@netlify/spark-ui 1.31.0-alpha.2 → 1.31.0-alpha.3

package/dist/components/preact/DropZone/DropZone.d.ts

@@ -47,6 +47,13 @@ interface Props {
      * static path. Distinct from `client`, which is the anonymous fallback.
      */
     authenticatedDropClient?: DropClient;
+    /**
+     * API root for the authenticated paths' JSON calls, which go through your
+     * access-control rewrite so the session cookie authorizes them. Defaults to
+     * `/access-control/bb-api/api/v1`. (Uploads always go direct to
+     * `api.netlify.com` — the proxy can't carry bodies that large.)
+     */
+    proxyBase?: string;
     /** Create the visitor's new project in this account. Omit for their default account. */
     accountSlug?: string;
     /**
@@ -123,5 +130,5 @@ interface Props {
     analyticsId?: string;
     className?: string;
 }
-export default function DropZone({ children, apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, getUploadToken, buildClient, authenticatedDropClient, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, showStatus, onTrack, analyticsId, className, }: Props): import("preact").JSX.Element;
+export default function DropZone({ children, apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, getUploadToken, buildClient, authenticatedDropClient, proxyBase, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, showStatus, onTrack, analyticsId, className, }: Props): import("preact").JSX.Element;
 export {};

package/dist/components/preact/DropZone/DropZone.js

@@ -1,35 +1,36 @@
 import { u as e } from "../../../chunks/jsxRuntime.module.Bzuv3cXw.js";
-import { A as j, d as V, y as G } from "../../../chunks/hooks.module.DRcxknIz.js";
-import { readFileList as K, readDataTransfer as L } from "./drop-core/readFiles.js";
+import { A as j, d as G, y as K } from "../../../chunks/hooks.module.DRcxknIz.js";
+import { readFileList as L, readDataTransfer as Z } from "./drop-core/readFiles.js";
 import { getFileTypes as D } from "./drop-core/fileTypes.js";
 import "./drop-core/detectBuild.js";
 import "./drop-core/zip.js";
-import { useDropDeploy as Z } from "./useDropDeploy.js";
+import { useDropDeploy as q } from "./useDropDeploy.js";
 import { Fragment as w } from "preact";
-import '../../../assets/DropZone.css';const q = 120, H = (r) => `https://app.netlify.com/drop/${r}`, J = (r) => `https://app.netlify.com/projects/${r}`, Q = "https://app.netlify.com/signup?next=/drop&utm_campaign=drop", W = ({ siteName: r }) => `https://app.netlify.com/projects/${r}`;
-function se({
+import '../../../assets/DropZone.css';const H = 120, J = (r) => `https://app.netlify.com/drop/${r}`, Q = (r) => `https://app.netlify.com/projects/${r}`, W = "https://app.netlify.com/signup?next=/drop&utm_campaign=drop", X = ({ siteName: r }) => `https://app.netlify.com/projects/${r}`;
+function ce({
   children: r,
   apiBase: a,
   client: l,
-  claimUrl: c = H,
-  siteDashboardUrl: u = J,
-  buildSignupUrl: A = Q,
+  claimUrl: c = J,
+  siteDashboardUrl: u = Q,
+  buildSignupUrl: A = W,
   getUploadToken: T,
   buildClient: C,
   authenticatedDropClient: S,
-  accountSlug: _,
-  buildDeployUrl: $ = W,
-  waitForBuild: B,
-  onBuildRequired: U,
-  onDeploy: P,
-  onBuildDeploy: R,
-  onError: x,
+  proxyBase: _,
+  accountSlug: $,
+  buildDeployUrl: B = X,
+  waitForBuild: U,
+  onBuildRequired: P,
+  onDeploy: R,
+  onBuildDeploy: x,
+  onError: E,
   showStatus: f = !0,
   onTrack: d,
   analyticsId: g,
-  className: E
+  className: F
 }) {
-  const y = (t, n = {}) => d == null ? void 0 : d(t, g ? { dropzone_id: g, ...n } : n), { status: s, warning: b, busy: i, deploy: m, reset: F } = Z({
+  const y = (t, n = {}) => d == null ? void 0 : d(t, g ? { dropzone_id: g, ...n } : n), { status: s, warning: b, busy: i, deploy: m, reset: I } = q({
     apiBase: a,
     client: l,
     claimUrl: c,
@@ -38,40 +39,41 @@ function se({
     getUploadToken: T,
     buildClient: C,
     authenticatedDropClient: S,
-    accountSlug: _,
-    buildDeployUrl: $,
-    waitForBuild: B,
-    onBuildRequired: U,
-    onDeploy: P,
-    onBuildDeploy: R,
-    onError: x,
+    proxyBase: _,
+    accountSlug: $,
+    buildDeployUrl: B,
+    waitForBuild: U,
+    onBuildRequired: P,
+    onDeploy: R,
+    onBuildDeploy: x,
+    onError: E,
     track: y
-  }), { active: p, keepActive: I, endDrag: M } = X(), h = j(null), v = (t) => {
+  }), { active: p, keepActive: M, endDrag: N } = Y(), h = j(null), v = (t) => {
     var n;
     y("dropzone_browse_opened", { method: t }), (n = h.current) == null || n.click();
-  }, N = f && (p || i || s.kind === "error"), O = [
+  }, O = f && (p || i || s.kind === "error"), V = [
     "n-dropzone",
     p && "is-active",
     i && "is-busy",
     !f && "is-bare",
-    E
+    F
   ].filter(Boolean).join(" ");
   return /* @__PURE__ */ e(
     "div",
     {
-      class: O,
+      class: V,
       "data-state": s.kind,
       role: "button",
       tabIndex: i ? -1 : 0,
       "aria-label": "Drop a site folder or zip here to deploy it, or press Enter to browse for files",
       "aria-busy": i,
       onDragOver: (t) => {
-        i || (t.preventDefault(), I());
+        i || (t.preventDefault(), M());
       },
       onDrop: (t) => {
-        if (t.preventDefault(), M(), i) return;
+        if (t.preventDefault(), N(), i) return;
         const n = t.dataTransfer;
-        n && m(() => L(n), "drag", D(n.files));
+        n && m(() => Z(n), "drag", D(n.files));
       },
       onClick: (t) => {
         !i && t.target === t.currentTarget && v("click");
@@ -95,18 +97,18 @@ function se({
               const n = t.currentTarget;
               if ((k = n.files) != null && k.length) {
                 const z = n.files;
-                m(() => K(z), "browse", D(z));
+                m(() => L(z), "browse", D(z));
               }
               n.value = "";
             }
           }
         ),
-        N && /* @__PURE__ */ e(
+        O && /* @__PURE__ */ e(
           "div",
           {
             class: "n-dropzone-overlay n-fadeIn",
             children: [
-              /* @__PURE__ */ e(Y, { status: s, active: p, onReset: F }),
+              /* @__PURE__ */ e(ee, { status: s, active: p, onReset: I }),
               b && s.kind !== "error" && i && /* @__PURE__ */ e("p", { class: "n-dropzone-warning", role: "status", children: b })
             ]
           },
@@ -116,15 +118,15 @@ function se({
     }
   );
 }
-function X() {
-  const [r, a] = V(!1), l = j();
-  return G(() => () => clearTimeout(l.current), []), { active: r, keepActive: () => {
-    a(!0), clearTimeout(l.current), l.current = setTimeout(() => a(!1), q);
+function Y() {
+  const [r, a] = G(!1), l = j();
+  return K(() => () => clearTimeout(l.current), []), { active: r, keepActive: () => {
+    a(!0), clearTimeout(l.current), l.current = setTimeout(() => a(!1), H);
   }, endDrag: () => {
     clearTimeout(l.current), a(!1);
   } };
 }
-function Y({
+function ee({
   status: r,
   active: a,
   onReset: l
@@ -180,5 +182,5 @@ function o({ label: r }) {
   ] });
 }
 export {
-  se as default
+  ce as default
 };

package/dist/components/preact/DropZone/drop-core/authedDropClient.d.ts

@@ -2,18 +2,26 @@ import { DropClient } from './client';
 import { Digest, DropResponse } from './types';
 export interface AuthenticatedDropClientConfig {
     /**
-     * API base for every call. Requests go straight to `api.netlify.com`, whose
-     * `/api/*` CORS policy allows any origin, rather than through a consumer's
-     * access-control rewrite — that proxy allowlists paths per origin, and site
-     * and deploy creation are not on the list for netlify.com (they 400 with
-     * `x-debug: request origin not allowed to call endpoint`).
+     * Base for JSON API calls, routed through the consumer's access-control
+     * rewrite so the session cookie authenticates them. On netlify.com that
+     * rewrite is `/access-control/*` → the app's access-control function, which
+     * makes `/access-control/bb-api/api/v1` the API root (the default here).
+     */
+    proxyBase?: string;
+    /**
+     * Direct API base for the file uploads. The proxy above runs in a Lambda with
+     * a ~6MB request body limit, so file PUTs go straight to `api.netlify.com`
+     * (whose `/api/*` CORS policy allows any origin).
      */
     apiBase?: string;
     /**
-     * Mint a short-lived bearer token authorizing the calls. On netlify.com this
-     * is `GET /access-control/generate-access-control-token`, whose
+     * Mint a bearer token for those direct uploads. On netlify.com this is
+     * `GET /access-control/generate-access-control-token`, whose
      * `accessControlToken` the API decrypts back into the user's access token.
      * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
+     *
+     * Called repeatedly, not once: the token issued to a non-app origin lives
+     * only 30 seconds, which a multi-file upload routinely outlasts.
      */
     getUploadToken: () => Promise<string | null>;
     /** Create the site in this account. Omit to use the user's default account. */
@@ -31,47 +39,62 @@ export interface AuthenticatedDropClientConfig {
  * There is no claim step, so the caller should hand off to the site's dashboard
  * page rather than the claim page.
  *
- * Every request goes direct to `api.netlify.com` with the short-lived bearer
- * from `getUploadToken()`. Routing the JSON calls through a consumer's
- * access-control rewrite instead (cookie session, no token in the browser)
- * would be the tighter design, but that proxy allowlists paths per origin and
- * site/deploy creation isn't allowed from netlify.com — it 400s before
- * reaching the API. Revisit if that allowlist gains these paths.
+ * Requests split across two hosts by necessity. JSON calls (create the site,
+ * create the deploy, poll it) go through the consumer's access-control proxy on
+ * the session cookie — no token involved, and nothing that can expire mid-deploy.
+ * File uploads can't: the proxy caps bodies at ~6MB, so they go direct to
+ * `api.netlify.com` with a bearer, re-minted as it ages (see `TOKEN_REUSE_MS`).
  *
- * Error-mapping invariant: only pre-mutation failures — a null upload token, or
- * a 401/403 creating the site — throw `NotAuthenticatedError`, which is the
- * signal the drop flow may safely retry anonymously. Once the site exists, an
- * auth failure throws a plain status-carrying error instead: falling back at
- * that point would strand an empty site in the account *and* deploy a duplicate
+ * Error-mapping invariant: only pre-mutation failures — a null upload token at
+ * the gate, or a 401/403 creating the site — throw `NotAuthenticatedError`,
+ * which is the signal the drop flow may safely retry anonymously. Once the site
+ * exists, any auth failure throws a plain error instead: falling back at that
+ * point would strand an empty site in the account *and* deploy a duplicate
  * anonymously.
  */
 export declare class AuthenticatedDropClient implements DropClient {
+    private proxyBase;
     private apiBase;
     private getUploadToken;
     private accountSlug?;
     private pollIntervalMs;
     private timeoutMs;
-    constructor({ apiBase, getUploadToken, accountSlug, pollIntervalMs, timeoutMs, }: AuthenticatedDropClientConfig);
+    private cachedToken?;
+    constructor({ proxyBase, apiBase, getUploadToken, accountSlug, pollIntervalMs, timeoutMs, }: AuthenticatedDropClientConfig);
     /**
-     * The token here is the upload bearer, not a drop token — it authorizes every
-     * call this client makes. Minted once per deploy, before anything is created,
-     * so a missing session fails the whole attempt cleanly.
+     * The auth gate. Minting here — before anything is created — is what lets a
+     * logged-out visitor fail cleanly and fall back to the anonymous flow. The
+     * returned token is threaded through `deployFiles`, but only the uploads
+     * actually need one, and they re-mint rather than trusting this to still be
+     * valid by the time they run.
      */
     getToken(): Promise<string>;
     /**
-     * Two calls: create the site in the visitor's account, then the deploy on it.
-     * Mapped into the anonymous `DropResponse` shape so `deployFiles` runs
-     * unchanged over either client.
+     * A token young enough to authorize an upload, minting a new one once the
+     * cached one nears its 30s expiry.
+     *
+     * Deliberately NOT `NotAuthenticatedError` when minting fails: by the time
+     * uploads run the site already exists, and that error would send the drop
+     * back through the anonymous path — leaving an empty project behind and
+     * deploying a duplicate. See the class doc.
+     */
+    private freshToken;
+    /**
+     * Two proxied calls: create the site in the visitor's account, then the
+     * deploy on it. Mapped into the anonymous `DropResponse` shape so
+     * `deployFiles` runs unchanged over either client.
+     */
+    createDeploy(files: Digest, _token: string): Promise<DropResponse>;
+    /**
+     * Direct to `api.netlify.com` on a freshly-aged bearer — the threaded `token`
+     * is ignored because an upload queue easily outlives the 30 seconds it was
+     * minted with. PUT (not POST) so paths with "&" etc. work.
      */
-    createDeploy(files: Digest, token: string): Promise<DropResponse>;
-    uploadFile(deployId: string, path: string, content: ArrayBuffer, token: string): Promise<void>;
+    uploadFile(deployId: string, path: string, content: ArrayBuffer, _token: string): Promise<void>;
     /**
-     * Poll until the deploy settles: resolve on `ready`, throw on
-     * `error`/`rejected`, throw on timeout. Reuses the bearer minted at the start
-     * of the deploy, so a deploy that outlives the token's TTL will start seeing
-     * 401s here — those are ignored like any other non-ok read and the loop runs
-     * to its timeout rather than failing fast. Acceptable while static deploys
-     * finish in seconds; re-mint per poll if that stops being true.
+     * Poll the deploy through the proxy until it settles: resolve on `ready`,
+     * throw on `error`/`rejected`, throw on timeout. On the session cookie rather
+     * than a bearer, so a deploy taking minutes can't outlive its own credentials.
      */
-    waitUntilReady(deploy: DropResponse, token: string): Promise<void>;
+    waitUntilReady(deploy: DropResponse, _token: string): Promise<void>;
 }

package/dist/components/preact/DropZone/drop-core/authedDropClient.js

@@ -1,93 +1,119 @@
-var c = Object.defineProperty;
-var h = (r, t, e) => t in r ? c(r, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : r[t] = e;
-var n = (r, t, e) => h(r, typeof t != "symbol" ? t + "" : t, e);
-import { apiError as l } from "./client.js";
-import { NotAuthenticatedError as p, SiteCreateError as u } from "./errors.js";
-const y = "https://api.netlify.com/api/v1", w = 1e3, f = 10 * 60 * 1e3, m = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
+var h = Object.defineProperty;
+var p = (r, e, o) => e in r ? h(r, e, { enumerable: !0, configurable: !0, writable: !0, value: o }) : r[e] = o;
+var i = (r, e, o) => p(r, typeof e != "symbol" ? e + "" : e, o);
+import { apiError as d } from "./client.js";
+import { NotAuthenticatedError as l, SiteCreateError as u } from "./errors.js";
+const y = "/access-control/bb-api/api/v1", w = "https://api.netlify.com/api/v1", T = 1e3, f = 10 * 60 * 1e3, k = 20 * 1e3, m = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
 class g {
   constructor({
-    apiBase: t = y,
-    getUploadToken: e,
-    accountSlug: i,
-    pollIntervalMs: o = w,
-    timeoutMs: s = f
+    proxyBase: e = y,
+    apiBase: o = w,
+    getUploadToken: n,
+    accountSlug: s,
+    pollIntervalMs: a = T,
+    timeoutMs: t = f
   }) {
-    n(this, "apiBase");
-    n(this, "getUploadToken");
-    n(this, "accountSlug");
-    n(this, "pollIntervalMs");
-    n(this, "timeoutMs");
-    this.apiBase = t, this.getUploadToken = e, this.accountSlug = i, this.pollIntervalMs = o, this.timeoutMs = s;
+    i(this, "proxyBase");
+    i(this, "apiBase");
+    i(this, "getUploadToken");
+    i(this, "accountSlug");
+    i(this, "pollIntervalMs");
+    i(this, "timeoutMs");
+    i(this, "cachedToken");
+    this.proxyBase = e, this.apiBase = o, this.getUploadToken = n, this.accountSlug = s, this.pollIntervalMs = a, this.timeoutMs = t;
   }
   /**
-   * The token here is the upload bearer, not a drop token — it authorizes every
-   * call this client makes. Minted once per deploy, before anything is created,
-   * so a missing session fails the whole attempt cleanly.
+   * The auth gate. Minting here — before anything is created — is what lets a
+   * logged-out visitor fail cleanly and fall back to the anonymous flow. The
+   * returned token is threaded through `deployFiles`, but only the uploads
+   * actually need one, and they re-mint rather than trusting this to still be
+   * valid by the time they run.
    */
   async getToken() {
-    const t = await this.getUploadToken();
-    if (!t) throw new p();
-    return t;
+    const e = await this.getUploadToken();
+    if (!e) throw new l();
+    return this.cachedToken = { value: e, mintedAt: Date.now() }, e;
   }
   /**
-   * Two calls: create the site in the visitor's account, then the deploy on it.
-   * Mapped into the anonymous `DropResponse` shape so `deployFiles` runs
-   * unchanged over either client.
+   * A token young enough to authorize an upload, minting a new one once the
+   * cached one nears its 30s expiry.
+   *
+   * Deliberately NOT `NotAuthenticatedError` when minting fails: by the time
+   * uploads run the site already exists, and that error would send the drop
+   * back through the anonymous path — leaving an empty project behind and
+   * deploying a duplicate. See the class doc.
    */
-  async createDeploy(t, e) {
-    const i = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", o = await fetch(`${this.apiBase}${i}`, {
+  async freshToken() {
+    const e = Date.now();
+    if (this.cachedToken && e - this.cachedToken.mintedAt < k)
+      return this.cachedToken.value;
+    const o = await this.getUploadToken();
+    if (!o) throw new Error("could not renew the upload token");
+    return this.cachedToken = { value: o, mintedAt: e }, o;
+  }
+  /**
+   * Two proxied calls: create the site in the visitor's account, then the
+   * deploy on it. Mapped into the anonymous `DropResponse` shape so
+   * `deployFiles` runs unchanged over either client.
+   */
+  async createDeploy(e, o) {
+    const n = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", s = await fetch(`${this.proxyBase}${n}`, {
       method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${e}` },
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ created_via: "drop" })
     });
-    if (o.status === 401 || o.status === 403) throw new p();
-    if (!o.ok) throw new u(o.status);
-    const s = await o.json(), a = await fetch(`${this.apiBase}/sites/${s.id}/deploys`, {
+    if (s.status === 401 || s.status === 403) throw new l();
+    if (!s.ok) throw new u(s.status);
+    const a = await s.json(), t = await fetch(`${this.proxyBase}/sites/${a.id}/deploys`, {
       method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${e}` },
-      body: JSON.stringify({ files: t, deploy_source: "drop" })
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ files: e, deploy_source: "drop" })
     });
-    if (!a.ok) throw l("deploy create", a.status);
-    const d = await a.json();
+    if (!t.ok) throw d("deploy create", t.status);
+    const c = await t.json();
     return {
-      id: s.id,
-      deploy_id: d.id,
-      subdomain: s.name,
-      required: d.required ?? []
+      id: a.id,
+      deploy_id: c.id,
+      subdomain: a.name,
+      required: c.required ?? []
     };
   }
-  async uploadFile(t, e, i, o) {
-    const s = await fetch(`${this.apiBase}/deploys/${t}/files${e}`, {
+  /**
+   * Direct to `api.netlify.com` on a freshly-aged bearer — the threaded `token`
+   * is ignored because an upload queue easily outlives the 30 seconds it was
+   * minted with. PUT (not POST) so paths with "&" etc. work.
+   */
+  async uploadFile(e, o, n, s) {
+    const a = await this.freshToken(), t = await fetch(`${this.apiBase}/deploys/${e}/files${o}`, {
       method: "PUT",
-      headers: { "Content-Type": "application/octet-stream", Authorization: `Bearer ${o}` },
-      body: i
+      headers: { "Content-Type": "application/octet-stream", Authorization: `Bearer ${a}` },
+      body: n
     });
-    if (!s.ok) throw l(`upload ${e}`, s.status);
+    if (!t.ok) throw d(`upload ${o}`, t.status);
   }
   /**
-   * Poll until the deploy settles: resolve on `ready`, throw on
-   * `error`/`rejected`, throw on timeout. Reuses the bearer minted at the start
-   * of the deploy, so a deploy that outlives the token's TTL will start seeing
-   * 401s here — those are ignored like any other non-ok read and the loop runs
-   * to its timeout rather than failing fast. Acceptable while static deploys
-   * finish in seconds; re-mint per poll if that stops being true.
+   * Poll the deploy through the proxy until it settles: resolve on `ready`,
+   * throw on `error`/`rejected`, throw on timeout. On the session cookie rather
+   * than a bearer, so a deploy taking minutes can't outlive its own credentials.
    */
-  async waitUntilReady(t, e) {
-    const i = this.timeoutMs / this.pollIntervalMs;
-    for (let o = 0; o < i; o++) {
-      const s = await fetch(`${this.apiBase}/deploys/${t.deploy_id}`, {
-        headers: { Authorization: `Bearer ${e}` }
+  async waitUntilReady(e, o) {
+    const n = this.timeoutMs / this.pollIntervalMs;
+    for (let s = 0; s < n; s++) {
+      const a = await fetch(`${this.proxyBase}/deploys/${e.deploy_id}`, {
+        credentials: "include"
       });
-      if (s.ok) {
-        const a = await s.json();
-        if (a.state && m.has(a.state)) {
-          if (a.state === "ready") return;
+      if (a.ok) {
+        const t = await a.json();
+        if (t.state && m.has(t.state)) {
+          if (t.state === "ready") return;
           throw new Error(
-            a.error_message ? `deploy failed: ${a.error_message}` : "deploy failed"
+            t.error_message ? `deploy failed: ${t.error_message}` : "deploy failed"
           );
         }
       }
-      await new Promise((a) => setTimeout(a, this.pollIntervalMs));
+      await new Promise((t) => setTimeout(t, this.pollIntervalMs));
     }
     throw new Error("Deploy did not become ready in time");
   }

package/dist/components/preact/DropZone/drop-core/buildClient.d.ts

@@ -22,20 +22,27 @@ export interface BuildClient {
 }
 export interface AuthenticatedBuildClientConfig {
     /**
-     * API base for every call. Requests go straight to `api.netlify.com`, whose
-     * `/api/*` CORS policy allows any origin, rather than through a consumer's
-     * access-control rewrite — that proxy allowlists paths per origin, and site
-     * creation and deploy reads are not on the list for netlify.com (they 400
-     * with `x-debug: request origin not allowed to call endpoint`). The zip
-     * upload could not use that proxy regardless: it runs in a Lambda with a
-     * ~6MB request body limit.
+     * Base for JSON API calls, routed through the consumer's access-control
+     * rewrite so the session cookie authenticates them. On netlify.com that
+     * rewrite is `/access-control/*` → the app's access-control function, which
+     * makes `/access-control/bb-api/api/v1` the API root (the default here).
+     */
+    proxyBase?: string;
+    /**
+     * Direct API base for the zip upload. The proxy above runs in a Lambda with a
+     * ~6MB request body limit, so the multipart POST has to go straight to
+     * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
      */
     apiBase?: string;
     /**
-     * Mint a short-lived bearer token authorizing the calls. On netlify.com this
-     * is `GET /access-control/generate-access-control-token`, whose
+     * Mint a bearer token for that direct upload. On netlify.com this is
+     * `GET /access-control/generate-access-control-token`, whose
      * `accessControlToken` the API decrypts back into the user's access token.
      * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
+     *
+     * Note the token issued to a non-app origin lives only 30 seconds. It is
+     * minted immediately before the upload, but a zip that takes longer than that
+     * to transfer will still be rejected mid-flight — see `createBuildFromZip`.
      */
     getUploadToken: () => Promise<string | null>;
     /** Create the site in this account. Omit to use the user's default account. */
@@ -60,16 +67,18 @@ export interface AuthenticatedBuildClientConfig {
  * short-lived bearer token because the proxy can't carry a body that large.
  */
 export declare class AuthenticatedBuildClient implements BuildClient {
+    private proxyBase;
     private apiBase;
     private getUploadToken;
     private accountSlug?;
     private title;
     private pollIntervalMs;
     private timeoutMs;
-    constructor({ apiBase, getUploadToken, accountSlug, title, pollIntervalMs, timeoutMs, }: AuthenticatedBuildClientConfig);
+    constructor({ proxyBase, apiBase, getUploadToken, accountSlug, title, pollIntervalMs, timeoutMs, }: AuthenticatedBuildClientConfig);
     /**
-     * Create the site the build deploys into. Authorized by the bearer token;
-     * without an account slug the API picks the user's default account.
+     * Create the site the build deploys into. Goes through the proxy with
+     * `credentials: 'include'` so the app session authorizes it; without an
+     * account slug the API picks the user's default account.
      */
     createSite(): Promise<BuildSite>;
     /**
@@ -77,6 +86,11 @@ export declare class AuthenticatedBuildClient implements BuildClient {
      * (see the note on `apiBase`), authorized by a freshly minted bearer token.
      * `Content-Type` is left unset on purpose so the browser adds the multipart
      * boundary itself.
+     *
+     * Known ceiling: this is one request on a 30s token, and re-minting can't
+     * help once it is in flight. A zip that takes longer than that to upload will
+     * fail — the app origin gets 300s for exactly this reason, and lifting the
+     * limit for other origins is a platform-side change.
      */
     createBuildFromZip(siteId: string, zip: File): Promise<BuildResponse>;
     /**
@@ -86,10 +100,10 @@ export declare class AuthenticatedBuildClient implements BuildClient {
      * deploy id yet has nothing pollable, so it resolves immediately and the
      * caller falls back to the site page.
      *
-     * Optional in the drop flow, and off by default: a build takes minutes, which
-     * can outlive the bearer token minted for it. Each poll re-mints so a long
-     * build keeps reading; a token that can't be minted any more ends the wait as
-     * a timeout rather than a false failure.
+     * Optional in the drop flow, and off by default: a build takes minutes, so
+     * the useful hand-off is usually the project page rather than a spinner.
+     * Polling rides the session cookie, so it cannot outlive its credentials the
+     * way a 30s bearer would.
      */
     waitUntilBuildReady(build: BuildResponse): Promise<void>;
 }