@netlify/spark-ui 1.31.0-alpha.5 → 1.31.0-alpha.7

package/dist/drop-core/authedDropClient.d.ts

@@ -1,27 +1,13 @@
 import { DropClient } from './client';
 import { Digest, DropResponse } from './types';
 export interface AuthenticatedDropClientConfig {
-    /**
-     * Base for JSON API calls, routed through the consumer's access-control
-     * rewrite so the session cookie authenticates them. On netlify.com that
-     * rewrite is `/access-control/*` → the app's access-control function, which
-     * makes `/access-control/bb-api/api/v1` the API root (the default here).
-     */
+    /** Root for session-cookie JSON calls, via the consumer's access-control rewrite. */
     proxyBase?: string;
-    /**
-     * Direct API base for the file uploads. The proxy above runs in a Lambda with
-     * a ~6MB request body limit, so file PUTs go straight to `api.netlify.com`
-     * (whose `/api/*` CORS policy allows any origin).
-     */
+    /** Direct base for file PUTs — the proxy's ~6MB Lambda body limit can't carry uploads. */
     apiBase?: string;
     /**
-     * Mint a bearer token for those direct uploads. On netlify.com this is
-     * `GET /access-control/generate-access-control-token`, whose
-     * `accessControlToken` the API decrypts back into the user's access token.
-     * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
-     *
-     * Called repeatedly, not once: the token issued to a non-app origin lives
-     * only 30 seconds, which a multi-file upload routinely outlasts.
+     * Mint the upload bearer; `null` means "no session". Called repeatedly —
+     * non-app origins get 30-second tokens, which an upload queue outlasts.
      */
     getUploadToken: () => Promise<string | null>;
     /** Create the site in this account. Omit to use the user's default account. */
@@ -32,25 +18,10 @@ export interface AuthenticatedDropClientConfig {
     timeoutMs?: number;
 }
 /**
- * Authenticated drop client for logged-in visitors. Unlike `AnonymousDropClient`
- * — which creates an account-less site the visitor must later claim — this
- * deploys straight into the visitor's account via the sites/deploys API,
- * mirroring what app.netlify.com does for a logged-in drag-and-drop deploy.
- * There is no claim step, so the caller should hand off to the site's dashboard
- * page rather than the claim page.
- *
- * Requests split across two hosts by necessity. JSON calls (create the site,
- * create the deploy, poll it) go through the consumer's access-control proxy on
- * the session cookie — no token involved, and nothing that can expire mid-deploy.
- * File uploads can't: the proxy caps bodies at ~6MB, so they go direct to
- * `api.netlify.com` with a bearer, re-minted as it ages (see `TOKEN_REUSE_MS`).
- *
- * Error-mapping invariant: only pre-mutation failures — a null upload token at
- * the gate, or a 401/403 creating the site — throw `NotAuthenticatedError`,
- * which is the signal the drop flow may safely retry anonymously. Once the site
- * exists, any auth failure throws a plain error instead: falling back at that
- * point would strand an empty site in the account *and* deploy a duplicate
- * anonymously.
+ * Deploys a static drop straight into a logged-in visitor's account — no claim
+ * step. JSON rides the cookie proxy; file PUTs go direct on a re-minted bearer.
+ * Invariant: NotAuthenticatedError only pre-mutation — after the site exists, a
+ * fallback would strand an empty site and deploy a duplicate.
  */
 export declare class AuthenticatedDropClient implements DropClient {
     private proxyBase;
@@ -67,27 +38,14 @@ export declare class AuthenticatedDropClient implements DropClient {
      */
     getToken(): Promise<string>;
     /**
-     * A token young enough to authorize an upload, minting a new one once the
-     * cached one nears its 30s expiry. A mint failure here is a plain `Error`,
-     * never `NotAuthenticatedError` — the site exists by now (class doc).
+     * A token younger than its 30s expiry. Mint failures here are plain Errors,
+     * never NotAuthenticatedError — the site exists by now (class doc).
      */
     private freshToken;
-    /**
-     * Two proxied calls: create the site in the visitor's account, then the
-     * deploy on it. Mapped into the anonymous `DropResponse` shape so
-     * `deployFiles` runs unchanged over either client.
-     */
+    /** Site + deploy via the proxy, mapped into `DropResponse` so `deployFiles` runs unchanged. */
     createDeploy(files: Digest, _token: string): Promise<DropResponse>;
-    /**
-     * Direct to `api.netlify.com` on a freshly-aged bearer — the threaded `token`
-     * is ignored because an upload queue easily outlives the 30 seconds it was
-     * minted with. PUT (not POST) so paths with "&" etc. work.
-     */
+    /** Direct on a fresh bearer (the threaded one has expired). PUT so paths with "&" work. */
     uploadFile(deployId: string, path: string, content: ArrayBuffer, _token: string): Promise<void>;
-    /**
-     * Poll the deploy through the proxy until it settles: resolve on `ready`,
-     * throw on `error`/`rejected`, throw on timeout. On the session cookie rather
-     * than a bearer, so a deploy taking minutes can't outlive its own credentials.
-     */
+    /** Polls on the session cookie, so a slow deploy can't outlive its own credentials. */
     waitUntilReady(deploy: DropResponse, _token: string): Promise<void>;
 }

package/dist/drop-core/authedDropClient.js

@@ -33,9 +33,8 @@ class B {
     return this.cachedToken = { value: e, mintedAt: Date.now() }, e;
   }
   /**
-   * A token young enough to authorize an upload, minting a new one once the
-   * cached one nears its 30s expiry. A mint failure here is a plain `Error`,
-   * never `NotAuthenticatedError` — the site exists by now (class doc).
+   * A token younger than its 30s expiry. Mint failures here are plain Errors,
+   * never NotAuthenticatedError — the site exists by now (class doc).
    */
   async freshToken() {
     const e = Date.now();
@@ -45,11 +44,7 @@ class B {
     if (!t) throw new Error("could not renew the upload token");
     return this.cachedToken = { value: t, mintedAt: e }, t;
   }
-  /**
-   * Two proxied calls: create the site in the visitor's account, then the
-   * deploy on it. Mapped into the anonymous `DropResponse` shape so
-   * `deployFiles` runs unchanged over either client.
-   */
+  /** Site + deploy via the proxy, mapped into `DropResponse` so `deployFiles` runs unchanged. */
   async createDeploy(e, t) {
     const o = await p(this.proxyBase, this.accountSlug), s = await fetch(`${this.proxyBase}/sites/${o.id}/deploys`, {
       method: "POST",
@@ -66,11 +61,7 @@ class B {
       required: n.required ?? []
     };
   }
-  /**
-   * Direct to `api.netlify.com` on a freshly-aged bearer — the threaded `token`
-   * is ignored because an upload queue easily outlives the 30 seconds it was
-   * minted with. PUT (not POST) so paths with "&" etc. work.
-   */
+  /** Direct on a fresh bearer (the threaded one has expired). PUT so paths with "&" work. */
   async uploadFile(e, t, o, s) {
     const n = await this.freshToken(), r = await fetch(`${this.apiBase}/deploys/${e}/files${t}`, {
       method: "PUT",
@@ -79,11 +70,7 @@ class B {
     });
     if (!r.ok) throw l(`upload ${t}`, r.status);
   }
-  /**
-   * Poll the deploy through the proxy until it settles: resolve on `ready`,
-   * throw on `error`/`rejected`, throw on timeout. On the session cookie rather
-   * than a bearer, so a deploy taking minutes can't outlive its own credentials.
-   */
+  /** Polls on the session cookie, so a slow deploy can't outlive its own credentials. */
   async waitUntilReady(e, t) {
     const o = await h({
       proxyBase: this.proxyBase,

package/dist/drop-core/buildClient.d.ts

@@ -2,7 +2,6 @@ import { BuildSite } from './types';
 export type { BuildSite } from './types';
 /** The subset of a Netlify Build returned by `POST /sites/{id}/builds`. */
 export interface BuildResponse {
-    /** build id */
     id: string;
     /** the deploy the build produces — present as soon as the build is enqueued */
     deploy_id?: string;
@@ -13,28 +12,14 @@ export interface BuildClient {
     waitUntilBuildReady(build: BuildResponse): Promise<void>;
 }
 export interface AuthenticatedBuildClientConfig {
-    /**
-     * Base for JSON API calls, routed through the consumer's access-control
-     * rewrite so the session cookie authenticates them. On netlify.com that
-     * rewrite is `/access-control/*` → the app's access-control function, which
-     * makes `/access-control/bb-api/api/v1` the API root (the default here).
-     */
+    /** Root for session-cookie JSON calls, via the consumer's access-control rewrite. */
     proxyBase?: string;
-    /**
-     * Direct API base for the zip upload. The proxy above runs in a Lambda with a
-     * ~6MB request body limit, so the multipart POST has to go straight to
-     * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
-     */
+    /** Direct base for the zip upload — the proxy's ~6MB Lambda body limit can't carry it. */
     apiBase?: string;
     /**
-     * Mint a bearer token for that direct upload. On netlify.com this is
-     * `GET /access-control/generate-access-control-token`, whose
-     * `accessControlToken` the API decrypts back into the user's access token.
-     * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
-     *
-     * Note the token issued to a non-app origin lives only 30 seconds. It is
-     * minted immediately before the upload, but a zip that takes longer than that
-     * to transfer will still be rejected mid-flight — see `createBuildFromZip`.
+     * Mint the upload bearer; `null` means "no session". Non-app origins get
+     * 30-second tokens — a zip slower than that fails mid-flight (see
+     * `createBuildFromZip`).
      */
     getUploadToken: () => Promise<string | null>;
     /** Create the site in this account. Omit to use the user's default account. */
@@ -47,16 +32,9 @@ export interface AuthenticatedBuildClientConfig {
     timeoutMs?: number;
 }
 /**
- * Authenticated drop client for projects that need a build. Unlike
- * `AnonymousDropClient` — which creates an account-less static site and can only
- * upload pre-built files — this creates a real site in the user's account and
- * hands buildbot a source archive to build, mirroring what app.netlify.com does
- * for a drag-and-drop build.
- *
- * Requests split across two hosts by necessity: JSON calls go through the
- * consumer's access-control proxy (cookie session, no token handling in the
- * browser), while the zip upload goes direct to `api.netlify.com` with a
- * short-lived bearer token because the proxy can't carry a body that large.
+ * Builds a drop in a logged-in visitor's account: create the site, hand
+ * buildbot the source zip. JSON rides the cookie proxy; the zip goes direct
+ * with a bearer (the proxy can't carry it).
  */
 export declare class AuthenticatedBuildClient implements BuildClient {
     private proxyBase;
@@ -67,35 +45,23 @@ export declare class AuthenticatedBuildClient implements BuildClient {
     private pollIntervalMs;
     private timeoutMs;
     constructor({ proxyBase, apiBase, getUploadToken, accountSlug, title, pollIntervalMs, timeoutMs, }: AuthenticatedBuildClientConfig);
-    /**
-     * Create the site the build deploys into. A logged-out visitor fails here,
-     * before anything is created — see `createSiteInAccount` for the error
-     * mapping that makes the signup fallback safe.
-     */
+    /** A logged-out visitor fails here, before anything is created (see `createSiteInAccount`). */
     createSite(): Promise<BuildSite>;
     /**
-     * Upload the source archive and enqueue a build. Direct to `api.netlify.com`
-     * (see the note on `apiBase`), authorized by a freshly minted bearer token.
-     * `Content-Type` is left unset on purpose so the browser adds the multipart
-     * boundary itself.
+     * One multipart request on a fresh 30s bearer — a slower zip fails mid-flight
+     * (the app origin gets 300s; raising ours is a platform-side change).
+     * Content-Type stays unset so the browser adds the multipart boundary.
      *
-     * Known ceiling: this is one request on a 30s token, and re-minting can't
-     * help once it is in flight. A zip that takes longer than that to upload will
-     * fail — the app origin gets 300s for exactly this reason, and lifting the
-     * limit for other origins is a platform-side change.
+     * Never NotAuthenticatedError, including for a 401: the site exists by the
+     * time this runs, so signalling "no session" would strand it and re-stash
+     * the drop for the next visit to strand another. `createSite` is the auth
+     * gate for this path.
      */
     createBuildFromZip(siteId: string, zip: File): Promise<BuildResponse>;
     /**
-     * Poll the build's deploy until it settles, mirroring
-     * `AnonymousDropClient.waitUntilReady` — resolve on `ready`, throw on
-     * `error`/`rejected`, throw on timeout. A build that hasn't been given a
-     * deploy id yet has nothing pollable, so it resolves immediately and the
-     * caller falls back to the site page.
-     *
-     * Optional in the drop flow, and off by default: a build takes minutes, so
-     * the useful hand-off is usually the project page rather than a spinner.
-     * Polling rides the session cookie, so it cannot outlive its credentials the
-     * way a 30s bearer would.
+     * Optional (a build takes minutes; the useful hand-off is the project page).
+     * Polls on the cookie, so it can't outlive its credentials; no deploy id yet
+     * means nothing pollable, so it resolves immediately.
      */
     waitUntilBuildReady(build: BuildResponse): Promise<void>;
 }

package/dist/drop-core/buildClient.js

@@ -1,16 +1,16 @@
-var u = Object.defineProperty;
-var d = (r, t, e) => t in r ? u(r, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : r[t] = e;
-var o = (r, t, e) => d(r, typeof t != "symbol" ? t + "" : t, e);
+var d = Object.defineProperty;
+var u = (i, t, e) => t in i ? d(i, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : i[t] = e;
+var o = (i, t, e) => u(i, typeof t != "symbol" ? t + "" : t, e);
 import { createSiteInAccount as c, pollDeployUntilSettled as h } from "./authedApi.js";
 import { DEFAULT_PROXY_BASE as m, DEFAULT_API_BASE as B, DEFAULT_POLL_INTERVAL_MS as y, DEFAULT_TIMEOUT_MS as w } from "./constants.js";
-import { NotAuthenticatedError as l, BuildCreateError as f, BuildFailedError as A, BuildTimeoutError as E } from "./errors.js";
-class U {
+import { BuildCreateError as l, BuildFailedError as M, BuildTimeoutError as T } from "./errors.js";
+class _ {
   constructor({
     proxyBase: t = m,
     apiBase: e = B,
     getUploadToken: a,
-    accountSlug: s,
-    title: i = "Build from drop deployment",
+    accountSlug: r,
+    title: s = "Build from drop deployment",
     pollIntervalMs: n = y,
     timeoutMs: p = w
   }) {
@@ -21,52 +21,39 @@ class U {
     o(this, "title");
     o(this, "pollIntervalMs");
     o(this, "timeoutMs");
-    this.proxyBase = t, this.apiBase = e, this.getUploadToken = a, this.accountSlug = s, this.title = i, this.pollIntervalMs = n, this.timeoutMs = p;
+    this.proxyBase = t, this.apiBase = e, this.getUploadToken = a, this.accountSlug = r, this.title = s, this.pollIntervalMs = n, this.timeoutMs = p;
   }
-  /**
-   * Create the site the build deploys into. A logged-out visitor fails here,
-   * before anything is created — see `createSiteInAccount` for the error
-   * mapping that makes the signup fallback safe.
-   */
+  /** A logged-out visitor fails here, before anything is created (see `createSiteInAccount`). */
   async createSite() {
     return c(this.proxyBase, this.accountSlug);
   }
   /**
-   * Upload the source archive and enqueue a build. Direct to `api.netlify.com`
-   * (see the note on `apiBase`), authorized by a freshly minted bearer token.
-   * `Content-Type` is left unset on purpose so the browser adds the multipart
-   * boundary itself.
+   * One multipart request on a fresh 30s bearer — a slower zip fails mid-flight
+   * (the app origin gets 300s; raising ours is a platform-side change).
+   * Content-Type stays unset so the browser adds the multipart boundary.
    *
-   * Known ceiling: this is one request on a 30s token, and re-minting can't
-   * help once it is in flight. A zip that takes longer than that to upload will
-   * fail — the app origin gets 300s for exactly this reason, and lifting the
-   * limit for other origins is a platform-side change.
+   * Never NotAuthenticatedError, including for a 401: the site exists by the
+   * time this runs, so signalling "no session" would strand it and re-stash
+   * the drop for the next visit to strand another. `createSite` is the auth
+   * gate for this path.
    */
   async createBuildFromZip(t, e) {
     const a = await this.getUploadToken();
     if (!a) throw new l();
-    const s = new FormData();
-    s.append("zip", e), s.append("title", this.title);
-    const i = await fetch(`${this.apiBase}/sites/${t}/builds`, {
+    const r = new FormData();
+    r.append("zip", e), r.append("title", this.title);
+    const s = await fetch(`${this.apiBase}/sites/${t}/builds`, {
       method: "POST",
       headers: { Authorization: `Bearer ${a}` },
-      body: s
+      body: r
     });
-    if (i.status === 401 || i.status === 403) throw new l();
-    if (!i.ok) throw new f(i.status);
-    return i.json();
+    if (!s.ok) throw new l(s.status);
+    return s.json();
   }
   /**
-   * Poll the build's deploy until it settles, mirroring
-   * `AnonymousDropClient.waitUntilReady` — resolve on `ready`, throw on
-   * `error`/`rejected`, throw on timeout. A build that hasn't been given a
-   * deploy id yet has nothing pollable, so it resolves immediately and the
-   * caller falls back to the site page.
-   *
-   * Optional in the drop flow, and off by default: a build takes minutes, so
-   * the useful hand-off is usually the project page rather than a spinner.
-   * Polling rides the session cookie, so it cannot outlive its credentials the
-   * way a 30s bearer would.
+   * Optional (a build takes minutes; the useful hand-off is the project page).
+   * Polls on the cookie, so it can't outlive its credentials; no deploy id yet
+   * means nothing pollable, so it resolves immediately.
    */
   async waitUntilBuildReady(t) {
     if (!t.deploy_id) return;
@@ -77,9 +64,9 @@ class U {
       timeoutMs: this.timeoutMs
     });
     if (e.outcome !== "ready")
-      throw e.outcome === "failed" ? new A(e.errorMessage) : new E();
+      throw e.outcome === "failed" ? new M(e.errorMessage) : new T();
   }
 }
 export {
-  U as AuthenticatedBuildClient
+  _ as AuthenticatedBuildClient
 };

package/dist/drop-core/buildStash.d.ts

@@ -1,20 +1,10 @@
 import { InferredBuildSettings } from './detectBuild';
 /**
- * Carry a build-required drop across the signup round-trip.
- *
- * A logged-out visitor's drop can't be built (builds have no anonymous
- * equivalent), so before handing them to signup the zone stashes the source
- * archive here — IndexedDB, because the zip is far beyond localStorage's
- * budget. When they return to this origin authenticated, the zone deploys the
- * stash automatically instead of asking them to drop again.
- *
- * Storage is per-origin: a stash written on www.netlify.com can only ever be
- * resumed on www.netlify.com. That is the design, not a limitation — it is
- * exactly why the hand-off page must bring the visitor back here.
- *
- * Every operation is failure-swallowing: the stash is an enhancement, and a
- * browser without IndexedDB (or with a full quota) degrades to the plain
- * signup redirect the zone always supported.
+ * Carries a build drop across the signup round-trip: stash the zip in
+ * IndexedDB before the hand-off, deploy it when the visitor returns
+ * authenticated. Storage is per-origin by design — the hand-off must bring
+ * them back here. Every operation swallows failures: no storage means the
+ * plain signup redirect the zone always supported.
  */
 export interface DropBuildStash {
     /** The `source.zip` exactly as it would have been uploaded. */
@@ -23,11 +13,7 @@ export interface DropBuildStash {
     buildSettings: InferredBuildSettings | null;
     createdAt: number;
 }
-/**
- * Stash a drop's source archive for an automatic deploy after signup. Returns
- * whether it was actually stored — callers use that only to phrase the
- * hand-off, never to block it.
- */
+/** Stash the archive for auto-deploy after signup. The result phrases the hand-off, never blocks it. */
 export declare function saveDropStash(zipFile: File, buildSettings?: InferredBuildSettings | null): Promise<boolean>;
 /** The stashed drop, or null when there is none, it expired, or storage is unavailable. */
 export declare function loadDropStash(): Promise<DropBuildStash | null>;

package/dist/drop-core/buildStash.js

@@ -1,17 +1,20 @@
-const f = "netlify-drop";
+const l = "netlify-drop";
 const s = "build-stash", c = "latest", i = "dropBuildStash";
-const S = (e) => Promise.race([
+const f = (e) => Promise.race([
   e,
   new Promise((r, t) => {
     setTimeout(() => t(new Error("IndexedDB operation timed out")), 3e3);
   })
-]), d = () => new Promise((e, r) => {
-  const t = indexedDB.open(f, 1);
+]), S = () => new Promise((e, r) => {
+  const t = indexedDB.deleteDatabase(l);
+  t.onsuccess = () => e(), t.onblocked = () => e(), t.onerror = () => r(t.error);
+}), p = () => new Promise((e, r) => {
+  const t = indexedDB.open(l, 1);
   t.onupgradeneeded = () => {
     t.result.createObjectStore(s);
   }, t.onsuccess = () => e(t.result), t.onerror = () => r(t.error);
-}), u = (e, r) => S(
-  d().then(
+}), u = (e, r) => f(
+  p().then(
     (t) => new Promise((o, a) => {
       const n = r(t.transaction(s, e).objectStore(s));
       n.onsuccess = () => {
@@ -21,33 +24,42 @@ const S = (e) => Promise.race([
       };
     })
   )
-), p = async (e) => {
+), y = async (e) => {
   const { quota: r, usage: t } = await navigator.storage.estimate();
   return r !== void 0 && t !== void 0 && r - t > e * 2;
 }, T = () => {
-  localStorage.setItem(i, JSON.stringify({ expiresAt: Date.now() + 864e5 }));
-}, l = () => {
+  localStorage.setItem(
+    i,
+    JSON.stringify({ value: "true", expiry: Date.now() + 864e5 })
+  );
+}, d = () => {
   localStorage.removeItem(i);
 };
-async function A(e, r = null) {
+async function O(e, r = null) {
   var t;
   try {
-    if (typeof indexedDB > "u" || !((t = navigator.storage) != null && t.estimate) || e.size > 209715200 || !await p(e.size))
+    if (typeof indexedDB > "u" || !((t = navigator.storage) != null && t.estimate) || e.size > 209715200 || !await y(e.size))
       return !1;
-    const o = { zipFile: e, buildSettings: r, createdAt: Date.now() };
+    const o = {
+      // Round-trip through JSON so an injected detector's richer object can't
+      // fail the structured clone the put() below performs.
+      buildSettings: r && JSON.parse(JSON.stringify(r)),
+      zipFile: e,
+      createdAt: Date.now()
+    };
     return await u("readwrite", (a) => a.put(o, c)), T(), !0;
   } catch {
     return !1;
   }
 }
-async function D() {
+async function w() {
   try {
     if (typeof indexedDB > "u") return null;
     const e = await u(
       "readonly",
       (t) => t.get(c)
     ), r = e && _(e.zipFile);
-    return !e || !r ? null : Date.now() - e.createdAt > 864e5 ? (await y(), null) : { ...e, zipFile: r };
+    return !e || !r ? null : Date.now() - e.createdAt > 864e5 ? (await D(), null) : { ...e, zipFile: r };
   } catch {
     return null;
   }
@@ -55,30 +67,30 @@ async function D() {
 function _(e) {
   return e instanceof File && e.name ? e : e instanceof Blob || e && typeof e.arrayBuffer == "function" ? new File([e], "source.zip", { type: "application/zip" }) : null;
 }
-async function y() {
+async function D() {
   try {
-    l();
+    d();
   } catch {
   }
   try {
     if (typeof indexedDB > "u") return;
-    await u("readwrite", (e) => e.delete(c));
+    await u("readwrite", (e) => e.delete(c)), await f(S());
   } catch {
   }
 }
-function O() {
+function E() {
   try {
     const e = localStorage.getItem(i);
     if (!e) return !1;
-    const { expiresAt: r } = JSON.parse(e);
-    return typeof r != "number" || Date.now() > r ? (l(), !1) : !0;
+    const { value: r, expiry: t } = JSON.parse(e);
+    return r !== "true" || typeof t != "number" || Date.now() > t ? (d(), !1) : !0;
   } catch {
     return !1;
   }
 }
 export {
-  y as clearDropStash,
-  O as hasDropStashMarker,
-  D as loadDropStash,
-  A as saveDropStash
+  D as clearDropStash,
+  E as hasDropStashMarker,
+  w as loadDropStash,
+  O as saveDropStash
 };

package/dist/drop-core/client.d.ts

@@ -11,7 +11,7 @@ export interface DropClient {
 }
 /**
  * Unauthenticated drop client. Authorized server-side by the Referer header,
- * so it only works from an allowlisted origin (see backend checklist).
+ * so it only works from an allowlisted origin.
  */
 export declare class AnonymousDropClient implements DropClient {
     private apiBase;

package/dist/drop-core/constants.d.ts

@@ -1,29 +1,9 @@
-/**
- * The tunables shared across drop-core, one place and one comment each.
- * Module-specific constants (e.g. buildStash's storage caps) stay with their
- * module; anything two modules read belongs here.
- */
-/**
- * Root for session-cookie JSON calls, via the consumer's access-control
- * rewrite. On netlify.com, `/access-control/*` targets the app's
- * access-control function; the paths an origin may call are allowlisted
- * server-side.
- */
+/** Tunables shared across drop-core. Module-specific constants stay with their module. */
 export declare const DEFAULT_PROXY_BASE = "/access-control/bb-api/api/v1";
 /** Direct api.netlify.com root for the uploads the proxy's ~6MB Lambda body limit can't carry. */
 export declare const DEFAULT_API_BASE = "https://api.netlify.com/api/v1";
 export declare const DEFAULT_POLL_INTERVAL_MS = 1000;
 export declare const DEFAULT_TIMEOUT_MS: number;
 export declare const MAX_CONCURRENT_UPLOADS = 5;
-/**
- * How long a minted upload token is reused before minting another: 20 seconds.
- * The server issues non-app origins a 30s token; the gap leaves margin for the
- * request the token authorizes to finish.
- */
 export declare const TOKEN_REUSE_MS: number;
-/**
- * Waits between attempts of a failed file upload, as data so the whole curve
- * can be overridden (the tus-js-client `retryDelays` idiom). Three retries,
- * linear backoff; 400/422 responses never retry — see `uploadWithRetry`.
- */
 export declare const UPLOAD_RETRY_DELAYS_MS: readonly number[];

package/dist/drop-core/deploy.d.ts

@@ -10,7 +10,6 @@ export interface DeployOptions {
 }
 export declare function deployFiles(client: DropClient, files: ProcessedFile[], opts?: DeployOptions): Promise<DeployResult>;
 export interface BuildDeployResult {
-    /** The site created for this build. */
     site: BuildSite;
     /** The enqueued build; `deploy_id` is what the app's deploy page keys off. */
     build: BuildResponse;
@@ -21,26 +20,15 @@ export interface BuildDeployResult {
 }
 export interface BuildDeployOptions extends DeployOptions {
     /**
-     * Poll until the build finishes instead of returning as soon as it's enqueued.
-     * Off by default: a build takes minutes, so the useful hand-off is usually the
-     * app's deploy page with its live logs, not a spinner. Turn it on when the
-     * caller needs to know the outcome — only then can a `BuildFailedError` reach
-     * it with the build's own error message.
+     * Wait for the build instead of returning at enqueue. Off by default (builds
+     * take minutes); on is the only way a BuildFailedError reaches the caller.
      */
     waitForBuild?: boolean;
 }
 /**
- * The build counterpart to `deployFiles`: zip the drop, create a site in the
- * user's account, and hand the archive to buildbot. Requires an authenticated
- * client — builds have no anonymous equivalent.
- *
- * Site creation deliberately happens *after* zipping, so a zip that fails
- * doesn't leave an empty site behind in the user's account.
+ * Zip the drop, create a site, hand buildbot the archive. Zipping comes first
+ * on purpose: a failed zip must not leave an empty site behind.
  */
 export declare function deployBuild(client: BuildClient, files: ProcessedFile[], opts?: BuildDeployOptions): Promise<BuildDeployResult>;
-/**
- * Deploy an archive that was already zipped — the resume path for a drop
- * stashed across the signup round-trip (see `buildStash`), where `source.zip`
- * and its synthesised settings were produced before the visitor left.
- */
+/** Deploy an already-zipped archive — the resume path for a stashed drop (see `buildStash`). */
 export declare function deployZippedBuild(client: BuildClient, { file: zip, buildSettings }: ZipResult, opts?: BuildDeployOptions): Promise<BuildDeployResult>;