@dropthis/cli 0.9.2 → 0.10.0

package/README.md

@@ -88,18 +88,19 @@ dropthis ./dist --url
 dropthis publish ./dist \
   --title "Launch page" \
   --visibility unlisted \
-  --password s3cret \
   --entry index.html \
   --expires-at 2026-12-31T00:00:00Z
 ```
 
+`publish` always creates a NEW drop with a new URL. To change a drop you already published, use `update-content` or `update-settings` with its `drop_…` id — never publish again.
+
 All publish flags:
 
 | Flag | Description |
 |------|-------------|
 | `--title <title>` | Drop title |
 | `--visibility <public\|unlisted>` | Drop visibility |
-| `--password <password>` | Set password protection |
+| `--password <password>` | Set password protection (ships with Pro; not enabled on any tier yet) |
 | `--noindex` | Prevent search indexing |
 | `--entry <path>` | Entry file for directories |
 | `--content-type <mime>` | MIME type (required for stdin) |
@@ -126,48 +127,78 @@ These flags are inherited by all commands:
 
 ## Update
 
-Update an existing drop's content, metadata, or both via `drops update`:
+Change an existing drop without creating a new URL. Content and settings are **separate** operations — pass the full `drop_…` id (not the slug):
 
 ```bash
-# Replace content
-dropthis drops update drop_abc123 ./dist-v2
+# Replace the content at the same URL (ships a new deployment)
+dropthis update-content drop_abc123 ./dist-v2
+
+# Change settings only — title, visibility, password, expiry, metadata
+dropthis update-settings drop_abc123 --title "New title"
+
+# Optimistic concurrency (both accept --if-revision)
+dropthis update-content drop_abc123 ./dist-v2 --if-revision 1
+```
+
+`update-content` replaces the files at the URL; `update-settings` changes title, visibility, password, noindex, expiry, or metadata. Creating a new drop is always `publish` — neither update command makes a new URL.
 
-# Update metadata only
-dropthis drops update drop_abc123 --title "New title"
+With `--if-revision`, a concurrent edit fails with a 409 instead of clobbering. The error shows the drop's `current_revision` and how to retry:
 
-# Optimistic concurrency
-dropthis drops update drop_abc123 ./dist-v2 --if-revision 1
+```text
+✗ Revision mismatch
+  The drop changed since it was last read. Re-read it with GET /v1/drops/{drop_id} and retry with if_revision: 2 (sent as the If-Revision header).
+  Current revision: 2 — retry with --if-revision 2
 ```
 
-`drops update` supports all publish flags plus `--if-revision`.
+In JSON mode the same error carries `current_revision` and a `next_action` field.
+
+## Pull (read back)
+
+Download what a drop is serving — by `drop_…` id, drop URL, or slug. URLs and slugs are resolved to your own drops; the local copy is also the rollback path (pull an old state, then `update-content` it back):
+
+```bash
+# By id, into ./drop_abc123/
+dropthis pull drop_abc123
+
+# By URL — resolves the slug to your drop, writes into ./abc123/
+dropthis pull https://abc123.dropthis.app
+
+# Choose the output directory
+dropthis pull drop_abc123 -o ./site
+```
+
+Pull fetches the current deployment's file manifest and writes every file into the output directory. It is owner-side read-back via the API — it works regardless of any viewer password. Custom-domain URLs are not resolvable yet; use the `drop_…` id instead.
 
 ## Commands
 
 ```bash
-dropthis [input...]                    # Publish content (default command)
-dropthis publish [input...]            # Same as above, explicit form
+dropthis [input...]                          # Publish content (default command)
+dropthis publish [input...]                  # Same as above, explicit form
 
-dropthis drops list                    # List your drops
-dropthis drops get <drop-id>           # Get drop details
-dropthis drops update <drop-id> [input] # Update content or metadata
-dropthis drops delete <drop-id>        # Delete a drop
+dropthis update-content <drop-id> [input]    # Replace a drop's content (same URL)
+dropthis update-settings <drop-id>           # Change title/visibility/password/expiry/metadata
+dropthis pull <id|url> [-o <dir>]            # Download a drop's files to a local directory
+dropthis get <drop-id>                       # Show drop details
+dropthis list                                # List your drops
+dropthis delete <drop-id>                    # Delete a drop (--yes to confirm)
 
-dropthis login                         # Authenticate with email OTP
-dropthis login request --email <email> # Request OTP (non-interactive)
-dropthis login verify --email <email> --otp <code>  # Verify OTP
-dropthis logout                        # Remove stored credentials
-dropthis whoami                        # Show current auth status
-dropthis account                       # Account details
+dropthis deployments                         # View deployment history
 
-dropthis api-keys create               # Create an API key
-dropthis api-keys list                 # List API keys
-dropthis api-keys delete <key-id>      # Delete an API key
+dropthis login                               # Authenticate with email OTP
+dropthis login request --email <email>       # Request OTP (non-interactive)
+dropthis login verify --email <email> --otp <code>   # Verify OTP
+dropthis logout                              # Remove stored credentials
+dropthis whoami                              # Show current auth status
 
-dropthis deployments list <drop-id>              # List deployments
-dropthis deployments get <drop-id> <dep-id>      # Get deployment details
+dropthis account                             # Show account details
+dropthis account update --display-name <name>  # Update your display name
 
-dropthis doctor                        # CLI diagnostics
-dropthis commands                      # Machine-readable command metadata
+dropthis api-keys create                     # Create an API key
+dropthis api-keys list                       # List API keys
+dropthis api-keys delete <key-id>            # Delete an API key (--yes to confirm)
+
+dropthis doctor                              # CLI diagnostics
+dropthis commands                            # Machine-readable command metadata
 ```
 
 ## Agent & CI/CD usage
@@ -190,7 +221,7 @@ dropthis publish ./dist --url
 
 - Use `--url` to get only the published URL (cleanest for agents)
 - Use `--json` for the full structured response
-- Use `--yes` for destructive commands (`drops delete`, `api-keys delete`)
+- Use `--yes` for destructive commands (`delete`, `api-keys delete`, `account delete`)
 - Use `--no-interactive` to disable inline auth prompts
 - All errors write to stderr as JSON with a `next_action` field
 
@@ -231,6 +262,14 @@ Reports CLI version, auth source (`env`, `flag`, `storage`, or `missing`), and c
 {"ok":true,"version":"0.4.1","auth":{"source":"env"},"storage":{"backend":"secure"}}
 ```
 
+## Pricing tiers
+
+- **Free ($0)** — drops expire after 7 days, 5 MB per drop, dropthis badge.
+- **Personal ($5/mo)** — drops stay live while subscribed (no expiry), no badge, 100 MB per drop, 2 GB account storage.
+- **Pro ($19/mo)** — everything in Personal plus password protection, custom domains, and analytics.
+
+`dropthis account` shows your active tier and its limits. Note: password protection ships with Pro and is not enabled on any tier yet — the API rejects the `--password` option until then.
+
 ## Agent skills
 
 For AI coding agents (Cursor, Claude Code, Windsurf, etc.), install the [dropthis-skills](https://github.com/dropthis-dev/dropthis-skills) package:

package/dist/cli.cjs

@@ -135,10 +135,10 @@ function readlineQuestion(question) {
     input: process.stdin,
     output: process.stderr
   });
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve(answer);
+      resolve2(answer);
     });
   });
 }
@@ -207,7 +207,7 @@ function nextActionForApiError(error2) {
   const uploadNextAction = error2.code ? UPLOAD_NEXT_ACTIONS[error2.code] : void 0;
   if (uploadNextAction) return uploadNextAction;
   if (error2.code === "revision_conflict") {
-    return "Fetch the drop, merge your changes, and retry with the current revision.";
+    return "Re-read the drop with dropthis get <drop-id>, merge your changes, and retry with --if-revision set to the current revision.";
   }
   if (error2.statusCode === 404 || error2.code === "not_found") {
     return "Check the drop id or slug and retry; list your drops with dropthis list.";
@@ -371,6 +371,11 @@ function writeApiError(deps, details) {
     const nextAction = nextActionForApiError(details);
     if (nextAction) deps.stderr(`${hint(nextAction)}
 `);
+    if (details.currentRevision !== void 0)
+      deps.stderr(
+        `${hint(`Current revision: ${details.currentRevision} \u2014 retry with --if-revision ${details.currentRevision}`)}
+`
+      );
     if (details.requestId)
       deps.stderr(`${import_picocolors2.default.dim(`Request ID: ${details.requestId}`)}
 `);
@@ -605,6 +610,13 @@ var COMMAND_ANNOTATIONS = {
     auth: "required",
     examples: ["dropthis update-settings drop_abc --title 'Launch' --json"]
   },
+  pull: {
+    auth: "required",
+    examples: [
+      "dropthis pull drop_abc -o ./site",
+      "dropthis pull https://abc123.dropthis.app"
+    ]
+  },
   get: {
     auth: "required",
     examples: ["dropthis get drop_abc --json"]
@@ -769,13 +781,13 @@ async function runDoctor(_input, deps) {
   const authSource = credential?.source ?? "missing";
   const storageBackend = stored?.storage ?? "none";
   const pairs = [
-    ["Version", "0.9.2"],
+    ["Version", "0.10.0"],
     ["Auth", authSource],
     ["Storage", storageBackend]
   ];
   writeKv(deps, pairs, {
     ok: true,
-    version: "0.9.2",
+    version: "0.10.0",
     auth: { source: authSource },
     storage: { backend: storageBackend }
   });
@@ -1274,6 +1286,110 @@ async function handlePublishDryRun(input, raw, deps, client) {
   }
 }
 
+// src/commands/pull.ts
+var import_promises2 = require("fs/promises");
+var import_node_path = require("path");
+async function runPull(target, input, deps) {
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  let dropId;
+  let defaultDirName;
+  if (target.startsWith("drop_")) {
+    dropId = target;
+    defaultDirName = target;
+  } else {
+    const resolved = await deps.client.drops.resolve(target);
+    if (resolved.error) return writeApiError(deps, resolved.error);
+    if (resolved.data === null) {
+      return writeApiError(deps, {
+        code: "not_found",
+        message: `No drop matching "${target}" found in your account.`,
+        suggestion: "It may belong to another account or have been deleted. Run dropthis list to see your drops, or pass the full drop_\u2026 id."
+      });
+    }
+    dropId = resolved.data.id;
+    defaultDirName = resolved.data.slug || resolved.data.id;
+  }
+  const spin = shouldSpin(deps.outputMode) ? createSpinner("Pulling content\u2026", deps.stderr) : void 0;
+  const manifestResult = await deps.client.drops.getContent(dropId);
+  if (manifestResult.error) {
+    spin?.fail();
+    return writeApiError(deps, manifestResult.error);
+  }
+  const manifest = manifestResult.data;
+  const outDir = (0, import_node_path.resolve)(
+    deps.cwd ?? process.cwd(),
+    input.output ?? defaultDirName
+  );
+  let destinations;
+  try {
+    destinations = manifest.files.map((file) => ({
+      path: file.path,
+      dest: safeDestination(outDir, file.path)
+    }));
+  } catch (error2) {
+    spin?.fail();
+    const message = error2 instanceof Error ? error2.message : "Invalid manifest path.";
+    return writeError(deps, "local_input_error", message);
+  }
+  try {
+    await (0, import_promises2.mkdir)(outDir, { recursive: true });
+    for (const { path, dest } of destinations) {
+      const fileResult = await deps.client.drops.getContent(dropId, { path });
+      if (fileResult.error) {
+        spin?.fail();
+        return writeApiError(deps, {
+          ...fileResult.error,
+          message: `${path}: ${fileResult.error.message}`
+        });
+      }
+      const file = fileResult.data;
+      await (0, import_promises2.mkdir)((0, import_node_path.dirname)(dest), { recursive: true });
+      await (0, import_promises2.writeFile)(dest, file.bytes);
+    }
+  } catch (error2) {
+    spin?.fail();
+    const message = error2 instanceof Error ? error2.message : "Failed to write files.";
+    return writeError(deps, "local_input_error", message);
+  }
+  spin?.stop();
+  const count = manifest.files.length;
+  writeHumanOrJson(
+    deps,
+    success(`Pulled ${count} ${count === 1 ? "file" : "files"} to ${outDir}`),
+    {
+      ok: true,
+      pulled: {
+        dropId: manifest.dropId,
+        deploymentId: manifest.deploymentId,
+        revision: manifest.revision,
+        ...manifest.entry !== void 0 ? { entry: manifest.entry } : {},
+        dir: outDir,
+        files: manifest.files
+      }
+    }
+  );
+  return { exitCode: 0 };
+}
+function safeDestination(outDir, filePath) {
+  if (!filePath || (0, import_node_path.isAbsolute)(filePath)) {
+    throw new Error(`Unsafe file path in content manifest: "${filePath}"`);
+  }
+  const dest = (0, import_node_path.join)(outDir, filePath);
+  const rel = (0, import_node_path.relative)(outDir, dest);
+  if (rel.startsWith("..") || (0, import_node_path.isAbsolute)(rel)) {
+    throw new Error(`Unsafe file path in content manifest: "${filePath}"`);
+  }
+  return dest;
+}
+
 // src/commands/update-content.ts
 var NO_CONTENT_MESSAGE = "update-content requires content. Provide a file, folder, URL, or text to ship a new deployment.";
 var NO_CONTENT_NEXT_ACTION = "Pass an input, e.g. dropthis update-content <dropId> ./dist. To change title, visibility, password, expiry, or metadata, use dropthis update-settings <dropId> instead.";
@@ -1691,9 +1807,9 @@ function createContext(input) {
 }
 
 // src/storage.ts
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_node_os = require("os");
-var import_node_path = require("path");
+var import_node_path2 = require("path");
 var import_keyring = require("@napi-rs/keyring");
 var MemoryCredentialStore = class {
   credential = null;
@@ -1725,7 +1841,7 @@ var InsecureFileCredentialStore = class {
     });
   }
   async clear() {
-    await (0, import_promises2.rm)(this.filePath, { force: true });
+    await (0, import_promises3.rm)(this.filePath, { force: true });
   }
 };
 var KeyringCredentialStore = class {
@@ -1752,7 +1868,7 @@ var KeyringCredentialStore = class {
   }
   async clear() {
     await this.keyring.deletePassword();
-    await (0, import_promises2.rm)(this.filePath, { force: true });
+    await (0, import_promises3.rm)(this.filePath, { force: true });
   }
 };
 function createCredentialStore(options = {}) {
@@ -1770,14 +1886,14 @@ function defaultKeyringAdapter() {
   };
 }
 function credentialPath(configDir) {
-  return (0, import_node_path.join)(
-    configDir ?? (0, import_node_path.join)((0, import_node_os.homedir)(), ".config", "dropthis"),
+  return (0, import_node_path2.join)(
+    configDir ?? (0, import_node_path2.join)((0, import_node_os.homedir)(), ".config", "dropthis"),
     "credentials.json"
   );
 }
 async function readJsonFile(path) {
   try {
-    return JSON.parse(await (0, import_promises2.readFile)(path, "utf8"));
+    return JSON.parse(await (0, import_promises3.readFile)(path, "utf8"));
   } catch (error2) {
     if (error2 && typeof error2 === "object" && "code" in error2 && error2.code === "ENOENT") {
       return null;
@@ -1786,14 +1902,14 @@ async function readJsonFile(path) {
   }
 }
 async function writeCredentialFile(path, credential) {
-  await (0, import_promises2.mkdir)((0, import_node_path.dirname)(path), { recursive: true });
+  await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(path), { recursive: true });
   const tmpPath = `${path}.${process.pid}.tmp`;
-  await (0, import_promises2.writeFile)(tmpPath, `${JSON.stringify(credential, null, 2)}
+  await (0, import_promises3.writeFile)(tmpPath, `${JSON.stringify(credential, null, 2)}
 `, {
     mode: 384
   });
-  await (0, import_promises2.chmod)(tmpPath, 384);
-  await (0, import_promises2.rename)(tmpPath, path);
+  await (0, import_promises3.chmod)(tmpPath, 384);
+  await (0, import_promises3.rename)(tmpPath, path);
 }
 
 // src/program.ts
@@ -1822,7 +1938,7 @@ function buildProgram(options = {}) {
       `  ${import_picocolors4.default.cyan("dropthis login")}`,
       `  ${import_picocolors4.default.cyan("dropthis publish ./dist")}`
     ].join("\n")
-  ).version("0.9.2").configureHelp({
+  ).version("0.10.0").configureHelp({
     subcommandTerm(cmd) {
       const args = cmd.registeredArguments.map((a) => {
         const name = a.name();
@@ -1984,6 +2100,20 @@ function buildProgram(options = {}) {
       process.exitCode = result.exitCode;
     }
   );
+  program.command("pull <target>").description(
+    "Download a drop's files into a local directory (accepts the drop_\u2026 id, the drop URL, or its slug).\nFetches the current deployment's file manifest and writes every file. Pull, edit, then update-content to ship the changes back to the same URL \u2014 also the rollback path."
+  ).option("-o, --output <dir>", "Output directory (default: ./<slug-or-id>)").option("--json", "Force JSON output").action(
+    async (target, commandOptions) => {
+      const deps = await commandDeps(
+        program,
+        options,
+        store,
+        commandOptions
+      );
+      const result = await runPull(target, commandOptions, deps);
+      process.exitCode = result.exitCode;
+    }
+  );
   program.command("get <dropId>").description("Show drop details (pass the full drop_\u2026 id)").option("--json", "Force JSON output").action(async (dropId, commandOptions) => {
     const deps = await commandDeps(program, options, store, commandOptions);
     const result = await runDropsGet(dropId, commandOptions, deps);