@netlify/spark-ui 1.31.0-alpha.1 → 1.31.0-alpha.2

package/dist/components/preact/DropZone/DropZone.d.ts

@@ -47,13 +47,6 @@ interface Props {
      * static path. Distinct from `client`, which is the anonymous fallback.
      */
     authenticatedDropClient?: DropClient;
-    /**
-     * API root for the authenticated paths' JSON calls, which go through your
-     * access-control rewrite so the session cookie authorizes them. Defaults to
-     * `/access-control/bb-api/api/v1`. (Uploads always go direct to
-     * `api.netlify.com` — the proxy can't carry bodies that large.)
-     */
-    proxyBase?: string;
     /** Create the visitor's new project in this account. Omit for their default account. */
     accountSlug?: string;
     /**
@@ -130,5 +123,5 @@ interface Props {
     analyticsId?: string;
     className?: string;
 }
-export default function DropZone({ children, apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, getUploadToken, buildClient, authenticatedDropClient, proxyBase, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, showStatus, onTrack, analyticsId, className, }: Props): import("preact").JSX.Element;
+export default function DropZone({ children, apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, getUploadToken, buildClient, authenticatedDropClient, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, showStatus, onTrack, analyticsId, className, }: Props): import("preact").JSX.Element;
 export {};

package/dist/components/preact/DropZone/DropZone.js

@@ -1,36 +1,35 @@
 import { u as e } from "../../../chunks/jsxRuntime.module.Bzuv3cXw.js";
-import { A as j, d as G, y as K } from "../../../chunks/hooks.module.DRcxknIz.js";
-import { readFileList as L, readDataTransfer as Z } from "./drop-core/readFiles.js";
+import { A as j, d as V, y as G } from "../../../chunks/hooks.module.DRcxknIz.js";
+import { readFileList as K, readDataTransfer as L } from "./drop-core/readFiles.js";
 import { getFileTypes as D } from "./drop-core/fileTypes.js";
 import "./drop-core/detectBuild.js";
 import "./drop-core/zip.js";
-import { useDropDeploy as q } from "./useDropDeploy.js";
+import { useDropDeploy as Z } from "./useDropDeploy.js";
 import { Fragment as w } from "preact";
-import '../../../assets/DropZone.css';const H = 120, J = (r) => `https://app.netlify.com/drop/${r}`, Q = (r) => `https://app.netlify.com/projects/${r}`, W = "https://app.netlify.com/signup?next=/drop&utm_campaign=drop", X = ({ siteName: r }) => `https://app.netlify.com/projects/${r}`;
-function ce({
+import '../../../assets/DropZone.css';const q = 120, H = (r) => `https://app.netlify.com/drop/${r}`, J = (r) => `https://app.netlify.com/projects/${r}`, Q = "https://app.netlify.com/signup?next=/drop&utm_campaign=drop", W = ({ siteName: r }) => `https://app.netlify.com/projects/${r}`;
+function se({
   children: r,
   apiBase: a,
   client: l,
-  claimUrl: c = J,
-  siteDashboardUrl: u = Q,
-  buildSignupUrl: A = W,
+  claimUrl: c = H,
+  siteDashboardUrl: u = J,
+  buildSignupUrl: A = Q,
   getUploadToken: T,
   buildClient: C,
   authenticatedDropClient: S,
-  proxyBase: _,
-  accountSlug: $,
-  buildDeployUrl: B = X,
-  waitForBuild: U,
-  onBuildRequired: P,
-  onDeploy: R,
-  onBuildDeploy: x,
-  onError: E,
+  accountSlug: _,
+  buildDeployUrl: $ = W,
+  waitForBuild: B,
+  onBuildRequired: U,
+  onDeploy: P,
+  onBuildDeploy: R,
+  onError: x,
   showStatus: f = !0,
   onTrack: d,
   analyticsId: g,
-  className: F
+  className: E
 }) {
-  const y = (t, n = {}) => d == null ? void 0 : d(t, g ? { dropzone_id: g, ...n } : n), { status: s, warning: b, busy: i, deploy: m, reset: I } = q({
+  const y = (t, n = {}) => d == null ? void 0 : d(t, g ? { dropzone_id: g, ...n } : n), { status: s, warning: b, busy: i, deploy: m, reset: F } = Z({
     apiBase: a,
     client: l,
     claimUrl: c,
@@ -39,41 +38,40 @@ function ce({
     getUploadToken: T,
     buildClient: C,
     authenticatedDropClient: S,
-    proxyBase: _,
-    accountSlug: $,
-    buildDeployUrl: B,
-    waitForBuild: U,
-    onBuildRequired: P,
-    onDeploy: R,
-    onBuildDeploy: x,
-    onError: E,
+    accountSlug: _,
+    buildDeployUrl: $,
+    waitForBuild: B,
+    onBuildRequired: U,
+    onDeploy: P,
+    onBuildDeploy: R,
+    onError: x,
     track: y
-  }), { active: p, keepActive: M, endDrag: N } = Y(), h = j(null), v = (t) => {
+  }), { active: p, keepActive: I, endDrag: M } = X(), h = j(null), v = (t) => {
     var n;
     y("dropzone_browse_opened", { method: t }), (n = h.current) == null || n.click();
-  }, O = f && (p || i || s.kind === "error"), V = [
+  }, N = f && (p || i || s.kind === "error"), O = [
     "n-dropzone",
     p && "is-active",
     i && "is-busy",
     !f && "is-bare",
-    F
+    E
   ].filter(Boolean).join(" ");
   return /* @__PURE__ */ e(
     "div",
     {
-      class: V,
+      class: O,
       "data-state": s.kind,
       role: "button",
       tabIndex: i ? -1 : 0,
       "aria-label": "Drop a site folder or zip here to deploy it, or press Enter to browse for files",
       "aria-busy": i,
       onDragOver: (t) => {
-        i || (t.preventDefault(), M());
+        i || (t.preventDefault(), I());
       },
       onDrop: (t) => {
-        if (t.preventDefault(), N(), i) return;
+        if (t.preventDefault(), M(), i) return;
         const n = t.dataTransfer;
-        n && m(() => Z(n), "drag", D(n.files));
+        n && m(() => L(n), "drag", D(n.files));
       },
       onClick: (t) => {
         !i && t.target === t.currentTarget && v("click");
@@ -97,18 +95,18 @@ function ce({
               const n = t.currentTarget;
               if ((k = n.files) != null && k.length) {
                 const z = n.files;
-                m(() => L(z), "browse", D(z));
+                m(() => K(z), "browse", D(z));
               }
               n.value = "";
             }
           }
         ),
-        O && /* @__PURE__ */ e(
+        N && /* @__PURE__ */ e(
           "div",
           {
             class: "n-dropzone-overlay n-fadeIn",
             children: [
-              /* @__PURE__ */ e(ee, { status: s, active: p, onReset: I }),
+              /* @__PURE__ */ e(Y, { status: s, active: p, onReset: F }),
               b && s.kind !== "error" && i && /* @__PURE__ */ e("p", { class: "n-dropzone-warning", role: "status", children: b })
             ]
           },
@@ -118,15 +116,15 @@ function ce({
     }
   );
 }
-function Y() {
-  const [r, a] = G(!1), l = j();
-  return K(() => () => clearTimeout(l.current), []), { active: r, keepActive: () => {
-    a(!0), clearTimeout(l.current), l.current = setTimeout(() => a(!1), H);
+function X() {
+  const [r, a] = V(!1), l = j();
+  return G(() => () => clearTimeout(l.current), []), { active: r, keepActive: () => {
+    a(!0), clearTimeout(l.current), l.current = setTimeout(() => a(!1), q);
   }, endDrag: () => {
     clearTimeout(l.current), a(!1);
   } };
 }
-function ee({
+function Y({
   status: r,
   active: a,
   onReset: l
@@ -182,5 +180,5 @@ function o({ label: r }) {
   ] });
 }
 export {
-  ce as default
+  se as default
 };

package/dist/components/preact/DropZone/drop-core/authedDropClient.d.ts

@@ -2,21 +2,16 @@ import { DropClient } from './client';
 import { Digest, DropResponse } from './types';
 export interface AuthenticatedDropClientConfig {
     /**
-     * Base for JSON API calls, routed through the consumer's access-control
-     * rewrite so the session cookie authenticates them. On netlify.com that
-     * rewrite is `/access-control/*` → the app's access-control function, which
-     * makes `/access-control/bb-api/api/v1` the API root (the default here).
-     */
-    proxyBase?: string;
-    /**
-     * Direct API base for the per-file uploads. The proxy above runs in a Lambda
-     * with a ~6MB request body limit, so file PUTs go straight to
-     * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
+     * API base for every call. Requests go straight to `api.netlify.com`, whose
+     * `/api/*` CORS policy allows any origin, rather than through a consumer's
+     * access-control rewrite — that proxy allowlists paths per origin, and site
+     * and deploy creation are not on the list for netlify.com (they 400 with
+     * `x-debug: request origin not allowed to call endpoint`).
      */
     apiBase?: string;
     /**
-     * Mint a short-lived bearer token for those direct uploads. On netlify.com
-     * this is `GET /access-control/generate-access-control-token`, whose
+     * Mint a short-lived bearer token authorizing the calls. On netlify.com this
+     * is `GET /access-control/generate-access-control-token`, whose
      * `accessControlToken` the API decrypts back into the user's access token.
      * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
      */
@@ -36,11 +31,12 @@ export interface AuthenticatedDropClientConfig {
  * There is no claim step, so the caller should hand off to the site's dashboard
  * page rather than the claim page.
  *
- * Requests split across two hosts by necessity: JSON calls go through the
- * consumer's access-control proxy (cookie session, no token handling in the
- * browser), while the per-file PUTs go direct to `api.netlify.com` with the
- * short-lived bearer from `getUploadToken()` because the proxy can't carry
- * large bodies.
+ * Every request goes direct to `api.netlify.com` with the short-lived bearer
+ * from `getUploadToken()`. Routing the JSON calls through a consumer's
+ * access-control rewrite instead (cookie session, no token in the browser)
+ * would be the tighter design, but that proxy allowlists paths per origin and
+ * site/deploy creation isn't allowed from netlify.com — it 400s before
+ * reaching the API. Revisit if that allowlist gains these paths.
  *
  * Error-mapping invariant: only pre-mutation failures — a null upload token, or
  * a 401/403 creating the site — throw `NotAuthenticatedError`, which is the
@@ -50,31 +46,32 @@ export interface AuthenticatedDropClientConfig {
  * anonymously.
  */
 export declare class AuthenticatedDropClient implements DropClient {
-    private proxyBase;
     private apiBase;
     private getUploadToken;
     private accountSlug?;
     private pollIntervalMs;
     private timeoutMs;
-    constructor({ proxyBase, apiBase, getUploadToken, accountSlug, pollIntervalMs, timeoutMs, }: AuthenticatedDropClientConfig);
+    constructor({ apiBase, getUploadToken, accountSlug, pollIntervalMs, timeoutMs, }: AuthenticatedDropClientConfig);
     /**
-     * The token here is the upload bearer, not a drop token — it authorizes the
-     * direct-API file PUTs, while the proxied JSON calls ignore it and ride the
-     * session cookie. Minted once per deploy, before anything is created, so a
-     * missing session fails the whole attempt cleanly.
+     * The token here is the upload bearer, not a drop token — it authorizes every
+     * call this client makes. Minted once per deploy, before anything is created,
+     * so a missing session fails the whole attempt cleanly.
      */
     getToken(): Promise<string>;
     /**
-     * Two proxied calls: create the site in the visitor's account, then the
-     * deploy on it. Mapped into the anonymous `DropResponse` shape so
-     * `deployFiles` runs unchanged over either client.
+     * Two calls: create the site in the visitor's account, then the deploy on it.
+     * Mapped into the anonymous `DropResponse` shape so `deployFiles` runs
+     * unchanged over either client.
      */
-    createDeploy(files: Digest, _token: string): Promise<DropResponse>;
+    createDeploy(files: Digest, token: string): Promise<DropResponse>;
     uploadFile(deployId: string, path: string, content: ArrayBuffer, token: string): Promise<void>;
     /**
-     * Poll the deploy through the proxy until it settles — the session cookie
-     * outlives the short-lived upload bearer, so a slow deploy can't expire its
-     * own poll. Resolve on `ready`, throw on `error`/`rejected`, throw on timeout.
+     * Poll until the deploy settles: resolve on `ready`, throw on
+     * `error`/`rejected`, throw on timeout. Reuses the bearer minted at the start
+     * of the deploy, so a deploy that outlives the token's TTL will start seeing
+     * 401s here — those are ignored like any other non-ok read and the loop runs
+     * to its timeout rather than failing fast. Acceptable while static deploys
+     * finish in seconds; re-mint per poll if that stops being true.
      */
-    waitUntilReady(deploy: DropResponse, _token: string): Promise<void>;
+    waitUntilReady(deploy: DropResponse, token: string): Promise<void>;
 }

package/dist/components/preact/DropZone/drop-core/authedDropClient.js

@@ -1,95 +1,93 @@
-var p = Object.defineProperty;
-var h = (n, t, s) => t in n ? p(n, t, { enumerable: !0, configurable: !0, writable: !0, value: s }) : n[t] = s;
-var r = (n, t, s) => h(n, typeof t != "symbol" ? t + "" : t, s);
-import { apiError as d } from "./client.js";
-import { NotAuthenticatedError as l, SiteCreateError as y } from "./errors.js";
-const u = "/access-control/bb-api/api/v1", w = "https://api.netlify.com/api/v1", f = 1e3, m = 10 * 60 * 1e3, T = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
+var c = Object.defineProperty;
+var h = (r, t, e) => t in r ? c(r, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : r[t] = e;
+var n = (r, t, e) => h(r, typeof t != "symbol" ? t + "" : t, e);
+import { apiError as l } from "./client.js";
+import { NotAuthenticatedError as p, SiteCreateError as u } from "./errors.js";
+const y = "https://api.netlify.com/api/v1", w = 1e3, f = 10 * 60 * 1e3, m = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
 class g {
   constructor({
-    proxyBase: t = u,
-    apiBase: s = w,
-    getUploadToken: i,
-    accountSlug: o,
-    pollIntervalMs: a = f,
-    timeoutMs: e = m
+    apiBase: t = y,
+    getUploadToken: e,
+    accountSlug: i,
+    pollIntervalMs: o = w,
+    timeoutMs: s = f
   }) {
-    r(this, "proxyBase");
-    r(this, "apiBase");
-    r(this, "getUploadToken");
-    r(this, "accountSlug");
-    r(this, "pollIntervalMs");
-    r(this, "timeoutMs");
-    this.proxyBase = t, this.apiBase = s, this.getUploadToken = i, this.accountSlug = o, this.pollIntervalMs = a, this.timeoutMs = e;
+    n(this, "apiBase");
+    n(this, "getUploadToken");
+    n(this, "accountSlug");
+    n(this, "pollIntervalMs");
+    n(this, "timeoutMs");
+    this.apiBase = t, this.getUploadToken = e, this.accountSlug = i, this.pollIntervalMs = o, this.timeoutMs = s;
   }
   /**
-   * The token here is the upload bearer, not a drop token — it authorizes the
-   * direct-API file PUTs, while the proxied JSON calls ignore it and ride the
-   * session cookie. Minted once per deploy, before anything is created, so a
-   * missing session fails the whole attempt cleanly.
+   * The token here is the upload bearer, not a drop token — it authorizes every
+   * call this client makes. Minted once per deploy, before anything is created,
+   * so a missing session fails the whole attempt cleanly.
    */
   async getToken() {
     const t = await this.getUploadToken();
-    if (!t) throw new l();
+    if (!t) throw new p();
     return t;
   }
   /**
-   * Two proxied calls: create the site in the visitor's account, then the
-   * deploy on it. Mapped into the anonymous `DropResponse` shape so
-   * `deployFiles` runs unchanged over either client.
+   * Two calls: create the site in the visitor's account, then the deploy on it.
+   * Mapped into the anonymous `DropResponse` shape so `deployFiles` runs
+   * unchanged over either client.
    */
-  async createDeploy(t, s) {
-    const i = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", o = await fetch(`${this.proxyBase}${i}`, {
+  async createDeploy(t, e) {
+    const i = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", o = await fetch(`${this.apiBase}${i}`, {
       method: "POST",
-      credentials: "include",
-      headers: { "Content-Type": "application/json" },
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${e}` },
       body: JSON.stringify({ created_via: "drop" })
     });
-    if (o.status === 401 || o.status === 403) throw new l();
-    if (!o.ok) throw new y(o.status);
-    const a = await o.json(), e = await fetch(`${this.proxyBase}/sites/${a.id}/deploys`, {
+    if (o.status === 401 || o.status === 403) throw new p();
+    if (!o.ok) throw new u(o.status);
+    const s = await o.json(), a = await fetch(`${this.apiBase}/sites/${s.id}/deploys`, {
       method: "POST",
-      credentials: "include",
-      headers: { "Content-Type": "application/json" },
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${e}` },
       body: JSON.stringify({ files: t, deploy_source: "drop" })
     });
-    if (!e.ok) throw d("deploy create", e.status);
-    const c = await e.json();
+    if (!a.ok) throw l("deploy create", a.status);
+    const d = await a.json();
     return {
-      id: a.id,
-      deploy_id: c.id,
-      subdomain: a.name,
-      required: c.required ?? []
+      id: s.id,
+      deploy_id: d.id,
+      subdomain: s.name,
+      required: d.required ?? []
     };
   }
-  async uploadFile(t, s, i, o) {
-    const a = await fetch(`${this.apiBase}/deploys/${t}/files${s}`, {
+  async uploadFile(t, e, i, o) {
+    const s = await fetch(`${this.apiBase}/deploys/${t}/files${e}`, {
       method: "PUT",
       headers: { "Content-Type": "application/octet-stream", Authorization: `Bearer ${o}` },
       body: i
     });
-    if (!a.ok) throw d(`upload ${s}`, a.status);
+    if (!s.ok) throw l(`upload ${e}`, s.status);
   }
   /**
-   * Poll the deploy through the proxy until it settles — the session cookie
-   * outlives the short-lived upload bearer, so a slow deploy can't expire its
-   * own poll. Resolve on `ready`, throw on `error`/`rejected`, throw on timeout.
+   * Poll until the deploy settles: resolve on `ready`, throw on
+   * `error`/`rejected`, throw on timeout. Reuses the bearer minted at the start
+   * of the deploy, so a deploy that outlives the token's TTL will start seeing
+   * 401s here — those are ignored like any other non-ok read and the loop runs
+   * to its timeout rather than failing fast. Acceptable while static deploys
+   * finish in seconds; re-mint per poll if that stops being true.
    */
-  async waitUntilReady(t, s) {
+  async waitUntilReady(t, e) {
     const i = this.timeoutMs / this.pollIntervalMs;
     for (let o = 0; o < i; o++) {
-      const a = await fetch(`${this.proxyBase}/deploys/${t.deploy_id}`, {
-        credentials: "include"
+      const s = await fetch(`${this.apiBase}/deploys/${t.deploy_id}`, {
+        headers: { Authorization: `Bearer ${e}` }
       });
-      if (a.ok) {
-        const e = await a.json();
-        if (e.state && T.has(e.state)) {
-          if (e.state === "ready") return;
+      if (s.ok) {
+        const a = await s.json();
+        if (a.state && m.has(a.state)) {
+          if (a.state === "ready") return;
           throw new Error(
-            e.error_message ? `deploy failed: ${e.error_message}` : "deploy failed"
+            a.error_message ? `deploy failed: ${a.error_message}` : "deploy failed"
           );
         }
       }
-      await new Promise((e) => setTimeout(e, this.pollIntervalMs));
+      await new Promise((a) => setTimeout(a, this.pollIntervalMs));
     }
     throw new Error("Deploy did not become ready in time");
   }

package/dist/components/preact/DropZone/drop-core/buildClient.d.ts

@@ -22,20 +22,17 @@ export interface BuildClient {
 }
 export interface AuthenticatedBuildClientConfig {
     /**
-     * Base for JSON API calls, routed through the consumer's access-control
-     * rewrite so the session cookie authenticates them. On netlify.com that
-     * rewrite is `/access-control/*` → the app's access-control function, which
-     * makes `/access-control/bb-api/api/v1` the API root (the default here).
-     */
-    proxyBase?: string;
-    /**
-     * Direct API base for the zip upload. The proxy above runs in a Lambda with a
-     * ~6MB request body limit, so the multipart POST has to go straight to
-     * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
+     * API base for every call. Requests go straight to `api.netlify.com`, whose
+     * `/api/*` CORS policy allows any origin, rather than through a consumer's
+     * access-control rewrite — that proxy allowlists paths per origin, and site
+     * creation and deploy reads are not on the list for netlify.com (they 400
+     * with `x-debug: request origin not allowed to call endpoint`). The zip
+     * upload could not use that proxy regardless: it runs in a Lambda with a
+     * ~6MB request body limit.
      */
     apiBase?: string;
     /**
-     * Mint a short-lived bearer token for that direct upload. On netlify.com this
+     * Mint a short-lived bearer token authorizing the calls. On netlify.com this
      * is `GET /access-control/generate-access-control-token`, whose
      * `accessControlToken` the API decrypts back into the user's access token.
      * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
@@ -63,18 +60,16 @@ export interface AuthenticatedBuildClientConfig {
  * short-lived bearer token because the proxy can't carry a body that large.
  */
 export declare class AuthenticatedBuildClient implements BuildClient {
-    private proxyBase;
     private apiBase;
     private getUploadToken;
     private accountSlug?;
     private title;
     private pollIntervalMs;
     private timeoutMs;
-    constructor({ proxyBase, apiBase, getUploadToken, accountSlug, title, pollIntervalMs, timeoutMs, }: AuthenticatedBuildClientConfig);
+    constructor({ apiBase, getUploadToken, accountSlug, title, pollIntervalMs, timeoutMs, }: AuthenticatedBuildClientConfig);
     /**
-     * Create the site the build deploys into. Goes through the proxy with
-     * `credentials: 'include'` so the app session authorizes it; without an
-     * account slug the API picks the user's default account.
+     * Create the site the build deploys into. Authorized by the bearer token;
+     * without an account slug the API picks the user's default account.
      */
     createSite(): Promise<BuildSite>;
     /**
@@ -85,14 +80,16 @@ export declare class AuthenticatedBuildClient implements BuildClient {
      */
     createBuildFromZip(siteId: string, zip: File): Promise<BuildResponse>;
     /**
-     * Poll the build's deploy through the proxy until it settles, mirroring
+     * Poll the build's deploy until it settles, mirroring
      * `AnonymousDropClient.waitUntilReady` — resolve on `ready`, throw on
      * `error`/`rejected`, throw on timeout. A build that hasn't been given a
      * deploy id yet has nothing pollable, so it resolves immediately and the
      * caller falls back to the site page.
      *
-     * Optional in the drop flow: a build takes minutes, so the default hand-off
-     * redirects to the app's deploy page (live logs) instead of waiting here.
+     * Optional in the drop flow, and off by default: a build takes minutes, which
+     * can outlive the bearer token minted for it. Each poll re-mints so a long
+     * build keeps reading; a token that can't be minted any more ends the wait as
+     * a timeout rather than a false failure.
      */
     waitUntilBuildReady(build: BuildResponse): Promise<void>;
 }

package/dist/components/preact/DropZone/drop-core/buildClient.js

@@ -1,41 +1,39 @@
-var d = Object.defineProperty;
-var p = (r, t, e) => t in r ? d(r, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : r[t] = e;
-var i = (r, t, e) => p(r, typeof t != "symbol" ? t + "" : t, e);
-import { NotAuthenticatedError as n, SiteCreateError as h, BuildCreateError as u, BuildFailedError as w, BuildTimeoutError as y } from "./errors.js";
-const f = "/access-control/bb-api/api/v1", B = "https://api.netlify.com/api/v1", m = 1e3, S = 10 * 60 * 1e3, T = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
-class _ {
+var h = Object.defineProperty;
+var d = (n, t, o) => t in n ? h(n, t, { enumerable: !0, configurable: !0, writable: !0, value: o }) : n[t] = o;
+var r = (n, t, o) => d(n, typeof t != "symbol" ? t + "" : t, o);
+import { NotAuthenticatedError as l, SiteCreateError as c, BuildCreateError as p, BuildFailedError as u, BuildTimeoutError as w } from "./errors.js";
+const f = "https://api.netlify.com/api/v1", m = 1e3, y = 10 * 60 * 1e3, B = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
+class g {
   constructor({
-    proxyBase: t = f,
-    apiBase: e = B,
-    getUploadToken: a,
-    accountSlug: o,
+    apiBase: t = f,
+    getUploadToken: o,
+    accountSlug: e,
     title: s = "Build from drop deployment",
-    pollIntervalMs: l = m,
-    timeoutMs: c = S
+    pollIntervalMs: i = m,
+    timeoutMs: a = y
   }) {
-    i(this, "proxyBase");
-    i(this, "apiBase");
-    i(this, "getUploadToken");
-    i(this, "accountSlug");
-    i(this, "title");
-    i(this, "pollIntervalMs");
-    i(this, "timeoutMs");
-    this.proxyBase = t, this.apiBase = e, this.getUploadToken = a, this.accountSlug = o, this.title = s, this.pollIntervalMs = l, this.timeoutMs = c;
+    r(this, "apiBase");
+    r(this, "getUploadToken");
+    r(this, "accountSlug");
+    r(this, "title");
+    r(this, "pollIntervalMs");
+    r(this, "timeoutMs");
+    this.apiBase = t, this.getUploadToken = o, this.accountSlug = e, this.title = s, this.pollIntervalMs = i, this.timeoutMs = a;
   }
   /**
-   * Create the site the build deploys into. Goes through the proxy with
-   * `credentials: 'include'` so the app session authorizes it; without an
-   * account slug the API picks the user's default account.
+   * Create the site the build deploys into. Authorized by the bearer token;
+   * without an account slug the API picks the user's default account.
    */
   async createSite() {
-    const t = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", e = await fetch(`${this.proxyBase}${t}`, {
+    const t = await this.getUploadToken();
+    if (!t) throw new l();
+    const o = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", e = await fetch(`${this.apiBase}${o}`, {
       method: "POST",
-      credentials: "include",
-      headers: { "Content-Type": "application/json" },
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${t}` },
       body: JSON.stringify({ created_via: "drop" })
     });
-    if (e.status === 401 || e.status === 403) throw new n();
-    if (!e.ok) throw new h(e.status);
+    if (e.status === 401 || e.status === 403) throw new l();
+    if (!e.ok) throw new c(e.status);
     return e.json();
   }
   /**
@@ -44,49 +42,51 @@ class _ {
    * `Content-Type` is left unset on purpose so the browser adds the multipart
    * boundary itself.
    */
-  async createBuildFromZip(t, e) {
-    const a = await this.getUploadToken();
-    if (!a) throw new n();
-    const o = new FormData();
-    o.append("zip", e), o.append("title", this.title);
-    const s = await fetch(`${this.apiBase}/sites/${t}/builds`, {
+  async createBuildFromZip(t, o) {
+    const e = await this.getUploadToken();
+    if (!e) throw new l();
+    const s = new FormData();
+    s.append("zip", o), s.append("title", this.title);
+    const i = await fetch(`${this.apiBase}/sites/${t}/builds`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${a}` },
-      body: o
+      headers: { Authorization: `Bearer ${e}` },
+      body: s
     });
-    if (s.status === 401 || s.status === 403) throw new n();
-    if (!s.ok) throw new u(s.status);
-    return s.json();
+    if (i.status === 401 || i.status === 403) throw new l();
+    if (!i.ok) throw new p(i.status);
+    return i.json();
   }
   /**
-   * Poll the build's deploy through the proxy until it settles, mirroring
+   * Poll the build's deploy until it settles, mirroring
    * `AnonymousDropClient.waitUntilReady` — resolve on `ready`, throw on
    * `error`/`rejected`, throw on timeout. A build that hasn't been given a
    * deploy id yet has nothing pollable, so it resolves immediately and the
    * caller falls back to the site page.
    *
-   * Optional in the drop flow: a build takes minutes, so the default hand-off
-   * redirects to the app's deploy page (live logs) instead of waiting here.
+   * Optional in the drop flow, and off by default: a build takes minutes, which
+   * can outlive the bearer token minted for it. Each poll re-mints so a long
+   * build keeps reading; a token that can't be minted any more ends the wait as
+   * a timeout rather than a false failure.
    */
   async waitUntilBuildReady(t) {
     if (!t.deploy_id) return;
-    const e = this.timeoutMs / this.pollIntervalMs;
-    for (let a = 0; a < e; a++) {
-      const o = await fetch(`${this.proxyBase}/deploys/${t.deploy_id}`, {
-        credentials: "include"
+    const o = this.timeoutMs / this.pollIntervalMs;
+    for (let e = 0; e < o; e++) {
+      const s = await this.getUploadToken(), i = await fetch(`${this.apiBase}/deploys/${t.deploy_id}`, {
+        headers: s ? { Authorization: `Bearer ${s}` } : {}
       });
-      if (o.ok) {
-        const s = await o.json();
-        if (s.state && T.has(s.state)) {
-          if (s.state === "ready") return;
-          throw new w(s.error_message);
+      if (i.ok) {
+        const a = await i.json();
+        if (a.state && B.has(a.state)) {
+          if (a.state === "ready") return;
+          throw new u(a.error_message);
         }
       }
-      await new Promise((s) => setTimeout(s, this.pollIntervalMs));
+      await new Promise((a) => setTimeout(a, this.pollIntervalMs));
     }
-    throw new y();
+    throw new w();
   }
 }
 export {
-  _ as AuthenticatedBuildClient
+  g as AuthenticatedBuildClient
 };

package/dist/components/preact/DropZone/useDropDeploy.d.ts

@@ -68,7 +68,6 @@ interface UseDropDeployOptions {
     buildClient?: BuildClient;
     authenticatedDropClient?: DropClient;
     getUploadToken?: () => Promise<string | null>;
-    proxyBase?: string;
     accountSlug?: string;
     buildDeployUrl: (build: DeployedBuild) => string;
     waitForBuild?: boolean;
@@ -82,7 +81,7 @@ interface UseDropDeployOptions {
  * Owns the deploy state machine and its side effects (upload, local persistence,
  * analytics, redirect), keeping DropZone a thin view over the returned `status`.
  */
-export declare function useDropDeploy({ apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, buildClient, authenticatedDropClient, getUploadToken, proxyBase, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, track, }: UseDropDeployOptions): {
+export declare function useDropDeploy({ apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, buildClient, authenticatedDropClient, getUploadToken, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, track, }: UseDropDeployOptions): {
     status: DeployStatus;
     warning: string | null;
     busy: boolean;

package/dist/components/preact/DropZone/useDropDeploy.js

@@ -1,12 +1,12 @@
-import { d as H, A as I } from "../../../chunks/hooks.module.DRcxknIz.js";
-import { renameSingleNonIndexHtmlToIndex as Y, getSingleNonIndexHtmlFileName as Z, hasMultipleHtmlFilesWithoutIndex as B } from "./drop-core/readFiles.js";
-import { detectBuild as D } from "./drop-core/detectBuild.js";
-import { AnonymousDropClient as T } from "./drop-core/client.js";
-import { AuthenticatedDropClient as U } from "./drop-core/authedDropClient.js";
-import { AuthenticatedBuildClient as tt } from "./drop-core/buildClient.js";
+import { d as P, A as I } from "../../../chunks/hooks.module.DRcxknIz.js";
+import { renameSingleNonIndexHtmlToIndex as X, getSingleNonIndexHtmlFileName as Y, hasMultipleHtmlFilesWithoutIndex as Z } from "./drop-core/readFiles.js";
+import { detectBuild as B } from "./drop-core/detectBuild.js";
+import { AnonymousDropClient as D } from "./drop-core/client.js";
+import { AuthenticatedDropClient as T } from "./drop-core/authedDropClient.js";
+import { AuthenticatedBuildClient as U } from "./drop-core/buildClient.js";
 import "./drop-core/zip.js";
-import { deployFiles as W, deployBuild as et } from "./drop-core/deploy.js";
-import { NotAuthenticatedError as $, humanizeDropError as nt } from "./drop-core/errors.js";
+import { deployFiles as H, deployBuild as tt } from "./drop-core/deploy.js";
+import { NotAuthenticatedError as W, humanizeDropError as et } from "./drop-core/errors.js";
 function S(o) {
   switch (o.phase) {
     case "zipping":
@@ -22,39 +22,38 @@ function S(o) {
       return { kind: "processing" };
   }
 }
-function it(o) {
-  const f = Z(o);
-  return f ? `No index.html found — "${f}" won’t be served at the site root.` : B(o) ? "No index.html found — your site may not have a landing page." : null;
+function nt(o) {
+  const f = Y(o);
+  return f ? `No index.html found — "${f}" won’t be served at the site root.` : Z(o) ? "No index.html found — your site may not have a landing page." : null;
 }
-function mt({
+function ft({
   apiBase: o,
   client: f,
-  claimUrl: v,
-  siteDashboardUrl: j,
-  buildSignupUrl: q,
-  buildClient: M,
-  authenticatedDropClient: E,
+  claimUrl: $,
+  siteDashboardUrl: v,
+  buildSignupUrl: j,
+  buildClient: q,
+  authenticatedDropClient: M,
   getUploadToken: m,
-  proxyBase: x,
-  accountSlug: z,
-  buildDeployUrl: G,
-  waitForBuild: J,
-  onBuildRequired: C,
-  onDeploy: p,
+  accountSlug: x,
+  buildDeployUrl: E,
+  waitForBuild: G,
+  onBuildRequired: z,
+  onDeploy: g,
   onBuildDeploy: h,
   onError: b,
   track: c
 }) {
-  const [w, n] = H({ kind: "idle" }), [K, _] = H(null), L = I(f ?? new T(o)).current, A = I(
-    M ?? (m ? new tt({ proxyBase: x, getUploadToken: m, accountSlug: z }) : null)
-  ).current, F = I(
-    E ?? (m ? new U({ proxyBase: x, getUploadToken: m, accountSlug: z }) : null)
-  ).current, O = w.kind !== "idle" && w.kind !== "error";
-  async function Q(y, r) {
+  const [w, n] = P({ kind: "idle" }), [J, _] = P(null), K = I(f ?? new D(o)).current, C = I(
+    q ?? (m ? new U({ getUploadToken: m, accountSlug: x }) : null)
+  ).current, A = I(
+    M ?? (m ? new T({ getUploadToken: m, accountSlug: x }) : null)
+  ).current, L = w.kind !== "idle" && w.kind !== "error";
+  async function O(y, r) {
     try {
-      const { site: d, build: l, buildSettings: g, url: k } = await et(y, r, {
+      const { site: d, build: l, buildSettings: p, url: k } = await tt(y, r, {
         onProgress: (t) => n(S(t)),
-        waitForBuild: J
+        waitForBuild: G
       });
       return {
         url: k,
@@ -62,25 +61,25 @@ function mt({
         siteId: d.id,
         buildId: l.id,
         deployId: l.deploy_id,
-        buildSettings: g
+        buildSettings: p
       };
     } catch (d) {
-      if (d instanceof $) return null;
+      if (d instanceof W) return null;
       throw d;
     }
   }
-  async function R(y, r, d) {
+  async function Q(y, r, d) {
     _(null), n({ kind: "reading" });
-    const l = d.length ? { file_types: d } : {}, g = (t, i, a) => {
+    const l = d.length ? { file_types: d } : {}, p = (t, i, a) => {
       n({ kind: "error", message: t }), c("dropzone_deploy_failed", { method: r, reason: i, ...l, ...a }), b == null || b({ message: t, reason: i });
     }, k = (t, i) => {
       const a = t instanceof Error ? t.message : String(t);
-      g(nt(t), a, i);
+      p(et(t), a, i);
     };
     try {
-      const t = Y(await y());
+      const t = X(await y());
       if (!t.length) {
-        g("No files found to deploy.", "No files found to deploy.", { file_count: 0 });
+        p("No files found to deploy.", "No files found to deploy.", { file_count: 0 });
         return;
       }
       r === "drag" && c("dropzone_files_dropped", {
@@ -88,19 +87,19 @@ function mt({
         file_count: t.length,
         ...l
       });
-      const i = D(t);
+      const i = B(t);
       if (i.buildRequired) {
         if (c("dropzone_build_required", {
           method: r,
           reason: i.reason,
           file_count: t.length,
           ...l
-        }), C) {
-          n({ kind: "idle" }), C(i);
+        }), z) {
+          n({ kind: "idle" }), z(i);
           return;
         }
-        if (A) {
-          const e = await Q(A, t);
+        if (C) {
+          const e = await O(C, t);
           if (e) {
             n({ kind: "redirecting", target: "build" }), c("dropzone_build_deploy_succeeded", {
               method: r,
@@ -109,28 +108,28 @@ function mt({
               file_count: t.length,
               ...e.buildSettings ? { framework: e.buildSettings.framework } : {},
               ...l
-            }), h == null || h(e), window.location.assign(G(e));
+            }), h == null || h(e), window.location.assign(E(e));
             return;
           }
         }
-        n({ kind: "redirecting", target: "signup" }), window.location.assign(q);
+        n({ kind: "redirecting", target: "signup" }), window.location.assign(j);
         return;
       }
-      _(it(t));
-      let a = null, s = !1, P = !1;
-      if (F)
+      _(nt(t));
+      let a = null, s = !1, F = !1;
+      if (A)
         try {
-          a = await W(F, t, {
+          a = await H(A, t, {
             onProgress: (e) => n(S(e))
           }), s = !0;
         } catch (e) {
-          if (!(e instanceof $)) throw e;
-          P = !0;
+          if (!(e instanceof W)) throw e;
+          F = !0;
         }
-      a || (a = await W(L, t, {
+      a || (a = await H(K, t, {
         onProgress: (e) => n(S(e))
       }));
-      const { url: X, token: N, deploy: u } = a;
+      const { url: V, token: N, deploy: u } = a;
       if (!s)
         try {
           localStorage.setItem("drop-token", N), localStorage.setItem("dropSiteName", u.subdomain);
@@ -141,24 +140,24 @@ function mt({
         site_name: u.subdomain,
         file_count: t.length,
         authenticated: s,
-        ...P ? { auth_fallback: !0 } : {},
+        ...F ? { auth_fallback: !0 } : {},
         ...l
-      }), p == null || p({
-        url: X,
+      }), g == null || g({
+        url: V,
         ...s ? {} : { token: N },
         siteName: u.subdomain,
         siteId: u.id,
         authenticated: s
-      }), s ? window.location.assign(j(u.subdomain)) : window.location.assign(`${v(u.subdomain)}#drop_token=${N}`);
+      }), s ? window.location.assign(v(u.subdomain)) : window.location.assign(`${$(u.subdomain)}#drop_token=${N}`);
     } catch (t) {
       k(t);
     }
   }
-  function V() {
+  function R() {
     _(null), n({ kind: "idle" });
   }
-  return { status: w, warning: K, busy: O, deploy: R, reset: V };
+  return { status: w, warning: J, busy: L, deploy: Q, reset: R };
 }
 export {
-  mt as useDropDeploy
+  ft as useDropDeploy
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@netlify/spark-ui",
   "description": "Assets, design tokens, components, and utilities",
-  "version": "1.31.0-alpha.1",
+  "version": "1.31.0-alpha.2",
   "type": "module",
   "main": "dist/components/preact/index.js",
   "types": "dist/components/preact/index.d.ts",

package/packages/components/preact/DropZone/DropZone.tsx

@@ -93,13 +93,6 @@ interface Props {
    * static path. Distinct from `client`, which is the anonymous fallback.
    */
   authenticatedDropClient?: DropClient;
-  /**
-   * API root for the authenticated paths' JSON calls, which go through your
-   * access-control rewrite so the session cookie authorizes them. Defaults to
-   * `/access-control/bb-api/api/v1`. (Uploads always go direct to
-   * `api.netlify.com` — the proxy can't carry bodies that large.)
-   */
-  proxyBase?: string;
   /** Create the visitor's new project in this account. Omit for their default account. */
   accountSlug?: string;
   /**
@@ -187,7 +180,6 @@ export default function DropZone({
   getUploadToken,
   buildClient,
   authenticatedDropClient,
-  proxyBase,
   accountSlug,
   buildDeployUrl = defaultBuildDeployUrl,
   waitForBuild,
@@ -214,7 +206,6 @@ export default function DropZone({
     getUploadToken,
     buildClient,
     authenticatedDropClient,
-    proxyBase,
     accountSlug,
     buildDeployUrl,
     waitForBuild,

package/packages/components/preact/DropZone/drop-core/authedDropClient.ts

@@ -5,21 +5,16 @@ import { NotAuthenticatedError, SiteCreateError } from './errors';
 
 export interface AuthenticatedDropClientConfig {
   /**
-   * Base for JSON API calls, routed through the consumer's access-control
-   * rewrite so the session cookie authenticates them. On netlify.com that
-   * rewrite is `/access-control/*` → the app's access-control function, which
-   * makes `/access-control/bb-api/api/v1` the API root (the default here).
-   */
-  proxyBase?: string;
-  /**
-   * Direct API base for the per-file uploads. The proxy above runs in a Lambda
-   * with a ~6MB request body limit, so file PUTs go straight to
-   * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
+   * API base for every call. Requests go straight to `api.netlify.com`, whose
+   * `/api/*` CORS policy allows any origin, rather than through a consumer's
+   * access-control rewrite — that proxy allowlists paths per origin, and site
+   * and deploy creation are not on the list for netlify.com (they 400 with
+   * `x-debug: request origin not allowed to call endpoint`).
    */
   apiBase?: string;
   /**
-   * Mint a short-lived bearer token for those direct uploads. On netlify.com
-   * this is `GET /access-control/generate-access-control-token`, whose
+   * Mint a short-lived bearer token authorizing the calls. On netlify.com this
+   * is `GET /access-control/generate-access-control-token`, whose
    * `accessControlToken` the API decrypts back into the user's access token.
    * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
    */
@@ -36,7 +31,6 @@ export interface AuthenticatedDropClientConfig {
 // (constants + site create) are deliberately duplicated rather than extracted,
 // to avoid churn on the in-review build-client branch. Worth unifying once both
 // have landed.
-const PROXY_BASE = '/access-control/bb-api/api/v1';
 const API_BASE = 'https://api.netlify.com/api/v1';
 const POLL_INTERVAL_MS = 1000;
 const TIMEOUT_MS = 10 * 60 * 1000;
@@ -65,11 +59,12 @@ interface SiteDeployResponse {
  * There is no claim step, so the caller should hand off to the site's dashboard
  * page rather than the claim page.
  *
- * Requests split across two hosts by necessity: JSON calls go through the
- * consumer's access-control proxy (cookie session, no token handling in the
- * browser), while the per-file PUTs go direct to `api.netlify.com` with the
- * short-lived bearer from `getUploadToken()` because the proxy can't carry
- * large bodies.
+ * Every request goes direct to `api.netlify.com` with the short-lived bearer
+ * from `getUploadToken()`. Routing the JSON calls through a consumer's
+ * access-control rewrite instead (cookie session, no token in the browser)
+ * would be the tighter design, but that proxy allowlists paths per origin and
+ * site/deploy creation isn't allowed from netlify.com — it 400s before
+ * reaching the API. Revisit if that allowlist gains these paths.
  *
  * Error-mapping invariant: only pre-mutation failures — a null upload token, or
  * a 401/403 creating the site — throw `NotAuthenticatedError`, which is the
@@ -79,7 +74,6 @@ interface SiteDeployResponse {
  * anonymously.
  */
 export class AuthenticatedDropClient implements DropClient {
-  private proxyBase: string;
   private apiBase: string;
   private getUploadToken: () => Promise<string | null>;
   private accountSlug?: string;
@@ -87,14 +81,12 @@ export class AuthenticatedDropClient implements DropClient {
   private timeoutMs: number;
 
   constructor({
-    proxyBase = PROXY_BASE,
     apiBase = API_BASE,
     getUploadToken,
     accountSlug,
     pollIntervalMs = POLL_INTERVAL_MS,
     timeoutMs = TIMEOUT_MS,
   }: AuthenticatedDropClientConfig) {
-    this.proxyBase = proxyBase;
     this.apiBase = apiBase;
     this.getUploadToken = getUploadToken;
     this.accountSlug = accountSlug;
@@ -103,10 +95,9 @@ export class AuthenticatedDropClient implements DropClient {
   }
 
   /**
-   * The token here is the upload bearer, not a drop token — it authorizes the
-   * direct-API file PUTs, while the proxied JSON calls ignore it and ride the
-   * session cookie. Minted once per deploy, before anything is created, so a
-   * missing session fails the whole attempt cleanly.
+   * The token here is the upload bearer, not a drop token — it authorizes every
+   * call this client makes. Minted once per deploy, before anything is created,
+   * so a missing session fails the whole attempt cleanly.
    */
   async getToken(): Promise<string> {
     const token = await this.getUploadToken();
@@ -115,16 +106,15 @@ export class AuthenticatedDropClient implements DropClient {
   }
 
   /**
-   * Two proxied calls: create the site in the visitor's account, then the
-   * deploy on it. Mapped into the anonymous `DropResponse` shape so
-   * `deployFiles` runs unchanged over either client.
+   * Two calls: create the site in the visitor's account, then the deploy on it.
+   * Mapped into the anonymous `DropResponse` shape so `deployFiles` runs
+   * unchanged over either client.
    */
-  async createDeploy(files: Digest, _token: string): Promise<DropResponse> {
+  async createDeploy(files: Digest, token: string): Promise<DropResponse> {
     const path = this.accountSlug ? `/${this.accountSlug}/sites` : '/sites';
-    const siteRes = await fetch(`${this.proxyBase}${path}`, {
+    const siteRes = await fetch(`${this.apiBase}${path}`, {
       method: 'POST',
-      credentials: 'include',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
       body: JSON.stringify({ created_via: 'drop' }),
     });
     // A logged-out visitor 401s here, before anything is created — the one
@@ -133,10 +123,9 @@ export class AuthenticatedDropClient implements DropClient {
     if (!siteRes.ok) throw new SiteCreateError(siteRes.status);
     const site: BuildSite = await siteRes.json();
 
-    const deployRes = await fetch(`${this.proxyBase}/sites/${site.id}/deploys`, {
+    const deployRes = await fetch(`${this.apiBase}/sites/${site.id}/deploys`, {
       method: 'POST',
-      credentials: 'include',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
       body: JSON.stringify({ files, deploy_source: 'drop' }),
     });
     if (!deployRes.ok) throw apiError('deploy create', deployRes.status);
@@ -156,7 +145,6 @@ export class AuthenticatedDropClient implements DropClient {
     content: ArrayBuffer,
     token: string
   ): Promise<void> {
-    // Direct to api.netlify.com with the upload bearer — see the class doc.
     // PUT (not POST) so paths with "&" etc. work.
     const res = await fetch(`${this.apiBase}/deploys/${deployId}/files${path}`, {
       method: 'PUT',
@@ -167,15 +155,18 @@ export class AuthenticatedDropClient implements DropClient {
   }
 
   /**
-   * Poll the deploy through the proxy until it settles — the session cookie
-   * outlives the short-lived upload bearer, so a slow deploy can't expire its
-   * own poll. Resolve on `ready`, throw on `error`/`rejected`, throw on timeout.
+   * Poll until the deploy settles: resolve on `ready`, throw on
+   * `error`/`rejected`, throw on timeout. Reuses the bearer minted at the start
+   * of the deploy, so a deploy that outlives the token's TTL will start seeing
+   * 401s here — those are ignored like any other non-ok read and the loop runs
+   * to its timeout rather than failing fast. Acceptable while static deploys
+   * finish in seconds; re-mint per poll if that stops being true.
    */
-  async waitUntilReady(deploy: DropResponse, _token: string): Promise<void> {
+  async waitUntilReady(deploy: DropResponse, token: string): Promise<void> {
     const deadline = this.timeoutMs / this.pollIntervalMs;
     for (let i = 0; i < deadline; i++) {
-      const res = await fetch(`${this.proxyBase}/deploys/${deploy.deploy_id}`, {
-        credentials: 'include',
+      const res = await fetch(`${this.apiBase}/deploys/${deploy.deploy_id}`, {
+        headers: { Authorization: `Bearer ${token}` },
       });
       if (res.ok) {
         const state: DeployState = await res.json();

package/packages/components/preact/DropZone/drop-core/buildClient.ts

@@ -33,20 +33,17 @@ export interface BuildClient {
 
 export interface AuthenticatedBuildClientConfig {
   /**
-   * Base for JSON API calls, routed through the consumer's access-control
-   * rewrite so the session cookie authenticates them. On netlify.com that
-   * rewrite is `/access-control/*` → the app's access-control function, which
-   * makes `/access-control/bb-api/api/v1` the API root (the default here).
-   */
-  proxyBase?: string;
-  /**
-   * Direct API base for the zip upload. The proxy above runs in a Lambda with a
-   * ~6MB request body limit, so the multipart POST has to go straight to
-   * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
+   * API base for every call. Requests go straight to `api.netlify.com`, whose
+   * `/api/*` CORS policy allows any origin, rather than through a consumer's
+   * access-control rewrite — that proxy allowlists paths per origin, and site
+   * creation and deploy reads are not on the list for netlify.com (they 400
+   * with `x-debug: request origin not allowed to call endpoint`). The zip
+   * upload could not use that proxy regardless: it runs in a Lambda with a
+   * ~6MB request body limit.
    */
   apiBase?: string;
   /**
-   * Mint a short-lived bearer token for that direct upload. On netlify.com this
+   * Mint a short-lived bearer token authorizing the calls. On netlify.com this
    * is `GET /access-control/generate-access-control-token`, whose
    * `accessControlToken` the API decrypts back into the user's access token.
    * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
@@ -62,7 +59,6 @@ export interface AuthenticatedBuildClientConfig {
   timeoutMs?: number;
 }
 
-const PROXY_BASE = '/access-control/bb-api/api/v1';
 const API_BASE = 'https://api.netlify.com/api/v1';
 const POLL_INTERVAL_MS = 1000;
 const TIMEOUT_MS = 10 * 60 * 1000;
@@ -88,7 +84,6 @@ interface DeployState {
  * short-lived bearer token because the proxy can't carry a body that large.
  */
 export class AuthenticatedBuildClient implements BuildClient {
-  private proxyBase: string;
   private apiBase: string;
   private getUploadToken: () => Promise<string | null>;
   private accountSlug?: string;
@@ -97,7 +92,6 @@ export class AuthenticatedBuildClient implements BuildClient {
   private timeoutMs: number;
 
   constructor({
-    proxyBase = PROXY_BASE,
     apiBase = API_BASE,
     getUploadToken,
     accountSlug,
@@ -105,7 +99,6 @@ export class AuthenticatedBuildClient implements BuildClient {
     pollIntervalMs = POLL_INTERVAL_MS,
     timeoutMs = TIMEOUT_MS,
   }: AuthenticatedBuildClientConfig) {
-    this.proxyBase = proxyBase;
     this.apiBase = apiBase;
     this.getUploadToken = getUploadToken;
     this.accountSlug = accountSlug;
@@ -115,16 +108,17 @@ export class AuthenticatedBuildClient implements BuildClient {
   }
 
   /**
-   * Create the site the build deploys into. Goes through the proxy with
-   * `credentials: 'include'` so the app session authorizes it; without an
-   * account slug the API picks the user's default account.
+   * Create the site the build deploys into. Authorized by the bearer token;
+   * without an account slug the API picks the user's default account.
    */
   async createSite(): Promise<BuildSite> {
+    const token = await this.getUploadToken();
+    if (!token) throw new NotAuthenticatedError();
+
     const path = this.accountSlug ? `/${this.accountSlug}/sites` : '/sites';
-    const res = await fetch(`${this.proxyBase}${path}`, {
+    const res = await fetch(`${this.apiBase}${path}`, {
       method: 'POST',
-      credentials: 'include',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
       body: JSON.stringify({ created_via: 'drop' }),
     });
     // A logged-out visitor gets a 401 here rather than at the token step, since
@@ -159,22 +153,25 @@ export class AuthenticatedBuildClient implements BuildClient {
   }
 
   /**
-   * Poll the build's deploy through the proxy until it settles, mirroring
+   * Poll the build's deploy until it settles, mirroring
    * `AnonymousDropClient.waitUntilReady` — resolve on `ready`, throw on
    * `error`/`rejected`, throw on timeout. A build that hasn't been given a
    * deploy id yet has nothing pollable, so it resolves immediately and the
    * caller falls back to the site page.
    *
-   * Optional in the drop flow: a build takes minutes, so the default hand-off
-   * redirects to the app's deploy page (live logs) instead of waiting here.
+   * Optional in the drop flow, and off by default: a build takes minutes, which
+   * can outlive the bearer token minted for it. Each poll re-mints so a long
+   * build keeps reading; a token that can't be minted any more ends the wait as
+   * a timeout rather than a false failure.
    */
   async waitUntilBuildReady(build: BuildResponse): Promise<void> {
     if (!build.deploy_id) return;
 
     const deadline = this.timeoutMs / this.pollIntervalMs;
     for (let i = 0; i < deadline; i++) {
-      const res = await fetch(`${this.proxyBase}/deploys/${build.deploy_id}`, {
-        credentials: 'include',
+      const token = await this.getUploadToken();
+      const res = await fetch(`${this.apiBase}/deploys/${build.deploy_id}`, {
+        headers: token ? { Authorization: `Bearer ${token}` } : {},
       });
       if (res.ok) {
         const deploy: DeployState = await res.json();

package/packages/components/preact/DropZone/useDropDeploy.ts

@@ -89,7 +89,6 @@ interface UseDropDeployOptions {
   buildClient?: BuildClient;
   authenticatedDropClient?: DropClient;
   getUploadToken?: () => Promise<string | null>;
-  proxyBase?: string;
   accountSlug?: string;
   buildDeployUrl: (build: DeployedBuild) => string;
   waitForBuild?: boolean;
@@ -142,7 +141,6 @@ export function useDropDeploy({
   buildClient,
   authenticatedDropClient,
   getUploadToken,
-  proxyBase,
   accountSlug,
   buildDeployUrl,
   waitForBuild,
@@ -162,9 +160,7 @@ export function useDropDeploy({
   // fresh client (and a fresh token cache) to an in-flight deploy.
   const authedBuildClient = useRef(
     buildClient ??
-      (getUploadToken
-        ? new AuthenticatedBuildClient({ proxyBase, getUploadToken, accountSlug })
-        : null)
+      (getUploadToken ? new AuthenticatedBuildClient({ getUploadToken, accountSlug }) : null)
   ).current;
 
   // Same opt-in for static drops: with authenticated wiring present, deploy
@@ -172,9 +168,7 @@ export function useDropDeploy({
   // every static drop stays anonymous.
   const authedDropClient = useRef(
     authenticatedDropClient ??
-      (getUploadToken
-        ? new AuthenticatedDropClient({ proxyBase, getUploadToken, accountSlug })
-        : null)
+      (getUploadToken ? new AuthenticatedDropClient({ getUploadToken, accountSlug }) : null)
   ).current;
 
   const busy = status.kind !== 'idle' && status.kind !== 'error';