drop2run 0.10.0 → 1.0.0

package/dist/index.js

@@ -1,17 +1,21 @@
 import { join, dirname, relative, sep, resolve } from "node:path";
 import { readFileSync, writeFileSync, chmodSync, renameSync, mkdirSync } from "node:fs";
 import { homedir, hostname } from "node:os";
+import { realpath, readdir, stat, readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { randomBytes, createHash } from "node:crypto";
 import { createServer } from "node:http";
-import { realpath, readdir, stat, readFile } from "node:fs/promises";
+const DEFAULT_API_BASE_URL = "https://dropto.run/api";
+const PRODUCTION_SITE_ORIGIN = "https://dropto.run";
+const PRODUCTION_DASHBOARD_ORIGIN = "https://app.dropto.run";
+function dashboardUrlFor(apiBaseUrl) {
+  const origin = apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+  return origin === PRODUCTION_SITE_ORIGIN ? PRODUCTION_DASHBOARD_ORIGIN : origin;
+}
 const TOKEN_VARIABLE = "DROP2RUN_TOKEN";
 function configPath() {
   return join(homedir(), ".config", "drop2run", "config.json");
 }
-const DEFAULT_API_BASE_URL = "https://dropto.run/api";
-const PRODUCTION_SITE_ORIGIN = "https://dropto.run";
-const PRODUCTION_DASHBOARD_ORIGIN = "https://app.dropto.run";
 function loadCredentials(env = process.env, read = (path) => readFileSync(path, "utf8")) {
   let stored = {};
   try {
@@ -34,10 +38,6 @@ function resolveApiBaseUrl(env = process.env, read = (path) => readFileSync(path
   const url = env.DROP2RUN_API_URL?.trim() || stored.apiBaseUrl?.trim() || DEFAULT_API_BASE_URL;
   return url.replace(/\/+$/, "");
 }
-function dashboardUrlFor(apiBaseUrl) {
-  const origin = apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
-  return origin === PRODUCTION_SITE_ORIGIN ? PRODUCTION_DASHBOARD_ORIGIN : origin;
-}
 function saveToken(token, path = configPath()) {
   let existing = {};
   try {
@@ -100,705 +100,233 @@ function missingCredentialsMessage(surface = "cli") {
     "The token is shown once when it is created and cannot be recovered afterwards."
   ].join("\n");
 }
-async function call(credentials, path, init2 = {}) {
-  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
-    ...init2,
-    headers: {
-      ...init2.headers,
-      Authorization: `Bearer ${credentials.token}`,
-      ...init2.body === void 0 ? {} : { "Content-Type": "application/json" }
-    }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+function sizeOf(content) {
+  if (ArrayBuffer.isView(content)) return content.byteLength;
+  if (isArrayBuffer(content)) return content.byteLength;
+  if (typeof content.size === "number") return content.size;
+  throw new TypeError("File contents must be a Uint8Array, an ArrayBuffer or a Blob.");
+}
+function isArrayBuffer(value) {
+  return Object.prototype.toString.call(value) === "[object ArrayBuffer]";
+}
+async function bytesOf(content) {
+  if (ArrayBuffer.isView(content)) return content;
+  if (isArrayBuffer(content)) return new Uint8Array(content);
+  return new Uint8Array(await content.arrayBuffer());
+}
+class DeployError extends Error {
+  /**
+   * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
+   *   the client-side codes in {@link ClientErrorCode}.
+   * @param message Text safe to show the user.
+   * @param detail Anything extra worth logging, such as the RFC 9457 body from the API.
+   */
+  constructor(code, message, detail) {
+    super(message);
+    this.code = code;
+    this.detail = detail;
+    this.name = "DeployError";
   }
-  return await response.json();
 }
-async function findSite(credentials, site) {
-  const found = await lookUpSite(credentials, site);
-  if (found === void 0) {
-    throw new Error(
-      `No site of yours is called "${site}". \`drop2run ls\` or the list_sites tool shows what exists.`
-    );
+const ClientErrorCode = {
+  /** The drop held no files once junk was filtered out. */
+  Empty: "empty_drop",
+  /** No `index.html` at the root of the drop. */
+  MissingIndex: "missing_index",
+  /** The drop is larger than the plan allows; the server enforces this too. */
+  TooLarge: "too_large",
+  /** A single file is larger than the plan allows. */
+  FileTooLarge: "file_too_large",
+  /** More files than the plan allows. */
+  TooManyFiles: "too_many_files",
+  /**
+   * A zip claims to expand to more than the plan allows.
+   *
+   * Distinct from {@link TooLarge}, which is about a drop whose files have already been read. This one
+   * is raised from the archive's own directory before anything is decompressed, so the numbers in it
+   * are what the zip declared rather than what was measured.
+   */
+  ZipTooLarge: "zip_too_large",
+  /** The user cancelled. */
+  Cancelled: "cancelled",
+  /** An upload kept failing after every retry. */
+  UploadFailed: "upload_failed",
+  /**
+   * The browser could not hold what was dropped in memory. Raised when allocating the buffer for a
+   * large zip or file fails, which a browser reports as a `RangeError` rather than as anything that
+   * names memory.
+   */
+  OutOfMemory: "out_of_memory",
+  /**
+   * A dropped file could not be read when it came to be hashed. Files from a folder stay on disk until
+   * then, so one moved, deleted or changed after the drop fails here rather than at the drop.
+   */
+  ReadFailed: "read_failed",
+  /**
+   * A control-plane call got no answer: the connection failed before a response arrived, or the
+   * request timeout passed. Distinct from an HTTP error, which is an answer — this one says nothing
+   * about whether the server acted, which is why only an idempotent call may retry on it.
+   */
+  NetworkFailed: "network_failed"
+};
+function describeError(error) {
+  const parts = [];
+  let current = error;
+  for (let depth = 0; depth < 5 && current !== void 0 && current !== null; depth++) {
+    if (current instanceof Error) {
+      const code = current.code;
+      parts.push(typeof code === "string" ? `${current.message} (${code})` : current.message);
+      current = current.cause;
+    } else {
+      parts.push(String(current));
+      break;
+    }
   }
-  return found;
+  return parts.join(" ← ");
 }
-const SITE_ID_SHAPE = /^[0-9a-z]{26}$/i;
-async function lookUpSite(credentials, site) {
-  const wanted = site.trim().toLowerCase();
-  if (wanted === "") return void 0;
-  const { sites } = await call(
-    credentials,
-    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(wanted)}`
-  );
-  const bySubdomain = sites.find((candidate) => candidate.subdomain.toLowerCase() === wanted);
-  if (bySubdomain !== void 0) return bySubdomain;
-  if (!SITE_ID_SHAPE.test(wanted)) return void 0;
-  const response = await fetch(
-    `${credentials.apiBaseUrl}/sites/${encodeURIComponent(wanted.toUpperCase())}`,
-    { headers: { Authorization: `Bearer ${credentials.token}` } }
+const ACCOUNT_HEADER = "X-Drop2Run-Account";
+const CLAIM_TOKEN_HEADER = "X-Claim-Token";
+const DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+const COMPLETE_RETRY_DELAYS_MS = [1e3, 4e3];
+async function prepareDeploy(siteId, files, options, signal) {
+  const manifest = files.map((file) => ({
+    path: file.path,
+    sha256: file.sha256,
+    size: sizeOf(file.bytes)
+  }));
+  const prepared = await request(
+    `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
+    // `batches` asks for batch permits; an API that predates them ignores the field, and one that
+    // knows them answers with single permits until they are switched on.
+    { files: manifest, batches: true },
+    options,
+    signal
   );
-  if (response.status === 404) return void 0;
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-  const detail = await response.json();
-  return { siteId: detail.siteId, subdomain: detail.subdomain, url: detail.url, name: detail.name };
+  return { ...prepared, uploadUrl: absolute(prepared.uploadUrl, options.baseUrl) };
 }
-async function deleteSite(credentials, siteId) {
-  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
-    method: "DELETE",
-    headers: { Authorization: `Bearer ${credentials.token}` }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+function absolute(uploadUrl, baseUrl) {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(uploadUrl)) return uploadUrl;
+  if (baseUrl === void 0 || !/^[a-z][a-z0-9+.-]*:/i.test(baseUrl)) return uploadUrl;
+  return new URL(uploadUrl, baseUrl).toString();
+}
+async function completeDeploy(siteId, deployId, options, signal, name) {
+  const path = `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`;
+  const body = name === null || name === void 0 ? void 0 : { name };
+  const delay = options.delay ?? wait;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await request(path, body, options, signal);
+    } catch (error) {
+      const unanswered = error instanceof DeployError && error.code === ClientErrorCode.NetworkFailed;
+      if (!unanswered || attempt >= COMPLETE_RETRY_DELAYS_MS.length || signal?.aborted) throw error;
+      await delay(COMPLETE_RETRY_DELAYS_MS[attempt] ?? 1e3);
+    }
   }
 }
-async function promoteDeploy(credentials, siteId, deployId) {
-  return await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
-    { method: "POST" }
-  );
+function wait(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
-function enumName(value) {
-  return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+async function request(path, body, options, signal) {
+  const doFetch = options.fetch ?? globalFetch$1();
+  const base = options.baseUrl ?? "/api";
+  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const headers = { ...options.headers };
+  if (body !== void 0) headers["Content-Type"] = "application/json";
+  if (options.claimToken) headers[CLAIM_TOKEN_HEADER] = options.claimToken;
+  if (options.token) headers.Authorization = `Bearer ${options.token}`;
+  if (options.accountId) headers[ACCOUNT_HEADER] = options.accountId;
+  const controller = new AbortController();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  try {
+    const response = await doFetch(`${base}/${path}`, {
+      method: "POST",
+      headers,
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      signal: controller.signal
+    });
+    if (!response.ok) throw await problemToError(response);
+    return await response.json();
+  } catch (error) {
+    if (error instanceof DeployError || signal?.aborted) throw error;
+    if (timedOut) {
+      throw new DeployError(
+        ClientErrorCode.NetworkFailed,
+        `The server did not answer within ${Math.round(timeoutMs / 1e3)} seconds.`,
+        { path, cause: describeError(error) }
+      );
+    }
+    if (error instanceof TypeError) {
+      throw new DeployError(ClientErrorCode.NetworkFailed, "Could not reach the server.", {
+        path,
+        cause: describeError(error)
+      });
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
 }
-function actionOf(expiresAt, action) {
-  return expiresAt === null ? null : enumName(action);
+function globalFetch$1() {
+  return globalThis.fetch.bind(globalThis);
 }
-async function readInvitedOnly(credentials, siteId) {
+async function problemToError(response) {
+  let problem = {};
   try {
-    const page = await call(
-      credentials,
-      `sites/${encodeURIComponent(siteId)}/viewers?pageSize=1`
+    problem = await response.json();
+  } catch {
+    return new DeployError(
+      `http_${response.status}`,
+      `The server responded with ${response.status}.`
     );
-    return typeof page.invitedOnly === "boolean" ? page.invitedOnly : null;
+  }
+  const code = typeof problem.type === "string" ? problem.type : `http_${response.status}`;
+  const message = typeof problem.detail === "string" ? problem.detail : typeof problem.title === "string" ? problem.title : `The server responded with ${response.status}.`;
+  return new DeployError(code, message, problem);
+}
+function batchLayout(members) {
+  return members.map((member) => `${member.sha256} ${member.size}
+`).join("");
+}
+function isBatch(target) {
+  return "files" in target;
+}
+function parseBatchResult(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed === null || typeof parsed !== "object") return null;
+    const { stored, present, failed } = parsed;
+    if (typeof stored !== "number" || typeof present !== "number" || !Array.isArray(failed))
+      return null;
+    return { stored, present, failed };
   } catch {
     return null;
   }
 }
-async function folderFromListing(credentials, siteId, subdomain) {
-  const { sites } = await call(
-    credentials,
-    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(subdomain)}`
-  );
-  return sites.find((candidate) => candidate.siteId === siteId)?.folderId ?? null;
-}
-async function getSite(credentials, siteId) {
-  const [site, invitedOnly] = await Promise.all([
-    call(credentials, `sites/${encodeURIComponent(siteId)}`),
-    readInvitedOnly(credentials, siteId)
-  ]);
-  const folderId = site.folderId !== void 0 ? site.folderId : await folderFromListing(credentials, site.siteId, site.subdomain);
-  return {
-    siteId: site.siteId,
-    subdomain: site.subdomain,
-    url: site.url,
-    name: site.name,
-    status: enumName(site.status),
-    invitedOnly,
-    liveDeployId: site.liveDeployId,
-    spaMode: site.spaMode,
-    docsMode: site.docsMode,
-    modeIsManual: site.modeIsManual,
-    passwordProtected: site.passwordProtected,
-    passwordProtectionAvailable: site.passwordProtectionAvailable,
-    formsEnabled: site.formsEnabled,
-    formsAvailable: site.formsAvailable,
-    expiresAt: site.expiresAt,
-    expiryAction: actionOf(site.expiresAt, site.expiryAction ?? ""),
-    scheduledExpiryAvailable: site.scheduledExpiryAvailable,
-    comments: audienceOf(site.commentAudience),
-    commentsAvailable: site.feedbackAvailable === true,
-    folderId,
-    deploys: site.deploys.map((deploy2) => ({
-      deployId: deploy2.deployId,
-      status: deploy2.status,
-      fileCount: deploy2.fileCount,
-      totalBytes: deploy2.totalBytes,
-      createdAt: deploy2.createdAt,
-      completedAt: deploy2.completedAt,
-      filesKept: deploy2.filesKept
-    }))
-  };
-}
-async function updateSiteSettings(credentials, siteId, change) {
-  const body = {};
-  if (change.name !== void 0) body.name = change.name;
-  if (change.mode !== void 0) {
-    body.spaMode = change.mode === "spa";
-    body.docsMode = change.mode === "docs";
-  }
-  if (change.password !== void 0) body.password = change.password;
-  if (change.expiresAt !== void 0) body.expiresAt = change.expiresAt;
-  if (change.expiryAction !== void 0) body.expiryAction = change.expiryAction;
-  if (change.formsEnabled !== void 0) body.formsEnabled = change.formsEnabled;
-  if (change.folderId !== void 0) body.folderId = change.folderId;
-  if (change.invitedOnly !== void 0) body.invitedOnly = change.invitedOnly;
-  if (change.comments !== void 0) body.commentAudience = API_AUDIENCE[change.comments];
-  if (Object.keys(body).length === 0) throw new Error("Nothing to change — name a setting.");
-  const wasInvitedOnly = change.password !== void 0 && change.password !== "" ? await readInvitedOnly(credentials, siteId) : null;
-  const { commentAudience, ...settings } = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
-    method: "PATCH",
-    body: JSON.stringify(body)
-  });
-  const invitedOnly = typeof settings.invitedOnly === "boolean" ? settings.invitedOnly : null;
-  return {
-    ...settings,
-    expiryAction: actionOf(settings.expiresAt, settings.expiryAction ?? ""),
-    invitedOnly,
-    comments: audienceOf(commentAudience),
-    replacedInviteOnly: wasInvitedOnly === true && invitedOnly === false
-  };
-}
-const API_AUDIENCE = {
-  off: "Off",
-  invited: "Invited",
-  anyone: "Anyone"
-};
-function audienceOf(value) {
-  const lower = value?.toLowerCase();
-  return lower === "off" || lower === "invited" || lower === "anyone" ? lower : null;
-}
-async function setSitePaused(credentials, siteId, action) {
-  const state = await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/${action}`,
-    { method: "POST" }
-  );
-  return {
-    siteId: state.siteId,
-    subdomain: state.subdomain,
-    status: enumName(state.status),
-    ownerPaused: state.ownerPaused
-  };
-}
-async function listTokens(credentials) {
-  const body = await call(credentials, "tokens");
-  return body.tokens;
-}
-const SITES_PER_REQUEST = 100;
-async function listSites(credentials) {
-  const body = await call(
-    credentials,
-    `sites?pageSize=${SITES_PER_REQUEST}`
-  );
-  return { sites: body.sites, total: body.total };
-}
-async function createSite(credentials, subdomain, folderId) {
-  const created = await call(
-    credentials,
-    "sites",
-    {
-      method: "POST",
-      // Absent fields rather than null ones, because the API reads null, empty and missing the same
-      // way and a body carrying only what was asked for is the one that reads correctly in a log.
-      body: JSON.stringify({
-        ...subdomain === void 0 ? {} : { subdomain },
-        ...folderId === void 0 ? {} : { folderId }
-      })
-    }
-  );
-  return { ...created, name: null };
-}
-async function listFolders(credentials) {
-  const body = await call(credentials, "site-folders");
-  const byId = new Map(body.folders.map((folder) => [folder.folderId, folder]));
-  const pathOf = (folderId) => {
-    const names = [];
-    let cursor = byId.get(folderId);
-    while (cursor !== void 0 && names.length <= byId.size) {
-      names.unshift(cursor.name);
-      cursor = cursor.parentId === null ? void 0 : byId.get(cursor.parentId);
-    }
-    return names.join("/");
-  };
-  return body.folders.map((folder) => ({ folderId: folder.folderId, path: pathOf(folder.folderId) })).sort((a, b) => a.path.localeCompare(b.path));
-}
-function comparablePath(path) {
-  return path.split("/").map((name) => name.trim()).filter((name) => name !== "").join("/").toLowerCase();
-}
-const FOLDERS_LISTED_ON_MISS = 20;
-async function resolveFolder(credentials, folder) {
-  const wanted = comparablePath(folder);
-  if (wanted === "") {
-    throw new Error(
-      `"${folder}" does not name a folder. Leave the folder out to put the site at the top level.`
-    );
-  }
-  const folders2 = await listFolders(credentials);
-  const byId = folders2.find((candidate) => candidate.folderId.toLowerCase() === wanted);
-  if (byId !== void 0) return byId.folderId;
-  const matches = folders2.filter((candidate) => comparablePath(candidate.path) === wanted);
-  if (matches.length === 1 && matches[0] !== void 0) return matches[0].folderId;
-  if (matches.length > 1) {
-    throw new Error(
-      `More than one folder is at "${folder}", because a folder name can contain "/". Name it by id instead: ${matches.map((match) => match.folderId).join(", ")}.`
-    );
-  }
-  if (folders2.length === 0) {
-    throw new Error(
-      `No folder of yours is called "${folder}" — this account has no folders yet. Make one in the dashboard at ${dashboardUrlFor(credentials.apiBaseUrl)}, or leave the folder out.`
-    );
-  }
-  const listed = folders2.slice(0, FOLDERS_LISTED_ON_MISS).map((candidate) => candidate.path);
-  const more = folders2.length - listed.length;
-  throw new Error(
-    `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
-  );
-}
-const ROOT_FOLDER = "root";
-async function resolveFolderTarget(credentials, folder) {
-  return folder.trim().toLowerCase() === ROOT_FOLDER ? ROOT_FOLDER : await resolveFolder(credentials, folder);
-}
-async function listComments(credentials, siteId, query = {}) {
-  const search = new URLSearchParams();
-  if (query.status !== void 0) search.set("status", query.status);
-  if (query.path !== void 0) search.set("path", query.path);
-  if (query.since !== void 0) search.set("since", String(query.since));
-  if (query.page !== void 0) search.set("page", String(query.page));
-  const encoded = search.toString();
-  const suffix = encoded === "" ? "" : `?${encoded}`;
-  return await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/feedback/threads${suffix}`
-  );
-}
-async function replyToComment(credentials, siteId, threadId, body, resolve2 = false) {
-  return await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/comments`,
-    { method: "POST", body: JSON.stringify({ body, resolve: resolve2 }) }
-  );
-}
-async function setCommentResolved(credentials, siteId, threadId, resolved) {
-  return await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/${resolved ? "resolve" : "reopen"}`,
-    { method: "POST" }
-  );
-}
-const PEOPLE_PER_REQUEST = 50;
-async function listPeople(credentials, siteId) {
-  const page = await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers?pageSize=${PEOPLE_PER_REQUEST}`);
-  return {
-    invitedOnly: page.invitedOnly,
-    total: page.total,
-    limit: page.limit,
-    people: page.viewers.map((row) => ({
-      email: row.email,
-      role: enumName(row.role),
-      owner: row.owner,
-      status: enumName(row.status)
-    }))
-  };
-}
-async function invitePeople(credentials, siteId, emails, role) {
-  return await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers`, {
-    method: "POST",
-    body: JSON.stringify({ emails, role: role === "comment" ? "Comment" : "View", notify: true })
-  });
-}
-async function removePerson(credentials, siteId, email) {
-  await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/viewers?email=${encodeURIComponent(email)}`,
-    { method: "DELETE" }
-  );
-}
-const VERSIONS_LISTED = 10;
-function servingModeOf$1(site) {
-  if (site.spaMode) return "spa";
-  if (site.docsMode) return "docs";
-  return "static";
-}
-function accessOf(site) {
-  if (site.passwordProtected) return "password";
-  if (site.invitedOnly === true) return "invite-only";
-  if (site.invitedOnly === false) return "public";
-  return "no password (whether it is invite-only could not be read)";
-}
-function describeSite(site, folderPath) {
-  const unavailable = (available) => available ? "" : " (not on this plan)";
-  const versions = site.deploys.slice(0, VERSIONS_LISTED).map((deploy2) => {
-    const live = deploy2.deployId === site.liveDeployId ? " ← served" : "";
-    const kept = deploy2.filesKept ? "" : ", files collected — cannot be rolled back to";
-    return `  ${deploy2.deployId}  ${deploy2.createdAt}  ${deploy2.status}, ${deploy2.fileCount} files${kept}${live}`;
-  });
-  const more = site.deploys.length - versions.length;
-  return [
-    `${site.subdomain} — ${site.url}`,
-    `  name      ${site.name ?? "(none)"}`,
-    `  status    ${site.status}`,
-    `  access    ${accessOf(site)}`,
-    `  mode      ${servingModeOf$1(site)}${site.modeIsManual ? "" : " (detected on each publish)"}`,
-    `  password  ${site.passwordProtected ? "on" : "off"}${unavailable(site.passwordProtectionAvailable)}`,
-    `  forms     ${site.formsEnabled ? "on" : "off"}${unavailable(site.formsAvailable)}`,
-    `  comments  ${site.comments ?? "unknown"}${unavailable(site.commentsAvailable)}`,
-    `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
-    `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
-    "",
-    site.deploys.length === 0 ? "No versions yet." : "Versions, newest first:",
-    ...versions,
-    ...more > 0 ? [`  … and ${more} older`] : []
-  ].join("\n");
-}
-const TIMEOUT_MS = 5 * 60 * 1e3;
-function newAttempt() {
-  const verifier = randomBytes(32).toString("base64url");
-  return {
-    verifier,
-    challenge: createHash("sha256").update(verifier).digest("base64url"),
-    state: randomBytes(16).toString("base64url")
-  };
-}
-function clientName(surface) {
-  const clean2 = (value) => value.trim().replace(/[^A-Za-z0-9._-]/g, "-");
-  const label = "";
-  const raw = clean2(hostname()).slice(0, 64 - label.length);
-  return `${raw === "" ? "drop2run" : raw}${label}`;
-}
-function openBrowser(url) {
-  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  try {
-    const child = spawn(command, [...args], { stdio: "ignore", detached: true });
-    child.unref();
-    child.on("error", () => {
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function listen(state) {
-  return new Promise((resolveListener, rejectListener) => {
-    let settle = null;
-    let fail = null;
-    const received = new Promise((resolveCode, rejectCode) => {
-      settle = resolveCode;
-      fail = rejectCode;
-    });
-    const server = createServer((request2, response) => {
-      const url = new URL(request2.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/cb") {
-        response.writeHead(404, { "Content-Type": "text/plain" });
-        response.end("Not found.\n");
-        return;
-      }
-      const code = url.searchParams.get("code") ?? "";
-      const returned = url.searchParams.get("state") ?? "";
-      if (returned !== state || code === "") {
-        respond(
-          response,
-          400,
-          "Sign-in could not be completed",
-          "This did not come from the sign-in that was started here. Nothing has been changed."
-        );
-        fail?.(new Error("The browser returned a response that did not match this sign-in."));
-        return;
-      }
-      respond(response, 200, "Signed in", "You can close this tab now.");
-      settle?.({ code });
-    });
-    server.on("error", (error) => {
-      rejectListener(error);
-      fail?.(error instanceof Error ? error : new Error(String(error)));
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (address === null) {
-        rejectListener(new Error("Could not open a local port to receive the sign-in."));
-        return;
-      }
-      resolveListener({
-        port: address.port,
-        received,
-        close: () => server.close()
-      });
-    });
-  });
-}
-function respond(response, status, title, detail) {
-  response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
-  response.end(
-    `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title} — drop2run</title><style>body{font:16px/1.6 system-ui,sans-serif;margin:20vh auto;max-width:28rem;padding:0 1.5rem;color:#12211f}h1{font-size:1.4rem;margin:0 0 .5rem}p{margin:0;color:#64706e}@media(prefers-color-scheme:dark){body{background:#0d1413;color:#e8efee}p{color:#9aa8a6}}</style></head><body><h1>${title}</h1><p>${detail}</p></body></html>
-`
-  );
-}
-async function waitForCallback(received, timeoutMs = TIMEOUT_MS) {
-  let timer;
-  try {
-    return await Promise.race([
-      received,
-      new Promise((_, reject) => {
-        timer = setTimeout(
-          () => reject(new Error("Timed out waiting for the browser. Nothing has been changed.")),
-          timeoutMs
-        );
-      })
-    ]);
-  } finally {
-    if (timer !== void 0) clearTimeout(timer);
-  }
-}
-function consentUrl(dashboardUrl, attempt, port, name) {
-  const url = new URL("/cli-auth", dashboardUrl);
-  url.searchParams.set("challenge", attempt.challenge);
-  url.searchParams.set("state", attempt.state);
-  url.searchParams.set("port", String(port));
-  url.searchParams.set("name", name);
-  return url.toString();
-}
-async function startDevice(apiBaseUrl, clientName2) {
-  const response = await fetch(`${apiBaseUrl}/auth/cli/device`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ clientName: clientName2 })
-  });
-  if (!response.ok) throw new Error(await problemDetail(response));
-  return await response.json();
-}
-async function pollDevice(apiBaseUrl, deviceCode) {
-  let response;
-  try {
-    response = await fetch(`${apiBaseUrl}/auth/cli/device/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ deviceCode })
-    });
-  } catch {
-    return { state: "pending" };
-  }
-  if (response.ok) {
-    const body = await response.json();
-    return { state: "granted", token: { token: body.token, name: body.name, email: body.email } };
-  }
-  const problem = await response.json().catch(() => null);
-  if (problem?.type === "authorization_pending") return { state: "pending" };
-  if (problem?.type === "slow_down") return { state: "slow_down" };
-  return {
-    state: "dead",
-    message: problem?.detail ?? `The API answered ${response.status}.`
-  };
-}
-async function problemDetail(response) {
-  const problem = await response.json().catch(() => null);
-  return problem?.detail ?? `The API answered ${response.status}.`;
-}
-async function exchange(apiBaseUrl, code, verifier) {
-  const response = await fetch(`${apiBaseUrl}/auth/cli/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ code, verifier })
-  });
-  if (!response.ok) throw new Error(await problemDetail(response));
-  const body = await response.json();
-  return { token: body.token, name: body.name, email: body.email };
-}
-const PROJECT_FILE = "drop2run.json";
-function projectPath(directory = process.cwd()) {
-  return join(directory, PROJECT_FILE);
-}
-function readProject(directory = process.cwd(), read = (path) => readFileSync(path, "utf8")) {
-  let parsed;
-  try {
-    parsed = JSON.parse(read(projectPath(directory)));
-  } catch {
-    return null;
-  }
-  if (typeof parsed.siteId !== "string" || parsed.siteId === "") return null;
-  return {
-    siteId: parsed.siteId,
-    subdomain: typeof parsed.subdomain === "string" ? parsed.subdomain : "",
-    dir: typeof parsed.dir === "string" && parsed.dir !== "" ? parsed.dir : "."
-  };
-}
-function writeProject(project, directory = process.cwd()) {
-  const path = projectPath(directory);
-  writeFileSync(path, `${JSON.stringify(project, null, "	")}
-`);
-  return path;
-}
-function sizeOf(content) {
-  return ArrayBuffer.isView(content) ? content.byteLength : content.size;
-}
-async function bytesOf(content) {
-  return ArrayBuffer.isView(content) ? content : new Uint8Array(await content.arrayBuffer());
-}
-class DeployError extends Error {
-  /**
-   * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
-   *   the client-side codes in {@link ClientErrorCode}.
-   * @param message Text safe to show the user.
-   * @param detail Anything extra worth logging, such as the RFC 9457 body from the API.
-   */
-  constructor(code, message, detail) {
-    super(message);
-    this.code = code;
-    this.detail = detail;
-    this.name = "DeployError";
-  }
-}
-const ClientErrorCode = {
-  /** The drop held no files once junk was filtered out. */
-  Empty: "empty_drop",
-  /** No `index.html` at the root of the drop. */
-  MissingIndex: "missing_index",
-  /** The drop is larger than the plan allows; the server enforces this too. */
-  TooLarge: "too_large",
-  /** A single file is larger than the plan allows. */
-  FileTooLarge: "file_too_large",
-  /** More files than the plan allows. */
-  TooManyFiles: "too_many_files",
-  /**
-   * A zip claims to expand to more than the plan allows.
-   *
-   * Distinct from {@link TooLarge}, which is about a drop whose files have already been read. This one
-   * is raised from the archive's own directory before anything is decompressed, so the numbers in it
-   * are what the zip declared rather than what was measured.
-   */
-  ZipTooLarge: "zip_too_large",
-  /** The user cancelled. */
-  Cancelled: "cancelled",
-  /** An upload kept failing after every retry. */
-  UploadFailed: "upload_failed",
-  /**
-   * The browser could not hold what was dropped in memory. Raised when allocating the buffer for a
-   * large zip or file fails, which a browser reports as a `RangeError` rather than as anything that
-   * names memory.
-   */
-  OutOfMemory: "out_of_memory",
-  /**
-   * A dropped file could not be read when it came to be hashed. Files from a folder stay on disk until
-   * then, so one moved, deleted or changed after the drop fails here rather than at the drop.
-   */
-  ReadFailed: "read_failed",
-  /**
-   * A control-plane call got no answer: the connection failed before a response arrived, or the
-   * request timeout passed. Distinct from an HTTP error, which is an answer — this one says nothing
-   * about whether the server acted, which is why only an idempotent call may retry on it.
-   */
-  NetworkFailed: "network_failed"
-};
-function describeError(error) {
-  const parts = [];
-  let current = error;
-  for (let depth = 0; depth < 5 && current !== void 0 && current !== null; depth++) {
-    if (current instanceof Error) {
-      const code = current.code;
-      parts.push(typeof code === "string" ? `${current.message} (${code})` : current.message);
-      current = current.cause;
-    } else {
-      parts.push(String(current));
-      break;
-    }
-  }
-  return parts.join(" ← ");
-}
-const ACCOUNT_HEADER = "X-Drop2Run-Account";
-const CLAIM_TOKEN_HEADER = "X-Claim-Token";
-const DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
-const COMPLETE_RETRY_DELAYS_MS = [1e3, 4e3];
-async function prepareDeploy(siteId, files, options, signal) {
-  const manifest = files.map((file) => ({
-    path: file.path,
-    sha256: file.sha256,
-    size: sizeOf(file.bytes)
-  }));
-  const prepared = await request(
-    `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
-    { files: manifest },
-    options,
-    signal
-  );
-  return { ...prepared, uploadUrl: absolute(prepared.uploadUrl, options.baseUrl) };
-}
-function absolute(uploadUrl, baseUrl) {
-  if (/^[a-z][a-z0-9+.-]*:/i.test(uploadUrl)) return uploadUrl;
-  if (baseUrl === void 0 || !/^[a-z][a-z0-9+.-]*:/i.test(baseUrl)) return uploadUrl;
-  return new URL(uploadUrl, baseUrl).toString();
-}
-async function completeDeploy(siteId, deployId, options, signal, name) {
-  const path = `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`;
-  const body = name === null || name === void 0 ? void 0 : { name };
-  const delay = options.delay ?? wait;
-  for (let attempt = 0; ; attempt++) {
-    try {
-      return await request(path, body, options, signal);
-    } catch (error) {
-      const unanswered = error instanceof DeployError && error.code === ClientErrorCode.NetworkFailed;
-      if (!unanswered || attempt >= COMPLETE_RETRY_DELAYS_MS.length || signal?.aborted) throw error;
-      await delay(COMPLETE_RETRY_DELAYS_MS[attempt] ?? 1e3);
-    }
-  }
-}
-function wait(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
-async function request(path, body, options, signal) {
-  const doFetch = options.fetch ?? globalFetch$1();
-  const base = options.baseUrl ?? "/api";
-  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-  const headers = {};
-  if (body !== void 0) headers["Content-Type"] = "application/json";
-  if (options.claimToken) headers[CLAIM_TOKEN_HEADER] = options.claimToken;
-  if (options.token) headers.Authorization = `Bearer ${options.token}`;
-  if (options.accountId) headers[ACCOUNT_HEADER] = options.accountId;
-  const controller = new AbortController();
-  let timedOut = false;
-  const timer = setTimeout(() => {
-    timedOut = true;
-    controller.abort();
-  }, timeoutMs);
-  try {
-    const response = await doFetch(`${base}/${path}`, {
-      method: "POST",
-      headers,
-      ...body === void 0 ? {} : { body: JSON.stringify(body) },
-      signal: controller.signal
-    });
-    if (!response.ok) throw await problemToError(response);
-    return await response.json();
-  } catch (error) {
-    if (error instanceof DeployError || signal?.aborted) throw error;
-    if (timedOut) {
-      throw new DeployError(
-        ClientErrorCode.NetworkFailed,
-        `The server did not answer within ${Math.round(timeoutMs / 1e3)} seconds.`,
-        { path, cause: describeError(error) }
-      );
-    }
-    if (error instanceof TypeError) {
-      throw new DeployError(ClientErrorCode.NetworkFailed, "Could not reach the server.", {
-        path,
-        cause: describeError(error)
-      });
-    }
-    throw error;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function globalFetch$1() {
-  return globalThis.fetch.bind(globalThis);
-}
-async function problemToError(response) {
-  let problem = {};
-  try {
-    problem = await response.json();
-  } catch {
-    return new DeployError(
-      `http_${response.status}`,
-      `The server responded with ${response.status}.`
-    );
-  }
-  const code = typeof problem.type === "string" ? problem.type : `http_${response.status}`;
-  const message = typeof problem.detail === "string" ? problem.detail : typeof problem.title === "string" ? problem.title : `The server responded with ${response.status}.`;
-  return new DeployError(code, message, problem);
+async function mapInOrder(items, limit, fn, signal) {
+  const results = new Array(items.length);
+  let next = 0;
+  let failure2 = null;
+  const lane = async () => {
+    for (; ; ) {
+      if (failure2 !== null) return;
+      const index = next++;
+      if (index >= items.length) return;
+      try {
+        results[index] = await fn(items[index], index);
+      } catch (error) {
+        failure2 ??= { error };
+        return;
+      }
+    }
+  };
+  const lanes = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, lane);
+  await Promise.all(lanes);
+  if (failure2 !== null) throw failure2.error;
+  return results;
 }
 const FILE_TYPES = [
   // Documents. The three extensions that make a folder a documents site.
@@ -873,7 +401,7 @@ const FILE_TYPES = [
   {
     ext: ".csv",
     mime: "text/csv; charset=utf-8",
-    kind: "text",
+    kind: "csv",
     document: false,
     reader: true,
     editable: true
@@ -1250,807 +778,1561 @@ const FILE_TYPES = [
     reader: false,
     editable: false
   }
-];
-function extensionsWhere(include) {
-  return FILE_TYPES.filter(include).map((type) => type.ext);
+];
+function extensionsWhere(include) {
+  return FILE_TYPES.filter(include).map((type) => type.ext);
+}
+const DOCUMENT_EXTENSIONS$1 = extensionsWhere((type) => type.document);
+const VIEWABLE_EXTENSIONS$1 = extensionsWhere(
+  (type) => type.kind !== "binary"
+);
+extensionsWhere((type) => type.reader);
+extensionsWhere((type) => type.editable);
+const WEB_ASSET_EXTENSIONS = [
+  ".html",
+  ".htm",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".css"
+];
+const GALLERY_EXTENSIONS = extensionsWhere(
+  (type) => type.kind === "image"
+);
+Object.fromEntries(
+  FILE_TYPES.filter((type) => type.mime !== null).map((type) => [type.ext, type.mime])
+);
+function extensionOf(path) {
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  return dot <= 0 ? "" : name.slice(dot).toLowerCase();
+}
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+const HASH_CONCURRENCY = 4;
+const HASH_BYTES_IN_FLIGHT = 16 * 1024 * 1024;
+async function hashAll(files, onProgress, signal) {
+  const budget = byteBudget(HASH_BYTES_IN_FLIGHT);
+  let done = 0;
+  return mapInOrder(
+    files,
+    HASH_CONCURRENCY,
+    async (file) => {
+      const size = sizeOf(file.bytes);
+      await budget.acquire(size);
+      try {
+        signal?.throwIfAborted();
+        const hashed = { ...file, sha256: await sha256Hex(await readForHash(file)) };
+        done += 1;
+        onProgress?.(done, files.length);
+        return hashed;
+      } finally {
+        budget.release(size);
+      }
+    }
+  );
+}
+function byteBudget(limit) {
+  let held = 0;
+  let waiting = [];
+  return {
+    async acquire(size) {
+      while (held > 0 && held + size > limit) {
+        await new Promise((resolve2) => waiting.push(resolve2));
+      }
+      held += size;
+    },
+    release(size) {
+      held -= size;
+      const woken = waiting;
+      waiting = [];
+      for (const wake of woken) wake();
+    }
+  };
+}
+async function readForHash(file) {
+  try {
+    return await bytesOf(file.bytes);
+  } catch (error) {
+    if (error instanceof RangeError) throw error;
+    throw new DeployError(
+      ClientErrorCode.ReadFailed,
+      `Could not read ${file.path}. It may have been moved, renamed or changed since you dropped it — drop the folder again.`,
+      { path: file.path, cause: describeError(error) }
+    );
+  }
+}
+const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
+const IGNORED_DIRECTORIES = [
+  "__MACOSX",
+  ".git",
+  "node_modules",
+  ".svn",
+  ".hg",
+  ".idea",
+  ".vscode",
+  ".claude",
+  ".agents",
+  ".cursor",
+  ".codex",
+  ".gemini"
+];
+function isEnvironmentFile(name) {
+  return name === ".env" || name === ".envrc" || name.startsWith(".env.");
+}
+function shouldIgnore(path) {
+  const segments = path.split("/");
+  const name = segments.at(-1) ?? "";
+  if (name === "" || IGNORED_EXACT.has(name) || isEnvironmentFile(name)) return true;
+  if (name.startsWith("._")) return true;
+  return segments.some((segment) => IGNORED_DIRECTORIES.includes(segment));
+}
+const REQUIRED_INDEX = "index.html";
+const DOCUMENT_EXTENSIONS = DOCUMENT_EXTENSIONS$1;
+function isDocumentPath(path) {
+  const lower = path.toLowerCase();
+  return DOCUMENT_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+const VIEWABLE_EXTENSIONS = VIEWABLE_EXTENSIONS$1;
+function isViewablePath(path) {
+  const lower = path.toLowerCase();
+  return VIEWABLE_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+function isImageFolder(paths) {
+  let pictures = false;
+  for (const path of paths) {
+    const ext = extensionOf(path);
+    if (WEB_ASSET_EXTENSIONS.includes(ext)) return false;
+    if (GALLERY_EXTENSIONS.includes(ext)) pictures = true;
+  }
+  return pictures;
+}
+function canPublish(paths) {
+  if (paths.some((path) => path === REQUIRED_INDEX)) return true;
+  if (paths.some(isDocumentPath)) return true;
+  if (isImageFolder(paths)) return true;
+  return paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0]);
+}
+function servingModeOf$1(flags) {
+  if (flags.docsMode) return "docs";
+  if (flags.spaMode) return "spa";
+  return "static";
+}
+function predictedModeOf(paths) {
+  if (paths.some((path) => path === REQUIRED_INDEX)) return "static";
+  if (paths.some(isDocumentPath)) return "docs";
+  if (isImageFolder(paths)) return "docs";
+  if (paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0])) return "docs";
+  return "static";
+}
+function nestedIndexOf(paths) {
+  if (predictedModeOf(paths) !== "docs") return null;
+  const suffix = `/${REQUIRED_INDEX}`;
+  const folders2 = paths.filter((path) => path.endsWith(suffix)).map((path) => path.slice(0, -suffix.length)).sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
+  return folders2[0] ?? null;
+}
+function renameOfLoneHtmlPage(paths) {
+  if (paths.length !== 1) return null;
+  const [only] = paths;
+  if (only === void 0 || only === REQUIRED_INDEX) return null;
+  const lower = only.toLowerCase();
+  return lower.endsWith(".html") || lower.endsWith(".htm") ? only : null;
+}
+function formatBytes$1(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+}
+function checkLimits(files, limits) {
+  if (files.length === 0) {
+    throw new DeployError(
+      ClientErrorCode.Empty,
+      "That drop contained no files to deploy. Folders like .git and node_modules are skipped."
+    );
+  }
+  if (!canPublish(files.map((file) => file.path))) {
+    throw new DeployError(
+      ClientErrorCode.MissingIndex,
+      `A site needs an ${REQUIRED_INDEX} at its top level, or at least one .md or .pdf file to publish as a documents site — or be a single file that can be displayed on its own, such as a note, a PDF, a page or an image. Drop the folder that contains it, not the folder above.`
+    );
+  }
+  const refusal = sizeRefusal(
+    files.map((file) => ({ path: file.path, size: sizeOf(file.bytes) })),
+    limits
+  );
+  if (refusal) throw refusal;
+}
+function sizeRefusal(files, limits) {
+  if (!limits) return null;
+  if (files.length > limits.maxFiles) {
+    return new DeployError(
+      ClientErrorCode.TooManyFiles,
+      `That is ${files.length} files, and this plan allows ${limits.maxFiles}.`,
+      { limit: limits.maxFiles, actual: files.length }
+    );
+  }
+  const oversized = files.find((file) => file.size > limits.maxFileBytes);
+  if (oversized) {
+    return new DeployError(
+      ClientErrorCode.FileTooLarge,
+      `${oversized.path} is ${formatBytes$1(oversized.size)}, and this plan allows ${formatBytes$1(limits.maxFileBytes)} per file.`,
+      {
+        path: oversized.path,
+        limit: limits.maxFileBytes,
+        actual: oversized.size
+      }
+    );
+  }
+  const total = files.reduce((sum, file) => sum + file.size, 0);
+  if (limits.maxSiteBytes !== null && total > limits.maxSiteBytes) {
+    return new DeployError(
+      ClientErrorCode.TooLarge,
+      `That drop is ${formatBytes$1(total)}, and this plan allows ${formatBytes$1(limits.maxSiteBytes)}.`,
+      { limit: limits.maxSiteBytes, actual: total }
+    );
+  }
+  return null;
 }
-const DOCUMENT_EXTENSIONS$1 = extensionsWhere((type) => type.document);
-const VIEWABLE_EXTENSIONS$1 = extensionsWhere(
-  (type) => type.kind !== "binary"
-);
-extensionsWhere((type) => type.reader);
-extensionsWhere((type) => type.editable);
-const WEB_ASSET_EXTENSIONS = [
-  ".html",
-  ".htm",
-  ".js",
-  ".mjs",
-  ".cjs",
-  ".css"
-];
-const GALLERY_EXTENSIONS = extensionsWhere(
-  (type) => type.kind === "image"
-);
-Object.fromEntries(
-  FILE_TYPES.filter((type) => type.mime !== null).map((type) => [type.ext, type.mime])
+const MAX_NAME_LENGTH = 60;
+const HEAD_BYTES = 64 * 1024;
+const TITLE_SEPARATORS = ["|", "·", "—", "–", " - "];
+function suggestSiteName(files) {
+  const index = files.find((file) => file.path === "index.html");
+  if (index === void 0 || !ArrayBuffer.isView(index.bytes)) return null;
+  try {
+    return nameFromHtml(decodeHead(index.bytes));
+  } catch {
+    return null;
+  }
+}
+async function readSiteName(files) {
+  const index = files.find((file) => file.path === "index.html");
+  if (index === void 0) return null;
+  if (ArrayBuffer.isView(index.bytes)) return suggestSiteName(files);
+  try {
+    const head = new Uint8Array(await index.bytes.slice(0, HEAD_BYTES).arrayBuffer());
+    return suggestSiteName([{ path: index.path, bytes: head }]);
+  } catch {
+    return null;
+  }
+}
+function decodeHead(bytes) {
+  return new TextDecoder("utf-8", { fatal: false, ignoreBOM: false }).decode(
+    bytes.subarray(0, HEAD_BYTES)
+  );
+}
+function nameFromHtml(html) {
+  const document = parse(html);
+  const candidates = document ? [
+    document.querySelector('meta[property="og:site_name"]')?.getAttribute("content"),
+    document.querySelector("title")?.textContent,
+    document.querySelector("h1")?.textContent
+  ] : [matchOgSiteName(html), matchTag(html, "title"), matchTag(html, "h1")];
+  for (const candidate of candidates) {
+    const name = clean(candidate);
+    if (name !== null) return name;
+  }
+  return null;
+}
+function parse(html) {
+  const parser = globalThis.DOMParser;
+  if (parser === void 0) return null;
+  try {
+    return new parser().parseFromString(html, "text/html");
+  } catch {
+    return null;
+  }
+}
+function matchTag(html, tag) {
+  const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(html);
+  return match?.[1] === void 0 ? null : decodeEntities(match[1]);
+}
+function matchOgSiteName(html) {
+  const patterns = [
+    /<meta[^>]*property\s*=\s*["']og:site_name["'][^>]*content\s*=\s*["']([^"']*)["']/i,
+    /<meta[^>]*content\s*=\s*["']([^"']*)["'][^>]*property\s*=\s*["']og:site_name["']/i
+  ];
+  for (const pattern of patterns) {
+    const match = pattern.exec(html);
+    if (match?.[1] !== void 0) return decodeEntities(match[1]);
+  }
+  return null;
+}
+const LATIN1_ENTITIES = "nbsp iexcl cent pound curren yen brvbar sect uml copy ordf laquo not shy reg macr deg plusmn sup2 sup3 acute micro para middot cedil sup1 ordm raquo frac14 frac12 frac34 iquest Agrave Aacute Acirc Atilde Auml Aring AElig Ccedil Egrave Eacute Ecirc Euml Igrave Iacute Icirc Iuml ETH Ntilde Ograve Oacute Ocirc Otilde Ouml times Oslash Ugrave Uacute Ucirc Uuml Yacute THORN szlig agrave aacute acirc atilde auml aring aelig ccedil egrave eacute ecirc euml igrave iacute icirc iuml eth ntilde ograve oacute ocirc otilde ouml divide oslash ugrave uacute ucirc uuml yacute thorn yuml".split(" ");
+const NAMED_ENTITIES = new Map([
+  ...LATIN1_ENTITIES.map((name, index) => [name, 160 + index]),
+  ["amp", 38],
+  ["lt", 60],
+  ["gt", 62],
+  ["quot", 34],
+  ["apos", 39],
+  ["ensp", 8194],
+  ["emsp", 8195],
+  ["thinsp", 8201],
+  ["ndash", 8211],
+  ["mdash", 8212],
+  ["lsquo", 8216],
+  ["rsquo", 8217],
+  ["sbquo", 8218],
+  ["ldquo", 8220],
+  ["rdquo", 8221],
+  ["bdquo", 8222],
+  ["dagger", 8224],
+  ["Dagger", 8225],
+  ["bull", 8226],
+  ["hellip", 8230],
+  ["prime", 8242],
+  ["lsaquo", 8249],
+  ["rsaquo", 8250],
+  ["euro", 8364],
+  ["trade", 8482],
+  ["larr", 8592],
+  ["rarr", 8594],
+  ["hearts", 9829]
+]);
+function decodeEntities(text) {
+  return text.replace(
+    /&(?:#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{1,31}));/g,
+    (whole, decimal, hex, name) => {
+      if (name !== void 0) {
+        const code2 = NAMED_ENTITIES.get(name);
+        return code2 === void 0 ? whole : String.fromCodePoint(code2);
+      }
+      const code = decimal !== void 0 ? Number(decimal) : Number.parseInt(hex ?? "", 16);
+      const valid = code > 0 && code <= 1114111 && (code < 55296 || code > 57343);
+      return String.fromCodePoint(valid ? code : 65533);
+    }
+  );
+}
+const INVISIBLE = new RegExp(
+  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8203)}-${String.fromCharCode(8207)}${String.fromCharCode(8232)}-${String.fromCharCode(8238)}${String.fromCharCode(8288)}-${String.fromCharCode(8292)}${String.fromCharCode(8294)}-${String.fromCharCode(8303)}${String.fromCharCode(65279)}]`,
+  "g"
 );
-function extensionOf(path) {
-  const name = path.slice(path.lastIndexOf("/") + 1);
-  const dot = name.lastIndexOf(".");
-  return dot <= 0 ? "" : name.slice(dot).toLowerCase();
+function clean(raw) {
+  if (raw === null || raw === void 0) return null;
+  if (raw.includes("<") || raw.includes(">")) return null;
+  const collapsed = raw.replace(INVISIBLE, " ").replace(/\s+/g, " ").trim();
+  const name = trimSuffix(collapsed);
+  if (name.length === 0) return null;
+  if (PLACEHOLDERS.has(name.toLowerCase())) return null;
+  return name.length > MAX_NAME_LENGTH ? name.slice(0, MAX_NAME_LENGTH).trimEnd() : name;
 }
-async function sha256Hex(bytes) {
-  const digest = await crypto.subtle.digest("SHA-256", bytes);
-  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+const PLACEHOLDERS = /* @__PURE__ */ new Set([
+  "document",
+  "untitled",
+  "untitled document",
+  "index",
+  "home",
+  "new page",
+  "my site",
+  "vite app",
+  "vite + react",
+  "react app",
+  "create next app",
+  "svelte app",
+  "webpack app",
+  "hello world",
+  "title"
+]);
+function trimSuffix(title) {
+  for (const separator of TITLE_SEPARATORS) {
+    const at = title.lastIndexOf(separator);
+    if (at <= 0) continue;
+    const before = title.slice(0, at).trim();
+    const after = title.slice(at + separator.length).trim();
+    if (before.length > 0 && after.length > 0) return after;
+  }
+  return title;
 }
-async function hashAll(files, onProgress, signal) {
-  const hashed = [];
-  for (const [index, file] of files.entries()) {
-    hashed.push({ ...file, sha256: await sha256Hex(await readForHash(file)) });
-    onProgress?.(index + 1, files.length);
+const DEFAULT_CONCURRENCY = 8;
+const MAX_BATCH_CONCURRENCY = 64;
+const DEFAULT_BYTES_IN_FLIGHT = 64 * 1024 * 1024;
+const DEFAULT_RETRIES = 3;
+const BACKOFF_MS = [1e3, 2e3, 4e3];
+const DEFAULT_STALL_MS = 3e4;
+const PROGRESS_INTERVAL_MS = 200;
+class StalledError extends Error {
+  /** @param seconds How long nothing moved. */
+  constructor(seconds) {
+    super(`No data moved for ${seconds}s.`);
+    this.name = "StalledError";
   }
-  return hashed;
 }
-async function readForHash(file) {
+async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}, onRetry) {
+  const put = deps.put ?? defaultTransport(deps.fetch);
+  const delay = deps.delay ?? defaultDelay;
+  const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
+  const batchConcurrency = Math.max(
+    1,
+    Math.min(MAX_BATCH_CONCURRENCY, Math.floor(deps.batchConcurrency ?? concurrency))
+  );
+  const retries = deps.retries ?? DEFAULT_RETRIES;
+  const stallMs = deps.stallMs ?? DEFAULT_STALL_MS;
+  const now = deps.now ?? Date.now;
+  const maxBytesInFlight = deps.maxBytesInFlight ?? DEFAULT_BYTES_IN_FLIGHT;
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  const fileCount = targets.reduce(
+    (sum, target) => sum + (isBatch(target) ? target.files.length : 1),
+    0
+  );
+  let nextIndex = 0;
+  let done = 0;
+  let failed = false;
+  let firstFailure;
+  const local = new AbortController();
+  const inner = local.signal;
+  const fail = (error) => {
+    if (failed) return;
+    failed = true;
+    firstFailure = error;
+    local.abort();
+  };
+  let reserved = 0;
+  let waiting = [];
+  const acquire = async (size) => {
+    while (reserved > 0 && reserved + size > maxBytesInFlight) {
+      await new Promise((resolve2) => waiting.push(resolve2));
+    }
+    reserved += size;
+  };
+  const release = (size) => {
+    reserved -= size;
+    const woken = waiting;
+    waiting = [];
+    for (const wake of woken) wake();
+  };
+  const running = { single: 0, batch: 0 };
+  const limit = { single: concurrency, batch: batchConcurrency };
+  let slotWaiting = [];
+  const takeSlot = async (kind) => {
+    while (running[kind] >= limit[kind]) {
+      await new Promise((resolve2) => slotWaiting.push(resolve2));
+    }
+    running[kind] += 1;
+  };
+  const freeSlot = (kind) => {
+    running[kind] -= 1;
+    const woken = slotWaiting;
+    slotWaiting = [];
+    for (const wake of woken) wake();
+  };
+  let landedBytes = 0;
+  const inFlight = /* @__PURE__ */ new Map();
+  let lastReport = Number.NEGATIVE_INFINITY;
+  const report = (path) => {
+    if (onProgress === void 0 || failed) return;
+    const at = now();
+    if (path === void 0 && at - lastReport < PROGRESS_INTERVAL_MS) return;
+    lastReport = at;
+    let bytes = landedBytes;
+    for (const sent of inFlight.values()) bytes += sent;
+    onProgress(done, fileCount, bytes, path);
+  };
+  const worker = async () => {
+    for (; ; ) {
+      if (failed) return;
+      const index = nextIndex++;
+      const target = targets[index];
+      if (target === void 0) return;
+      inner.throwIfAborted();
+      const refs = isBatch(target) ? target.files : [target];
+      const members = [];
+      for (const ref of refs) {
+        const file = byPath.get(ref.path);
+        if (file === void 0) {
+          const missing = new DeployError(
+            ClientErrorCode.UploadFailed,
+            `The server asked for ${ref.path}, which is not in the manifest.`,
+            { path: ref.path }
+          );
+          fail(missing);
+          throw missing;
+        }
+        members.push(file);
+      }
+      const layout = isBatch(target) ? new TextEncoder().encode(
+        batchLayout(
+          target.files.map((ref, i) => ({
+            sha256: ref.sha256,
+            size: sizeOf(members[i].bytes)
+          }))
+        )
+      ) : null;
+      const size = members.reduce((sum, file) => sum + sizeOf(file.bytes), layout?.length ?? 0);
+      const copied = isBatch(target) ? members.reduce(
+        (sum, file) => sum + (file.bytes instanceof Blob ? 0 : sizeOf(file.bytes)),
+        0
+      ) : 0;
+      const reservation = size + copied;
+      const first = members[0].path;
+      const label = members.length === 1 ? first : `${first} and ${members.length - 1} more`;
+      const kind = isBatch(target) ? "batch" : "single";
+      await takeSlot(kind);
+      await acquire(reservation);
+      try {
+        if (failed) return;
+        inner.throwIfAborted();
+        const context = {
+          put,
+          delay,
+          retries,
+          signal: inner,
+          uploadUrl,
+          stallMs,
+          onSent: (sent) => {
+            inFlight.set(index, sent);
+            report();
+          },
+          onRetry: (attempt, stalled) => {
+            inFlight.set(index, 0);
+            onRetry?.(label, attempt, retries + 1, stalled);
+          }
+        };
+        if (isBatch(target) && layout !== null)
+          await uploadBatchOne(target, members, layout, context);
+        else await uploadOne(target, members[0], context);
+      } catch (error) {
+        fail(error);
+        throw error;
+      } finally {
+        release(reservation);
+        freeSlot(kind);
+      }
+      inFlight.delete(index);
+      done += members.length;
+      landedBytes += size;
+      report(members.at(-1).path);
+    }
+  };
+  const workers = Array.from(
+    { length: Math.min(Math.max(concurrency, batchConcurrency), targets.length) },
+    worker
+  );
   try {
-    return await bytesOf(file.bytes);
+    await Promise.all(workers);
   } catch (error) {
-    if (error instanceof RangeError) throw error;
-    throw new DeployError(
-      ClientErrorCode.ReadFailed,
-      `Could not read ${file.path}. It may have been moved, renamed or changed since you dropped it — drop the folder again.`,
-      { path: file.path, cause: describeError(error) }
-    );
+    throw asDeployError(firstFailure ?? error);
+  } finally {
   }
 }
-const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
-const IGNORED_DIRECTORIES = [
-  "__MACOSX",
-  ".git",
-  "node_modules",
-  ".svn",
-  ".hg",
-  ".idea",
-  ".vscode",
-  ".claude",
-  ".agents",
-  ".cursor",
-  ".codex",
-  ".gemini"
-];
-function shouldIgnore(path) {
-  const segments = path.split("/");
-  const name = segments.at(-1) ?? "";
-  if (name === "" || IGNORED_EXACT.has(name)) return true;
-  if (name.startsWith("._")) return true;
-  return segments.some((segment) => IGNORED_DIRECTORIES.includes(segment));
-}
-const REQUIRED_INDEX = "index.html";
-const DOCUMENT_EXTENSIONS = DOCUMENT_EXTENSIONS$1;
-function isDocumentPath(path) {
-  const lower = path.toLowerCase();
-  return DOCUMENT_EXTENSIONS.some((extension) => lower.endsWith(extension));
-}
-const VIEWABLE_EXTENSIONS = VIEWABLE_EXTENSIONS$1;
-function isViewablePath(path) {
-  const lower = path.toLowerCase();
-  return VIEWABLE_EXTENSIONS.some((extension) => lower.endsWith(extension));
-}
-function isImageFolder(paths) {
-  let pictures = false;
-  for (const path of paths) {
-    const ext = extensionOf(path);
-    if (WEB_ASSET_EXTENSIONS.includes(ext)) return false;
-    if (GALLERY_EXTENSIONS.includes(ext)) pictures = true;
+async function uploadOne(target, file, context) {
+  let lastError;
+  for (let attempt = 0; attempt <= context.retries; attempt++) {
+    context.signal?.throwIfAborted();
+    if (attempt > 0) {
+      context.onRetry(attempt + 1, lastError instanceof StalledError);
+      await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
+      context.signal?.throwIfAborted();
+    }
+    try {
+      const answer = await context.put({
+        url: context.uploadUrl,
+        token: target.token,
+        body: untyped(file.bytes),
+        signal: context.signal,
+        onSent: context.onSent,
+        stallMs: context.stallMs
+      });
+      const status = typeof answer === "number" ? answer : answer.status;
+      if (status >= 200 && status < 300) return;
+      if (status === 401 || status === 403 || status === 429) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `Upload of ${target.path} was refused. The upload window may have expired — try deploying again.`,
+          { path: target.path, status }
+        );
+      }
+      if (status === 413) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `${target.path} is too large to upload in one request. Make it smaller, or leave it out of this publish.`,
+          { path: target.path, status }
+        );
+      }
+      lastError = new Error(`HTTP ${status}`);
+    } catch (error) {
+      if (error instanceof DeployError) throw error;
+      if (isAbort(error)) throw cancelled();
+      lastError = error;
+    }
   }
-  return pictures;
-}
-function canPublish(paths) {
-  if (paths.some((path) => path === REQUIRED_INDEX)) return true;
-  if (paths.some(isDocumentPath)) return true;
-  if (isImageFolder(paths)) return true;
-  return paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0]);
-}
-function servingModeOf(flags) {
-  if (flags.docsMode) return "docs";
-  if (flags.spaMode) return "spa";
-  return "static";
+  const message = lastError instanceof StalledError ? `Upload of ${target.path} stopped moving and did not recover after ${context.retries + 1} attempts. Check your connection and try again.` : `Could not upload ${target.path} after ${context.retries + 1} attempts.`;
+  throw new DeployError(ClientErrorCode.UploadFailed, message, {
+    path: target.path,
+    cause: describeError(lastError)
+  });
 }
-function predictedModeOf(paths) {
-  if (paths.some((path) => path === REQUIRED_INDEX)) return "static";
-  if (paths.some(isDocumentPath)) return "docs";
-  if (isImageFolder(paths)) return "docs";
-  if (paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0])) return "docs";
-  return "static";
+async function uploadBatchOne(batch, members, layout, context) {
+  const first = members[0].path;
+  const label = members.length === 1 ? first : `${first} and ${members.length - 1} more`;
+  let lastError;
+  for (let attempt = 0; attempt <= context.retries; attempt++) {
+    context.signal?.throwIfAborted();
+    if (attempt > 0) {
+      context.onRetry(attempt + 1, lastError instanceof StalledError);
+      await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
+      context.signal?.throwIfAborted();
+    }
+    try {
+      const body = new Blob([layout, ...members.map((file) => file.bytes)]);
+      const answer = await context.put({
+        url: context.uploadUrl,
+        token: batch.token,
+        body,
+        signal: context.signal,
+        onSent: context.onSent,
+        stallMs: context.stallMs,
+        wantsBody: true
+      });
+      const status = typeof answer === "number" ? answer : answer.status;
+      if (status >= 200 && status < 300) {
+        const result = typeof answer === "number" ? null : parseBatchResult(answer.body);
+        if (result === null) {
+          lastError = new Error(
+            "The upload service answered with something that is not a batch result."
+          );
+          continue;
+        }
+        if (result.failed.length === 0) return;
+        const changed = result.failed.find((failure2) => failure2.reason === "hash_mismatch");
+        if (changed !== void 0) {
+          const path = members[changed.i]?.path ?? first;
+          throw new DeployError(
+            ClientErrorCode.ReadFailed,
+            `${path} changed after it was read, so it no longer matches what was checked. Drop the folder again.`,
+            { path }
+          );
+        }
+        lastError = new Error(
+          `${result.failed.length} of ${members.length} files were not stored.`
+        );
+        continue;
+      }
+      if ([400, 401, 403, 411, 413, 429].includes(status)) {
+        throw new DeployError(ClientErrorCode.UploadFailed, refusalMessage(status, label), {
+          path: first,
+          status
+        });
+      }
+      lastError = new Error(`HTTP ${status}`);
+    } catch (error) {
+      if (error instanceof DeployError) throw error;
+      if (isAbort(error)) throw cancelled();
+      lastError = error;
+    }
+  }
+  const message = lastError instanceof StalledError ? `Upload of ${label} stopped moving and did not recover after ${context.retries + 1} attempts. Check your connection and try again.` : `Could not upload ${label} after ${context.retries + 1} attempts.`;
+  throw new DeployError(ClientErrorCode.UploadFailed, message, {
+    path: first,
+    cause: describeError(lastError)
+  });
 }
-function nestedIndexOf(paths) {
-  if (predictedModeOf(paths) !== "docs") return null;
-  const suffix = `/${REQUIRED_INDEX}`;
-  const folders2 = paths.filter((path) => path.endsWith(suffix)).map((path) => path.slice(0, -suffix.length)).sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
-  return folders2[0] ?? null;
+function refusalMessage(status, label) {
+  switch (status) {
+    case 401:
+      return `Upload of ${label} was refused because its upload window expired. Try deploying again.`;
+    case 429:
+      return `Upload of ${label} was refused: this deploy has used every upload it was given. Try deploying again.`;
+    case 400:
+    case 411:
+    case 413:
+      return `Upload of ${label} was refused because it no longer matches what was checked — a file may have changed since you dropped it. Drop the folder again.`;
+    default:
+      return `Upload of ${label} was refused by the upload service. Try deploying again.`;
+  }
 }
-function renameOfLoneHtmlPage(paths) {
-  if (paths.length !== 1) return null;
-  const [only] = paths;
-  if (only === void 0 || only === REQUIRED_INDEX) return null;
-  const lower = only.toLowerCase();
-  return lower.endsWith(".html") || lower.endsWith(".htm") ? only : null;
+function untyped(content) {
+  if (ArrayBuffer.isView(content) || content.type === "") return content;
+  return content.slice(0, content.size);
 }
-function formatBytes$1(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+function defaultTransport(doFetch) {
+  if (doFetch !== void 0) return fetchTransport(doFetch);
+  const Xhr = globalThis.XMLHttpRequest;
+  return Xhr === void 0 ? fetchTransport(globalFetch()) : xhrTransport(Xhr);
 }
-function checkLimits(files, limits) {
-  if (files.length === 0) {
-    throw new DeployError(
-      ClientErrorCode.Empty,
-      "That drop contained no files to deploy. Folders like .git and node_modules are skipped."
-    );
-  }
-  if (!canPublish(files.map((file) => file.path))) {
-    throw new DeployError(
-      ClientErrorCode.MissingIndex,
-      `A site needs an ${REQUIRED_INDEX} at its top level, or at least one .md or .pdf file to publish as a documents site — or be a single file that can be displayed on its own, such as a note, a PDF, a page or an image. Drop the folder that contains it, not the folder above.`
-    );
-  }
-  const refusal = sizeRefusal(
-    files.map((file) => ({ path: file.path, size: sizeOf(file.bytes) })),
-    limits
-  );
-  if (refusal) throw refusal;
+function fetchTransport(doFetch) {
+  return async (request2) => {
+    const { url, token, body, signal } = request2;
+    const response = await doFetch(url, {
+      method: "PUT",
+      // The view, not a copy. Wrapping it in `new Blob([body.slice().buffer])` made two extra
+      // full-size copies of every file in flight — eight at once, so up to 400 MB on a drop of
+      // 50 MB files. `fetch` sends exactly the range a view covers. The cast is TypeScript's
+      // SharedArrayBuffer distinction again; see `sha256Hex`. A `Blob` goes as it is, and the runtime
+      // streams it from disk.
+      body,
+      // The permit is the whole request. `Content-Length` is required by the Worker and cannot be
+      // set here — it is a forbidden header name — but the runtime derives it from the body, which
+      // is exactly the length the token names.
+      headers: { Authorization: `Bearer ${token}` },
+      ...signal ? { signal } : {}
+    });
+    return request2.wantsBody === true ? { status: response.status, body: await response.text() } : response.status;
+  };
 }
-function sizeRefusal(files, limits) {
-  if (!limits) return null;
-  if (files.length > limits.maxFiles) {
-    return new DeployError(
-      ClientErrorCode.TooManyFiles,
-      `That is ${files.length} files, and this plan allows ${limits.maxFiles}.`,
-      { limit: limits.maxFiles, actual: files.length }
-    );
-  }
-  const oversized = files.find((file) => file.size > limits.maxFileBytes);
-  if (oversized) {
-    return new DeployError(
-      ClientErrorCode.FileTooLarge,
-      `${oversized.path} is ${formatBytes$1(oversized.size)}, and this plan allows ${formatBytes$1(limits.maxFileBytes)} per file.`,
-      {
-        path: oversized.path,
-        limit: limits.maxFileBytes,
-        actual: oversized.size
-      }
-    );
-  }
-  const total = files.reduce((sum, file) => sum + file.size, 0);
-  if (limits.maxSiteBytes !== null && total > limits.maxSiteBytes) {
-    return new DeployError(
-      ClientErrorCode.TooLarge,
-      `That drop is ${formatBytes$1(total)}, and this plan allows ${formatBytes$1(limits.maxSiteBytes)}.`,
-      { limit: limits.maxSiteBytes, actual: total }
+function xhrTransport(Xhr) {
+  return ({ url, token, body, signal, onSent, stallMs, wantsBody }) => new Promise((resolve2, reject) => {
+    const xhr = new Xhr();
+    let settled = false;
+    let timer;
+    const settle = (finish) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      finish();
+    };
+    const arm = () => {
+      if (timer !== void 0) clearTimeout(timer);
+      timer = setTimeout(() => {
+        xhr.abort();
+        settle(() => reject(new StalledError(Math.round(stallMs / 1e3))));
+      }, stallMs);
+    };
+    function onAbort() {
+      xhr.abort();
+      settle(() => reject(abortReason(signal)));
+    }
+    if (signal?.aborted) {
+      reject(abortReason(signal));
+      return;
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+    xhr.open("PUT", url);
+    xhr.setRequestHeader("Authorization", `Bearer ${token}`);
+    xhr.upload.onprogress = (event) => {
+      arm();
+      onSent(event.loaded);
+    };
+    xhr.onprogress = arm;
+    xhr.onload = () => settle(
+      () => resolve2(
+        wantsBody === true ? { status: xhr.status, body: xhr.responseText ?? "" } : xhr.status
+      )
     );
-  }
-  return null;
+    xhr.onerror = () => settle(() => reject(new TypeError("Network error during upload.")));
+    arm();
+    xhr.send(body);
+  });
 }
-const MAX_NAME_LENGTH = 60;
-const HEAD_BYTES = 64 * 1024;
-const TITLE_SEPARATORS = ["|", "·", "—", "–", " - "];
-function suggestSiteName(files) {
-  const index = files.find((file) => file.path === "index.html");
-  if (index === void 0 || !ArrayBuffer.isView(index.bytes)) return null;
-  try {
-    return nameFromHtml(decodeHead(index.bytes));
-  } catch {
-    return null;
-  }
+function abortReason(signal) {
+  const reason = signal?.reason;
+  if (reason instanceof Error) return reason;
+  const error = new Error("Aborted.");
+  error.name = "AbortError";
+  return error;
 }
-async function readSiteName(files) {
-  const index = files.find((file) => file.path === "index.html");
-  if (index === void 0) return null;
-  if (ArrayBuffer.isView(index.bytes)) return suggestSiteName(files);
-  try {
-    const head = new Uint8Array(await index.bytes.slice(0, HEAD_BYTES).arrayBuffer());
-    return suggestSiteName([{ path: index.path, bytes: head }]);
-  } catch {
-    return null;
-  }
+function globalFetch() {
+  return globalThis.fetch.bind(globalThis);
 }
-function decodeHead(bytes) {
-  return new TextDecoder("utf-8", { fatal: false }).decode(
-    bytes.subarray(0, HEAD_BYTES)
+function defaultDelay(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function isAbort(error) {
+  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
+function cancelled() {
+  return new DeployError(ClientErrorCode.Cancelled, "Deploy cancelled.");
+}
+function outOfMemory(detail) {
+  return new DeployError(
+    ClientErrorCode.OutOfMemory,
+    "This browser ran out of memory reading what you dropped. Drop the unzipped folder instead, or try again in a desktop browser with fewer tabs open.",
+    detail
   );
 }
-function nameFromHtml(html) {
-  const document = parse(html);
-  const candidates = document ? [
-    document.querySelector('meta[property="og:site_name"]')?.getAttribute("content"),
-    document.querySelector("title")?.textContent,
-    document.querySelector("h1")?.textContent
-  ] : [matchOgSiteName(html), matchTag(html, "title"), matchTag(html, "h1")];
-  for (const candidate of candidates) {
-    const name = clean(candidate);
-    if (name !== null) return name;
-  }
-  return null;
+function asDeployError(error) {
+  if (error instanceof DeployError) return error;
+  if (isAbort(error)) return cancelled();
+  if (error instanceof RangeError) return outOfMemory(error.message);
+  return new DeployError(
+    ClientErrorCode.UploadFailed,
+    error instanceof Error ? error.message : "Upload failed.",
+    error
+  );
 }
-function parse(html) {
-  const parser = globalThis.DOMParser;
-  if (parser === void 0) return null;
+async function deploy(source, siteId, onProgress, signal, options = {}) {
   try {
-    return new parser().parseFromString(html, "text/html");
-  } catch {
-    return null;
+    onProgress({ type: "reading", bytes: 0, total: 0 });
+    const collected = await source(
+      signal,
+      (bytes, total) => onProgress({ type: "reading", bytes, total })
+    );
+    onProgress({ type: "collecting", files: collected.length });
+    const rename = renameOfLoneHtmlPage(collected.map((file) => file.path));
+    const files = rename === null ? collected : collected.map((file) => file.path === rename ? { ...file, path: "index.html" } : file);
+    const hashed = await hashAll(
+      files,
+      (done, total) => onProgress({ type: "hashing", done, total }),
+      signal
+    );
+    checkLimits(hashed, options.limits ?? null);
+    onProgress({ type: "preparing" });
+    const prepared = await prepareDeploy(siteId, hashed, options, signal);
+    if (prepared.unchanged) {
+      onProgress({ type: "unchanged", url: prepared.url ?? "" });
+      return;
+    }
+    const sizes = new Map(hashed.map((file) => [file.path, sizeOf(file.bytes)]));
+    const batches = prepared.batches ?? [];
+    const targets = [...prepared.upload, ...batches];
+    const totalBytes = prepared.upload.reduce((sum, target) => sum + (sizes.get(target.path) ?? 0), 0) + batches.reduce((sum, batch) => {
+      const members = batch.files.map((ref) => ({
+        sha256: ref.sha256,
+        size: sizes.get(ref.path) ?? 0
+      }));
+      return sum + batchLayout(members).length + members.reduce((n, member) => n + member.size, 0);
+    }, 0);
+    if (targets.length > 0) {
+      onProgress({
+        type: "uploading",
+        done: prepared.reused,
+        total: prepared.total,
+        bytes: 0,
+        totalBytes,
+        reused: prepared.reused
+      });
+    }
+    await uploadAll(
+      targets,
+      prepared.uploadUrl,
+      hashed,
+      (done, _total, bytes, path) => onProgress({
+        type: "uploading",
+        done: prepared.reused + done,
+        total: prepared.total,
+        bytes,
+        totalBytes,
+        reused: prepared.reused,
+        ...path === void 0 ? {} : { path }
+      }),
+      signal,
+      // The server's number unless the caller set one: it is tuned on the server so a deploy of many
+      // small files speeds up without a CLI or MCP release.
+      typeof prepared.batchConcurrency === "number" && options.upload?.batchConcurrency === void 0 ? { ...options.upload, batchConcurrency: prepared.batchConcurrency } : options.upload,
+      (path, attempt, attempts, stalled) => onProgress({ type: "retrying", path, attempt, attempts, stalled })
+    );
+    onProgress({ type: "completing", reused: prepared.reused });
+    const completed = await completeDeploy(
+      siteId,
+      prepared.deployId,
+      options,
+      signal,
+      await readSiteName(files)
+    );
+    onProgress({
+      type: "done",
+      url: completed.url,
+      name: completed.name,
+      mode: servingModeOf$1(completed),
+      modeIsManual: completed.modeIsManual
+    });
+  } catch (error) {
+    const failure2 = asDeployError(error);
+    onProgress({
+      type: "error",
+      code: failure2.code,
+      message: failure2.message,
+      ...failure2.detail === void 0 ? {} : { detail: failure2.detail }
+    });
+    throw failure2;
   }
 }
-function matchTag(html, tag) {
-  const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(
-    html
-  );
-  return match?.[1] === void 0 ? null : decodeEntities(match[1]);
+async function call(credentials, path, init2 = {}) {
+  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
+    ...init2,
+    headers: {
+      ...credentials.headers,
+      ...init2.headers,
+      Authorization: `Bearer ${credentials.token}`,
+      ...init2.body === void 0 ? {} : { "Content-Type": "application/json" }
+    }
+  });
+  if (!response.ok) throw await failureOf(response);
+  return await response.json();
 }
-function matchOgSiteName(html) {
-  const patterns = [
-    /<meta[^>]*property\s*=\s*["']og:site_name["'][^>]*content\s*=\s*["']([^"']*)["']/i,
-    /<meta[^>]*content\s*=\s*["']([^"']*)["'][^>]*property\s*=\s*["']og:site_name["']/i
-  ];
-  for (const pattern of patterns) {
-    const match = pattern.exec(html);
-    if (match?.[1] !== void 0) return decodeEntities(match[1]);
+async function failureOf(response) {
+  const problem = await response.json().catch(() => null);
+  return Object.assign(new Error(problem?.detail ?? `The API answered ${response.status}.`), {
+    status: response.status
+  });
+}
+async function findSite(credentials, site) {
+  const found = await lookUpSite(credentials, site);
+  if (found === void 0) {
+    throw new Error(
+      `No site of yours is called "${site}". \`drop2run ls\` or the list_sites tool shows what exists.`
+    );
   }
-  return null;
+  return found;
 }
-const LATIN1_ENTITIES = "nbsp iexcl cent pound curren yen brvbar sect uml copy ordf laquo not shy reg macr deg plusmn sup2 sup3 acute micro para middot cedil sup1 ordm raquo frac14 frac12 frac34 iquest Agrave Aacute Acirc Atilde Auml Aring AElig Ccedil Egrave Eacute Ecirc Euml Igrave Iacute Icirc Iuml ETH Ntilde Ograve Oacute Ocirc Otilde Ouml times Oslash Ugrave Uacute Ucirc Uuml Yacute THORN szlig agrave aacute acirc atilde auml aring aelig ccedil egrave eacute ecirc euml igrave iacute icirc iuml eth ntilde ograve oacute ocirc otilde ouml divide oslash ugrave uacute ucirc uuml yacute thorn yuml".split(" ");
-const NAMED_ENTITIES = new Map([
-  ...LATIN1_ENTITIES.map((name, index) => [name, 160 + index]),
-  ["amp", 38],
-  ["lt", 60],
-  ["gt", 62],
-  ["quot", 34],
-  ["apos", 39],
-  ["ensp", 8194],
-  ["emsp", 8195],
-  ["thinsp", 8201],
-  ["ndash", 8211],
-  ["mdash", 8212],
-  ["lsquo", 8216],
-  ["rsquo", 8217],
-  ["sbquo", 8218],
-  ["ldquo", 8220],
-  ["rdquo", 8221],
-  ["bdquo", 8222],
-  ["dagger", 8224],
-  ["Dagger", 8225],
-  ["bull", 8226],
-  ["hellip", 8230],
-  ["prime", 8242],
-  ["lsaquo", 8249],
-  ["rsaquo", 8250],
-  ["euro", 8364],
-  ["trade", 8482],
-  ["larr", 8592],
-  ["rarr", 8594],
-  ["hearts", 9829]
-]);
-function decodeEntities(text) {
-  return text.replace(
-    /&(?:#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{1,31}));/g,
-    (whole, decimal, hex, name) => {
-      if (name !== void 0) {
-        const code2 = NAMED_ENTITIES.get(name);
-        return code2 === void 0 ? whole : String.fromCodePoint(code2);
-      }
-      const code = decimal !== void 0 ? Number(decimal) : Number.parseInt(hex ?? "", 16);
-      const valid = code > 0 && code <= 1114111 && (code < 55296 || code > 57343);
-      return String.fromCodePoint(valid ? code : 65533);
-    }
+const SITE_ID_SHAPE = /^[0-9a-z]{26}$/i;
+const FORMER_NAME_CANDIDATES = 3;
+async function lookUpSite(credentials, site) {
+  const wanted = site.trim().toLowerCase();
+  if (wanted === "") return void 0;
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(wanted)}`
+  );
+  const bySubdomain = sites.find((candidate) => candidate.subdomain.toLowerCase() === wanted);
+  if (bySubdomain !== void 0) return bySubdomain;
+  for (const candidate of sites.slice(0, FORMER_NAME_CANDIDATES)) {
+    const detail2 = await call(
+      credentials,
+      `sites/${encodeURIComponent(candidate.siteId)}`
+    );
+    if (detail2.formerSubdomains?.some((former) => former.subdomain === wanted)) return candidate;
+  }
+  if (!SITE_ID_SHAPE.test(wanted)) return void 0;
+  const response = await fetch(
+    `${credentials.apiBaseUrl}/sites/${encodeURIComponent(wanted.toUpperCase())}`,
+    { headers: { ...credentials.headers, Authorization: `Bearer ${credentials.token}` } }
   );
+  if (response.status === 404) return void 0;
+  if (!response.ok) throw await failureOf(response);
+  const detail = await response.json();
+  return { siteId: detail.siteId, subdomain: detail.subdomain, url: detail.url, name: detail.name };
 }
-const INVISIBLE = new RegExp(
-  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8203)}-${String.fromCharCode(8207)}${String.fromCharCode(8232)}-${String.fromCharCode(8238)}${String.fromCharCode(8288)}-${String.fromCharCode(8292)}${String.fromCharCode(8294)}-${String.fromCharCode(8303)}${String.fromCharCode(65279)}]`,
-  "g"
-);
-function clean(raw) {
-  if (raw === null || raw === void 0) return null;
-  if (raw.includes("<") || raw.includes(">")) return null;
-  const collapsed = raw.replace(INVISIBLE, " ").replace(/\s+/g, " ").trim();
-  const name = trimSuffix(collapsed);
-  if (name.length === 0) return null;
-  if (PLACEHOLDERS.has(name.toLowerCase())) return null;
-  return name.length > MAX_NAME_LENGTH ? name.slice(0, MAX_NAME_LENGTH).trimEnd() : name;
+async function deleteSite(credentials, siteId) {
+  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
+    method: "DELETE",
+    headers: { ...credentials.headers, Authorization: `Bearer ${credentials.token}` }
+  });
+  if (!response.ok) throw await failureOf(response);
 }
-const PLACEHOLDERS = /* @__PURE__ */ new Set([
-  "document",
-  "untitled",
-  "untitled document",
-  "index",
-  "home",
-  "new page",
-  "my site",
-  "vite app",
-  "vite + react",
-  "react app",
-  "create next app",
-  "svelte app",
-  "webpack app",
-  "hello world",
-  "title"
-]);
-function trimSuffix(title) {
-  for (const separator of TITLE_SEPARATORS) {
-    const at = title.lastIndexOf(separator);
-    if (at <= 0) continue;
-    const before = title.slice(0, at).trim();
-    const after = title.slice(at + separator.length).trim();
-    if (before.length > 0 && after.length > 0) return after;
-  }
-  return title;
+async function promoteDeploy(credentials, siteId, deployId) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
+    { method: "POST" }
+  );
 }
-const DEFAULT_CONCURRENCY = 8;
-const DEFAULT_BYTES_IN_FLIGHT = 64 * 1024 * 1024;
-const DEFAULT_RETRIES = 3;
-const BACKOFF_MS = [1e3, 2e3, 4e3];
-const DEFAULT_STALL_MS = 3e4;
-const PROGRESS_INTERVAL_MS = 200;
-class StalledError extends Error {
-  /** @param seconds How long nothing moved. */
-  constructor(seconds) {
-    super(`No data moved for ${seconds}s.`);
-    this.name = "StalledError";
+function enumName(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function actionOf(expiresAt, action) {
+  return expiresAt === null ? null : enumName(action);
+}
+async function readInvitedOnly(credentials, siteId) {
+  try {
+    const page = await call(
+      credentials,
+      `sites/${encodeURIComponent(siteId)}/viewers?pageSize=1`
+    );
+    return typeof page.invitedOnly === "boolean" ? page.invitedOnly : null;
+  } catch {
+    return null;
   }
 }
-async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}, onRetry) {
-  const put = deps.put ?? defaultTransport(deps.fetch);
-  const delay = deps.delay ?? defaultDelay;
-  const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
-  const retries = deps.retries ?? DEFAULT_RETRIES;
-  const stallMs = deps.stallMs ?? DEFAULT_STALL_MS;
-  const now = deps.now ?? Date.now;
-  const maxBytesInFlight = deps.maxBytesInFlight ?? DEFAULT_BYTES_IN_FLIGHT;
-  const byPath = new Map(files.map((file) => [file.path, file]));
-  let nextIndex = 0;
-  let done = 0;
-  let failed = false;
-  let reserved = 0;
-  let waiting = [];
-  const acquire = async (size) => {
-    while (reserved > 0 && reserved + size > maxBytesInFlight) {
-      await new Promise((resolve2) => waiting.push(resolve2));
-    }
-    reserved += size;
-  };
-  const release = (size) => {
-    reserved -= size;
-    const woken = waiting;
-    waiting = [];
-    for (const wake of woken) wake();
-  };
-  let landedBytes = 0;
-  const inFlight = /* @__PURE__ */ new Map();
-  let lastReport = Number.NEGATIVE_INFINITY;
-  const report = (path) => {
-    if (onProgress === void 0) return;
-    const at = now();
-    if (path === void 0 && at - lastReport < PROGRESS_INTERVAL_MS) return;
-    lastReport = at;
-    let bytes = landedBytes;
-    for (const sent of inFlight.values()) bytes += sent;
-    onProgress(done, targets.length, bytes, path);
+async function folderFromListing(credentials, siteId, subdomain) {
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(subdomain)}`
+  );
+  return sites.find((candidate) => candidate.siteId === siteId)?.folderId ?? null;
+}
+async function getSite(credentials, siteId) {
+  const [site, invitedOnly] = await Promise.all([
+    call(credentials, `sites/${encodeURIComponent(siteId)}`),
+    readInvitedOnly(credentials, siteId)
+  ]);
+  const folderId = site.folderId !== void 0 ? site.folderId : await folderFromListing(credentials, site.siteId, site.subdomain);
+  return {
+    siteId: site.siteId,
+    subdomain: site.subdomain,
+    url: site.url,
+    name: site.name,
+    status: enumName(site.status),
+    invitedOnly,
+    liveDeployId: site.liveDeployId,
+    spaMode: site.spaMode,
+    docsMode: site.docsMode,
+    modeIsManual: site.modeIsManual,
+    passwordProtected: site.passwordProtected,
+    passwordProtectionAvailable: site.passwordProtectionAvailable,
+    formsEnabled: site.formsEnabled,
+    formsAvailable: site.formsAvailable,
+    expiresAt: site.expiresAt,
+    expiryAction: actionOf(site.expiresAt, site.expiryAction ?? ""),
+    scheduledExpiryAvailable: site.scheduledExpiryAvailable,
+    comments: audienceOf(site.commentAudience),
+    commentsAvailable: site.feedbackAvailable === true,
+    folderId,
+    deploys: site.deploys.map((deploy2) => ({
+      deployId: deploy2.deployId,
+      status: deploy2.status,
+      fileCount: deploy2.fileCount,
+      totalBytes: deploy2.totalBytes,
+      createdAt: deploy2.createdAt,
+      completedAt: deploy2.completedAt,
+      filesKept: deploy2.filesKept
+    })),
+    subdomainChangesLeft: site.subdomainChangesLeft ?? null,
+    formerSubdomains: (site.formerSubdomains ?? []).map((former) => former.subdomain)
   };
-  const worker = async () => {
-    for (; ; ) {
-      if (failed) return;
-      const index = nextIndex++;
-      const target = targets[index];
-      if (target === void 0) return;
-      const file = byPath.get(target.path);
-      if (file === void 0) {
-        failed = true;
-        throw new DeployError(
-          ClientErrorCode.UploadFailed,
-          `The server asked for ${target.path}, which is not in the manifest.`,
-          { path: target.path }
-        );
-      }
-      const size = sizeOf(file.bytes);
-      await acquire(size);
-      try {
-        if (failed) return;
-        signal?.throwIfAborted();
-        await uploadOne(target, file, {
-          put,
-          delay,
-          retries,
-          signal,
-          uploadUrl,
-          stallMs,
-          onSent: (sent) => {
-            inFlight.set(index, sent);
-            report();
-          },
-          onRetry: (attempt, stalled) => {
-            inFlight.set(index, 0);
-            onRetry?.(target.path, attempt, retries + 1, stalled);
-          }
-        });
-      } catch (error) {
-        failed = true;
-        throw error;
-      } finally {
-        release(size);
-      }
-      inFlight.delete(index);
-      done += 1;
-      landedBytes += size;
-      report(file.path);
-    }
+}
+async function changeSubdomain(credentials, siteId, subdomain) {
+  const changed = await call(credentials, `sites/${encodeURIComponent(siteId)}/subdomain`, {
+    method: "POST",
+    body: JSON.stringify({ subdomain })
+  });
+  return {
+    ...changed,
+    formerSubdomains: changed.formerSubdomains.map((former) => former.subdomain)
   };
-  const workers = Array.from({ length: Math.min(concurrency, targets.length) }, worker);
-  try {
-    await Promise.all(workers);
-  } catch (error) {
-    throw asDeployError(error);
+}
+async function updateSiteSettings(credentials, siteId, change) {
+  const body = {};
+  if (change.name !== void 0) body.name = change.name;
+  if (change.mode !== void 0) {
+    body.spaMode = change.mode === "spa";
+    body.docsMode = change.mode === "docs";
   }
+  if (change.password !== void 0) body.password = change.password;
+  if (change.expiresAt !== void 0) body.expiresAt = change.expiresAt;
+  if (change.expiryAction !== void 0) body.expiryAction = change.expiryAction;
+  if (change.formsEnabled !== void 0) body.formsEnabled = change.formsEnabled;
+  if (change.folderId !== void 0) body.folderId = change.folderId;
+  if (change.invitedOnly !== void 0) body.invitedOnly = change.invitedOnly;
+  if (change.comments !== void 0) body.commentAudience = API_AUDIENCE[change.comments];
+  if (Object.keys(body).length === 0) throw new Error("Nothing to change — name a setting.");
+  const wasInvitedOnly = change.password !== void 0 && change.password !== "" ? await readInvitedOnly(credentials, siteId) : null;
+  const { commentAudience, ...settings } = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  const invitedOnly = typeof settings.invitedOnly === "boolean" ? settings.invitedOnly : null;
+  return {
+    ...settings,
+    expiryAction: actionOf(settings.expiresAt, settings.expiryAction ?? ""),
+    invitedOnly,
+    comments: audienceOf(commentAudience),
+    replacedInviteOnly: wasInvitedOnly === true && invitedOnly === false
+  };
+}
+const API_AUDIENCE = {
+  off: "Off",
+  invited: "Invited",
+  anyone: "Anyone"
+};
+function audienceOf(value) {
+  const lower = value?.toLowerCase();
+  return lower === "off" || lower === "invited" || lower === "anyone" ? lower : null;
+}
+async function setSitePaused(credentials, siteId, action) {
+  const state = await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/${action}`,
+    { method: "POST" }
+  );
+  return {
+    siteId: state.siteId,
+    subdomain: state.subdomain,
+    status: enumName(state.status),
+    ownerPaused: state.ownerPaused
+  };
 }
-async function uploadOne(target, file, context) {
-  let lastError;
-  for (let attempt = 0; attempt <= context.retries; attempt++) {
-    context.signal?.throwIfAborted();
-    if (attempt > 0) {
-      context.onRetry(attempt + 1, lastError instanceof StalledError);
-      await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
-      context.signal?.throwIfAborted();
+async function listTokens(credentials) {
+  const body = await call(credentials, "tokens");
+  return body.tokens;
+}
+const SITES_PER_REQUEST = 100;
+async function listSites(credentials) {
+  const body = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}`
+  );
+  return { sites: body.sites, total: body.total };
+}
+async function createSite(credentials, subdomain, folderId) {
+  const created = await call(
+    credentials,
+    "sites",
+    {
+      method: "POST",
+      // Absent fields rather than null ones, because the API reads null, empty and missing the same
+      // way and a body carrying only what was asked for is the one that reads correctly in a log.
+      body: JSON.stringify({
+        ...subdomain === void 0 ? {} : { subdomain },
+        ...folderId === void 0 ? {} : { folderId }
+      })
     }
-    try {
-      const status = await context.put({
-        url: context.uploadUrl,
-        token: target.token,
-        body: untyped(file.bytes),
-        signal: context.signal,
-        onSent: context.onSent,
-        stallMs: context.stallMs
-      });
-      if (status >= 200 && status < 300) return;
-      if (status === 401 || status === 403 || status === 429) {
-        throw new DeployError(
-          ClientErrorCode.UploadFailed,
-          `Upload of ${target.path} was refused. The upload window may have expired — try deploying again.`,
-          { path: target.path, status }
-        );
-      }
-      if (status === 413) {
-        throw new DeployError(
-          ClientErrorCode.UploadFailed,
-          `${target.path} is too large to upload in one request. Make it smaller, or leave it out of this publish.`,
-          { path: target.path, status }
-        );
-      }
-      lastError = new Error(`HTTP ${status}`);
-    } catch (error) {
-      if (error instanceof DeployError) throw error;
-      if (isAbort(error)) throw cancelled();
-      lastError = error;
+  );
+  return { ...created, name: null };
+}
+async function listFolders(credentials) {
+  const body = await call(credentials, "site-folders");
+  const byId = new Map(body.folders.map((folder) => [folder.folderId, folder]));
+  const pathOf = (folderId) => {
+    const names = [];
+    let cursor = byId.get(folderId);
+    while (cursor !== void 0 && names.length <= byId.size) {
+      names.unshift(cursor.name);
+      cursor = cursor.parentId === null ? void 0 : byId.get(cursor.parentId);
     }
+    return names.join("/");
+  };
+  return body.folders.map((folder) => ({ folderId: folder.folderId, path: pathOf(folder.folderId) })).sort((a, b) => a.path.localeCompare(b.path));
+}
+function comparablePath(path) {
+  return path.split("/").map((name) => name.trim()).filter((name) => name !== "").join("/").toLowerCase();
+}
+const FOLDERS_LISTED_ON_MISS = 20;
+async function resolveFolder(credentials, folder) {
+  const wanted = comparablePath(folder);
+  if (wanted === "") {
+    throw new Error(
+      `"${folder}" does not name a folder. Leave the folder out to put the site at the top level.`
+    );
   }
-  const message = lastError instanceof StalledError ? `Upload of ${target.path} stopped moving and did not recover after ${context.retries + 1} attempts. Check your connection and try again.` : `Could not upload ${target.path} after ${context.retries + 1} attempts.`;
-  throw new DeployError(ClientErrorCode.UploadFailed, message, {
-    path: target.path,
-    cause: describeError(lastError)
-  });
+  const folders2 = await listFolders(credentials);
+  const byId = folders2.find((candidate) => candidate.folderId.toLowerCase() === wanted);
+  if (byId !== void 0) return byId.folderId;
+  const matches = folders2.filter((candidate) => comparablePath(candidate.path) === wanted);
+  if (matches.length === 1 && matches[0] !== void 0) return matches[0].folderId;
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one folder is at "${folder}", because a folder name can contain "/". Name it by id instead: ${matches.map((match) => match.folderId).join(", ")}.`
+    );
+  }
+  if (folders2.length === 0) {
+    throw new Error(
+      `No folder of yours is called "${folder}" — this account has no folders yet. Make one in the dashboard at ${dashboardUrlFor(credentials.apiBaseUrl)}, or leave the folder out.`
+    );
+  }
+  const listed = folders2.slice(0, FOLDERS_LISTED_ON_MISS).map((candidate) => candidate.path);
+  const more = folders2.length - listed.length;
+  throw new Error(
+    `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
+  );
 }
-function untyped(content) {
-  if (ArrayBuffer.isView(content) || content.type === "") return content;
-  return content.slice(0, content.size);
+const ROOT_FOLDER = "root";
+async function resolveFolderTarget(credentials, folder) {
+  return folder.trim().toLowerCase() === ROOT_FOLDER ? ROOT_FOLDER : await resolveFolder(credentials, folder);
 }
-function defaultTransport(doFetch) {
-  if (doFetch !== void 0) return fetchTransport(doFetch);
-  const Xhr = globalThis.XMLHttpRequest;
-  return Xhr === void 0 ? fetchTransport(globalFetch()) : xhrTransport(Xhr);
+async function listComments(credentials, siteId, query = {}) {
+  const search = new URLSearchParams();
+  if (query.status !== void 0) search.set("status", query.status);
+  if (query.path !== void 0) search.set("path", query.path);
+  if (query.since !== void 0) search.set("since", String(query.since));
+  if (query.page !== void 0) search.set("page", String(query.page));
+  const encoded = search.toString();
+  const suffix = encoded === "" ? "" : `?${encoded}`;
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads${suffix}`
+  );
 }
-function fetchTransport(doFetch) {
-  return async ({ url, token, body, signal }) => {
-    const response = await doFetch(url, {
-      method: "PUT",
-      // The view, not a copy. Wrapping it in `new Blob([body.slice().buffer])` made two extra
-      // full-size copies of every file in flight — eight at once, so up to 400 MB on a drop of
-      // 50 MB files. `fetch` sends exactly the range a view covers. The cast is TypeScript's
-      // SharedArrayBuffer distinction again; see `sha256Hex`. A `Blob` goes as it is, and the runtime
-      // streams it from disk.
-      body,
-      // The permit is the whole request. `Content-Length` is required by the Worker and cannot be
-      // set here — it is a forbidden header name — but the runtime derives it from the body, which
-      // is exactly the length the token names.
-      headers: { Authorization: `Bearer ${token}` },
-      ...signal ? { signal } : {}
-    });
-    return response.status;
+async function replyToComment(credentials, siteId, threadId, body, resolve2 = false) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/comments`,
+    { method: "POST", body: JSON.stringify({ body, resolve: resolve2 }) }
+  );
+}
+async function setCommentResolved(credentials, siteId, threadId, resolved) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/${resolved ? "resolve" : "reopen"}`,
+    { method: "POST" }
+  );
+}
+const PEOPLE_PER_REQUEST = 50;
+async function listPeople(credentials, siteId) {
+  const page = await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers?pageSize=${PEOPLE_PER_REQUEST}`);
+  return {
+    invitedOnly: page.invitedOnly,
+    total: page.total,
+    limit: page.limit,
+    people: page.viewers.map((row) => ({
+      email: row.email,
+      role: enumName(row.role),
+      owner: row.owner,
+      status: enumName(row.status)
+    }))
   };
 }
-function xhrTransport(Xhr) {
-  return ({ url, token, body, signal, onSent, stallMs }) => new Promise((resolve2, reject) => {
-    const xhr = new Xhr();
-    let settled = false;
-    let timer;
-    const settle = (finish) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", onAbort);
-      finish();
-    };
-    const arm = () => {
-      clearTimeout(timer);
-      timer = setTimeout(() => {
-        xhr.abort();
-        settle(() => reject(new StalledError(Math.round(stallMs / 1e3))));
-      }, stallMs);
-    };
-    function onAbort() {
-      xhr.abort();
-      settle(() => reject(abortReason(signal)));
+async function invitePeople(credentials, siteId, emails, role) {
+  return await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers`, {
+    method: "POST",
+    body: JSON.stringify({ emails, role: role === "comment" ? "Comment" : "View", notify: true })
+  });
+}
+async function removePerson(credentials, siteId, email) {
+  await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/viewers?email=${encodeURIComponent(email)}`,
+    { method: "DELETE" }
+  );
+}
+function describeMode(result) {
+  if (result.mode === null) return null;
+  if (result.nestedIndex !== null) {
+    return `Served as documents: there is no index.html at the top, but ${result.nestedIndex}/index.html is there. To publish the website, publish the ${result.nestedIndex} folder instead.`;
+  }
+  if (result.mode === "docs") return "Served as documents, in the documents reader.";
+  if (result.mode === "spa") return "Served as a single-page app.";
+  return "Served as a static site.";
+}
+async function ownSiteAt(credentials, subdomain) {
+  const found = await lookUpSite(credentials, subdomain);
+  return found?.subdomain.toLowerCase() === subdomain.trim().toLowerCase() ? found : void 0;
+}
+async function resolveSite(credentials, site, newSite) {
+  const { subdomain, folder } = newSite;
+  if (site !== void 0 && subdomain !== void 0) {
+    throw new Error(
+      "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
+    );
+  }
+  if (site !== void 0 && folder !== void 0) {
+    throw new Error(
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site with `drop2run set folder` or the `update_site` tool's `folder`."
+    );
+  }
+  if (site === void 0) {
+    const folderId = folder === void 0 ? void 0 : await resolveFolder(credentials, folder);
+    const held = subdomain === void 0 ? void 0 : await ownSiteAt(credentials, subdomain);
+    if (held !== void 0) {
+      if (held.liveDeployId === null) return held;
+      throw new Error(
+        `You already have a site at ${held.subdomain}, and it is live. To replace what it serves, publish to it as an existing site (the \`site\` argument, or \`--site\` on the command line); to make a new site, choose another subdomain.`
+      );
+    }
+    return await createSite(credentials, subdomain, folderId);
+  }
+  const found = await lookUpSite(credentials, site);
+  if (found === void 0) {
+    throw new Error(
+      `No site of yours is called "${site}". Leave the site out to publish to a new one, or list your sites to see what exists.`
+    );
+  }
+  return found;
+}
+async function publish(credentials, source, site, onProgress, newSite = {}) {
+  const target = await resolveSite(credentials, site, newSite);
+  let files = 0;
+  let url = target.url;
+  let unchanged = false;
+  let mode = null;
+  let paths = [];
+  let failure2 = null;
+  let failureCode;
+  let failureDetail;
+  const record = (event) => {
+    if (event.type === "collecting") files = event.files;
+    if (event.type === "unchanged") {
+      unchanged = true;
+      url = event.url || target.url;
     }
-    if (signal?.aborted) {
-      reject(abortReason(signal));
-      return;
+    if (event.type === "done") {
+      url = event.url;
+      mode = event.mode;
     }
-    signal?.addEventListener("abort", onAbort, { once: true });
-    xhr.open("PUT", url);
-    xhr.setRequestHeader("Authorization", `Bearer ${token}`);
-    xhr.upload.onprogress = (event) => {
-      arm();
-      onSent(event.loaded);
-    };
-    xhr.onprogress = arm;
-    xhr.onload = () => settle(() => resolve2(xhr.status));
-    xhr.onerror = () => settle(() => reject(new TypeError("Network error during upload.")));
-    arm();
-    xhr.send(body);
+    if (event.type === "error") {
+      failure2 = event.message;
+      failureCode = event.code;
+      failureDetail = event.detail;
+    }
+    onProgress?.(event);
+  };
+  const watched = async (signal, onRead) => {
+    const collected = await source(signal, onRead);
+    paths = collected.map((file) => file.path);
+    return collected;
+  };
+  await deploy(watched, target.siteId, record, void 0, {
+    baseUrl: credentials.apiBaseUrl,
+    token: credentials.token,
+    ...credentials.headers === void 0 ? {} : { headers: credentials.headers }
+  }).catch((error) => {
+    const thrown = new Error(
+      failure2 ?? (error instanceof Error ? error.message : String(error))
+    );
+    thrown.detail = failureDetail ?? error?.detail;
+    thrown.code = failureCode ?? error?.code;
+    throw thrown;
   });
+  return {
+    url,
+    siteId: target.siteId,
+    subdomain: target.subdomain,
+    files,
+    unchanged,
+    mode,
+    nestedIndex: mode === "docs" ? nestedIndexOf(paths) : null
+  };
 }
-function abortReason(signal) {
-  const reason = signal?.reason;
-  if (reason instanceof Error) return reason;
-  const error = new Error("Aborted.");
-  error.name = "AbortError";
-  return error;
-}
-function globalFetch() {
-  return globalThis.fetch.bind(globalThis);
+const MAX_FILES = 2e4;
+function directorySource(root) {
+  return async () => {
+    const base = await realpath(root);
+    const files = [];
+    await walk(base, base, files);
+    return files;
+  };
 }
-function defaultDelay(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+async function walk(root, directory, into) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const full = join(directory, entry.name);
+    const path = relative(root, full).split(sep).join("/");
+    if (shouldIgnore(path)) continue;
+    if (entry.isSymbolicLink()) {
+      const target = await realpath(full).catch(() => null);
+      if (target === null || escapesRoot(root, target)) continue;
+      const targeted = await stat(target);
+      if (targeted.isDirectory()) {
+        await walk(root, target, into);
+        continue;
+      }
+      if (!targeted.isFile()) continue;
+    } else if (entry.isDirectory()) {
+      await walk(root, full, into);
+      continue;
+    } else if (!entry.isFile()) {
+      continue;
+    }
+    if (into.length >= MAX_FILES) {
+      throw new Error(
+        `This folder holds more than ${MAX_FILES.toLocaleString()} files. Publish a build output directory rather than a whole project.`
+      );
+    }
+    into.push({ path, bytes: new Uint8Array(await readFile(full)) });
+  }
 }
-function isAbort(error) {
-  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+function escapesRoot(root, candidate) {
+  const inside = relative(root, candidate);
+  return inside === "" || inside.startsWith("..");
 }
-function cancelled() {
-  return new DeployError(ClientErrorCode.Cancelled, "Deploy cancelled.");
+async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
+  const found = await stat(directory).catch(() => null);
+  if (found === null) throw new Error(`There is no folder at ${directory}.`);
+  if (!found.isDirectory()) throw new Error(`${directory} is a file, not a folder to publish.`);
+  return await publish(credentials, directorySource(directory), site, onProgress, newSite);
 }
-function outOfMemory(detail) {
-  return new DeployError(
-    ClientErrorCode.OutOfMemory,
-    "This browser ran out of memory reading what you dropped. Drop the unzipped folder instead, or try again in a desktop browser with fewer tabs open.",
-    detail
-  );
+const TIMEOUT_MS = 5 * 60 * 1e3;
+function newAttempt() {
+  const verifier = randomBytes(32).toString("base64url");
+  return {
+    verifier,
+    challenge: createHash("sha256").update(verifier).digest("base64url"),
+    state: randomBytes(16).toString("base64url")
+  };
 }
-function asDeployError(error) {
-  if (error instanceof DeployError) return error;
-  if (isAbort(error)) return cancelled();
-  if (error instanceof RangeError) return outOfMemory(error.message);
-  return new DeployError(
-    ClientErrorCode.UploadFailed,
-    error instanceof Error ? error.message : "Upload failed.",
-    error
-  );
+function clientName(surface) {
+  const clean2 = (value) => value.trim().replace(/[^A-Za-z0-9._-]/g, "-");
+  const label = "";
+  const raw = clean2(hostname()).slice(0, 64 - label.length);
+  return `${raw === "" ? "drop2run" : raw}${label}`;
 }
-async function deploy(source, siteId, onProgress, signal, options = {}) {
+function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    onProgress({ type: "reading", bytes: 0, total: 0 });
-    const collected = await source(
-      signal,
-      (bytes, total) => onProgress({ type: "reading", bytes, total })
-    );
-    onProgress({ type: "collecting", files: collected.length });
-    const rename = renameOfLoneHtmlPage(collected.map((file) => file.path));
-    const files = rename === null ? collected : collected.map((file) => file.path === rename ? { ...file, path: "index.html" } : file);
-    const hashed = await hashAll(
-      files,
-      (done, total) => onProgress({ type: "hashing", done, total }),
-      signal
-    );
-    checkLimits(hashed, options.limits ?? null);
-    onProgress({ type: "preparing" });
-    const prepared = await prepareDeploy(siteId, hashed, options, signal);
-    if (prepared.unchanged) {
-      onProgress({ type: "unchanged", url: prepared.url ?? "" });
-      return;
-    }
-    const sizes = new Map(hashed.map((file) => [file.path, sizeOf(file.bytes)]));
-    const totalBytes = prepared.upload.reduce(
-      (sum, target) => sum + (sizes.get(target.path) ?? 0),
-      0
-    );
-    if (prepared.upload.length > 0) {
-      onProgress({
-        type: "uploading",
-        done: prepared.reused,
-        total: prepared.total,
-        bytes: 0,
-        totalBytes,
-        reused: prepared.reused
-      });
-    }
-    await uploadAll(
-      prepared.upload,
-      prepared.uploadUrl,
-      hashed,
-      (done, _total, bytes, path) => onProgress({
-        type: "uploading",
-        done: prepared.reused + done,
-        total: prepared.total,
-        bytes,
-        totalBytes,
-        reused: prepared.reused,
-        ...path === void 0 ? {} : { path }
-      }),
-      signal,
-      options.upload,
-      (path, attempt, attempts, stalled) => onProgress({ type: "retrying", path, attempt, attempts, stalled })
-    );
-    onProgress({ type: "completing", reused: prepared.reused });
-    const completed = await completeDeploy(
-      siteId,
-      prepared.deployId,
-      options,
-      signal,
-      await readSiteName(files)
-    );
-    onProgress({
-      type: "done",
-      url: completed.url,
-      name: completed.name,
-      mode: servingModeOf(completed),
-      modeIsManual: completed.modeIsManual
+    const child = spawn(command, [...args], { stdio: "ignore", detached: true });
+    child.unref();
+    child.on("error", () => {
     });
-  } catch (error) {
-    const failure2 = asDeployError(error);
-    onProgress({
-      type: "error",
-      code: failure2.code,
-      message: failure2.message,
-      ...failure2.detail === void 0 ? {} : { detail: failure2.detail }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function listen(state) {
+  return new Promise((resolveListener, rejectListener) => {
+    let settle = null;
+    let fail = null;
+    const received = new Promise((resolveCode, rejectCode) => {
+      settle = resolveCode;
+      fail = rejectCode;
+    });
+    const server = createServer((request2, response) => {
+      const url = new URL(request2.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/cb") {
+        response.writeHead(404, { "Content-Type": "text/plain" });
+        response.end("Not found.\n");
+        return;
+      }
+      const code = url.searchParams.get("code") ?? "";
+      const returned = url.searchParams.get("state") ?? "";
+      if (returned !== state || code === "") {
+        respond(
+          response,
+          400,
+          "Sign-in could not be completed",
+          "This did not come from the sign-in that was started here. Nothing has been changed."
+        );
+        fail?.(new Error("The browser returned a response that did not match this sign-in."));
+        return;
+      }
+      respond(response, 200, "Signed in", "You can close this tab now.");
+      settle?.({ code });
+    });
+    server.on("error", (error) => {
+      rejectListener(error);
+      fail?.(error instanceof Error ? error : new Error(String(error)));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (address === null) {
+        rejectListener(new Error("Could not open a local port to receive the sign-in."));
+        return;
+      }
+      resolveListener({
+        port: address.port,
+        received,
+        close: () => server.close()
+      });
     });
-    throw failure2;
-  }
+  });
 }
-const MAX_FILES = 2e4;
-function directorySource(root) {
-  return async () => {
-    const base = await realpath(root);
-    const files = [];
-    await walk(base, base, files);
-    return files;
-  };
+function respond(response, status, title, detail) {
+  response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+  response.end(
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title} — drop2run</title><style>body{font:16px/1.6 system-ui,sans-serif;margin:20vh auto;max-width:28rem;padding:0 1.5rem;color:#12211f}h1{font-size:1.4rem;margin:0 0 .5rem}p{margin:0;color:#64706e}@media(prefers-color-scheme:dark){body{background:#0d1413;color:#e8efee}p{color:#9aa8a6}}</style></head><body><h1>${title}</h1><p>${detail}</p></body></html>
+`
+  );
 }
-async function walk(root, directory, into) {
-  for (const entry of await readdir(directory, { withFileTypes: true })) {
-    const full = join(directory, entry.name);
-    const path = relative(root, full).split(sep).join("/");
-    if (shouldIgnore(path)) continue;
-    if (entry.isSymbolicLink()) {
-      const target = await realpath(full).catch(() => null);
-      if (target === null || escapesRoot(root, target)) continue;
-      const targeted = await stat(target);
-      if (targeted.isDirectory()) {
-        await walk(root, target, into);
-        continue;
-      }
-      if (!targeted.isFile()) continue;
-    } else if (entry.isDirectory()) {
-      await walk(root, full, into);
-      continue;
-    } else if (!entry.isFile()) {
-      continue;
-    }
-    if (into.length >= MAX_FILES) {
-      throw new Error(
-        `This folder holds more than ${MAX_FILES.toLocaleString()} files. Publish a build output directory rather than a whole project.`
-      );
-    }
-    into.push({ path, bytes: new Uint8Array(await readFile(full)) });
+async function waitForCallback(received, timeoutMs = TIMEOUT_MS) {
+  let timer;
+  try {
+    return await Promise.race([
+      received,
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("Timed out waiting for the browser. Nothing has been changed.")),
+          timeoutMs
+        );
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
   }
 }
-function escapesRoot(root, candidate) {
-  const inside = relative(root, candidate);
-  return inside === "" || inside.startsWith("..");
+function consentUrl(dashboardUrl, attempt, port, name) {
+  const url = new URL("/cli-auth", dashboardUrl);
+  url.searchParams.set("challenge", attempt.challenge);
+  url.searchParams.set("state", attempt.state);
+  url.searchParams.set("port", String(port));
+  url.searchParams.set("name", name);
+  return url.toString();
 }
-function describeMode(result) {
-  if (result.mode === null) return null;
-  if (result.nestedIndex !== null) {
-    return `Served as documents: there is no index.html at the top, but ${result.nestedIndex}/index.html is there. To publish the website, publish the ${result.nestedIndex} folder instead.`;
-  }
-  if (result.mode === "docs") return "Served as documents, in the documents reader.";
-  if (result.mode === "spa") return "Served as a single-page app.";
-  return "Served as a static site.";
+async function startDevice(apiBaseUrl, clientName2) {
+  const response = await fetch(`${apiBaseUrl}/auth/cli/device`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientName: clientName2 })
+  });
+  if (!response.ok) throw new Error(await problemDetail(response));
+  return await response.json();
 }
-async function resolveSite(credentials, site, newSite) {
-  const { subdomain, folder } = newSite;
-  if (site !== void 0 && subdomain !== void 0) {
-    throw new Error(
-      "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
-    );
-  }
-  if (site !== void 0 && folder !== void 0) {
-    throw new Error(
-      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site with `drop2run set folder` or the `update_site` tool's `folder`."
-    );
-  }
-  if (site === void 0) {
-    const folderId = folder === void 0 ? void 0 : await resolveFolder(credentials, folder);
-    return await createSite(credentials, subdomain, folderId);
+async function pollDevice(apiBaseUrl, deviceCode) {
+  let response;
+  try {
+    response = await fetch(`${apiBaseUrl}/auth/cli/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ deviceCode })
+    });
+  } catch {
+    return { state: "pending" };
   }
-  const found = await lookUpSite(credentials, site);
-  if (found === void 0) {
-    throw new Error(
-      `No site of yours is called "${site}". Leave the site out to publish to a new one, or list your sites to see what exists.`
-    );
+  if (response.ok) {
+    const body = await response.json();
+    return { state: "granted", token: { token: body.token, name: body.name, email: body.email } };
   }
-  return found;
-}
-async function publish(credentials, source, site, onProgress, newSite = {}) {
-  const target = await resolveSite(credentials, site, newSite);
-  let files = 0;
-  let url = target.url;
-  let unchanged = false;
-  let mode = null;
-  let paths = [];
-  let failure2 = null;
-  let failureDetail;
-  const record = (event) => {
-    if (event.type === "collecting") files = event.files;
-    if (event.type === "unchanged") {
-      unchanged = true;
-      url = event.url || target.url;
-    }
-    if (event.type === "done") {
-      url = event.url;
-      mode = event.mode;
-    }
-    if (event.type === "error") {
-      failure2 = event.message;
-      failureDetail = event.detail;
-    }
-    onProgress?.(event);
-  };
-  const watched = async (signal, onRead) => {
-    const collected = await source(signal, onRead);
-    paths = collected.map((file) => file.path);
-    return collected;
+  const problem = await response.json().catch(() => null);
+  if (problem?.type === "authorization_pending") return { state: "pending" };
+  if (problem?.type === "slow_down") return { state: "slow_down" };
+  return {
+    state: "dead",
+    message: problem?.detail ?? `The API answered ${response.status}.`
   };
-  await deploy(watched, target.siteId, record, void 0, {
-    baseUrl: credentials.apiBaseUrl,
-    token: credentials.token
-  }).catch((error) => {
-    const thrown = new Error(
-      failure2 ?? (error instanceof Error ? error.message : String(error))
-    );
-    thrown.detail = failureDetail ?? error?.detail;
-    throw thrown;
+}
+async function problemDetail(response) {
+  const problem = await response.json().catch(() => null);
+  return problem?.detail ?? `The API answered ${response.status}.`;
+}
+async function exchange(apiBaseUrl, code, verifier) {
+  const response = await fetch(`${apiBaseUrl}/auth/cli/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, verifier })
+  });
+  if (!response.ok) throw new Error(await problemDetail(response));
+  const body = await response.json();
+  return { token: body.token, name: body.name, email: body.email };
+}
+const VERSIONS_LISTED = 10;
+function servingModeOf(site) {
+  if (site.spaMode) return "spa";
+  if (site.docsMode) return "docs";
+  return "static";
+}
+function accessOf(site) {
+  if (site.passwordProtected) return "password";
+  if (site.invitedOnly === true) return "invite-only";
+  if (site.invitedOnly === false) return "public";
+  return "no password (whether it is invite-only could not be read)";
+}
+function addressLines(site) {
+  return [
+    ...site.formerSubdomains.length > 0 ? [`  formerly ${site.formerSubdomains.join(", ")} (redirect here)`] : [],
+    ...site.subdomainChangesLeft === null ? [] : [`  address   ${site.subdomainChangesLeft} change(s) left`]
+  ];
+}
+function describeSite(site, folderPath) {
+  const unavailable = (available) => available ? "" : " (not on this plan)";
+  const versions = site.deploys.slice(0, VERSIONS_LISTED).map((deploy2) => {
+    const live = deploy2.deployId === site.liveDeployId ? " ← served" : "";
+    const kept = deploy2.filesKept ? "" : ", files collected — cannot be rolled back to";
+    return `  ${deploy2.deployId}  ${deploy2.createdAt}  ${deploy2.status}, ${deploy2.fileCount} files${kept}${live}`;
   });
+  const more = site.deploys.length - versions.length;
+  return [
+    `${site.subdomain} — ${site.url}`,
+    `  name      ${site.name ?? "(none)"}`,
+    `  status    ${site.status}`,
+    `  access    ${accessOf(site)}`,
+    `  mode      ${servingModeOf(site)}${site.modeIsManual ? "" : " (detected on each publish)"}`,
+    `  password  ${site.passwordProtected ? "on" : "off"}${unavailable(site.passwordProtectionAvailable)}`,
+    `  forms     ${site.formsEnabled ? "on" : "off"}${unavailable(site.formsAvailable)}`,
+    `  comments  ${site.comments ?? "unknown"}${unavailable(site.commentsAvailable)}`,
+    `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
+    `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
+    ...addressLines(site),
+    "",
+    site.deploys.length === 0 ? "No versions yet." : "Versions, newest first:",
+    ...versions,
+    ...more > 0 ? [`  … and ${more} older`] : []
+  ].join("\n");
+}
+const PROJECT_FILE = "drop2run.json";
+function projectPath(directory = process.cwd()) {
+  return join(directory, PROJECT_FILE);
+}
+function readProject(directory = process.cwd(), read = (path) => readFileSync(path, "utf8")) {
+  let parsed;
+  try {
+    parsed = JSON.parse(read(projectPath(directory)));
+  } catch {
+    return null;
+  }
+  if (typeof parsed.siteId !== "string" || parsed.siteId === "") return null;
   return {
-    url,
-    siteId: target.siteId,
-    subdomain: target.subdomain,
-    files,
-    unchanged,
-    mode,
-    nestedIndex: mode === "docs" ? nestedIndexOf(paths) : null
+    siteId: parsed.siteId,
+    subdomain: typeof parsed.subdomain === "string" ? parsed.subdomain : "",
+    dir: typeof parsed.dir === "string" && parsed.dir !== "" ? parsed.dir : "."
   };
 }
-async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
-  const found = await stat(directory).catch(() => null);
-  if (found === null) throw new Error(`There is no folder at ${directory}.`);
-  if (!found.isDirectory()) throw new Error(`${directory} is a file, not a folder to publish.`);
-  return await publish(credentials, directorySource(directory), site, onProgress, newSite);
+function writeProject(project, directory = process.cwd()) {
+  const path = projectPath(directory);
+  writeFileSync(path, `${JSON.stringify(project, null, "	")}
+`);
+  return path;
 }
 const silentProgress = Object.assign(() => {
 }, { done: () => {
@@ -2530,7 +2812,7 @@ async function info(site) {
     )?.path;
     return {
       text: describeSite(detail, folderPath),
-      json: { ...detail, mode: servingModeOf$1(detail), folderPath: folderPath ?? null },
+      json: { ...detail, mode: servingModeOf(detail), folderPath: folderPath ?? null },
       code: 0
     };
   } catch (error) {
@@ -2567,7 +2849,8 @@ const SETTINGS_USAGE = [
   "  expires <ISO 8601 instant>  When it comes down; add --then delete to delete rather than pause",
   "  folder <path|id|root>       Which folder it is filed in",
   "  invite-only on|off          Whether only the people on its list can open it",
-  "  comments off|invited|anyone Who may comment on its pages"
+  "  comments off|invited|anyone Who may comment on its pages",
+  "  subdomain <name>            Its address; needs --yes, the old one keeps redirecting"
 ].join("\n");
 function settingChange(setting, values, then) {
   const value = setting === "name" ? values.join(" ").trim() : values[0];
@@ -2615,6 +2898,8 @@ function settingChange(setting, values, then) {
     }
     case "folder":
       return value ? { folder: value } : needs("Clients/Acme");
+    case "subdomain":
+      return value ? { subdomain: value } : needs("tidy-otter --yes");
     case "invite-only":
       if (value === "on" || value === "off") return { change: { invitedOnly: value === "on" } };
       return { refusal: "`set invite-only` takes `on` or `off`." };
@@ -2640,6 +2925,15 @@ async function set(site, setting, values, options, readPassword = () => readSecr
   try {
     const summary = await findSite(found.credentials, target.named);
     let change;
+    if ("subdomain" in parsed) {
+      return await moved(
+        found.credentials,
+        summary.siteId,
+        summary.subdomain,
+        parsed.subdomain,
+        options.confirmed
+      );
+    }
     if ("folder" in parsed) {
       change = { folderId: await resolveFolderTarget(found.credentials, parsed.folder) };
     } else if ("password" in parsed) {
@@ -2662,6 +2956,29 @@ Add --yes if that is what you want, or leave out --then to pause it instead.`
     return failure(error instanceof Error ? error.message : String(error));
   }
 }
+async function moved(credentials, siteId, current, wanted, confirmed) {
+  if (!confirmed) {
+    const site = await getSite(credentials, siteId);
+    const left2 = site.subdomainChangesLeft === null ? "Your plan does not limit how often it changes." : `It spends one of the ${site.subdomainChangesLeft} address change(s) this site has left, a change back to an old name included.`;
+    return failure(
+      `This moves ${current} to ${wanted}. ${current} keeps working and redirects there, and nobody else can take it. ${left2}
+Add --yes if that is what you want.`
+    );
+  }
+  const change = await changeSubdomain(credentials, siteId, wanted);
+  const project = readProject();
+  if (project?.siteId === siteId && project.subdomain !== change.subdomain) {
+    writeProject({ ...project, subdomain: change.subdomain });
+  }
+  const left = change.subdomainChangesLeft === null ? "" : `
+${change.subdomainChangesLeft} address change(s) left.`;
+  return {
+    text: `${current} is now ${change.url}
+The old address redirects there.${left}`,
+    json: change,
+    code: 0
+  };
+}
 async function unset(site, setting, extra = []) {
   if (extra.length > 0) {
     return failure(
@@ -2698,7 +3015,7 @@ async function applied(credentials, siteId, subdomain, change) {
       `Updated ${subdomain}.`,
       `  name      ${settings.name ?? "(none)"}`,
       `  access    ${accessOf(settings)}`,
-      `  mode      ${servingModeOf$1(settings)}`,
+      `  mode      ${servingModeOf(settings)}`,
       `  forms     ${settings.formsEnabled ? "on" : "off"}`,
       `  comments  ${settings.comments ?? "unknown"}`,
       `  takedown  ${takedown}`,
@@ -2711,7 +3028,7 @@ async function applied(credentials, siteId, subdomain, change) {
       ] : [],
       settings.live ? "Reaching every edge takes up to about a minute." : "Nothing is published yet, so this applies from the first publish."
     ].join("\n"),
-    json: { ...settings, mode: servingModeOf$1(settings) },
+    json: { ...settings, mode: servingModeOf(settings) },
     code: 0
   };
 }
@@ -3058,7 +3375,7 @@ async function run(commandLine) {
   const positional = [...positionals(argv), ...literal];
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-CGI7Yt81.js").then(
+    const { version } = await import("./package-DgeW4aj9.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };