];
         hasMore: boolean;
         nextCursor: string | null;
+        headers?: Record<string, string>;
         fetchNextPage?: (() => Promise<DropthisResult<CursorPage<T>>>) | undefined;
     });
+    /**
+     * Collect items across every page into a single array.
+     *
+     * No-throw, consistent with the rest of the SDK's {@link DropthisResult}
+     * contract: returns `{ data: items, error: null }` on success, or
+     * `{ data: null, error }` if fetching a later page fails — never a thrown
+     * exception, and never a silently truncated list. Inspect `.error`
+     * (`code`/`statusCode`/`retryable`/`requestId`) exactly as you would for any
+     * other call. Pass `limit` to stop once that many items are collected.
+     */
     autoPagingToArray(options?: {
         limit?: number;
-    }): Promise<T[]>;
-    [Symbol.asyncIterator](): AsyncIterableIterator<T>;
+    }): Promise<DropthisResult<T[]>>;
 }
 
 /**
@@ -794,4 +841,4 @@ declare class DropsResource<TInput = PublishInput> {
     delete(dropId: string): Promise<DropthisResult<null>>;
 }
 
-export { type AccountLimits as A, type PreparedUploadFile as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PublishFileInput as F, type GetContentOptions as G, type PublishInput as H, type InMemoryPublishInput as I, type PublishOptions as J, type RequestOptions as K, type Limitations as L, type SessionResponse as M, type NextHint as N, Transport as O, type PrepareOptions as P, type UploadManifestFile as Q, type RequestControls as R, SHARED_POOL as S, type TierInfo as T, type UpdateContentOptions as U, type UploadSessionFileResponse as V, type UploadSessionResponse as W, type UploadTarget as X, AccountResource as a, type AccountResponse as b, type ActionResolve as c, ApiKeysResource as d, type CreateUploadSessionResponse as e, CursorPage as f, type DeploymentContentManifest as g, DeploymentsResource as h, type DnsRecord as i, type DomainDeletedResponse as j, type DomainListResponse as k, type DomainResponse as l, DomainsResource as m, type DropAction as n, type DropContentFile as o, type DropDeploymentResponse as p, type DropOptions as q, type DropResponse as r, DropsResource as s, type DropthisClientOptions as t, type DropthisErrorResponse as u, type DropthisResult as v, type ListDeploymentsParams as w, type ListDeploymentsResponse as x, type ListPage as y, type PreparedPublishRequest as z };
+export { type AccountLimits as A, type PreparedUploadFile as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PublishFileInput as F, type GetContentOptions as G, type PublishInput as H, type InMemoryPublishInput as I, type PublishOptions as J, type KeyType as K, type Limitations as L, type RequestOptions as M, type NextHint as N, type RevokeImpact as O, type PrepareOptions as P, type SessionResponse as Q, type RequestControls as R, SHARED_POOL as S, type TierInfo as T, Transport as U, type UpdateContentOptions as V, type UploadManifestFile as W, type UploadSessionFileResponse as X, type UploadSessionResponse as Y, type UploadTarget as Z, AccountResource as a, type AccountResponse as b, type ActionResolve as c, ApiKeysResource as d, type CreateUploadSessionResponse as e, CursorPage as f, type DeploymentContentManifest as g, DeploymentsResource as h, type DnsRecord as i, type DomainDeletedResponse as j, type DomainListResponse as k, type DomainResponse as l, DomainsResource as m, type DropAction as n, type DropContentFile as o, type DropDeploymentResponse as p, type DropOptions as q, type DropResponse as r, DropsResource as s, type DropthisClientOptions as t, type DropthisErrorResponse as u, type DropthisResult as v, type ListDeploymentsParams as w, type ListDeploymentsResponse as x, type ListPage as y, type PreparedPublishRequest as z };

package/node_modules/@dropthis/node/dist/edge.cjs

@@ -636,30 +636,50 @@ var CursorPage = class {
   data;
   hasMore;
   nextCursor;
+  /** Response headers from the fetch that produced this page. */
+  headers;
   fetchNextPage;
   constructor(input) {
     this.data = input.data;
     this.hasMore = input.hasMore;
     this.nextCursor = input.nextCursor;
+    this.headers = input.headers ?? {};
     this.fetchNextPage = input.fetchNextPage;
   }
+  /**
+   * Collect items across every page into a single array.
+   *
+   * No-throw, consistent with the rest of the SDK's {@link DropthisResult}
+   * contract: returns `{ data: items, error: null }` on success, or
+   * `{ data: null, error }` if fetching a later page fails — never a thrown
+   * exception, and never a silently truncated list. Inspect `.error`
+   * (`code`/`statusCode`/`retryable`/`requestId`) exactly as you would for any
+   * other call. Pass `limit` to stop once that many items are collected.
+   */
   async autoPagingToArray(options = {}) {
-    const items = [];
-    for await (const item of this) {
-      items.push(item);
-      if (options.limit !== void 0 && items.length >= options.limit) break;
+    const { limit } = options;
+    if (limit !== void 0 && limit <= 0) {
+      return { data: [], error: null, headers: this.headers };
     }
-    return items;
-  }
-  async *[Symbol.asyncIterator]() {
-    for (const item of this.data) yield item;
+    const items = [];
     let current = this;
-    while (current.hasMore && current.fetchNextPage) {
+    let lastHeaders = this.headers;
+    while (current) {
+      for (const item of current.data) {
+        items.push(item);
+        if (limit !== void 0 && items.length >= limit) {
+          return { data: items, error: null, headers: lastHeaders };
+        }
+      }
+      if (!current.hasMore || !current.fetchNextPage) break;
       const next = await current.fetchNextPage();
-      if (next.error) break;
+      if (next.error) {
+        return { data: null, error: next.error, headers: next.headers };
+      }
+      lastHeaders = next.headers;
       current = next.data;
-      for (const item of current.data) yield item;
     }
+    return { data: items, error: null, headers: lastHeaders };
   }
 };
 
@@ -728,6 +748,7 @@ var DropsResource = class {
       data: result.data.drops,
       nextCursor: result.data.nextCursor,
       hasMore: result.data.nextCursor !== null,
+      headers: result.headers,
       fetchNextPage: result.data.nextCursor ? () => this.list({ ...params, cursor: result.data.nextCursor }) : void 0
     });
     return { data: page, error: null, headers: result.headers };
@@ -871,7 +892,7 @@ function toSnakeCase(value) {
 
 // src/transport.ts
 var DEFAULT_BASE_URL = "https://api.dropthis.app";
-var SDK_VERSION = "0.20.0";
+var SDK_VERSION = "0.22.0";
 var Transport = class {
   apiKey;
   baseUrl;
@@ -910,7 +931,10 @@ var Transport = class {
           `signed_upload_${response.status}`,
           text || response.statusText,
           response.status,
-          { headers: responseHeaders }
+          // A 5xx from object storage is a transient upstream failure — safe to
+          // re-PUT. A 4xx (e.g. 403 expired/denied signed URL) won't fix itself on
+          // a blind retry, so leave it unmarked.
+          { headers: responseHeaders, retryable: response.status >= 500 }
         );
       }
       return {
@@ -925,7 +949,8 @@ var Transport = class {
       return createErrorResult(
         error instanceof Error && error.name === "AbortError" ? "timeout" : "network_error",
         message,
-        null
+        null,
+        { retryable: true }
       );
     } finally {
       clearTimeout(timeout);
@@ -982,7 +1007,8 @@ var Transport = class {
       return createErrorResult(
         error instanceof Error && error.name === "AbortError" ? "timeout" : "network_error",
         message,
-        null
+        null,
+        { retryable: true }
       );
     } finally {
       clearTimeout(timeout);
@@ -1043,10 +1069,12 @@ var Transport = class {
       };
     } catch (error) {
       const message = error instanceof Error && error.name === "AbortError" ? "Request timed out" : error instanceof Error ? error.message : "Network error";
+      const retrySafe = method.toUpperCase() === "GET" || options.idempotencyKey !== void 0;
       return createErrorResult(
         error instanceof Error && error.name === "AbortError" ? "timeout" : "network_error",
         message,
-        null
+        null,
+        retrySafe ? { retryable: true } : {}
       );
     } finally {
       clearTimeout(timeout);