drop2run 0.4.1 → 0.6.0

package/README.md

@@ -1,6 +1,7 @@
 # drop2run
 
-Publish a static site to [Drop2Run](https://dropto.run) from the command line.
+Publish a page, a folder of documents or a built site to [Drop2Run](https://dropto.run) from the
+command line — by hand, from CI, or from a coding agent.
 
 ```bash
 npm i -g drop2run
@@ -17,7 +18,9 @@ drop2run logout                              Remove the stored token
 drop2run init [dir] [--site <subdomain>]     Tie this folder to a site
 drop2run deploy [dir] [--site <subdomain>]   Publish a folder
 drop2run init|deploy --subdomain <name>      Create a new site under a name you pick
+drop2run init|deploy --folder <path>         File the new site in one of your folders
 drop2run ls                                  List your sites
+drop2run folders                             List your folders, as --folder takes them
 drop2run open [site]                         Open a site in a browser
 drop2run rollback <deployId> [--site X]      Put an earlier version back live
 drop2run rm <site> --yes                     Delete a site and everything on it
@@ -51,6 +54,17 @@ which is not undoable.
 `--site` never creates anything: it finds a site you already have, and fails when nothing matches. That
 is what keeps a subdomain typed one letter wrong from quietly becoming a second site.
 
+`--folder` files the site being created in one of your dashboard folders — by path, as `drop2run folders`
+prints it, or by folder id:
+
+```bash
+drop2run init dist --folder Clients/Acme
+```
+
+Case does not matter. It never creates a folder and never moves an existing site, so it cannot be given
+with `--site`, or to `deploy` in a project whose `drop2run.json` already names a site; a folder that does
+not exist is refused with the list of those that do, before any site is made.
+
 `deploy` never creates a second site while a `drop2run.json` sits next to it — that would leave the real
 site untouched and you looking at a URL you did not expect.
 

package/dist/index.js

@@ -5,70 +5,6 @@ import { spawn } from "node:child_process";
 import { randomBytes, createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { realpath, readdir, stat, readFile } from "node:fs/promises";
-async function call(credentials, path, init2 = {}) {
-  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
-    ...init2,
-    headers: {
-      ...init2.headers,
-      Authorization: `Bearer ${credentials.token}`,
-      ...init2.body === void 0 ? {} : { "Content-Type": "application/json" }
-    }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-  return await response.json();
-}
-async function findSite(credentials, site) {
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
-  if (found === void 0) {
-    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
-  }
-  return found;
-}
-async function deleteSite(credentials, siteId) {
-  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
-    method: "DELETE",
-    headers: { Authorization: `Bearer ${credentials.token}` }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-}
-async function promoteDeploy(credentials, siteId, deployId) {
-  return await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
-    { method: "POST" }
-  );
-}
-async function listTokens(credentials) {
-  const body = await call(credentials, "tokens");
-  return body.tokens;
-}
-async function listSites(credentials) {
-  const body = await call(credentials, "sites");
-  return body.sites;
-}
-async function createSite(credentials, subdomain) {
-  const created = await call(
-    credentials,
-    "sites",
-    {
-      method: "POST",
-      // An absent field rather than a null one, because the API reads null, empty and missing the
-      // same way and a body carrying only what was asked for is the one that reads correctly in a
-      // log.
-      body: JSON.stringify(subdomain === void 0 ? {} : { subdomain })
-    }
-  );
-  return { ...created, name: null };
-}
 const TOKEN_VARIABLE = "DROP2RUN_TOKEN";
 function configPath() {
   return join(homedir(), ".config", "drop2run", "config.json");
@@ -161,6 +97,142 @@ function missingCredentialsMessage(surface = "cli") {
     "The token is shown once when it is created and cannot be recovered afterwards."
   ].join("\n");
 }
+async function call(credentials, path, init2 = {}) {
+  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
+    ...init2,
+    headers: {
+      ...init2.headers,
+      Authorization: `Bearer ${credentials.token}`,
+      ...init2.body === void 0 ? {} : { "Content-Type": "application/json" }
+    }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  return await response.json();
+}
+async function findSite(credentials, site) {
+  const found = await lookUpSite(credentials, site);
+  if (found === void 0) {
+    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+  }
+  return found;
+}
+const SITE_ID_SHAPE = /^[0-9a-z]{26}$/i;
+async function lookUpSite(credentials, site) {
+  const wanted = site.trim().toLowerCase();
+  if (wanted === "") return void 0;
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(wanted)}`
+  );
+  const bySubdomain = sites.find((candidate) => candidate.subdomain.toLowerCase() === wanted);
+  if (bySubdomain !== void 0) return bySubdomain;
+  if (!SITE_ID_SHAPE.test(wanted)) return void 0;
+  const response = await fetch(
+    `${credentials.apiBaseUrl}/sites/${encodeURIComponent(wanted.toUpperCase())}`,
+    { headers: { Authorization: `Bearer ${credentials.token}` } }
+  );
+  if (response.status === 404) return void 0;
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  const detail = await response.json();
+  return { siteId: detail.siteId, subdomain: detail.subdomain, url: detail.url, name: detail.name };
+}
+async function deleteSite(credentials, siteId) {
+  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${credentials.token}` }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+}
+async function promoteDeploy(credentials, siteId, deployId) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
+    { method: "POST" }
+  );
+}
+async function listTokens(credentials) {
+  const body = await call(credentials, "tokens");
+  return body.tokens;
+}
+const SITES_PER_REQUEST = 100;
+async function listSites(credentials) {
+  const body = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}`
+  );
+  return { sites: body.sites, total: body.total };
+}
+async function createSite(credentials, subdomain, folderId) {
+  const created = await call(
+    credentials,
+    "sites",
+    {
+      method: "POST",
+      // Absent fields rather than null ones, because the API reads null, empty and missing the same
+      // way and a body carrying only what was asked for is the one that reads correctly in a log.
+      body: JSON.stringify({
+        ...subdomain === void 0 ? {} : { subdomain },
+        ...folderId === void 0 ? {} : { folderId }
+      })
+    }
+  );
+  return { ...created, name: null };
+}
+async function listFolders(credentials) {
+  const body = await call(credentials, "site-folders");
+  const byId = new Map(body.folders.map((folder) => [folder.folderId, folder]));
+  const pathOf = (folderId) => {
+    const names = [];
+    let cursor = byId.get(folderId);
+    while (cursor !== void 0 && names.length <= byId.size) {
+      names.unshift(cursor.name);
+      cursor = cursor.parentId === null ? void 0 : byId.get(cursor.parentId);
+    }
+    return names.join("/");
+  };
+  return body.folders.map((folder) => ({ folderId: folder.folderId, path: pathOf(folder.folderId) })).sort((a, b) => a.path.localeCompare(b.path));
+}
+function comparablePath(path) {
+  return path.split("/").map((name) => name.trim()).filter((name) => name !== "").join("/").toLowerCase();
+}
+const FOLDERS_LISTED_ON_MISS = 20;
+async function resolveFolder(credentials, folder) {
+  const wanted = comparablePath(folder);
+  if (wanted === "") {
+    throw new Error(
+      `"${folder}" does not name a folder. Leave the folder out to put the site at the top level.`
+    );
+  }
+  const folders2 = await listFolders(credentials);
+  const byId = folders2.find((candidate) => candidate.folderId.toLowerCase() === wanted);
+  if (byId !== void 0) return byId.folderId;
+  const matches = folders2.filter((candidate) => comparablePath(candidate.path) === wanted);
+  if (matches.length === 1 && matches[0] !== void 0) return matches[0].folderId;
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one folder is at "${folder}", because a folder name can contain "/". Name it by id instead: ${matches.map((match) => match.folderId).join(", ")}.`
+    );
+  }
+  if (folders2.length === 0) {
+    throw new Error(
+      `No folder of yours is called "${folder}" — this account has no folders yet. Make one in the dashboard at ${dashboardUrlFor(credentials.apiBaseUrl)}, or leave the folder out.`
+    );
+  }
+  const listed = folders2.slice(0, FOLDERS_LISTED_ON_MISS).map((candidate) => candidate.path);
+  const more = folders2.length - listed.length;
+  throw new Error(
+    `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
+  );
+}
 const TIMEOUT_MS = 5 * 60 * 1e3;
 function newAttempt() {
   const verifier = randomBytes(32).toString("base64url");
@@ -439,6 +511,485 @@ async function problemToError(response) {
   const message = typeof problem.detail === "string" ? problem.detail : typeof problem.title === "string" ? problem.title : `The server responded with ${response.status}.`;
   return new DeployError(code, message, problem);
 }
+const FILE_TYPES = [
+  // Documents. The three extensions that make a folder a documents site.
+  {
+    ext: ".md",
+    mime: "text/markdown; charset=utf-8",
+    kind: "markdown",
+    document: true,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".markdown",
+    mime: "text/markdown; charset=utf-8",
+    kind: "markdown",
+    document: true,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".pdf",
+    mime: "application/pdf",
+    kind: "pdf",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  // Office documents and ebooks. Each has its own kind because each needs its own renderer, loaded
+  // only when one is opened — `.docx` through mammoth, `.xlsx` through read-excel-file, `.epub`
+  // through foliate-js.
+  {
+    ext: ".docx",
+    mime: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    kind: "docx",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  {
+    ext: ".xlsx",
+    mime: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    kind: "xlsx",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  {
+    ext: ".epub",
+    mime: "application/epub+zip",
+    kind: "epub",
+    document: true,
+    reader: true,
+    editable: false
+  },
+  // Prose the reader shows preformatted.
+  {
+    ext: ".txt",
+    mime: "text/plain; charset=utf-8",
+    kind: "text",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".log",
+    mime: "text/plain; charset=utf-8",
+    kind: "text",
+    document: false,
+    reader: true,
+    editable: false
+  },
+  {
+    ext: ".csv",
+    mime: "text/csv; charset=utf-8",
+    kind: "text",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  // Structured text. Read through the reader inside a folder of notes, which is why these carry
+  // `reader: true` while the source formats below do not.
+  {
+    ext: ".json",
+    mime: "application/json",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".yaml",
+    mime: "text/yaml; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    ext: ".yml",
+    mime: "text/yaml; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  {
+    // No registered media type, so it takes text/plain rather than an invented one. The point is
+    // only that a browser shows it instead of downloading it.
+    ext: ".toml",
+    mime: "text/plain; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: true,
+    editable: true
+  },
+  // Source the viewer highlights. A link straight to one of these hands over the file.
+  {
+    ext: ".css",
+    mime: "text/css; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".js",
+    mime: "text/javascript; charset=utf-8",
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".ts",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".tsx",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".jsx",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".sh",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  // The languages an assistant writes most, beyond the web's own. Same row as `.ts`: shown as source
+  // when somebody opens one in the reader or publishes it on its own, handed over as a file when a
+  // link names it directly, and no media type — adding one changes what a browser does with a
+  // published file, which I10 makes a decision of its own rather than a side effect of this list.
+  {
+    ext: ".py",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".sql",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".go",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".rs",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".java",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".kt",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".swift",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".rb",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".php",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".c",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".h",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".cpp",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".cs",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".r",
+    mime: null,
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".xml",
+    mime: "application/xml",
+    kind: "code",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  // Pictures, shown with an img element.
+  {
+    ext: ".png",
+    mime: "image/png",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".jpg",
+    mime: "image/jpeg",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".jpeg",
+    mime: "image/jpeg",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".gif",
+    mime: "image/gif",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".webp",
+    mime: "image/webp",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".avif",
+    mime: "image/avif",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    // Text, hand-edited in practice, and script-carrying. Editable anyway: the Worker derives the
+    // type at serve time (I10) and already serves whatever was uploaded, so withholding the edit
+    // would withhold nothing else.
+    ext: ".svg",
+    mime: "image/svg+xml",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".ico",
+    mime: "image/x-icon",
+    kind: "image",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  // A customer's own pages. Never rendered inside the reader.
+  {
+    ext: ".html",
+    mime: "text/html; charset=utf-8",
+    kind: "html",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    // ⚠️ No media type, and that is the state of the code rather than a decision: `TYPES` in
+    // `headers.ts` has never held `htm`, so a published `.htm` is served as octet-stream and
+    // downloads instead of rendering. Recorded here rather than fixed, because this table was
+    // introduced as a refactor and a refactor that changes what a URL answers is not one.
+    ext: ".htm",
+    mime: null,
+    kind: "html",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  // Everything below renders as nothing — the viewer offers a download — but still needs a media
+  // type, because these are the files a static site is built out of.
+  {
+    ext: ".mjs",
+    mime: "text/javascript; charset=utf-8",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".cjs",
+    mime: null,
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: true
+  },
+  {
+    ext: ".map",
+    mime: "application/json",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".wasm",
+    mime: "application/wasm",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".woff2",
+    mime: "font/woff2",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".woff",
+    mime: "font/woff",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".ttf",
+    mime: "font/ttf",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".mp4",
+    mime: "video/mp4",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  },
+  {
+    ext: ".webm",
+    mime: "video/webm",
+    kind: "binary",
+    document: false,
+    reader: false,
+    editable: false
+  }
+];
+function extensionsWhere(include) {
+  return FILE_TYPES.filter(include).map((type) => type.ext);
+}
+const DOCUMENT_EXTENSIONS$1 = extensionsWhere((type) => type.document);
+const VIEWABLE_EXTENSIONS$1 = extensionsWhere(
+  (type) => type.kind !== "binary"
+);
+extensionsWhere((type) => type.reader);
+extensionsWhere((type) => type.editable);
+const WEB_ASSET_EXTENSIONS = [
+  ".html",
+  ".htm",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".css"
+];
+const GALLERY_EXTENSIONS = extensionsWhere(
+  (type) => type.kind === "image"
+);
+Object.fromEntries(
+  FILE_TYPES.filter((type) => type.mime !== null).map((type) => [type.ext, type.mime])
+);
+function extensionOf(path) {
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  return dot <= 0 ? "" : name.slice(dot).toLowerCase();
+}
 async function sha256Hex(bytes) {
   const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
@@ -470,52 +1021,29 @@ function shouldIgnore(path) {
   return segments.some((segment) => IGNORED_DIRECTORIES.includes(segment));
 }
 const REQUIRED_INDEX = "index.html";
-const DOCUMENT_EXTENSIONS = [".md", ".markdown", ".pdf"];
+const DOCUMENT_EXTENSIONS = DOCUMENT_EXTENSIONS$1;
 function isDocumentPath(path) {
   const lower = path.toLowerCase();
   return DOCUMENT_EXTENSIONS.some((extension) => lower.endsWith(extension));
 }
-const VIEWABLE_EXTENSIONS = [
-  // Documents — these also count at any depth, via DOCUMENT_EXTENSIONS.
-  ".md",
-  ".markdown",
-  ".pdf",
-  // Prose the reader shows preformatted.
-  ".txt",
-  ".log",
-  ".csv",
-  // Source the reader shows with highlighting.
-  ".json",
-  ".yaml",
-  ".yml",
-  ".toml",
-  ".css",
-  ".js",
-  ".ts",
-  ".tsx",
-  ".jsx",
-  ".sh",
-  ".xml",
-  // Pictures the reader shows with an img element.
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".gif",
-  ".webp",
-  ".avif",
-  ".svg",
-  ".ico",
-  // See the note above: a floor for a caller that did not rename it.
-  ".html",
-  ".htm"
-];
+const VIEWABLE_EXTENSIONS = VIEWABLE_EXTENSIONS$1;
 function isViewablePath(path) {
   const lower = path.toLowerCase();
   return VIEWABLE_EXTENSIONS.some((extension) => lower.endsWith(extension));
 }
+function isImageFolder(paths) {
+  let pictures = false;
+  for (const path of paths) {
+    const ext = extensionOf(path);
+    if (WEB_ASSET_EXTENSIONS.includes(ext)) return false;
+    if (GALLERY_EXTENSIONS.includes(ext)) pictures = true;
+  }
+  return pictures;
+}
 function canPublish(paths) {
   if (paths.some((path) => path === REQUIRED_INDEX)) return true;
   if (paths.some(isDocumentPath)) return true;
+  if (isImageFolder(paths)) return true;
   return paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0]);
 }
 function renameOfLoneHtmlPage(paths) {
@@ -544,37 +1072,42 @@ function checkLimits(files, limits) {
       `A site needs an ${REQUIRED_INDEX} at its top level, or at least one .md or .pdf file to publish as a documents site — or be a single file that can be displayed on its own, such as a note, a PDF, a page or an image. Drop the folder that contains it, not the folder above.`
     );
   }
-  if (!limits) return;
+  const refusal = sizeRefusal(
+    files.map((file) => ({ path: file.path, size: file.bytes.length })),
+    limits
+  );
+  if (refusal) throw refusal;
+}
+function sizeRefusal(files, limits) {
+  if (!limits) return null;
   if (files.length > limits.maxFiles) {
-    throw new DeployError(
+    return new DeployError(
       ClientErrorCode.TooManyFiles,
       `That is ${files.length} files, and this plan allows ${limits.maxFiles}.`,
       { limit: limits.maxFiles, actual: files.length }
     );
   }
-  const oversized = files.find((file) => file.bytes.length > limits.maxFileBytes);
+  const oversized = files.find((file) => file.size > limits.maxFileBytes);
   if (oversized) {
-    throw new DeployError(
+    return new DeployError(
       ClientErrorCode.FileTooLarge,
-      `${oversized.path} is ${formatBytes$1(oversized.bytes.length)}, and this plan allows ${formatBytes$1(limits.maxFileBytes)} per file.`,
+      `${oversized.path} is ${formatBytes$1(oversized.size)}, and this plan allows ${formatBytes$1(limits.maxFileBytes)} per file.`,
       {
         path: oversized.path,
         limit: limits.maxFileBytes,
-        actual: oversized.bytes.length
+        actual: oversized.size
       }
     );
   }
-  const total = totalBytes(files);
+  const total = files.reduce((sum, file) => sum + file.size, 0);
   if (limits.maxSiteBytes !== null && total > limits.maxSiteBytes) {
-    throw new DeployError(
+    return new DeployError(
       ClientErrorCode.TooLarge,
       `That drop is ${formatBytes$1(total)}, and this plan allows ${formatBytes$1(limits.maxSiteBytes)}.`,
       { limit: limits.maxSiteBytes, actual: total }
     );
   }
-}
-function totalBytes(files) {
-  return files.reduce((sum, file) => sum + file.bytes.length, 0);
+  return null;
 }
 const MAX_NAME_LENGTH = 60;
 const HEAD_BYTES = 64 * 1024;
@@ -873,20 +1406,23 @@ function escapesRoot(root, candidate) {
   const inside = relative(root, candidate);
   return inside === "" || inside.startsWith("..");
 }
-async function resolveSite(credentials, site, subdomain) {
-  if (subdomain !== void 0) {
-    if (site !== void 0) {
-      throw new Error(
-        "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
-      );
-    }
-    return await createSite(credentials, subdomain);
+async function resolveSite(credentials, site, newSite) {
+  const { subdomain, folder } = newSite;
+  if (site !== void 0 && subdomain !== void 0) {
+    throw new Error(
+      "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
+    );
   }
-  if (site === void 0) return await createSite(credentials);
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
+  if (site !== void 0 && folder !== void 0) {
+    throw new Error(
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site from the dashboard."
+    );
+  }
+  if (site === void 0) {
+    const folderId = folder === void 0 ? void 0 : await resolveFolder(credentials, folder);
+    return await createSite(credentials, subdomain, folderId);
+  }
+  const found = await lookUpSite(credentials, site);
   if (found === void 0) {
     throw new Error(
       `No site of yours is called "${site}". Leave the site out to publish to a new one, or list your sites to see what exists.`
@@ -894,8 +1430,8 @@ async function resolveSite(credentials, site, subdomain) {
   }
   return found;
 }
-async function publish(credentials, source, site, onProgress, subdomain) {
-  const target = await resolveSite(credentials, site, subdomain);
+async function publish(credentials, source, site, onProgress, newSite = {}) {
+  const target = await resolveSite(credentials, site, newSite);
   let files = 0;
   let url = target.url;
   let unchanged = false;
@@ -926,11 +1462,11 @@ async function publish(credentials, source, site, onProgress, subdomain) {
   });
   return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
 }
-async function publishDirectory(credentials, directory, site, onProgress, subdomain) {
+async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
   const found = await stat(directory).catch(() => null);
   if (found === null) throw new Error(`There is no folder at ${directory}.`);
   if (!found.isDirectory()) throw new Error(`${directory} is a file, not a folder to publish.`);
-  return await publish(credentials, directorySource(directory), site, onProgress, subdomain);
+  return await publish(credentials, directorySource(directory), site, onProgress, newSite);
 }
 const silentProgress = Object.assign(() => {
 }, { done: () => {
@@ -1127,33 +1663,67 @@ API: ${found.credentials.apiBaseUrl}`,
 async function list() {
   const found = credentialsOr();
   if ("result" in found) return found.result;
-  const sites = await listSites(found.credentials);
+  const { sites, total } = await listSites(found.credentials);
   if (sites.length === 0) {
     return {
       text: "No sites yet. `drop2run deploy` publishes one.",
-      json: { sites: [] },
+      json: { sites: [], total: 0 },
       code: 0
     };
   }
+  const lines = sites.map(
+    (site) => `${site.subdomain}	${site.url}${site.name ? `	${site.name}` : ""}`
+  );
+  if (total > sites.length) {
+    lines.push(
+      `… and ${(total - sites.length).toLocaleString()} more — this lists the newest ${sites.length.toLocaleString()} of ${total.toLocaleString()}.`
+    );
+  }
   return {
-    text: sites.map((site) => `${site.subdomain}	${site.url}${site.name ? `	${site.name}` : ""}`).join("\n"),
-    json: { sites },
+    text: lines.join("\n"),
+    json: { sites, total },
     code: 0
   };
 }
-async function deployCommand(directory, site, report = silentProgress, subdomain) {
+async function folders() {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  try {
+    const all = await listFolders(found.credentials);
+    if (all.length === 0) {
+      return {
+        text: `No folders yet. Make one in the dashboard at ${dashboardUrlFor(found.credentials.apiBaseUrl)}, then file a new site in it with \`--folder\`.`,
+        json: { folders: [] },
+        code: 0
+      };
+    }
+    return {
+      text: all.map((folder) => `${folder.path}	${folder.folderId}`).join("\n"),
+      json: { folders: all },
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function deployCommand(directory, site, report = silentProgress, newSite = {}) {
   const found = credentialsOr();
   if ("result" in found) return found.result;
   const project = readProject();
   const folder = directory ?? project?.dir ?? ".";
-  const target = subdomain === void 0 ? site ?? project?.siteId : void 0;
+  const target = newSite.subdomain === void 0 ? site ?? project?.siteId : void 0;
+  if (newSite.folder !== void 0 && target !== void 0 && project !== null) {
+    return failure(
+      `This folder's ${PROJECT_FILE} already publishes to ${project.subdomain || project.siteId}, and \`--folder\` only files a new site. Move that site from the dashboard, or add \`--subdomain\` to create a new one in the folder.`
+    );
+  }
   try {
     const result = await publishDirectory(
       found.credentials,
       resolve(folder),
       target,
       report,
-      subdomain
+      newSite
     );
     const what = result.unchanged ? "Already up to date — nothing needed publishing." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
     return {
@@ -1168,7 +1738,7 @@ ${result.url}`,
     report.done();
   }
 }
-async function init(directory, site, subdomain) {
+async function init(directory, site, newSite = {}) {
   const found = credentialsOr();
   if ("result" in found) return found.result;
   if (readProject() !== null) {
@@ -1177,7 +1747,11 @@ async function init(directory, site, subdomain) {
     );
   }
   try {
-    const target = site === void 0 ? await createSite(found.credentials, subdomain) : await findSite(found.credentials, site);
+    const target = site === void 0 ? await createSite(
+      found.credentials,
+      newSite.subdomain,
+      newSite.folder === void 0 ? void 0 : await resolveFolder(found.credentials, newSite.folder)
+    ) : await findSite(found.credentials, site);
     const project = {
       siteId: target.siteId,
       subdomain: target.subdomain,
@@ -1316,7 +1890,9 @@ const HELP = `drop2run — publish a static site from the command line
   drop2run init [dir] [--site <subdomain>]     Tie this folder to a site (writes drop2run.json)
   drop2run deploy [dir] [--site <subdomain>]   Publish a folder (default: . or drop2run.json)
   drop2run init|deploy --subdomain <name>      Create a new site under a name you pick
+  drop2run init|deploy --folder <path>         File the new site in one of your folders
   drop2run ls                                  List your sites
+  drop2run folders                             List your folders, as --folder takes them
   drop2run open [site]                         Open a site in a browser
   drop2run rollback <deployId> [--site X]      Put an earlier version back live
   drop2run rm <site> --yes                     Delete a site and everything on it
@@ -1329,6 +1905,8 @@ Flags
   --json         Print machine-readable output instead of text
   --site X       Act on an existing site rather than the one in drop2run.json
   --subdomain X  Create a new site under this name (init and deploy only)
+  --folder X     File the new site in this folder: a path such as Clients/Acme,
+                 or a folder id (init and deploy only)
   --device       Sign in by approving a code on another machine
   --yes          Confirm a deletion, which cannot be undone
 
@@ -1340,6 +1918,10 @@ Where a site comes from
   --site only ever finds a site you already have; it never creates one, so a
   subdomain typed wrong fails instead of quietly becoming a second site.
 
+  --folder only applies to a site being created. It never creates a folder
+  and never moves an existing site; make and rearrange folders in the
+  dashboard.
+
 Signing in
   \`login\` opens a browser and listens on 127.0.0.1, so it needs both on this
   machine. Over SSH, in a container or under WSL, use \`login --device\`: it
@@ -1355,7 +1937,7 @@ function flagValue(args, flag) {
   const value = args[at + 1];
   return value === void 0 || value.startsWith("-") ? void 0 : value;
 }
-const VALUE_FLAGS = ["--site", "--subdomain"];
+const VALUE_FLAGS = ["--site", "--subdomain", "--folder"];
 function positionals(argv) {
   const found = [];
   for (let at = 0; at < argv.length; at++) {
@@ -1370,16 +1952,29 @@ function positionals(argv) {
   }
   return found;
 }
-function subdomainFlagProblem(argv, command, site, subdomain) {
-  if (!argv.includes("--subdomain")) return void 0;
-  if (subdomain === void 0) {
-    return "`--subdomain` needs a name after it, for example `--subdomain my-docs`.";
+const SUBDOMAIN_FLAG = {
+  flag: "--subdomain",
+  example: "my-docs",
+  effect: "`--subdomain` creates a new one",
+  elsewhere: (command) => ` Use \`--site\` to tell \`${command}\` which of your sites to act on.`
+};
+const FOLDER_FLAG = {
+  flag: "--folder",
+  example: "Clients/Acme",
+  effect: "`--folder` only files a new one — move an existing site from the dashboard",
+  elsewhere: (command) => command === "ls" || command === "list" ? " `drop2run folders` lists them." : ""
+};
+function newSiteFlagProblem(argv, command, site, value, described) {
+  const { flag, example, effect, elsewhere } = described;
+  if (!argv.includes(flag)) return void 0;
+  if (value === void 0) {
+    return `\`${flag}\` needs a value after it, for example \`${flag} ${example}\`.`;
   }
   if (site !== void 0) {
-    return "`--site` and `--subdomain` cannot both be given: `--site` publishes to a site you already have, and `--subdomain` creates a new one. Drop whichever is not what you meant.";
+    return `\`--site\` and \`${flag}\` cannot both be given: \`--site\` publishes to a site you already have, and ${effect}. Drop whichever is not what you meant.`;
   }
   if (command !== "init" && command !== "deploy") {
-    return `\`--subdomain\` only applies to \`init\` and \`deploy\`, which can create a site. Use \`--site\` to tell \`${command}\` which of your sites to act on.`;
+    return `\`${flag}\` only applies to \`init\` and \`deploy\`, which can create a site.` + elsewhere(command);
   }
   return void 0;
 }
@@ -1388,7 +1983,7 @@ async function run(argv) {
   const positional = positionals(argv);
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-sLisZctX.js").then(
+    const { version } = await import("./package-bzaCMW_E.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };
@@ -1398,7 +1993,8 @@ async function run(argv) {
   if (command === void 0) return { text: HELP, json: { help: HELP }, code: 1 };
   const site = flagValue(argv, "--site");
   const subdomain = flagValue(argv, "--subdomain");
-  const refusal = subdomainFlagProblem(argv, command, site, subdomain);
+  const folder = flagValue(argv, "--folder");
+  const refusal = newSiteFlagProblem(argv, command, site, subdomain, SUBDOMAIN_FLAG) ?? newSiteFlagProblem(argv, command, site, folder, FOLDER_FLAG);
   if (refusal !== void 0) {
     const failed = { text: refusal, json: { error: refusal }, code: 1 };
     return json ? { ...failed, text: JSON.stringify(failed.json, null, 2) } : failed;
@@ -1410,11 +2006,11 @@ async function run(argv) {
     json,
     argv.includes("--device"),
     argv.includes("--yes"),
-    subdomain
+    { subdomain, folder }
   );
   return json ? { ...result, text: JSON.stringify(result.json, null, 2) } : result;
 }
-async function dispatch(command, rest, site, json, device, confirmed, subdomain) {
+async function dispatch(command, rest, site, json, device, confirmed, newSite = {}) {
   switch (command) {
     case "login": {
       const print = json ? () => {
@@ -1424,18 +2020,20 @@ async function dispatch(command, rest, site, json, device, confirmed, subdomain)
     case "logout":
       return logout();
     case "init":
-      return await init(rest[0] ?? ".", site, subdomain);
+      return await init(rest[0] ?? ".", site, newSite);
     case "deploy": {
       const report = json ? silentProgress : progressWriter(
         (text) => process.stderr.write(text),
         process.stderr.isTTY === true,
         process.stderr.columns ?? 80
       );
-      return await deployCommand(rest[0], site, report, subdomain);
+      return await deployCommand(rest[0], site, report, newSite);
     }
     case "ls":
     case "list":
       return await list();
+    case "folders":
+      return await folders();
     case "open":
       return await open(rest[0] ?? site);
     case "rollback":

package/dist/{package-sLisZctX.js → package-bzaCMW_E.js}

@@ -1,6 +1,6 @@
 const name = "drop2run";
-const version = "0.4.1";
-const description = "Publish a static site to Drop2Run from the command line.";
+const version = "0.6.0";
+const description = "Publish a page, a folder of documents or a built site to Drop2Run from the command line.";
 const license = "MIT";
 const type = "module";
 const bin = { "drop2run": "bin/drop2run.mjs" };
@@ -10,7 +10,7 @@ const publishConfig = { "access": "public" };
 const homepage = "https://dropto.run";
 const repository = { "type": "git", "url": "git+https://github.com/Drop-to-run/drop2run-cli.git" };
 const bugs = { "url": "https://github.com/Drop-to-run/drop2run-cli/issues" };
-const keywords = ["static-site", "deploy", "hosting", "cli", "ai", "claude", "agent", "llm"];
+const keywords = ["static-site", "markdown", "pdf", "deploy", "hosting", "cli", "ai", "claude", "agent", "llm"];
 const scripts = { "prepublishOnly": "npm run build && npm test", "build": "vite build", "typecheck": "tsc --noEmit", "test": "vitest run", "lint": "biome check .", "format": "biome check --write ." };
 const devDependencies = { "@biomejs/biome": "^2.5.11", "@types/node": "^26.4.0", "typescript": "^5.9.3", "vite": "^7.2.1", "vitest": "^4.1.11" };
 const _package = {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "drop2run",
-	"version": "0.4.1",
-	"description": "Publish a static site to Drop2Run from the command line.",
+	"version": "0.6.0",
+	"description": "Publish a page, a folder of documents or a built site to Drop2Run from the command line.",
 	"license": "MIT",
 	"type": "module",
 	"bin": {
@@ -27,6 +27,8 @@
 	},
 	"keywords": [
 		"static-site",
+		"markdown",
+		"pdf",
 		"deploy",
 		"hosting",
 		"cli",