drop2run 0.6.0 → 0.7.0

package/README.md

@@ -82,7 +82,7 @@ server on `127.0.0.1`, which is what keeps it out of clipboards and scrollback.
 
 ### `--device`, for a machine with no browser
 
-`drop2run login --device` prints a short code and waits. Enter it at <https://dropto.run/device> from any
+`drop2run login --device` prints a short code and waits. Enter it at <https://app.dropto.run/device> from any
 machine you are already signed in on — a phone will do — and the terminal picks up its token.
 
 The short code is not the credential; it names the pending request, so somebody reading it over your
@@ -92,7 +92,7 @@ works once.
 ### CI
 
 Neither flow works in CI — nothing there can open a browser or approve anything. Create a token at
-<https://dropto.run/account/tokens> and set it in the environment:
+<https://app.dropto.run/account/tokens> and set it in the environment:
 
 ```
 DROP2RUN_TOKEN=d2r_...
@@ -110,7 +110,7 @@ account" is answerable in an issue report or a CI log.
 
 Both need a browser session, and that is deliberate rather than missing. A token that can mint tokens is
 not a leaked credential but a permanent one: whoever takes it makes a second, and revoking the first
-changes nothing. Make and revoke tokens at <https://dropto.run/account/tokens>.
+changes nothing. Make and revoke tokens at <https://app.dropto.run/account/tokens>.
 
 `token list` does exist and answers what a terminal can answer — which machines hold a credential, and
 which of them has not used it since it was made. It prints prefixes, never secrets.

package/dist/index.js

@@ -10,6 +10,8 @@ function configPath() {
   return join(homedir(), ".config", "drop2run", "config.json");
 }
 const DEFAULT_API_BASE_URL = "https://dropto.run/api";
+const PRODUCTION_SITE_ORIGIN = "https://dropto.run";
+const PRODUCTION_DASHBOARD_ORIGIN = "https://app.dropto.run";
 function loadCredentials(env = process.env, read = (path) => readFileSync(path, "utf8")) {
   let stored = {};
   try {
@@ -33,7 +35,8 @@ function resolveApiBaseUrl(env = process.env, read = (path) => readFileSync(path
   return url.replace(/\/+$/, "");
 }
 function dashboardUrlFor(apiBaseUrl) {
-  return apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+  const origin = apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+  return origin === PRODUCTION_SITE_ORIGIN ? PRODUCTION_DASHBOARD_ORIGIN : origin;
 }
 function saveToken(token, path = configPath()) {
   let existing = {};
@@ -76,14 +79,14 @@ function missingCredentialsMessage(surface = "cli") {
   ] : ["Run `drop2run login` to sign in through a browser, which stores one for you."];
   const byHand = surface === "mcp" ? [
     "To set one without signing in here, create a token at",
-    "https://dropto.run/account/tokens and either:",
+    "https://app.dropto.run/account/tokens and either:",
     `  - put it in ${configPath()} as {"token": "d2r_..."}, which this`,
     "    server reads on every call and needs no restart, or",
     `  - set ${TOKEN_VARIABLE} in the environment and restart this server, since it reads`,
     "    the environment it was started in."
   ] : [
     "For CI, or where no browser can be opened, create a token at",
-    "https://dropto.run/account/tokens and either:",
+    "https://app.dropto.run/account/tokens and either:",
     `  - set ${TOKEN_VARIABLE} in the environment, or`,
     `  - put it in ${configPath()} as {"token": "d2r_..."}`
   ];
@@ -409,6 +412,12 @@ function writeProject(project, directory = process.cwd()) {
 `);
   return path;
 }
+function sizeOf(content) {
+  return ArrayBuffer.isView(content) ? content.byteLength : content.size;
+}
+async function bytesOf(content) {
+  return ArrayBuffer.isView(content) ? content : new Uint8Array(await content.arrayBuffer());
+}
 class DeployError extends Error {
   /**
    * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
@@ -445,20 +454,55 @@ const ClientErrorCode = {
   /** The user cancelled. */
   Cancelled: "cancelled",
   /** An upload kept failing after every retry. */
-  UploadFailed: "upload_failed"
+  UploadFailed: "upload_failed",
+  /**
+   * The browser could not hold what was dropped in memory. Raised when allocating the buffer for a
+   * large zip or file fails, which a browser reports as a `RangeError` rather than as anything that
+   * names memory.
+   */
+  OutOfMemory: "out_of_memory",
+  /**
+   * A dropped file could not be read when it came to be hashed. Files from a folder stay on disk until
+   * then, so one moved, deleted or changed after the drop fails here rather than at the drop.
+   */
+  ReadFailed: "read_failed",
+  /**
+   * A control-plane call got no answer: the connection failed before a response arrived, or the
+   * request timeout passed. Distinct from an HTTP error, which is an answer — this one says nothing
+   * about whether the server acted, which is why only an idempotent call may retry on it.
+   */
+  NetworkFailed: "network_failed"
 };
+function describeError(error) {
+  const parts = [];
+  let current = error;
+  for (let depth = 0; depth < 5 && current !== void 0 && current !== null; depth++) {
+    if (current instanceof Error) {
+      const code = current.code;
+      parts.push(typeof code === "string" ? `${current.message} (${code})` : current.message);
+      current = current.cause;
+    } else {
+      parts.push(String(current));
+      break;
+    }
+  }
+  return parts.join(" ← ");
+}
 const ACCOUNT_HEADER = "X-Drop2Run-Account";
 const CLAIM_TOKEN_HEADER = "X-Claim-Token";
+const DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+const COMPLETE_RETRY_DELAYS_MS = [1e3, 4e3];
 async function prepareDeploy(siteId, files, options, signal) {
   const manifest = files.map((file) => ({
     path: file.path,
     sha256: file.sha256,
-    size: file.bytes.length
+    size: sizeOf(file.bytes)
   }));
   const prepared = await request(
     `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
     { files: manifest },
-    options
+    options,
+    signal
   );
   return { ...prepared, uploadUrl: absolute(prepared.uploadUrl, options.baseUrl) };
 }
@@ -468,31 +512,65 @@ function absolute(uploadUrl, baseUrl) {
   return new URL(uploadUrl, baseUrl).toString();
 }
 async function completeDeploy(siteId, deployId, options, signal, name) {
-  return request(
-    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`,
-    // A bodyless POST when there is no name to send, which is what this call has always been. The
-    // server treats an absent body and an absent field identically, so nothing depends on which of
-    // the two a client picks.
-    name === null || name === void 0 ? void 0 : { name },
-    options
-  );
+  const path = `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`;
+  const body = name === null || name === void 0 ? void 0 : { name };
+  const delay = options.delay ?? wait;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await request(path, body, options, signal);
+    } catch (error) {
+      const unanswered = error instanceof DeployError && error.code === ClientErrorCode.NetworkFailed;
+      if (!unanswered || attempt >= COMPLETE_RETRY_DELAYS_MS.length || signal?.aborted) throw error;
+      await delay(COMPLETE_RETRY_DELAYS_MS[attempt] ?? 1e3);
+    }
+  }
+}
+function wait(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function request(path, body, options, signal) {
   const doFetch = options.fetch ?? globalFetch$1();
   const base = options.baseUrl ?? "/api";
+  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const headers = {};
   if (body !== void 0) headers["Content-Type"] = "application/json";
   if (options.claimToken) headers[CLAIM_TOKEN_HEADER] = options.claimToken;
   if (options.token) headers.Authorization = `Bearer ${options.token}`;
   if (options.accountId) headers[ACCOUNT_HEADER] = options.accountId;
-  const response = await doFetch(`${base}/${path}`, {
-    method: "POST",
-    headers,
-    ...body === void 0 ? {} : { body: JSON.stringify(body) },
-    ...{}
-  });
-  if (!response.ok) throw await problemToError(response);
-  return await response.json();
+  const controller = new AbortController();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  try {
+    const response = await doFetch(`${base}/${path}`, {
+      method: "POST",
+      headers,
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      signal: controller.signal
+    });
+    if (!response.ok) throw await problemToError(response);
+    return await response.json();
+  } catch (error) {
+    if (error instanceof DeployError || signal?.aborted) throw error;
+    if (timedOut) {
+      throw new DeployError(
+        ClientErrorCode.NetworkFailed,
+        `The server did not answer within ${Math.round(timeoutMs / 1e3)} seconds.`,
+        { path, cause: describeError(error) }
+      );
+    }
+    if (error instanceof TypeError) {
+      throw new DeployError(ClientErrorCode.NetworkFailed, "Could not reach the server.", {
+        path,
+        cause: describeError(error)
+      });
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function globalFetch$1() {
   return globalThis.fetch.bind(globalThis);
@@ -991,17 +1069,29 @@ function extensionOf(path) {
   return dot <= 0 ? "" : name.slice(dot).toLowerCase();
 }
 async function sha256Hex(bytes) {
-  const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 async function hashAll(files, onProgress, signal) {
   const hashed = [];
   for (const [index, file] of files.entries()) {
-    hashed.push({ ...file, sha256: await sha256Hex(file.bytes) });
+    hashed.push({ ...file, sha256: await sha256Hex(await readForHash(file)) });
     onProgress?.(index + 1, files.length);
   }
   return hashed;
 }
+async function readForHash(file) {
+  try {
+    return await bytesOf(file.bytes);
+  } catch (error) {
+    if (error instanceof RangeError) throw error;
+    throw new DeployError(
+      ClientErrorCode.ReadFailed,
+      `Could not read ${file.path}. It may have been moved, renamed or changed since you dropped it — drop the folder again.`,
+      { path: file.path, cause: describeError(error) }
+    );
+  }
+}
 const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
 const IGNORED_DIRECTORIES = [
   "__MACOSX",
@@ -1011,7 +1101,11 @@ const IGNORED_DIRECTORIES = [
   ".hg",
   ".idea",
   ".vscode",
-  ".claude"
+  ".claude",
+  ".agents",
+  ".cursor",
+  ".codex",
+  ".gemini"
 ];
 function shouldIgnore(path) {
   const segments = path.split("/");
@@ -1073,7 +1167,7 @@ function checkLimits(files, limits) {
     );
   }
   const refusal = sizeRefusal(
-    files.map((file) => ({ path: file.path, size: file.bytes.length })),
+    files.map((file) => ({ path: file.path, size: sizeOf(file.bytes) })),
     limits
   );
   if (refusal) throw refusal;
@@ -1114,13 +1208,24 @@ const HEAD_BYTES = 64 * 1024;
 const TITLE_SEPARATORS = ["|", "·", "—", "–", " - "];
 function suggestSiteName(files) {
   const index = files.find((file) => file.path === "index.html");
-  if (index === void 0) return null;
+  if (index === void 0 || !ArrayBuffer.isView(index.bytes)) return null;
   try {
     return nameFromHtml(decodeHead(index.bytes));
   } catch {
     return null;
   }
 }
+async function readSiteName(files) {
+  const index = files.find((file) => file.path === "index.html");
+  if (index === void 0) return null;
+  if (ArrayBuffer.isView(index.bytes)) return suggestSiteName(files);
+  try {
+    const head = new Uint8Array(await index.bytes.slice(0, HEAD_BYTES).arrayBuffer());
+    return suggestSiteName([{ path: index.path, bytes: head }]);
+  } catch {
+    return null;
+  }
+}
 function decodeHead(bytes) {
   return new TextDecoder("utf-8", { fatal: false }).decode(
     bytes.subarray(0, HEAD_BYTES)
@@ -1152,7 +1257,7 @@ function matchTag(html, tag) {
   const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(
     html
   );
-  return match?.[1] ?? null;
+  return match?.[1] === void 0 ? null : decodeEntities(match[1]);
 }
 function matchOgSiteName(html) {
   const patterns = [
@@ -1161,10 +1266,56 @@ function matchOgSiteName(html) {
   ];
   for (const pattern of patterns) {
     const match = pattern.exec(html);
-    if (match?.[1] !== void 0) return match[1];
+    if (match?.[1] !== void 0) return decodeEntities(match[1]);
   }
   return null;
 }
+const LATIN1_ENTITIES = "nbsp iexcl cent pound curren yen brvbar sect uml copy ordf laquo not shy reg macr deg plusmn sup2 sup3 acute micro para middot cedil sup1 ordm raquo frac14 frac12 frac34 iquest Agrave Aacute Acirc Atilde Auml Aring AElig Ccedil Egrave Eacute Ecirc Euml Igrave Iacute Icirc Iuml ETH Ntilde Ograve Oacute Ocirc Otilde Ouml times Oslash Ugrave Uacute Ucirc Uuml Yacute THORN szlig agrave aacute acirc atilde auml aring aelig ccedil egrave eacute ecirc euml igrave iacute icirc iuml eth ntilde ograve oacute ocirc otilde ouml divide oslash ugrave uacute ucirc uuml yacute thorn yuml".split(" ");
+const NAMED_ENTITIES = new Map([
+  ...LATIN1_ENTITIES.map((name, index) => [name, 160 + index]),
+  ["amp", 38],
+  ["lt", 60],
+  ["gt", 62],
+  ["quot", 34],
+  ["apos", 39],
+  ["ensp", 8194],
+  ["emsp", 8195],
+  ["thinsp", 8201],
+  ["ndash", 8211],
+  ["mdash", 8212],
+  ["lsquo", 8216],
+  ["rsquo", 8217],
+  ["sbquo", 8218],
+  ["ldquo", 8220],
+  ["rdquo", 8221],
+  ["bdquo", 8222],
+  ["dagger", 8224],
+  ["Dagger", 8225],
+  ["bull", 8226],
+  ["hellip", 8230],
+  ["prime", 8242],
+  ["lsaquo", 8249],
+  ["rsaquo", 8250],
+  ["euro", 8364],
+  ["trade", 8482],
+  ["larr", 8592],
+  ["rarr", 8594],
+  ["hearts", 9829]
+]);
+function decodeEntities(text) {
+  return text.replace(
+    /&(?:#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{1,31}));/g,
+    (whole, decimal, hex, name) => {
+      if (name !== void 0) {
+        const code2 = NAMED_ENTITIES.get(name);
+        return code2 === void 0 ? whole : String.fromCodePoint(code2);
+      }
+      const code = decimal !== void 0 ? Number(decimal) : Number.parseInt(hex ?? "", 16);
+      const valid = code > 0 && code <= 1114111 && (code < 55296 || code > 57343);
+      return String.fromCodePoint(valid ? code : 65533);
+    }
+  );
+}
 const INVISIBLE = new RegExp(
   `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8203)}-${String.fromCharCode(8207)}${String.fromCharCode(8232)}-${String.fromCharCode(8238)}${String.fromCharCode(8288)}-${String.fromCharCode(8292)}${String.fromCharCode(8294)}-${String.fromCharCode(8303)}${String.fromCharCode(65279)}]`,
   "g"
@@ -1206,46 +1357,105 @@ function trimSuffix(title) {
   return title;
 }
 const DEFAULT_CONCURRENCY = 8;
+const DEFAULT_BYTES_IN_FLIGHT = 64 * 1024 * 1024;
 const DEFAULT_RETRIES = 3;
 const BACKOFF_MS = [1e3, 2e3, 4e3];
-async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}) {
-  const doFetch = deps.fetch ?? globalFetch();
+const DEFAULT_STALL_MS = 3e4;
+const PROGRESS_INTERVAL_MS = 200;
+class StalledError extends Error {
+  /** @param seconds How long nothing moved. */
+  constructor(seconds) {
+    super(`No data moved for ${seconds}s.`);
+    this.name = "StalledError";
+  }
+}
+async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}, onRetry) {
+  const put = deps.put ?? defaultTransport(deps.fetch);
   const delay = deps.delay ?? defaultDelay;
   const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
   const retries = deps.retries ?? DEFAULT_RETRIES;
+  const stallMs = deps.stallMs ?? DEFAULT_STALL_MS;
+  const now = deps.now ?? Date.now;
+  const maxBytesInFlight = deps.maxBytesInFlight ?? DEFAULT_BYTES_IN_FLIGHT;
   const byPath = new Map(files.map((file) => [file.path, file]));
   let nextIndex = 0;
   let done = 0;
-  let uploadedBytes = 0;
+  let failed = false;
+  let reserved = 0;
+  let waiting = [];
+  const acquire = async (size) => {
+    while (reserved > 0 && reserved + size > maxBytesInFlight) {
+      await new Promise((resolve2) => waiting.push(resolve2));
+    }
+    reserved += size;
+  };
+  const release = (size) => {
+    reserved -= size;
+    const woken = waiting;
+    waiting = [];
+    for (const wake of woken) wake();
+  };
+  let landedBytes = 0;
+  const inFlight = /* @__PURE__ */ new Map();
+  let lastReport = Number.NEGATIVE_INFINITY;
+  const report = (path) => {
+    if (onProgress === void 0) return;
+    const at = now();
+    if (path === void 0 && at - lastReport < PROGRESS_INTERVAL_MS) return;
+    lastReport = at;
+    let bytes = landedBytes;
+    for (const sent of inFlight.values()) bytes += sent;
+    onProgress(done, targets.length, bytes, path);
+  };
   const worker = async () => {
     for (; ; ) {
+      if (failed) return;
       const index = nextIndex++;
       const target = targets[index];
       if (target === void 0) return;
       const file = byPath.get(target.path);
       if (file === void 0) {
+        failed = true;
         throw new DeployError(
           ClientErrorCode.UploadFailed,
           `The server asked for ${target.path}, which is not in the manifest.`,
           { path: target.path }
         );
       }
-      await uploadOne(target, file, {
-        doFetch,
-        delay,
-        retries,
-        signal,
-        uploadUrl
-      });
+      const size = sizeOf(file.bytes);
+      await acquire(size);
+      try {
+        if (failed) return;
+        signal?.throwIfAborted();
+        await uploadOne(target, file, {
+          put,
+          delay,
+          retries,
+          signal,
+          uploadUrl,
+          stallMs,
+          onSent: (sent) => {
+            inFlight.set(index, sent);
+            report();
+          },
+          onRetry: (attempt, stalled) => {
+            inFlight.set(index, 0);
+            onRetry?.(target.path, attempt, retries + 1, stalled);
+          }
+        });
+      } catch (error) {
+        failed = true;
+        throw error;
+      } finally {
+        release(size);
+      }
+      inFlight.delete(index);
       done += 1;
-      uploadedBytes += file.bytes.length;
-      onProgress?.(done, targets.length, uploadedBytes, file.path);
+      landedBytes += size;
+      report(file.path);
     }
   };
-  const workers = Array.from(
-    { length: Math.min(concurrency, targets.length) },
-    worker
-  );
+  const workers = Array.from({ length: Math.min(concurrency, targets.length) }, worker);
   try {
     await Promise.all(workers);
   } catch (error) {
@@ -1257,39 +1467,122 @@ async function uploadOne(target, file, context) {
   for (let attempt = 0; attempt <= context.retries; attempt++) {
     context.signal?.throwIfAborted();
     if (attempt > 0) {
+      context.onRetry(attempt + 1, lastError instanceof StalledError);
       await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
       context.signal?.throwIfAborted();
     }
     try {
-      const response = await context.doFetch(context.uploadUrl, {
-        method: "PUT",
-        body: new Blob([file.bytes.slice().buffer]),
-        // The permit is the whole request. `Content-Length` is required by the Worker and cannot
-        // be set here — it is a forbidden header name — but the browser derives it from the body,
-        // which is exactly the length the token names.
-        headers: { Authorization: `Bearer ${target.token}` },
-        ...context.signal ? { signal: context.signal } : {}
+      const status = await context.put({
+        url: context.uploadUrl,
+        token: target.token,
+        body: untyped(file.bytes),
+        signal: context.signal,
+        onSent: context.onSent,
+        stallMs: context.stallMs
       });
-      if (response.ok) return;
-      if (response.status === 401 || response.status === 403 || response.status === 429) {
+      if (status >= 200 && status < 300) return;
+      if (status === 401 || status === 403 || status === 429) {
         throw new DeployError(
           ClientErrorCode.UploadFailed,
           `Upload of ${target.path} was refused. The upload window may have expired — try deploying again.`,
-          { path: target.path, status: response.status }
+          { path: target.path, status }
         );
       }
-      lastError = new Error(`HTTP ${response.status}`);
+      if (status === 413) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `${target.path} is too large to upload in one request. Make it smaller, or leave it out of this publish.`,
+          { path: target.path, status }
+        );
+      }
+      lastError = new Error(`HTTP ${status}`);
     } catch (error) {
       if (error instanceof DeployError) throw error;
       if (isAbort(error)) throw cancelled();
       lastError = error;
     }
   }
-  throw new DeployError(
-    ClientErrorCode.UploadFailed,
-    `Could not upload ${target.path} after ${context.retries + 1} attempts.`,
-    { path: target.path, cause: String(lastError) }
-  );
+  const message = lastError instanceof StalledError ? `Upload of ${target.path} stopped moving and did not recover after ${context.retries + 1} attempts. Check your connection and try again.` : `Could not upload ${target.path} after ${context.retries + 1} attempts.`;
+  throw new DeployError(ClientErrorCode.UploadFailed, message, {
+    path: target.path,
+    cause: describeError(lastError)
+  });
+}
+function untyped(content) {
+  if (ArrayBuffer.isView(content) || content.type === "") return content;
+  return content.slice(0, content.size);
+}
+function defaultTransport(doFetch) {
+  if (doFetch !== void 0) return fetchTransport(doFetch);
+  const Xhr = globalThis.XMLHttpRequest;
+  return Xhr === void 0 ? fetchTransport(globalFetch()) : xhrTransport(Xhr);
+}
+function fetchTransport(doFetch) {
+  return async ({ url, token, body, signal }) => {
+    const response = await doFetch(url, {
+      method: "PUT",
+      // The view, not a copy. Wrapping it in `new Blob([body.slice().buffer])` made two extra
+      // full-size copies of every file in flight — eight at once, so up to 400 MB on a drop of
+      // 50 MB files. `fetch` sends exactly the range a view covers. The cast is TypeScript's
+      // SharedArrayBuffer distinction again; see `sha256Hex`. A `Blob` goes as it is, and the runtime
+      // streams it from disk.
+      body,
+      // The permit is the whole request. `Content-Length` is required by the Worker and cannot be
+      // set here — it is a forbidden header name — but the runtime derives it from the body, which
+      // is exactly the length the token names.
+      headers: { Authorization: `Bearer ${token}` },
+      ...signal ? { signal } : {}
+    });
+    return response.status;
+  };
+}
+function xhrTransport(Xhr) {
+  return ({ url, token, body, signal, onSent, stallMs }) => new Promise((resolve2, reject) => {
+    const xhr = new Xhr();
+    let settled = false;
+    let timer;
+    const settle = (finish) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      finish();
+    };
+    const arm = () => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        xhr.abort();
+        settle(() => reject(new StalledError(Math.round(stallMs / 1e3))));
+      }, stallMs);
+    };
+    function onAbort() {
+      xhr.abort();
+      settle(() => reject(abortReason(signal)));
+    }
+    if (signal?.aborted) {
+      reject(abortReason(signal));
+      return;
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+    xhr.open("PUT", url);
+    xhr.setRequestHeader("Authorization", `Bearer ${token}`);
+    xhr.upload.onprogress = (event) => {
+      arm();
+      onSent(event.loaded);
+    };
+    xhr.onprogress = arm;
+    xhr.onload = () => settle(() => resolve2(xhr.status));
+    xhr.onerror = () => settle(() => reject(new TypeError("Network error during upload.")));
+    arm();
+    xhr.send(body);
+  });
+}
+function abortReason(signal) {
+  const reason = signal?.reason;
+  if (reason instanceof Error) return reason;
+  const error = new Error("Aborted.");
+  error.name = "AbortError";
+  return error;
 }
 function globalFetch() {
   return globalThis.fetch.bind(globalThis);
@@ -1303,9 +1596,17 @@ function isAbort(error) {
 function cancelled() {
   return new DeployError(ClientErrorCode.Cancelled, "Deploy cancelled.");
 }
+function outOfMemory(detail) {
+  return new DeployError(
+    ClientErrorCode.OutOfMemory,
+    "This browser ran out of memory reading what you dropped. Drop the unzipped folder instead, or try again in a desktop browser with fewer tabs open.",
+    detail
+  );
+}
 function asDeployError(error) {
   if (error instanceof DeployError) return error;
   if (isAbort(error)) return cancelled();
+  if (error instanceof RangeError) return outOfMemory(error.message);
   return new DeployError(
     ClientErrorCode.UploadFailed,
     error instanceof Error ? error.message : "Upload failed.",
@@ -1314,7 +1615,11 @@ function asDeployError(error) {
 }
 async function deploy(source, siteId, onProgress, signal, options = {}) {
   try {
-    const collected = await source(signal);
+    onProgress({ type: "reading", bytes: 0, total: 0 });
+    const collected = await source(
+      signal,
+      (bytes, total) => onProgress({ type: "reading", bytes, total })
+    );
     onProgress({ type: "collecting", files: collected.length });
     const rename = renameOfLoneHtmlPage(collected.map((file) => file.path));
     const files = rename === null ? collected : collected.map((file) => file.path === rename ? { ...file, path: "index.html" } : file);
@@ -1330,6 +1635,21 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       onProgress({ type: "unchanged", url: prepared.url ?? "" });
       return;
     }
+    const sizes = new Map(hashed.map((file) => [file.path, sizeOf(file.bytes)]));
+    const totalBytes = prepared.upload.reduce(
+      (sum, target) => sum + (sizes.get(target.path) ?? 0),
+      0
+    );
+    if (prepared.upload.length > 0) {
+      onProgress({
+        type: "uploading",
+        done: prepared.reused,
+        total: prepared.total,
+        bytes: 0,
+        totalBytes,
+        reused: prepared.reused
+      });
+    }
     await uploadAll(
       prepared.upload,
       prepared.uploadUrl,
@@ -1339,11 +1659,13 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
         done: prepared.reused + done,
         total: prepared.total,
         bytes,
+        totalBytes,
         reused: prepared.reused,
-        path
+        ...path === void 0 ? {} : { path }
       }),
       signal,
-      options.upload
+      options.upload,
+      (path, attempt, attempts, stalled) => onProgress({ type: "retrying", path, attempt, attempts, stalled })
     );
     onProgress({ type: "completing", reused: prepared.reused });
     const completed = await completeDeploy(
@@ -1351,7 +1673,7 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       prepared.deployId,
       options,
       signal,
-      suggestSiteName(files)
+      await readSiteName(files)
     );
     onProgress({ type: "done", url: completed.url, name: completed.name });
   } catch (error) {
@@ -1488,6 +1810,10 @@ function shortenPath(path, width) {
 }
 function describe(event, width = 80) {
   switch (event.type) {
+    case "reading":
+      return event.total > 0 ? `Reading ${formatBytes(event.bytes)}/${formatBytes(event.total)}` : "Reading files";
+    case "retrying":
+      return `${event.stalled ? "Upload stalled" : "Upload failed"}, retrying ${shortenPath(event.path, Math.max(12, width - 40))} (attempt ${event.attempt}/${event.attempts})`;
     case "collecting":
       return `Collected ${event.files.toLocaleString()} ${event.files === 1 ? "file" : "files"}`;
     case "hashing":
@@ -1648,7 +1974,7 @@ async function whoami() {
   });
   if (!response.ok) {
     return failure(
-      response.status === 401 ? "This token is not valid any more. It may have been revoked or expired — create another at https://dropto.run/account/tokens." : `The API answered ${response.status}.`
+      response.status === 401 ? "This token is not valid any more. It may have been revoked or expired — create another at https://app.dropto.run/account/tokens." : `The API answered ${response.status}.`
     );
   }
   const me = await response.json();
@@ -1925,10 +2251,10 @@ Where a site comes from
 Signing in
   \`login\` opens a browser and listens on 127.0.0.1, so it needs both on this
   machine. Over SSH, in a container or under WSL, use \`login --device\`: it
-  prints a short code to enter at https://dropto.run/device from anywhere.
+  prints a short code to enter at https://app.dropto.run/device from anywhere.
 
   For CI, neither flow applies — create a token at
-  https://dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
+  https://app.dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
   environment or put it in ~/.config/drop2run/config.json as {"token": "d2r_..."}.
 `;
 function flagValue(args, flag) {
@@ -1983,7 +2309,7 @@ async function run(argv) {
   const positional = positionals(argv);
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-bzaCMW_E.js").then(
+    const { version } = await import("./package-D8mWS-nC.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };
@@ -2043,7 +2369,7 @@ async function dispatch(command, rest, site, json, device, confirmed, newSite =
     case "token":
     case "tokens":
       return rest[0] === void 0 || rest[0] === "list" ? await tokens() : {
-        text: `\`token ${rest[0]}\` does not exist. Only \`token list\` does: creating and revoking a token need a browser session, at https://dropto.run/account/tokens.`,
+        text: `\`token ${rest[0]}\` does not exist. Only \`token list\` does: creating and revoking a token need a browser session, at https://app.dropto.run/account/tokens.`,
         json: { error: `Unknown token subcommand "${rest[0]}".` },
         code: 1
       };

package/dist/{package-bzaCMW_E.js → package-D8mWS-nC.js}

@@ -1,5 +1,5 @@
 const name = "drop2run";
-const version = "0.6.0";
+const version = "0.7.0";
 const description = "Publish a page, a folder of documents or a built site to Drop2Run from the command line.";
 const license = "MIT";
 const type = "module";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "drop2run",
-	"version": "0.6.0",
+	"version": "0.7.0",
 	"description": "Publish a page, a folder of documents or a built site to Drop2Run from the command line.",
 	"license": "MIT",
 	"type": "module",