drop2run 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Drop2Run
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,62 @@
+# drop2run
+
+Publish a static site to [Drop2Run](https://dropto.run) from the command line.
+
+```
+drop2run deploy [dir] [--site <subdomain>]   Publish a folder (default: .)
+drop2run ls                                  List your sites
+drop2run whoami                              Check the token and whose it is
+drop2run where                               Show which token source is in use
+```
+
+`--json` on any command prints machine-readable output instead of text.
+
+## Signing in
+
+**There is no `drop2run login` yet.** It needs endpoints the API does not have — the loopback PKCE flow
+in §4 of `docs/briefs/DEVTOOLS-BRIEF.md` — and a `login` that printed "not implemented" would be worse
+than none, so the command does not exist rather than existing and lying.
+
+Until then, create a token at <https://dropto.run/account/tokens> and either set it in the environment:
+
+```
+DROP2RUN_TOKEN=d2r_...
+```
+
+or put it in `~/.config/drop2run/config.json`:
+
+```json
+{ "token": "d2r_..." }
+```
+
+The environment wins. That is the same file and the same precedence `@drop2run/mcp` uses, so signing in
+once covers both.
+
+`drop2run where` says which source is in force without ever printing the token. That is deliberate: the
+output of a command line ends up in issue reports, terminal recordings and CI logs, and "why is it using
+the wrong account" is answerable without showing the secret.
+
+## What `token create` is not
+
+The brief's §5 lists `token create|list|revoke`. **Create and revoke cannot exist here**, and that is a
+decision rather than an omission: a token that can mint tokens is not a leaked credential but a permanent
+one — whoever takes it makes a second, and revoking the first changes nothing because the replacement is
+one the owner never made and will not recognise. Both endpoints require a browser session. `gh` and
+`vercel` draw the line in the same place.
+
+## Not published yet
+
+`private: true`, because P2 is not finished: without `login` this is a tool that installs and then asks
+you to go and paste a token by hand. The npm name `drop2run` is still unheld — a known risk, recorded in
+§8 of the brief.
+
+The bundle itself would work. `@drop2run/core` and `@drop2run/node` are resolved by build aliases rather
+than installed, and `vite build` folds both into `dist/index.js`, so the tarball has no import pointing
+at something npm cannot fetch. What is missing is a reason to release, not a way to.
+
+## Running it from a checkout
+
+```bash
+cd packages/cli && npm run build
+node bin/drop2run.mjs --help
+```

package/bin/drop2run.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+/**
+ * Entry point for `drop2run`.
+ *
+ * Thin on purpose: the shebang and the executable bit are the two things that have to survive being
+ * published, and `.gitignore` has already eaten this directory once — see the commit that added the
+ * negation for bin directories under packages.
+ */
+import { main } from "../dist/index.js";
+
+await main(process.argv.slice(2));

package/dist/index.js

@@ -0,0 +1,717 @@
+import { join, relative, sep, resolve } from "node:path";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { realpath, readdir, stat, readFile } from "node:fs/promises";
+async function call(credentials, path, init = {}) {
+  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
+    ...init,
+    headers: {
+      ...init.headers,
+      Authorization: `Bearer ${credentials.token}`,
+      ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
+    }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  return await response.json();
+}
+async function listSites(credentials) {
+  const body = await call(credentials, "sites");
+  return body.sites;
+}
+async function createSite(credentials) {
+  const created = await call(
+    credentials,
+    "sites",
+    { method: "POST", body: JSON.stringify({}) }
+  );
+  return { ...created, name: null };
+}
+const TOKEN_VARIABLE = "DROP2RUN_TOKEN";
+function configPath() {
+  return join(homedir(), ".config", "drop2run", "config.json");
+}
+const DEFAULT_API_BASE_URL = "https://dropto.run/api";
+function loadCredentials(env = process.env, read = (path) => readFileSync(path, "utf8")) {
+  let stored = {};
+  try {
+    stored = JSON.parse(read(configPath()));
+  } catch {
+  }
+  const token = env[TOKEN_VARIABLE]?.trim() || stored.token?.trim();
+  if (!token) return null;
+  return {
+    token,
+    apiBaseUrl: env.DROP2RUN_API_URL?.trim() || stored.apiBaseUrl?.trim() || DEFAULT_API_BASE_URL
+  };
+}
+function missingCredentialsMessage() {
+  return [
+    "No Drop2Run access token.",
+    "",
+    "Create one at https://dropto.run/account/tokens, then either:",
+    `  - set ${TOKEN_VARIABLE} in the environment, or`,
+    `  - put it in ${configPath()} as {"token": "d2r_..."}`,
+    "",
+    "The token is shown once when it is created and cannot be recovered afterwards."
+  ].join("\n");
+}
+class DeployError extends Error {
+  /**
+   * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
+   *   the client-side codes in {@link ClientErrorCode}.
+   * @param message Text safe to show the user.
+   * @param detail Anything extra worth logging, such as the RFC 9457 body from the API.
+   */
+  constructor(code, message, detail) {
+    super(message);
+    this.code = code;
+    this.detail = detail;
+    this.name = "DeployError";
+  }
+}
+const ClientErrorCode = {
+  /** The drop held no files once junk was filtered out. */
+  Empty: "empty_drop",
+  /** No `index.html` at the root of the drop. */
+  MissingIndex: "missing_index",
+  /** The drop is larger than the plan allows; the server enforces this too. */
+  TooLarge: "too_large",
+  /** A single file is larger than the plan allows. */
+  FileTooLarge: "file_too_large",
+  /** More files than the plan allows. */
+  TooManyFiles: "too_many_files",
+  /**
+   * A zip claims to expand to more than the plan allows.
+   *
+   * Distinct from {@link TooLarge}, which is about a drop whose files have already been read. This one
+   * is raised from the archive's own directory before anything is decompressed, so the numbers in it
+   * are what the zip declared rather than what was measured.
+   */
+  ZipTooLarge: "zip_too_large",
+  /** The user cancelled. */
+  Cancelled: "cancelled",
+  /** An upload kept failing after every retry. */
+  UploadFailed: "upload_failed"
+};
+const CLAIM_TOKEN_HEADER = "X-Claim-Token";
+async function prepareDeploy(siteId, files, options, signal) {
+  const manifest = files.map((file) => ({
+    path: file.path,
+    sha256: file.sha256,
+    size: file.bytes.length
+  }));
+  return request(
+    `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
+    { files: manifest },
+    options
+  );
+}
+async function completeDeploy(siteId, deployId, options, signal, name) {
+  return request(
+    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`,
+    // A bodyless POST when there is no name to send, which is what this call has always been. The
+    // server treats an absent body and an absent field identically, so nothing depends on which of
+    // the two a client picks.
+    name === null || name === void 0 ? void 0 : { name },
+    options
+  );
+}
+async function request(path, body, options, signal) {
+  const doFetch = options.fetch ?? globalFetch$1();
+  const base = options.baseUrl ?? "/api";
+  const headers = {};
+  if (body !== void 0) headers["Content-Type"] = "application/json";
+  if (options.claimToken) headers[CLAIM_TOKEN_HEADER] = options.claimToken;
+  if (options.token) headers.Authorization = `Bearer ${options.token}`;
+  const response = await doFetch(`${base}/${path}`, {
+    method: "POST",
+    headers,
+    ...body === void 0 ? {} : { body: JSON.stringify(body) },
+    ...{}
+  });
+  if (!response.ok) throw await problemToError(response);
+  return await response.json();
+}
+function globalFetch$1() {
+  return globalThis.fetch.bind(globalThis);
+}
+async function problemToError(response) {
+  let problem = {};
+  try {
+    problem = await response.json();
+  } catch {
+    return new DeployError(
+      `http_${response.status}`,
+      `The server responded with ${response.status}.`
+    );
+  }
+  const code = typeof problem.type === "string" ? problem.type : `http_${response.status}`;
+  const message = typeof problem.detail === "string" ? problem.detail : typeof problem.title === "string" ? problem.title : `The server responded with ${response.status}.`;
+  return new DeployError(code, message, problem);
+}
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function hashAll(files, onProgress, signal) {
+  const hashed = [];
+  for (const [index, file] of files.entries()) {
+    hashed.push({ ...file, sha256: await sha256Hex(file.bytes) });
+    onProgress?.(index + 1, files.length);
+  }
+  return hashed;
+}
+const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
+const IGNORED_DIRECTORIES = ["__MACOSX", ".git", "node_modules", ".svn", ".hg", ".idea", ".vscode"];
+function shouldIgnore(path) {
+  const segments = path.split("/");
+  const name = segments.at(-1) ?? "";
+  if (name === "" || IGNORED_EXACT.has(name)) return true;
+  if (name.startsWith("._")) return true;
+  return segments.some((segment) => IGNORED_DIRECTORIES.includes(segment));
+}
+const REQUIRED_INDEX = "index.html";
+const DOCUMENT_EXTENSIONS = [".md", ".markdown", ".pdf"];
+function isDocumentPath(path) {
+  const lower = path.toLowerCase();
+  return DOCUMENT_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function checkLimits(files, limits) {
+  if (files.length === 0) {
+    throw new DeployError(
+      ClientErrorCode.Empty,
+      "That drop contained no files to deploy. Folders like .git and node_modules are skipped."
+    );
+  }
+  const hasIndex = files.some((file) => file.path === REQUIRED_INDEX);
+  if (!hasIndex && !files.some((file) => isDocumentPath(file.path))) {
+    throw new DeployError(
+      ClientErrorCode.MissingIndex,
+      `A site needs an ${REQUIRED_INDEX} at its top level, or at least one .md or .pdf file to publish as a documents site. Drop the folder that contains it, not the folder above.`
+    );
+  }
+  if (!limits) return;
+  if (files.length > limits.maxFiles) {
+    throw new DeployError(
+      ClientErrorCode.TooManyFiles,
+      `That is ${files.length} files, and this plan allows ${limits.maxFiles}.`,
+      { limit: limits.maxFiles, actual: files.length }
+    );
+  }
+  const oversized = files.find(
+    (file) => file.bytes.length > limits.maxFileBytes
+  );
+  if (oversized) {
+    throw new DeployError(
+      ClientErrorCode.FileTooLarge,
+      `${oversized.path} is ${formatBytes(oversized.bytes.length)}, and this plan allows ${formatBytes(limits.maxFileBytes)} per file.`,
+      {
+        path: oversized.path,
+        limit: limits.maxFileBytes,
+        actual: oversized.bytes.length
+      }
+    );
+  }
+  const total = totalBytes(files);
+  if (total > limits.maxSiteBytes) {
+    throw new DeployError(
+      ClientErrorCode.TooLarge,
+      `That drop is ${formatBytes(total)}, and this plan allows ${formatBytes(limits.maxSiteBytes)}.`,
+      { limit: limits.maxSiteBytes, actual: total }
+    );
+  }
+}
+function totalBytes(files) {
+  return files.reduce((sum, file) => sum + file.bytes.length, 0);
+}
+const MAX_NAME_LENGTH = 60;
+const HEAD_BYTES = 64 * 1024;
+const TITLE_SEPARATORS = ["|", "·", "—", "–", " - "];
+function suggestSiteName(files) {
+  const index = files.find((file) => file.path === "index.html");
+  if (index === void 0) return null;
+  try {
+    return nameFromHtml(decodeHead(index.bytes));
+  } catch {
+    return null;
+  }
+}
+function decodeHead(bytes) {
+  return new TextDecoder("utf-8", { fatal: false }).decode(
+    bytes.subarray(0, HEAD_BYTES)
+  );
+}
+function nameFromHtml(html) {
+  const document = parse(html);
+  const candidates = document ? [
+    document.querySelector('meta[property="og:site_name"]')?.getAttribute("content"),
+    document.querySelector("title")?.textContent,
+    document.querySelector("h1")?.textContent
+  ] : [matchOgSiteName(html), matchTag(html, "title"), matchTag(html, "h1")];
+  for (const candidate of candidates) {
+    const name = clean(candidate);
+    if (name !== null) return name;
+  }
+  return null;
+}
+function parse(html) {
+  const parser = globalThis.DOMParser;
+  if (parser === void 0) return null;
+  try {
+    return new parser().parseFromString(html, "text/html");
+  } catch {
+    return null;
+  }
+}
+function matchTag(html, tag) {
+  const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(
+    html
+  );
+  return match?.[1] ?? null;
+}
+function matchOgSiteName(html) {
+  const patterns = [
+    /<meta[^>]*property\s*=\s*["']og:site_name["'][^>]*content\s*=\s*["']([^"']*)["']/i,
+    /<meta[^>]*content\s*=\s*["']([^"']*)["'][^>]*property\s*=\s*["']og:site_name["']/i
+  ];
+  for (const pattern of patterns) {
+    const match = pattern.exec(html);
+    if (match?.[1] !== void 0) return match[1];
+  }
+  return null;
+}
+const INVISIBLE = new RegExp(
+  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8203)}-${String.fromCharCode(8207)}${String.fromCharCode(8232)}-${String.fromCharCode(8238)}${String.fromCharCode(8288)}-${String.fromCharCode(8292)}${String.fromCharCode(8294)}-${String.fromCharCode(8303)}${String.fromCharCode(65279)}]`,
+  "g"
+);
+function clean(raw) {
+  if (raw === null || raw === void 0) return null;
+  if (raw.includes("<") || raw.includes(">")) return null;
+  const collapsed = raw.replace(INVISIBLE, " ").replace(/\s+/g, " ").trim();
+  const name = trimSuffix(collapsed);
+  if (name.length === 0) return null;
+  if (PLACEHOLDERS.has(name.toLowerCase())) return null;
+  return name.length > MAX_NAME_LENGTH ? name.slice(0, MAX_NAME_LENGTH).trimEnd() : name;
+}
+const PLACEHOLDERS = /* @__PURE__ */ new Set([
+  "document",
+  "untitled",
+  "untitled document",
+  "index",
+  "home",
+  "new page",
+  "my site",
+  "vite app",
+  "vite + react",
+  "react app",
+  "create next app",
+  "svelte app",
+  "webpack app",
+  "hello world",
+  "title"
+]);
+function trimSuffix(title) {
+  for (const separator of TITLE_SEPARATORS) {
+    const at = title.lastIndexOf(separator);
+    if (at <= 0) continue;
+    const before = title.slice(0, at).trim();
+    const after = title.slice(at + separator.length).trim();
+    if (before.length > 0 && after.length > 0) return after;
+  }
+  return title;
+}
+const DEFAULT_CONCURRENCY = 8;
+const DEFAULT_RETRIES = 3;
+const BACKOFF_MS = [1e3, 2e3, 4e3];
+async function uploadAll(targets, files, onProgress, signal, deps = {}) {
+  const doFetch = deps.fetch ?? globalFetch();
+  const delay = deps.delay ?? defaultDelay;
+  const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
+  const retries = deps.retries ?? DEFAULT_RETRIES;
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  let nextIndex = 0;
+  let done = 0;
+  let uploadedBytes = 0;
+  const worker = async () => {
+    for (; ; ) {
+      const index = nextIndex++;
+      const target = targets[index];
+      if (target === void 0) return;
+      const file = byPath.get(target.path);
+      if (file === void 0) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `The server asked for ${target.path}, which is not in the manifest.`,
+          { path: target.path }
+        );
+      }
+      await uploadOne(target, file, { doFetch, delay, retries, signal });
+      done += 1;
+      uploadedBytes += file.bytes.length;
+      onProgress?.(done, targets.length, uploadedBytes);
+    }
+  };
+  const workers = Array.from(
+    { length: Math.min(concurrency, targets.length) },
+    worker
+  );
+  try {
+    await Promise.all(workers);
+  } catch (error) {
+    throw asDeployError(error);
+  }
+}
+async function uploadOne(target, file, context) {
+  let lastError;
+  for (let attempt = 0; attempt <= context.retries; attempt++) {
+    context.signal?.throwIfAborted();
+    if (attempt > 0) {
+      await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
+      context.signal?.throwIfAborted();
+    }
+    try {
+      const response = await context.doFetch(target.url, {
+        method: "PUT",
+        body: new Blob([file.bytes.slice().buffer]),
+        // Signed into the URL, so this is not optional: storage checks the bytes against it and
+        // rejects the PUT if they disagree. `Content-Length` is signed too but cannot be set
+        // here — it is a forbidden header name, and the browser derives it from the body, which
+        // is exactly the value the server signed.
+        headers: { "x-amz-checksum-sha256": toBase64Digest(target.sha256) },
+        ...context.signal ? { signal: context.signal } : {}
+      });
+      if (response.ok) return;
+      if (response.status === 403 || response.status === 401) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `Upload of ${target.path} was rejected by storage. The upload window may have expired — try deploying again.`,
+          { path: target.path, status: response.status }
+        );
+      }
+      lastError = new Error(`HTTP ${response.status}`);
+    } catch (error) {
+      if (error instanceof DeployError) throw error;
+      if (isAbort(error)) throw cancelled();
+      lastError = error;
+    }
+  }
+  throw new DeployError(
+    ClientErrorCode.UploadFailed,
+    `Could not upload ${target.path} after ${context.retries + 1} attempts.`,
+    { path: target.path, cause: String(lastError) }
+  );
+}
+function toBase64Digest(sha256Hex2) {
+  const bytes = new Uint8Array(sha256Hex2.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = Number.parseInt(sha256Hex2.slice(i * 2, i * 2 + 2), 16);
+  }
+  return btoa(String.fromCharCode(...bytes));
+}
+function globalFetch() {
+  return globalThis.fetch.bind(globalThis);
+}
+function defaultDelay(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function isAbort(error) {
+  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
+function cancelled() {
+  return new DeployError(ClientErrorCode.Cancelled, "Deploy cancelled.");
+}
+function asDeployError(error) {
+  if (error instanceof DeployError) return error;
+  if (isAbort(error)) return cancelled();
+  return new DeployError(
+    ClientErrorCode.UploadFailed,
+    error instanceof Error ? error.message : "Upload failed.",
+    error
+  );
+}
+async function deploy(source, siteId, onProgress, signal, options = {}) {
+  try {
+    const files = await source(signal);
+    onProgress({ type: "collecting", files: files.length });
+    const hashed = await hashAll(
+      files,
+      (done, total) => onProgress({ type: "hashing", done, total }),
+      signal
+    );
+    checkLimits(hashed, options.limits ?? null);
+    onProgress({ type: "preparing" });
+    const prepared = await prepareDeploy(siteId, hashed, options, signal);
+    if (prepared.unchanged) {
+      onProgress({ type: "unchanged", url: prepared.url ?? "" });
+      return;
+    }
+    await uploadAll(
+      prepared.upload,
+      hashed,
+      (done, _total, bytes) => onProgress({
+        type: "uploading",
+        done: prepared.reused + done,
+        total: prepared.total,
+        bytes,
+        reused: prepared.reused
+      }),
+      signal,
+      options.upload
+    );
+    onProgress({ type: "completing", reused: prepared.reused });
+    const completed = await completeDeploy(
+      siteId,
+      prepared.deployId,
+      options,
+      signal,
+      suggestSiteName(files)
+    );
+    onProgress({ type: "done", url: completed.url, name: completed.name });
+  } catch (error) {
+    const failure2 = asDeployError(error);
+    onProgress({
+      type: "error",
+      code: failure2.code,
+      message: failure2.message,
+      ...failure2.detail === void 0 ? {} : { detail: failure2.detail }
+    });
+    throw failure2;
+  }
+}
+const MAX_FILES = 2e4;
+function directorySource(root) {
+  return async () => {
+    const base = await realpath(root);
+    const files = [];
+    await walk(base, base, files);
+    return files;
+  };
+}
+async function walk(root, directory, into) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const full = join(directory, entry.name);
+    const path = relative(root, full).split(sep).join("/");
+    if (shouldIgnore(path)) continue;
+    if (entry.isSymbolicLink()) {
+      const target = await realpath(full).catch(() => null);
+      if (target === null || escapesRoot(root, target)) continue;
+      const targeted = await stat(target);
+      if (targeted.isDirectory()) {
+        await walk(root, target, into);
+        continue;
+      }
+      if (!targeted.isFile()) continue;
+    } else if (entry.isDirectory()) {
+      await walk(root, full, into);
+      continue;
+    } else if (!entry.isFile()) {
+      continue;
+    }
+    if (into.length >= MAX_FILES) {
+      throw new Error(
+        `This folder holds more than ${MAX_FILES.toLocaleString()} files. Publish a build output directory rather than a whole project.`
+      );
+    }
+    into.push({ path, bytes: new Uint8Array(await readFile(full)) });
+  }
+}
+function escapesRoot(root, candidate) {
+  const inside = relative(root, candidate);
+  return inside === "" || inside.startsWith("..");
+}
+async function resolveSite(credentials, site) {
+  if (site === void 0) return await createSite(credentials);
+  const wanted = site.trim().toLowerCase();
+  const found = (await listSites(credentials)).find(
+    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
+  );
+  if (found === void 0) {
+    throw new Error(
+      `No site of yours is called "${site}". Leave the site out to publish to a new one, or use list_sites to see what exists.`
+    );
+  }
+  return found;
+}
+async function publish(credentials, source, site) {
+  const target = await resolveSite(credentials, site);
+  let files = 0;
+  let url = target.url;
+  let unchanged = false;
+  let failure2 = null;
+  const record = (event) => {
+    if (event.type === "collecting") files = event.files;
+    if (event.type === "unchanged") {
+      unchanged = true;
+      url = event.url || target.url;
+    }
+    if (event.type === "done") url = event.url;
+    if (event.type === "error") failure2 = event.message;
+  };
+  await deploy(source, target.siteId, record, void 0, {
+    baseUrl: credentials.apiBaseUrl,
+    token: credentials.token
+  }).catch((error) => {
+    throw new Error(failure2 ?? (error instanceof Error ? error.message : String(error)));
+  });
+  return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
+}
+function publishDirectory(credentials, directory, site) {
+  return publish(credentials, directorySource(directory), site);
+}
+function failure(text) {
+  return { text, json: { error: text }, code: 1 };
+}
+function credentialsOr() {
+  const credentials = loadCredentials();
+  if (credentials === null) return { result: failure(missingCredentialsMessage()) };
+  return { credentials };
+}
+async function whoami() {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const response = await fetch(`${found.credentials.apiBaseUrl}/me`, {
+    headers: { Authorization: `Bearer ${found.credentials.token}` }
+  });
+  if (!response.ok) {
+    return failure(
+      response.status === 401 ? "This token is not valid any more. It may have been revoked or expired — create another at https://dropto.run/account/tokens." : `The API answered ${response.status}.`
+    );
+  }
+  const me = await response.json();
+  const plan = me.plan?.name ? ` on ${me.plan.name}` : "";
+  return {
+    text: `${me.email}${plan}
+API: ${found.credentials.apiBaseUrl}`,
+    json: me,
+    code: 0
+  };
+}
+async function list() {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const sites = await listSites(found.credentials);
+  if (sites.length === 0) {
+    return {
+      text: "No sites yet. `drop2run deploy` publishes one.",
+      json: { sites: [] },
+      code: 0
+    };
+  }
+  return {
+    text: sites.map((site) => `${site.subdomain}	${site.url}${site.name ? `	${site.name}` : ""}`).join("\n"),
+    json: { sites },
+    code: 0
+  };
+}
+async function deployCommand(directory, site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  try {
+    const result = await publishDirectory(found.credentials, resolve(directory), site);
+    const what = result.unchanged ? "Already up to date — nothing needed publishing." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
+    return {
+      text: `${what}
+${result.url}`,
+      json: result,
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+function where() {
+  const fromEnvironment = process.env[TOKEN_VARIABLE]?.trim();
+  const credentials = loadCredentials();
+  const source = fromEnvironment ? `${TOKEN_VARIABLE} (environment)` : credentials === null ? "nowhere — no token found" : configPath();
+  return {
+    text: [
+      `Token source: ${source}`,
+      `Config file:  ${configPath()}`,
+      `API:          ${credentials?.apiBaseUrl ?? "—"}`
+    ].join("\n"),
+    json: {
+      tokenSource: source,
+      configPath: configPath(),
+      apiBaseUrl: credentials?.apiBaseUrl ?? null
+    },
+    code: credentials === null ? 1 : 0
+  };
+}
+const HELP = `drop2run — publish a static site from the command line
+
+  drop2run deploy [dir] [--site <subdomain>]   Publish a folder (default: .)
+  drop2run ls                                  List your sites
+  drop2run whoami                              Check the token and whose it is
+  drop2run where                               Show which token source is in use
+  drop2run --version                           Print the version
+
+Flags
+  --json      Print machine-readable output instead of text
+  --site X    Publish over an existing site rather than creating one
+
+Signing in
+  There is no \`drop2run login\` yet. Create a token at
+  https://dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
+  environment or put it in ~/.config/drop2run/config.json as {"token": "d2r_..."}.
+`;
+function flagValue(args, flag) {
+  const at = args.indexOf(flag);
+  if (at === -1) return void 0;
+  const value = args[at + 1];
+  return value === void 0 || value.startsWith("-") ? void 0 : value;
+}
+async function run(argv) {
+  const json = argv.includes("--json");
+  const positional = argv.filter((argument) => !argument.startsWith("-"));
+  const [command, ...rest] = positional;
+  if (argv.includes("--version")) {
+    const { version } = await import("./package-VuVin5yv.js").then(
+      (module) => module.default
+    );
+    return { text: version, json: { version }, code: 0 };
+  }
+  const askedForHelp = argv.includes("--help") || argv.includes("-h") || command === "help";
+  if (askedForHelp) return { text: HELP, json: { help: HELP }, code: 0 };
+  if (command === void 0) return { text: HELP, json: { help: HELP }, code: 1 };
+  const site = flagValue(argv, "--site");
+  const result = await dispatch(command, rest, site);
+  return json ? { ...result, text: JSON.stringify(result.json, null, 2) } : result;
+}
+async function dispatch(command, rest, site) {
+  switch (command) {
+    case "deploy":
+      return await deployCommand(rest[0] ?? ".", site);
+    case "ls":
+    case "list":
+      return await list();
+    case "whoami":
+      return await whoami();
+    case "where":
+      return where();
+    default:
+      return {
+        text: `Unknown command "${command}".
+
+${HELP}`,
+        json: { error: `Unknown command "${command}".` },
+        code: 1
+      };
+  }
+}
+async function main(argv) {
+  const result = await run(argv);
+  if (result.code === 0) console.log(result.text);
+  else console.error(result.text);
+  process.exit(result.code);
+}
+export {
+  main
+};

package/dist/package-VuVin5yv.js

@@ -0,0 +1,44 @@
+const name = "drop2run";
+const version = "0.0.0";
+const description = "Publish a static site to Drop2Run from the command line.";
+const license = "MIT";
+const type = "module";
+const bin = { "drop2run": "bin/drop2run.mjs" };
+const files = ["bin", "dist"];
+const engines = { "node": ">=20" };
+const publishConfig = { "access": "public" };
+const homepage = "https://dropto.run";
+const keywords = ["static-site", "deploy", "hosting", "cli"];
+const scripts = { "build": "vite build", "typecheck": "tsc --noEmit", "test": "vitest run", "lint": "biome check .", "format": "biome check --write ." };
+const devDependencies = { "@biomejs/biome": "^2.5.11", "@types/node": "^26.4.0", "typescript": "^5.9.3", "vite": "^7.2.1", "vitest": "^4.1.11" };
+const _package = {
+  name,
+  version,
+  description,
+  license,
+  type,
+  bin,
+  files,
+  engines,
+  publishConfig,
+  homepage,
+  keywords,
+  scripts,
+  devDependencies
+};
+export {
+  bin,
+  _package as default,
+  description,
+  devDependencies,
+  engines,
+  files,
+  homepage,
+  keywords,
+  license,
+  name,
+  publishConfig,
+  scripts,
+  type,
+  version
+};

package/package.json

@@ -0,0 +1,41 @@
+{
+	"name": "drop2run",
+	"version": "0.0.0",
+	"description": "Publish a static site to Drop2Run from the command line.",
+	"license": "MIT",
+	"type": "module",
+	"bin": {
+		"drop2run": "bin/drop2run.mjs"
+	},
+	"files": [
+		"bin",
+		"dist"
+	],
+	"engines": {
+		"node": ">=20"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"homepage": "https://dropto.run",
+	"keywords": [
+		"static-site",
+		"deploy",
+		"hosting",
+		"cli"
+	],
+	"scripts": {
+		"build": "vite build",
+		"typecheck": "tsc --noEmit",
+		"test": "vitest run",
+		"lint": "biome check .",
+		"format": "biome check --write ."
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2.5.11",
+		"@types/node": "^26.4.0",
+		"typescript": "^5.9.3",
+		"vite": "^7.2.1",
+		"vitest": "^4.1.11"
+	}
+}