@netlify/spark-ui 1.30.0 → 1.31.0-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/README.md +4 -3
  2. package/dist/chunks/browser.Ca2rTNTu.js +769 -0
  3. package/dist/components/articleCopyActions.d.ts +9 -0
  4. package/dist/components/articleCopyActions.test.d.ts +1 -0
  5. package/dist/components/index.d.ts +2 -2
  6. package/dist/components/preact/DropZone/DropZone.d.ts +69 -14
  7. package/dist/components/preact/DropZone/DropZone.js +109 -84
  8. package/dist/components/preact/DropZone/drop-core/authedDropClient.d.ts +77 -0
  9. package/dist/components/preact/DropZone/drop-core/authedDropClient.js +97 -0
  10. package/dist/components/preact/DropZone/drop-core/buildClient.d.ts +95 -0
  11. package/dist/components/preact/DropZone/drop-core/buildClient.js +92 -0
  12. package/dist/components/preact/DropZone/drop-core/client.d.ts +4 -0
  13. package/dist/components/preact/DropZone/drop-core/client.js +2 -1
  14. package/dist/components/preact/DropZone/drop-core/deploy.d.ts +31 -0
  15. package/dist/components/preact/DropZone/drop-core/deploy.js +36 -18
  16. package/dist/components/preact/DropZone/drop-core/detectBuild.d.ts +26 -0
  17. package/dist/components/preact/DropZone/drop-core/detectBuild.js +80 -53
  18. package/dist/components/preact/DropZone/drop-core/errors.d.ts +38 -0
  19. package/dist/components/preact/DropZone/drop-core/errors.js +50 -5
  20. package/dist/components/preact/DropZone/drop-core/index.d.ts +3 -0
  21. package/dist/components/preact/DropZone/drop-core/index.js +33 -18
  22. package/dist/components/preact/DropZone/drop-core/readFiles.js +1 -1
  23. package/dist/components/preact/DropZone/drop-core/types.d.ts +6 -1
  24. package/dist/components/preact/DropZone/drop-core/zip.d.ts +46 -0
  25. package/dist/components/preact/DropZone/drop-core/zip.js +43 -0
  26. package/dist/components/preact/DropZone/index.d.ts +3 -2
  27. package/dist/components/preact/DropZone/index.js +27 -11
  28. package/dist/components/preact/DropZone/useDropDeploy.d.ts +34 -4
  29. package/dist/components/preact/DropZone/useDropDeploy.js +138 -70
  30. package/dist/components/preact/index.d.ts +2 -1
  31. package/dist/components/preact/index.js +17 -12
  32. package/package.json +5 -2
  33. package/packages/components/ArticleCopyActions.astro +122 -0
  34. package/packages/components/articleCopyActions.test.ts +143 -0
  35. package/packages/components/articleCopyActions.ts +41 -0
  36. package/packages/components/index.ts +15 -0
  37. package/packages/components/preact/DropZone/DropZone.tsx +114 -20
  38. package/packages/components/preact/DropZone/drop-core/authedDropClient.ts +185 -0
  39. package/packages/components/preact/DropZone/drop-core/buildClient.ts +187 -0
  40. package/packages/components/preact/DropZone/drop-core/client.ts +1 -1
  41. package/packages/components/preact/DropZone/drop-core/deploy.ts +65 -0
  42. package/packages/components/preact/DropZone/drop-core/detectBuild.ts +125 -41
  43. package/packages/components/preact/DropZone/drop-core/errors.ts +84 -1
  44. package/packages/components/preact/DropZone/drop-core/index.ts +3 -0
  45. package/packages/components/preact/DropZone/drop-core/readFiles.ts +1 -1
  46. package/packages/components/preact/DropZone/drop-core/types.ts +12 -1
  47. package/packages/components/preact/DropZone/drop-core/zip.ts +118 -0
  48. package/packages/components/preact/DropZone/index.tsx +23 -0
  49. package/packages/components/preact/DropZone/useDropDeploy.ts +189 -30
  50. package/packages/components/preact/index.ts +2 -1
  51. package/dist/chunks/browser.D58rdxmc.js +0 -444
@@ -12,6 +12,67 @@ export class UnsupportedDropError extends Error {
12
12
  }
13
13
  }
14
14
 
15
+ /**
16
+ * Thrown when an authenticated path (static or build) turns out to have no
17
+ * usable session — the short-lived upload token came back empty, or the
18
+ * session-cookie site create was refused, so nothing was created. For static
19
+ * drops the flow falls back to the anonymous drop + claim; builds have no
20
+ * anonymous equivalent, so the consumer's only recourse is to send the visitor
21
+ * through login/signup and have them drop again.
22
+ */
23
+ export class NotAuthenticatedError extends Error {
24
+ constructor(message = 'not authenticated') {
25
+ super(message);
26
+ this.name = 'NotAuthenticatedError';
27
+ }
28
+ }
29
+
30
+ /** `POST …/sites` failed, so there is nothing to build into. Carries the HTTP status. */
31
+ export class SiteCreateError extends Error {
32
+ status?: number;
33
+
34
+ constructor(status?: number) {
35
+ super(`site create failed${status ? `: ${status}` : ''}`);
36
+ this.name = 'SiteCreateError';
37
+ this.status = status;
38
+ }
39
+ }
40
+
41
+ /**
42
+ * The multipart `POST /sites/{id}/builds` upload itself failed — the build never
43
+ * started. Distinct from `BuildFailedError`, which is a build that ran and broke.
44
+ */
45
+ export class BuildCreateError extends Error {
46
+ status?: number;
47
+
48
+ constructor(status?: number) {
49
+ super(`build create failed${status ? `: ${status}` : ''}`);
50
+ this.name = 'BuildCreateError';
51
+ this.status = status;
52
+ }
53
+ }
54
+
55
+ /**
56
+ * The build ran and ended in `error`/`rejected`. `reason` is the API's
57
+ * `error_message` when there is one — it's the only part of a build failure that
58
+ * says anything actionable (a failing build command, a missing dependency), so
59
+ * it is surfaced to the user rather than swallowed.
60
+ */
61
+ export class BuildFailedError extends Error {
62
+ constructor(public reason?: string) {
63
+ super(reason ? `build failed: ${reason}` : 'build failed');
64
+ this.name = 'BuildFailedError';
65
+ }
66
+ }
67
+
68
+ /** The build hadn't settled before the poller gave up. The build itself may still finish. */
69
+ export class BuildTimeoutError extends Error {
70
+ constructor() {
71
+ super('Build did not finish in time');
72
+ this.name = 'BuildTimeoutError';
73
+ }
74
+ }
75
+
15
76
  /**
16
77
  * Turn a raw deploy failure into copy a non-technical user can act on.
17
78
  * The original message is still tracked via analytics — this is only for display.
@@ -23,6 +84,26 @@ export function humanizeDropError(err: unknown): string {
23
84
  return 'To deploy, drop a folder or a .zip file — or a single HTML page.';
24
85
  }
25
86
 
87
+ if (err instanceof NotAuthenticatedError) {
88
+ return 'Please log in to Netlify to deploy a project that needs a build, then try again.';
89
+ }
90
+
91
+ if (err instanceof SiteCreateError) {
92
+ return "We couldn't create a project for this build. Please try again.";
93
+ }
94
+
95
+ // The build's own error message is the only actionable part of a build
96
+ // failure, so pass it straight through instead of a generic apology.
97
+ if (err instanceof BuildFailedError) {
98
+ return err.reason
99
+ ? `Your build failed: ${err.reason}`
100
+ : 'Your build failed. Check your build settings and try again.';
101
+ }
102
+
103
+ if (err instanceof BuildTimeoutError) {
104
+ return 'Your build is taking longer than expected. It may still finish — check your Netlify dashboard.';
105
+ }
106
+
26
107
  if (err.message === 'Deploy did not become ready in time') {
27
108
  return 'Your site is taking longer than expected to go live. Please try again in a moment.';
28
109
  }
@@ -31,7 +112,9 @@ export function humanizeDropError(err: unknown): string {
31
112
  return "Couldn't connect to Netlify. Check your internet connection and try again.";
32
113
  }
33
114
 
34
- // client.ts attaches `.status` to API failures — see apiError().
115
+ // client.ts attaches `.status` to API failures (see apiError()), as do the
116
+ // typed build errors above — so `BuildCreateError(413)` lands on the
117
+ // upload-too-large copy rather than a generic message.
35
118
  const status = 'status' in err && typeof err.status === 'number' ? err.status : undefined;
36
119
 
37
120
  switch (status) {
@@ -4,5 +4,8 @@ export * from './readFiles';
4
4
  export * from './fileTypes';
5
5
  export * from './detectBuild';
6
6
  export * from './client';
7
+ export * from './authedDropClient';
8
+ export * from './buildClient';
9
+ export * from './zip';
7
10
  export * from './deploy';
8
11
  export * from './errors';
@@ -123,7 +123,7 @@ async function readZip(zip: File): Promise<ProcessedFile[]> {
123
123
  // ArrayBuffer, so narrow it for toProcessedFile's ArrayBuffer parameter.
124
124
  const content = bytes.buffer.slice(
125
125
  bytes.byteOffset,
126
- bytes.byteOffset + bytes.byteLength,
126
+ bytes.byteOffset + bytes.byteLength
127
127
  ) as ArrayBuffer;
128
128
  out.push(toProcessedFile(path, content, path.split('/').pop()!));
129
129
  }
@@ -34,7 +34,18 @@ export interface DeployResult {
34
34
  url: string; // https://<subdomain>.netlify.app
35
35
  }
36
36
 
37
- export type DeployPhase = 'creating' | 'uploading' | 'processing' | 'ready';
37
+ /**
38
+ * Phases shared by both deploy paths. A static drop runs
39
+ * creating → uploading → processing → ready; a build drop runs
40
+ * zipping → creating → uploading → building → ready.
41
+ */
42
+ export type DeployPhase =
43
+ | 'zipping'
44
+ | 'creating'
45
+ | 'uploading'
46
+ | 'processing'
47
+ | 'building'
48
+ | 'ready';
38
49
 
39
50
  export interface DeployProgress {
40
51
  phase: DeployPhase;
@@ -0,0 +1,118 @@
1
+ import { inferBuildSettings, type InferredBuildSettings } from './detectBuild';
2
+ import type { ProcessedFile } from './types';
3
+
4
+ const NETLIFY_TOML_PATH = '/netlify.toml';
5
+
6
+ /** TOML basic-string escaping — enough for the two values we ever write. */
7
+ function escapeTomlString(value: string): string {
8
+ return value
9
+ .replace(/\\/g, '\\\\')
10
+ .replace(/"/g, '\\"')
11
+ .replace(/\n/g, '\\n')
12
+ .replace(/\r/g, '\\r')
13
+ .replace(/\t/g, '\\t');
14
+ }
15
+
16
+ /**
17
+ * Render inferred settings as a `[build]` table. Only `command` and `publish`
18
+ * are written: everything else (functions directory, plugins, node version)
19
+ * is zero-config on Netlify's side and guessing at it would override detection
20
+ * that is better informed than we are.
21
+ */
22
+ export function generateNetlifyToml({ command, publish }: InferredBuildSettings): string {
23
+ return [
24
+ '[build]',
25
+ ` command = "${escapeTomlString(command)}"`,
26
+ ` publish = "${escapeTomlString(publish)}"`,
27
+ '',
28
+ ].join('\n');
29
+ }
30
+
31
+ export interface ZipOptions {
32
+ /** Filename given to the produced `File`. Shows up as the build's source archive. */
33
+ name?: string;
34
+ /**
35
+ * Synthesise a `netlify.toml` `[build]` table from `inferBuildSettings` when the
36
+ * drop doesn't declare one (default `true`). Set `false` to upload the files
37
+ * exactly as dropped and let buildbot resolve every setting itself.
38
+ */
39
+ synthesizeNetlifyToml?: boolean;
40
+ }
41
+
42
+ export interface ZipResult {
43
+ /** The archive, ready to hand to `createBuildFromZip`. */
44
+ file: File;
45
+ /**
46
+ * The settings written into `netlify.toml`, or `null` when the archive is a
47
+ * faithful copy of the drop — either because it already declared a `[build]`
48
+ * table, or because nothing could be inferred with confidence.
49
+ */
50
+ buildSettings: InferredBuildSettings | null;
51
+ }
52
+
53
+ const encoder = new TextEncoder();
54
+ const decoder = new TextDecoder();
55
+
56
+ function toBytes(content: ArrayBuffer): Uint8Array {
57
+ return new Uint8Array(content);
58
+ }
59
+
60
+ /**
61
+ * Zip an already-read file set into the source archive that
62
+ * `POST /sites/{id}/builds` expects.
63
+ *
64
+ * The input is the same root-normalized `ProcessedFile[]` the static deploy path
65
+ * uses (see `readFiles`), so junk — dotfiles, `node_modules`, macOS metadata — is
66
+ * already gone and paths sit at the deploy root. Output directories (`dist/`,
67
+ * `build/`) are deliberately *not* stripped: buildbot regenerates them when
68
+ * there's a build command, and a drop whose `netlify.toml` publishes a committed
69
+ * directory without a command would break if we removed it.
70
+ *
71
+ * When the drop needs a build but declares no `[build]` table, an inferred one is
72
+ * written in (appended to an existing `netlify.toml`, or created if there is
73
+ * none) so buildbot doesn't publish the project's source. See
74
+ * `inferBuildSettings` for how conservative that inference is.
75
+ */
76
+ export async function zipFiles(
77
+ files: ProcessedFile[],
78
+ { name = 'source.zip', synthesizeNetlifyToml = true }: ZipOptions = {}
79
+ ): Promise<ZipResult> {
80
+ if (!files.length) throw new Error('No files to deploy');
81
+
82
+ const buildSettings = synthesizeNetlifyToml ? inferBuildSettings(files) : null;
83
+
84
+ const entries: Record<string, Uint8Array> = {};
85
+ for (const file of files) {
86
+ // fflate keys are paths relative to the archive root, so drop the leading
87
+ // slash `ProcessedFile.path` carries.
88
+ const path = file.path.replace(/^\//, '');
89
+ if (path) entries[path] = toBytes(file.content);
90
+ }
91
+
92
+ if (buildSettings) {
93
+ const existing = files.find(f => f.path === NETLIFY_TOML_PATH);
94
+ const table = generateNetlifyToml(buildSettings);
95
+ // Append rather than replace so the drop's own redirects, headers and
96
+ // environment survive alongside the synthesised build settings.
97
+ const contents = existing
98
+ ? `${decoder.decode(existing.content).replace(/\n*$/, '\n')}\n${table}`
99
+ : table;
100
+ entries['netlify.toml'] = encoder.encode(contents);
101
+ }
102
+
103
+ // fflate is loaded on demand — same as the unzip path in readFiles — so a
104
+ // consumer that never drops a build project never pays for it.
105
+ const { zip } = await import('fflate');
106
+ const bytes = await new Promise<Uint8Array>((resolve, reject) =>
107
+ zip(entries, { level: 6 }, (err, out) => (err ? reject(err) : resolve(out)))
108
+ );
109
+
110
+ // `bytes.buffer` is ArrayBufferLike; narrow it to the plain ArrayBuffer the
111
+ // File constructor takes, the same way readFiles does on the unzip side.
112
+ const archive = bytes.buffer.slice(
113
+ bytes.byteOffset,
114
+ bytes.byteOffset + bytes.byteLength
115
+ ) as ArrayBuffer;
116
+ const file = new File([archive], name, { type: 'application/zip' });
117
+ return { file, buildSettings };
118
+ }
@@ -1,20 +1,43 @@
1
1
  export { default as DropZone } from './DropZone';
2
2
  export {
3
3
  AnonymousDropClient,
4
+ AuthenticatedBuildClient,
5
+ AuthenticatedDropClient,
6
+ BuildCreateError,
7
+ BuildFailedError,
8
+ BuildTimeoutError,
9
+ deployBuild,
4
10
  deployFiles,
5
11
  detectBuild,
6
12
  getFileTypes,
13
+ humanizeDropError,
14
+ inferBuildSettings,
15
+ NotAuthenticatedError,
7
16
  readDataTransfer,
8
17
  readFileList,
18
+ SiteCreateError,
19
+ UnsupportedDropError,
20
+ zipFiles,
9
21
  } from './drop-core';
10
22
  export type {
23
+ AuthenticatedBuildClientConfig,
24
+ AuthenticatedDropClientConfig,
25
+ BuildClient,
26
+ BuildDeployOptions,
27
+ BuildDeployResult,
11
28
  BuildDetection,
12
29
  BuildReason,
30
+ BuildResponse,
31
+ BuildSite,
13
32
  DropClient,
14
33
  DropResponse,
15
34
  Digest,
16
35
  DeployResult,
17
36
  DeployProgress,
18
37
  DeployPhase,
38
+ InferredBuildSettings,
19
39
  ProcessedFile,
40
+ ZipOptions,
41
+ ZipResult,
20
42
  } from './drop-core';
43
+ export type { DeployedBuild, DeployedSite, DeployError, DeployStatus } from './useDropDeploy';
@@ -1,15 +1,22 @@
1
1
  import { useRef, useState } from 'preact/hooks';
2
2
  import {
3
3
  AnonymousDropClient,
4
+ AuthenticatedBuildClient,
5
+ AuthenticatedDropClient,
6
+ deployBuild,
4
7
  deployFiles,
5
8
  detectBuild,
6
9
  getSingleNonIndexHtmlFileName,
7
10
  hasMultipleHtmlFilesWithoutIndex,
8
11
  humanizeDropError,
12
+ NotAuthenticatedError,
9
13
  renameSingleNonIndexHtmlToIndex,
14
+ type BuildClient,
10
15
  type BuildDetection,
11
16
  type DeployProgress,
17
+ type DeployResult,
12
18
  type DropClient,
19
+ type InferredBuildSettings,
13
20
  type ProcessedFile,
14
21
  } from './drop-core';
15
22
 
@@ -19,9 +26,15 @@ export type DeploySource = 'drag' | 'browse';
19
26
  /** The live site handed back once a deploy succeeds. */
20
27
  export interface DeployedSite {
21
28
  url: string;
22
- token: string;
29
+ /**
30
+ * Drop claim token — only present for anonymous deploys. An authenticated
31
+ * deploy lands directly in the visitor's account, so there is nothing to claim.
32
+ */
33
+ token?: string;
23
34
  siteName: string;
24
35
  siteId: string;
36
+ /** True when the deploy landed directly in the visitor's account. */
37
+ authenticated: boolean;
25
38
  }
26
39
 
27
40
  /** A deploy failure, handed to `onError` so consumers can render their own error UI. */
@@ -32,16 +45,36 @@ export interface DeployError {
32
45
  reason: string;
33
46
  }
34
47
 
48
+ /** The build handed back once a build-required drop is enqueued. */
49
+ export interface DeployedBuild {
50
+ /** The site created for the build — live once the build finishes. */
51
+ url: string;
52
+ siteName: string;
53
+ siteId: string;
54
+ buildId: string;
55
+ /** The deploy the build produces, if the API has assigned one yet. */
56
+ deployId?: string;
57
+ /** Build settings synthesised into the uploaded `netlify.toml`, if any. */
58
+ buildSettings: InferredBuildSettings | null;
59
+ }
60
+
35
61
  /** Finite states of a single deploy attempt. */
36
62
  export type DeployStatus =
37
63
  | { kind: 'idle' }
38
64
  | { kind: 'reading' }
65
+ // Build path only: packing the drop into the source archive buildbot builds.
66
+ | { kind: 'zipping' }
39
67
  | { kind: 'creating' }
40
68
  | { kind: 'uploading'; uploaded: number; total: number }
41
69
  | { kind: 'processing' }
42
- // `claim` follows a static deploy (hand off to the claim page); `signup`
43
- // follows a build-required drop (hand off to the authenticated Drop page).
44
- | { kind: 'redirecting'; target: 'claim' | 'signup' }
70
+ // Build path only: the archive is uploaded and buildbot is building it.
71
+ | { kind: 'building' }
72
+ // `claim` follows an anonymous static deploy (hand off to the claim page);
73
+ // `dashboard` follows an authenticated static deploy (hand off to the new
74
+ // site's project page); `build` follows an authenticated build (hand off to
75
+ // the app's project page while the build runs); `signup` follows a
76
+ // build-required drop with no session to build it with.
77
+ | { kind: 'redirecting'; target: 'claim' | 'dashboard' | 'signup' | 'build' }
45
78
  | { kind: 'error'; message: string };
46
79
 
47
80
  /** Provider-agnostic analytics sink. */
@@ -51,9 +84,17 @@ interface UseDropDeployOptions {
51
84
  apiBase?: string;
52
85
  client?: DropClient;
53
86
  claimUrl: (siteName: string) => string;
87
+ siteDashboardUrl: (siteName: string) => string;
54
88
  buildSignupUrl: string;
89
+ buildClient?: BuildClient;
90
+ authenticatedDropClient?: DropClient;
91
+ getUploadToken?: () => Promise<string | null>;
92
+ accountSlug?: string;
93
+ buildDeployUrl: (build: DeployedBuild) => string;
94
+ waitForBuild?: boolean;
55
95
  onBuildRequired?: (info: BuildDetection) => void;
56
96
  onDeploy?: (site: DeployedSite) => void;
97
+ onBuildDeploy?: (build: DeployedBuild) => void;
57
98
  onError?: (error: DeployError) => void;
58
99
  track: TrackFn;
59
100
  }
@@ -61,10 +102,14 @@ interface UseDropDeployOptions {
61
102
  /** Map a low-level deploy progress event onto our UI status. */
62
103
  function progressToStatus(e: DeployProgress): DeployStatus {
63
104
  switch (e.phase) {
105
+ case 'zipping':
106
+ return { kind: 'zipping' };
64
107
  case 'creating':
65
108
  return { kind: 'creating' };
66
109
  case 'uploading':
67
110
  return { kind: 'uploading', uploaded: e.uploaded ?? 0, total: e.total ?? 0 };
111
+ case 'building':
112
+ return { kind: 'building' };
68
113
  case 'processing':
69
114
  case 'ready':
70
115
  return { kind: 'processing' };
@@ -91,9 +136,17 @@ export function useDropDeploy({
91
136
  apiBase,
92
137
  client,
93
138
  claimUrl,
139
+ siteDashboardUrl,
94
140
  buildSignupUrl,
141
+ buildClient,
142
+ authenticatedDropClient,
143
+ getUploadToken,
144
+ accountSlug,
145
+ buildDeployUrl,
146
+ waitForBuild,
95
147
  onBuildRequired,
96
148
  onDeploy,
149
+ onBuildDeploy,
97
150
  onError,
98
151
  track,
99
152
  }: UseDropDeployOptions) {
@@ -101,8 +154,54 @@ export function useDropDeploy({
101
154
  const [warning, setWarning] = useState<string | null>(null);
102
155
  const dropClient = useRef(client ?? new AnonymousDropClient(apiBase)).current;
103
156
 
157
+ // Building is opt-in: without an injected client or a way to mint an upload
158
+ // token there is no authenticated path, and build-required drops fall back to
159
+ // the signup hand-off. Built once and held so a re-render doesn't hand a
160
+ // fresh client (and a fresh token cache) to an in-flight deploy.
161
+ const authedBuildClient = useRef(
162
+ buildClient ??
163
+ (getUploadToken ? new AuthenticatedBuildClient({ getUploadToken, accountSlug }) : null)
164
+ ).current;
165
+
166
+ // Same opt-in for static drops: with authenticated wiring present, deploy
167
+ // straight into the visitor's account and skip the claim step; without it,
168
+ // every static drop stays anonymous.
169
+ const authedDropClient = useRef(
170
+ authenticatedDropClient ??
171
+ (getUploadToken ? new AuthenticatedDropClient({ getUploadToken, accountSlug }) : null)
172
+ ).current;
173
+
104
174
  const busy = status.kind !== 'idle' && status.kind !== 'error';
105
175
 
176
+ /**
177
+ * Zip the drop, create a site and enqueue a build. Returns `null` when the
178
+ * visitor turns out not to be logged in — nothing is created in that case, so
179
+ * the caller can still fall back to the signup hand-off. Every other failure
180
+ * throws and is reported by the caller's `catch`.
181
+ */
182
+ async function buildProject(
183
+ client: BuildClient,
184
+ files: ProcessedFile[]
185
+ ): Promise<DeployedBuild | null> {
186
+ try {
187
+ const { site, build, buildSettings, url } = await deployBuild(client, files, {
188
+ onProgress: e => setStatus(progressToStatus(e)),
189
+ waitForBuild,
190
+ });
191
+ return {
192
+ url,
193
+ siteName: site.name,
194
+ siteId: site.id,
195
+ buildId: build.id,
196
+ deployId: build.deploy_id,
197
+ buildSettings,
198
+ };
199
+ } catch (err) {
200
+ if (err instanceof NotAuthenticatedError) return null;
201
+ throw err;
202
+ }
203
+ }
204
+
106
205
  /**
107
206
  * `fileTypes` is the MIME types of the selection, read at the drop boundary
108
207
  * (see `getFileTypes`) and passed in rather than derived here — it has to be
@@ -164,9 +263,10 @@ export function useDropDeploy({
164
263
 
165
264
  // Build-required projects can't deploy through the anonymous drop API —
166
265
  // it only performs static deploys, so building one this way yields a
167
- // broken site. Detect them up front and hand off to the authenticated
168
- // Drop page (via signup) instead. Consumers can override the hand-off
169
- // with `onBuildRequired`.
266
+ // broken site. Detect them up front and route them to the build path
267
+ // (which needs a logged-in user) or, failing that, hand off to the
268
+ // authenticated Drop page via signup. Consumers can override the hand-off
269
+ // entirely with `onBuildRequired`.
170
270
  const build = detectBuild(files);
171
271
  if (build.buildRequired) {
172
272
  track('dropzone_build_required', {
@@ -182,6 +282,26 @@ export function useDropDeploy({
182
282
  onBuildRequired(build);
183
283
  return;
184
284
  }
285
+ if (authedBuildClient) {
286
+ const built = await buildProject(authedBuildClient, files);
287
+ // No session after all (the auth hint cookie can outlive the session).
288
+ // Nothing was created, so fall through to the signup hand-off rather
289
+ // than dead-ending on an error the visitor can't act on from here.
290
+ if (built) {
291
+ setStatus({ kind: 'redirecting', target: 'build' });
292
+ track('dropzone_build_deploy_succeeded', {
293
+ method: source,
294
+ reason: build.reason,
295
+ site_name: built.siteName,
296
+ file_count: files.length,
297
+ ...(built.buildSettings ? { framework: built.buildSettings.framework } : {}),
298
+ ...typeProps,
299
+ });
300
+ onBuildDeploy?.(built);
301
+ window.location.assign(buildDeployUrl(built));
302
+ return;
303
+ }
304
+ }
185
305
  setStatus({ kind: 'redirecting', target: 'signup' });
186
306
  window.location.assign(buildSignupUrl);
187
307
  return;
@@ -189,41 +309,80 @@ export function useDropDeploy({
189
309
 
190
310
  setWarning(indexHtmlWarning(files));
191
311
 
192
- const {
193
- url,
194
- token,
195
- deploy: result,
196
- } = await deployFiles(dropClient, files, {
197
- onProgress: e => setStatus(progressToStatus(e)),
198
- });
312
+ // Deploy into the visitor's account when we can. NotAuthenticatedError is
313
+ // the one failure that falls back to the anonymous flow — it's thrown
314
+ // before anything is created (the auth hint cookie can outlive the
315
+ // session), so retrying anonymously can't strand a half-made site. Any
316
+ // later failure is real and surfaces as an error instead: falling back
317
+ // then would leave an empty site in the account and deploy a duplicate.
318
+ let deployed: DeployResult | null = null;
319
+ let authenticated = false;
320
+ let authFallback = false;
321
+ if (authedDropClient) {
322
+ try {
323
+ deployed = await deployFiles(authedDropClient, files, {
324
+ onProgress: e => setStatus(progressToStatus(e)),
325
+ });
326
+ authenticated = true;
327
+ } catch (err) {
328
+ if (!(err instanceof NotAuthenticatedError)) throw err;
329
+ authFallback = true;
330
+ }
331
+ }
332
+ if (!deployed) {
333
+ deployed = await deployFiles(dropClient, files, {
334
+ onProgress: e => setStatus(progressToStatus(e)),
335
+ });
336
+ }
337
+ const { url, token, deploy: result } = deployed;
199
338
 
200
- // Best-effort local persistence. Note this does NOT reach the dashboard:
201
- // localStorage is per-origin, so a token written here (e.g. www.netlify.com)
202
- // is invisible to app.netlify.com. The cross-origin handoff is the URL
203
- // fragment below; this only helps if the drop and claim share an origin.
204
- try {
205
- localStorage.setItem('drop-token', token);
206
- localStorage.setItem('dropSiteName', result.subdomain);
207
- } catch {
208
- /* private mode / storage disabled — non-fatal */
339
+ if (!authenticated) {
340
+ // Best-effort local persistence. Note this does NOT reach the dashboard:
341
+ // localStorage is per-origin, so a token written here (e.g. www.netlify.com)
342
+ // is invisible to app.netlify.com. The cross-origin handoff is the URL
343
+ // fragment below; this only helps if the drop and claim share an origin.
344
+ // Authenticated deploys skip this entirely — there is no claim token,
345
+ // and the upload bearer must never be persisted.
346
+ try {
347
+ localStorage.setItem('drop-token', token);
348
+ localStorage.setItem('dropSiteName', result.subdomain);
349
+ } catch {
350
+ /* private mode / storage disabled — non-fatal */
351
+ }
209
352
  }
210
353
 
211
- setStatus({ kind: 'redirecting', target: 'claim' });
354
+ setStatus({ kind: 'redirecting', target: authenticated ? 'dashboard' : 'claim' });
212
355
  // Fired before the redirect below. Note: the navigation can cut a
213
356
  // fire-and-forget analytics request short — see the docs for delivery
214
- // hardening (sendBeacon / deferring the redirect).
357
+ // hardening (sendBeacon / deferring the redirect). `auth_fallback` is only
358
+ // sent when an authenticated attempt bounced (stale auth hint) — omitted
359
+ // otherwise, like `file_types`.
215
360
  track('dropzone_deploy_succeeded', {
216
361
  method: source,
217
362
  site_name: result.subdomain,
218
363
  file_count: files.length,
364
+ authenticated,
365
+ ...(authFallback ? { auth_fallback: true } : {}),
219
366
  ...typeProps,
220
367
  });
221
- onDeploy?.({ url, token, siteName: result.subdomain, siteId: result.id });
368
+ onDeploy?.({
369
+ url,
370
+ ...(authenticated ? {} : { token }),
371
+ siteName: result.subdomain,
372
+ siteId: result.id,
373
+ authenticated,
374
+ });
222
375
 
223
- // Hand the drop token to the dashboard via the URL fragment — localStorage
224
- // does not cross origins. The dashboard's /drop/:name page reads
225
- // `#drop_token=` and persists it for the claim + post-signup steps.
226
- window.location.assign(`${claimUrl(result.subdomain)}#drop_token=${token}`);
376
+ if (authenticated) {
377
+ // The site already lives in the visitor's account — send them straight
378
+ // to its dashboard page. No claim step, no token in the URL.
379
+ window.location.assign(siteDashboardUrl(result.subdomain));
380
+ } else {
381
+ // Hand the drop token to the dashboard via the URL fragment — localStorage
382
+ // does not cross origins. The dashboard's /drop/:name page reads
383
+ // `#drop_token=` and persists it for the claim + post-signup steps.
384
+ window.location.assign(`${claimUrl(result.subdomain)}#drop_token=${token}`);
385
+ }
227
386
  } catch (err) {
228
387
  failFromError(err);
229
388
  }
@@ -6,6 +6,7 @@ export { default as SearchHeading } from './SearchModal/components/SearchHeading
6
6
  export { default as SearchToggle } from './SearchModal/components/SearchToggle/SearchToggle';
7
7
  export { default as AskNetlify } from './AskNetlify/AskNetlify';
8
8
  export { SearchModal } from './SearchModal';
9
- export { DropZone } from './DropZone';
9
+ export { DropZone, AuthenticatedBuildClient, AuthenticatedDropClient } from './DropZone';
10
+ export type { BuildClient, DeployedBuild, DeployedSite, DropClient } from './DropZone';
10
11
 
11
12
  export { type IconName } from './Icon';