@nearform/fling 0.9.0 → 0.10.1

package/dist/cli.js

@@ -1289,6 +1289,31 @@ import { z as z4 } from "zod";
 
 // ../../packages/shared/src/comments.ts
 import { z as z3 } from "zod";
+
+// ../../packages/shared/src/markdown-path.ts
+var MARKDOWN_EXTENSION = /\.(md|markdown)$/i;
+var isMarkdownPath = (path3) => MARKDOWN_EXTENSION.test(path3);
+var HOME_PAGE_NAMES = [/^index\.(md|markdown)$/i, /^readme\.(md|markdown)$/i];
+function markdownHomePages(files) {
+  const folders = /* @__PURE__ */ new Map();
+  for (const path3 of files) {
+    const slash = path3.lastIndexOf("/");
+    const folder = slash === -1 ? "" : path3.slice(0, slash);
+    const names = folders.get(folder) ?? [];
+    names.push(path3.slice(slash + 1));
+    folders.set(folder, names);
+  }
+  const pages = /* @__PURE__ */ new Map();
+  for (const [folder, names] of folders) {
+    if (names.includes("index.html")) continue;
+    const markdown = names.filter(isMarkdownPath).sort();
+    const chosen = HOME_PAGE_NAMES.map((pattern) => markdown.find((name) => pattern.test(name))).find(Boolean) ?? (markdown.length === 1 ? markdown[0] : void 0);
+    if (chosen) pages.set(folder, folder ? `${folder}/${chosen}` : chosen);
+  }
+  return pages;
+}
+
+// ../../packages/shared/src/comments.ts
 var COMMENT_MAX_CHARS = 4e3;
 var COMMENT_PATH_MAX = 1024;
 var FORM_ID_MAX = 40;
@@ -1382,18 +1407,22 @@ function normalizeCommentPath(input) {
   if (path3 === "") return "/";
   if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path3)) {
     try {
-      path3 = new URL(path3).pathname;
+      const url = new URL(path3);
+      path3 = url.pathname + url.search;
     } catch {
       return null;
     }
   }
+  const query = /^[^?#]*\?([^#]*)/.exec(path3)?.[1] ?? "";
   path3 = path3.replace(/[?#].*$/, "");
+  if (isMarkdownPath(path3) && query.split("&").includes("raw=1")) path3 += RAW_QUERY;
   if (!path3.startsWith("/")) path3 = `/${path3}`;
   path3 = path3.replace(/\/{2,}/g, "/").replace(/(^|\/)index\.html$/, "$1");
   if (path3.length > COMMENT_PATH_MAX || /\s/.test(path3)) return null;
   if (path3.split("/").some((s) => s === "." || s === "..")) return null;
   return path3;
 }
+var RAW_QUERY = "?raw=1";
 function commentThreads(comments) {
   const threads = /* @__PURE__ */ new Map();
   for (const c of comments) {
@@ -1729,16 +1758,16 @@ function formAppliesTo(form, path3) {
   if (include.length > 0 && !include.some((g) => globMatches(g, path3))) return false;
   return !exclude.some((g) => globMatches(g, path3));
 }
-function reviewPages(paths) {
+function reviewPages(paths2) {
   const pages = /* @__PURE__ */ new Set();
-  for (const p of paths) {
+  for (const p of paths2) {
     if (!/\.html?$/i.test(p) && !p.endsWith("/")) continue;
-    const page = normalizeCommentPath(p);
-    if (page !== null) pages.add(page);
+    const page2 = normalizeCommentPath(p);
+    if (page2 !== null) pages.add(page2);
   }
   return [...pages].sort();
 }
-function checkFormsConfig(config, paths) {
+function checkFormsConfig(config, paths2) {
   const parsed = FormsConfigSchema.safeParse(config);
   if (!parsed.success) {
     const errors = parsed.error.issues.map(
@@ -1746,7 +1775,7 @@ function checkFormsConfig(config, paths) {
     );
     return { ok: false, errors, summary: null };
   }
-  const pages = paths ? reviewPages(paths) : null;
+  const pages = paths2 ? reviewPages(paths2) : null;
   const warnings = [];
   const forms2 = parsed.data.forms.map((form) => {
     const matched = pages ? pages.filter((p) => formAppliesTo(form, p)) : null;
@@ -1863,7 +1892,7 @@ function responsesPageUrl(appOrigin, name) {
 function progressLines(exported) {
   return exported.progress.map((p) => {
     const form = exported.forms.find((f) => f.id === p.form);
-    const done = p.pages.filter((page) => (p.done[page]?.length ?? 0) > 0).length;
+    const done = p.pages.filter((page2) => (p.done[page2]?.length ?? 0) > 0).length;
     const count2 = exported.responses.filter((r) => r.formId === p.form).length;
     const where = form?.kind === "comment" ? `${count2} response${count2 === 1 ? "" : "s"} on ${Object.keys(p.done).length} of ${p.pages.length} pages` : `${done} / ${p.pages.length} page${p.pages.length === 1 ? "" : "s"} answered`;
     return `${form?.title ?? p.form} (${p.form}): ${where}, ${p.reviewers.length} reviewer${p.reviewers.length === 1 ? "" : "s"}`;
@@ -1875,6 +1904,7 @@ var MAX_DEPLOY_BYTES = 100 * 1024 * 1024;
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
 var MAX_FILES = 5e3;
 var MAX_PATH_LENGTH = 1024;
+var MAX_PATH_FOLDER_LENGTH = 100;
 
 // ../../packages/shared/src/manifest.ts
 import { z as z5 } from "zod";
@@ -2085,12 +2115,17 @@ function normalizePublishPath(raw) {
   const path3 = raw.trim().replace(/^\/+/, "").replace(/\/+$/, "");
   return isValidSitePath(path3) ? path3 : null;
 }
-var PublishPathSchema = z6.string().transform((raw, ctx) => {
+function normalizePathFolder(raw) {
   const path3 = normalizePublishPath(raw);
+  if (path3 === null || path3.includes("/") || path3.length > MAX_PATH_FOLDER_LENGTH) return null;
+  return path3;
+}
+var PublishPathSchema = z6.string().transform((raw, ctx) => {
+  const path3 = normalizePathFolder(raw);
   if (path3 === null) {
     ctx.addIssue({
       code: "custom",
-      message: "path must be a folder of the site, like 30-10-26 or reports/2026 (no dotfiles)"
+      message: `path must be one top-level folder of the site, like PAY-412 (at most ${MAX_PATH_FOLDER_LENGTH} characters, no dotfiles): publish nested folders as part of it`
     });
     return z6.NEVER;
   }
@@ -2192,9 +2227,8 @@ var VersionSchema = z9.object({
   /** who published it (email); absent on versions published before it was recorded */
   publishedBy: z9.string().optional(),
   /**
-   * A path publish (`pathPublish` capability): the folder it replaced (`30-10-26`, shown as
-   * `/30-10-26/`), and the version it carried the rest of the site forward from (absent when the
-   * site had none)
+   * A Path's version: the Path's folder (`PAY-412`, shown as `/PAY-412/`). A publish on a base:
+   * the version it built on, carrying its other files forward
    */
   path: z9.string().optional(),
   base: z9.string().optional(),
@@ -2205,6 +2239,29 @@ var SiteDetailSchema = SiteWithAudienceSchema.extend({
   versions: z9.array(VersionSchema)
 });
 var SiteListSchema = z9.object({ sites: z9.array(SiteSchema) });
+var SitePathSchema = z9.object({
+  folder: z9.string(),
+  /** the `<title>` of its index.html, '' without one */
+  title: z9.string(),
+  url: z9.string(),
+  currentVersionId: z9.string().nullable(),
+  archived: z9.boolean(),
+  owners: SiteRoleMembersSchema.optional(),
+  publishers: SiteRoleMembersSchema.optional(),
+  createdBy: z9.string().optional(),
+  canPublish: z9.boolean(),
+  /** the caller may change its owners and publishers, archive and delete it */
+  canManage: z9.boolean().optional(),
+  createdAt: z9.string(),
+  updatedAt: z9.string()
+});
+var PathListSchema = z9.object({ paths: z9.array(SitePathSchema) });
+var PathDetailSchema = SitePathSchema.extend({ versions: z9.array(VersionSchema) });
+var UpdatePathRequestSchema = z9.object({
+  owners: OwnersInputSchema.optional(),
+  publishers: PublishersInputSchema.optional(),
+  archived: z9.boolean().optional()
+});
 var SharedSiteSchema = z9.object({
   name: z9.string(),
   url: z9.string(),
@@ -2270,7 +2327,6 @@ var DeployRequestSchema = z9.object({
   }
   if (req.partial && req.base === void 0) issue("`partial` needs `base`");
   if (req.remove !== void 0 && !req.partial) issue("`remove` needs `partial: true`");
-  if (req.base !== void 0 && req.path !== void 0) issue("Pass `base` or `path`, not both");
 });
 var UploadSchema = z9.object({
   path: z9.string(),
@@ -2278,11 +2334,26 @@ var UploadSchema = z9.object({
   /** headers the client must send with the PUT (they are part of the signature) */
   headers: z9.record(z9.string(), z9.string())
 });
+var PublishHintSchema = z9.object({
+  code: z9.enum(["paths_index_missing", "paths_block_hidden"]),
+  message: z9.string(),
+  folders: z9.array(z9.string()).optional()
+});
 var DeployResponseSchema = z9.discriminatedUnion("status", [
   /** content identical to the current version — nothing happened */
-  z9.object({ status: z9.literal("unchanged"), versionId: z9.string(), site: SiteSchema }),
+  z9.object({
+    status: z9.literal("unchanged"),
+    versionId: z9.string(),
+    site: SiteSchema,
+    hints: z9.array(PublishHintSchema).optional()
+  }),
   /** this content was deployed before — site now points at that version again */
-  z9.object({ status: z9.literal("repointed"), versionId: z9.string(), site: SiteSchema }),
+  z9.object({
+    status: z9.literal("repointed"),
+    versionId: z9.string(),
+    site: SiteSchema,
+    hints: z9.array(PublishHintSchema).optional()
+  }),
   /** new content — PUT every upload, then POST /api/sites/:name/deploys/:versionId/finalize */
   z9.object({
     status: z9.literal("upload"),
@@ -2295,7 +2366,8 @@ var FinalizeResponseSchema = z9.object({
   versionId: z9.string(),
   site: SiteSchema,
   /** this deploy made the site live for the first time (a new site, its access just set) */
-  first: z9.boolean().optional()
+  first: z9.boolean().optional(),
+  hints: z9.array(PublishHintSchema).optional()
 });
 var RollbackRequestSchema = z9.object({ versionId: z9.string() });
 var UpdateSiteRequestSchema = z9.object({
@@ -2840,7 +2912,22 @@ var KvsSiteValueSchema = z12.object({
   /** serve /index.html for unknown extensionless paths */
   spa: z12.boolean(),
   /** present when the site is restricted (private with an audience): the edge wants a site pass */
-  r: z12.literal(1).optional()
+  r: z12.literal(1).optional(),
+  /** present when the site has live Paths: a request's first folder may be one (`path:` keys) */
+  p: z12.literal(1).optional(),
+  /**
+   * the rendered home page and Paths listing (`sites/<id>/_rendered/<i>.html|json`), served for
+   * `/`, `/index.html` and PATHS_JSON_PATH instead of the version's own index.html
+   */
+  i: z12.string().optional(),
+  /** present when the current version's Markdown files have rendered pages (markdown.ts) */
+  m: z12.literal(1).optional()
+});
+var KvsPathValueSchema = z12.object({
+  id: z12.string(),
+  v: z12.string(),
+  /** as on a site's value: its current version's Markdown has rendered pages */
+  m: z12.literal(1).optional()
 });
 
 // ../../packages/shared/src/listing.ts
@@ -2861,10 +2948,10 @@ function extractHtmlTitle(html) {
 function renderHtmlListing(siteName2, entries) {
   const pages = entries.filter((e) => isHtmlPath(e.path) && e.path.toLowerCase() !== "index.html").sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const groups2 = /* @__PURE__ */ new Map();
-  for (const page of pages) {
-    const slash = page.path.lastIndexOf("/");
-    const folder = slash === -1 ? "" : page.path.slice(0, slash);
-    groups2.set(folder, [...groups2.get(folder) ?? [], page]);
+  for (const page2 of pages) {
+    const slash = page2.path.lastIndexOf("/");
+    const folder = slash === -1 ? "" : page2.path.slice(0, slash);
+    groups2.set(folder, [...groups2.get(folder) ?? [], page2]);
   }
   const sections = [...groups2.entries()].sort(([a], [b]) => a === "" ? -1 : b === "" ? 1 : a < b ? -1 : 1).map(([folder, items]) => {
     const heading = folder ? `<h2>${escapeHtml(folder)}/</h2>` : "";
@@ -3125,6 +3212,385 @@ function describeNotificationSettings(settings) {
   return lines.join("\n");
 }
 
+// ../../packages/shared/src/paths-index.ts
+var PATHS_SORTS = ["updated", "oldest", "folder", "folder-desc"];
+var PATHS_OPTIONS = ["nocontrols", "nostyle", ...PATHS_SORTS.map((s) => `sort=${s}`)];
+var PATHS_PLACEHOLDERS = ["href", "folder", "title", "updated", "date", "version"];
+function matchesQuery(row2, query) {
+  const marks = /[̀-ͯ]/g;
+  const hay = `${row2.folder} ${row2.title}`.normalize("NFD").replace(marks, "").toLowerCase();
+  const terms = String(query).normalize("NFD").replace(marks, "").toLowerCase().split(/\s+/);
+  for (let i = 0; i < terms.length; i++) {
+    if (terms[i] && hay.indexOf(terms[i]) < 0) return false;
+  }
+  return true;
+}
+function compareRows(a, b, sort) {
+  const x = String(a.folder);
+  const y = String(b.folder);
+  const xs = x.match(/\d+|\D+/g) || [];
+  const ys = y.match(/\d+|\D+/g) || [];
+  let byFolder = 0;
+  for (let i = 0; i < xs.length && i < ys.length && byFolder === 0; i++) {
+    const p = xs[i];
+    const q = ys[i];
+    if (/^\d/.test(p) && /^\d/.test(q)) {
+      const pn = p.replace(/^0+/, "");
+      const qn = q.replace(/^0+/, "");
+      byFolder = pn.length - qn.length || (pn < qn ? -1 : pn > qn ? 1 : 0);
+    } else {
+      const pl = p.toLowerCase();
+      const ql = q.toLowerCase();
+      byFolder = pl < ql ? -1 : pl > ql ? 1 : 0;
+    }
+  }
+  if (byFolder === 0) byFolder = xs.length - ys.length;
+  if (byFolder === 0) byFolder = x < y ? -1 : x > y ? 1 : 0;
+  const byTime = (Date.parse(a.updated) || 0) - (Date.parse(b.updated) || 0);
+  if (sort === "folder") return byFolder;
+  if (sort === "folder-desc") return -byFolder;
+  if (sort === "oldest") return byTime || byFolder;
+  return -byTime || byFolder;
+}
+var OPENER = /<!--\s*fling:paths(?=\s|-->)([\s\S]*?)-->/g;
+var CLOSER = /<!--\s*\/fling:paths\s*-->/g;
+var EMPTY = /<!--\s*fling:empty\s*-->/;
+var CONTROLS = /<!--\s*fling:paths-controls\s*-->/;
+var PLACEHOLDER = /\{\{\s*([A-Za-z_]\w*)\s*\}\}/g;
+function findBlock(html) {
+  OPENER.lastIndex = 0;
+  const open = OPENER.exec(html);
+  if (!open) return null;
+  const afterOpen = open.index + open[0].length;
+  const options = open[1].trim().split(/\s+/).filter(Boolean);
+  OPENER.lastIndex = afterOpen;
+  const next = OPENER.exec(html);
+  CLOSER.lastIndex = afterOpen;
+  const close = CLOSER.exec(html);
+  const paired = close !== null && (next === null || close.index < next.index);
+  OPENER.lastIndex = paired && close ? close.index + close[0].length : afterOpen;
+  const more = OPENER.exec(html) !== null;
+  OPENER.lastIndex = 0;
+  if (!paired || !close) {
+    return { kind: "bare", start: open.index, end: afterOpen, options, item: "", empty: null, more };
+  }
+  const inner = html.slice(afterOpen, close.index);
+  const e = EMPTY.exec(inner);
+  return {
+    kind: "template",
+    start: open.index,
+    end: close.index + close[0].length,
+    options,
+    item: e ? inner.slice(0, e.index) : inner,
+    empty: e ? inner.slice(e.index + e[0].length) : null,
+    more
+  };
+}
+function relativeTime(iso, now) {
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return "";
+  const minutes = Math.floor((now - t) / 6e4);
+  if (minutes < 1) return "just now";
+  if (minutes < 60) return minutes === 1 ? "1 minute ago" : `${minutes} minutes ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return hours === 1 ? "1 hour ago" : `${hours} hours ago`;
+  const days = Math.floor(hours / 24);
+  if (days < 7) return days === 1 ? "yesterday" : `${days} days ago`;
+  return "";
+}
+var LOOK = [
+  ".fling-paths-controls{display:flex;flex-wrap:wrap;align-items:stretch;gap:var(--fling-paths-gap,.75rem);margin:0 0 var(--fling-paths-gap,.75rem);font:inherit;color:inherit}",
+  ".fling-paths-controls label{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%);white-space:nowrap}",
+  ".fling-paths-controls input,.fling-paths-controls select{font:inherit;line-height:1.25;color:inherit;background-color:transparent;color-scheme:inherit;accent-color:var(--fling-paths-accent,LinkText);border:1px solid color-mix(in srgb,currentColor 25%,transparent);border-radius:var(--fling-paths-radius,.5rem);padding:.45rem .65rem;margin:0}",
+  // The platform's own select keeps its height and arrow whatever the padding: draw both, the
+  // arrow in the text's colour so it follows the page.
+  ".fling-paths-controls select{appearance:none;cursor:pointer;padding-inline-end:2rem;background-image:linear-gradient(45deg,transparent 50%,currentColor 50%),linear-gradient(135deg,currentColor 50%,transparent 50%);background-size:.3rem .3rem;background-position:right 1rem center,right .7rem center;background-repeat:no-repeat}",
+  ".fling-paths-controls select option{color:CanvasText;background:Canvas}",
+  ".fling-paths-controls input{flex:1 1 14rem;min-inline-size:0}",
+  ".fling-paths-controls :focus-visible{outline:2px solid var(--fling-paths-accent,LinkText);outline-offset:1px}",
+  ".fling-paths-count{align-self:center;opacity:.7;font-size:.9em;font-variant-numeric:tabular-nums}",
+  ".fling-paths{list-style:none;margin:0;padding:0;display:grid;gap:calc(var(--fling-paths-gap,.75rem)/2)}",
+  ".fling-paths li{display:flex;flex-wrap:wrap;align-items:baseline;justify-content:space-between;gap:.25rem var(--fling-paths-gap,.75rem);padding:.6rem .8rem;border:1px solid color-mix(in srgb,currentColor 15%,transparent);border-radius:var(--fling-paths-radius,.5rem)}",
+  ".fling-paths a{color:var(--fling-paths-accent,LinkText);text-decoration:none;font-weight:600}",
+  ".fling-paths a:hover{text-decoration:underline}",
+  ".fling-paths-folder{font-weight:400;opacity:.7;font-family:ui-monospace,monospace;font-size:.85em;margin-inline-start:.5rem}",
+  ".fling-paths time{opacity:.7;font-size:.9em;font-variant-numeric:tabular-nums}"
+].join("\n");
+var PATHS_SCRIPT = `(function () {
+  var matchesQuery = (${matchesQuery.toString()});
+  var compareRows = (${compareRows.toString()});
+  var relativeTime = (${relativeTime.toString()});
+  // Dates within the last week read as how long ago they were; the rendered date stays as the
+  // tooltip, and as the text from a week on.
+  function ages() {
+    var now = Date.now();
+    document.querySelectorAll('[data-fling-path] time[datetime]').forEach(function (el) {
+      if (!el.hasAttribute('data-fling-date')) el.setAttribute('data-fling-date', el.textContent);
+      var fixed = el.getAttribute('data-fling-date');
+      var ago = relativeTime(el.getAttribute('datetime'), now);
+      el.textContent = ago || fixed;
+      if (ago && fixed) el.title = fixed; else el.removeAttribute('title');
+    });
+  }
+  function start() {
+    if (window.__flingPaths) return;
+    var box = document.querySelector('[data-fling-paths-controls]');
+    if (!box) return;
+    window.__flingPaths = true;
+    ages();
+    setInterval(ages, 60000);
+    var input = box.querySelector('input');
+    var select = box.querySelector('select');
+    var count = box.querySelector('[data-fling-paths-count]');
+    var fallback = box.getAttribute('data-sort') || 'updated';
+    var els = Array.prototype.slice.call(document.querySelectorAll('[data-fling-path]'));
+    var rows = els.map(function (el) {
+      return { el: el, folder: el.getAttribute('data-folder') || '', title: el.getAttribute('data-title') || '', updated: el.getAttribute('data-updated') || '' };
+    });
+    function rowOf(el) { return rows[els.indexOf(el)]; }
+    function known(sort) {
+      for (var i = 0; i < select.options.length; i++) if (select.options[i].value === sort) return true;
+      return false;
+    }
+    function apply(write) {
+      var q = input.value;
+      var sort = select.value;
+      var shown = 0;
+      rows.forEach(function (r) {
+        var ok = matchesQuery(r, q);
+        r.el.hidden = !ok;
+        if (ok) shown++;
+      });
+      var parents = [];
+      rows.forEach(function (r) { if (r.el.parentNode && parents.indexOf(r.el.parentNode) < 0) parents.push(r.el.parentNode); });
+      parents.forEach(function (p) {
+        var group = Array.prototype.filter.call(p.children, function (el) { return els.indexOf(el) >= 0; });
+        if (group.length < 2) return;
+        var anchor = group[group.length - 1].nextSibling;
+        group.slice().sort(function (a, b) { return compareRows(rowOf(a), rowOf(b), sort); })
+          .forEach(function (el) { p.insertBefore(el, anchor); });
+      });
+      if (count) count.textContent = shown + ' of ' + rows.length;
+      if (!write) return;
+      try {
+        var url = new URL(location.href);
+        if (q) url.searchParams.set('q', q); else url.searchParams.delete('q');
+        if (sort !== fallback) url.searchParams.set('sort', sort); else url.searchParams.delete('sort');
+        history.replaceState(history.state, '', url.toString());
+      } catch (e) {}
+    }
+    var params = new URLSearchParams(location.search);
+    input.value = params.get('q') || '';
+    var wanted = params.get('sort');
+    if (wanted && known(wanted)) select.value = wanted;
+    input.addEventListener('input', function () { apply(true); });
+    select.addEventListener('change', function () { apply(true); });
+    input.addEventListener('keydown', function (e) {
+      if (e.key === 'Escape' && input.value) { e.preventDefault(); input.value = ''; apply(true); }
+    });
+    document.addEventListener('keydown', function (e) {
+      if (e.key !== '/' || e.ctrlKey || e.metaKey || e.altKey) return;
+      var t = e.target;
+      if (t && (t.isContentEditable || /^(INPUT|TEXTAREA|SELECT)$/.test(t.tagName))) return;
+      e.preventDefault();
+      input.focus();
+    });
+    apply(false);
+  }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', start);
+  else start();
+})();`;
+function checkPathsIndex(html) {
+  const page2 = typeof html === "string" ? html : "";
+  const warnings = [];
+  const errors = [];
+  const block = findBlock(page2);
+  if (!block) {
+    errors.push("No Paths block: add <!-- fling:paths --> where the listing should go.");
+    return { ok: false, block: null, options: [], warnings, errors };
+  }
+  for (const o of block.options) {
+    if (!PATHS_OPTIONS.includes(o)) {
+      warnings.push(`Unknown option "${o}"; the options are ${PATHS_OPTIONS.join(", ")}.`);
+    }
+  }
+  if (block.more) warnings.push("More than one Paths block: only the first is filled.");
+  CLOSER.lastIndex = 0;
+  const firstClose = CLOSER.exec(page2);
+  CLOSER.lastIndex = 0;
+  if (firstClose && firstClose.index < block.start) {
+    warnings.push("A <!-- /fling:paths --> comes before the opening marker and is ignored.");
+  }
+  if (block.kind === "bare") {
+    if (EMPTY.test(page2.slice(block.end)) || firstClose && firstClose.index > block.start) {
+      warnings.push(
+        "The template is not closed: add <!-- /fling:paths --> after it (before any other block). Until then the marker is bare and Fling uses its default list."
+      );
+    }
+  } else {
+    if (!/<[A-Za-z]/.test(block.item) && !/\{\{/.test(block.item)) {
+      warnings.push("The template item is empty, so each Path renders as nothing.");
+    }
+    const unknown = /* @__PURE__ */ new Set();
+    for (const m of block.item.matchAll(PLACEHOLDER)) {
+      if (!PATHS_PLACEHOLDERS.includes(m[1])) unknown.add(m[1]);
+    }
+    for (const name of unknown) {
+      warnings.push(
+        `Unknown placeholder {{${name}}} is left as it is; the placeholders are ${PATHS_PLACEHOLDERS.map((p) => `{{${p}}}`).join(" ")}.`
+      );
+    }
+    if (!/href\s*=\s*["']?\{\{\s*href\s*\}\}/.test(block.item)) {
+      warnings.push('The template item has no link to its Path: add <a href="{{href}}">.');
+    }
+  }
+  const panels = page2.match(new RegExp(CONTROLS.source, "g"))?.length ?? 0;
+  if (panels > 0 && block.options.includes("nocontrols")) {
+    warnings.push("<!-- fling:paths-controls --> is removed because the block says nocontrols.");
+  }
+  if (panels > 1)
+    warnings.push("More than one <!-- fling:paths-controls -->: only the first is used.");
+  return { ok: errors.length === 0, block: block.kind, options: block.options, warnings, errors };
+}
+
+// ../../packages/shared/src/paths-templates.ts
+var PATHS_TEMPLATE_NAMES = ["plans", "docs", "reports", "minimal"];
+var PATHS_TEMPLATE_DESCRIPTIONS = {
+  plans: "a board of plans, one card per ticket folder (e.g. PAY-412), newest first",
+  docs: "a hub of documentation sections, A\u2013Z",
+  reports: "an archive of reports by date, newest first, the date shown first",
+  minimal: "a plain page with Fling's default list"
+};
+var DEFAULT_TITLES = {
+  plans: "Plans",
+  docs: "Docs",
+  reports: "Reports",
+  minimal: "Paths"
+};
+var ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+var esc = (value) => value.replace(/[&<>"']/g, (c) => ESCAPES[c] ?? c);
+var BASE_CSS = `:root{color-scheme:light dark;--bg:#f7f7f8;--fg:#1c1c21;--muted:#5d5d68;--card:#fff;--line:#e2e2e7;--fling-paths-accent:#2f5fc4}
+@media (prefers-color-scheme:dark){:root{--bg:#141417;--fg:#ececf0;--muted:#a0a0ab;--card:#1d1d22;--line:#2e2e35;--fling-paths-accent:#8ab0ff}}
+*{box-sizing:border-box}
+body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.55 system-ui,-apple-system,"Segoe UI",sans-serif}
+main{max-width:var(--width,56rem);margin:0 auto;padding:clamp(1.5rem,5vw,3.5rem) 1.25rem}
+header{margin-bottom:1.75rem}
+h1{font-size:clamp(1.6rem,4vw,2.2rem);letter-spacing:-.015em;margin:0 0 .35rem}
+header p{margin:0;color:var(--muted)}
+a{color:var(--fling-paths-accent)}
+.empty{color:var(--muted);padding:2rem;text-align:center;border:1px dashed var(--line);border-radius:.75rem}`;
+function page(title, intro2, css, body) {
+  const t = esc(title);
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<title>${t}</title>
+<style>
+${BASE_CSS}
+${css}
+</style>
+</head>
+<body>
+<main>
+<header>
+<h1>${t}</h1>
+<p>${intro2}</p>
+</header>
+<!-- fling:paths-controls -->
+${body}
+</main>
+</body>
+</html>
+`;
+}
+var TEMPLATES2 = {
+  plans: (title) => page(
+    title,
+    "One plan per ticket, newest first.",
+    `.board{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(100%,16rem),1fr));gap:1rem}
+.card{background:var(--card);border:1px solid var(--line);border-radius:.75rem;transition:border-color .15s}
+.card:hover{border-color:var(--fling-paths-accent)}
+.card a{display:flex;flex-direction:column;gap:.4rem;height:100%;padding:1rem 1.1rem;color:inherit;text-decoration:none}
+.ticket{align-self:start;font:600 .8rem/1 ui-monospace,monospace;color:var(--fling-paths-accent);background:color-mix(in srgb,var(--fling-paths-accent) 12%,transparent);padding:.3rem .5rem;border-radius:.4rem}
+.card h2{font-size:1.05rem;line-height:1.35;margin:0}
+.card time{margin-top:auto;font-size:.85rem;color:var(--muted)}`,
+    `<div class="board">
+<!-- fling:paths sort=updated -->
+<article class="card"><a href="{{href}}"><span class="ticket">{{folder}}</span><h2>{{title}}</h2><time datetime="{{updated}}">{{date}}</time></a></article>
+<!-- fling:empty -->
+<p class="empty">No plans yet. Publish each plan to a folder named after its ticket, such as PAY-412.</p>
+<!-- /fling:paths -->
+</div>`
+  ),
+  docs: (title) => page(
+    title,
+    "Every section, A\u2013Z.",
+    `.sections{list-style:none;margin:0;padding:0;border-top:1px solid var(--line)}
+.sections li{border-bottom:1px solid var(--line)}
+.sections a{display:flex;flex-wrap:wrap;align-items:baseline;gap:.25rem 1rem;padding:.9rem .25rem;color:inherit;text-decoration:none}
+.sections a:hover .name{color:var(--fling-paths-accent);text-decoration:underline}
+.name{font-weight:600;flex:1 1 16rem}
+.meta{font-size:.85rem;color:var(--muted)}
+.meta code{font-family:ui-monospace,monospace}`,
+    `<ul class="sections">
+<!-- fling:paths sort=folder -->
+<li><a href="{{href}}"><span class="name">{{title}}</span><span class="meta"><code>{{folder}}</code> \xB7 updated <time datetime="{{updated}}">{{date}}</time></span></a></li>
+<!-- fling:empty -->
+<li class="empty">No sections yet. Publish each section to its own folder.</li>
+<!-- /fling:paths -->
+</ul>`
+  ),
+  reports: (title) => page(
+    title,
+    "Every report, newest first.",
+    `.archive{list-style:none;margin:0;padding:0;display:grid;gap:.75rem}
+.report{display:grid;grid-template-columns:8.5rem 1fr;align-items:baseline;gap:.25rem 1.25rem;background:var(--card);border:1px solid var(--line);border-radius:.75rem;padding:1rem 1.1rem}
+@media (width < 34rem){.report{grid-template-columns:1fr}}
+.report time{font-size:1.15rem;font-weight:700;font-variant-numeric:tabular-nums}
+.report a{font-weight:600;text-decoration:none}
+.report a:hover{text-decoration:underline}
+.report small{grid-column:-2;color:var(--muted);font-family:ui-monospace,monospace}`,
+    `<ol class="archive">
+<!-- fling:paths sort=updated -->
+<li class="report"><time datetime="{{updated}}">{{date}}</time><a href="{{href}}">{{title}}</a><small>{{folder}}</small></li>
+<!-- fling:empty -->
+<li class="empty">No reports yet. Publish each report to its own folder, such as 2026-11-05.</li>
+<!-- /fling:paths -->
+</ol>`
+  ),
+  minimal: (title) => `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<title>${esc(title)}</title>
+<style>
+body{max-width:44rem;margin:0 auto;padding:3rem 1.25rem;font:16px/1.5 system-ui,sans-serif}
+</style>
+</head>
+<body>
+<h1>${esc(title)}</h1>
+<!-- fling:paths -->
+</body>
+</html>
+`
+};
+function pathsTemplate(name, opts = {}) {
+  const title = opts.title?.trim() || DEFAULT_TITLES[name];
+  return TEMPLATES2[name](title);
+}
+var isPathsTemplateName = (name) => PATHS_TEMPLATE_NAMES.includes(name);
+
 // ../../packages/shared/src/read-files.ts
 var MCP_READ_MAX_BYTES = 1.5 * 1024 * 1024;
 function pageOfFiles(files, opts) {
@@ -3133,7 +3599,7 @@ function pageOfFiles(files, opts) {
   const found = new Set(selected.map((f) => f.path));
   const missing = opts.paths ? opts.paths.filter((p) => !found.has(p)) : [];
   const start = Math.max(0, Number.parseInt(opts.cursor ?? "0", 10) || 0);
-  const page = [];
+  const page2 = [];
   const tooLarge = [];
   let used = 0;
   for (let i = start; i < selected.length; i++) {
@@ -3142,11 +3608,11 @@ function pageOfFiles(files, opts) {
       tooLarge.push(file);
       continue;
     }
-    if (used + file.size > opts.budget) return { page, tooLarge, missing, nextCursor: String(i) };
-    page.push(file);
+    if (used + file.size > opts.budget) return { page: page2, tooLarge, missing, nextCursor: String(i) };
+    page2.push(file);
     used += file.size;
   }
-  return { page, tooLarge, missing };
+  return { page: page2, tooLarge, missing };
 }
 function encodeForAgent(path3, bytes) {
   if (isScannablePath(path3) && !looksBinary(bytes)) {
@@ -3164,8 +3630,9 @@ function encodeForAgent(path3, bytes) {
 function describeReadFiles(name, result) {
   const read = result.files.filter((f) => !f.tooLarge);
   const big = result.files.filter((f) => f.tooLarge);
+  const of = result.path === void 0 ? name : `the Path /${result.path}/ of ${name}`;
   const lines = [
-    `${read.length} file(s) of ${name}, version ${result.versionId}: ${read.map((f) => f.path).join(", ") || "(none)"}.`
+    `${read.length} file(s) of ${of}, version ${result.versionId}${result.path === void 0 ? "" : " (paths within the Path)"}: ${read.map((f) => f.path).join(", ") || "(none)"}.`
   ];
   if (big.length) {
     lines.push(
@@ -3179,7 +3646,7 @@ function describeReadFiles(name, result) {
     );
   }
   lines.push(
-    `To change the site, call fling_publish with base "${result.versionId}" and only the files you changed or added (and \`remove\` for files to delete): every other file is kept.`
+    result.path === void 0 ? `To change the site, call fling_publish with base "${result.versionId}" and only the files you changed or added (and \`remove\` for files to delete): every other file is kept.` : `To change the Path, call fling_publish with path "${result.path}", base "${result.versionId}" and only the files you changed or added (and \`remove\` for files to delete), named within the Path: every other file of it is kept.`
   );
   return lines.join("\n");
 }
@@ -3232,14 +3699,20 @@ var listHtml = z14.boolean().optional().describe(
   "Only matters when there is no root index.html: true \u2192 generate an index.html linking every HTML page; false \u2192 publish without one (root 404s). Omit until the user has decided"
 );
 var siteName = z14.string().min(1).max(200).describe('Site name, e.g. "q3-report"');
-var PATH_PUBLISH_NOTE = 'With `path` (e.g. "30-10-26"), only that folder of the site is replaced: the files go to <site>/30-10-26/\u2026 (give their paths relative to the folder, its page being "index.html") and every other file of the site stays as it is. Use it to add one report, release note or week\'s page to a shared site without republishing the rest; rolling back removes it again.';
+function describePublishHints(hints) {
+  if (!hints?.length) return "";
+  return `
+Worth doing:
+- ${hints.map((h) => h.message).join("\n- ")}`;
+}
+var PATH_PUBLISH_NOTE = `With \`path\` (one top-level folder, e.g. "PAY-412"), the files are published as that folder's Path: they go to <site>/PAY-412/\u2026 (give their paths relative to the folder, its page being "index.html"), and the rest of the site is untouched. A Path has its own versions, rollback, owners and publishers, and is made on first use (you own it). Use it for one plan, spec, report or week's page on a shared team site; teammates publishing other Paths never collide. fling_paths lists a site's Paths. The site's home page lists them by default when it has no index.html, or as a custom page with a Paths block (fling_paths_template); an index.html without a block lists none: settle which with the user (see fling_paths).`;
 var PULL_NOTE = "To change a site that is already published (fix a typo, update a page, add one), start from what is live, not from scratch: read its files with fling_read_files, then call fling_publish with `base` (the `versionId` it returned) and only the files you changed or added, plus `remove` for files to delete; every other file stays as it is. If someone published the site in between, it fails with base_changed: read the files again and redo the changes, rather than publishing without `base` over theirs.";
 var base = z14.string().min(1).max(100).optional().describe(
   "The versionId fling_read_files returned: publish only what changed on top of it. `files` then holds only the files you changed or added, and every other file of the site is kept. Fails with base_changed if the site has changed since. Not with `path`"
 );
 var remove = z14.array(z14.string().min(1).max(1024)).max(MAX_FILES).optional().describe("With `base`: the paths of the files to delete from the site");
 var publishPath = z14.string().min(1).max(1024).optional().describe(
-  'Publish into this folder of the site only, e.g. "30-10-26" or "reports/2026" (served at <site>/30-10-26/), keeping every other file. File paths are relative to it. Omit to replace the whole site'
+  'Publish as the Path at this top-level folder of the site, e.g. "PAY-412" (served at <site>/PAY-412/); the rest of the site is untouched. File paths are relative to it. Omit to publish the site itself'
 );
 var sitePath = z14.string().min(1).max(1024).describe(
   'Site-relative path with forward slashes, e.g. "index.html", "css/app.css", "img/logo.png". The root page must be "index.html". No dotfiles (".env", ".well-known/\u2026")'
@@ -3285,6 +3758,53 @@ function describeResponses(exported, opts = {}) {
     ...opts.responsesPage ? [`Progress and downloads (CSV, JSONL): ${opts.responsesPage}`] : []
   ].join("\n");
 }
+var PATHS_TEMPLATES_LIST = PATHS_TEMPLATE_NAMES.map(
+  (n) => `\`${n}\` (${PATHS_TEMPLATE_DESCRIPTIONS[n]})`
+).join(", ");
+var PATHS_BLOCK_FORMAT = `A Paths block is either the bare marker \`<!-- fling:paths -->\` (Fling's default list, styled by the page) or a template pair \`<!-- fling:paths sort=updated --> item <!-- fling:empty --> shown when there are none <!-- /fling:paths -->\`, whose item repeats once per Path with the placeholders ${PATHS_PLACEHOLDERS.map((p) => `{{${p}}}`).join(" ")} (HTML-escaped; the \`<!-- fling:empty -->\` part is optional). Put dates in \`<time datetime="{{updated}}">{{date}}</time>\`: within a week they read as how long ago ("2 hours ago") once the page loads. Options go in the opening marker: ${PATHS_OPTIONS.join(", ")}. \`<!-- fling:paths-controls -->\` places the search and sort controls. Only the first block is filled.`;
+var PATHS_HOME_CHOICE = `A site with Paths has a home page (its root index.html) that can list them. Make the choice explicit with the user: (a) the default: with no root index.html, Fling serves a listing of the live Paths, and a site whose first publish is a Path gets one (the \`minimal\` template); nothing to do. (b) a custom page: the site's own index.html with a Paths block, which Fling fills with the live Paths whenever one changes. Start from fling_paths_template (${PATHS_TEMPLATE_NAMES.join(", ")}), adapt it freely while keeping the block, check it with fling_paths_check, then publish it as the site root (without \`path\`). (c) an index.html without a Paths block is served as it is and lists no Paths; publishing then says so (the paths_index_missing hint).`;
+function describePathsHome(home) {
+  if (home === "block") {
+    return "Home page: the site's index.html has a Paths block, which lists the live Paths. To change how it looks, edit that page keeping the block (fling_read_files), check it with fling_paths_check and publish it as the site root (without `path`).";
+  }
+  if (home === "default") {
+    return "Home page: Fling's default listing of the live Paths (the site has no index.html of its own). For a custom page, start from fling_paths_template, check it with fling_paths_check and publish it as the site's index.html (without `path`).";
+  }
+  if (home === "own") {
+    return 'Home page: the site\'s own index.html, which has no Paths block, so it lists none of them. Offer the user a custom page with a block (fling_paths_template) or the default listing (remove index.html: fling_publish with `base` and `remove: ["index.html"]`).';
+  }
+  return 'Home page: if the site\'s home page has no Paths block, offer a custom one (fling_paths_template) or the default (remove index.html: fling_publish with `base` and `remove: ["index.html"]`).';
+}
+function describePathLine(p) {
+  const state = p.archived ? "archived" : p.currentVersionId ? `version ${p.currentVersionId}` : "nothing published";
+  return `- /${p.folder}/${p.title ? ` "${p.title}"` : ""}: ${p.url} (${state}, updated ${p.updatedAt}${p.canPublish ? ", you can publish it" : ""})`;
+}
+function describePaths(name, paths2, opts = {}) {
+  const head = paths2.length ? `${paths2.length} Path${paths2.length === 1 ? "" : "s"} on ${name}:` : `${name} has no Paths yet. Publish a folder as one with \`path\` (e.g. "PAY-412").`;
+  return [head, ...paths2.map(describePathLine), describePathsHome(opts.home)].join("\n");
+}
+function describePathDetail(name, path3) {
+  const roles = path3.owners ? [`Owners: ${whoHolds(path3.owners)}. Publishers: ${whoHolds(path3.publishers)}.`] : [];
+  const versions = path3.versions.slice(0, 10).map(
+    (v) => `- ${v.id}${v.id === path3.currentVersionId ? " (current)" : ""}: ${v.fileCount} files, ${v.createdAt}${v.publishedBy ? `, by ${v.publishedBy}` : ""}`
+  );
+  return [
+    `/${path3.folder}/ of ${name}${path3.title ? ` "${path3.title}"` : ""}: ${path3.url}${path3.archived ? " (archived)" : ""}${path3.canPublish ? " \u2014 you can publish it" : ""}`,
+    ...roles,
+    "Versions (newest first; roll back with fling_rollback and this `path`):",
+    ...versions.length ? versions : ["(none)"]
+  ].join("\n");
+}
+function describePathsCheck(check2) {
+  const head = check2.ok ? `The page has a ${check2.block === "template" ? "template" : "bare"} Paths block${check2.options.length ? ` (options: ${check2.options.join(", ")})` : ""}: Fling fills it with the live Paths.` : "The page has no Paths block Fling can fill:";
+  return [
+    head,
+    ...check2.errors.map((e) => `- Error: ${e}`),
+    ...check2.warnings.map((w) => `- Warning: ${w}`),
+    ...check2.ok ? ["Publish it as the site's root index.html (without `path`)."] : []
+  ].join("\n");
+}
+var pathFolder = z14.string().min(1).max(MAX_PATH_FOLDER_LENGTH + 2);
 var encoding = z14.enum(["utf8", "base64"]).optional().describe('How `content` is encoded: "utf8" (default) for text, "base64" for binary files');
 var spa = z14.boolean().optional().describe(
   "Single-page app: serve index.html for unknown paths (client-side routing). Omit to keep the current setting"
@@ -3324,8 +3844,13 @@ function mcpToolsFor(w) {
     info: tool({
       name: "fling_info",
       title: "Site details",
-      description: "Show one site: URL, visibility, share link, current version and version history (ids for fling_rollback).",
-      inputSchema: { name: siteName },
+      description: "Show one site: URL, visibility, share link, current version and version history (ids for fling_rollback). With `path` (one of the site's Paths, from fling_paths), show that Path instead: its URL, owners, publishers and its own versions.",
+      inputSchema: {
+        name: siteName,
+        path: pathFolder.optional().describe(
+          `One of the site's Paths, its folder (e.g. "PAY-412"): show it instead of the site`
+        )
+      },
       annotations: { readOnlyHint: true, openWorldHint: false }
     }),
     files: tool({
@@ -3334,7 +3859,10 @@ function mcpToolsFor(w) {
       description: "List the files in a site's current version (or in `versionId`, from fling_info): path, size and content type, sorted by path. Use it to check what was actually published \u2014 e.g. when the user sees a 404, confirm the page exists at that path and that there is a root index.html (without one the site root 404s).",
       inputSchema: {
         name: siteName,
-        versionId: z14.string().min(1).max(100).optional().describe("Version id (from fling_info); omit for the version being served")
+        versionId: z14.string().min(1).max(100).optional().describe("Version id (from fling_info); omit for the version being served"),
+        path: pathFolder.optional().describe(
+          "One of the site's Paths, its folder (e.g. \"PAY-412\"): list that Path's version (ids from fling_info with this `path`) instead; its files are under the folder"
+        )
       },
       annotations: { readOnlyHint: true, openWorldHint: false }
     }),
@@ -3345,7 +3873,7 @@ function mcpToolsFor(w) {
       inputSchema: {
         name: siteName,
         paths: z14.array(z14.string().min(1).max(1024)).max(MAX_FILES).optional().describe('Only these files (site paths, e.g. "index.html"); omit for all of them'),
-        path: z14.string().min(1).max(1024).optional().describe('Only the files under this folder of the site, e.g. "30-10-26"'),
+        path: z14.string().min(1).max(1024).optional().describe('The files of this Path of the site, e.g. "PAY-412" (paths relative to it)'),
         cursor: z14.string().max(20).optional().describe("From the previous call, for the next files"),
         versionId: z14.string().min(1).max(100).optional().describe("Version id (from fling_info); omit for the version being served")
       },
@@ -3383,7 +3911,7 @@ function mcpToolsFor(w) {
         public: isPublic,
         listHtml,
         forms: formsConfig.nullable().optional().describe(
-          `The site's forms config (as ${FORMS_FILE}; fling_forms_template, fling_forms_check), for structured feedback on the review page. null removes the forms. Omitted: a publish with \`path\` or \`base\` keeps the site's forms, any other publish has none`
+          `The site's forms config (as ${FORMS_FILE}; fling_forms_template, fling_forms_check), for structured feedback on the review page. null removes the forms. Omitted: a publish on a \`base\` keeps the site's forms, a publish with \`path\` leaves them as they are (forms are the site's, never a Path's: \`forms\` with \`path\` is refused), any other publish has none`
         )
       },
       annotations: { destructiveHint: false, idempotentHint: true, openWorldHint: true }
@@ -3421,7 +3949,7 @@ function mcpToolsFor(w) {
     uploadFinish: tool({
       name: "fling_upload_finish",
       title: "Finish a chunked upload",
-      description: `Publish everything sent with fling_upload_file as the new version of the site and return its URL. The site becomes exactly the uploaded files (with \`path\` or \`base\`, plus the rest of the site). ${LIST_HTML} The upload stays open, so just call fling_upload_finish again with \`listHtml\`. The result includes \`warnings\`.`,
+      description: `Publish everything sent with fling_upload_file as the new version of the site and return its URL. The site becomes exactly the uploaded files (with \`path\`, that Path does; with \`base\`, plus the rest of that version). ${LIST_HTML} The upload stays open, so just call fling_upload_finish again with \`listHtml\`. The result includes \`warnings\`.`,
       inputSchema: {
         uploadId: z14.string().min(1).max(100).describe("From fling_upload_begin"),
         listHtml
@@ -3700,13 +4228,42 @@ function mcpToolsFor(w) {
       },
       annotations: { idempotentHint: true, openWorldHint: false }
     }),
+    paths: tool({
+      name: "fling_paths",
+      title: "List a site's Paths",
+      description: `List a site's Paths: the top-level folders (e.g. one per ticket, PAY-412) published on their own with \`path\`, each with its title, URL, current version, when it was updated, whether it is archived and whether the user can publish to it. Use it before publishing to a shared team site, to find a Path to change or roll back (fling_info, fling_files and fling_rollback take \`path\`), or when the user asks what is on it. ${PATHS_HOME_CHOICE} ${PATHS_BLOCK_FORMAT}`,
+      inputSchema: { name: siteName },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    pathsTemplate: tool({
+      name: "fling_paths_template",
+      title: "Start a Paths home page",
+      description: `A starter home page (index.html) for a site with Paths, with its Paths block in place: Fling fills it with the site's live Paths. Templates: ${PATHS_TEMPLATES_LIST}. Use it when the user wants a custom home page listing their Paths rather than the default one. Adapt it freely (wording, layout, styling) while keeping the block, check it with fling_paths_check, then publish it as the site root (without \`path\`). Needs no sign-in. ${PATHS_HOME_CHOICE} ${PATHS_BLOCK_FORMAT}`,
+      inputSchema: {
+        template: z14.enum(PATHS_TEMPLATE_NAMES).describe("Which starter"),
+        title: z14.string().min(1).max(200).optional().describe(`The page's title and heading (e.g. "Payments plans")`)
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    pathsCheck: tool({
+      name: "fling_paths_check",
+      title: "Check a Paths home page",
+      description: `Check a site's home page (index.html) before publishing it, for the Paths block Fling fills with the site's Paths: whether there is one, bare or template, its options, and warnings (unknown options or placeholders, an unclosed template, an item without a link). Returns \`ok\`, \`errors\` and \`warnings\`. Use it on every custom home page for a site with Paths. Needs no sign-in. ${PATHS_HOME_CHOICE} ${PATHS_BLOCK_FORMAT}`,
+      inputSchema: {
+        html: z14.string().min(1).max(MCP_PUBLISH_MAX_BYTES).describe("The page, as HTML")
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
     rollback: tool({
       name: "fling_rollback",
       title: "Roll back",
-      description: "Point a site at an earlier version (ids from fling_info). Instant; nothing is uploaded.",
+      description: "Point a site at an earlier version (ids from fling_info). Instant; nothing is uploaded. With `path`, roll back only that Path (ids from fling_info with the same `path`); the rest of the site and its other Paths stay as they are.",
       inputSchema: {
         name: siteName,
-        versionId: z14.string().min(1).max(100).describe("Version id to serve")
+        versionId: z14.string().min(1).max(100).describe("Version id to serve"),
+        path: pathFolder.optional().describe(
+          `One of the site's Paths, its folder (e.g. "PAY-412"): roll back only that Path`
+        )
       },
       annotations: { idempotentHint: true, openWorldHint: false }
     })
@@ -3772,7 +4329,7 @@ function describeComments(list, opts = {}) {
 var READY_TIMEOUT_MS = 15e3;
 var NOT_READY_NOTE = "it can take a few more seconds to appear everywhere; reload if you see a 404";
 var isReachableStatus = (status) => status >= 200 && status < 400 || status === 401 || status === 403;
-var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var defaultSleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 async function waitUntilReachable(url, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? READY_TIMEOUT_MS;
   const doFetch = opts.fetch ?? ((u, init) => fetch(u, init));
@@ -3805,10 +4362,10 @@ async function waitUntilReachable(url, opts = {}) {
     interval = Math.min(interval * 1.25, 2e3);
   }
 }
-function probeUrl(siteUrl2, paths) {
+function probeUrl(siteUrl2, paths2) {
   const base2 = siteUrl2.endsWith("/") ? siteUrl2 : `${siteUrl2}/`;
-  if (paths.length === 0 || paths.includes("index.html")) return base2;
-  const pick = paths.find((p) => /\.html?$/i.test(p)) ?? paths[0];
+  if (paths2.length === 0 || paths2.includes("index.html")) return base2;
+  const pick = paths2.find((p) => /\.html?$/i.test(p)) ?? paths2[0];
   return base2 + pick.split("/").map(encodeURIComponent).join("/");
 }
 function readinessWaitDisabled(env) {
@@ -3922,7 +4479,7 @@ var LiveServerMessageSchema = z16.discriminatedUnion("type", [
 ]);
 
 // src/cli.ts
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import { Command, Option } from "commander";
 
 // src/commands/auth.ts
@@ -3972,7 +4529,7 @@ function exitCodeFor(error) {
 // package.json
 var package_default = {
   name: "@nearform/fling",
-  version: "0.9.0",
+  version: "0.10.1",
   license: "MIT",
   description: "Fling a folder of static files at a Fling server and get a link back. CLI + MCP server.",
   type: "module",
@@ -4019,7 +4576,7 @@ var package_default = {
     esbuild: "^0.25.12",
     tsx: "^4.23.13",
     typescript: "^5.9.3",
-    vitest: "^3.2.7"
+    vitest: "^4.1.12"
   }
 };
 
@@ -4545,8 +5102,8 @@ async function startCallbackServer(options = {}) {
   const timeoutMs = options.timeoutMs ?? LOGIN_TIMEOUT_MS;
   let settle;
   let timer;
-  const result = new Promise((resolve7, reject) => {
-    settle = { resolve: resolve7, reject };
+  const result = new Promise((resolve8, reject) => {
+    settle = { resolve: resolve8, reject };
   }).finally(() => clearTimeout(timer));
   result.catch(() => {
   });
@@ -4607,7 +5164,7 @@ ${close ? "<script>setTimeout(function(){window.close()},800)</script>" : ""}
   res.end(html);
 }
 function listenOnFreePort(server) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let port = CALLBACK_PORT_START;
     const tryNext = () => {
       if (port > CALLBACK_PORT_END) {
@@ -4629,7 +5186,7 @@ function listenOnFreePort(server) {
       });
       server.listen(port, "127.0.0.1", () => {
         server.removeAllListeners("error");
-        resolve7(port);
+        resolve8(port);
       });
     };
     tryNext();
@@ -4647,20 +5204,20 @@ import chalk from "chalk";
 var skipWait = async () => ({ ready: true, waitedMs: 0, skipped: true });
 function createReadyWaiter(options = {}) {
   if (readinessWaitDisabled(options.env ?? process.env)) return skipWait;
-  return (url, paths, opts) => waitUntilReachable(probeUrl(url, paths), {
+  return (url, paths2, opts) => waitUntilReachable(probeUrl(url, paths2), {
     timeoutMs: options.timeoutMs,
     fetch: options.fetch,
     onWaiting: opts?.onWaiting
   });
 }
 var SPINNER = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-async function waitWithSpinner(waiter, url, paths, io) {
+async function waitWithSpinner(waiter, url, paths2, io) {
   if (!waiter) return { ready: true, waitedMs: 0, skipped: true };
   let frame = 0;
   let timer;
   const draw = () => io.progress(`${chalk.cyan(SPINNER[frame++ % SPINNER.length])} Waiting for the edge\u2026`);
   try {
-    const result = await waiter(url, paths, {
+    const result = await waiter(url, paths2, {
       onWaiting: () => {
         draw();
         timer = setInterval(draw, 100);
@@ -5012,6 +5569,73 @@ async function setRoles(client, name, which, change) {
   });
   return withRoles(site);
 }
+function pathsEnabled(instance) {
+  return instance?.capabilities.paths === true;
+}
+var pathOf = (name, folder) => `${sitePath2(name)}/paths/${encodeURIComponent(folder)}`;
+async function listPaths(client, name) {
+  const res = await client.request("GET", `${sitePath2(name)}/paths`, { schema: PathListSchema });
+  return res.paths;
+}
+function getPath(client, name, folder) {
+  return client.request("GET", pathOf(name, folder), { schema: PathDetailSchema });
+}
+function rollbackPath(client, name, folder, versionId) {
+  return client.request("POST", `${pathOf(name, folder)}/current`, {
+    schema: SitePathSchema,
+    body: { versionId }
+  });
+}
+function archivePath(client, name, folder, archived) {
+  return client.request("PATCH", pathOf(name, folder), {
+    schema: SitePathSchema,
+    body: { archived }
+  });
+}
+async function deletePath(client, name, folder) {
+  await client.request("DELETE", pathOf(name, folder));
+  return { name, path: folder, deleted: true };
+}
+var pathWithRoles = (path3) => {
+  if (!path3.owners) {
+    throw new CliError(`You can't see who owns /${path3.folder}/`, {
+      hint: "Only those on the site see its Paths' owners and publishers."
+    });
+  }
+  return {
+    ...path3,
+    owners: path3.owners,
+    publishers: path3.publishers ?? { emails: [], groups: [] }
+  };
+};
+async function getPathRoles(client, name, folder) {
+  return pathWithRoles(await getPath(client, name, folder));
+}
+async function setPathRoles(client, name, folder, which, change) {
+  const current = await getPathRoles(client, name, folder);
+  const path3 = await client.request("PATCH", pathOf(name, folder), {
+    schema: SitePathSchema,
+    body: { [which]: editRoleInput(current[which], change) }
+  });
+  return pathWithRoles(path3);
+}
+async function pathVersionFiles(client, name, folder, versionId) {
+  const path3 = await getPath(client, name, folder);
+  const id = versionId ?? path3.currentVersionId;
+  if (!id) throw new CliError(`/${path3.folder}/ of ${name} has no published version yet`);
+  const files = await client.request(
+    "GET",
+    `${sitePath2(name)}/versions/${encodeURIComponent(id)}/files`,
+    { schema: VersionFilesSchema, query: { path: path3.folder } }
+  );
+  return {
+    name,
+    path: path3.folder,
+    url: path3.url,
+    current: id === path3.currentVersionId,
+    ...files
+  };
+}
 var groupPath = (slug) => `/api/groups/${encodeURIComponent(slug)}`;
 async function listGroups(client, opts = {}) {
   const res = await client.request("GET", "/api/groups", {
@@ -5369,7 +5993,7 @@ import { join as join2, relative, sep } from "node:path";
 import ignore from "ignore";
 var GIT_TIMEOUT_MS = 2e4;
 function git(cwd, args, input) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
       const child = execFile(
         "git",
@@ -5377,14 +6001,14 @@ function git(cwd, args, input) {
         { timeout: GIT_TIMEOUT_MS, maxBuffer: 256 * 1024 * 1024, encoding: "utf8" },
         (error, stdout) => {
           const code = error?.code;
-          if (error && !(args[0] === "check-ignore" && code === 1)) resolve7(null);
-          else resolve7(stdout);
+          if (error && !(args[0] === "check-ignore" && code === 1)) resolve8(null);
+          else resolve8(stdout);
         }
       );
-      child.on("error", () => resolve7(null));
+      child.on("error", () => resolve8(null));
       if (input !== void 0) child.stdin?.end(input);
     } catch {
-      resolve7(null);
+      resolve8(null);
     }
   });
 }
@@ -5475,15 +6099,15 @@ var CHARSET_TYPES = /* @__PURE__ */ new Set([
   "image/svg+xml"
 ]);
 var SecretFilesError = class extends CliError {
-  constructor(paths) {
-    const shown2 = paths.slice(0, 20);
+  constructor(paths2) {
+    const shown3 = paths2.slice(0, 20);
     super(
-      `Not flung: ${paths.length === 1 ? "this is a secret file" : `these are ${paths.length} secret files`} (keys, certificates, credentials): ${shown2.join(", ")}${paths.length > shown2.length ? ` (+${paths.length - shown2.length} more)` : ""}. ${NEVER_PUBLISHED_NOTE}`,
+      `Not flung: ${paths2.length === 1 ? "this is a secret file" : `these are ${paths2.length} secret files`} (keys, certificates, credentials): ${shown3.join(", ")}${paths2.length > shown3.length ? ` (+${paths2.length - shown3.length} more)` : ""}. ${NEVER_PUBLISHED_NOTE}`,
       {
-        hint: `Move ${paths.length === 1 ? "it" : "them"} out of the folder, or add ${paths.length === 1 ? "it" : "them"} to ${IGNORE_FILE} if the site does not need ${paths.length === 1 ? "it" : "them"}.`
+        hint: `Move ${paths2.length === 1 ? "it" : "them"} out of the folder, or add ${paths2.length === 1 ? "it" : "them"} to ${IGNORE_FILE} if the site does not need ${paths2.length === 1 ? "it" : "them"}.`
       }
     );
-    this.paths = paths;
+    this.paths = paths2;
     this.name = "SecretFilesError";
   }
   code = "secret_file";
@@ -5672,7 +6296,7 @@ function checkLimits(files, dir) {
     );
   }
 }
-var hasRootIndex = (local) => local.files.some((f) => f.path === "index.html");
+var hasRootIndex = (local, markdown = false) => local.files.some((f) => f.path === "index.html") || markdown && markdownHomePages(local.files.map((f) => f.path)).has("");
 var htmlPages = (local) => local.files.filter((f) => isHtmlPath(f.path) && f.path !== "index.html");
 var TITLE_BYTES = 65536;
 async function readHead(file) {
@@ -5871,14 +6495,14 @@ async function deploy(deps, opts) {
   try {
     return await deployOnce(deps, opts, name, local);
   } catch (error) {
-    if (opts.path === void 0 || !baseChanged(error)) throw error;
+    if (opts.path === void 0 || opts.base !== void 0 || !baseChanged(error)) throw error;
     return deployOnce(deps, opts, name, local);
   }
 }
 async function deployOnce(deps, opts, name, local) {
   const onBaseChanged = (error) => opts.base !== void 0 && baseChanged(error) ? new BaseChangedError(name, opts.base) : error;
   const folder = opts.path;
-  const prefix = folder ?? opts.within;
+  const prefix = folder;
   const sitePath4 = (file) => prefix === void 0 ? file : `${prefix}/${file}`;
   const base2 = {
     name,
@@ -5896,7 +6520,7 @@ async function deployOnce(deps, opts, name, local) {
       ...folder === void 0 ? {} : { path: folder },
       ...opts.base === void 0 ? {} : {
         base: opts.base,
-        ...opts.partial ? { partial: true, remove: opts.remove ?? [] } : {}
+        ...opts.partial ? { partial: true, remove: (opts.remove ?? []).map(sitePath4) } : {}
       },
       ...opts.spa !== void 0 ? { spa: opts.spa } : {},
       ...opts.public ? { visibility: "public" } : {},
@@ -5917,7 +6541,8 @@ async function deployOnce(deps, opts, name, local) {
       versionId: res.versionId,
       site: res.site,
       uploaded: 0,
-      first: false
+      first: false,
+      hints: res.hints ?? []
     };
   }
   const byPath = new Map(local.files.map((f) => [sitePath4(f.path), f]));
@@ -5948,7 +6573,8 @@ async function deployOnce(deps, opts, name, local) {
     versionId: fin.versionId,
     site: fin.site,
     uploaded: uploads.length,
-    first: fin.first === true
+    first: fin.first === true,
+    hints: fin.hints ?? []
   };
 }
 async function uploadWithRetry(deps, file, url, headers) {
@@ -5996,8 +6622,8 @@ async function readFormsFile(dir) {
     });
   }
 }
-function requireValidForms(config, paths, where, bin) {
-  const check2 = checkFormsConfig(config, paths);
+function requireValidForms(config, paths2, where, bin) {
+  const check2 = checkFormsConfig(config, paths2);
   if (!check2.ok) {
     throw new CliError(
       `${where} is not a forms config Fling can use:
@@ -6010,6 +6636,12 @@ function requireValidForms(config, paths, where, bin) {
 async function planForms(opts) {
   const file = opts.inline === void 0 ? await readFormsFile(opts.dir) : null;
   const raw = opts.inline !== void 0 ? opts.inline : file?.config;
+  if (opts.path !== void 0) {
+    if (raw === void 0 || raw === null) return { send: void 0, check: null };
+    throw new CliError(`Forms belong to the site, not to the Path /${opts.path}/`, {
+      hint: `Deploy ${file ? FORMS_FILE : "the forms"} with the site's root (without a path), with \`paths\` patterns that reach /${opts.path}/ if its pages need them.`
+    });
+  }
   if (raw === void 0) {
     if (!formsEnabled(opts.instance)) return { send: void 0, check: null };
     const send = !opts.layered || opts.pulledWithForms ? null : void 0;
@@ -6077,7 +6709,7 @@ async function tempFolder() {
   const dir = await mkdtemp(join5(tmpdir(), "fling-"));
   return { dir, cleanup: () => rm(dir, { recursive: true, force: true }) };
 }
-async function prepareInput(path3) {
+async function prepareInput(path3, opts = {}) {
   let info;
   try {
     info = await stat3(path3);
@@ -6118,7 +6750,9 @@ async function prepareInput(path3) {
     } else {
       const name = basename2(path3);
       await copyFile(path3, join5(tmp.dir, name));
-      await writeFile2(join5(tmp.dir, "index.html"), wrapperPage(name));
+      if (!(opts.markdown && isMarkdownPath(name))) {
+        await writeFile2(join5(tmp.dir, "index.html"), wrapperPage(name));
+      }
     }
   } catch (error) {
     await tmp.cleanup();
@@ -6139,8 +6773,8 @@ function zipEntryPath(name) {
   if (JUNK_FILES.has((segments.at(-1) ?? "").toLowerCase())) return null;
   return segments.join("/");
 }
-function unwrapSingleFolder(paths) {
-  let current = paths;
+function unwrapSingleFolder(paths2) {
+  let current = paths2;
   for (; ; ) {
     const first = current[0]?.split("/")[0];
     if (!first || !current.every((p) => p.includes("/") && p.split("/")[0] === first)) return current;
@@ -6197,11 +6831,11 @@ async function extractZip(data, dest, skippedDotfiles = []) {
       `Refusing to extract the zip: it has paths that escape its folder (${unsafe.slice(0, 3).join(", ")})`
     );
   const names = Object.keys(entries);
-  const paths = /* @__PURE__ */ new Map();
+  const paths2 = /* @__PURE__ */ new Map();
   const kept = names.map((n) => zipEntryPath(n));
   const unwrapped = unwrapSingleFolder(kept);
   names.forEach((n, i) => {
-    paths.set(n, unwrapped[i]);
+    paths2.set(n, unwrapped[i]);
   });
   if (names.length === 0) throw new CliError("The zip has no files to fling");
   const root = resolve2(dest);
@@ -6212,7 +6846,7 @@ async function extractZip(data, dest, skippedDotfiles = []) {
     total += content.length;
     if (content.length > MAX_FILE_BYTES || total > MAX_DEPLOY_BYTES)
       throw new CliError(`The zip expands to more than the limits allow`);
-    const rel = paths.get(name);
+    const rel = paths2.get(name);
     const target = resolve2(root, ...rel.split("/"));
     if (!target.startsWith(root + sep4)) throw new CliError(`Unsafe path in the zip: ${name}`);
     await mkdir2(join5(target, ".."), { recursive: true });
@@ -6269,7 +6903,7 @@ var SiteLinkSchema = z19.object({
   name: z19.string(),
   /** the version pulled, or the one the last deploy made */
   versionId: z19.string(),
-  /** a pull of one folder of the site: the folder is this folder */
+  /** a pull of one of the site's Paths (its folder): the folder is that Path */
   path: z19.string().optional(),
   /** every file pulled (or deployed), by site path: its SHA-256 */
   files: z19.record(z19.string(), z19.string()),
@@ -6309,7 +6943,7 @@ function onLink(link, local) {
   for (const path3 of Object.keys(link.files)) if (!(path3 in now)) changes.removed.push(path3);
   return {
     base: link.versionId,
-    ...link.path === void 0 ? {} : { partial: true, within: link.path, remove: changes.removed },
+    ...link.path === void 0 ? {} : { path: link.path },
     changes
   };
 }
@@ -6494,7 +7128,9 @@ async function runDeploy(ctx, input, opts) {
       hint: `Leave it out, then use \`${ctx.binName} access\` or \`${ctx.binName} visibility\`.`
     });
   }
-  const prepared = await prepareInput(path3);
+  const prepared = await prepareInput(path3, {
+    markdown: instance?.capabilities.markdown === true
+  });
   try {
     const { access: _asked, path: _path, ...rest } = opts;
     await deployPrepared(
@@ -6535,10 +7171,10 @@ async function linkedTo(ctx, link, opts) {
 }
 function publishFolder(ctx, opts) {
   if (opts.path === void 0) return void 0;
-  const folder = normalizePublishPath(opts.path);
+  const folder = normalizePathFolder(opts.path);
   if (folder === null) {
     throw new CliError(`Invalid --path "${opts.path}"`, {
-      hint: "Use a folder of the site, like 30-10-26 or reports/2026 (no dotfiles)."
+      hint: `Use one top-level folder of the site, like PAY-412 (no dotfiles, at most ${MAX_PATH_FOLDER_LENGTH} characters): it becomes that folder's Path. Nested folders go inside it.`
     });
   }
   if (opts.name === void 0) {
@@ -6559,7 +7195,7 @@ async function deployPrepared(ctx, client, instance, base2, prepared, opts, ask)
   if (!link && opts.name === void 0 && ask) {
     name = await confirmSiteName(ctx, client, name, base2);
   }
-  if (!link && !hasRootIndex(local)) {
+  if (!link && !hasRootIndex(local, instance?.capabilities.markdown === true)) {
     const pages = htmlPages(local).length;
     const root = base2 ? siteUrlFor(name, base2) + (folder ? `${folder}/` : "") : "the site root";
     const warning = `No index.html ${folder ? `in ${folder}/` : "at the root"} \u2014 ${root} will show a 404.`;
@@ -6574,10 +7210,11 @@ async function deployPrepared(ctx, client, instance, base2, prepared, opts, ask)
   const forms2 = await planForms({
     dir: prepared.dir,
     pages: local.files.map((f) => inFolder(f.path)),
-    layered: opts.folder !== void 0 || onBase !== null,
+    layered: onBase !== null,
     pulledWithForms: onBase !== null && link?.forms !== void 0,
     instance,
-    bin: ctx.binName
+    bin: ctx.binName,
+    ...folder === void 0 ? {} : { path: folder }
   });
   let progressShown = false;
   const result = await deploy(
@@ -6586,10 +7223,9 @@ async function deployPrepared(ctx, client, instance, base2, prepared, opts, ask)
       dir: prepared.dir,
       name,
       manifest: local,
-      path: opts.folder,
+      path: opts.folder ?? onBase?.path,
       ...onBase ? {
-        base: onBase.base,
-        ...onBase.partial ? { partial: true, remove: onBase.remove, within: onBase.within } : {}
+        base: onBase.base
       } : {},
       spa: opts.spa ? true : void 0,
       public: opts.public,
@@ -6622,6 +7258,7 @@ async function deployPrepared(ctx, client, instance, base2, prepared, opts, ask)
     );
   }
   for (const warning of result.warnings) if (warning !== NO_INDEX_WARNING) ctx.log.warn(warning);
+  for (const hint2 of result.hints) ctx.log.info(hint2.message);
   const summary = changes ? `${describeChanges(changes)} since ${link?.versionId}` : `${result.fileCount} files, ${formatBytes(result.totalBytes)}`;
   if (result.status === "unchanged") ctx.log.info(`Unchanged ${chalk7.dim(`(${summary})`)}`);
   else if (result.status === "repointed")
@@ -6631,12 +7268,15 @@ async function deployPrepared(ctx, client, instance, base2, prepared, opts, ask)
       `Deployed ${result.name}${folder ? ` to /${folder}/` : ""} ${chalk7.dim(`(${summary}; uploaded ${result.uploaded}, version ${result.versionId})`)}`
     );
   const url = folder ? new URL(`${folder}/`, result.url).href : result.url;
-  const ready = result.status === "unchanged" ? true : (await waitWithSpinner(
-    ctx.waitReady,
-    url,
-    local.files.map((f) => inFolder(f.path)),
-    { progress: ctx.progress, warn: (m) => ctx.log.warn(m) }
-  )).ready;
+  const ready = result.status === "unchanged" ? true : (
+    // From the site's root, as the files are named there: a Path's are under its folder.
+    (await waitWithSpinner(
+      ctx.waitReady,
+      result.url,
+      local.files.map((f) => inFolder(f.path)),
+      { progress: ctx.progress, warn: (m) => ctx.log.warn(m) }
+    )).ready
+  );
   const members2 = instance ? privateAudience(instance) : "anyone signed in to this Fling";
   const level = siteAccessLevel(result.site);
   const who = describeSiteAccess(result.site, members2);
@@ -6655,16 +7295,18 @@ async function deployPrepared(ctx, client, instance, base2, prepared, opts, ask)
   const review = instance && commentsEnabled(instance) ? reviewUrl(instance.appOrigin, result.name) : void 0;
   const reviewNote = instance ? `Share for feedback (reviewers sign in to ${instance.name}):` : "Share for feedback:";
   let formsSummary = forms2.check?.summary ?? null;
-  if (!formsSummary && forms2.send === void 0 && formsEnabled(instance)) {
+  if (!formsSummary && folder === void 0 && forms2.send === void 0 && formsEnabled(instance)) {
     const live = await getForms(client, result.name).catch(() => null);
     if (live?.config) formsSummary = checkFormsConfig(live.config).summary;
   }
   const responsesUrl = formsSummary && instance ? responsesPageUrl(instance.appOrigin, result.name) : void 0;
-  const hint = formsEnabled(instance) && !formsSummary ? formsHint(ctx.binName) : void 0;
+  const hint = formsEnabled(instance) && !formsSummary && folder === void 0 ? formsHint(ctx.binName) : void 0;
   const data = {
     status: result.status,
     site: result.site,
     ...folder ? { path: folder, url } : {},
+    versionId: result.versionId,
+    ...result.hints.length ? { hints: result.hints } : {},
     ...changes && link ? { base: opts.force ? null : link.versionId, changes } : {},
     access: level,
     ...result.first ? { created: true } : {},
@@ -6771,7 +7413,7 @@ var manifest_default = {
   manifest_version: "0.3",
   name: "fling",
   display_name: "Fling",
-  version: "0.9.0",
+  version: "0.10.1",
   description: "Publish HTML pages, zips and folders from your computer to Fling and get a link back.",
   long_description: "Fling hosts static sites at https://<name>.<your sites domain> (private to people signed in to your Fling unless you make them public or share a link).\n\nThis extension runs on your computer, so Claude can publish:\n\n- content it created in the conversation (sent inline \u2014 no sandbox uploads),\n- a file you downloaded or Claude Desktop saved, by name: it looks in Downloads, Desktop, Documents/Claude and Claude Desktop's output folders,\n- a single .html file, a .zip of a site, or a folder with index.html.\n\nIt works with every Fling you sign in to: the one you downloaded it from is added on start, Claude can sign in to another with the fling_login tool, and the logins are shared with the fling CLI (`fling login <address>`). When several Flings are set up, Claude settles with you which one a conversation uses and names it on every call.",
   author: {
@@ -6885,7 +7527,7 @@ var MARKETPLACE_NAME = "fling";
 var PLUGIN_NAME = "fling";
 var PLUGIN_ID = `${PLUGIN_NAME}@${MARKETPLACE_NAME}`;
 var MCPB_PATH = "/downloads/fling.mcpb";
-var runClaude = (args) => new Promise((resolve7) => {
+var runClaude = (args) => new Promise((resolve8) => {
   execFile2(
     "claude",
     [...args],
@@ -6893,7 +7535,7 @@ var runClaude = (args) => new Promise((resolve7) => {
     (error, stdout, stderr) => {
       const missing = error?.code === "ENOENT";
       const code = !error ? 0 : missing ? -1 : typeof error.code === "number" ? error.code : 1;
-      resolve7({ code, stdout: String(stdout), stderr: String(stderr) });
+      resolve8({ code, stdout: String(stdout), stderr: String(stderr) });
     }
   );
 });
@@ -7124,12 +7766,12 @@ function systemDoctorDeps(store, fetch2, runClaude2, findClaudeDesktop2) {
     platform,
     runClaude: runClaude2,
     findClaudeDesktop: findClaudeDesktop2,
-    runProgram: (file, args) => new Promise((resolve7) => {
+    runProgram: (file, args) => new Promise((resolve8) => {
       execFile3(
         file,
         [...args],
         { timeout: DEFAULT_TIMEOUT_MS, shell: platform === "win32" },
-        (error, stdout) => resolve7({ code: error ? 1 : 0, stdout: String(stdout) })
+        (error, stdout) => resolve8({ code: error ? 1 : 0, stdout: String(stdout) })
       );
     }),
     selfPath: process.argv[1],
@@ -7659,7 +8301,7 @@ async function runResponses(ctx, name, opts) {
   }
   const { client, instance } = await formsClient(ctx);
   const exported = await getResponses(client, name, { form: opts.form, path: opts.path });
-  const page = instance ? responsesPageUrl(instance.appOrigin, name) : void 0;
+  const page2 = instance ? responsesPageUrl(instance.appOrigin, name) : void 0;
   if (format2 !== void 0 || opts.output !== void 0) {
     const as = format2 ?? "json";
     const body = as === "csv" ? responsesCsv(exported.responses, exported.forms) : as === "jsonl" ? responsesJsonl(exported.responses) : `${formatJson(exported)}
@@ -7672,7 +8314,7 @@ async function runResponses(ctx, name, opts) {
     } else ctx.out.data(as === "json" ? exported : body, () => body.replace(/\n$/, ""));
     return;
   }
-  ctx.out.data({ ...exported, ...page ? { responsesUrl: page } : {} }, () => {
+  ctx.out.data({ ...exported, ...page2 ? { responsesUrl: page2 } : {} }, () => {
     if (!exported.title) return chalk9.dim(`${name} has no forms on its live version.`);
     const byId = new Map(exported.forms.map((f) => [f.id, f]));
     const table = renderTable(exported.responses, [
@@ -7696,7 +8338,7 @@ async function runResponses(ctx, name, opts) {
       table,
       "",
       ...progressLines(exported).map((l) => chalk9.dim(l)),
-      ...page ? [chalk9.dim(`Progress and downloads: ${page}`)] : [],
+      ...page2 ? [chalk9.dim(`Progress and downloads: ${page2}`)] : [],
       chalk9.dim(`Export: \`${ctx.binName} responses ${name} --format csv -o responses.csv\``)
     ].join("\n");
   });
@@ -7859,9 +8501,145 @@ async function runNotificationsSent(ctx) {
   );
 }
 
-// src/commands/pull.ts
-import { relative as relative6, resolve as resolve5 } from "node:path";
+// src/commands/paths.ts
+import { readFile as readFile11, stat as stat8, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join12, relative as relative6, resolve as resolve5 } from "node:path";
 import chalk12 from "chalk";
+var pathsHomeChoice = (bin) => [
+  "A site's home page (its root index.html) can list its Paths:",
+  `  default  no index.html of its own: Fling serves a listing of the live Paths (a site whose first publish is a Path gets one). Nothing to do.`,
+  `  custom   your own index.html with a Paths block, filled with the live Paths: \`${bin} paths init\` writes a starter (${PATHS_TEMPLATE_NAMES.join(", ")}); adapt it, keeping the block, \`${bin} paths check\` it, then deploy it as the site root (without --path).`,
+  "  none     an index.html without a Paths block lists no Paths; a deploy then says so."
+];
+async function pathsClient(ctx) {
+  const client = requireClient(ctx);
+  const instance = await loadInstanceWith(ctx.store, ctx.config, ctx.fetch, "paths");
+  if (instance && !pathsEnabled(instance)) {
+    throw new CliError(`${instance.name} has no Paths`, { hint: "Ask its operator to update it." });
+  }
+  return client;
+}
+function pathFolder2(raw) {
+  const folder = normalizePathFolder(raw);
+  if (folder === null) {
+    throw new CliError(`Invalid Path "${raw}"`, {
+      hint: `A Path is one top-level folder of the site, like PAY-412 (no dotfiles, at most ${MAX_PATH_FOLDER_LENGTH} characters).`
+    });
+  }
+  return folder;
+}
+var stateOf = (p) => p.archived ? chalk12.yellow("archived") : p.currentVersionId ? "live" : chalk12.dim("unpublished");
+async function runPaths(ctx, name) {
+  const paths2 = await listPaths(await pathsClient(ctx), name);
+  if (!ctx.json) {
+    if (paths2.length === 0) ctx.log.info(`${name} has no Paths yet`);
+    for (const line of pathsHomeChoice(ctx.binName)) ctx.log.hint(line);
+  }
+  ctx.out.data(
+    { name, paths: paths2 },
+    () => paths2.length === 0 ? chalk12.dim(
+      `Publish a folder as one: \`${ctx.binName} deploy ./plan --name ${name} --path PAY-412\`.`
+    ) : renderTable(paths2, [
+      { header: "PATH", value: (p) => `/${p.folder}/` },
+      { header: "TITLE", value: (p) => p.title || "-" },
+      { header: "VERSION", value: (p) => p.currentVersionId ?? "-" },
+      { header: "STATE", value: stateOf },
+      { header: "PUBLISH", value: (p) => p.canPublish ? "yes" : "no" },
+      { header: "UPDATED", value: (p) => formatDate(p.updatedAt) }
+    ])
+  );
+}
+async function runPathArchive(ctx, name, raw, unarchive = false) {
+  const folder = pathFolder2(raw);
+  const path3 = await archivePath(await pathsClient(ctx), name, folder, !unarchive);
+  ctx.log.success(
+    unarchive ? `/${folder}/ of ${name} restored` : `/${folder}/ of ${name} archived: it 404s until \`${ctx.binName} paths unarchive ${name} ${folder}\``
+  );
+  if (ctx.json) ctx.out.data(path3, () => "");
+  else if (unarchive) ctx.out.text(path3.url);
+}
+async function runPathDelete(ctx, name, raw, opts) {
+  const folder = pathFolder2(raw);
+  const client = await pathsClient(ctx);
+  if (!opts.yes) {
+    if (!ctx.interactive) {
+      throw new CliError(`Refusing to delete /${folder}/ of ${name} without confirmation`, {
+        hint: "Pass --yes to delete."
+      });
+    }
+    const ok = await ctx.confirm(
+      `Delete /${folder}/ of ${name} and every version of it? This cannot be undone.`
+    );
+    if (!ok) throw new CliError("Cancelled");
+  }
+  const result = await deletePath(client, name, folder);
+  ctx.log.success(`/${folder}/ of ${name} deleted`);
+  if (ctx.json) ctx.out.data(result, () => "");
+}
+var shown2 = (path3) => {
+  const rel = relative6(process.cwd(), path3);
+  return rel === "" ? "." : rel.startsWith("..") ? path3 : rel;
+};
+async function runPathsInit(ctx, dir, opts) {
+  const template = opts.template ?? "minimal";
+  if (!isPathsTemplateName(template)) {
+    throw new CliError(`Unknown template "${template}"`, {
+      hint: `Use one of: ${PATHS_TEMPLATE_NAMES.join(", ")}.`
+    });
+  }
+  const folder = resolve5(dir ?? ".");
+  const info = await stat8(folder).catch(() => null);
+  if (!info?.isDirectory()) throw new CliError(`No such folder: ${dir ?? "."}`);
+  const file = join12(folder, "index.html");
+  if (!opts.force && await stat8(file).catch(() => null)) {
+    throw new CliError(`${shown2(file)} already exists`, {
+      hint: `Pass --force to replace it with the template, or add a Paths block to it (\`${ctx.binName} paths check ${shown2(file)}\` says how).`
+    });
+  }
+  const html = pathsTemplate(template, { title: opts.title });
+  await writeFile7(file, html);
+  ctx.log.success(`Wrote ${shown2(file)} (${template}: ${PATHS_TEMPLATE_DESCRIPTIONS[template]})`);
+  ctx.out.data(
+    { path: file, template },
+    () => chalk12.dim(
+      `Adapt its wording and look, keeping the <!-- fling:paths --> block; check it with \`${ctx.binName} paths check ${shown2(folder)}\`, then deploy the folder as the site root (without --path).`
+    )
+  );
+}
+async function runPathsCheck(ctx, path3) {
+  const target = resolve5(path3 ?? ".");
+  const info = await stat8(target).catch(() => null);
+  if (!info) throw new CliError(`No such file or folder: ${path3 ?? "."}`);
+  const file = info.isDirectory() ? join12(target, "index.html") : target;
+  const html = await readFile11(file, "utf8").catch(() => null);
+  if (html === null) {
+    throw new CliError(`No ${shown2(file)}`, {
+      hint: `\`${ctx.binName} paths init ${shown2(info.isDirectory() ? target : resolve5(target, ".."))}\` writes a starter.`
+    });
+  }
+  const check2 = checkPathsIndex(html);
+  for (const w of check2.warnings) ctx.log.warn(w);
+  if (!check2.ok) {
+    if (ctx.json) ctx.out.data({ path: file, ...check2 }, () => "");
+    throw new CliError(`${shown2(file)} has no Paths block:
+  ${check2.errors.join("\n  ")}`, {
+      hint: `Placeholders in a template: ${PATHS_PLACEHOLDERS.map((p) => `{{${p}}}`).join(" ")}. Options: ${PATHS_OPTIONS.join(", ")}.`
+    });
+  }
+  ctx.log.success(
+    `${shown2(file)} has a ${check2.block} Paths block${check2.options.length ? ` (${check2.options.join(", ")})` : ""}`
+  );
+  ctx.out.data(
+    { path: file, ...check2 },
+    () => chalk12.dim(
+      "Deploy it as the site root (without --path): the listing fills in with the live Paths."
+    )
+  );
+}
+
+// src/commands/pull.ts
+import { relative as relative7, resolve as resolve6 } from "node:path";
+import chalk13 from "chalk";
 async function runPull(ctx, name, dir, opts) {
   const client = requireClient(ctx);
   const instance = await loadInstanceWith(ctx.store, ctx.config, ctx.fetch, "pull");
@@ -7872,15 +8650,15 @@ async function runPull(ctx, name, dir, opts) {
   }
   let path3;
   if (opts.path !== void 0) {
-    const folder = normalizePublishPath(opts.path);
+    const folder = normalizePathFolder(opts.path);
     if (folder === null) {
       throw new CliError(`Invalid --path "${opts.path}"`, {
-        hint: "Use a folder of the site, like 30-10-26 or reports/2026 (no dotfiles)."
+        hint: "Use one of the site\u2019s Paths, like PAY-412: `fling paths <site>` lists them."
       });
     }
     path3 = folder;
   }
-  const target = resolve5(dir ?? name);
+  const target = resolve6(dir ?? name);
   let progressShown = false;
   const pulled = await pullSite(
     { client, fetch: ctx.fetch },
@@ -7901,21 +8679,21 @@ async function runPull(ctx, name, dir, opts) {
   ).finally(() => {
     if (progressShown) ctx.progress(null);
   });
-  const shown2 = relative6(process.cwd(), pulled.dir) || ".";
+  const shown3 = relative7(process.cwd(), pulled.dir) || ".";
   ctx.log.success(
-    `Pulled ${name}${path3 ? ` /${path3}/` : ""} into ${shown2} ${chalk12.dim(`(${pulled.fileCount} files, ${formatBytes(pulled.totalBytes)}, version ${pulled.versionId})`)}`
+    `Pulled ${name}${path3 ? ` /${path3}/` : ""} into ${shown3} ${chalk13.dim(`(${pulled.fileCount} files, ${formatBytes(pulled.totalBytes)}, version ${pulled.versionId})`)}`
   );
   ctx.out.data(
     pulled,
-    () => chalk12.dim(
-      `Change what you need, then \`${ctx.binName} deploy ${shown2}\`: it publishes on version ${pulled.versionId}, and stops if someone publishes ${name} before you do.`
+    () => chalk13.dim(
+      `Change what you need, then \`${ctx.binName} deploy ${shown3}\`: it publishes on version ${pulled.versionId}, and stops if someone publishes ${name} before you do.`
     )
   );
 }
 
 // src/commands/setup.ts
 import { intro, outro, spinner } from "@clack/prompts";
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 var SCOPES = ["user", "project", "local"];
 async function runSetup(baseCtx, opts, deps = {}) {
   const scope = opts.scope ?? "user";
@@ -7928,14 +8706,14 @@ async function runSetup(baseCtx, opts, deps = {}) {
     ...baseCtx,
     log: createLogger({
       debug: baseCtx.config.debug,
-      write: (line) => process.stderr.write(`${chalk13.gray("\u2502")}  ${line}
+      write: (line) => process.stderr.write(`${chalk14.gray("\u2502")}  ${line}
 `)
     })
   } : baseCtx;
   if (fancy) {
     process.stderr.write(`${logo()}
 `);
-    intro(chalk13.bold(" fling setup "), { output: process.stderr });
+    intro(chalk14.bold(" fling setup "), { output: process.stderr });
   }
   const login = await stepLogin(ctx, opts.url);
   const results = {
@@ -7949,7 +8727,7 @@ async function runSetup(baseCtx, opts, deps = {}) {
   const failed = Object.values(results).includes("failed");
   if (fancy)
     outro(
-      failed ? chalk13.yellow("Setup finished with problems \u2014 see above, then run `fling setup` again.") : `You're set. Try ${chalk13.bold(`${ctx.binName} deploy ./dist`)}, or ask Claude to \u201Cfling this\u201D.`,
+      failed ? chalk14.yellow("Setup finished with problems \u2014 see above, then run `fling setup` again.") : `You're set. Try ${chalk14.bold(`${ctx.binName} deploy ./dist`)}, or ask Claude to \u201Cfling this\u201D.`,
       { output: process.stderr }
     );
   ctx.out.data(results, () => "");
@@ -7972,7 +8750,7 @@ async function signIn(ctx, serverUrl) {
     try {
       const me = await whoami(requireClient(ctx));
       if (ctx.config.remembered) await ctx.store.setCurrent(serverUrl);
-      ctx.log.success(`Signed in as ${chalk13.bold(me.name)} ${chalk13.dim(`<${me.email}>`)}`);
+      ctx.log.success(`Signed in as ${chalk14.bold(me.name)} ${chalk14.dim(`<${me.email}>`)}`);
       if (ctx.config.remembered)
         await fetchInstance(serverUrl, ctx.fetch).then((instance) => ctx.store.putServer(serverUrl, { instance }, { makeCurrent: false })).catch(() => {
         });
@@ -7996,7 +8774,7 @@ async function signIn(ctx, serverUrl) {
 async function stepClaudeCode(ctx, run, scope, ask, fancy) {
   const status = await claudeCodeStatus(run);
   if (status.claude === "missing") {
-    ctx.log.info(`Claude Code not found ${chalk13.dim("(no `claude` on your PATH) \u2014 skipped")}`);
+    ctx.log.info(`Claude Code not found ${chalk14.dim("(no `claude` on your PATH) \u2014 skipped")}`);
     ctx.log.hint(
       `Once it is installed, run \`${ctx.binName} setup\` again, or in Claude Code: /plugin marketplace add ${MARKETPLACE_SOURCE} then /plugin install ${PLUGIN_ID}`
     );
@@ -8004,7 +8782,7 @@ async function stepClaudeCode(ctx, run, scope, ask, fancy) {
   }
   if ("installed" in status && status.installed) return refreshPlugin(ctx, run, status, fancy);
   if (ask && !await ctx.confirm("Install the Fling plugin (skill + MCP server) into Claude Code?")) {
-    ctx.log.info(chalk13.dim("Claude Code plugin: skipped"));
+    ctx.log.info(chalk14.dim("Claude Code plugin: skipped"));
     return "skipped";
   }
   const s = fancy ? spinner({ output: process.stderr }) : null;
@@ -8017,7 +8795,7 @@ async function stepClaudeCode(ctx, run, scope, ask, fancy) {
     else ctx.log.error(message);
     return "failed";
   }
-  const done = `Claude Code plugin ${PLUGIN_NAME} installed ${chalk13.dim(`(${scope} scope)`)}`;
+  const done = `Claude Code plugin ${PLUGIN_NAME} installed ${chalk14.dim(`(${scope} scope)`)}`;
   if (s) s.stop(done);
   else ctx.log.success(done);
   ctx.log.hint("Restart Claude Code (or run /reload-plugins) to pick it up.");
@@ -8030,14 +8808,14 @@ async function refreshPlugin(ctx, run, before, fancy) {
     await updatePlugin(run, before.scope);
   } catch (error) {
     const message = `${error instanceof Error ? error.message : String(error)} \u2014 the installed plugin${before.version ? ` (${before.version})` : ""} is unchanged`;
-    if (s) s.stop(chalk13.yellow(message));
+    if (s) s.stop(chalk14.yellow(message));
     else ctx.log.warn(message);
     return "already";
   }
   const after = await claudeCodeStatus(run).catch(() => null);
   const version = after && "installed" in after && after.installed ? after.version : void 0;
   const unchanged = before.version !== void 0 && version === before.version;
-  const done = unchanged ? `Claude Code plugin ${PLUGIN_NAME} is up to date ${chalk13.dim(`(${version})`)}` : before.version && version ? `Claude Code plugin ${PLUGIN_NAME} updated from ${before.version} to ${version}` : `Claude Code plugin ${PLUGIN_NAME} updated${version ? ` to ${version}` : ""}`;
+  const done = unchanged ? `Claude Code plugin ${PLUGIN_NAME} is up to date ${chalk14.dim(`(${version})`)}` : before.version && version ? `Claude Code plugin ${PLUGIN_NAME} updated from ${before.version} to ${version}` : `Claude Code plugin ${PLUGIN_NAME} updated${version ? ` to ${version}` : ""}`;
   if (s) s.stop(done);
   else ctx.log.success(done);
   if (unchanged) return "already";
@@ -8048,7 +8826,7 @@ async function stepClaudeDesktop(ctx, deps, ask, fancy) {
   const app = await (deps.findClaudeDesktop ?? findClaudeDesktop)();
   if (!app) return "missing";
   if (ask && !await ctx.confirm("Add the Fling extension to Claude Desktop too?")) {
-    ctx.log.info(chalk13.dim("Claude Desktop extension: skipped"));
+    ctx.log.info(chalk14.dim("Claude Desktop extension: skipped"));
     return "skipped";
   }
   const s = fancy ? spinner({ output: process.stderr }) : null;
@@ -8082,7 +8860,7 @@ async function stepClaudeDesktop(ctx, deps, ask, fancy) {
 }
 
 // src/commands/sites.ts
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 async function runList(ctx, opts) {
   const sites = await listSites(requireClient(ctx), opts);
   ctx.out.data(
@@ -8118,12 +8896,12 @@ async function runListShared(ctx, opts) {
   );
 }
 var accessLabel = (site) => ACCESS_LABELS[siteAccessLevel(site)];
-var row = (label, value) => `${chalk14.bold(`${label}:`.padEnd(14))}${value}`;
+var row = (label, value) => `${chalk15.bold(`${label}:`.padEnd(14))}${value}`;
 function describeSite(site) {
   return [
     row("Name", site.name),
     row("URL", site.url),
-    row("Access", accessLabel(site) + (site.archived ? chalk14.yellow(" (archived)") : "")),
+    row("Access", accessLabel(site) + (site.archived ? chalk15.yellow(" (archived)") : "")),
     row("SPA", site.spa ? "yes" : "no"),
     row("Share link", site.shareUrl ?? "-"),
     row("Version", site.currentVersionId ?? "-"),
@@ -8152,7 +8930,7 @@ function filesRow(site) {
 var membersOf = (ctx) => ctx.config.instance ? privateAudience(ctx.config.instance) : "anyone signed in to this Fling";
 async function runInfo(ctx, name) {
   const site = await getSite(requireClient(ctx), name);
-  const access3 = site.audience && audiencesEnabled(ctx.config.instance) ? [`${chalk14.bold("Who:".padEnd(14))}${describeAudience(site, membersOf(ctx))}`] : [];
+  const access3 = site.audience && audiencesEnabled(ctx.config.instance) ? [`${chalk15.bold("Who:".padEnd(14))}${describeAudience(site, membersOf(ctx))}`] : [];
   ctx.out.data(
     site,
     () => [
@@ -8160,13 +8938,14 @@ async function runInfo(ctx, name) {
       ...access3,
       ...rolesRows(site),
       "",
-      chalk14.dim(
+      chalk15.dim(
         `${site.versions.length} version(s) \u2014 \`fling versions ${name}\`; files \u2014 \`fling files ${name}\``
       )
     ].join("\n")
   );
 }
-async function runVersions(ctx, name) {
+async function runVersions(ctx, name, opts = {}) {
+  if (opts.path !== void 0) return runPathVersions(ctx, name, pathFolder2(opts.path));
   const site = await getSite(requireClient(ctx), name);
   ctx.out.data(
     { name: site.name, currentVersionId: site.currentVersionId, versions: site.versions },
@@ -8181,14 +8960,36 @@ async function runVersions(ctx, name) {
     ])
   );
 }
-async function runFiles(ctx, name, versionId) {
-  const result = await versionFiles(requireClient(ctx), name, versionId);
+async function runPathVersions(ctx, name, folder) {
+  const path3 = await getPath(await pathsClient(ctx), name, folder);
+  ctx.out.data(
+    {
+      name,
+      path: path3.folder,
+      currentVersionId: path3.currentVersionId,
+      versions: path3.versions
+    },
+    () => renderTable(path3.versions, [
+      { header: "", value: (v) => v.id === path3.currentVersionId ? "*" : " " },
+      { header: "VERSION", value: (v) => v.id },
+      { header: "FILES", value: (v) => v.fileCount },
+      { header: "SIZE", value: (v) => formatBytes(v.totalBytes) },
+      { header: "BY", value: (v) => v.publishedBy ?? "-" },
+      { header: "CREATED", value: (v) => formatDate(v.createdAt) }
+    ])
+  );
+}
+async function runFiles(ctx, name, versionId, opts = {}) {
+  const folder = opts.path === void 0 ? void 0 : pathFolder2(opts.path);
+  const result = folder === void 0 ? await versionFiles(requireClient(ctx), name, versionId) : await pathVersionFiles(await pathsClient(ctx), name, folder, versionId);
   if (!result.files.some((f) => f.path === "index.html")) {
-    ctx.log.warn("No index.html at the root \u2014 the site root URL will 404");
+    ctx.log.warn(
+      folder === void 0 ? "No index.html at the root \u2014 the site root URL will 404" : `No index.html in /${folder}/ \u2014 it will 404`
+    );
   }
   ctx.out.data(result, () => {
     const n = result.files.length;
-    const header = chalk14.dim(
+    const header = chalk15.dim(
       `${result.versionId}${result.current ? " (current)" : " (not served)"} \u2014 ${n} file${n === 1 ? "" : "s"}, ${formatBytes(result.totalBytes)}${result.generatedIndex ? ", generated index.html" : ""}`
     );
     const table = renderTable(result.files, [
@@ -8200,7 +9001,16 @@ async function runFiles(ctx, name, versionId) {
 ${table}`;
   });
 }
-async function runRollback(ctx, name, versionId) {
+async function runRollback(ctx, name, versionId, opts = {}) {
+  if (opts.path !== void 0) {
+    const folder = pathFolder2(opts.path);
+    const path3 = await rollbackPath(await pathsClient(ctx), name, folder, versionId);
+    ctx.log.success(
+      `/${folder}/ of ${name} now serves version ${path3.currentVersionId ?? versionId} (the rest of the site untouched)`
+    );
+    ctx.out.data(path3, () => path3.url);
+    return;
+  }
   const site = await rollback(requireClient(ctx), name, versionId);
   ctx.log.success(`${name} now serves version ${site.currentVersionId ?? versionId}`);
   ctx.out.data(site, () => site.url);
@@ -8224,7 +9034,7 @@ async function runShare(ctx, name, opts) {
     ctx.log.success("Share link created \u2014 anyone with it can view the site");
   ctx.out.data(
     ready === void 0 ? result : { ...result, ready },
-    () => result.shareUrl ? result.shareUrl : chalk14.dim("(no share link)")
+    () => result.shareUrl ? result.shareUrl : chalk15.dim("(no share link)")
   );
 }
 async function runVisibility(ctx, name, visibility) {
@@ -8287,6 +9097,7 @@ async function runSetLevel(ctx, name, level, opts) {
   ctx.out.data({ ...site, warnings }, () => describeAudience(site, membersOf(ctx)));
 }
 async function runRoles(ctx, which, name, opts) {
+  if (opts.path !== void 0) return runPathRoles(ctx, which, name, pathFolder2(opts.path), opts);
   const instance = await loadInstanceWith(ctx.store, ctx.config, ctx.fetch, "siteRoles");
   if (instance && !siteRolesEnabled(instance)) {
     throw new CliError(`${instance.name} has no site owners and publishers yet`, {
@@ -8312,6 +9123,23 @@ async function runRoles(ctx, which, name, opts) {
     () => describeRoles(site)
   );
 }
+async function runPathRoles(ctx, which, name, folder, opts) {
+  const client = await pathsClient(ctx);
+  const change = {
+    ...opts.set ? { set: splitEmails(opts.set) } : {},
+    add: splitEmails(opts.add ?? []),
+    remove: splitEmails(opts.remove ?? []),
+    addGroups: splitGroups(opts.group ?? []),
+    removeGroups: splitGroups(opts.removeGroup ?? [])
+  };
+  const changed = changesAudience(change);
+  const path3 = changed ? await setPathRoles(client, name, folder, which, change) : await getPathRoles(client, name, folder);
+  if (changed) ctx.log.success(`The ${which} of /${folder}/ of ${name} changed`);
+  ctx.out.data(
+    { name, path: path3.folder, owners: path3.owners, publishers: path3.publishers },
+    () => `/${path3.folder}/: ${describeRoles(path3)}`
+  );
+}
 async function runArchive(ctx, name, unarchive = false) {
   const site = await archiveSite(requireClient(ctx), name, { unarchive });
   ctx.log.success(
@@ -8336,15 +9164,15 @@ async function runRemove(ctx, name, opts) {
 }
 
 // src/mcp.ts
-import { mkdir as mkdir5, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir5, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile8 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename3, dirname as dirname4, join as join12, resolve as resolvePath } from "node:path";
+import { basename as basename3, dirname as dirname4, join as join13, resolve as resolvePath } from "node:path";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z20 } from "zod";
 
 // src/locate.ts
-import { lstat, readdir as readdir3, readFile as readFile11, realpath as realpath4, stat as stat8 } from "node:fs/promises";
+import { lstat, readdir as readdir3, readFile as readFile12, realpath as realpath4, stat as stat9 } from "node:fs/promises";
 import { posix, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 var DOWNLOADS_DIR_ENV = "FLING_DOWNLOADS_DIR";
@@ -8357,7 +9185,7 @@ var SANDBOX_PATH_RE = /^\/(mnt\/user-data|mnt\/data|sessions|home\/claude|tmp\/o
 var nodeFs = {
   async stat(path3) {
     try {
-      const s = await stat8(path3);
+      const s = await stat9(path3);
       return { isFile: s.isFile(), isDirectory: s.isDirectory(), mtimeMs: s.mtimeMs, size: s.size };
     } catch {
       return null;
@@ -8369,7 +9197,7 @@ var nodeFs = {
       const out = [];
       for (const e of entries) {
         if (e.isSymbolicLink()) {
-          const s = await stat8(`${path3}/${e.name}`).catch(() => null);
+          const s = await stat9(`${path3}/${e.name}`).catch(() => null);
           out.push({ name: e.name, isFile: Boolean(s?.isFile()), isDirectory: false });
         } else out.push({ name: e.name, isFile: e.isFile(), isDirectory: e.isDirectory() });
       }
@@ -8384,7 +9212,7 @@ var nodeFs = {
   async readText(path3) {
     try {
       if (!(await lstat(path3)).isFile()) return null;
-      return await readFile11(path3, "utf8");
+      return await readFile12(path3, "utf8");
     } catch {
       return null;
     }
@@ -8800,8 +9628,8 @@ function createMcpServer(deps = {}) {
     inputSchema: { ...def.inputSchema, server: serverArg },
     annotations: def.annotations
   });
-  async function edgeReady(url, paths) {
-    const r = await waitReady(url, paths).catch(() => ({ ready: false, waitedMs: 0 }));
+  async function edgeReady(url, paths2) {
+    const r = await waitReady(url, paths2).catch(() => ({ ready: false, waitedMs: 0 }));
     return {
       ready: r.ready,
       note: r.ready ? "" : `
@@ -8862,10 +9690,10 @@ Not reachable yet at ${url}: ${NOT_READY_NOTE}.`
     return instance;
   }
   async function publishFolder2(target2, raw) {
-    const folder = normalizePublishPath(raw);
+    const folder = normalizePathFolder(raw);
     if (folder === null) {
       throw new CliError(
-        `Invalid path "${raw}": use a folder of the site, like "30-10-26" or "reports/2026" (no dotfiles)`
+        `Invalid path "${raw}": use one top-level folder of the site, like "PAY-412" (no dotfiles, at most ${MAX_PATH_FOLDER_LENGTH} characters)`
       );
     }
     const instance = await loadInstanceWith(store, target2.config, fetchImpl, "pathPublish");
@@ -8884,6 +9712,23 @@ Not reachable yet at ${url}: ${NOT_READY_NOTE}.`
       );
     }
   }
+  async function pathOn(target2, raw) {
+    const folder = normalizePathFolder(raw);
+    if (folder === null) {
+      throw new CliError(
+        `"${raw}" is not a Path: give one top-level folder of the site, like "PAY-412"`
+      );
+    }
+    await requirePaths(target2);
+    return folder;
+  }
+  async function requirePaths(target2) {
+    const instance = await loadInstanceWith(store, target2.config, fetchImpl, "paths");
+    if (instance && !pathsEnabled(instance)) {
+      throw new CliError(`${instance.name} (${serverLabel(target2.url)}) has no Paths`);
+    }
+    return instance;
+  }
   async function linkedServer(path3) {
     try {
       const located = await resolveInput(path3, locate);
@@ -8920,9 +9765,6 @@ ${JSON.stringify(data, null, 2)}`);
     if (opts.access) await requireAccessLevels(t2);
     const link = opts.link ?? null;
     if (link && !opts.force || opts.base !== void 0) await requirePull(t2);
-    if (opts.base !== void 0 && opts.folder !== void 0) {
-      throw new CliError("Pass `base` or `path`, not both");
-    }
     const folder = opts.folder === void 0 ? void 0 : await publishFolder2(t2, opts.folder);
     const shownFolder = folder ?? link?.path;
     const inFolder = (file) => shownFolder === void 0 ? file : `${shownFolder}/${file}`;
@@ -8933,17 +9775,17 @@ ${JSON.stringify(data, null, 2)}`);
 ${l}.`).join("");
     let generatedIndex = false;
     const asItIs = link !== null || opts.base !== void 0;
-    if (!asItIs && !hasRootIndex(local)) {
+    if (!asItIs && !hasRootIndex(local, (await t2.instance())?.capabilities.markdown === true)) {
       const pages = htmlPages(local).map((f) => f.path);
       if (pages.length > 0 && opts.listHtml === void 0) {
-        const shown2 = pages.slice(0, 20);
+        const shown3 = pages.slice(0, 20);
         return {
           kind: "needs_decision",
           summary: `Not published yet: there is no index.html ${top}, but there ${pages.length === 1 ? "is 1 HTML page" : `are ${pages.length} HTML pages`}. Ask the user whether to generate an index.html listing them (call again with \`listHtml: true\`) or to publish without one (\`listHtml: false\` \u2014 the root URL will 404, the pages still work at their own paths). Then call ${opts.retryWith} again with the same arguments plus \`listHtml\`.`,
           data: {
             status: "needs_decision",
-            htmlPages: shown2,
-            ...pages.length > shown2.length ? { moreHtmlPages: pages.length - shown2.length } : {},
+            htmlPages: shown3,
+            ...pages.length > shown3.length ? { moreHtmlPages: pages.length - shown3.length } : {},
             fileCount: local.files.length
           }
         };
@@ -8955,7 +9797,7 @@ ${l}.`).join("");
     }
     const onBase = link && !opts.force ? onLink(link, local) : null;
     const changes = link ? onLink(link, local).changes : null;
-    const layered = folder !== void 0 || onBase !== null || opts.base !== void 0;
+    const layered = onBase !== null || opts.base !== void 0;
     let instance = await t2.instance();
     const forms2 = await planForms({
       dir,
@@ -8965,7 +9807,8 @@ ${l}.`).join("");
       // A Fling whose stored metadata predates forms is asked again before a forms file is refused.
       instance: formsEnabled(instance) ? instance : await loadInstanceWith(store, t2.config, fetchImpl, "forms"),
       bin: "fling",
-      ...opts.forms === void 0 ? {} : { inline: opts.forms }
+      ...opts.forms === void 0 ? {} : { inline: opts.forms },
+      ...shownFolder === void 0 ? {} : { path: shownFolder }
     });
     const result = await deploy(
       { client: t2.client, fetch: fetchImpl },
@@ -8973,10 +9816,9 @@ ${l}.`).join("");
         dir,
         name: opts.name,
         manifest: local,
-        path: folder,
+        path: folder ?? onBase?.path,
         ...onBase ? {
-          base: onBase.base,
-          ...onBase.partial ? { partial: true, remove: onBase.remove, within: onBase.within } : {}
+          base: onBase.base
         } : opts.base !== void 0 ? { base: opts.base, partial: true, remove: opts.remove ?? [] } : {},
         spa: opts.spa,
         ...opts.access ? {
@@ -8999,7 +9841,7 @@ ${l}.`).join("");
       );
     });
     if (link) await writeSiteLink(dir, linkAfter(link, result.versionId, local, forms2.sha256));
-    const what = result.status === "unchanged" ? "Unchanged \u2014 already live" : result.status === "repointed" ? `Restored version ${result.versionId}` : changes && link ? `Deployed ${describeChanges(changes)} since version ${link.versionId}${link.path === void 0 ? "" : ` in /${link.path}/`} (uploaded ${result.uploaded})` : opts.base !== void 0 ? `Published ${result.fileCount} changed or added file${result.fileCount === 1 ? "" : "s"} on version ${opts.base} (the rest of the site kept as it was)` : `Deployed ${result.fileCount} files${folder === void 0 ? "" : ` to /${folder}/ (the rest of the site kept as it was)`} (uploaded ${result.uploaded})`;
+    const what = result.status === "unchanged" ? "Unchanged \u2014 already live" : result.status === "repointed" ? `Restored version ${result.versionId}` : changes && link ? `Deployed ${describeChanges(changes)} since version ${link.versionId}${link.path === void 0 ? "" : ` in /${link.path}/`} (uploaded ${result.uploaded})` : opts.base !== void 0 ? `Published ${result.fileCount} changed or added file${result.fileCount === 1 ? "" : "s"} on version ${opts.base} (the rest kept as it was)` : `Deployed ${result.fileCount} files${folder === void 0 ? "" : ` to the Path /${folder}/ (the rest of the site untouched)`} (uploaded ${result.uploaded})`;
     const warnings = result.warnings.length ? `
 Warnings:
 - ${result.warnings.join("\n- ")}` : "";
@@ -9010,13 +9852,14 @@ Warnings:
     const url = shownFolder === void 0 ? result.url : new URL(`${shownFolder}/`, result.url).href;
     instance = await t2.instance();
     const review = instance && commentsEnabled(instance) ? reviewUrl(instance.appOrigin, result.name) : void 0;
+    const onPath2 = shownFolder !== void 0;
     let formsSummary = forms2.check?.summary ?? null;
-    if (!formsSummary && forms2.send === void 0 && formsEnabled(instance)) {
+    if (!formsSummary && !onPath2 && forms2.send === void 0 && formsEnabled(instance)) {
       const live = await getForms(t2.client, result.name).catch(() => null);
       if (live?.config) formsSummary = checkFormsConfig(live.config).summary;
     }
     const responsesPage = formsSummary && instance ? responsesPageUrl(instance.appOrigin, result.name) : void 0;
-    const formsHint2 = formsEnabled(instance) && !formsSummary ? FORMS_HINT : void 0;
+    const formsHint2 = formsEnabled(instance) && !formsSummary && !onPath2 ? FORMS_HINT : void 0;
     const formsText = formsSummary && responsesPage ? `
 ${describeFormsSummary(formsSummary, responsesPage)}` : "";
     const listing2 = generatedIndex ? " \u2014 with a generated index.html listing the HTML pages" : "";
@@ -9030,7 +9873,7 @@ Who can open it: ${who} ${accessChangeHint("mcp", result.name, { invites: instan
 Its access is unchanged (deploying never changes it for an existing site): ${who} ${accessChangeHint("mcp", result.name, { invites: instance?.capabilities.invites === true })}` : "";
     return {
       kind: "deployed",
-      summary: `${head}${access4}${warnings}${skippedNote}${edge.note}${onFling(t2.url, instance)}
+      summary: `${head}${access4}${warnings}${describePublishHints(result.hints)}${skippedNote}${edge.note}${onFling(t2.url, instance)}
 To check exactly which files the site has, call fling_files with name "${result.name}".` + (formsHint2 ? `
 ${formsHint2}` : ""),
       data: {
@@ -9094,7 +9937,7 @@ ${formsHint2}` : ""),
           "Site name (lowercase letters, digits, single hyphens; max 50). Defaults to a name generated from the file or folder"
         ),
         sitePath: z20.string().min(1).max(1024).optional().describe(
-          'Publish into this folder of the site only, e.g. "30-10-26" (served at <site>/30-10-26/), keeping every other file of the site. Needs `name`. Omit to replace the whole site'
+          'Publish as the Path at this top-level folder of the site, e.g. "PAY-412" (served at <site>/PAY-412/); the rest of the site is untouched. Needs `name`. Omit to publish the site itself'
         ),
         spa: spa2,
         access: access3,
@@ -9119,7 +9962,9 @@ ${formsHint2}` : ""),
           "`sitePath` needs `name`: the site to publish into. Ask the user which site, then call fling_deploy again"
         );
       }
-      const prepared = await prepareInput(located.path);
+      const prepared = await prepareInput(located.path, {
+        markdown: (await t2.instance())?.capabilities.markdown === true
+      });
       try {
         const found = prepared.kind === "folder" ? await readSiteLink(prepared.dir) : null;
         const link = found && (args.name === void 0 || args.name === found.name) && args.sitePath === void 0 && found.server === t2.url ? found : null;
@@ -9173,7 +10018,7 @@ ${formsHint2}` : ""),
         versionId: z20.string().min(1).max(100).optional().describe(
           "Another version than the live one (owners and publishers; ids from fling_info)"
         ),
-        path: z20.string().min(1).max(1024).optional().describe('Only this folder of the site, e.g. "30-10-26"'),
+        path: z20.string().min(1).max(1024).optional().describe('Only this Path of the site, e.g. "PAY-412"'),
         force: z20.boolean().optional().describe("Write into the folder even if it is not empty"),
         server: serverArg
       },
@@ -9181,13 +10026,13 @@ ${formsHint2}` : ""),
     },
     (args) => run("fling_pull", args.server, async (t2) => {
       await requirePull(t2);
-      const path3 = args.path === void 0 ? void 0 : normalizePublishPath(args.path);
+      const path3 = args.path === void 0 ? void 0 : normalizePathFolder(args.path);
       if (path3 === null) {
         throw new CliError(
-          `Invalid path "${args.path}": use a folder of the site, like "30-10-26" (no dotfiles)`
+          `Invalid path "${args.path}": use one of the site's Paths, like "PAY-412"`
         );
       }
-      const dir = args.dir === void 0 ? join12(locate.home, "Documents", "Claude", "fling", args.name) : resolvePath(cwd, args.dir);
+      const dir = args.dir === void 0 ? join13(locate.home, "Documents", "Claude", "fling", args.name) : resolvePath(cwd, args.dir);
       const pulled = await pullSite(
         { client: t2.client, fetch: fetchImpl },
         {
@@ -9209,20 +10054,23 @@ ${formsHint2}` : ""),
     serverTool(mcpTools2.readFiles),
     (args) => run(mcpTools2.readFiles.name, args.server, async (t2) => {
       await requirePull(t2);
-      const path3 = args.path === void 0 ? void 0 : normalizePublishPath(args.path);
-      if (path3 === null) throw new CliError(`Invalid path "${args.path}"`);
+      const path3 = args.path === void 0 ? void 0 : normalizePathFolder(args.path);
+      if (path3 === null)
+        throw new CliError(`Invalid path "${args.path}": use one of the site's Paths`);
       const pulled = await t2.client.request(
         "GET",
         `/api/sites/${encodeURIComponent(args.name)}/pull`,
         { schema: PullResponseSchema, query: { version: args.versionId, path: path3 } }
       );
-      const { page, tooLarge, missing, nextCursor } = pageOfFiles(pulled.files, {
+      const prefix = path3 === void 0 ? "" : `${path3}/`;
+      const within2 = pulled.files.map((f) => ({ ...f, path: f.path.slice(prefix.length) }));
+      const { page: page2, tooLarge, missing, nextCursor } = pageOfFiles(within2, {
         paths: args.paths,
         cursor: args.cursor,
         budget: MCP_READ_MAX_BYTES
       });
       const read = await Promise.all(
-        page.map(async ({ url, ...f }) => {
+        page2.map(async ({ url, ...f }) => {
           const res = await fetchImpl(url);
           if (!res.ok) throw new CliError(`Could not read ${f.path}: HTTP ${res.status}`);
           return { ...f, ...encodeForAgent(f.path, new Uint8Array(await res.arrayBuffer())) };
@@ -9235,6 +10083,7 @@ ${formsHint2}` : ""),
       const result = {
         name: args.name,
         versionId: pulled.versionId,
+        ...path3 === void 0 ? {} : { path: path3 },
         files,
         missing,
         ...nextCursor ? { nextCursor } : {}
@@ -9293,7 +10142,7 @@ ${JSON.stringify(data, null, 2)}`);
       }
       if (args.files.length === 0 && !args.remove?.length)
         throw new CliError("No files to publish");
-      const tmp = await mkdtemp3(join12(tmpdir3(), "fling-publish-"));
+      const tmp = await mkdtemp3(join13(tmpdir3(), "fling-publish-"));
       try {
         const { skippedDotfiles } = await writeInlineFiles(tmp, args.files);
         return await deployFolder(t2, tmp, {
@@ -9540,6 +10389,10 @@ ${lines}` : ""}`,
     t.info.name,
     serverTool(t.info),
     (args) => run(t.info.name, args.server, async (target2) => {
+      if (args.path !== void 0) {
+        const path3 = await getPath(target2.client, args.name, await pathOn(target2, args.path));
+        return { summary: describePathDetail(args.name, path3), data: { name: args.name, ...path3 } };
+      }
       const site = await getSite(target2.client, args.name);
       const access4 = site.audience ? `
 ${describeAudience(site, await membersOn(target2))}` : "";
@@ -9556,8 +10409,19 @@ ${describeRoles(site)}` : "";
   server.registerTool(
     t.files.name,
     serverTool(t.files),
-    (args) => run(t.files.name, args.server, async ({ client }) => {
-      const result = await versionFiles(client, args.name, args.versionId);
+    (args) => run(t.files.name, args.server, async (target2) => {
+      if (args.path !== void 0) {
+        const folder = await pathOn(target2, args.path);
+        const result2 = await pathVersionFiles(target2.client, args.name, folder, args.versionId);
+        return {
+          summary: describeVersionFiles(`${args.name} /${folder}/`, result2, {
+            current: result2.current,
+            url: result2.url
+          }),
+          data: result2
+        };
+      }
+      const result = await versionFiles(target2.client, args.name, args.versionId);
       return {
         summary: describeVersionFiles(result.name, result, {
           current: result.current,
@@ -9781,14 +10645,76 @@ ${describeGroups(groups3, me.email)}`,
   server.registerTool(
     t.rollback.name,
     serverTool(t.rollback),
-    (args) => run(t.rollback.name, args.server, async ({ client }) => {
-      const site = await rollback(client, args.name, args.versionId);
+    (args) => run(t.rollback.name, args.server, async (target2) => {
+      if (args.path !== void 0) {
+        const folder = await pathOn(target2, args.path);
+        const path3 = await rollbackPath(target2.client, args.name, folder, args.versionId);
+        return {
+          summary: `/${folder}/ of ${args.name} now serves version ${path3.currentVersionId}: ${path3.url} (the rest of the site untouched)`,
+          data: { name: args.name, ...path3 }
+        };
+      }
+      const site = await rollback(target2.client, args.name, args.versionId);
       return {
         summary: `${site.name} now serves version ${site.currentVersionId}: ${site.url}`,
         data: site
       };
     })
   );
+  if (servers.some((s) => pathsEnabled(s.instance))) {
+    server.registerTool(
+      t.paths.name,
+      serverTool(t.paths),
+      (args) => run(t.paths.name, args.server, async (target2) => {
+        const instance = await requirePaths(target2);
+        const paths2 = await listPaths(target2.client, args.name);
+        return {
+          summary: `${describePaths(args.name, paths2)}${onFling(target2.url, instance)}`,
+          data: { name: args.name, paths: paths2 }
+        };
+      })
+    );
+  }
+  server.registerTool(
+    t.pathsTemplate.name,
+    {
+      title: t.pathsTemplate.title,
+      description: `${t.pathsTemplate.description} To deploy a folder with it, save it as the folder's index.html.`,
+      inputSchema: t.pathsTemplate.inputSchema,
+      annotations: t.pathsTemplate.annotations
+    },
+    async (args) => {
+      try {
+        const html = pathsTemplate(args.template, { title: args.title });
+        return textResult(
+          `A starter "${args.template}" home page with its Paths block in place. Adapt it to what the user wants while keeping the block, check it with fling_paths_check, then publish it as the site's root index.html (without \`path\`), or save it as index.html at the top of a folder to deploy.
+
+` + html
+        );
+      } catch (error) {
+        return failure(error);
+      }
+    }
+  );
+  server.registerTool(
+    t.pathsCheck.name,
+    {
+      title: t.pathsCheck.title,
+      description: t.pathsCheck.description,
+      inputSchema: t.pathsCheck.inputSchema,
+      annotations: t.pathsCheck.annotations
+    },
+    async (args) => {
+      try {
+        const check2 = checkPathsIndex(args.html);
+        return textResult(`${describePathsCheck(check2)}
+
+${JSON.stringify(check2, null, 2)}`);
+      } catch (error) {
+        return failure(error);
+      }
+    }
+  );
   if (servers.some((s) => commentsEnabled(s.instance))) {
     async function reviewOn(target2) {
       const instance = await target2.instance();
@@ -10048,9 +10974,9 @@ async function writeInlineFiles(dir, files) {
     total += bytes.length;
     if (total > MAX_DEPLOY_BYTES)
       throw new CliError(`The site is larger than ${formatBytes(MAX_DEPLOY_BYTES)}`);
-    const target = join12(dir, ...path3.split("/"));
+    const target = join13(dir, ...path3.split("/"));
     await mkdir5(dirname4(target), { recursive: true });
-    await writeFile7(target, bytes);
+    await writeFile8(target, bytes);
   }
   if (secretFiles.length > 0) throw new SecretFilesError(secretFiles);
   return { skippedDotfiles };
@@ -10094,10 +11020,10 @@ async function runMcpServer(deps = {}) {
 }
 
 // src/route.ts
-import { stat as stat9 } from "node:fs/promises";
-import { resolve as resolve6 } from "node:path";
+import { stat as stat10 } from "node:fs/promises";
+import { resolve as resolve7 } from "node:path";
 var PASS_THROUGH = /* @__PURE__ */ new Set(["-h", "--help", "-V", "--version"]);
-var pathExists = (path3) => stat9(resolve6(path3)).then(
+var pathExists = (path3) => stat10(resolve7(path3)).then(
   () => true,
   () => false
 );
@@ -10148,18 +11074,18 @@ program.name(BIN_NAME).description("Fling a folder of static files at Fling and
   `server for this command: a URL, or the host of one you signed in to (default: $${ENV.url}, else the current one)`
 ).option("--json", "print JSON instead of human output", false).showHelpAfterError().configureHelp({
   sortSubcommands: false,
-  styleTitle: (title) => chalk15.bold(brand.primary(title)),
-  styleCommandText: (text2) => chalk15.bold(text2),
+  styleTitle: (title) => chalk16.bold(brand.primary(title)),
+  styleCommandText: (text2) => chalk16.bold(text2),
   styleSubcommandText: (text2) => brand.accent(text2),
   styleOptionText: (text2) => brand.accent(text2),
-  styleArgumentText: (text2) => chalk15.dim(text2)
+  styleArgumentText: (text2) => chalk16.dim(text2)
 }).addHelpText(
   "before",
   () => process.stdout.isTTY ? logo({ columns: process.stdout.columns }) : ""
 ).addHelpText(
   "after",
   () => `
-${chalk15.bold(brand.primary("Examples:"))}
+${chalk16.bold(brand.primary("Examples:"))}
   $ ${BIN_NAME} login https://fling.example.com  sign in to your Fling (once; there is no default)
   $ ${BIN_NAME} setup                      sign in and add Fling to Claude Code / Claude Desktop
   $ ${BIN_NAME} use                        list the Flings you signed in to; \`use <url>\` switches
@@ -10170,7 +11096,7 @@ ${chalk15.bold(brand.primary("Examples:"))}
   $ ${BIN_NAME} site.zip                   a zip of a site
   $ ${BIN_NAME} share my-app               public link for people who can't sign in
 
-${chalk15.dim(`Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
+${chalk16.dim(`Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
 Env:        ${ENV.apiKey} \xB7 ${ENV.url} \xB7 ${ENV.configDir} \xB7 ${ENV.debug}`)}`
 );
 function action(handler) {
@@ -10195,7 +11121,7 @@ function report(error, ctx) {
   if (error instanceof CliError && error.hint) log.hint(error.hint);
   if (ctx?.config.debug && error instanceof Error && error.stack) log.hint(error.stack);
   if (ctx?.json) {
-    const { code, findings, paths } = error;
+    const { code, findings, paths: paths2 } = error;
     process.stdout.write(
       `${formatJson({
         error: {
@@ -10203,7 +11129,7 @@ function report(error, ctx) {
           exitCode: exitCodeFor(error),
           ...typeof code === "string" ? { code } : {},
           ...Array.isArray(findings) ? { findings } : {},
-          ...Array.isArray(paths) ? { paths } : {}
+          ...Array.isArray(paths2) ? { paths: paths2 } : {}
         }
       })}
 `
@@ -10217,7 +11143,7 @@ program.command("deploy [path]").helpGroup("Deploy:").description(
   "site name \u2014 names are global, first come first served (default: generated from the project and folder, e.g. rocketpod-docs; you confirm it on a terminal)"
 ).option(
   "--path <folder>",
-  "publish into this folder of the site (e.g. 30-10-26, served at <site>/30-10-26/) and keep the rest of the site; needs --name"
+  "publish the folder as the Path at this top-level folder of the site (e.g. PAY-412, served at <site>/PAY-412/), with its own versions, owners and publishers; the rest of the site is untouched; one folder, not nested; needs --name (see `paths`)"
 ).option("--spa", "single-page app: serve index.html for unknown paths").option(
   "--access <level>",
   "who can open a new site: only_me, members (everyone signed in), groups, people or public (default: the Fling's, usually only_me). A deployed site keeps its access: see `access`"
@@ -10240,7 +11166,7 @@ program.command("pull <name> [dir]").helpGroup("Deploy:").description(
 ).option(
   "--version-id <id>",
   "another version than the live one (owners and publishers; ids from `versions`)"
-).option("--path <folder>", "only this folder of the site (e.g. 30-10-26), at the top of dir").option("--force", "write into dir even if it is not empty").action(
+).option("--path <folder>", "only this Path of the site (e.g. PAY-412), at the top of dir").option("--force", "write into dir even if it is not empty").action(
   action(
     (ctx, name, dir, opts) => runPull(ctx, name, dir, opts)
   )
@@ -10284,11 +11210,20 @@ program.command("ls").helpGroup("Sites:").alias("list").description("list your s
   )
 );
 program.command("info <name>").helpGroup("Sites:").description("show a site").action(action((ctx, name) => runInfo(ctx, name)));
-program.command("versions <name>").helpGroup("Sites:").description("list a site's versions (* = live)").action(action((ctx, name) => runVersions(ctx, name)));
-program.command("files <name> [versionId]").helpGroup("Sites:").description("list the files in a site's live version (or in versionId)").action(
-  action((ctx, name, versionId) => runFiles(ctx, name, versionId))
+program.command("versions <name>").helpGroup("Sites:").description("list a site's versions (* = live)").option("--path <folder>", "one of the site's Paths (e.g. PAY-412): list its own versions").action(action((ctx, name, opts) => runVersions(ctx, name, opts)));
+program.command("files <name> [versionId]").helpGroup("Sites:").description("list the files in a site's live version (or in versionId)").option("--path <folder>", "one of the site's Paths (e.g. PAY-412): the files of its version").action(
+  action(
+    (ctx, name, versionId, opts) => runFiles(ctx, name, versionId, opts)
+  )
+);
+program.command("rollback <name> <versionId>").helpGroup("Sites:").description("serve an earlier version again").option(
+  "--path <folder>",
+  "one of the site's Paths (e.g. PAY-412): roll back only it (ids from `versions --path`)"
+).action(
+  action(
+    (ctx, name, versionId, opts) => runRollback(ctx, name, versionId, opts)
+  )
 );
-program.command("rollback <name> <versionId>").helpGroup("Sites:").description("serve an earlier version again").action(action((ctx, name, versionId) => runRollback(ctx, name, versionId)));
 program.command("share <name>").helpGroup("Sites:").description("print (or create) a public share link \u2014 anyone with it can view the site").option("--refresh", "replace the link; the old one stops working").option("--revoke", "remove the link").action(
   action(
     (ctx, name, opts) => runShare(ctx, name, opts)
@@ -10328,7 +11263,10 @@ for (const [which, does] of [
   ).option("--add <emails...>", `add these addresses (members of this Fling only)`).option("--remove <emails...>", "take these addresses out").option("--set <emails...>", `make these addresses the whole list (groups stay)`).option(
     "--group <slugs...>",
     "add these groups (see `fling groups`); whoever manages a group decides who is in it"
-  ).option("--remove-group <slugs...>", "take these groups out").action(
+  ).option("--remove-group <slugs...>", "take these groups out").option(
+    "--path <folder>",
+    `one of the site's Paths (e.g. PAY-412): its own ${which}, besides the site's owners`
+  ).action(
     action(
       (ctx, name, opts) => runRoles(ctx, which, name, opts)
     )
@@ -10337,6 +11275,36 @@ for (const [which, does] of [
 program.command("archive <name>").helpGroup("Sites:").description("take a site offline (404) but keep its files; undo with unarchive").action(action((ctx, name) => runArchive(ctx, name)));
 program.command("unarchive <name>").helpGroup("Sites:").description("bring an archived site back").action(action((ctx, name) => runArchive(ctx, name, true)));
 program.command("rm <name>").helpGroup("Sites:").alias("delete").description("delete a site and all its versions (asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(action((ctx, name, opts) => runRemove(ctx, name, opts)));
+var paths = program.command("paths").helpGroup("Paths:").description(
+  "a site's top-level folders published on their own (`deploy --path`), each with its own versions and owners (default: list)"
+);
+paths.command("list <name>", { isDefault: true }).alias("ls").description(
+  "list a site's Paths (`paths <name>`): folder, title, version, state, whether you can publish, updated"
+).action(action((ctx, name) => runPaths(ctx, name)));
+paths.command("archive <name> <folder>").description("take a Path off the site (404) but keep its versions; undo with `paths unarchive`").action(action((ctx, name, folder) => runPathArchive(ctx, name, folder)));
+paths.command("unarchive <name> <folder>").description("bring an archived Path back").action(action((ctx, name, folder) => runPathArchive(ctx, name, folder, true)));
+paths.command("delete <name> <folder>").alias("rm").description("delete a Path and all its versions (asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(
+  action(
+    (ctx, name, folder, opts) => runPathDelete(ctx, name, folder, opts)
+  )
+);
+paths.command("init [dir]").description(
+  "write a starter home page (index.html) listing the Paths into dir (default: .), to deploy as the site root"
+).addOption(
+  new Option("-t, --template <name>", "how it lists them").choices(PATHS_TEMPLATE_NAMES).default("minimal")
+).option("--title <title>", "the page's title and heading").option("--force", "replace an existing index.html").addHelpText(
+  "after",
+  () => `
+Templates:
+${PATHS_TEMPLATE_NAMES.map((n) => `  ${n.padEnd(8)} ${PATHS_TEMPLATE_DESCRIPTIONS[n]}`).join("\n")}
+
+${pathsHomeChoice(BIN_NAME).join("\n")}`
+).action(
+  action(
+    (ctx, dir, opts) => runPathsInit(ctx, dir, opts)
+  )
+);
+paths.command("check [path]").description("check a home page's Paths block: a folder's index.html (default: .) or a file").action(action((ctx, path3) => runPathsCheck(ctx, path3)));
 var groups = program.command("groups").helpGroup("Groups:").description(
   "named lists of people anyone can use in an audience; only the owner changes one (default: list)"
 );