@netlify/spark-ui 1.29.0 → 1.31.0-alpha.1

package/dist/components/articleCopyActions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Wire up the "Copy URL" / "Copy page" buttons rendered by ArticleCopyActions.astro.
+ *
+ * This runs on every `astro:page-load` (initial load *and* every client-side
+ * navigation via `<ClientRouter />`), so the buttons keep working after routing
+ * to another article/post. Each wrapper is guarded so re-initialising the same
+ * DOM node never attaches duplicate listeners.
+ */
+export declare function initArticleCopyActions(root?: ParentNode): void;

package/dist/components/articleCopyActions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/components/index.d.ts

@@ -5,6 +5,6 @@ export { default as SearchLink } from './preact/SearchModal/components/SearchLin
 export { default as SearchHeading } from './preact/SearchModal/components/SearchHeading/SearchHeading';
 export { default as SearchToggle } from './preact/SearchModal/components/SearchToggle/SearchToggle';
 export { default as SearchModal } from './preact/SearchModal/components/SearchModal/SearchModal';
-export { DropZone, AnonymousDropClient, deployFiles, readDataTransfer, readFileList, } from './preact/DropZone';
-export type { DropClient, DropResponse, Digest, DeployResult, DeployProgress, DeployPhase, ProcessedFile, } from './preact/DropZone';
+export { DropZone, AnonymousDropClient, AuthenticatedBuildClient, AuthenticatedDropClient, deployBuild, deployFiles, detectBuild, inferBuildSettings, readDataTransfer, readFileList, zipFiles, } from './preact/DropZone';
+export type { AuthenticatedBuildClientConfig, AuthenticatedDropClientConfig, BuildClient, BuildDeployResult, BuildDetection, BuildSite, DeployedBuild, DeployedSite, DropClient, DropResponse, Digest, DeployResult, DeployProgress, DeployPhase, InferredBuildSettings, ProcessedFile, } from './preact/DropZone';
 export { type IconName } from './preact/Icon';

package/dist/components/preact/DropZone/DropZone.d.ts

@@ -1,6 +1,6 @@
 import { ComponentChildren } from 'preact';
-import { BuildDetection, DropClient } from './drop-core';
-import { DeployedSite, DeployError, TrackFn } from './useDropDeploy';
+import { BuildClient, BuildDetection, DropClient } from './drop-core';
+import { DeployedBuild, DeployedSite, DeployError, TrackFn } from './useDropDeploy';
 interface Props {
     /** Content the drop layer sits on top of. The zone is invisible until you drag over it. */
     children?: ComponentChildren;
@@ -10,23 +10,81 @@ interface Props {
     client?: DropClient;
     /** Build the "claim this site" URL from the assigned site name (subdomain). */
     claimUrl?: (siteName: string) => string;
+    /**
+     * Where an authenticated static deploy sends the visitor — the site already
+     * lives in their account, so there is no claim step. Defaults to the new
+     * site's project overview on app.netlify.com.
+     */
+    siteDashboardUrl?: (siteName: string) => string;
     /**
      * Where to send a build-required drop (framework source, build command,
-     * functions) when `onBuildRequired` isn't set. Such projects can't deploy
-     * through the anonymous static drop API, so by default the user is redirected
-     * here — the app signup page with `next=/drop` — to build on the
-     * authenticated Drop page. Override to point at your own destination.
+     * functions) that can't be built here — no `getUploadToken`/`buildClient`, or a
+     * visitor who isn't logged in. Such projects can't deploy through the anonymous
+     * static drop API, so by default the user is redirected here — the app signup
+     * page with `next=/drop` — to build on the authenticated Drop page. Override to
+     * point at your own destination.
      */
     buildSignupUrl?: string;
     /**
-     * Called when a build-required drop is detected, instead of the default
-     * `buildSignupUrl` redirect. Use it to own the hand-off yourself (custom
-     * routing, persisting the drop, gating on auth). When set, the component does
-     * not redirect. The static drop path is unaffected either way.
+     * Mint a short-lived bearer token for direct api.netlify.com uploads — pass it
+     * to switch on the whole authenticated path for logged-in visitors: static
+     * drops deploy straight into their account (then `siteDashboardUrl`), and
+     * build-required drops build in place instead of being handed off to the app.
+     * On netlify.com this reads `GET /access-control/generate-access-control-token`.
+     * Resolving `null` means "no session": static drops fall back to the anonymous
+     * claim flow, build drops to `buildSignupUrl`.
+     * See [Logged-in visitors](#logged-in-visitors).
+     */
+    getUploadToken?: () => Promise<string | null>;
+    /**
+     * Inject a custom `BuildClient` (tests, staging, a different account flow).
+     * Takes precedence over `getUploadToken` for the build path.
+     */
+    buildClient?: BuildClient;
+    /**
+     * Inject a custom authenticated `DropClient` for static drops (tests, staging,
+     * a different account flow). Takes precedence over `getUploadToken` for the
+     * static path. Distinct from `client`, which is the anonymous fallback.
+     */
+    authenticatedDropClient?: DropClient;
+    /**
+     * API root for the authenticated paths' JSON calls, which go through your
+     * access-control rewrite so the session cookie authorizes them. Defaults to
+     * `/access-control/bb-api/api/v1`. (Uploads always go direct to
+     * `api.netlify.com` — the proxy can't carry bodies that large.)
+     */
+    proxyBase?: string;
+    /** Create the visitor's new project in this account. Omit for their default account. */
+    accountSlug?: string;
+    /**
+     * Where an enqueued build sends the visitor. Defaults to the new site's
+     * project overview, same as a static deploy; `build.deployId` is available for
+     * consumers who want the deploy-log page instead.
+     */
+    buildDeployUrl?: (build: DeployedBuild) => string;
+    /**
+     * Poll until the build finishes before handing off, instead of redirecting as
+     * soon as it's enqueued. The trade-off: waiting means a failing build surfaces
+     * its own error message here (via `onError` and the overlay) rather than the
+     * visitor discovering it on the deploy page — at the cost of holding them on a
+     * spinner for the length of the build, which is minutes. Off by default.
+     */
+    waitForBuild?: boolean;
+    /**
+     * Called when a build-required drop is detected, instead of building it or
+     * redirecting. Use it to own the hand-off yourself (custom routing, persisting
+     * the drop, gating on auth). When set, the component neither builds nor
+     * redirects. The static drop path is unaffected either way.
      */
     onBuildRequired?: (info: BuildDetection) => void;
     /** Called once the deploy is live. */
     onDeploy?: (result: DeployedSite) => void;
+    /**
+     * Called once a build-required drop has been zipped, uploaded and enqueued —
+     * before the redirect to `buildDeployUrl`. The site exists at this point but
+     * won't serve content until the build finishes.
+     */
+    onBuildDeploy?: (build: DeployedBuild) => void;
     /**
      * Called when a deploy fails, with a humanized `message` (ready to show a
      * user — the same copy the built-in overlay uses) and the raw `reason`. Pair
@@ -46,11 +104,22 @@ interface Props {
      * properties. Stays provider-agnostic — wire it to Segment/Amplitude/GA in the
      * consuming app, e.g. `onTrack={(name, props) => new Analytics().track(name, props)}`.
      * Emitted events (all include `dropzone_id` when `analyticsId` is set):
-     * - `dropzone_files_dropped`  — files dropped via drag  ({ method: 'drag', file_count })
+     * - `dropzone_files_dropped`  — files dropped via drag  ({ method: 'drag', file_count, file_types })
      * - `dropzone_browse_opened`  — file picker opened       ({ method: 'keyboard' | 'click' })
-     * - `dropzone_build_required` — drop needs a build; handed off to signup ({ method, reason, file_count })
-     * - `dropzone_deploy_succeeded` — deploy went live       ({ method, site_name, file_count })
-     * - `dropzone_deploy_failed`  — deploy errored out       ({ method, reason, file_count? })
+     * - `dropzone_build_required` — drop needs a build (built here, or handed off) ({ method, reason, file_count, file_types })
+     * - `dropzone_deploy_succeeded` — static deploy went live ({ method, site_name, file_count, authenticated, auth_fallback?, file_types })
+     * - `dropzone_build_deploy_succeeded` — build enqueued for a logged-in visitor ({ method, reason, site_name, file_count, framework?, file_types })
+     * - `dropzone_deploy_failed`  — deploy or build errored out ({ method, reason, file_count?, file_types })
+     *
+     * `authenticated` says whether the deploy landed in the visitor's account;
+     * `auth_fallback: true` is sent only when an authenticated attempt bounced
+     * (stale auth hint) and the drop completed anonymously — omitted otherwise.
+     * `file_types` is the sorted, de-duplicated list of MIME types in the
+     * selection, with `application/octet-stream` standing in wherever the browser
+     * reports none (a dragged folder, an `.exe`). It is omitted when the browser
+     * exposes no files at all. Note `dropzone_files_dropped` only fires for drag —
+     * a file-picker selection reports its types on the outcome events, as
+     * `dropzone_browse_opened` fires before any file exists.
      */
     onTrack?: TrackFn;
     /**
@@ -61,5 +130,5 @@ interface Props {
     analyticsId?: string;
     className?: string;
 }
-export default function DropZone({ children, apiBase, client, claimUrl, buildSignupUrl, onBuildRequired, onDeploy, onError, showStatus, onTrack, analyticsId, className, }: Props): import("preact").JSX.Element;
+export default function DropZone({ children, apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, getUploadToken, buildClient, authenticatedDropClient, proxyBase, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, showStatus, onTrack, analyticsId, className, }: Props): import("preact").JSX.Element;
 export {};

package/dist/components/preact/DropZone/DropZone.js

@@ -1,154 +1,186 @@
 import { u as e } from "../../../chunks/jsxRuntime.module.Bzuv3cXw.js";
-import { A as D, d as E, y as I } from "../../../chunks/hooks.module.DRcxknIz.js";
-import { readFileList as P, readDataTransfer as U } from "./drop-core/readFiles.js";
+import { A as j, d as G, y as K } from "../../../chunks/hooks.module.DRcxknIz.js";
+import { readFileList as L, readDataTransfer as Z } from "./drop-core/readFiles.js";
+import { getFileTypes as D } from "./drop-core/fileTypes.js";
 import "./drop-core/detectBuild.js";
-import { useDropDeploy as j } from "./useDropDeploy.js";
-import { Fragment as k } from "preact";
-import '../../../assets/DropZone.css';const B = 120, F = (n) => `https://app.netlify.com/drop/${n}`, M = "https://app.netlify.com/signup?next=/drop&utm_campaign=drop";
-function H({
-  children: n,
-  apiBase: l,
-  client: i,
-  claimUrl: s = F,
-  buildSignupUrl: u = M,
-  onBuildRequired: w,
-  onDeploy: A,
-  onError: C,
+import "./drop-core/zip.js";
+import { useDropDeploy as q } from "./useDropDeploy.js";
+import { Fragment as w } from "preact";
+import '../../../assets/DropZone.css';const H = 120, J = (r) => `https://app.netlify.com/drop/${r}`, Q = (r) => `https://app.netlify.com/projects/${r}`, W = "https://app.netlify.com/signup?next=/drop&utm_campaign=drop", X = ({ siteName: r }) => `https://app.netlify.com/projects/${r}`;
+function ce({
+  children: r,
+  apiBase: a,
+  client: l,
+  claimUrl: c = J,
+  siteDashboardUrl: u = Q,
+  buildSignupUrl: A = W,
+  getUploadToken: T,
+  buildClient: C,
+  authenticatedDropClient: S,
+  proxyBase: _,
+  accountSlug: $,
+  buildDeployUrl: B = X,
+  waitForBuild: U,
+  onBuildRequired: P,
+  onDeploy: R,
+  onBuildDeploy: x,
+  onError: E,
   showStatus: f = !0,
-  onTrack: c,
+  onTrack: d,
   analyticsId: g,
-  className: T
+  className: F
 }) {
-  const h = (r, t = {}) => c == null ? void 0 : c(r, g ? { dropzone_id: g, ...t } : t), { status: a, warning: m, busy: o, deploy: v, reset: _ } = j({
-    apiBase: l,
-    client: i,
-    claimUrl: s,
-    buildSignupUrl: u,
-    onBuildRequired: w,
-    onDeploy: A,
-    onError: C,
-    track: h
-  }), { active: p, keepActive: S, endDrag: R } = N(), b = D(null), y = (r) => {
-    var t;
-    h("dropzone_browse_opened", { method: r }), (t = b.current) == null || t.click();
-  }, $ = f && (p || o || a.kind === "error"), x = [
+  const y = (t, n = {}) => d == null ? void 0 : d(t, g ? { dropzone_id: g, ...n } : n), { status: s, warning: b, busy: i, deploy: m, reset: I } = q({
+    apiBase: a,
+    client: l,
+    claimUrl: c,
+    siteDashboardUrl: u,
+    buildSignupUrl: A,
+    getUploadToken: T,
+    buildClient: C,
+    authenticatedDropClient: S,
+    proxyBase: _,
+    accountSlug: $,
+    buildDeployUrl: B,
+    waitForBuild: U,
+    onBuildRequired: P,
+    onDeploy: R,
+    onBuildDeploy: x,
+    onError: E,
+    track: y
+  }), { active: p, keepActive: M, endDrag: N } = Y(), h = j(null), v = (t) => {
+    var n;
+    y("dropzone_browse_opened", { method: t }), (n = h.current) == null || n.click();
+  }, O = f && (p || i || s.kind === "error"), V = [
     "n-dropzone",
     p && "is-active",
-    o && "is-busy",
+    i && "is-busy",
     !f && "is-bare",
-    T
+    F
   ].filter(Boolean).join(" ");
   return /* @__PURE__ */ e(
     "div",
     {
-      class: x,
-      "data-state": a.kind,
+      class: V,
+      "data-state": s.kind,
       role: "button",
-      tabIndex: o ? -1 : 0,
+      tabIndex: i ? -1 : 0,
       "aria-label": "Drop a site folder or zip here to deploy it, or press Enter to browse for files",
-      "aria-busy": o,
-      onDragOver: (r) => {
-        o || (r.preventDefault(), S());
+      "aria-busy": i,
+      onDragOver: (t) => {
+        i || (t.preventDefault(), M());
       },
-      onDrop: (r) => {
-        if (r.preventDefault(), R(), o) return;
-        const t = r.dataTransfer;
-        t && v(() => U(t), "drag");
+      onDrop: (t) => {
+        if (t.preventDefault(), N(), i) return;
+        const n = t.dataTransfer;
+        n && m(() => Z(n), "drag", D(n.files));
       },
-      onClick: (r) => {
-        !o && r.target === r.currentTarget && y("click");
+      onClick: (t) => {
+        !i && t.target === t.currentTarget && v("click");
       },
-      onKeyDown: (r) => {
-        o || (r.key === "Enter" || r.key === " ") && (r.preventDefault(), y("keyboard"));
+      onKeyDown: (t) => {
+        i || (t.key === "Enter" || t.key === " ") && (t.preventDefault(), v("keyboard"));
       },
       children: [
-        /* @__PURE__ */ e("div", { class: "n-dropzone-content", children: n }),
+        /* @__PURE__ */ e("div", { class: "n-dropzone-content", children: r }),
         /* @__PURE__ */ e(
           "input",
           {
-            ref: b,
+            ref: h,
             type: "file",
             hidden: !0,
             multiple: !0,
             webkitdirectory: "",
             directory: "",
-            onChange: (r) => {
-              var z;
-              const t = r.currentTarget;
-              (z = t.files) != null && z.length && v(() => P(t.files), "browse"), t.value = "";
+            onChange: (t) => {
+              var k;
+              const n = t.currentTarget;
+              if ((k = n.files) != null && k.length) {
+                const z = n.files;
+                m(() => L(z), "browse", D(z));
+              }
+              n.value = "";
             }
           }
         ),
-        $ && /* @__PURE__ */ e(
+        O && /* @__PURE__ */ e(
           "div",
           {
             class: "n-dropzone-overlay n-fadeIn",
             children: [
-              /* @__PURE__ */ e(O, { status: a, active: p, onReset: _ }),
-              m && a.kind !== "error" && o && /* @__PURE__ */ e("p", { class: "n-dropzone-warning", role: "status", children: m })
+              /* @__PURE__ */ e(ee, { status: s, active: p, onReset: I }),
+              b && s.kind !== "error" && i && /* @__PURE__ */ e("p", { class: "n-dropzone-warning", role: "status", children: b })
             ]
           },
-          a.kind === "idle" ? "active" : a.kind
+          s.kind === "idle" ? "active" : s.kind
         )
       ]
     }
   );
 }
-function N() {
-  const [n, l] = E(!1), i = D();
-  return I(() => () => clearTimeout(i.current), []), { active: n, keepActive: () => {
-    l(!0), clearTimeout(i.current), i.current = setTimeout(() => l(!1), B);
+function Y() {
+  const [r, a] = G(!1), l = j();
+  return K(() => () => clearTimeout(l.current), []), { active: r, keepActive: () => {
+    a(!0), clearTimeout(l.current), l.current = setTimeout(() => a(!1), H);
   }, endDrag: () => {
-    clearTimeout(i.current), l(!1);
+    clearTimeout(l.current), a(!1);
   } };
 }
-function O({
-  status: n,
-  active: l,
-  onReset: i
+function ee({
+  status: r,
+  active: a,
+  onReset: l
 }) {
-  switch (n.kind) {
+  switch (r.kind) {
     // Idle-but-active means a drag is hovering the zone.
     case "idle":
-      return l ? /* @__PURE__ */ e("p", { class: "n-dropzone-hint", children: "Drop to deploy" }) : null;
+      return a ? /* @__PURE__ */ e("p", { class: "n-dropzone-hint", children: "Drop to deploy" }) : null;
     case "reading":
-      return /* @__PURE__ */ e(d, { label: "Reading files…" });
+      return /* @__PURE__ */ e(o, { label: "Reading files…" });
+    case "zipping":
+      return /* @__PURE__ */ e(o, { label: "Packaging your project…" });
     case "creating":
-      return /* @__PURE__ */ e(d, { label: "Creating deploy…" });
+      return /* @__PURE__ */ e(o, { label: "Creating deploy…" });
     case "processing":
-      return /* @__PURE__ */ e(d, { label: "Processing — almost live…" });
+      return /* @__PURE__ */ e(o, { label: "Processing — almost live…" });
+    case "building":
+      return /* @__PURE__ */ e(o, { label: "Building your project…" });
     case "redirecting":
-      return /* @__PURE__ */ e(
-        d,
-        {
-          label: n.target === "signup" ? "This project needs a build — taking you to Netlify…" : "Site’s live — taking you to claim it…"
-        }
-      );
+      switch (r.target) {
+        case "signup":
+          return /* @__PURE__ */ e(o, { label: "This project needs a build — taking you to Netlify…" });
+        case "build":
+          return /* @__PURE__ */ e(o, { label: "Build started — taking you to your new project…" });
+        case "claim":
+          return /* @__PURE__ */ e(o, { label: "Site’s live — taking you to claim it…" });
+        case "dashboard":
+          return /* @__PURE__ */ e(o, { label: "Site’s live — taking you to your new project…" });
+      }
     case "uploading": {
-      const s = n.total ? Math.round(n.uploaded / n.total * 100) : 0;
-      return /* @__PURE__ */ e(k, { children: [
-        /* @__PURE__ */ e(d, { label: `Uploading ${n.uploaded}/${n.total} files…` }),
-        /* @__PURE__ */ e("div", { class: "n-dropzone-progress", role: "progressbar", "aria-valuenow": s, children: /* @__PURE__ */ e("div", { class: "n-dropzone-progress-bar", style: { width: `${s}%` } }) })
+      const c = r.total ? Math.round(r.uploaded / r.total * 100) : 0;
+      return /* @__PURE__ */ e(w, { children: [
+        /* @__PURE__ */ e(o, { label: `Uploading ${r.uploaded}/${r.total} files…` }),
+        /* @__PURE__ */ e("div", { class: "n-dropzone-progress", role: "progressbar", "aria-valuenow": c, children: /* @__PURE__ */ e("div", { class: "n-dropzone-progress-bar", style: { width: `${c}%` } }) })
       ] });
     }
     case "error":
-      return /* @__PURE__ */ e(k, { children: [
+      return /* @__PURE__ */ e(w, { children: [
         /* @__PURE__ */ e("p", { class: "n-dropzone-title n-dropzone-title--error", children: "Something went wrong" }),
-        /* @__PURE__ */ e("p", { class: "n-dropzone-subtitle", role: "alert", children: n.message }),
-        /* @__PURE__ */ e("button", { type: "button", class: "n-dropzone-browse", onClick: i, children: "Try again" })
+        /* @__PURE__ */ e("p", { class: "n-dropzone-subtitle", role: "alert", children: r.message }),
+        /* @__PURE__ */ e("button", { type: "button", class: "n-dropzone-browse", onClick: l, children: "Try again" })
       ] });
   }
 }
-function d({ label: n }) {
+function o({ label: r }) {
   return /* @__PURE__ */ e("div", { class: "n-dropzone-loading", children: [
     /* @__PURE__ */ e("span", { class: "n-dropzone-spinner", "aria-hidden": "true" }),
     /* @__PURE__ */ e("p", { class: "n-dropzone-subtitle", "aria-live": "polite", children: [
-      n,
+      r,
       " ",
       /* @__PURE__ */ e("span", { class: "n-dropzone-nudge", children: "Please don’t refresh." })
     ] })
   ] });
 }
 export {
-  H as default
+  ce as default
 };

package/dist/components/preact/DropZone/drop-core/authedDropClient.d.ts

@@ -0,0 +1,80 @@
+import { DropClient } from './client';
+import { Digest, DropResponse } from './types';
+export interface AuthenticatedDropClientConfig {
+    /**
+     * Base for JSON API calls, routed through the consumer's access-control
+     * rewrite so the session cookie authenticates them. On netlify.com that
+     * rewrite is `/access-control/*` → the app's access-control function, which
+     * makes `/access-control/bb-api/api/v1` the API root (the default here).
+     */
+    proxyBase?: string;
+    /**
+     * Direct API base for the per-file uploads. The proxy above runs in a Lambda
+     * with a ~6MB request body limit, so file PUTs go straight to
+     * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
+     */
+    apiBase?: string;
+    /**
+     * Mint a short-lived bearer token for those direct uploads. On netlify.com
+     * this is `GET /access-control/generate-access-control-token`, whose
+     * `accessControlToken` the API decrypts back into the user's access token.
+     * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
+     */
+    getUploadToken: () => Promise<string | null>;
+    /** Create the site in this account. Omit to use the user's default account. */
+    accountSlug?: string;
+    /** How often to re-read the deploy while waiting. Default 1s. */
+    pollIntervalMs?: number;
+    /** How long to wait before giving up on the deploy. Default 10 minutes. */
+    timeoutMs?: number;
+}
+/**
+ * Authenticated drop client for logged-in visitors. Unlike `AnonymousDropClient`
+ * — which creates an account-less site the visitor must later claim — this
+ * deploys straight into the visitor's account via the sites/deploys API,
+ * mirroring what app.netlify.com does for a logged-in drag-and-drop deploy.
+ * There is no claim step, so the caller should hand off to the site's dashboard
+ * page rather than the claim page.
+ *
+ * Requests split across two hosts by necessity: JSON calls go through the
+ * consumer's access-control proxy (cookie session, no token handling in the
+ * browser), while the per-file PUTs go direct to `api.netlify.com` with the
+ * short-lived bearer from `getUploadToken()` because the proxy can't carry
+ * large bodies.
+ *
+ * Error-mapping invariant: only pre-mutation failures — a null upload token, or
+ * a 401/403 creating the site — throw `NotAuthenticatedError`, which is the
+ * signal the drop flow may safely retry anonymously. Once the site exists, an
+ * auth failure throws a plain status-carrying error instead: falling back at
+ * that point would strand an empty site in the account *and* deploy a duplicate
+ * anonymously.
+ */
+export declare class AuthenticatedDropClient implements DropClient {
+    private proxyBase;
+    private apiBase;
+    private getUploadToken;
+    private accountSlug?;
+    private pollIntervalMs;
+    private timeoutMs;
+    constructor({ proxyBase, apiBase, getUploadToken, accountSlug, pollIntervalMs, timeoutMs, }: AuthenticatedDropClientConfig);
+    /**
+     * The token here is the upload bearer, not a drop token — it authorizes the
+     * direct-API file PUTs, while the proxied JSON calls ignore it and ride the
+     * session cookie. Minted once per deploy, before anything is created, so a
+     * missing session fails the whole attempt cleanly.
+     */
+    getToken(): Promise<string>;
+    /**
+     * Two proxied calls: create the site in the visitor's account, then the
+     * deploy on it. Mapped into the anonymous `DropResponse` shape so
+     * `deployFiles` runs unchanged over either client.
+     */
+    createDeploy(files: Digest, _token: string): Promise<DropResponse>;
+    uploadFile(deployId: string, path: string, content: ArrayBuffer, token: string): Promise<void>;
+    /**
+     * Poll the deploy through the proxy until it settles — the session cookie
+     * outlives the short-lived upload bearer, so a slow deploy can't expire its
+     * own poll. Resolve on `ready`, throw on `error`/`rejected`, throw on timeout.
+     */
+    waitUntilReady(deploy: DropResponse, _token: string): Promise<void>;
+}

package/dist/components/preact/DropZone/drop-core/authedDropClient.js

@@ -0,0 +1,99 @@
+var p = Object.defineProperty;
+var h = (n, t, s) => t in n ? p(n, t, { enumerable: !0, configurable: !0, writable: !0, value: s }) : n[t] = s;
+var r = (n, t, s) => h(n, typeof t != "symbol" ? t + "" : t, s);
+import { apiError as d } from "./client.js";
+import { NotAuthenticatedError as l, SiteCreateError as y } from "./errors.js";
+const u = "/access-control/bb-api/api/v1", w = "https://api.netlify.com/api/v1", f = 1e3, m = 10 * 60 * 1e3, T = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
+class g {
+  constructor({
+    proxyBase: t = u,
+    apiBase: s = w,
+    getUploadToken: i,
+    accountSlug: o,
+    pollIntervalMs: a = f,
+    timeoutMs: e = m
+  }) {
+    r(this, "proxyBase");
+    r(this, "apiBase");
+    r(this, "getUploadToken");
+    r(this, "accountSlug");
+    r(this, "pollIntervalMs");
+    r(this, "timeoutMs");
+    this.proxyBase = t, this.apiBase = s, this.getUploadToken = i, this.accountSlug = o, this.pollIntervalMs = a, this.timeoutMs = e;
+  }
+  /**
+   * The token here is the upload bearer, not a drop token — it authorizes the
+   * direct-API file PUTs, while the proxied JSON calls ignore it and ride the
+   * session cookie. Minted once per deploy, before anything is created, so a
+   * missing session fails the whole attempt cleanly.
+   */
+  async getToken() {
+    const t = await this.getUploadToken();
+    if (!t) throw new l();
+    return t;
+  }
+  /**
+   * Two proxied calls: create the site in the visitor's account, then the
+   * deploy on it. Mapped into the anonymous `DropResponse` shape so
+   * `deployFiles` runs unchanged over either client.
+   */
+  async createDeploy(t, s) {
+    const i = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", o = await fetch(`${this.proxyBase}${i}`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ created_via: "drop" })
+    });
+    if (o.status === 401 || o.status === 403) throw new l();
+    if (!o.ok) throw new y(o.status);
+    const a = await o.json(), e = await fetch(`${this.proxyBase}/sites/${a.id}/deploys`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ files: t, deploy_source: "drop" })
+    });
+    if (!e.ok) throw d("deploy create", e.status);
+    const c = await e.json();
+    return {
+      id: a.id,
+      deploy_id: c.id,
+      subdomain: a.name,
+      required: c.required ?? []
+    };
+  }
+  async uploadFile(t, s, i, o) {
+    const a = await fetch(`${this.apiBase}/deploys/${t}/files${s}`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/octet-stream", Authorization: `Bearer ${o}` },
+      body: i
+    });
+    if (!a.ok) throw d(`upload ${s}`, a.status);
+  }
+  /**
+   * Poll the deploy through the proxy until it settles — the session cookie
+   * outlives the short-lived upload bearer, so a slow deploy can't expire its
+   * own poll. Resolve on `ready`, throw on `error`/`rejected`, throw on timeout.
+   */
+  async waitUntilReady(t, s) {
+    const i = this.timeoutMs / this.pollIntervalMs;
+    for (let o = 0; o < i; o++) {
+      const a = await fetch(`${this.proxyBase}/deploys/${t.deploy_id}`, {
+        credentials: "include"
+      });
+      if (a.ok) {
+        const e = await a.json();
+        if (e.state && T.has(e.state)) {
+          if (e.state === "ready") return;
+          throw new Error(
+            e.error_message ? `deploy failed: ${e.error_message}` : "deploy failed"
+          );
+        }
+      }
+      await new Promise((e) => setTimeout(e, this.pollIntervalMs));
+    }
+    throw new Error("Deploy did not become ready in time");
+  }
+}
+export {
+  g as AuthenticatedDropClient
+};