@netlify/spark-ui 1.31.0-alpha.2 → 1.31.0-alpha.3

package/dist/components/preact/DropZone/drop-core/buildClient.js

@@ -1,39 +1,41 @@
-var h = Object.defineProperty;
-var d = (n, t, o) => t in n ? h(n, t, { enumerable: !0, configurable: !0, writable: !0, value: o }) : n[t] = o;
-var r = (n, t, o) => d(n, typeof t != "symbol" ? t + "" : t, o);
-import { NotAuthenticatedError as l, SiteCreateError as c, BuildCreateError as p, BuildFailedError as u, BuildTimeoutError as w } from "./errors.js";
-const f = "https://api.netlify.com/api/v1", m = 1e3, y = 10 * 60 * 1e3, B = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
-class g {
+var d = Object.defineProperty;
+var p = (r, t, e) => t in r ? d(r, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : r[t] = e;
+var i = (r, t, e) => p(r, typeof t != "symbol" ? t + "" : t, e);
+import { NotAuthenticatedError as n, SiteCreateError as h, BuildCreateError as u, BuildFailedError as w, BuildTimeoutError as y } from "./errors.js";
+const f = "/access-control/bb-api/api/v1", B = "https://api.netlify.com/api/v1", m = 1e3, S = 10 * 60 * 1e3, T = /* @__PURE__ */ new Set(["ready", "error", "rejected"]);
+class _ {
   constructor({
-    apiBase: t = f,
-    getUploadToken: o,
-    accountSlug: e,
+    proxyBase: t = f,
+    apiBase: e = B,
+    getUploadToken: a,
+    accountSlug: o,
     title: s = "Build from drop deployment",
-    pollIntervalMs: i = m,
-    timeoutMs: a = y
+    pollIntervalMs: l = m,
+    timeoutMs: c = S
   }) {
-    r(this, "apiBase");
-    r(this, "getUploadToken");
-    r(this, "accountSlug");
-    r(this, "title");
-    r(this, "pollIntervalMs");
-    r(this, "timeoutMs");
-    this.apiBase = t, this.getUploadToken = o, this.accountSlug = e, this.title = s, this.pollIntervalMs = i, this.timeoutMs = a;
+    i(this, "proxyBase");
+    i(this, "apiBase");
+    i(this, "getUploadToken");
+    i(this, "accountSlug");
+    i(this, "title");
+    i(this, "pollIntervalMs");
+    i(this, "timeoutMs");
+    this.proxyBase = t, this.apiBase = e, this.getUploadToken = a, this.accountSlug = o, this.title = s, this.pollIntervalMs = l, this.timeoutMs = c;
   }
   /**
-   * Create the site the build deploys into. Authorized by the bearer token;
-   * without an account slug the API picks the user's default account.
+   * Create the site the build deploys into. Goes through the proxy with
+   * `credentials: 'include'` so the app session authorizes it; without an
+   * account slug the API picks the user's default account.
    */
   async createSite() {
-    const t = await this.getUploadToken();
-    if (!t) throw new l();
-    const o = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", e = await fetch(`${this.apiBase}${o}`, {
+    const t = this.accountSlug ? `/${this.accountSlug}/sites` : "/sites", e = await fetch(`${this.proxyBase}${t}`, {
       method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${t}` },
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ created_via: "drop" })
     });
-    if (e.status === 401 || e.status === 403) throw new l();
-    if (!e.ok) throw new c(e.status);
+    if (e.status === 401 || e.status === 403) throw new n();
+    if (!e.ok) throw new h(e.status);
     return e.json();
   }
   /**
@@ -41,20 +43,25 @@ class g {
    * (see the note on `apiBase`), authorized by a freshly minted bearer token.
    * `Content-Type` is left unset on purpose so the browser adds the multipart
    * boundary itself.
+   *
+   * Known ceiling: this is one request on a 30s token, and re-minting can't
+   * help once it is in flight. A zip that takes longer than that to upload will
+   * fail — the app origin gets 300s for exactly this reason, and lifting the
+   * limit for other origins is a platform-side change.
    */
-  async createBuildFromZip(t, o) {
-    const e = await this.getUploadToken();
-    if (!e) throw new l();
-    const s = new FormData();
-    s.append("zip", o), s.append("title", this.title);
-    const i = await fetch(`${this.apiBase}/sites/${t}/builds`, {
+  async createBuildFromZip(t, e) {
+    const a = await this.getUploadToken();
+    if (!a) throw new n();
+    const o = new FormData();
+    o.append("zip", e), o.append("title", this.title);
+    const s = await fetch(`${this.apiBase}/sites/${t}/builds`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${e}` },
-      body: s
+      headers: { Authorization: `Bearer ${a}` },
+      body: o
     });
-    if (i.status === 401 || i.status === 403) throw new l();
-    if (!i.ok) throw new p(i.status);
-    return i.json();
+    if (s.status === 401 || s.status === 403) throw new n();
+    if (!s.ok) throw new u(s.status);
+    return s.json();
   }
   /**
    * Poll the build's deploy until it settles, mirroring
@@ -63,30 +70,30 @@ class g {
    * deploy id yet has nothing pollable, so it resolves immediately and the
    * caller falls back to the site page.
    *
-   * Optional in the drop flow, and off by default: a build takes minutes, which
-   * can outlive the bearer token minted for it. Each poll re-mints so a long
-   * build keeps reading; a token that can't be minted any more ends the wait as
-   * a timeout rather than a false failure.
+   * Optional in the drop flow, and off by default: a build takes minutes, so
+   * the useful hand-off is usually the project page rather than a spinner.
+   * Polling rides the session cookie, so it cannot outlive its credentials the
+   * way a 30s bearer would.
    */
   async waitUntilBuildReady(t) {
     if (!t.deploy_id) return;
-    const o = this.timeoutMs / this.pollIntervalMs;
-    for (let e = 0; e < o; e++) {
-      const s = await this.getUploadToken(), i = await fetch(`${this.apiBase}/deploys/${t.deploy_id}`, {
-        headers: s ? { Authorization: `Bearer ${s}` } : {}
+    const e = this.timeoutMs / this.pollIntervalMs;
+    for (let a = 0; a < e; a++) {
+      const o = await fetch(`${this.proxyBase}/deploys/${t.deploy_id}`, {
+        credentials: "include"
       });
-      if (i.ok) {
-        const a = await i.json();
-        if (a.state && B.has(a.state)) {
-          if (a.state === "ready") return;
-          throw new u(a.error_message);
+      if (o.ok) {
+        const s = await o.json();
+        if (s.state && T.has(s.state)) {
+          if (s.state === "ready") return;
+          throw new w(s.error_message);
         }
       }
-      await new Promise((a) => setTimeout(a, this.pollIntervalMs));
+      await new Promise((s) => setTimeout(s, this.pollIntervalMs));
     }
-    throw new w();
+    throw new y();
   }
 }
 export {
-  g as AuthenticatedBuildClient
+  _ as AuthenticatedBuildClient
 };

package/dist/components/preact/DropZone/useDropDeploy.d.ts

@@ -68,6 +68,7 @@ interface UseDropDeployOptions {
     buildClient?: BuildClient;
     authenticatedDropClient?: DropClient;
     getUploadToken?: () => Promise<string | null>;
+    proxyBase?: string;
     accountSlug?: string;
     buildDeployUrl: (build: DeployedBuild) => string;
     waitForBuild?: boolean;
@@ -81,7 +82,7 @@ interface UseDropDeployOptions {
  * Owns the deploy state machine and its side effects (upload, local persistence,
  * analytics, redirect), keeping DropZone a thin view over the returned `status`.
  */
-export declare function useDropDeploy({ apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, buildClient, authenticatedDropClient, getUploadToken, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, track, }: UseDropDeployOptions): {
+export declare function useDropDeploy({ apiBase, client, claimUrl, siteDashboardUrl, buildSignupUrl, buildClient, authenticatedDropClient, getUploadToken, proxyBase, accountSlug, buildDeployUrl, waitForBuild, onBuildRequired, onDeploy, onBuildDeploy, onError, track, }: UseDropDeployOptions): {
     status: DeployStatus;
     warning: string | null;
     busy: boolean;

package/dist/components/preact/DropZone/useDropDeploy.js

@@ -1,12 +1,12 @@
-import { d as P, A as I } from "../../../chunks/hooks.module.DRcxknIz.js";
-import { renameSingleNonIndexHtmlToIndex as X, getSingleNonIndexHtmlFileName as Y, hasMultipleHtmlFilesWithoutIndex as Z } from "./drop-core/readFiles.js";
-import { detectBuild as B } from "./drop-core/detectBuild.js";
-import { AnonymousDropClient as D } from "./drop-core/client.js";
-import { AuthenticatedDropClient as T } from "./drop-core/authedDropClient.js";
-import { AuthenticatedBuildClient as U } from "./drop-core/buildClient.js";
+import { d as H, A as I } from "../../../chunks/hooks.module.DRcxknIz.js";
+import { renameSingleNonIndexHtmlToIndex as Y, getSingleNonIndexHtmlFileName as Z, hasMultipleHtmlFilesWithoutIndex as B } from "./drop-core/readFiles.js";
+import { detectBuild as D } from "./drop-core/detectBuild.js";
+import { AnonymousDropClient as T } from "./drop-core/client.js";
+import { AuthenticatedDropClient as U } from "./drop-core/authedDropClient.js";
+import { AuthenticatedBuildClient as tt } from "./drop-core/buildClient.js";
 import "./drop-core/zip.js";
-import { deployFiles as H, deployBuild as tt } from "./drop-core/deploy.js";
-import { NotAuthenticatedError as W, humanizeDropError as et } from "./drop-core/errors.js";
+import { deployFiles as W, deployBuild as et } from "./drop-core/deploy.js";
+import { NotAuthenticatedError as $, humanizeDropError as nt } from "./drop-core/errors.js";
 function S(o) {
   switch (o.phase) {
     case "zipping":
@@ -22,38 +22,39 @@ function S(o) {
       return { kind: "processing" };
   }
 }
-function nt(o) {
-  const f = Y(o);
-  return f ? `No index.html found — "${f}" won’t be served at the site root.` : Z(o) ? "No index.html found — your site may not have a landing page." : null;
+function it(o) {
+  const f = Z(o);
+  return f ? `No index.html found — "${f}" won’t be served at the site root.` : B(o) ? "No index.html found — your site may not have a landing page." : null;
 }
-function ft({
+function mt({
   apiBase: o,
   client: f,
-  claimUrl: $,
-  siteDashboardUrl: v,
-  buildSignupUrl: j,
-  buildClient: q,
-  authenticatedDropClient: M,
+  claimUrl: v,
+  siteDashboardUrl: j,
+  buildSignupUrl: q,
+  buildClient: M,
+  authenticatedDropClient: E,
   getUploadToken: m,
-  accountSlug: x,
-  buildDeployUrl: E,
-  waitForBuild: G,
-  onBuildRequired: z,
-  onDeploy: g,
+  proxyBase: x,
+  accountSlug: z,
+  buildDeployUrl: G,
+  waitForBuild: J,
+  onBuildRequired: C,
+  onDeploy: p,
   onBuildDeploy: h,
   onError: b,
   track: c
 }) {
-  const [w, n] = P({ kind: "idle" }), [J, _] = P(null), K = I(f ?? new D(o)).current, C = I(
-    q ?? (m ? new U({ getUploadToken: m, accountSlug: x }) : null)
-  ).current, A = I(
-    M ?? (m ? new T({ getUploadToken: m, accountSlug: x }) : null)
-  ).current, L = w.kind !== "idle" && w.kind !== "error";
-  async function O(y, r) {
+  const [w, n] = H({ kind: "idle" }), [K, _] = H(null), L = I(f ?? new T(o)).current, A = I(
+    M ?? (m ? new tt({ proxyBase: x, getUploadToken: m, accountSlug: z }) : null)
+  ).current, F = I(
+    E ?? (m ? new U({ proxyBase: x, getUploadToken: m, accountSlug: z }) : null)
+  ).current, O = w.kind !== "idle" && w.kind !== "error";
+  async function Q(y, r) {
     try {
-      const { site: d, build: l, buildSettings: p, url: k } = await tt(y, r, {
+      const { site: d, build: l, buildSettings: g, url: k } = await et(y, r, {
         onProgress: (t) => n(S(t)),
-        waitForBuild: G
+        waitForBuild: J
       });
       return {
         url: k,
@@ -61,25 +62,25 @@ function ft({
         siteId: d.id,
         buildId: l.id,
         deployId: l.deploy_id,
-        buildSettings: p
+        buildSettings: g
       };
     } catch (d) {
-      if (d instanceof W) return null;
+      if (d instanceof $) return null;
       throw d;
     }
   }
-  async function Q(y, r, d) {
+  async function R(y, r, d) {
     _(null), n({ kind: "reading" });
-    const l = d.length ? { file_types: d } : {}, p = (t, i, a) => {
+    const l = d.length ? { file_types: d } : {}, g = (t, i, a) => {
       n({ kind: "error", message: t }), c("dropzone_deploy_failed", { method: r, reason: i, ...l, ...a }), b == null || b({ message: t, reason: i });
     }, k = (t, i) => {
       const a = t instanceof Error ? t.message : String(t);
-      p(et(t), a, i);
+      g(nt(t), a, i);
     };
     try {
-      const t = X(await y());
+      const t = Y(await y());
       if (!t.length) {
-        p("No files found to deploy.", "No files found to deploy.", { file_count: 0 });
+        g("No files found to deploy.", "No files found to deploy.", { file_count: 0 });
         return;
       }
       r === "drag" && c("dropzone_files_dropped", {
@@ -87,19 +88,19 @@ function ft({
         file_count: t.length,
         ...l
       });
-      const i = B(t);
+      const i = D(t);
       if (i.buildRequired) {
         if (c("dropzone_build_required", {
           method: r,
           reason: i.reason,
           file_count: t.length,
           ...l
-        }), z) {
-          n({ kind: "idle" }), z(i);
+        }), C) {
+          n({ kind: "idle" }), C(i);
           return;
         }
-        if (C) {
-          const e = await O(C, t);
+        if (A) {
+          const e = await Q(A, t);
           if (e) {
             n({ kind: "redirecting", target: "build" }), c("dropzone_build_deploy_succeeded", {
               method: r,
@@ -108,28 +109,28 @@ function ft({
               file_count: t.length,
               ...e.buildSettings ? { framework: e.buildSettings.framework } : {},
               ...l
-            }), h == null || h(e), window.location.assign(E(e));
+            }), h == null || h(e), window.location.assign(G(e));
             return;
           }
         }
-        n({ kind: "redirecting", target: "signup" }), window.location.assign(j);
+        n({ kind: "redirecting", target: "signup" }), window.location.assign(q);
         return;
       }
-      _(nt(t));
-      let a = null, s = !1, F = !1;
-      if (A)
+      _(it(t));
+      let a = null, s = !1, P = !1;
+      if (F)
         try {
-          a = await H(A, t, {
+          a = await W(F, t, {
             onProgress: (e) => n(S(e))
           }), s = !0;
         } catch (e) {
-          if (!(e instanceof W)) throw e;
-          F = !0;
+          if (!(e instanceof $)) throw e;
+          P = !0;
         }
-      a || (a = await H(K, t, {
+      a || (a = await W(L, t, {
         onProgress: (e) => n(S(e))
       }));
-      const { url: V, token: N, deploy: u } = a;
+      const { url: X, token: N, deploy: u } = a;
       if (!s)
         try {
           localStorage.setItem("drop-token", N), localStorage.setItem("dropSiteName", u.subdomain);
@@ -140,24 +141,24 @@ function ft({
         site_name: u.subdomain,
         file_count: t.length,
         authenticated: s,
-        ...F ? { auth_fallback: !0 } : {},
+        ...P ? { auth_fallback: !0 } : {},
         ...l
-      }), g == null || g({
-        url: V,
+      }), p == null || p({
+        url: X,
         ...s ? {} : { token: N },
         siteName: u.subdomain,
         siteId: u.id,
         authenticated: s
-      }), s ? window.location.assign(v(u.subdomain)) : window.location.assign(`${$(u.subdomain)}#drop_token=${N}`);
+      }), s ? window.location.assign(j(u.subdomain)) : window.location.assign(`${v(u.subdomain)}#drop_token=${N}`);
     } catch (t) {
       k(t);
     }
   }
-  function R() {
+  function V() {
     _(null), n({ kind: "idle" });
   }
-  return { status: w, warning: J, busy: L, deploy: Q, reset: R };
+  return { status: w, warning: K, busy: O, deploy: R, reset: V };
 }
 export {
-  ft as useDropDeploy
+  mt as useDropDeploy
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@netlify/spark-ui",
   "description": "Assets, design tokens, components, and utilities",
-  "version": "1.31.0-alpha.2",
+  "version": "1.31.0-alpha.3",
   "type": "module",
   "main": "dist/components/preact/index.js",
   "types": "dist/components/preact/index.d.ts",

package/packages/components/preact/DropZone/DropZone.tsx

@@ -93,6 +93,13 @@ interface Props {
    * static path. Distinct from `client`, which is the anonymous fallback.
    */
   authenticatedDropClient?: DropClient;
+  /**
+   * API root for the authenticated paths' JSON calls, which go through your
+   * access-control rewrite so the session cookie authorizes them. Defaults to
+   * `/access-control/bb-api/api/v1`. (Uploads always go direct to
+   * `api.netlify.com` — the proxy can't carry bodies that large.)
+   */
+  proxyBase?: string;
   /** Create the visitor's new project in this account. Omit for their default account. */
   accountSlug?: string;
   /**
@@ -180,6 +187,7 @@ export default function DropZone({
   getUploadToken,
   buildClient,
   authenticatedDropClient,
+  proxyBase,
   accountSlug,
   buildDeployUrl = defaultBuildDeployUrl,
   waitForBuild,
@@ -206,6 +214,7 @@ export default function DropZone({
     getUploadToken,
     buildClient,
     authenticatedDropClient,
+    proxyBase,
     accountSlug,
     buildDeployUrl,
     waitForBuild,

package/packages/components/preact/DropZone/drop-core/authedDropClient.ts

@@ -5,18 +5,26 @@ import { NotAuthenticatedError, SiteCreateError } from './errors';
 
 export interface AuthenticatedDropClientConfig {
   /**
-   * API base for every call. Requests go straight to `api.netlify.com`, whose
-   * `/api/*` CORS policy allows any origin, rather than through a consumer's
-   * access-control rewrite — that proxy allowlists paths per origin, and site
-   * and deploy creation are not on the list for netlify.com (they 400 with
-   * `x-debug: request origin not allowed to call endpoint`).
+   * Base for JSON API calls, routed through the consumer's access-control
+   * rewrite so the session cookie authenticates them. On netlify.com that
+   * rewrite is `/access-control/*` → the app's access-control function, which
+   * makes `/access-control/bb-api/api/v1` the API root (the default here).
+   */
+  proxyBase?: string;
+  /**
+   * Direct API base for the file uploads. The proxy above runs in a Lambda with
+   * a ~6MB request body limit, so file PUTs go straight to `api.netlify.com`
+   * (whose `/api/*` CORS policy allows any origin).
    */
   apiBase?: string;
   /**
-   * Mint a short-lived bearer token authorizing the calls. On netlify.com this
-   * is `GET /access-control/generate-access-control-token`, whose
+   * Mint a bearer token for those direct uploads. On netlify.com this is
+   * `GET /access-control/generate-access-control-token`, whose
    * `accessControlToken` the API decrypts back into the user's access token.
    * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
+   *
+   * Called repeatedly, not once: the token issued to a non-app origin lives
+   * only 30 seconds, which a multi-file upload routinely outlasts.
    */
   getUploadToken: () => Promise<string | null>;
   /** Create the site in this account. Omit to use the user's default account. */
@@ -31,10 +39,18 @@ export interface AuthenticatedDropClientConfig {
 // (constants + site create) are deliberately duplicated rather than extracted,
 // to avoid churn on the in-review build-client branch. Worth unifying once both
 // have landed.
+const PROXY_BASE = '/access-control/bb-api/api/v1';
 const API_BASE = 'https://api.netlify.com/api/v1';
 const POLL_INTERVAL_MS = 1000;
 const TIMEOUT_MS = 10 * 60 * 1000;
 
+/**
+ * How long a minted upload token is reused before minting another. The server
+ * issues non-app origins a 30s token, so this leaves a margin for the request
+ * it authorizes to finish.
+ */
+const TOKEN_REUSE_MS = 20 * 1000;
+
 /** Deploy states that end the wait — `ready` succeeds, the rest are failures. */
 const TERMINAL_STATES = new Set(['ready', 'error', 'rejected']);
 
@@ -59,34 +75,37 @@ interface SiteDeployResponse {
  * There is no claim step, so the caller should hand off to the site's dashboard
  * page rather than the claim page.
  *
- * Every request goes direct to `api.netlify.com` with the short-lived bearer
- * from `getUploadToken()`. Routing the JSON calls through a consumer's
- * access-control rewrite instead (cookie session, no token in the browser)
- * would be the tighter design, but that proxy allowlists paths per origin and
- * site/deploy creation isn't allowed from netlify.com — it 400s before
- * reaching the API. Revisit if that allowlist gains these paths.
+ * Requests split across two hosts by necessity. JSON calls (create the site,
+ * create the deploy, poll it) go through the consumer's access-control proxy on
+ * the session cookie — no token involved, and nothing that can expire mid-deploy.
+ * File uploads can't: the proxy caps bodies at ~6MB, so they go direct to
+ * `api.netlify.com` with a bearer, re-minted as it ages (see `TOKEN_REUSE_MS`).
  *
- * Error-mapping invariant: only pre-mutation failures — a null upload token, or
- * a 401/403 creating the site — throw `NotAuthenticatedError`, which is the
- * signal the drop flow may safely retry anonymously. Once the site exists, an
- * auth failure throws a plain status-carrying error instead: falling back at
- * that point would strand an empty site in the account *and* deploy a duplicate
+ * Error-mapping invariant: only pre-mutation failures — a null upload token at
+ * the gate, or a 401/403 creating the site — throw `NotAuthenticatedError`,
+ * which is the signal the drop flow may safely retry anonymously. Once the site
+ * exists, any auth failure throws a plain error instead: falling back at that
+ * point would strand an empty site in the account *and* deploy a duplicate
  * anonymously.
  */
 export class AuthenticatedDropClient implements DropClient {
+  private proxyBase: string;
   private apiBase: string;
   private getUploadToken: () => Promise<string | null>;
   private accountSlug?: string;
   private pollIntervalMs: number;
   private timeoutMs: number;
+  private cachedToken?: { value: string; mintedAt: number };
 
   constructor({
+    proxyBase = PROXY_BASE,
     apiBase = API_BASE,
     getUploadToken,
     accountSlug,
     pollIntervalMs = POLL_INTERVAL_MS,
     timeoutMs = TIMEOUT_MS,
   }: AuthenticatedDropClientConfig) {
+    this.proxyBase = proxyBase;
     this.apiBase = apiBase;
     this.getUploadToken = getUploadToken;
     this.accountSlug = accountSlug;
@@ -95,26 +114,50 @@ export class AuthenticatedDropClient implements DropClient {
   }
 
   /**
-   * The token here is the upload bearer, not a drop token — it authorizes every
-   * call this client makes. Minted once per deploy, before anything is created,
-   * so a missing session fails the whole attempt cleanly.
+   * The auth gate. Minting here — before anything is created — is what lets a
+   * logged-out visitor fail cleanly and fall back to the anonymous flow. The
+   * returned token is threaded through `deployFiles`, but only the uploads
+   * actually need one, and they re-mint rather than trusting this to still be
+   * valid by the time they run.
    */
   async getToken(): Promise<string> {
     const token = await this.getUploadToken();
     if (!token) throw new NotAuthenticatedError();
+    this.cachedToken = { value: token, mintedAt: Date.now() };
     return token;
   }
 
   /**
-   * Two calls: create the site in the visitor's account, then the deploy on it.
-   * Mapped into the anonymous `DropResponse` shape so `deployFiles` runs
-   * unchanged over either client.
+   * A token young enough to authorize an upload, minting a new one once the
+   * cached one nears its 30s expiry.
+   *
+   * Deliberately NOT `NotAuthenticatedError` when minting fails: by the time
+   * uploads run the site already exists, and that error would send the drop
+   * back through the anonymous path — leaving an empty project behind and
+   * deploying a duplicate. See the class doc.
+   */
+  private async freshToken(): Promise<string> {
+    const now = Date.now();
+    if (this.cachedToken && now - this.cachedToken.mintedAt < TOKEN_REUSE_MS) {
+      return this.cachedToken.value;
+    }
+    const value = await this.getUploadToken();
+    if (!value) throw new Error('could not renew the upload token');
+    this.cachedToken = { value, mintedAt: now };
+    return value;
+  }
+
+  /**
+   * Two proxied calls: create the site in the visitor's account, then the
+   * deploy on it. Mapped into the anonymous `DropResponse` shape so
+   * `deployFiles` runs unchanged over either client.
    */
-  async createDeploy(files: Digest, token: string): Promise<DropResponse> {
+  async createDeploy(files: Digest, _token: string): Promise<DropResponse> {
     const path = this.accountSlug ? `/${this.accountSlug}/sites` : '/sites';
-    const siteRes = await fetch(`${this.apiBase}${path}`, {
+    const siteRes = await fetch(`${this.proxyBase}${path}`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      credentials: 'include',
+      headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ created_via: 'drop' }),
     });
     // A logged-out visitor 401s here, before anything is created — the one
@@ -123,9 +166,10 @@ export class AuthenticatedDropClient implements DropClient {
     if (!siteRes.ok) throw new SiteCreateError(siteRes.status);
     const site: BuildSite = await siteRes.json();
 
-    const deployRes = await fetch(`${this.apiBase}/sites/${site.id}/deploys`, {
+    const deployRes = await fetch(`${this.proxyBase}/sites/${site.id}/deploys`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      credentials: 'include',
+      headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ files, deploy_source: 'drop' }),
     });
     if (!deployRes.ok) throw apiError('deploy create', deployRes.status);
@@ -139,13 +183,18 @@ export class AuthenticatedDropClient implements DropClient {
     };
   }
 
+  /**
+   * Direct to `api.netlify.com` on a freshly-aged bearer — the threaded `token`
+   * is ignored because an upload queue easily outlives the 30 seconds it was
+   * minted with. PUT (not POST) so paths with "&" etc. work.
+   */
   async uploadFile(
     deployId: string,
     path: string,
     content: ArrayBuffer,
-    token: string
+    _token: string
   ): Promise<void> {
-    // PUT (not POST) so paths with "&" etc. work.
+    const token = await this.freshToken();
     const res = await fetch(`${this.apiBase}/deploys/${deployId}/files${path}`, {
       method: 'PUT',
       headers: { 'Content-Type': 'application/octet-stream', Authorization: `Bearer ${token}` },
@@ -155,18 +204,15 @@ export class AuthenticatedDropClient implements DropClient {
   }
 
   /**
-   * Poll until the deploy settles: resolve on `ready`, throw on
-   * `error`/`rejected`, throw on timeout. Reuses the bearer minted at the start
-   * of the deploy, so a deploy that outlives the token's TTL will start seeing
-   * 401s here — those are ignored like any other non-ok read and the loop runs
-   * to its timeout rather than failing fast. Acceptable while static deploys
-   * finish in seconds; re-mint per poll if that stops being true.
+   * Poll the deploy through the proxy until it settles: resolve on `ready`,
+   * throw on `error`/`rejected`, throw on timeout. On the session cookie rather
+   * than a bearer, so a deploy taking minutes can't outlive its own credentials.
    */
-  async waitUntilReady(deploy: DropResponse, token: string): Promise<void> {
+  async waitUntilReady(deploy: DropResponse, _token: string): Promise<void> {
     const deadline = this.timeoutMs / this.pollIntervalMs;
     for (let i = 0; i < deadline; i++) {
-      const res = await fetch(`${this.apiBase}/deploys/${deploy.deploy_id}`, {
-        headers: { Authorization: `Bearer ${token}` },
+      const res = await fetch(`${this.proxyBase}/deploys/${deploy.deploy_id}`, {
+        credentials: 'include',
       });
       if (res.ok) {
         const state: DeployState = await res.json();