drop2run 0.6.0 → 0.8.0

package/dist/index.js

@@ -10,6 +10,8 @@ function configPath() {
   return join(homedir(), ".config", "drop2run", "config.json");
 }
 const DEFAULT_API_BASE_URL = "https://dropto.run/api";
+const PRODUCTION_SITE_ORIGIN = "https://dropto.run";
+const PRODUCTION_DASHBOARD_ORIGIN = "https://app.dropto.run";
 function loadCredentials(env = process.env, read = (path) => readFileSync(path, "utf8")) {
   let stored = {};
   try {
@@ -33,7 +35,8 @@ function resolveApiBaseUrl(env = process.env, read = (path) => readFileSync(path
   return url.replace(/\/+$/, "");
 }
 function dashboardUrlFor(apiBaseUrl) {
-  return apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+  const origin = apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+  return origin === PRODUCTION_SITE_ORIGIN ? PRODUCTION_DASHBOARD_ORIGIN : origin;
 }
 function saveToken(token, path = configPath()) {
   let existing = {};
@@ -76,14 +79,14 @@ function missingCredentialsMessage(surface = "cli") {
   ] : ["Run `drop2run login` to sign in through a browser, which stores one for you."];
   const byHand = surface === "mcp" ? [
     "To set one without signing in here, create a token at",
-    "https://dropto.run/account/tokens and either:",
+    "https://app.dropto.run/account/tokens and either:",
     `  - put it in ${configPath()} as {"token": "d2r_..."}, which this`,
     "    server reads on every call and needs no restart, or",
     `  - set ${TOKEN_VARIABLE} in the environment and restart this server, since it reads`,
     "    the environment it was started in."
   ] : [
     "For CI, or where no browser can be opened, create a token at",
-    "https://dropto.run/account/tokens and either:",
+    "https://app.dropto.run/account/tokens and either:",
     `  - set ${TOKEN_VARIABLE} in the environment, or`,
     `  - put it in ${configPath()} as {"token": "d2r_..."}`
   ];
@@ -115,7 +118,9 @@ async function call(credentials, path, init2 = {}) {
 async function findSite(credentials, site) {
   const found = await lookUpSite(credentials, site);
   if (found === void 0) {
-    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+    throw new Error(
+      `No site of yours is called "${site}". \`drop2run ls\` or the list_sites tool shows what exists.`
+    );
   }
   return found;
 }
@@ -159,6 +164,108 @@ async function promoteDeploy(credentials, siteId, deployId) {
     { method: "POST" }
   );
 }
+function enumName(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function actionOf(expiresAt, action) {
+  return expiresAt === null ? null : enumName(action);
+}
+async function readInvitedOnly(credentials, siteId) {
+  try {
+    const page = await call(
+      credentials,
+      `sites/${encodeURIComponent(siteId)}/viewers?pageSize=1`
+    );
+    return typeof page.invitedOnly === "boolean" ? page.invitedOnly : null;
+  } catch {
+    return null;
+  }
+}
+async function folderFromListing(credentials, siteId, subdomain) {
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(subdomain)}`
+  );
+  return sites.find((candidate) => candidate.siteId === siteId)?.folderId ?? null;
+}
+async function getSite(credentials, siteId) {
+  const [site, invitedOnly] = await Promise.all([
+    call(
+      credentials,
+      `sites/${encodeURIComponent(siteId)}`
+    ),
+    readInvitedOnly(credentials, siteId)
+  ]);
+  const folderId = site.folderId !== void 0 ? site.folderId : await folderFromListing(credentials, site.siteId, site.subdomain);
+  return {
+    siteId: site.siteId,
+    subdomain: site.subdomain,
+    url: site.url,
+    name: site.name,
+    status: enumName(site.status),
+    invitedOnly,
+    liveDeployId: site.liveDeployId,
+    spaMode: site.spaMode,
+    docsMode: site.docsMode,
+    modeIsManual: site.modeIsManual,
+    passwordProtected: site.passwordProtected,
+    passwordProtectionAvailable: site.passwordProtectionAvailable,
+    formsEnabled: site.formsEnabled,
+    formsAvailable: site.formsAvailable,
+    expiresAt: site.expiresAt,
+    expiryAction: actionOf(site.expiresAt, site.expiryAction ?? ""),
+    scheduledExpiryAvailable: site.scheduledExpiryAvailable,
+    folderId,
+    deploys: site.deploys.map((deploy2) => ({
+      deployId: deploy2.deployId,
+      status: deploy2.status,
+      fileCount: deploy2.fileCount,
+      totalBytes: deploy2.totalBytes,
+      createdAt: deploy2.createdAt,
+      completedAt: deploy2.completedAt,
+      filesKept: deploy2.filesKept
+    }))
+  };
+}
+async function updateSiteSettings(credentials, siteId, change) {
+  const body = {};
+  if (change.name !== void 0) body.name = change.name;
+  if (change.mode !== void 0) {
+    body.spaMode = change.mode === "spa";
+    body.docsMode = change.mode === "docs";
+  }
+  if (change.password !== void 0) body.password = change.password;
+  if (change.expiresAt !== void 0) body.expiresAt = change.expiresAt;
+  if (change.expiryAction !== void 0) body.expiryAction = change.expiryAction;
+  if (change.formsEnabled !== void 0) body.formsEnabled = change.formsEnabled;
+  if (change.folderId !== void 0) body.folderId = change.folderId;
+  if (Object.keys(body).length === 0) throw new Error("Nothing to change — name a setting.");
+  const wasInvitedOnly = change.password !== void 0 && change.password !== "" ? await readInvitedOnly(credentials, siteId) : null;
+  const settings = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  const invitedOnly = typeof settings.invitedOnly === "boolean" ? settings.invitedOnly : null;
+  return {
+    ...settings,
+    expiryAction: actionOf(settings.expiresAt, settings.expiryAction ?? ""),
+    invitedOnly,
+    replacedInviteOnly: wasInvitedOnly === true && invitedOnly === false
+  };
+}
+async function setSitePaused(credentials, siteId, action) {
+  const state = await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/${action}`,
+    { method: "POST" }
+  );
+  return {
+    siteId: state.siteId,
+    subdomain: state.subdomain,
+    status: enumName(state.status),
+    ownerPaused: state.ownerPaused
+  };
+}
 async function listTokens(credentials) {
   const body = await call(credentials, "tokens");
   return body.tokens;
@@ -233,6 +340,46 @@ async function resolveFolder(credentials, folder) {
     `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
   );
 }
+const ROOT_FOLDER = "root";
+async function resolveFolderTarget(credentials, folder) {
+  return folder.trim().toLowerCase() === ROOT_FOLDER ? ROOT_FOLDER : await resolveFolder(credentials, folder);
+}
+const VERSIONS_LISTED = 10;
+function servingModeOf$1(site) {
+  if (site.spaMode) return "spa";
+  if (site.docsMode) return "docs";
+  return "static";
+}
+function accessOf(site) {
+  if (site.passwordProtected) return "password";
+  if (site.invitedOnly === true) return "invite-only";
+  if (site.invitedOnly === false) return "public";
+  return "no password (whether it is invite-only could not be read)";
+}
+function describeSite(site, folderPath) {
+  const unavailable = (available) => available ? "" : " (not on this plan)";
+  const versions = site.deploys.slice(0, VERSIONS_LISTED).map((deploy2) => {
+    const live = deploy2.deployId === site.liveDeployId ? " ← served" : "";
+    const kept = deploy2.filesKept ? "" : ", files collected — cannot be rolled back to";
+    return `  ${deploy2.deployId}  ${deploy2.createdAt}  ${deploy2.status}, ${deploy2.fileCount} files${kept}${live}`;
+  });
+  const more = site.deploys.length - versions.length;
+  return [
+    `${site.subdomain} — ${site.url}`,
+    `  name      ${site.name ?? "(none)"}`,
+    `  status    ${site.status}`,
+    `  access    ${accessOf(site)}`,
+    `  mode      ${servingModeOf$1(site)}${site.modeIsManual ? "" : " (detected on each publish)"}`,
+    `  password  ${site.passwordProtected ? "on" : "off"}${unavailable(site.passwordProtectionAvailable)}`,
+    `  forms     ${site.formsEnabled ? "on" : "off"}${unavailable(site.formsAvailable)}`,
+    `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
+    `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
+    "",
+    site.deploys.length === 0 ? "No versions yet." : "Versions, newest first:",
+    ...versions,
+    ...more > 0 ? [`  … and ${more} older`] : []
+  ].join("\n");
+}
 const TIMEOUT_MS = 5 * 60 * 1e3;
 function newAttempt() {
   const verifier = randomBytes(32).toString("base64url");
@@ -409,6 +556,12 @@ function writeProject(project, directory = process.cwd()) {
 `);
   return path;
 }
+function sizeOf(content) {
+  return ArrayBuffer.isView(content) ? content.byteLength : content.size;
+}
+async function bytesOf(content) {
+  return ArrayBuffer.isView(content) ? content : new Uint8Array(await content.arrayBuffer());
+}
 class DeployError extends Error {
   /**
    * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
@@ -445,20 +598,55 @@ const ClientErrorCode = {
   /** The user cancelled. */
   Cancelled: "cancelled",
   /** An upload kept failing after every retry. */
-  UploadFailed: "upload_failed"
+  UploadFailed: "upload_failed",
+  /**
+   * The browser could not hold what was dropped in memory. Raised when allocating the buffer for a
+   * large zip or file fails, which a browser reports as a `RangeError` rather than as anything that
+   * names memory.
+   */
+  OutOfMemory: "out_of_memory",
+  /**
+   * A dropped file could not be read when it came to be hashed. Files from a folder stay on disk until
+   * then, so one moved, deleted or changed after the drop fails here rather than at the drop.
+   */
+  ReadFailed: "read_failed",
+  /**
+   * A control-plane call got no answer: the connection failed before a response arrived, or the
+   * request timeout passed. Distinct from an HTTP error, which is an answer — this one says nothing
+   * about whether the server acted, which is why only an idempotent call may retry on it.
+   */
+  NetworkFailed: "network_failed"
 };
+function describeError(error) {
+  const parts = [];
+  let current = error;
+  for (let depth = 0; depth < 5 && current !== void 0 && current !== null; depth++) {
+    if (current instanceof Error) {
+      const code = current.code;
+      parts.push(typeof code === "string" ? `${current.message} (${code})` : current.message);
+      current = current.cause;
+    } else {
+      parts.push(String(current));
+      break;
+    }
+  }
+  return parts.join(" ← ");
+}
 const ACCOUNT_HEADER = "X-Drop2Run-Account";
 const CLAIM_TOKEN_HEADER = "X-Claim-Token";
+const DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+const COMPLETE_RETRY_DELAYS_MS = [1e3, 4e3];
 async function prepareDeploy(siteId, files, options, signal) {
   const manifest = files.map((file) => ({
     path: file.path,
     sha256: file.sha256,
-    size: file.bytes.length
+    size: sizeOf(file.bytes)
   }));
   const prepared = await request(
     `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
     { files: manifest },
-    options
+    options,
+    signal
   );
   return { ...prepared, uploadUrl: absolute(prepared.uploadUrl, options.baseUrl) };
 }
@@ -468,31 +656,65 @@ function absolute(uploadUrl, baseUrl) {
   return new URL(uploadUrl, baseUrl).toString();
 }
 async function completeDeploy(siteId, deployId, options, signal, name) {
-  return request(
-    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`,
-    // A bodyless POST when there is no name to send, which is what this call has always been. The
-    // server treats an absent body and an absent field identically, so nothing depends on which of
-    // the two a client picks.
-    name === null || name === void 0 ? void 0 : { name },
-    options
-  );
+  const path = `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`;
+  const body = name === null || name === void 0 ? void 0 : { name };
+  const delay = options.delay ?? wait;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await request(path, body, options, signal);
+    } catch (error) {
+      const unanswered = error instanceof DeployError && error.code === ClientErrorCode.NetworkFailed;
+      if (!unanswered || attempt >= COMPLETE_RETRY_DELAYS_MS.length || signal?.aborted) throw error;
+      await delay(COMPLETE_RETRY_DELAYS_MS[attempt] ?? 1e3);
+    }
+  }
+}
+function wait(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function request(path, body, options, signal) {
   const doFetch = options.fetch ?? globalFetch$1();
   const base = options.baseUrl ?? "/api";
+  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const headers = {};
   if (body !== void 0) headers["Content-Type"] = "application/json";
   if (options.claimToken) headers[CLAIM_TOKEN_HEADER] = options.claimToken;
   if (options.token) headers.Authorization = `Bearer ${options.token}`;
   if (options.accountId) headers[ACCOUNT_HEADER] = options.accountId;
-  const response = await doFetch(`${base}/${path}`, {
-    method: "POST",
-    headers,
-    ...body === void 0 ? {} : { body: JSON.stringify(body) },
-    ...{}
-  });
-  if (!response.ok) throw await problemToError(response);
-  return await response.json();
+  const controller = new AbortController();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  try {
+    const response = await doFetch(`${base}/${path}`, {
+      method: "POST",
+      headers,
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      signal: controller.signal
+    });
+    if (!response.ok) throw await problemToError(response);
+    return await response.json();
+  } catch (error) {
+    if (error instanceof DeployError || signal?.aborted) throw error;
+    if (timedOut) {
+      throw new DeployError(
+        ClientErrorCode.NetworkFailed,
+        `The server did not answer within ${Math.round(timeoutMs / 1e3)} seconds.`,
+        { path, cause: describeError(error) }
+      );
+    }
+    if (error instanceof TypeError) {
+      throw new DeployError(ClientErrorCode.NetworkFailed, "Could not reach the server.", {
+        path,
+        cause: describeError(error)
+      });
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function globalFetch$1() {
   return globalThis.fetch.bind(globalThis);
@@ -991,17 +1213,29 @@ function extensionOf(path) {
   return dot <= 0 ? "" : name.slice(dot).toLowerCase();
 }
 async function sha256Hex(bytes) {
-  const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 async function hashAll(files, onProgress, signal) {
   const hashed = [];
   for (const [index, file] of files.entries()) {
-    hashed.push({ ...file, sha256: await sha256Hex(file.bytes) });
+    hashed.push({ ...file, sha256: await sha256Hex(await readForHash(file)) });
     onProgress?.(index + 1, files.length);
   }
   return hashed;
 }
+async function readForHash(file) {
+  try {
+    return await bytesOf(file.bytes);
+  } catch (error) {
+    if (error instanceof RangeError) throw error;
+    throw new DeployError(
+      ClientErrorCode.ReadFailed,
+      `Could not read ${file.path}. It may have been moved, renamed or changed since you dropped it — drop the folder again.`,
+      { path: file.path, cause: describeError(error) }
+    );
+  }
+}
 const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
 const IGNORED_DIRECTORIES = [
   "__MACOSX",
@@ -1011,7 +1245,11 @@ const IGNORED_DIRECTORIES = [
   ".hg",
   ".idea",
   ".vscode",
-  ".claude"
+  ".claude",
+  ".agents",
+  ".cursor",
+  ".codex",
+  ".gemini"
 ];
 function shouldIgnore(path) {
   const segments = path.split("/");
@@ -1046,6 +1284,24 @@ function canPublish(paths) {
   if (isImageFolder(paths)) return true;
   return paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0]);
 }
+function servingModeOf(flags) {
+  if (flags.docsMode) return "docs";
+  if (flags.spaMode) return "spa";
+  return "static";
+}
+function predictedModeOf(paths) {
+  if (paths.some((path) => path === REQUIRED_INDEX)) return "static";
+  if (paths.some(isDocumentPath)) return "docs";
+  if (isImageFolder(paths)) return "docs";
+  if (paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0])) return "docs";
+  return "static";
+}
+function nestedIndexOf(paths) {
+  if (predictedModeOf(paths) !== "docs") return null;
+  const suffix = `/${REQUIRED_INDEX}`;
+  const folders2 = paths.filter((path) => path.endsWith(suffix)).map((path) => path.slice(0, -suffix.length)).sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
+  return folders2[0] ?? null;
+}
 function renameOfLoneHtmlPage(paths) {
   if (paths.length !== 1) return null;
   const [only] = paths;
@@ -1073,7 +1329,7 @@ function checkLimits(files, limits) {
     );
   }
   const refusal = sizeRefusal(
-    files.map((file) => ({ path: file.path, size: file.bytes.length })),
+    files.map((file) => ({ path: file.path, size: sizeOf(file.bytes) })),
     limits
   );
   if (refusal) throw refusal;
@@ -1114,13 +1370,24 @@ const HEAD_BYTES = 64 * 1024;
 const TITLE_SEPARATORS = ["|", "·", "—", "–", " - "];
 function suggestSiteName(files) {
   const index = files.find((file) => file.path === "index.html");
-  if (index === void 0) return null;
+  if (index === void 0 || !ArrayBuffer.isView(index.bytes)) return null;
   try {
     return nameFromHtml(decodeHead(index.bytes));
   } catch {
     return null;
   }
 }
+async function readSiteName(files) {
+  const index = files.find((file) => file.path === "index.html");
+  if (index === void 0) return null;
+  if (ArrayBuffer.isView(index.bytes)) return suggestSiteName(files);
+  try {
+    const head = new Uint8Array(await index.bytes.slice(0, HEAD_BYTES).arrayBuffer());
+    return suggestSiteName([{ path: index.path, bytes: head }]);
+  } catch {
+    return null;
+  }
+}
 function decodeHead(bytes) {
   return new TextDecoder("utf-8", { fatal: false }).decode(
     bytes.subarray(0, HEAD_BYTES)
@@ -1152,7 +1419,7 @@ function matchTag(html, tag) {
   const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(
     html
   );
-  return match?.[1] ?? null;
+  return match?.[1] === void 0 ? null : decodeEntities(match[1]);
 }
 function matchOgSiteName(html) {
   const patterns = [
@@ -1161,10 +1428,56 @@ function matchOgSiteName(html) {
   ];
   for (const pattern of patterns) {
     const match = pattern.exec(html);
-    if (match?.[1] !== void 0) return match[1];
+    if (match?.[1] !== void 0) return decodeEntities(match[1]);
   }
   return null;
 }
+const LATIN1_ENTITIES = "nbsp iexcl cent pound curren yen brvbar sect uml copy ordf laquo not shy reg macr deg plusmn sup2 sup3 acute micro para middot cedil sup1 ordm raquo frac14 frac12 frac34 iquest Agrave Aacute Acirc Atilde Auml Aring AElig Ccedil Egrave Eacute Ecirc Euml Igrave Iacute Icirc Iuml ETH Ntilde Ograve Oacute Ocirc Otilde Ouml times Oslash Ugrave Uacute Ucirc Uuml Yacute THORN szlig agrave aacute acirc atilde auml aring aelig ccedil egrave eacute ecirc euml igrave iacute icirc iuml eth ntilde ograve oacute ocirc otilde ouml divide oslash ugrave uacute ucirc uuml yacute thorn yuml".split(" ");
+const NAMED_ENTITIES = new Map([
+  ...LATIN1_ENTITIES.map((name, index) => [name, 160 + index]),
+  ["amp", 38],
+  ["lt", 60],
+  ["gt", 62],
+  ["quot", 34],
+  ["apos", 39],
+  ["ensp", 8194],
+  ["emsp", 8195],
+  ["thinsp", 8201],
+  ["ndash", 8211],
+  ["mdash", 8212],
+  ["lsquo", 8216],
+  ["rsquo", 8217],
+  ["sbquo", 8218],
+  ["ldquo", 8220],
+  ["rdquo", 8221],
+  ["bdquo", 8222],
+  ["dagger", 8224],
+  ["Dagger", 8225],
+  ["bull", 8226],
+  ["hellip", 8230],
+  ["prime", 8242],
+  ["lsaquo", 8249],
+  ["rsaquo", 8250],
+  ["euro", 8364],
+  ["trade", 8482],
+  ["larr", 8592],
+  ["rarr", 8594],
+  ["hearts", 9829]
+]);
+function decodeEntities(text) {
+  return text.replace(
+    /&(?:#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{1,31}));/g,
+    (whole, decimal, hex, name) => {
+      if (name !== void 0) {
+        const code2 = NAMED_ENTITIES.get(name);
+        return code2 === void 0 ? whole : String.fromCodePoint(code2);
+      }
+      const code = decimal !== void 0 ? Number(decimal) : Number.parseInt(hex ?? "", 16);
+      const valid = code > 0 && code <= 1114111 && (code < 55296 || code > 57343);
+      return String.fromCodePoint(valid ? code : 65533);
+    }
+  );
+}
 const INVISIBLE = new RegExp(
   `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8203)}-${String.fromCharCode(8207)}${String.fromCharCode(8232)}-${String.fromCharCode(8238)}${String.fromCharCode(8288)}-${String.fromCharCode(8292)}${String.fromCharCode(8294)}-${String.fromCharCode(8303)}${String.fromCharCode(65279)}]`,
   "g"
@@ -1206,46 +1519,105 @@ function trimSuffix(title) {
   return title;
 }
 const DEFAULT_CONCURRENCY = 8;
+const DEFAULT_BYTES_IN_FLIGHT = 64 * 1024 * 1024;
 const DEFAULT_RETRIES = 3;
 const BACKOFF_MS = [1e3, 2e3, 4e3];
-async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}) {
-  const doFetch = deps.fetch ?? globalFetch();
+const DEFAULT_STALL_MS = 3e4;
+const PROGRESS_INTERVAL_MS = 200;
+class StalledError extends Error {
+  /** @param seconds How long nothing moved. */
+  constructor(seconds) {
+    super(`No data moved for ${seconds}s.`);
+    this.name = "StalledError";
+  }
+}
+async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}, onRetry) {
+  const put = deps.put ?? defaultTransport(deps.fetch);
   const delay = deps.delay ?? defaultDelay;
   const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
   const retries = deps.retries ?? DEFAULT_RETRIES;
+  const stallMs = deps.stallMs ?? DEFAULT_STALL_MS;
+  const now = deps.now ?? Date.now;
+  const maxBytesInFlight = deps.maxBytesInFlight ?? DEFAULT_BYTES_IN_FLIGHT;
   const byPath = new Map(files.map((file) => [file.path, file]));
   let nextIndex = 0;
   let done = 0;
-  let uploadedBytes = 0;
+  let failed = false;
+  let reserved = 0;
+  let waiting = [];
+  const acquire = async (size) => {
+    while (reserved > 0 && reserved + size > maxBytesInFlight) {
+      await new Promise((resolve2) => waiting.push(resolve2));
+    }
+    reserved += size;
+  };
+  const release = (size) => {
+    reserved -= size;
+    const woken = waiting;
+    waiting = [];
+    for (const wake of woken) wake();
+  };
+  let landedBytes = 0;
+  const inFlight = /* @__PURE__ */ new Map();
+  let lastReport = Number.NEGATIVE_INFINITY;
+  const report = (path) => {
+    if (onProgress === void 0) return;
+    const at = now();
+    if (path === void 0 && at - lastReport < PROGRESS_INTERVAL_MS) return;
+    lastReport = at;
+    let bytes = landedBytes;
+    for (const sent of inFlight.values()) bytes += sent;
+    onProgress(done, targets.length, bytes, path);
+  };
   const worker = async () => {
     for (; ; ) {
+      if (failed) return;
       const index = nextIndex++;
       const target = targets[index];
       if (target === void 0) return;
       const file = byPath.get(target.path);
       if (file === void 0) {
+        failed = true;
         throw new DeployError(
           ClientErrorCode.UploadFailed,
           `The server asked for ${target.path}, which is not in the manifest.`,
           { path: target.path }
         );
       }
-      await uploadOne(target, file, {
-        doFetch,
-        delay,
-        retries,
-        signal,
-        uploadUrl
-      });
+      const size = sizeOf(file.bytes);
+      await acquire(size);
+      try {
+        if (failed) return;
+        signal?.throwIfAborted();
+        await uploadOne(target, file, {
+          put,
+          delay,
+          retries,
+          signal,
+          uploadUrl,
+          stallMs,
+          onSent: (sent) => {
+            inFlight.set(index, sent);
+            report();
+          },
+          onRetry: (attempt, stalled) => {
+            inFlight.set(index, 0);
+            onRetry?.(target.path, attempt, retries + 1, stalled);
+          }
+        });
+      } catch (error) {
+        failed = true;
+        throw error;
+      } finally {
+        release(size);
+      }
+      inFlight.delete(index);
       done += 1;
-      uploadedBytes += file.bytes.length;
-      onProgress?.(done, targets.length, uploadedBytes, file.path);
+      landedBytes += size;
+      report(file.path);
     }
   };
-  const workers = Array.from(
-    { length: Math.min(concurrency, targets.length) },
-    worker
-  );
+  const workers = Array.from({ length: Math.min(concurrency, targets.length) }, worker);
   try {
     await Promise.all(workers);
   } catch (error) {
@@ -1257,39 +1629,122 @@ async function uploadOne(target, file, context) {
   for (let attempt = 0; attempt <= context.retries; attempt++) {
     context.signal?.throwIfAborted();
     if (attempt > 0) {
+      context.onRetry(attempt + 1, lastError instanceof StalledError);
       await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
       context.signal?.throwIfAborted();
     }
     try {
-      const response = await context.doFetch(context.uploadUrl, {
-        method: "PUT",
-        body: new Blob([file.bytes.slice().buffer]),
-        // The permit is the whole request. `Content-Length` is required by the Worker and cannot
-        // be set here — it is a forbidden header name — but the browser derives it from the body,
-        // which is exactly the length the token names.
-        headers: { Authorization: `Bearer ${target.token}` },
-        ...context.signal ? { signal: context.signal } : {}
+      const status = await context.put({
+        url: context.uploadUrl,
+        token: target.token,
+        body: untyped(file.bytes),
+        signal: context.signal,
+        onSent: context.onSent,
+        stallMs: context.stallMs
       });
-      if (response.ok) return;
-      if (response.status === 401 || response.status === 403 || response.status === 429) {
+      if (status >= 200 && status < 300) return;
+      if (status === 401 || status === 403 || status === 429) {
         throw new DeployError(
           ClientErrorCode.UploadFailed,
           `Upload of ${target.path} was refused. The upload window may have expired — try deploying again.`,
-          { path: target.path, status: response.status }
+          { path: target.path, status }
         );
       }
-      lastError = new Error(`HTTP ${response.status}`);
+      if (status === 413) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `${target.path} is too large to upload in one request. Make it smaller, or leave it out of this publish.`,
+          { path: target.path, status }
+        );
+      }
+      lastError = new Error(`HTTP ${status}`);
     } catch (error) {
       if (error instanceof DeployError) throw error;
       if (isAbort(error)) throw cancelled();
       lastError = error;
     }
   }
-  throw new DeployError(
-    ClientErrorCode.UploadFailed,
-    `Could not upload ${target.path} after ${context.retries + 1} attempts.`,
-    { path: target.path, cause: String(lastError) }
-  );
+  const message = lastError instanceof StalledError ? `Upload of ${target.path} stopped moving and did not recover after ${context.retries + 1} attempts. Check your connection and try again.` : `Could not upload ${target.path} after ${context.retries + 1} attempts.`;
+  throw new DeployError(ClientErrorCode.UploadFailed, message, {
+    path: target.path,
+    cause: describeError(lastError)
+  });
+}
+function untyped(content) {
+  if (ArrayBuffer.isView(content) || content.type === "") return content;
+  return content.slice(0, content.size);
+}
+function defaultTransport(doFetch) {
+  if (doFetch !== void 0) return fetchTransport(doFetch);
+  const Xhr = globalThis.XMLHttpRequest;
+  return Xhr === void 0 ? fetchTransport(globalFetch()) : xhrTransport(Xhr);
+}
+function fetchTransport(doFetch) {
+  return async ({ url, token, body, signal }) => {
+    const response = await doFetch(url, {
+      method: "PUT",
+      // The view, not a copy. Wrapping it in `new Blob([body.slice().buffer])` made two extra
+      // full-size copies of every file in flight — eight at once, so up to 400 MB on a drop of
+      // 50 MB files. `fetch` sends exactly the range a view covers. The cast is TypeScript's
+      // SharedArrayBuffer distinction again; see `sha256Hex`. A `Blob` goes as it is, and the runtime
+      // streams it from disk.
+      body,
+      // The permit is the whole request. `Content-Length` is required by the Worker and cannot be
+      // set here — it is a forbidden header name — but the runtime derives it from the body, which
+      // is exactly the length the token names.
+      headers: { Authorization: `Bearer ${token}` },
+      ...signal ? { signal } : {}
+    });
+    return response.status;
+  };
+}
+function xhrTransport(Xhr) {
+  return ({ url, token, body, signal, onSent, stallMs }) => new Promise((resolve2, reject) => {
+    const xhr = new Xhr();
+    let settled = false;
+    let timer;
+    const settle = (finish) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      finish();
+    };
+    const arm = () => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        xhr.abort();
+        settle(() => reject(new StalledError(Math.round(stallMs / 1e3))));
+      }, stallMs);
+    };
+    function onAbort() {
+      xhr.abort();
+      settle(() => reject(abortReason(signal)));
+    }
+    if (signal?.aborted) {
+      reject(abortReason(signal));
+      return;
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+    xhr.open("PUT", url);
+    xhr.setRequestHeader("Authorization", `Bearer ${token}`);
+    xhr.upload.onprogress = (event) => {
+      arm();
+      onSent(event.loaded);
+    };
+    xhr.onprogress = arm;
+    xhr.onload = () => settle(() => resolve2(xhr.status));
+    xhr.onerror = () => settle(() => reject(new TypeError("Network error during upload.")));
+    arm();
+    xhr.send(body);
+  });
+}
+function abortReason(signal) {
+  const reason = signal?.reason;
+  if (reason instanceof Error) return reason;
+  const error = new Error("Aborted.");
+  error.name = "AbortError";
+  return error;
 }
 function globalFetch() {
   return globalThis.fetch.bind(globalThis);
@@ -1303,9 +1758,17 @@ function isAbort(error) {
 function cancelled() {
   return new DeployError(ClientErrorCode.Cancelled, "Deploy cancelled.");
 }
+function outOfMemory(detail) {
+  return new DeployError(
+    ClientErrorCode.OutOfMemory,
+    "This browser ran out of memory reading what you dropped. Drop the unzipped folder instead, or try again in a desktop browser with fewer tabs open.",
+    detail
+  );
+}
 function asDeployError(error) {
   if (error instanceof DeployError) return error;
   if (isAbort(error)) return cancelled();
+  if (error instanceof RangeError) return outOfMemory(error.message);
   return new DeployError(
     ClientErrorCode.UploadFailed,
     error instanceof Error ? error.message : "Upload failed.",
@@ -1314,7 +1777,11 @@ function asDeployError(error) {
 }
 async function deploy(source, siteId, onProgress, signal, options = {}) {
   try {
-    const collected = await source(signal);
+    onProgress({ type: "reading", bytes: 0, total: 0 });
+    const collected = await source(
+      signal,
+      (bytes, total) => onProgress({ type: "reading", bytes, total })
+    );
     onProgress({ type: "collecting", files: collected.length });
     const rename = renameOfLoneHtmlPage(collected.map((file) => file.path));
     const files = rename === null ? collected : collected.map((file) => file.path === rename ? { ...file, path: "index.html" } : file);
@@ -1330,6 +1797,21 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       onProgress({ type: "unchanged", url: prepared.url ?? "" });
       return;
     }
+    const sizes = new Map(hashed.map((file) => [file.path, sizeOf(file.bytes)]));
+    const totalBytes = prepared.upload.reduce(
+      (sum, target) => sum + (sizes.get(target.path) ?? 0),
+      0
+    );
+    if (prepared.upload.length > 0) {
+      onProgress({
+        type: "uploading",
+        done: prepared.reused,
+        total: prepared.total,
+        bytes: 0,
+        totalBytes,
+        reused: prepared.reused
+      });
+    }
     await uploadAll(
       prepared.upload,
       prepared.uploadUrl,
@@ -1339,11 +1821,13 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
         done: prepared.reused + done,
         total: prepared.total,
         bytes,
+        totalBytes,
         reused: prepared.reused,
-        path
+        ...path === void 0 ? {} : { path }
       }),
       signal,
-      options.upload
+      options.upload,
+      (path, attempt, attempts, stalled) => onProgress({ type: "retrying", path, attempt, attempts, stalled })
     );
     onProgress({ type: "completing", reused: prepared.reused });
     const completed = await completeDeploy(
@@ -1351,9 +1835,15 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       prepared.deployId,
       options,
       signal,
-      suggestSiteName(files)
+      await readSiteName(files)
     );
-    onProgress({ type: "done", url: completed.url, name: completed.name });
+    onProgress({
+      type: "done",
+      url: completed.url,
+      name: completed.name,
+      mode: servingModeOf(completed),
+      modeIsManual: completed.modeIsManual
+    });
   } catch (error) {
     const failure2 = asDeployError(error);
     onProgress({
@@ -1406,6 +1896,15 @@ function escapesRoot(root, candidate) {
   const inside = relative(root, candidate);
   return inside === "" || inside.startsWith("..");
 }
+function describeMode(result) {
+  if (result.mode === null) return null;
+  if (result.nestedIndex !== null) {
+    return `Served as documents: there is no index.html at the top, but ${result.nestedIndex}/index.html is there. To publish the website, publish the ${result.nestedIndex} folder instead.`;
+  }
+  if (result.mode === "docs") return "Served as documents, in the documents reader.";
+  if (result.mode === "spa") return "Served as a single-page app.";
+  return "Served as a static site.";
+}
 async function resolveSite(credentials, site, newSite) {
   const { subdomain, folder } = newSite;
   if (site !== void 0 && subdomain !== void 0) {
@@ -1415,7 +1914,7 @@ async function resolveSite(credentials, site, newSite) {
   }
   if (site !== void 0 && folder !== void 0) {
     throw new Error(
-      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site from the dashboard."
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site with `drop2run set folder` or the `update_site` tool's `folder`."
     );
   }
   if (site === void 0) {
@@ -1435,6 +1934,8 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
   let files = 0;
   let url = target.url;
   let unchanged = false;
+  let mode = null;
+  let paths = [];
   let failure2 = null;
   let failureDetail;
   const record = (event) => {
@@ -1443,14 +1944,22 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
       unchanged = true;
       url = event.url || target.url;
     }
-    if (event.type === "done") url = event.url;
+    if (event.type === "done") {
+      url = event.url;
+      mode = event.mode;
+    }
     if (event.type === "error") {
       failure2 = event.message;
       failureDetail = event.detail;
     }
     onProgress?.(event);
   };
-  await deploy(source, target.siteId, record, void 0, {
+  const watched = async (signal, onRead) => {
+    const collected = await source(signal, onRead);
+    paths = collected.map((file) => file.path);
+    return collected;
+  };
+  await deploy(watched, target.siteId, record, void 0, {
     baseUrl: credentials.apiBaseUrl,
     token: credentials.token
   }).catch((error) => {
@@ -1460,7 +1969,15 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
     thrown.detail = failureDetail ?? error?.detail;
     throw thrown;
   });
-  return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
+  return {
+    url,
+    siteId: target.siteId,
+    subdomain: target.subdomain,
+    files,
+    unchanged,
+    mode,
+    nestedIndex: mode === "docs" ? nestedIndexOf(paths) : null
+  };
 }
 async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
   const found = await stat(directory).catch(() => null);
@@ -1488,6 +2005,10 @@ function shortenPath(path, width) {
 }
 function describe(event, width = 80) {
   switch (event.type) {
+    case "reading":
+      return event.total > 0 ? `Reading ${formatBytes(event.bytes)}/${formatBytes(event.total)}` : "Reading files";
+    case "retrying":
+      return `${event.stalled ? "Upload stalled" : "Upload failed"}, retrying ${shortenPath(event.path, Math.max(12, width - 40))} (attempt ${event.attempt}/${event.attempts})`;
     case "collecting":
       return `Collected ${event.files.toLocaleString()} ${event.files === 1 ? "file" : "files"}`;
     case "hashing":
@@ -1535,6 +2056,82 @@ function progressWriter(write, isTerminal, width = 80) {
   };
   return writer;
 }
+async function readSecret(prompt, input = process.stdin, output = process.stderr) {
+  if (input.isTTY !== true || input.setRawMode === void 0) {
+    const parts = [];
+    for await (const chunk of input)
+      parts.push(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+    return parts.join("").replace(/\r?\n$/, "");
+  }
+  const setRawMode = input.setRawMode.bind(input);
+  output.write(prompt);
+  setRawMode(true);
+  input.setEncoding("utf8");
+  input.resume();
+  return await new Promise((resolve2, reject) => {
+    const line = new HiddenLine();
+    const finish = () => {
+      setRawMode(false);
+      input.pause();
+      input.off("data", onData);
+      output.write("\n");
+    };
+    function onData(chunk) {
+      const outcome = line.type(chunk);
+      if (outcome === "more") return;
+      finish();
+      if (outcome === "cancelled") reject(new Error("Cancelled."));
+      else resolve2(line.value);
+    }
+    input.on("data", onData);
+  });
+}
+class HiddenLine {
+  /** What has been typed, one entry per code point, so Backspace never splits a surrogate pair. */
+  characters = [];
+  /** Where an escape sequence has got to: none, just after ESC, or inside a `CSI`/`SS3` sequence. */
+  escape = "none";
+  /** The line so far. */
+  get value() {
+    return this.characters.join("");
+  }
+  /**
+   * Takes the characters one chunk of input carries.
+   *
+   * @param chunk What arrived.
+   * @returns `done` on Enter or Ctrl+D, `cancelled` on Ctrl+C, `more` otherwise.
+   */
+  type(chunk) {
+    for (const character of chunk) {
+      const code = character.codePointAt(0) ?? 0;
+      if (this.escape === "started") {
+        this.escape = character === "[" || character === "O" ? "sequence" : "none";
+        continue;
+      }
+      if (this.escape === "sequence") {
+        if (code >= 64 && code <= 126) this.escape = "none";
+        continue;
+      }
+      if (character === "\r" || character === "\n" || character === "") return "done";
+      if (character === "") return "cancelled";
+      if (character === "\x1B") {
+        this.escape = "started";
+        continue;
+      }
+      if (character === "" || character === "\b") {
+        this.characters.pop();
+        continue;
+      }
+      if (character === "") {
+        this.characters.length = 0;
+        continue;
+      }
+      if (code < 32) continue;
+      this.characters.push(character);
+    }
+    return "more";
+  }
+}
 function failure(text) {
   return { text, json: { error: text }, code: 1 };
 }
@@ -1646,9 +2243,9 @@ async function whoami() {
   const response = await fetch(`${found.credentials.apiBaseUrl}/me`, {
     headers: { Authorization: `Bearer ${found.credentials.token}` }
   });
-  if (!response.ok) {
+  if (!response.ok || response.status === 204) {
     return failure(
-      response.status === 401 ? "This token is not valid any more. It may have been revoked or expired — create another at https://dropto.run/account/tokens." : `The API answered ${response.status}.`
+      response.status === 401 || response.status === 204 ? "This token is not valid any more. It may have been revoked or expired — create another at https://app.dropto.run/account/tokens." : `The API answered ${response.status}.`
     );
   }
   const me = await response.json();
@@ -1714,7 +2311,7 @@ async function deployCommand(directory, site, report = silentProgress, newSite =
   const target = newSite.subdomain === void 0 ? site ?? project?.siteId : void 0;
   if (newSite.folder !== void 0 && target !== void 0 && project !== null) {
     return failure(
-      `This folder's ${PROJECT_FILE} already publishes to ${project.subdomain || project.siteId}, and \`--folder\` only files a new site. Move that site from the dashboard, or add \`--subdomain\` to create a new one in the folder.`
+      `This folder's ${PROJECT_FILE} already publishes to ${project.subdomain || project.siteId}, and \`--folder\` only files a new site. Move that site with \`drop2run set folder <path>\`, or add \`--subdomain\` to create a new one in the folder.`
     );
   }
   try {
@@ -1726,9 +2323,11 @@ async function deployCommand(directory, site, report = silentProgress, newSite =
       newSite
     );
     const what = result.unchanged ? "Already up to date — nothing needed publishing." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
+    const mode = describeMode(result);
     return {
       text: `${what}
-${result.url}`,
+${result.url}${mode === null ? "" : `
+${mode}`}`,
       json: result,
       code: 0
     };
@@ -1843,6 +2442,197 @@ async function open(site, launch = openBrowser) {
     return failure(error instanceof Error ? error.message : String(error));
   }
 }
+function siteOr(site, usage) {
+  const named = site ?? readProject()?.siteId;
+  return named === void 0 ? {
+    result: failure(
+      `Name the site: \`${usage}\`, or run this in a folder with a ${PROJECT_FILE}.`
+    )
+  } : { named };
+}
+async function info(site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, "drop2run info <subdomain>");
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const detail = await getSite(found.credentials, summary.siteId);
+    const folderPath = detail.folderId === null ? void 0 : (await listFolders(found.credentials)).find(
+      (folder) => folder.folderId === detail.folderId
+    )?.path;
+    return {
+      text: describeSite(detail, folderPath),
+      json: { ...detail, mode: servingModeOf$1(detail), folderPath: folderPath ?? null },
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function pauseOrResume(action, site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, `drop2run ${action} <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const state = await setSitePaused(found.credentials, summary.siteId, action);
+    return {
+      text: action === "resume" ? `${state.subdomain} is back on the air.
+${summary.url}` : state.status === "paused" ? `Paused ${state.subdomain}. Its files and subdomain are kept; \`drop2run resume\` puts it back.` : (
+        // A site Drop2Run suspended stays suspended: the pause is recorded for when that lifts,
+        // and promising `resume` here would be promising something the API refuses.
+        `${state.subdomain} is ${state.status}, not paused by you, so \`drop2run resume\` cannot bring it back. The pause is recorded and applies if that is lifted.`
+      ),
+      json: state,
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+const SETTINGS_USAGE = [
+  "  name <text>                 What the dashboard calls the site",
+  "  mode static|spa|docs        How it serves files",
+  "  password                    Read from stdin, or typed at a hidden prompt",
+  "  forms on|off                Whether its forms accept submissions",
+  "  expires <ISO 8601 instant>  When it comes down; add --then delete to delete rather than pause",
+  "  folder <path|id|root>       Which folder it is filed in"
+].join("\n");
+function settingChange(setting, values, then) {
+  const value = setting === "name" ? values.join(" ").trim() : values[0];
+  const needs = (example) => ({
+    refusal: `\`set ${setting}\` needs a value, for example \`drop2run set ${setting} ${example}\`.`
+  });
+  if (then !== void 0 && setting !== "expires") {
+    return { refusal: "`--then` only applies to `set expires`." };
+  }
+  if (setting !== "name" && setting !== "password" && values.length > 1) {
+    return {
+      refusal: `\`set ${setting}\` takes one value, and "${values.slice(1).join(" ")}" is extra. Name the site with \`--site <subdomain>\`.`
+    };
+  }
+  switch (setting) {
+    case "name":
+      return value ? { change: { name: value } } : needs('"Launch notes"');
+    case "mode":
+      if (value === "static" || value === "spa" || value === "docs") {
+        return { change: { mode: value } };
+      }
+      return { refusal: "`set mode` takes `static`, `spa` or `docs`." };
+    case "forms":
+      if (value === "on" || value === "off") return { change: { formsEnabled: value === "on" } };
+      return { refusal: "`set forms` takes `on` or `off`." };
+    case "password": {
+      if (value !== void 0) {
+        return {
+          refusal: '`set password` does not take the password as an argument, where it would stay in your shell history. Run `drop2run set password` and type it, or pipe it in: `printf %s "$SITE_PASSWORD" | drop2run set password`.'
+        };
+      }
+      return { password: true };
+    }
+    case "expires": {
+      if (value === void 0) return needs("2026-12-31T09:00:00Z");
+      if (then !== void 0 && then !== "pause" && then !== "delete") {
+        return { refusal: "`--then` takes `pause` or `delete`." };
+      }
+      return {
+        change: {
+          expiresAt: value,
+          ...then === void 0 ? {} : { expiryAction: then }
+        }
+      };
+    }
+    case "folder":
+      return value ? { folder: value } : needs("Clients/Acme");
+    default:
+      return {
+        refusal: `${setting === void 0 ? "Name a setting." : `\`${setting}\` is not a setting.`} Settings:
+${SETTINGS_USAGE}`
+      };
+  }
+}
+async function set(site, setting, values, options, readPassword = () => readSecret("Password for visitors: ")) {
+  const parsed = settingChange(setting, values, options.then);
+  if ("refusal" in parsed) return failure(parsed.refusal);
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, `drop2run set ${setting} … --site <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    let change;
+    if ("folder" in parsed) {
+      change = { folderId: await resolveFolderTarget(found.credentials, parsed.folder) };
+    } else if ("password" in parsed) {
+      const password = await readPassword();
+      if (password === "") {
+        return failure("No password was given. To remove one, run `drop2run unset password`.");
+      }
+      change = { password };
+    } else {
+      change = parsed.change;
+    }
+    if (change.expiryAction === "delete" && !options.confirmed) {
+      return failure(
+        `This would delete ${summary.subdomain} and every version published to it when ${change.expiresAt} arrives, with no way back then.
+Add --yes if that is what you want, or leave out --then to pause it instead.`
+      );
+    }
+    return await applied(found.credentials, summary.siteId, summary.subdomain, change);
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function unset(site, setting, extra = []) {
+  if (extra.length > 0) {
+    return failure(
+      `\`unset ${setting}\` takes nothing after it, and "${extra.join(" ")}" is extra. Name the site with \`--site <subdomain>\`.`
+    );
+  }
+  const clear = /* @__PURE__ */ new Map([
+    ["name", { name: "" }],
+    ["password", { password: "" }],
+    ["expires", { expiresAt: "" }]
+  ]);
+  const change = setting === void 0 ? void 0 : clear.get(setting);
+  if (change === void 0) {
+    return failure(
+      "`unset` clears `name`, `password` or `expires`. To file the site at the top level, run `drop2run set folder root`."
+    );
+  }
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, `drop2run unset ${setting} --site <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    return await applied(found.credentials, summary.siteId, summary.subdomain, change);
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function applied(credentials, siteId, subdomain, change) {
+  const settings = await updateSiteSettings(credentials, siteId, change);
+  const takedown = settings.expiresAt === null ? "none" : `${settings.expiresAt} (${settings.expiryAction})`;
+  return {
+    text: [
+      `Updated ${subdomain}.`,
+      `  name      ${settings.name ?? "(none)"}`,
+      `  access    ${accessOf(settings)}`,
+      `  mode      ${servingModeOf$1(settings)}`,
+      `  forms     ${settings.formsEnabled ? "on" : "off"}`,
+      `  takedown  ${takedown}`,
+      ...settings.replacedInviteOnly ? [
+        "The password replaced invite-only: the people on its list can no longer get in without it. The list is kept for if you switch back in the dashboard."
+      ] : [],
+      settings.live ? "Reaching every edge takes up to about a minute." : "Nothing is published yet, so this applies from the first publish."
+    ].join("\n"),
+    json: { ...settings, mode: servingModeOf$1(settings) },
+    code: 0
+  };
+}
 async function tokens() {
   const found = credentialsOr();
   if ("result" in found) return found.result;
@@ -1894,6 +2684,11 @@ const HELP = `drop2run — publish a static site from the command line
   drop2run ls                                  List your sites
   drop2run folders                             List your folders, as --folder takes them
   drop2run open [site]                         Open a site in a browser
+  drop2run info [site]                         Show a site's settings and versions
+  drop2run set <setting> <value> [--site X]    Change one setting (see Settings below)
+  drop2run unset name|password|expires         Clear a name, a password or a takedown
+  drop2run pause [site]                        Take a site off the air, keeping its files
+  drop2run resume [site]                       Put a paused site back on the air
   drop2run rollback <deployId> [--site X]      Put an earlier version back live
   drop2run rm <site> --yes                     Delete a site and everything on it
   drop2run token list                          List your access tokens
@@ -1909,6 +2704,23 @@ Flags
                  or a folder id (init and deploy only)
   --device       Sign in by approving a code on another machine
   --yes          Confirm a deletion, which cannot be undone
+  --then X       What \`set expires\` does when the date arrives: pause
+                 (the default, keeps the files) or delete (needs --yes)
+
+Settings
+  set name <text>               What the dashboard calls the site; put a
+                                name with words starting "-" after --
+  set mode static|spa|docs      static answers 404 for a missing path, spa
+                                falls back to index.html, docs uses the viewer
+  set password                  Typed at a hidden prompt, or piped in:
+                                printf %s "$PW" | drop2run set password
+  set forms on|off              Whether its forms accept submissions
+  set expires <ISO 8601>        Take it down then, e.g. 2026-12-31T09:00:00Z
+  set folder <path|id|root>     Move it to a folder, or root for the top level
+
+  \`set\` and \`unset\` act on --site, else the site in drop2run.json. A
+  setting your plan does not include is refused with the reason, and
+  \`info\` says which ones those are.
 
 Where a site comes from
   --subdomain creates one under the name you give. Otherwise: --site, then
@@ -1925,10 +2737,10 @@ Where a site comes from
 Signing in
   \`login\` opens a browser and listens on 127.0.0.1, so it needs both on this
   machine. Over SSH, in a container or under WSL, use \`login --device\`: it
-  prints a short code to enter at https://dropto.run/device from anywhere.
+  prints a short code to enter at https://app.dropto.run/device from anywhere.
 
   For CI, neither flow applies — create a token at
-  https://dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
+  https://app.dropto.run/account/tokens and either set DROP2RUN_TOKEN in your
   environment or put it in ~/.config/drop2run/config.json as {"token": "d2r_..."}.
 `;
 function flagValue(args, flag) {
@@ -1937,7 +2749,7 @@ function flagValue(args, flag) {
   const value = args[at + 1];
   return value === void 0 || value.startsWith("-") ? void 0 : value;
 }
-const VALUE_FLAGS = ["--site", "--subdomain", "--folder"];
+const VALUE_FLAGS = ["--site", "--subdomain", "--folder", "--then"];
 function positionals(argv) {
   const found = [];
   for (let at = 0; at < argv.length; at++) {
@@ -1961,7 +2773,7 @@ const SUBDOMAIN_FLAG = {
 const FOLDER_FLAG = {
   flag: "--folder",
   example: "Clients/Acme",
-  effect: "`--folder` only files a new one — move an existing site from the dashboard",
+  effect: "`--folder` only files a new one — move an existing site with `drop2run set folder`",
   elsewhere: (command) => command === "ls" || command === "list" ? " `drop2run folders` lists them." : ""
 };
 function newSiteFlagProblem(argv, command, site, value, described) {
@@ -1978,12 +2790,15 @@ function newSiteFlagProblem(argv, command, site, value, described) {
   }
   return void 0;
 }
-async function run(argv) {
+async function run(commandLine) {
+  const end = commandLine.indexOf("--");
+  const argv = end === -1 ? commandLine : commandLine.slice(0, end);
+  const literal = end === -1 ? [] : commandLine.slice(end + 1);
   const json = argv.includes("--json");
-  const positional = positionals(argv);
+  const positional = [...positionals(argv), ...literal];
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-bzaCMW_E.js").then(
+    const { version } = await import("./package-BycuI1VJ.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };
@@ -1999,6 +2814,12 @@ async function run(argv) {
     const failed = { text: refusal, json: { error: refusal }, code: 1 };
     return json ? { ...failed, text: JSON.stringify(failed.json, null, 2) } : failed;
   }
+  const then = flagValue(argv, "--then");
+  if (argv.includes("--then") && then === void 0) {
+    const message = "`--then` needs a value: `--then pause` or `--then delete`.";
+    const failed = { text: message, json: { error: message }, code: 1 };
+    return json ? { ...failed, text: JSON.stringify(failed.json, null, 2) } : failed;
+  }
   const result = await dispatch(
     command,
     rest,
@@ -2006,11 +2827,12 @@ async function run(argv) {
     json,
     argv.includes("--device"),
     argv.includes("--yes"),
-    { subdomain, folder }
+    { subdomain, folder },
+    then
   );
   return json ? { ...result, text: JSON.stringify(result.json, null, 2) } : result;
 }
-async function dispatch(command, rest, site, json, device, confirmed, newSite = {}) {
+async function dispatch(command, rest, site, json, device, confirmed, newSite = {}, then = void 0) {
   switch (command) {
     case "login": {
       const print = json ? () => {
@@ -2036,6 +2858,15 @@ async function dispatch(command, rest, site, json, device, confirmed, newSite =
       return await folders();
     case "open":
       return await open(rest[0] ?? site);
+    case "info":
+      return await info(rest[0] ?? site);
+    case "set":
+      return await set(site, rest[0], rest.slice(1), { then, confirmed });
+    case "unset":
+      return await unset(site, rest[0], rest.slice(1));
+    case "pause":
+    case "resume":
+      return await pauseOrResume(command, rest[0] ?? site);
     case "rollback":
       return await rollback(rest[0], site);
     case "rm":
@@ -2043,7 +2874,7 @@ async function dispatch(command, rest, site, json, device, confirmed, newSite =
     case "token":
     case "tokens":
       return rest[0] === void 0 || rest[0] === "list" ? await tokens() : {
-        text: `\`token ${rest[0]}\` does not exist. Only \`token list\` does: creating and revoking a token need a browser session, at https://dropto.run/account/tokens.`,
+        text: `\`token ${rest[0]}\` does not exist. Only \`token list\` does: creating and revoking a token need a browser session, at https://app.dropto.run/account/tokens.`,
         json: { error: `Unknown token subcommand "${rest[0]}".` },
         code: 1
       };