drop2run 0.0.0 → 0.1.1

package/README.md

@@ -2,22 +2,76 @@
 
 Publish a static site to [Drop2Run](https://dropto.run) from the command line.
 
+```bash
+npm i -g drop2run
+drop2run login
+drop2run deploy dist
+```
+
+Node 20 or newer. That is the whole of it: `login` opens a browser and stores a token, `deploy` prints the
+URL. Full documentation at [dropto.run/docs/cli](https://dropto.run/docs/cli).
+
 ```
-drop2run deploy [dir] [--site <subdomain>]   Publish a folder (default: .)
+drop2run login [--device]                    Sign in and store a token
+drop2run logout                              Remove the stored token
+drop2run init [dir] [--site <subdomain>]     Tie this folder to a site
+drop2run deploy [dir] [--site <subdomain>]   Publish a folder
 drop2run ls                                  List your sites
+drop2run open [site]                         Open a site in a browser
+drop2run rollback <deployId> [--site X]      Put an earlier version back live
+drop2run rm <site> --yes                     Delete a site and everything on it
+drop2run token list                          List your access tokens
 drop2run whoami                              Check the token and whose it is
 drop2run where                               Show which token source is in use
 ```
 
 `--json` on any command prints machine-readable output instead of text.
 
+## Which site a command acts on
+
+`--site`, then `drop2run.json`, then a new one. `init` writes that file, so this is the whole of a
+normal project:
+
+```bash
+drop2run init dist        # creates a site, writes drop2run.json
+drop2run deploy           # publishes dist to it, no arguments
+```
+
+The order is not a convenience. A `deploy` that created a site while a project file sat next to it would
+leave the real site untouched and the person looking at a URL they did not expect.
+
+`rm` is the one command that will not act on what it worked out: it prints the site it would delete and
+stops, and only runs with `--yes`. There is no undo — the files go and the subdomain is released — and a
+terminal has no confirmation dialog, so the flag is the dialog.
+
+`token create` and `token revoke` do not exist; see below.
+
 ## Signing in
 
-**There is no `drop2run login` yet.** It needs endpoints the API does not have — the loopback PKCE flow
-in §4 of `docs/briefs/DEVTOOLS-BRIEF.md` — and a `login` that printed "not implemented" would be worse
-than none, so the command does not exist rather than existing and lying.
+`drop2run login` opens a browser, waits on `127.0.0.1`, and stores the token it is handed in
+`~/.config/drop2run/config.json` with mode `0600`.
+
+Two things about it are worth knowing, because they decide when it works:
+
+- **It needs a browser and loopback on the same machine.** The token is delivered by a redirect to a
+  temporary server this process opens on `127.0.0.1`, which is what keeps it out of clipboards and
+  scrollback. A remote shell whose browser is on another machine cannot complete that redirect — use
+  `--device` there.
+- **It uses PKCE, so there is no client secret.** A verifier is generated per sign-in and never leaves the
+  process; only its SHA-256 travels through the browser. A code intercepted anywhere along the way cannot
+  be exchanged without the verifier.
+
+### `--device`, for a machine with no browser
+
+`drop2run login --device` prints a short code and waits. Enter it at <https://dropto.run/device> from any
+machine you are signed in on — a phone will do — and the terminal picks up its token.
 
-Until then, create a token at <https://dropto.run/account/tokens> and either set it in the environment:
+The short code is not the credential: it names the pending request, and approving it releases a long code
+that never left the waiting process. Somebody reading it over your shoulder learns which sign-in is
+waiting, not how to collect its token. It lasts fifteen minutes and works once.
+
+For CI, neither flow applies — nothing there can open a browser or approve anything. Create a token at
+<https://dropto.run/account/tokens> and either set it in the environment:
 
 ```
 DROP2RUN_TOKEN=d2r_...
@@ -44,17 +98,54 @@ one — whoever takes it makes a second, and revoking the first changes nothing
 one the owner never made and will not recognise. Both endpoints require a browser session. `gh` and
 `vercel` draw the line in the same place.
 
-## Not published yet
+`token list` does exist, and answers the question a terminal can answer: which machines are holding a
+credential, and which of them has not used it since it was made. It prints prefixes, never secrets.
+`token revoke` is refused with a message rather than treated as `list` — somebody will type it, and
+listing instead would read as having worked.
+
+---
+
+Everything below is for whoever maintains this package. It is here rather than in the monorepo's docs
+because it is about this directory — but it is on the npm page too, so it says who it is for.
+
+## Releasing
+
+The current version is whatever `package.json` says; the first release with `login` in it was `0.1.0`,
+published 02/09/2026. `0.0.0` is also on the registry and is not a release — it held the bare name
+`drop2run` (brief §9.1) and predates `login` entirely, so nothing should ever be pinned to it.
+
+Check a publish from outside rather than from its own output, because the failure worth ruling out is a
+tarball with no `dist` — which the publish log looks perfectly happy about:
+
+```
+$ npx drop2run@<version> --version
+```
+
+Publishing is one command:
+
+```bash
+cd packages/cli && npm publish
+```
+
+`prepublishOnly` builds and runs the tests first, and that is load-bearing rather than tidy: `files` is
+`["bin", "dist"]`, `dist` is gitignored, and `bin/drop2run.mjs` imports `../dist/index.js`. A publish from
+a checkout that had not been built would ship a package that throws on its first line — at a version
+number that can never be reused, because npm burns one even after `unpublish`.
+
+**No `--provenance`, and not by oversight.** It needs a public repository, and this is a private monorepo;
+the flag fails locally with `Automatic provenance generation not supported for provider: null` and would
+fail in Actions too. Provenance arrives with the `drop2run-cli` split in brief §9.2 — which has its own
+precondition, a `gitleaks` sweep of the whole history rather than of HEAD.
 
-`private: true`, because P2 is not finished: without `login` this is a tool that installs and then asks
-you to go and paste a token by hand. The npm name `drop2run` is still unheld — a known risk, recorded in
-§8 of the brief.
+Two release chores still outstanding, neither blocking: changesets across `core` → `node` → `cli`, whose
+versions have to move in that order, and the fact that this package is the only one of the four with a
+licence field.
 
-The bundle itself would work. `@drop2run/core` and `@drop2run/node` are resolved by build aliases rather
-than installed, and `vite build` folds both into `dist/index.js`, so the tarball has no import pointing
-at something npm cannot fetch. What is missing is a reason to release, not a way to.
+The bundle itself works. `@drop2run/core` and `@drop2run/node` are resolved by build aliases rather than
+installed, and `vite build` folds both into `dist/index.js`, so the tarball has no import pointing at
+something npm cannot fetch.
 
-## Running it from a checkout
+## Running it from the monorepo
 
 ```bash
 cd packages/cli && npm run build

package/dist/index.js

@@ -1,14 +1,17 @@
-import { join, relative, sep, resolve } from "node:path";
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { join, dirname, relative, sep, resolve } from "node:path";
+import { readFileSync, writeFileSync, chmodSync, renameSync, mkdirSync } from "node:fs";
+import { homedir, hostname } from "node:os";
 import { realpath, readdir, stat, readFile } from "node:fs/promises";
-async function call(credentials, path, init = {}) {
+import { spawn } from "node:child_process";
+import { randomBytes, createHash } from "node:crypto";
+import { createServer } from "node:http";
+async function call(credentials, path, init2 = {}) {
   const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
-    ...init,
+    ...init2,
     headers: {
-      ...init.headers,
+      ...init2.headers,
       Authorization: `Bearer ${credentials.token}`,
-      ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
+      ...init2.body === void 0 ? {} : { "Content-Type": "application/json" }
     }
   });
   if (!response.ok) {
@@ -17,6 +20,37 @@ async function call(credentials, path, init = {}) {
   }
   return await response.json();
 }
+async function findSite(credentials, site) {
+  const wanted = site.trim().toLowerCase();
+  const found = (await listSites(credentials)).find(
+    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
+  );
+  if (found === void 0) {
+    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+  }
+  return found;
+}
+async function deleteSite(credentials, siteId) {
+  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${credentials.token}` }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+}
+async function promoteDeploy(credentials, siteId, deployId) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
+    { method: "POST" }
+  );
+}
+async function listTokens(credentials) {
+  const body = await call(credentials, "tokens");
+  return body.tokens;
+}
 async function listSites(credentials) {
   const body = await call(credentials, "sites");
   return body.sites;
@@ -47,17 +81,88 @@ function loadCredentials(env = process.env, read = (path) => readFileSync(path,
     apiBaseUrl: env.DROP2RUN_API_URL?.trim() || stored.apiBaseUrl?.trim() || DEFAULT_API_BASE_URL
   };
 }
+function resolveApiBaseUrl(env = process.env, read = (path) => readFileSync(path, "utf8")) {
+  let stored = {};
+  try {
+    stored = JSON.parse(read(configPath()));
+  } catch {
+  }
+  const url = env.DROP2RUN_API_URL?.trim() || stored.apiBaseUrl?.trim() || DEFAULT_API_BASE_URL;
+  return url.replace(/\/+$/, "");
+}
+function dashboardUrlFor(apiBaseUrl) {
+  return apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+}
+function saveToken(token, path = configPath()) {
+  let existing = {};
+  try {
+    existing = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+  }
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify({ ...existing, token }, null, "	")}
+`, {
+    mode: 384
+  });
+  chmodSync(temporary, 384);
+  renameSync(temporary, path);
+  return path;
+}
+function clearToken(path = configPath()) {
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return false;
+  }
+  if (existing.token === void 0) return false;
+  const { token: _removed, ...rest } = existing;
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(rest, null, "	")}
+`, { mode: 384 });
+  chmodSync(temporary, 384);
+  renameSync(temporary, path);
+  return true;
+}
 function missingCredentialsMessage() {
   return [
     "No Drop2Run access token.",
     "",
-    "Create one at https://dropto.run/account/tokens, then either:",
+    "Run `drop2run login` to sign in through a browser, which stores one for you.",
+    "",
+    "For CI, or where no browser can be opened, create a token at",
+    "https://dropto.run/account/tokens and either:",
     `  - set ${TOKEN_VARIABLE} in the environment, or`,
     `  - put it in ${configPath()} as {"token": "d2r_..."}`,
     "",
     "The token is shown once when it is created and cannot be recovered afterwards."
   ].join("\n");
 }
+const PROJECT_FILE = "drop2run.json";
+function projectPath(directory = process.cwd()) {
+  return join(directory, PROJECT_FILE);
+}
+function readProject(directory = process.cwd(), read = (path) => readFileSync(path, "utf8")) {
+  let parsed;
+  try {
+    parsed = JSON.parse(read(projectPath(directory)));
+  } catch {
+    return null;
+  }
+  if (typeof parsed.siteId !== "string" || parsed.siteId === "") return null;
+  return {
+    siteId: parsed.siteId,
+    subdomain: typeof parsed.subdomain === "string" ? parsed.subdomain : "",
+    dir: typeof parsed.dir === "string" && parsed.dir !== "" ? parsed.dir : "."
+  };
+}
+function writeProject(project, directory = process.cwd()) {
+  const path = projectPath(directory);
+  writeFileSync(path, `${JSON.stringify(project, null, "	")}
+`);
+  return path;
+}
 class DeployError extends Error {
   /**
    * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
@@ -103,11 +208,17 @@ async function prepareDeploy(siteId, files, options, signal) {
     sha256: file.sha256,
     size: file.bytes.length
   }));
-  return request(
+  const prepared = await request(
     `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
     { files: manifest },
     options
   );
+  return { ...prepared, uploadUrl: absolute(prepared.uploadUrl, options.baseUrl) };
+}
+function absolute(uploadUrl, baseUrl) {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(uploadUrl)) return uploadUrl;
+  if (baseUrl === void 0 || !/^[a-z][a-z0-9+.-]*:/i.test(baseUrl)) return uploadUrl;
+  return new URL(uploadUrl, baseUrl).toString();
 }
 async function completeDeploy(siteId, deployId, options, signal, name) {
   return request(
@@ -165,7 +276,16 @@ async function hashAll(files, onProgress, signal) {
   return hashed;
 }
 const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
-const IGNORED_DIRECTORIES = ["__MACOSX", ".git", "node_modules", ".svn", ".hg", ".idea", ".vscode"];
+const IGNORED_DIRECTORIES = [
+  "__MACOSX",
+  ".git",
+  "node_modules",
+  ".svn",
+  ".hg",
+  ".idea",
+  ".vscode",
+  ".claude"
+];
 function shouldIgnore(path) {
   const segments = path.split("/");
   const name = segments.at(-1) ?? "";
@@ -182,7 +302,8 @@ function isDocumentPath(path) {
 function formatBytes(bytes) {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
 }
 function checkLimits(files, limits) {
   if (files.length === 0) {
@@ -221,7 +342,7 @@ function checkLimits(files, limits) {
     );
   }
   const total = totalBytes(files);
-  if (total > limits.maxSiteBytes) {
+  if (limits.maxSiteBytes !== null && total > limits.maxSiteBytes) {
     throw new DeployError(
       ClientErrorCode.TooLarge,
       `That drop is ${formatBytes(total)}, and this plan allows ${formatBytes(limits.maxSiteBytes)}.`,
@@ -331,7 +452,7 @@ function trimSuffix(title) {
 const DEFAULT_CONCURRENCY = 8;
 const DEFAULT_RETRIES = 3;
 const BACKOFF_MS = [1e3, 2e3, 4e3];
-async function uploadAll(targets, files, onProgress, signal, deps = {}) {
+async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}) {
   const doFetch = deps.fetch ?? globalFetch();
   const delay = deps.delay ?? defaultDelay;
   const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
@@ -353,7 +474,13 @@ async function uploadAll(targets, files, onProgress, signal, deps = {}) {
           { path: target.path }
         );
       }
-      await uploadOne(target, file, { doFetch, delay, retries, signal });
+      await uploadOne(target, file, {
+        doFetch,
+        delay,
+        retries,
+        signal,
+        uploadUrl
+      });
       done += 1;
       uploadedBytes += file.bytes.length;
       onProgress?.(done, targets.length, uploadedBytes);
@@ -378,21 +505,20 @@ async function uploadOne(target, file, context) {
       context.signal?.throwIfAborted();
     }
     try {
-      const response = await context.doFetch(target.url, {
+      const response = await context.doFetch(context.uploadUrl, {
         method: "PUT",
         body: new Blob([file.bytes.slice().buffer]),
-        // Signed into the URL, so this is not optional: storage checks the bytes against it and
-        // rejects the PUT if they disagree. `Content-Length` is signed too but cannot be set
-        // here — it is a forbidden header name, and the browser derives it from the body, which
-        // is exactly the value the server signed.
-        headers: { "x-amz-checksum-sha256": toBase64Digest(target.sha256) },
+        // The permit is the whole request. `Content-Length` is required by the Worker and cannot
+        // be set here — it is a forbidden header name — but the browser derives it from the body,
+        // which is exactly the length the token names.
+        headers: { Authorization: `Bearer ${target.token}` },
         ...context.signal ? { signal: context.signal } : {}
       });
       if (response.ok) return;
-      if (response.status === 403 || response.status === 401) {
+      if (response.status === 401 || response.status === 403 || response.status === 429) {
         throw new DeployError(
           ClientErrorCode.UploadFailed,
-          `Upload of ${target.path} was rejected by storage. The upload window may have expired — try deploying again.`,
+          `Upload of ${target.path} was refused. The upload window may have expired — try deploying again.`,
           { path: target.path, status: response.status }
         );
       }
@@ -409,13 +535,6 @@ async function uploadOne(target, file, context) {
     { path: target.path, cause: String(lastError) }
   );
 }
-function toBase64Digest(sha256Hex2) {
-  const bytes = new Uint8Array(sha256Hex2.length / 2);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = Number.parseInt(sha256Hex2.slice(i * 2, i * 2 + 2), 16);
-  }
-  return btoa(String.fromCharCode(...bytes));
-}
 function globalFetch() {
   return globalThis.fetch.bind(globalThis);
 }
@@ -455,6 +574,7 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
     }
     await uploadAll(
       prepared.upload,
+      prepared.uploadUrl,
       hashed,
       (done, _total, bytes) => onProgress({
         type: "uploading",
@@ -546,6 +666,7 @@ async function publish(credentials, source, site) {
   let url = target.url;
   let unchanged = false;
   let failure2 = null;
+  let failureDetail;
   const record = (event) => {
     if (event.type === "collecting") files = event.files;
     if (event.type === "unchanged") {
@@ -553,27 +674,281 @@ async function publish(credentials, source, site) {
       url = event.url || target.url;
     }
     if (event.type === "done") url = event.url;
-    if (event.type === "error") failure2 = event.message;
+    if (event.type === "error") {
+      failure2 = event.message;
+      failureDetail = event.detail;
+    }
   };
   await deploy(source, target.siteId, record, void 0, {
     baseUrl: credentials.apiBaseUrl,
     token: credentials.token
   }).catch((error) => {
-    throw new Error(failure2 ?? (error instanceof Error ? error.message : String(error)));
+    const thrown = new Error(
+      failure2 ?? (error instanceof Error ? error.message : String(error))
+    );
+    thrown.detail = failureDetail ?? error?.detail;
+    throw thrown;
   });
   return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
 }
 function publishDirectory(credentials, directory, site) {
   return publish(credentials, directorySource(directory), site);
 }
+const TIMEOUT_MS = 5 * 60 * 1e3;
+function newAttempt() {
+  const verifier = randomBytes(32).toString("base64url");
+  return {
+    verifier,
+    challenge: createHash("sha256").update(verifier).digest("base64url"),
+    state: randomBytes(16).toString("base64url")
+  };
+}
+function clientName() {
+  const raw = hostname().trim().replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 64);
+  return raw === "" ? "drop2run-cli" : raw;
+}
+function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(command, [...args], { stdio: "ignore", detached: true });
+    child.unref();
+    child.on("error", () => {
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function listen(state) {
+  return new Promise((resolveListener, rejectListener) => {
+    let settle = null;
+    let fail = null;
+    const received = new Promise((resolveCode, rejectCode) => {
+      settle = resolveCode;
+      fail = rejectCode;
+    });
+    const server = createServer((request2, response) => {
+      const url = new URL(request2.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/cb") {
+        response.writeHead(404, { "Content-Type": "text/plain" });
+        response.end("Not found.\n");
+        return;
+      }
+      const code = url.searchParams.get("code") ?? "";
+      const returned = url.searchParams.get("state") ?? "";
+      if (returned !== state || code === "") {
+        respond(
+          response,
+          400,
+          "Sign-in could not be completed",
+          "This did not come from the sign-in that was started here. Nothing has been changed."
+        );
+        fail?.(new Error("The browser returned a response that did not match this sign-in."));
+        return;
+      }
+      respond(response, 200, "Signed in", "You can close this tab and go back to the terminal.");
+      settle?.({ code });
+    });
+    server.on("error", (error) => {
+      rejectListener(error);
+      fail?.(error instanceof Error ? error : new Error(String(error)));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (address === null) {
+        rejectListener(new Error("Could not open a local port to receive the sign-in."));
+        return;
+      }
+      resolveListener({
+        port: address.port,
+        received,
+        close: () => server.close()
+      });
+    });
+  });
+}
+function respond(response, status, title, detail) {
+  response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+  response.end(
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title} — drop2run</title><style>body{font:16px/1.6 system-ui,sans-serif;margin:20vh auto;max-width:28rem;padding:0 1.5rem;color:#12211f}h1{font-size:1.4rem;margin:0 0 .5rem}p{margin:0;color:#64706e}@media(prefers-color-scheme:dark){body{background:#0d1413;color:#e8efee}p{color:#9aa8a6}}</style></head><body><h1>${title}</h1><p>${detail}</p></body></html>
+`
+  );
+}
+async function waitForCallback(received, timeoutMs = TIMEOUT_MS) {
+  let timer;
+  try {
+    return await Promise.race([
+      received,
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("Timed out waiting for the browser. Nothing has been changed.")),
+          timeoutMs
+        );
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function consentUrl(dashboardUrl, attempt, port, name) {
+  const url = new URL("/cli-auth", dashboardUrl);
+  url.searchParams.set("challenge", attempt.challenge);
+  url.searchParams.set("state", attempt.state);
+  url.searchParams.set("port", String(port));
+  url.searchParams.set("name", name);
+  return url.toString();
+}
+async function startDevice(apiBaseUrl, clientName2) {
+  const response = await fetch(`${apiBaseUrl}/auth/cli/device`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientName: clientName2 })
+  });
+  if (!response.ok) throw new Error(await problemDetail(response));
+  return await response.json();
+}
+async function pollDevice(apiBaseUrl, deviceCode) {
+  let response;
+  try {
+    response = await fetch(`${apiBaseUrl}/auth/cli/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ deviceCode })
+    });
+  } catch {
+    return { state: "pending" };
+  }
+  if (response.ok) {
+    const body = await response.json();
+    return { state: "granted", token: { token: body.token, name: body.name, email: body.email } };
+  }
+  const problem = await response.json().catch(() => null);
+  if (problem?.type === "authorization_pending") return { state: "pending" };
+  if (problem?.type === "slow_down") return { state: "slow_down" };
+  return {
+    state: "dead",
+    message: problem?.detail ?? `The API answered ${response.status}.`
+  };
+}
+async function problemDetail(response) {
+  const problem = await response.json().catch(() => null);
+  return problem?.detail ?? `The API answered ${response.status}.`;
+}
+async function exchange(apiBaseUrl, code, verifier) {
+  const response = await fetch(`${apiBaseUrl}/auth/cli/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, verifier })
+  });
+  if (!response.ok) throw new Error(await problemDetail(response));
+  const body = await response.json();
+  return { token: body.token, name: body.name, email: body.email };
+}
 function failure(text) {
   return { text, json: { error: text }, code: 1 };
 }
+function failureFrom(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const detail = error?.detail;
+  const cause = detail?.cause;
+  const extra = cause === void 0 || cause === null ? "" : `
+${String(cause)}`;
+  return {
+    text: `${message}${extra}`,
+    json: { error: message, ...detail === void 0 ? {} : { detail } },
+    code: 1
+  };
+}
 function credentialsOr() {
   const credentials = loadCredentials();
   if (credentials === null) return { result: failure(missingCredentialsMessage()) };
   return { credentials };
 }
+async function login(print = console.error) {
+  const apiBaseUrl = resolveApiBaseUrl();
+  const attempt = newAttempt();
+  const name = clientName();
+  let listener;
+  try {
+    listener = await listen(attempt.state);
+  } catch (error) {
+    return failure(
+      `Could not open a local port to receive the sign-in: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  try {
+    const url = consentUrl(dashboardUrlFor(apiBaseUrl), attempt, listener.port, name);
+    print(`Opening ${url}`);
+    if (!openBrowser(url)) print("Could not open a browser. Open the URL above yourself.");
+    print(`Waiting for authorization of "${name}"…`);
+    const { code } = await waitForCallback(listener.received);
+    const issued = await exchange(apiBaseUrl, code, attempt.verifier);
+    const path = saveToken(issued.token);
+    return {
+      text: `Signed in${issued.email === null ? "" : ` as ${issued.email}`}.
+Token "${issued.name}" saved to ${path}`,
+      json: { email: issued.email, name: issued.name, configPath: path, apiBaseUrl },
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  } finally {
+    listener.close();
+  }
+}
+async function loginWithDevice(print = console.error, sleep = (ms) => new Promise((done) => setTimeout(done, ms))) {
+  const apiBaseUrl = resolveApiBaseUrl();
+  const name = clientName();
+  let request2;
+  try {
+    request2 = await startDevice(apiBaseUrl, name);
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+  print(`Open ${request2.verificationUri} and enter this code:`);
+  print("");
+  print(`    ${request2.userCode}`);
+  print("");
+  print(`Or open the link with the code already in it: ${request2.verificationUriComplete}`);
+  print(`Waiting for approval of "${name}"…`);
+  let waitMs = Math.max(1, request2.intervalSeconds) * 1e3;
+  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    await sleep(waitMs);
+    const poll = await pollDevice(apiBaseUrl, request2.deviceCode);
+    if (poll.state === "granted") {
+      const path = saveToken(poll.token.token);
+      return {
+        text: `Signed in${poll.token.email === null ? "" : ` as ${poll.token.email}`}.
+Token "${poll.token.name}" saved to ${path}`,
+        json: { email: poll.token.email, name: poll.token.name, configPath: path, apiBaseUrl },
+        code: 0
+      };
+    }
+    if (poll.state === "dead") return failure(poll.message);
+    if (poll.state === "slow_down") waitMs = Math.min(waitMs * 2, MAX_POLL_MS);
+  }
+  return failure("Timed out waiting for approval. Nothing has been changed.");
+}
+const DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
+const MAX_POLL_MS = 30 * 1e3;
+function logout() {
+  const removed = clearToken();
+  const fromEnvironment = process.env[TOKEN_VARIABLE]?.trim();
+  const lines = [
+    removed ? `Removed the token stored in ${configPath()}.` : "There was no stored token to remove."
+  ];
+  if (fromEnvironment) {
+    lines.push(
+      `${TOKEN_VARIABLE} is still set in this environment, so commands will keep using it. Unset it to sign out fully.`
+    );
+  }
+  return {
+    text: lines.join("\n"),
+    json: { removed, environmentTokenStillSet: Boolean(fromEnvironment) },
+    code: 0
+  };
+}
 async function whoami() {
   const found = credentialsOr();
   if ("result" in found) return found.result;
@@ -614,8 +989,11 @@ async function list() {
 async function deployCommand(directory, site) {
   const found = credentialsOr();
   if ("result" in found) return found.result;
+  const project = readProject();
+  const target = site ?? project?.siteId;
+  const folder = directory ?? project?.dir ?? ".";
   try {
-    const result = await publishDirectory(found.credentials, resolve(directory), site);
+    const result = await publishDirectory(found.credentials, resolve(folder), target);
     const what = result.unchanged ? "Already up to date — nothing needed publishing." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
     return {
       text: `${what}
@@ -623,10 +1001,133 @@ ${result.url}`,
       json: result,
       code: 0
     };
+  } catch (error) {
+    return failureFrom(error);
+  }
+}
+async function init(directory, site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  if (readProject() !== null) {
+    return failure(
+      `This folder already has a ${PROJECT_FILE}. Edit it, or delete it and run \`init\` again.`
+    );
+  }
+  try {
+    const target = site === void 0 ? await createSite(found.credentials) : await findSite(found.credentials, site);
+    const project = {
+      siteId: target.siteId,
+      subdomain: target.subdomain,
+      dir: directory
+    };
+    const path = writeProject(project);
+    return {
+      text: `Wrote ${path}
+${target.url}
+\`drop2run deploy\` now publishes ${directory} to this site.`,
+      json: { ...project, url: target.url, configPath: path },
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function remove(site, confirmed) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const named = site ?? readProject()?.siteId;
+  if (named === void 0) {
+    return failure(
+      `Name the site to delete: \`drop2run rm <subdomain>\`, or run this in a folder with a ${PROJECT_FILE}.`
+    );
+  }
+  try {
+    const target = await findSite(found.credentials, named);
+    if (!confirmed) {
+      return failure(
+        `This would delete ${target.subdomain} and every version published to it, with no way back.
+Run \`drop2run rm ${target.subdomain} --yes\` if that is what you want.`
+      );
+    }
+    await deleteSite(found.credentials, target.siteId);
+    return {
+      text: `Deleted ${target.subdomain}.`,
+      json: { siteId: target.siteId, subdomain: target.subdomain, deleted: true },
+      code: 0
+    };
   } catch (error) {
     return failure(error instanceof Error ? error.message : String(error));
   }
 }
+async function rollback(deployId, site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  if (deployId === void 0) {
+    return failure("Name the version to roll back to: `drop2run rollback <deployId>`.");
+  }
+  const named = site ?? readProject()?.siteId;
+  if (named === void 0) {
+    return failure(
+      `Name the site: \`drop2run rollback <deployId> --site <subdomain>\`, or run this in a folder with a ${PROJECT_FILE}.`
+    );
+  }
+  try {
+    const target = await findSite(found.credentials, named);
+    const promoted = await promoteDeploy(found.credentials, target.siteId, deployId);
+    return {
+      text: `${target.subdomain} is back on ${promoted.deployId}.
+${promoted.url}`,
+      json: promoted,
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function open(site, launch = openBrowser) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const named = site ?? readProject()?.siteId;
+  if (named === void 0) {
+    return failure(
+      `Name the site: \`drop2run open <subdomain>\`, or run this in a folder with a ${PROJECT_FILE}.`
+    );
+  }
+  try {
+    const target = await findSite(found.credentials, named);
+    const opened = launch(target.url);
+    return {
+      text: opened ? target.url : `${target.url}
+(Could not open a browser — open it yourself.)`,
+      json: { url: target.url, siteId: target.siteId, subdomain: target.subdomain, opened },
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function tokens() {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  try {
+    const list2 = await listTokens(found.credentials);
+    if (list2.length === 0) {
+      return { text: "No access tokens.", json: { tokens: [] }, code: 0 };
+    }
+    const text = list2.map((token) => {
+      const state = token.revokedAt !== null ? "revoked" : token.expiresAt !== null && new Date(token.expiresAt).getTime() <= Date.now() ? "expired" : "active";
+      const used = token.lastUsedAt === null ? "never used" : `last used ${day(token.lastUsedAt)}`;
+      return `${token.prefix}…	${token.name}	${state}	${used}`;
+    }).join("\n");
+    return { text, json: { tokens: list2 }, code: 0 };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+function day(iso) {
+  const parsed = new Date(iso);
+  return Number.isNaN(parsed.getTime()) ? iso : parsed.toISOString().slice(0, 10);
+}
 function where() {
   const fromEnvironment = process.env[TOKEN_VARIABLE]?.trim();
   const credentials = loadCredentials();
@@ -647,18 +1148,35 @@ function where() {
 }
 const HELP = `drop2run — publish a static site from the command line
 
-  drop2run deploy [dir] [--site <subdomain>]   Publish a folder (default: .)
+  drop2run login [--device]                    Sign in and store a token
+  drop2run logout                              Remove the stored token
+  drop2run init [dir] [--site <subdomain>]     Tie this folder to a site (writes drop2run.json)
+  drop2run deploy [dir] [--site <subdomain>]   Publish a folder (default: . or drop2run.json)
   drop2run ls                                  List your sites
+  drop2run open [site]                         Open a site in a browser
+  drop2run rollback <deployId> [--site X]      Put an earlier version back live
+  drop2run rm <site> --yes                     Delete a site and everything on it
+  drop2run token list                          List your access tokens
   drop2run whoami                              Check the token and whose it is
   drop2run where                               Show which token source is in use
   drop2run --version                           Print the version
 
 Flags
   --json      Print machine-readable output instead of text
-  --site X    Publish over an existing site rather than creating one
+  --site X    Act on an existing site rather than the one in drop2run.json
+  --device    Sign in by approving a code on another machine
+  --yes       Confirm a deletion, which cannot be undone
+
+Where a site comes from
+  --site, then drop2run.json, then a new one. \`init\` writes that file, so
+  \`deploy\` in the same folder needs no arguments at all.
 
 Signing in
-  There is no \`drop2run login\` yet. Create a token at
+  \`login\` opens a browser and listens on 127.0.0.1, so it needs both on this
+  machine. Over SSH, in a container or under WSL, use \`login --device\`: it
+  prints a short code to enter at https://dropto.run/device from anywhere.
+
+  For CI, neither flow applies — create a token at
   https://dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
   environment or put it in ~/.config/drop2run/config.json as {"token": "d2r_..."}.
 `;
@@ -673,7 +1191,7 @@ async function run(argv) {
   const positional = argv.filter((argument) => !argument.startsWith("-"));
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-VuVin5yv.js").then(
+    const { version } = await import("./package-BGfKrpb3.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };
@@ -682,16 +1200,45 @@ async function run(argv) {
   if (askedForHelp) return { text: HELP, json: { help: HELP }, code: 0 };
   if (command === void 0) return { text: HELP, json: { help: HELP }, code: 1 };
   const site = flagValue(argv, "--site");
-  const result = await dispatch(command, rest, site);
+  const result = await dispatch(
+    command,
+    rest,
+    site,
+    json,
+    argv.includes("--device"),
+    argv.includes("--yes")
+  );
   return json ? { ...result, text: JSON.stringify(result.json, null, 2) } : result;
 }
-async function dispatch(command, rest, site) {
+async function dispatch(command, rest, site, json, device, confirmed) {
   switch (command) {
+    case "login": {
+      const print = json ? () => {
+      } : (line) => console.error(line);
+      return device ? await loginWithDevice(print) : await login(print);
+    }
+    case "logout":
+      return logout();
+    case "init":
+      return await init(rest[0] ?? ".", site);
     case "deploy":
-      return await deployCommand(rest[0] ?? ".", site);
+      return await deployCommand(rest[0], site);
     case "ls":
     case "list":
       return await list();
+    case "open":
+      return await open(rest[0] ?? site);
+    case "rollback":
+      return await rollback(rest[0], site);
+    case "rm":
+      return await remove(rest[0] ?? site, confirmed);
+    case "token":
+    case "tokens":
+      return rest[0] === void 0 || rest[0] === "list" ? await tokens() : {
+        text: `\`token ${rest[0]}\` does not exist. Only \`token list\` does: creating and revoking a token need a browser session, at https://dropto.run/account/tokens.`,
+        json: { error: `Unknown token subcommand "${rest[0]}".` },
+        code: 1
+      };
     case "whoami":
       return await whoami();
     case "where":

package/dist/{package-VuVin5yv.js → package-BGfKrpb3.js}

@@ -1,5 +1,5 @@
 const name = "drop2run";
-const version = "0.0.0";
+const version = "0.1.1";
 const description = "Publish a static site to Drop2Run from the command line.";
 const license = "MIT";
 const type = "module";
@@ -9,7 +9,7 @@ const engines = { "node": ">=20" };
 const publishConfig = { "access": "public" };
 const homepage = "https://dropto.run";
 const keywords = ["static-site", "deploy", "hosting", "cli"];
-const scripts = { "build": "vite build", "typecheck": "tsc --noEmit", "test": "vitest run", "lint": "biome check .", "format": "biome check --write ." };
+const scripts = { "prepublishOnly": "npm run build && npm test", "build": "vite build", "typecheck": "tsc --noEmit", "test": "vitest run", "lint": "biome check .", "format": "biome check --write ." };
 const devDependencies = { "@biomejs/biome": "^2.5.11", "@types/node": "^26.4.0", "typescript": "^5.9.3", "vite": "^7.2.1", "vitest": "^4.1.11" };
 const _package = {
   name,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "drop2run",
-	"version": "0.0.0",
+	"version": "0.1.1",
 	"description": "Publish a static site to Drop2Run from the command line.",
 	"license": "MIT",
 	"type": "module",
@@ -25,6 +25,7 @@
 		"cli"
 	],
 	"scripts": {
+		"prepublishOnly": "npm run build && npm test",
 		"build": "vite build",
 		"typecheck": "tsc --noEmit",
 		"test": "vitest run",