drop2run 0.5.0 → 0.7.0

package/README.md

@@ -18,7 +18,9 @@ drop2run logout                              Remove the stored token
 drop2run init [dir] [--site <subdomain>]     Tie this folder to a site
 drop2run deploy [dir] [--site <subdomain>]   Publish a folder
 drop2run init|deploy --subdomain <name>      Create a new site under a name you pick
+drop2run init|deploy --folder <path>         File the new site in one of your folders
 drop2run ls                                  List your sites
+drop2run folders                             List your folders, as --folder takes them
 drop2run open [site]                         Open a site in a browser
 drop2run rollback <deployId> [--site X]      Put an earlier version back live
 drop2run rm <site> --yes                     Delete a site and everything on it
@@ -52,6 +54,17 @@ which is not undoable.
 `--site` never creates anything: it finds a site you already have, and fails when nothing matches. That
 is what keeps a subdomain typed one letter wrong from quietly becoming a second site.
 
+`--folder` files the site being created in one of your dashboard folders — by path, as `drop2run folders`
+prints it, or by folder id:
+
+```bash
+drop2run init dist --folder Clients/Acme
+```
+
+Case does not matter. It never creates a folder and never moves an existing site, so it cannot be given
+with `--site`, or to `deploy` in a project whose `drop2run.json` already names a site; a folder that does
+not exist is refused with the list of those that do, before any site is made.
+
 `deploy` never creates a second site while a `drop2run.json` sits next to it — that would leave the real
 site untouched and you looking at a URL you did not expect.
 
@@ -69,7 +82,7 @@ server on `127.0.0.1`, which is what keeps it out of clipboards and scrollback.
 
 ### `--device`, for a machine with no browser
 
-`drop2run login --device` prints a short code and waits. Enter it at <https://dropto.run/device> from any
+`drop2run login --device` prints a short code and waits. Enter it at <https://app.dropto.run/device> from any
 machine you are already signed in on — a phone will do — and the terminal picks up its token.
 
 The short code is not the credential; it names the pending request, so somebody reading it over your
@@ -79,7 +92,7 @@ works once.
 ### CI
 
 Neither flow works in CI — nothing there can open a browser or approve anything. Create a token at
-<https://dropto.run/account/tokens> and set it in the environment:
+<https://app.dropto.run/account/tokens> and set it in the environment:
 
 ```
 DROP2RUN_TOKEN=d2r_...
@@ -97,7 +110,7 @@ account" is answerable in an issue report or a CI log.
 
 Both need a browser session, and that is deliberate rather than missing. A token that can mint tokens is
 not a leaked credential but a permanent one: whoever takes it makes a second, and revoking the first
-changes nothing. Make and revoke tokens at <https://dropto.run/account/tokens>.
+changes nothing. Make and revoke tokens at <https://app.dropto.run/account/tokens>.
 
 `token list` does exist and answers what a terminal can answer — which machines hold a credential, and
 which of them has not used it since it was made. It prints prefixes, never secrets.

package/dist/index.js

@@ -5,75 +5,13 @@ import { spawn } from "node:child_process";
 import { randomBytes, createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { realpath, readdir, stat, readFile } from "node:fs/promises";
-async function call(credentials, path, init2 = {}) {
-  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
-    ...init2,
-    headers: {
-      ...init2.headers,
-      Authorization: `Bearer ${credentials.token}`,
-      ...init2.body === void 0 ? {} : { "Content-Type": "application/json" }
-    }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-  return await response.json();
-}
-async function findSite(credentials, site) {
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
-  if (found === void 0) {
-    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
-  }
-  return found;
-}
-async function deleteSite(credentials, siteId) {
-  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
-    method: "DELETE",
-    headers: { Authorization: `Bearer ${credentials.token}` }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-}
-async function promoteDeploy(credentials, siteId, deployId) {
-  return await call(
-    credentials,
-    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
-    { method: "POST" }
-  );
-}
-async function listTokens(credentials) {
-  const body = await call(credentials, "tokens");
-  return body.tokens;
-}
-async function listSites(credentials) {
-  const body = await call(credentials, "sites");
-  return body.sites;
-}
-async function createSite(credentials, subdomain) {
-  const created = await call(
-    credentials,
-    "sites",
-    {
-      method: "POST",
-      // An absent field rather than a null one, because the API reads null, empty and missing the
-      // same way and a body carrying only what was asked for is the one that reads correctly in a
-      // log.
-      body: JSON.stringify(subdomain === void 0 ? {} : { subdomain })
-    }
-  );
-  return { ...created, name: null };
-}
 const TOKEN_VARIABLE = "DROP2RUN_TOKEN";
 function configPath() {
   return join(homedir(), ".config", "drop2run", "config.json");
 }
 const DEFAULT_API_BASE_URL = "https://dropto.run/api";
+const PRODUCTION_SITE_ORIGIN = "https://dropto.run";
+const PRODUCTION_DASHBOARD_ORIGIN = "https://app.dropto.run";
 function loadCredentials(env = process.env, read = (path) => readFileSync(path, "utf8")) {
   let stored = {};
   try {
@@ -97,7 +35,8 @@ function resolveApiBaseUrl(env = process.env, read = (path) => readFileSync(path
   return url.replace(/\/+$/, "");
 }
 function dashboardUrlFor(apiBaseUrl) {
-  return apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+  const origin = apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+  return origin === PRODUCTION_SITE_ORIGIN ? PRODUCTION_DASHBOARD_ORIGIN : origin;
 }
 function saveToken(token, path = configPath()) {
   let existing = {};
@@ -140,14 +79,14 @@ function missingCredentialsMessage(surface = "cli") {
   ] : ["Run `drop2run login` to sign in through a browser, which stores one for you."];
   const byHand = surface === "mcp" ? [
     "To set one without signing in here, create a token at",
-    "https://dropto.run/account/tokens and either:",
+    "https://app.dropto.run/account/tokens and either:",
     `  - put it in ${configPath()} as {"token": "d2r_..."}, which this`,
     "    server reads on every call and needs no restart, or",
     `  - set ${TOKEN_VARIABLE} in the environment and restart this server, since it reads`,
     "    the environment it was started in."
   ] : [
     "For CI, or where no browser can be opened, create a token at",
-    "https://dropto.run/account/tokens and either:",
+    "https://app.dropto.run/account/tokens and either:",
     `  - set ${TOKEN_VARIABLE} in the environment, or`,
     `  - put it in ${configPath()} as {"token": "d2r_..."}`
   ];
@@ -161,6 +100,142 @@ function missingCredentialsMessage(surface = "cli") {
     "The token is shown once when it is created and cannot be recovered afterwards."
   ].join("\n");
 }
+async function call(credentials, path, init2 = {}) {
+  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
+    ...init2,
+    headers: {
+      ...init2.headers,
+      Authorization: `Bearer ${credentials.token}`,
+      ...init2.body === void 0 ? {} : { "Content-Type": "application/json" }
+    }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  return await response.json();
+}
+async function findSite(credentials, site) {
+  const found = await lookUpSite(credentials, site);
+  if (found === void 0) {
+    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+  }
+  return found;
+}
+const SITE_ID_SHAPE = /^[0-9a-z]{26}$/i;
+async function lookUpSite(credentials, site) {
+  const wanted = site.trim().toLowerCase();
+  if (wanted === "") return void 0;
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(wanted)}`
+  );
+  const bySubdomain = sites.find((candidate) => candidate.subdomain.toLowerCase() === wanted);
+  if (bySubdomain !== void 0) return bySubdomain;
+  if (!SITE_ID_SHAPE.test(wanted)) return void 0;
+  const response = await fetch(
+    `${credentials.apiBaseUrl}/sites/${encodeURIComponent(wanted.toUpperCase())}`,
+    { headers: { Authorization: `Bearer ${credentials.token}` } }
+  );
+  if (response.status === 404) return void 0;
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  const detail = await response.json();
+  return { siteId: detail.siteId, subdomain: detail.subdomain, url: detail.url, name: detail.name };
+}
+async function deleteSite(credentials, siteId) {
+  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${credentials.token}` }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+}
+async function promoteDeploy(credentials, siteId, deployId) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
+    { method: "POST" }
+  );
+}
+async function listTokens(credentials) {
+  const body = await call(credentials, "tokens");
+  return body.tokens;
+}
+const SITES_PER_REQUEST = 100;
+async function listSites(credentials) {
+  const body = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}`
+  );
+  return { sites: body.sites, total: body.total };
+}
+async function createSite(credentials, subdomain, folderId) {
+  const created = await call(
+    credentials,
+    "sites",
+    {
+      method: "POST",
+      // Absent fields rather than null ones, because the API reads null, empty and missing the same
+      // way and a body carrying only what was asked for is the one that reads correctly in a log.
+      body: JSON.stringify({
+        ...subdomain === void 0 ? {} : { subdomain },
+        ...folderId === void 0 ? {} : { folderId }
+      })
+    }
+  );
+  return { ...created, name: null };
+}
+async function listFolders(credentials) {
+  const body = await call(credentials, "site-folders");
+  const byId = new Map(body.folders.map((folder) => [folder.folderId, folder]));
+  const pathOf = (folderId) => {
+    const names = [];
+    let cursor = byId.get(folderId);
+    while (cursor !== void 0 && names.length <= byId.size) {
+      names.unshift(cursor.name);
+      cursor = cursor.parentId === null ? void 0 : byId.get(cursor.parentId);
+    }
+    return names.join("/");
+  };
+  return body.folders.map((folder) => ({ folderId: folder.folderId, path: pathOf(folder.folderId) })).sort((a, b) => a.path.localeCompare(b.path));
+}
+function comparablePath(path) {
+  return path.split("/").map((name) => name.trim()).filter((name) => name !== "").join("/").toLowerCase();
+}
+const FOLDERS_LISTED_ON_MISS = 20;
+async function resolveFolder(credentials, folder) {
+  const wanted = comparablePath(folder);
+  if (wanted === "") {
+    throw new Error(
+      `"${folder}" does not name a folder. Leave the folder out to put the site at the top level.`
+    );
+  }
+  const folders2 = await listFolders(credentials);
+  const byId = folders2.find((candidate) => candidate.folderId.toLowerCase() === wanted);
+  if (byId !== void 0) return byId.folderId;
+  const matches = folders2.filter((candidate) => comparablePath(candidate.path) === wanted);
+  if (matches.length === 1 && matches[0] !== void 0) return matches[0].folderId;
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one folder is at "${folder}", because a folder name can contain "/". Name it by id instead: ${matches.map((match) => match.folderId).join(", ")}.`
+    );
+  }
+  if (folders2.length === 0) {
+    throw new Error(
+      `No folder of yours is called "${folder}" — this account has no folders yet. Make one in the dashboard at ${dashboardUrlFor(credentials.apiBaseUrl)}, or leave the folder out.`
+    );
+  }
+  const listed = folders2.slice(0, FOLDERS_LISTED_ON_MISS).map((candidate) => candidate.path);
+  const more = folders2.length - listed.length;
+  throw new Error(
+    `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
+  );
+}
 const TIMEOUT_MS = 5 * 60 * 1e3;
 function newAttempt() {
   const verifier = randomBytes(32).toString("base64url");
@@ -337,6 +412,12 @@ function writeProject(project, directory = process.cwd()) {
 `);
   return path;
 }
+function sizeOf(content) {
+  return ArrayBuffer.isView(content) ? content.byteLength : content.size;
+}
+async function bytesOf(content) {
+  return ArrayBuffer.isView(content) ? content : new Uint8Array(await content.arrayBuffer());
+}
 class DeployError extends Error {
   /**
    * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
@@ -373,20 +454,55 @@ const ClientErrorCode = {
   /** The user cancelled. */
   Cancelled: "cancelled",
   /** An upload kept failing after every retry. */
-  UploadFailed: "upload_failed"
+  UploadFailed: "upload_failed",
+  /**
+   * The browser could not hold what was dropped in memory. Raised when allocating the buffer for a
+   * large zip or file fails, which a browser reports as a `RangeError` rather than as anything that
+   * names memory.
+   */
+  OutOfMemory: "out_of_memory",
+  /**
+   * A dropped file could not be read when it came to be hashed. Files from a folder stay on disk until
+   * then, so one moved, deleted or changed after the drop fails here rather than at the drop.
+   */
+  ReadFailed: "read_failed",
+  /**
+   * A control-plane call got no answer: the connection failed before a response arrived, or the
+   * request timeout passed. Distinct from an HTTP error, which is an answer — this one says nothing
+   * about whether the server acted, which is why only an idempotent call may retry on it.
+   */
+  NetworkFailed: "network_failed"
 };
+function describeError(error) {
+  const parts = [];
+  let current = error;
+  for (let depth = 0; depth < 5 && current !== void 0 && current !== null; depth++) {
+    if (current instanceof Error) {
+      const code = current.code;
+      parts.push(typeof code === "string" ? `${current.message} (${code})` : current.message);
+      current = current.cause;
+    } else {
+      parts.push(String(current));
+      break;
+    }
+  }
+  return parts.join(" ← ");
+}
 const ACCOUNT_HEADER = "X-Drop2Run-Account";
 const CLAIM_TOKEN_HEADER = "X-Claim-Token";
+const DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+const COMPLETE_RETRY_DELAYS_MS = [1e3, 4e3];
 async function prepareDeploy(siteId, files, options, signal) {
   const manifest = files.map((file) => ({
     path: file.path,
     sha256: file.sha256,
-    size: file.bytes.length
+    size: sizeOf(file.bytes)
   }));
   const prepared = await request(
     `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
     { files: manifest },
-    options
+    options,
+    signal
   );
   return { ...prepared, uploadUrl: absolute(prepared.uploadUrl, options.baseUrl) };
 }
@@ -396,31 +512,65 @@ function absolute(uploadUrl, baseUrl) {
   return new URL(uploadUrl, baseUrl).toString();
 }
 async function completeDeploy(siteId, deployId, options, signal, name) {
-  return request(
-    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`,
-    // A bodyless POST when there is no name to send, which is what this call has always been. The
-    // server treats an absent body and an absent field identically, so nothing depends on which of
-    // the two a client picks.
-    name === null || name === void 0 ? void 0 : { name },
-    options
-  );
+  const path = `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`;
+  const body = name === null || name === void 0 ? void 0 : { name };
+  const delay = options.delay ?? wait;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await request(path, body, options, signal);
+    } catch (error) {
+      const unanswered = error instanceof DeployError && error.code === ClientErrorCode.NetworkFailed;
+      if (!unanswered || attempt >= COMPLETE_RETRY_DELAYS_MS.length || signal?.aborted) throw error;
+      await delay(COMPLETE_RETRY_DELAYS_MS[attempt] ?? 1e3);
+    }
+  }
+}
+function wait(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function request(path, body, options, signal) {
   const doFetch = options.fetch ?? globalFetch$1();
   const base = options.baseUrl ?? "/api";
+  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const headers = {};
   if (body !== void 0) headers["Content-Type"] = "application/json";
   if (options.claimToken) headers[CLAIM_TOKEN_HEADER] = options.claimToken;
   if (options.token) headers.Authorization = `Bearer ${options.token}`;
   if (options.accountId) headers[ACCOUNT_HEADER] = options.accountId;
-  const response = await doFetch(`${base}/${path}`, {
-    method: "POST",
-    headers,
-    ...body === void 0 ? {} : { body: JSON.stringify(body) },
-    ...{}
-  });
-  if (!response.ok) throw await problemToError(response);
-  return await response.json();
+  const controller = new AbortController();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  try {
+    const response = await doFetch(`${base}/${path}`, {
+      method: "POST",
+      headers,
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      signal: controller.signal
+    });
+    if (!response.ok) throw await problemToError(response);
+    return await response.json();
+  } catch (error) {
+    if (error instanceof DeployError || signal?.aborted) throw error;
+    if (timedOut) {
+      throw new DeployError(
+        ClientErrorCode.NetworkFailed,
+        `The server did not answer within ${Math.round(timeoutMs / 1e3)} seconds.`,
+        { path, cause: describeError(error) }
+      );
+    }
+    if (error instanceof TypeError) {
+      throw new DeployError(ClientErrorCode.NetworkFailed, "Could not reach the server.", {
+        path,
+        cause: describeError(error)
+      });
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function globalFetch$1() {
   return globalThis.fetch.bind(globalThis);
@@ -919,17 +1069,29 @@ function extensionOf(path) {
   return dot <= 0 ? "" : name.slice(dot).toLowerCase();
 }
 async function sha256Hex(bytes) {
-  const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 async function hashAll(files, onProgress, signal) {
   const hashed = [];
   for (const [index, file] of files.entries()) {
-    hashed.push({ ...file, sha256: await sha256Hex(file.bytes) });
+    hashed.push({ ...file, sha256: await sha256Hex(await readForHash(file)) });
     onProgress?.(index + 1, files.length);
   }
   return hashed;
 }
+async function readForHash(file) {
+  try {
+    return await bytesOf(file.bytes);
+  } catch (error) {
+    if (error instanceof RangeError) throw error;
+    throw new DeployError(
+      ClientErrorCode.ReadFailed,
+      `Could not read ${file.path}. It may have been moved, renamed or changed since you dropped it — drop the folder again.`,
+      { path: file.path, cause: describeError(error) }
+    );
+  }
+}
 const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
 const IGNORED_DIRECTORIES = [
   "__MACOSX",
@@ -939,7 +1101,11 @@ const IGNORED_DIRECTORIES = [
   ".hg",
   ".idea",
   ".vscode",
-  ".claude"
+  ".claude",
+  ".agents",
+  ".cursor",
+  ".codex",
+  ".gemini"
 ];
 function shouldIgnore(path) {
   const segments = path.split("/");
@@ -1001,7 +1167,7 @@ function checkLimits(files, limits) {
     );
   }
   const refusal = sizeRefusal(
-    files.map((file) => ({ path: file.path, size: file.bytes.length })),
+    files.map((file) => ({ path: file.path, size: sizeOf(file.bytes) })),
     limits
   );
   if (refusal) throw refusal;
@@ -1042,13 +1208,24 @@ const HEAD_BYTES = 64 * 1024;
 const TITLE_SEPARATORS = ["|", "·", "—", "–", " - "];
 function suggestSiteName(files) {
   const index = files.find((file) => file.path === "index.html");
-  if (index === void 0) return null;
+  if (index === void 0 || !ArrayBuffer.isView(index.bytes)) return null;
   try {
     return nameFromHtml(decodeHead(index.bytes));
   } catch {
     return null;
   }
 }
+async function readSiteName(files) {
+  const index = files.find((file) => file.path === "index.html");
+  if (index === void 0) return null;
+  if (ArrayBuffer.isView(index.bytes)) return suggestSiteName(files);
+  try {
+    const head = new Uint8Array(await index.bytes.slice(0, HEAD_BYTES).arrayBuffer());
+    return suggestSiteName([{ path: index.path, bytes: head }]);
+  } catch {
+    return null;
+  }
+}
 function decodeHead(bytes) {
   return new TextDecoder("utf-8", { fatal: false }).decode(
     bytes.subarray(0, HEAD_BYTES)
@@ -1080,7 +1257,7 @@ function matchTag(html, tag) {
   const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(
     html
   );
-  return match?.[1] ?? null;
+  return match?.[1] === void 0 ? null : decodeEntities(match[1]);
 }
 function matchOgSiteName(html) {
   const patterns = [
@@ -1089,10 +1266,56 @@ function matchOgSiteName(html) {
   ];
   for (const pattern of patterns) {
     const match = pattern.exec(html);
-    if (match?.[1] !== void 0) return match[1];
+    if (match?.[1] !== void 0) return decodeEntities(match[1]);
   }
   return null;
 }
+const LATIN1_ENTITIES = "nbsp iexcl cent pound curren yen brvbar sect uml copy ordf laquo not shy reg macr deg plusmn sup2 sup3 acute micro para middot cedil sup1 ordm raquo frac14 frac12 frac34 iquest Agrave Aacute Acirc Atilde Auml Aring AElig Ccedil Egrave Eacute Ecirc Euml Igrave Iacute Icirc Iuml ETH Ntilde Ograve Oacute Ocirc Otilde Ouml times Oslash Ugrave Uacute Ucirc Uuml Yacute THORN szlig agrave aacute acirc atilde auml aring aelig ccedil egrave eacute ecirc euml igrave iacute icirc iuml eth ntilde ograve oacute ocirc otilde ouml divide oslash ugrave uacute ucirc uuml yacute thorn yuml".split(" ");
+const NAMED_ENTITIES = new Map([
+  ...LATIN1_ENTITIES.map((name, index) => [name, 160 + index]),
+  ["amp", 38],
+  ["lt", 60],
+  ["gt", 62],
+  ["quot", 34],
+  ["apos", 39],
+  ["ensp", 8194],
+  ["emsp", 8195],
+  ["thinsp", 8201],
+  ["ndash", 8211],
+  ["mdash", 8212],
+  ["lsquo", 8216],
+  ["rsquo", 8217],
+  ["sbquo", 8218],
+  ["ldquo", 8220],
+  ["rdquo", 8221],
+  ["bdquo", 8222],
+  ["dagger", 8224],
+  ["Dagger", 8225],
+  ["bull", 8226],
+  ["hellip", 8230],
+  ["prime", 8242],
+  ["lsaquo", 8249],
+  ["rsaquo", 8250],
+  ["euro", 8364],
+  ["trade", 8482],
+  ["larr", 8592],
+  ["rarr", 8594],
+  ["hearts", 9829]
+]);
+function decodeEntities(text) {
+  return text.replace(
+    /&(?:#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{1,31}));/g,
+    (whole, decimal, hex, name) => {
+      if (name !== void 0) {
+        const code2 = NAMED_ENTITIES.get(name);
+        return code2 === void 0 ? whole : String.fromCodePoint(code2);
+      }
+      const code = decimal !== void 0 ? Number(decimal) : Number.parseInt(hex ?? "", 16);
+      const valid = code > 0 && code <= 1114111 && (code < 55296 || code > 57343);
+      return String.fromCodePoint(valid ? code : 65533);
+    }
+  );
+}
 const INVISIBLE = new RegExp(
   `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8203)}-${String.fromCharCode(8207)}${String.fromCharCode(8232)}-${String.fromCharCode(8238)}${String.fromCharCode(8288)}-${String.fromCharCode(8292)}${String.fromCharCode(8294)}-${String.fromCharCode(8303)}${String.fromCharCode(65279)}]`,
   "g"
@@ -1134,46 +1357,105 @@ function trimSuffix(title) {
   return title;
 }
 const DEFAULT_CONCURRENCY = 8;
+const DEFAULT_BYTES_IN_FLIGHT = 64 * 1024 * 1024;
 const DEFAULT_RETRIES = 3;
 const BACKOFF_MS = [1e3, 2e3, 4e3];
-async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}) {
-  const doFetch = deps.fetch ?? globalFetch();
+const DEFAULT_STALL_MS = 3e4;
+const PROGRESS_INTERVAL_MS = 200;
+class StalledError extends Error {
+  /** @param seconds How long nothing moved. */
+  constructor(seconds) {
+    super(`No data moved for ${seconds}s.`);
+    this.name = "StalledError";
+  }
+}
+async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}, onRetry) {
+  const put = deps.put ?? defaultTransport(deps.fetch);
   const delay = deps.delay ?? defaultDelay;
   const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
   const retries = deps.retries ?? DEFAULT_RETRIES;
+  const stallMs = deps.stallMs ?? DEFAULT_STALL_MS;
+  const now = deps.now ?? Date.now;
+  const maxBytesInFlight = deps.maxBytesInFlight ?? DEFAULT_BYTES_IN_FLIGHT;
   const byPath = new Map(files.map((file) => [file.path, file]));
   let nextIndex = 0;
   let done = 0;
-  let uploadedBytes = 0;
+  let failed = false;
+  let reserved = 0;
+  let waiting = [];
+  const acquire = async (size) => {
+    while (reserved > 0 && reserved + size > maxBytesInFlight) {
+      await new Promise((resolve2) => waiting.push(resolve2));
+    }
+    reserved += size;
+  };
+  const release = (size) => {
+    reserved -= size;
+    const woken = waiting;
+    waiting = [];
+    for (const wake of woken) wake();
+  };
+  let landedBytes = 0;
+  const inFlight = /* @__PURE__ */ new Map();
+  let lastReport = Number.NEGATIVE_INFINITY;
+  const report = (path) => {
+    if (onProgress === void 0) return;
+    const at = now();
+    if (path === void 0 && at - lastReport < PROGRESS_INTERVAL_MS) return;
+    lastReport = at;
+    let bytes = landedBytes;
+    for (const sent of inFlight.values()) bytes += sent;
+    onProgress(done, targets.length, bytes, path);
+  };
   const worker = async () => {
     for (; ; ) {
+      if (failed) return;
       const index = nextIndex++;
       const target = targets[index];
       if (target === void 0) return;
       const file = byPath.get(target.path);
       if (file === void 0) {
+        failed = true;
         throw new DeployError(
           ClientErrorCode.UploadFailed,
           `The server asked for ${target.path}, which is not in the manifest.`,
           { path: target.path }
         );
       }
-      await uploadOne(target, file, {
-        doFetch,
-        delay,
-        retries,
-        signal,
-        uploadUrl
-      });
+      const size = sizeOf(file.bytes);
+      await acquire(size);
+      try {
+        if (failed) return;
+        signal?.throwIfAborted();
+        await uploadOne(target, file, {
+          put,
+          delay,
+          retries,
+          signal,
+          uploadUrl,
+          stallMs,
+          onSent: (sent) => {
+            inFlight.set(index, sent);
+            report();
+          },
+          onRetry: (attempt, stalled) => {
+            inFlight.set(index, 0);
+            onRetry?.(target.path, attempt, retries + 1, stalled);
+          }
+        });
+      } catch (error) {
+        failed = true;
+        throw error;
+      } finally {
+        release(size);
+      }
+      inFlight.delete(index);
       done += 1;
-      uploadedBytes += file.bytes.length;
-      onProgress?.(done, targets.length, uploadedBytes, file.path);
+      landedBytes += size;
+      report(file.path);
     }
   };
-  const workers = Array.from(
-    { length: Math.min(concurrency, targets.length) },
-    worker
-  );
+  const workers = Array.from({ length: Math.min(concurrency, targets.length) }, worker);
   try {
     await Promise.all(workers);
   } catch (error) {
@@ -1185,39 +1467,122 @@ async function uploadOne(target, file, context) {
   for (let attempt = 0; attempt <= context.retries; attempt++) {
     context.signal?.throwIfAborted();
     if (attempt > 0) {
+      context.onRetry(attempt + 1, lastError instanceof StalledError);
       await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
       context.signal?.throwIfAborted();
     }
     try {
-      const response = await context.doFetch(context.uploadUrl, {
-        method: "PUT",
-        body: new Blob([file.bytes.slice().buffer]),
-        // The permit is the whole request. `Content-Length` is required by the Worker and cannot
-        // be set here — it is a forbidden header name — but the browser derives it from the body,
-        // which is exactly the length the token names.
-        headers: { Authorization: `Bearer ${target.token}` },
-        ...context.signal ? { signal: context.signal } : {}
+      const status = await context.put({
+        url: context.uploadUrl,
+        token: target.token,
+        body: untyped(file.bytes),
+        signal: context.signal,
+        onSent: context.onSent,
+        stallMs: context.stallMs
       });
-      if (response.ok) return;
-      if (response.status === 401 || response.status === 403 || response.status === 429) {
+      if (status >= 200 && status < 300) return;
+      if (status === 401 || status === 403 || status === 429) {
         throw new DeployError(
           ClientErrorCode.UploadFailed,
           `Upload of ${target.path} was refused. The upload window may have expired — try deploying again.`,
-          { path: target.path, status: response.status }
+          { path: target.path, status }
+        );
+      }
+      if (status === 413) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `${target.path} is too large to upload in one request. Make it smaller, or leave it out of this publish.`,
+          { path: target.path, status }
         );
       }
-      lastError = new Error(`HTTP ${response.status}`);
+      lastError = new Error(`HTTP ${status}`);
     } catch (error) {
       if (error instanceof DeployError) throw error;
       if (isAbort(error)) throw cancelled();
       lastError = error;
     }
   }
-  throw new DeployError(
-    ClientErrorCode.UploadFailed,
-    `Could not upload ${target.path} after ${context.retries + 1} attempts.`,
-    { path: target.path, cause: String(lastError) }
-  );
+  const message = lastError instanceof StalledError ? `Upload of ${target.path} stopped moving and did not recover after ${context.retries + 1} attempts. Check your connection and try again.` : `Could not upload ${target.path} after ${context.retries + 1} attempts.`;
+  throw new DeployError(ClientErrorCode.UploadFailed, message, {
+    path: target.path,
+    cause: describeError(lastError)
+  });
+}
+function untyped(content) {
+  if (ArrayBuffer.isView(content) || content.type === "") return content;
+  return content.slice(0, content.size);
+}
+function defaultTransport(doFetch) {
+  if (doFetch !== void 0) return fetchTransport(doFetch);
+  const Xhr = globalThis.XMLHttpRequest;
+  return Xhr === void 0 ? fetchTransport(globalFetch()) : xhrTransport(Xhr);
+}
+function fetchTransport(doFetch) {
+  return async ({ url, token, body, signal }) => {
+    const response = await doFetch(url, {
+      method: "PUT",
+      // The view, not a copy. Wrapping it in `new Blob([body.slice().buffer])` made two extra
+      // full-size copies of every file in flight — eight at once, so up to 400 MB on a drop of
+      // 50 MB files. `fetch` sends exactly the range a view covers. The cast is TypeScript's
+      // SharedArrayBuffer distinction again; see `sha256Hex`. A `Blob` goes as it is, and the runtime
+      // streams it from disk.
+      body,
+      // The permit is the whole request. `Content-Length` is required by the Worker and cannot be
+      // set here — it is a forbidden header name — but the runtime derives it from the body, which
+      // is exactly the length the token names.
+      headers: { Authorization: `Bearer ${token}` },
+      ...signal ? { signal } : {}
+    });
+    return response.status;
+  };
+}
+function xhrTransport(Xhr) {
+  return ({ url, token, body, signal, onSent, stallMs }) => new Promise((resolve2, reject) => {
+    const xhr = new Xhr();
+    let settled = false;
+    let timer;
+    const settle = (finish) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      finish();
+    };
+    const arm = () => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        xhr.abort();
+        settle(() => reject(new StalledError(Math.round(stallMs / 1e3))));
+      }, stallMs);
+    };
+    function onAbort() {
+      xhr.abort();
+      settle(() => reject(abortReason(signal)));
+    }
+    if (signal?.aborted) {
+      reject(abortReason(signal));
+      return;
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+    xhr.open("PUT", url);
+    xhr.setRequestHeader("Authorization", `Bearer ${token}`);
+    xhr.upload.onprogress = (event) => {
+      arm();
+      onSent(event.loaded);
+    };
+    xhr.onprogress = arm;
+    xhr.onload = () => settle(() => resolve2(xhr.status));
+    xhr.onerror = () => settle(() => reject(new TypeError("Network error during upload.")));
+    arm();
+    xhr.send(body);
+  });
+}
+function abortReason(signal) {
+  const reason = signal?.reason;
+  if (reason instanceof Error) return reason;
+  const error = new Error("Aborted.");
+  error.name = "AbortError";
+  return error;
 }
 function globalFetch() {
   return globalThis.fetch.bind(globalThis);
@@ -1231,9 +1596,17 @@ function isAbort(error) {
 function cancelled() {
   return new DeployError(ClientErrorCode.Cancelled, "Deploy cancelled.");
 }
+function outOfMemory(detail) {
+  return new DeployError(
+    ClientErrorCode.OutOfMemory,
+    "This browser ran out of memory reading what you dropped. Drop the unzipped folder instead, or try again in a desktop browser with fewer tabs open.",
+    detail
+  );
+}
 function asDeployError(error) {
   if (error instanceof DeployError) return error;
   if (isAbort(error)) return cancelled();
+  if (error instanceof RangeError) return outOfMemory(error.message);
   return new DeployError(
     ClientErrorCode.UploadFailed,
     error instanceof Error ? error.message : "Upload failed.",
@@ -1242,7 +1615,11 @@ function asDeployError(error) {
 }
 async function deploy(source, siteId, onProgress, signal, options = {}) {
   try {
-    const collected = await source(signal);
+    onProgress({ type: "reading", bytes: 0, total: 0 });
+    const collected = await source(
+      signal,
+      (bytes, total) => onProgress({ type: "reading", bytes, total })
+    );
     onProgress({ type: "collecting", files: collected.length });
     const rename = renameOfLoneHtmlPage(collected.map((file) => file.path));
     const files = rename === null ? collected : collected.map((file) => file.path === rename ? { ...file, path: "index.html" } : file);
@@ -1258,6 +1635,21 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       onProgress({ type: "unchanged", url: prepared.url ?? "" });
       return;
     }
+    const sizes = new Map(hashed.map((file) => [file.path, sizeOf(file.bytes)]));
+    const totalBytes = prepared.upload.reduce(
+      (sum, target) => sum + (sizes.get(target.path) ?? 0),
+      0
+    );
+    if (prepared.upload.length > 0) {
+      onProgress({
+        type: "uploading",
+        done: prepared.reused,
+        total: prepared.total,
+        bytes: 0,
+        totalBytes,
+        reused: prepared.reused
+      });
+    }
     await uploadAll(
       prepared.upload,
       prepared.uploadUrl,
@@ -1267,11 +1659,13 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
         done: prepared.reused + done,
         total: prepared.total,
         bytes,
+        totalBytes,
         reused: prepared.reused,
-        path
+        ...path === void 0 ? {} : { path }
       }),
       signal,
-      options.upload
+      options.upload,
+      (path, attempt, attempts, stalled) => onProgress({ type: "retrying", path, attempt, attempts, stalled })
     );
     onProgress({ type: "completing", reused: prepared.reused });
     const completed = await completeDeploy(
@@ -1279,7 +1673,7 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       prepared.deployId,
       options,
       signal,
-      suggestSiteName(files)
+      await readSiteName(files)
     );
     onProgress({ type: "done", url: completed.url, name: completed.name });
   } catch (error) {
@@ -1334,20 +1728,23 @@ function escapesRoot(root, candidate) {
   const inside = relative(root, candidate);
   return inside === "" || inside.startsWith("..");
 }
-async function resolveSite(credentials, site, subdomain) {
-  if (subdomain !== void 0) {
-    if (site !== void 0) {
-      throw new Error(
-        "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
-      );
-    }
-    return await createSite(credentials, subdomain);
+async function resolveSite(credentials, site, newSite) {
+  const { subdomain, folder } = newSite;
+  if (site !== void 0 && subdomain !== void 0) {
+    throw new Error(
+      "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
+    );
   }
-  if (site === void 0) return await createSite(credentials);
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
+  if (site !== void 0 && folder !== void 0) {
+    throw new Error(
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site from the dashboard."
+    );
+  }
+  if (site === void 0) {
+    const folderId = folder === void 0 ? void 0 : await resolveFolder(credentials, folder);
+    return await createSite(credentials, subdomain, folderId);
+  }
+  const found = await lookUpSite(credentials, site);
   if (found === void 0) {
     throw new Error(
       `No site of yours is called "${site}". Leave the site out to publish to a new one, or list your sites to see what exists.`
@@ -1355,8 +1752,8 @@ async function resolveSite(credentials, site, subdomain) {
   }
   return found;
 }
-async function publish(credentials, source, site, onProgress, subdomain) {
-  const target = await resolveSite(credentials, site, subdomain);
+async function publish(credentials, source, site, onProgress, newSite = {}) {
+  const target = await resolveSite(credentials, site, newSite);
   let files = 0;
   let url = target.url;
   let unchanged = false;
@@ -1387,11 +1784,11 @@ async function publish(credentials, source, site, onProgress, subdomain) {
   });
   return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
 }
-async function publishDirectory(credentials, directory, site, onProgress, subdomain) {
+async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
   const found = await stat(directory).catch(() => null);
   if (found === null) throw new Error(`There is no folder at ${directory}.`);
   if (!found.isDirectory()) throw new Error(`${directory} is a file, not a folder to publish.`);
-  return await publish(credentials, directorySource(directory), site, onProgress, subdomain);
+  return await publish(credentials, directorySource(directory), site, onProgress, newSite);
 }
 const silentProgress = Object.assign(() => {
 }, { done: () => {
@@ -1413,6 +1810,10 @@ function shortenPath(path, width) {
 }
 function describe(event, width = 80) {
   switch (event.type) {
+    case "reading":
+      return event.total > 0 ? `Reading ${formatBytes(event.bytes)}/${formatBytes(event.total)}` : "Reading files";
+    case "retrying":
+      return `${event.stalled ? "Upload stalled" : "Upload failed"}, retrying ${shortenPath(event.path, Math.max(12, width - 40))} (attempt ${event.attempt}/${event.attempts})`;
     case "collecting":
       return `Collected ${event.files.toLocaleString()} ${event.files === 1 ? "file" : "files"}`;
     case "hashing":
@@ -1573,7 +1974,7 @@ async function whoami() {
   });
   if (!response.ok) {
     return failure(
-      response.status === 401 ? "This token is not valid any more. It may have been revoked or expired — create another at https://dropto.run/account/tokens." : `The API answered ${response.status}.`
+      response.status === 401 ? "This token is not valid any more. It may have been revoked or expired — create another at https://app.dropto.run/account/tokens." : `The API answered ${response.status}.`
     );
   }
   const me = await response.json();
@@ -1588,33 +1989,67 @@ API: ${found.credentials.apiBaseUrl}`,
 async function list() {
   const found = credentialsOr();
   if ("result" in found) return found.result;
-  const sites = await listSites(found.credentials);
+  const { sites, total } = await listSites(found.credentials);
   if (sites.length === 0) {
     return {
       text: "No sites yet. `drop2run deploy` publishes one.",
-      json: { sites: [] },
+      json: { sites: [], total: 0 },
       code: 0
     };
   }
+  const lines = sites.map(
+    (site) => `${site.subdomain}	${site.url}${site.name ? `	${site.name}` : ""}`
+  );
+  if (total > sites.length) {
+    lines.push(
+      `… and ${(total - sites.length).toLocaleString()} more — this lists the newest ${sites.length.toLocaleString()} of ${total.toLocaleString()}.`
+    );
+  }
   return {
-    text: sites.map((site) => `${site.subdomain}	${site.url}${site.name ? `	${site.name}` : ""}`).join("\n"),
-    json: { sites },
+    text: lines.join("\n"),
+    json: { sites, total },
     code: 0
   };
 }
-async function deployCommand(directory, site, report = silentProgress, subdomain) {
+async function folders() {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  try {
+    const all = await listFolders(found.credentials);
+    if (all.length === 0) {
+      return {
+        text: `No folders yet. Make one in the dashboard at ${dashboardUrlFor(found.credentials.apiBaseUrl)}, then file a new site in it with \`--folder\`.`,
+        json: { folders: [] },
+        code: 0
+      };
+    }
+    return {
+      text: all.map((folder) => `${folder.path}	${folder.folderId}`).join("\n"),
+      json: { folders: all },
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function deployCommand(directory, site, report = silentProgress, newSite = {}) {
   const found = credentialsOr();
   if ("result" in found) return found.result;
   const project = readProject();
   const folder = directory ?? project?.dir ?? ".";
-  const target = subdomain === void 0 ? site ?? project?.siteId : void 0;
+  const target = newSite.subdomain === void 0 ? site ?? project?.siteId : void 0;
+  if (newSite.folder !== void 0 && target !== void 0 && project !== null) {
+    return failure(
+      `This folder's ${PROJECT_FILE} already publishes to ${project.subdomain || project.siteId}, and \`--folder\` only files a new site. Move that site from the dashboard, or add \`--subdomain\` to create a new one in the folder.`
+    );
+  }
   try {
     const result = await publishDirectory(
       found.credentials,
       resolve(folder),
       target,
       report,
-      subdomain
+      newSite
     );
     const what = result.unchanged ? "Already up to date — nothing needed publishing." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
     return {
@@ -1629,7 +2064,7 @@ ${result.url}`,
     report.done();
   }
 }
-async function init(directory, site, subdomain) {
+async function init(directory, site, newSite = {}) {
   const found = credentialsOr();
   if ("result" in found) return found.result;
   if (readProject() !== null) {
@@ -1638,7 +2073,11 @@ async function init(directory, site, subdomain) {
     );
   }
   try {
-    const target = site === void 0 ? await createSite(found.credentials, subdomain) : await findSite(found.credentials, site);
+    const target = site === void 0 ? await createSite(
+      found.credentials,
+      newSite.subdomain,
+      newSite.folder === void 0 ? void 0 : await resolveFolder(found.credentials, newSite.folder)
+    ) : await findSite(found.credentials, site);
     const project = {
       siteId: target.siteId,
       subdomain: target.subdomain,
@@ -1777,7 +2216,9 @@ const HELP = `drop2run — publish a static site from the command line
   drop2run init [dir] [--site <subdomain>]     Tie this folder to a site (writes drop2run.json)
   drop2run deploy [dir] [--site <subdomain>]   Publish a folder (default: . or drop2run.json)
   drop2run init|deploy --subdomain <name>      Create a new site under a name you pick
+  drop2run init|deploy --folder <path>         File the new site in one of your folders
   drop2run ls                                  List your sites
+  drop2run folders                             List your folders, as --folder takes them
   drop2run open [site]                         Open a site in a browser
   drop2run rollback <deployId> [--site X]      Put an earlier version back live
   drop2run rm <site> --yes                     Delete a site and everything on it
@@ -1790,6 +2231,8 @@ Flags
   --json         Print machine-readable output instead of text
   --site X       Act on an existing site rather than the one in drop2run.json
   --subdomain X  Create a new site under this name (init and deploy only)
+  --folder X     File the new site in this folder: a path such as Clients/Acme,
+                 or a folder id (init and deploy only)
   --device       Sign in by approving a code on another machine
   --yes          Confirm a deletion, which cannot be undone
 
@@ -1801,13 +2244,17 @@ Where a site comes from
   --site only ever finds a site you already have; it never creates one, so a
   subdomain typed wrong fails instead of quietly becoming a second site.
 
+  --folder only applies to a site being created. It never creates a folder
+  and never moves an existing site; make and rearrange folders in the
+  dashboard.
+
 Signing in
   \`login\` opens a browser and listens on 127.0.0.1, so it needs both on this
   machine. Over SSH, in a container or under WSL, use \`login --device\`: it
-  prints a short code to enter at https://dropto.run/device from anywhere.
+  prints a short code to enter at https://app.dropto.run/device from anywhere.
 
   For CI, neither flow applies — create a token at
-  https://dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
+  https://app.dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
   environment or put it in ~/.config/drop2run/config.json as {"token": "d2r_..."}.
 `;
 function flagValue(args, flag) {
@@ -1816,7 +2263,7 @@ function flagValue(args, flag) {
   const value = args[at + 1];
   return value === void 0 || value.startsWith("-") ? void 0 : value;
 }
-const VALUE_FLAGS = ["--site", "--subdomain"];
+const VALUE_FLAGS = ["--site", "--subdomain", "--folder"];
 function positionals(argv) {
   const found = [];
   for (let at = 0; at < argv.length; at++) {
@@ -1831,16 +2278,29 @@ function positionals(argv) {
   }
   return found;
 }
-function subdomainFlagProblem(argv, command, site, subdomain) {
-  if (!argv.includes("--subdomain")) return void 0;
-  if (subdomain === void 0) {
-    return "`--subdomain` needs a name after it, for example `--subdomain my-docs`.";
+const SUBDOMAIN_FLAG = {
+  flag: "--subdomain",
+  example: "my-docs",
+  effect: "`--subdomain` creates a new one",
+  elsewhere: (command) => ` Use \`--site\` to tell \`${command}\` which of your sites to act on.`
+};
+const FOLDER_FLAG = {
+  flag: "--folder",
+  example: "Clients/Acme",
+  effect: "`--folder` only files a new one — move an existing site from the dashboard",
+  elsewhere: (command) => command === "ls" || command === "list" ? " `drop2run folders` lists them." : ""
+};
+function newSiteFlagProblem(argv, command, site, value, described) {
+  const { flag, example, effect, elsewhere } = described;
+  if (!argv.includes(flag)) return void 0;
+  if (value === void 0) {
+    return `\`${flag}\` needs a value after it, for example \`${flag} ${example}\`.`;
   }
   if (site !== void 0) {
-    return "`--site` and `--subdomain` cannot both be given: `--site` publishes to a site you already have, and `--subdomain` creates a new one. Drop whichever is not what you meant.";
+    return `\`--site\` and \`${flag}\` cannot both be given: \`--site\` publishes to a site you already have, and ${effect}. Drop whichever is not what you meant.`;
   }
   if (command !== "init" && command !== "deploy") {
-    return `\`--subdomain\` only applies to \`init\` and \`deploy\`, which can create a site. Use \`--site\` to tell \`${command}\` which of your sites to act on.`;
+    return `\`${flag}\` only applies to \`init\` and \`deploy\`, which can create a site.` + elsewhere(command);
   }
   return void 0;
 }
@@ -1849,7 +2309,7 @@ async function run(argv) {
   const positional = positionals(argv);
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-DXmy47q4.js").then(
+    const { version } = await import("./package-D8mWS-nC.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };
@@ -1859,7 +2319,8 @@ async function run(argv) {
   if (command === void 0) return { text: HELP, json: { help: HELP }, code: 1 };
   const site = flagValue(argv, "--site");
   const subdomain = flagValue(argv, "--subdomain");
-  const refusal = subdomainFlagProblem(argv, command, site, subdomain);
+  const folder = flagValue(argv, "--folder");
+  const refusal = newSiteFlagProblem(argv, command, site, subdomain, SUBDOMAIN_FLAG) ?? newSiteFlagProblem(argv, command, site, folder, FOLDER_FLAG);
   if (refusal !== void 0) {
     const failed = { text: refusal, json: { error: refusal }, code: 1 };
     return json ? { ...failed, text: JSON.stringify(failed.json, null, 2) } : failed;
@@ -1871,11 +2332,11 @@ async function run(argv) {
     json,
     argv.includes("--device"),
     argv.includes("--yes"),
-    subdomain
+    { subdomain, folder }
   );
   return json ? { ...result, text: JSON.stringify(result.json, null, 2) } : result;
 }
-async function dispatch(command, rest, site, json, device, confirmed, subdomain) {
+async function dispatch(command, rest, site, json, device, confirmed, newSite = {}) {
   switch (command) {
     case "login": {
       const print = json ? () => {
@@ -1885,18 +2346,20 @@ async function dispatch(command, rest, site, json, device, confirmed, subdomain)
     case "logout":
       return logout();
     case "init":
-      return await init(rest[0] ?? ".", site, subdomain);
+      return await init(rest[0] ?? ".", site, newSite);
     case "deploy": {
       const report = json ? silentProgress : progressWriter(
         (text) => process.stderr.write(text),
         process.stderr.isTTY === true,
         process.stderr.columns ?? 80
       );
-      return await deployCommand(rest[0], site, report, subdomain);
+      return await deployCommand(rest[0], site, report, newSite);
     }
     case "ls":
     case "list":
       return await list();
+    case "folders":
+      return await folders();
     case "open":
       return await open(rest[0] ?? site);
     case "rollback":
@@ -1906,7 +2369,7 @@ async function dispatch(command, rest, site, json, device, confirmed, subdomain)
     case "token":
     case "tokens":
       return rest[0] === void 0 || rest[0] === "list" ? await tokens() : {
-        text: `\`token ${rest[0]}\` does not exist. Only \`token list\` does: creating and revoking a token need a browser session, at https://dropto.run/account/tokens.`,
+        text: `\`token ${rest[0]}\` does not exist. Only \`token list\` does: creating and revoking a token need a browser session, at https://app.dropto.run/account/tokens.`,
         json: { error: `Unknown token subcommand "${rest[0]}".` },
         code: 1
       };

package/dist/{package-DXmy47q4.js → package-D8mWS-nC.js}

@@ -1,5 +1,5 @@
 const name = "drop2run";
-const version = "0.5.0";
+const version = "0.7.0";
 const description = "Publish a page, a folder of documents or a built site to Drop2Run from the command line.";
 const license = "MIT";
 const type = "module";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "drop2run",
-	"version": "0.5.0",
+	"version": "0.7.0",
 	"description": "Publish a page, a folder of documents or a built site to Drop2Run from the command line.",
 	"license": "MIT",
 	"type": "module",