drop2run 0.7.0 → 0.9.0

package/README.md

@@ -22,8 +22,16 @@ drop2run init|deploy --folder <path>         File the new site in one of your fo
 drop2run ls                                  List your sites
 drop2run folders                             List your folders, as --folder takes them
 drop2run open [site]                         Open a site in a browser
+drop2run info [site]                         Show a site's settings and versions
+drop2run set <setting> <value> [--site X]    Change one setting
+drop2run unset name|password|expires         Clear a name, a password or a takedown
+drop2run pause [site]                        Take a site off the air, keeping its files
+drop2run resume [site]                       Put a paused site back on the air
 drop2run rollback <deployId> [--site X]      Put an earlier version back live
 drop2run rm <site> --yes                     Delete a site and everything on it
+drop2run comments [site]                     Read the comments left on a site's pages
+drop2run comments reply <thread> <text>      Answer a thread as the owner [--resolve]
+drop2run comments resolve|reopen <thread>    Resolve a thread, or open it again
 drop2run token list                          List your access tokens
 drop2run whoami                              Check the token and whose it is
 drop2run where                               Show which token source is in use
@@ -32,6 +40,23 @@ drop2run --version                           Print the version
 
 `--json` on any command prints machine-readable output instead of text.
 
+## Comments
+
+On a plan that includes comments, people viewing a site can pin comments to its pages. `drop2run comments`
+reads them — each thread's id, page, the words it points at, and every comment — with `--status
+open|resolved|all` and `--path /page` to narrow it. The owner of the account can answer from here:
+
+```bash
+drop2run comments calm-cedar                                   # open threads
+drop2run deploy dist                                           # publish the fix first
+drop2run comments reply 01JTHREAD... "Fixed — please check" --site calm-cedar
+```
+
+The reply shows on the page under your name, as one typed there would, and the people in the thread are
+emailed.
+It leaves the thread open unless `--resolve` is given, so the person who raised it can check the fix and
+resolve it themselves. `comments resolve` and `comments reopen` change a thread's state on its own.
+
 ## Which site a command acts on
 
 `--subdomain` creates one under the name you give; otherwise `--site`, then `drop2run.json`, then a new

package/dist/index.js

@@ -118,7 +118,9 @@ async function call(credentials, path, init2 = {}) {
 async function findSite(credentials, site) {
   const found = await lookUpSite(credentials, site);
   if (found === void 0) {
-    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+    throw new Error(
+      `No site of yours is called "${site}". \`drop2run ls\` or the list_sites tool shows what exists.`
+    );
   }
   return found;
 }
@@ -162,6 +164,108 @@ async function promoteDeploy(credentials, siteId, deployId) {
     { method: "POST" }
   );
 }
+function enumName(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function actionOf(expiresAt, action) {
+  return expiresAt === null ? null : enumName(action);
+}
+async function readInvitedOnly(credentials, siteId) {
+  try {
+    const page = await call(
+      credentials,
+      `sites/${encodeURIComponent(siteId)}/viewers?pageSize=1`
+    );
+    return typeof page.invitedOnly === "boolean" ? page.invitedOnly : null;
+  } catch {
+    return null;
+  }
+}
+async function folderFromListing(credentials, siteId, subdomain) {
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(subdomain)}`
+  );
+  return sites.find((candidate) => candidate.siteId === siteId)?.folderId ?? null;
+}
+async function getSite(credentials, siteId) {
+  const [site, invitedOnly] = await Promise.all([
+    call(
+      credentials,
+      `sites/${encodeURIComponent(siteId)}`
+    ),
+    readInvitedOnly(credentials, siteId)
+  ]);
+  const folderId = site.folderId !== void 0 ? site.folderId : await folderFromListing(credentials, site.siteId, site.subdomain);
+  return {
+    siteId: site.siteId,
+    subdomain: site.subdomain,
+    url: site.url,
+    name: site.name,
+    status: enumName(site.status),
+    invitedOnly,
+    liveDeployId: site.liveDeployId,
+    spaMode: site.spaMode,
+    docsMode: site.docsMode,
+    modeIsManual: site.modeIsManual,
+    passwordProtected: site.passwordProtected,
+    passwordProtectionAvailable: site.passwordProtectionAvailable,
+    formsEnabled: site.formsEnabled,
+    formsAvailable: site.formsAvailable,
+    expiresAt: site.expiresAt,
+    expiryAction: actionOf(site.expiresAt, site.expiryAction ?? ""),
+    scheduledExpiryAvailable: site.scheduledExpiryAvailable,
+    folderId,
+    deploys: site.deploys.map((deploy2) => ({
+      deployId: deploy2.deployId,
+      status: deploy2.status,
+      fileCount: deploy2.fileCount,
+      totalBytes: deploy2.totalBytes,
+      createdAt: deploy2.createdAt,
+      completedAt: deploy2.completedAt,
+      filesKept: deploy2.filesKept
+    }))
+  };
+}
+async function updateSiteSettings(credentials, siteId, change) {
+  const body = {};
+  if (change.name !== void 0) body.name = change.name;
+  if (change.mode !== void 0) {
+    body.spaMode = change.mode === "spa";
+    body.docsMode = change.mode === "docs";
+  }
+  if (change.password !== void 0) body.password = change.password;
+  if (change.expiresAt !== void 0) body.expiresAt = change.expiresAt;
+  if (change.expiryAction !== void 0) body.expiryAction = change.expiryAction;
+  if (change.formsEnabled !== void 0) body.formsEnabled = change.formsEnabled;
+  if (change.folderId !== void 0) body.folderId = change.folderId;
+  if (Object.keys(body).length === 0) throw new Error("Nothing to change — name a setting.");
+  const wasInvitedOnly = change.password !== void 0 && change.password !== "" ? await readInvitedOnly(credentials, siteId) : null;
+  const settings = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  const invitedOnly = typeof settings.invitedOnly === "boolean" ? settings.invitedOnly : null;
+  return {
+    ...settings,
+    expiryAction: actionOf(settings.expiresAt, settings.expiryAction ?? ""),
+    invitedOnly,
+    replacedInviteOnly: wasInvitedOnly === true && invitedOnly === false
+  };
+}
+async function setSitePaused(credentials, siteId, action) {
+  const state = await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/${action}`,
+    { method: "POST" }
+  );
+  return {
+    siteId: state.siteId,
+    subdomain: state.subdomain,
+    status: enumName(state.status),
+    ownerPaused: state.ownerPaused
+  };
+}
 async function listTokens(credentials) {
   const body = await call(credentials, "tokens");
   return body.tokens;
@@ -236,6 +340,73 @@ async function resolveFolder(credentials, folder) {
     `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
   );
 }
+const ROOT_FOLDER = "root";
+async function resolveFolderTarget(credentials, folder) {
+  return folder.trim().toLowerCase() === ROOT_FOLDER ? ROOT_FOLDER : await resolveFolder(credentials, folder);
+}
+async function listComments(credentials, siteId, query = {}) {
+  const search = new URLSearchParams();
+  if (query.status !== void 0) search.set("status", query.status);
+  if (query.path !== void 0) search.set("path", query.path);
+  if (query.since !== void 0) search.set("since", String(query.since));
+  if (query.page !== void 0) search.set("page", String(query.page));
+  const encoded = search.toString();
+  const suffix = encoded === "" ? "" : `?${encoded}`;
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads${suffix}`
+  );
+}
+async function replyToComment(credentials, siteId, threadId, body, resolve2 = false) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/comments`,
+    { method: "POST", body: JSON.stringify({ body, resolve: resolve2 }) }
+  );
+}
+async function setCommentResolved(credentials, siteId, threadId, resolved) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/${resolved ? "resolve" : "reopen"}`,
+    { method: "POST" }
+  );
+}
+const VERSIONS_LISTED = 10;
+function servingModeOf$1(site) {
+  if (site.spaMode) return "spa";
+  if (site.docsMode) return "docs";
+  return "static";
+}
+function accessOf(site) {
+  if (site.passwordProtected) return "password";
+  if (site.invitedOnly === true) return "invite-only";
+  if (site.invitedOnly === false) return "public";
+  return "no password (whether it is invite-only could not be read)";
+}
+function describeSite(site, folderPath) {
+  const unavailable = (available) => available ? "" : " (not on this plan)";
+  const versions = site.deploys.slice(0, VERSIONS_LISTED).map((deploy2) => {
+    const live = deploy2.deployId === site.liveDeployId ? " ← served" : "";
+    const kept = deploy2.filesKept ? "" : ", files collected — cannot be rolled back to";
+    return `  ${deploy2.deployId}  ${deploy2.createdAt}  ${deploy2.status}, ${deploy2.fileCount} files${kept}${live}`;
+  });
+  const more = site.deploys.length - versions.length;
+  return [
+    `${site.subdomain} — ${site.url}`,
+    `  name      ${site.name ?? "(none)"}`,
+    `  status    ${site.status}`,
+    `  access    ${accessOf(site)}`,
+    `  mode      ${servingModeOf$1(site)}${site.modeIsManual ? "" : " (detected on each publish)"}`,
+    `  password  ${site.passwordProtected ? "on" : "off"}${unavailable(site.passwordProtectionAvailable)}`,
+    `  forms     ${site.formsEnabled ? "on" : "off"}${unavailable(site.formsAvailable)}`,
+    `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
+    `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
+    "",
+    site.deploys.length === 0 ? "No versions yet." : "Versions, newest first:",
+    ...versions,
+    ...more > 0 ? [`  … and ${more} older`] : []
+  ].join("\n");
+}
 const TIMEOUT_MS = 5 * 60 * 1e3;
 function newAttempt() {
   const verifier = randomBytes(32).toString("base64url");
@@ -1140,6 +1311,24 @@ function canPublish(paths) {
   if (isImageFolder(paths)) return true;
   return paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0]);
 }
+function servingModeOf(flags) {
+  if (flags.docsMode) return "docs";
+  if (flags.spaMode) return "spa";
+  return "static";
+}
+function predictedModeOf(paths) {
+  if (paths.some((path) => path === REQUIRED_INDEX)) return "static";
+  if (paths.some(isDocumentPath)) return "docs";
+  if (isImageFolder(paths)) return "docs";
+  if (paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0])) return "docs";
+  return "static";
+}
+function nestedIndexOf(paths) {
+  if (predictedModeOf(paths) !== "docs") return null;
+  const suffix = `/${REQUIRED_INDEX}`;
+  const folders2 = paths.filter((path) => path.endsWith(suffix)).map((path) => path.slice(0, -suffix.length)).sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
+  return folders2[0] ?? null;
+}
 function renameOfLoneHtmlPage(paths) {
   if (paths.length !== 1) return null;
   const [only] = paths;
@@ -1675,7 +1864,13 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       signal,
       await readSiteName(files)
     );
-    onProgress({ type: "done", url: completed.url, name: completed.name });
+    onProgress({
+      type: "done",
+      url: completed.url,
+      name: completed.name,
+      mode: servingModeOf(completed),
+      modeIsManual: completed.modeIsManual
+    });
   } catch (error) {
     const failure2 = asDeployError(error);
     onProgress({
@@ -1728,6 +1923,15 @@ function escapesRoot(root, candidate) {
   const inside = relative(root, candidate);
   return inside === "" || inside.startsWith("..");
 }
+function describeMode(result) {
+  if (result.mode === null) return null;
+  if (result.nestedIndex !== null) {
+    return `Served as documents: there is no index.html at the top, but ${result.nestedIndex}/index.html is there. To publish the website, publish the ${result.nestedIndex} folder instead.`;
+  }
+  if (result.mode === "docs") return "Served as documents, in the documents reader.";
+  if (result.mode === "spa") return "Served as a single-page app.";
+  return "Served as a static site.";
+}
 async function resolveSite(credentials, site, newSite) {
   const { subdomain, folder } = newSite;
   if (site !== void 0 && subdomain !== void 0) {
@@ -1737,7 +1941,7 @@ async function resolveSite(credentials, site, newSite) {
   }
   if (site !== void 0 && folder !== void 0) {
     throw new Error(
-      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site from the dashboard."
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site with `drop2run set folder` or the `update_site` tool's `folder`."
     );
   }
   if (site === void 0) {
@@ -1757,6 +1961,8 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
   let files = 0;
   let url = target.url;
   let unchanged = false;
+  let mode = null;
+  let paths = [];
   let failure2 = null;
   let failureDetail;
   const record = (event) => {
@@ -1765,14 +1971,22 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
       unchanged = true;
       url = event.url || target.url;
     }
-    if (event.type === "done") url = event.url;
+    if (event.type === "done") {
+      url = event.url;
+      mode = event.mode;
+    }
     if (event.type === "error") {
       failure2 = event.message;
       failureDetail = event.detail;
     }
     onProgress?.(event);
   };
-  await deploy(source, target.siteId, record, void 0, {
+  const watched = async (signal, onRead) => {
+    const collected = await source(signal, onRead);
+    paths = collected.map((file) => file.path);
+    return collected;
+  };
+  await deploy(watched, target.siteId, record, void 0, {
     baseUrl: credentials.apiBaseUrl,
     token: credentials.token
   }).catch((error) => {
@@ -1782,7 +1996,15 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
     thrown.detail = failureDetail ?? error?.detail;
     throw thrown;
   });
-  return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
+  return {
+    url,
+    siteId: target.siteId,
+    subdomain: target.subdomain,
+    files,
+    unchanged,
+    mode,
+    nestedIndex: mode === "docs" ? nestedIndexOf(paths) : null
+  };
 }
 async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
   const found = await stat(directory).catch(() => null);
@@ -1861,6 +2083,82 @@ function progressWriter(write, isTerminal, width = 80) {
   };
   return writer;
 }
+async function readSecret(prompt, input = process.stdin, output = process.stderr) {
+  if (input.isTTY !== true || input.setRawMode === void 0) {
+    const parts = [];
+    for await (const chunk of input)
+      parts.push(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+    return parts.join("").replace(/\r?\n$/, "");
+  }
+  const setRawMode = input.setRawMode.bind(input);
+  output.write(prompt);
+  setRawMode(true);
+  input.setEncoding("utf8");
+  input.resume();
+  return await new Promise((resolve2, reject) => {
+    const line = new HiddenLine();
+    const finish = () => {
+      setRawMode(false);
+      input.pause();
+      input.off("data", onData);
+      output.write("\n");
+    };
+    function onData(chunk) {
+      const outcome = line.type(chunk);
+      if (outcome === "more") return;
+      finish();
+      if (outcome === "cancelled") reject(new Error("Cancelled."));
+      else resolve2(line.value);
+    }
+    input.on("data", onData);
+  });
+}
+class HiddenLine {
+  /** What has been typed, one entry per code point, so Backspace never splits a surrogate pair. */
+  characters = [];
+  /** Where an escape sequence has got to: none, just after ESC, or inside a `CSI`/`SS3` sequence. */
+  escape = "none";
+  /** The line so far. */
+  get value() {
+    return this.characters.join("");
+  }
+  /**
+   * Takes the characters one chunk of input carries.
+   *
+   * @param chunk What arrived.
+   * @returns `done` on Enter or Ctrl+D, `cancelled` on Ctrl+C, `more` otherwise.
+   */
+  type(chunk) {
+    for (const character of chunk) {
+      const code = character.codePointAt(0) ?? 0;
+      if (this.escape === "started") {
+        this.escape = character === "[" || character === "O" ? "sequence" : "none";
+        continue;
+      }
+      if (this.escape === "sequence") {
+        if (code >= 64 && code <= 126) this.escape = "none";
+        continue;
+      }
+      if (character === "\r" || character === "\n" || character === "") return "done";
+      if (character === "") return "cancelled";
+      if (character === "\x1B") {
+        this.escape = "started";
+        continue;
+      }
+      if (character === "" || character === "\b") {
+        this.characters.pop();
+        continue;
+      }
+      if (character === "") {
+        this.characters.length = 0;
+        continue;
+      }
+      if (code < 32) continue;
+      this.characters.push(character);
+    }
+    return "more";
+  }
+}
 function failure(text) {
   return { text, json: { error: text }, code: 1 };
 }
@@ -1972,9 +2270,9 @@ async function whoami() {
   const response = await fetch(`${found.credentials.apiBaseUrl}/me`, {
     headers: { Authorization: `Bearer ${found.credentials.token}` }
   });
-  if (!response.ok) {
+  if (!response.ok || response.status === 204) {
     return failure(
-      response.status === 401 ? "This token is not valid any more. It may have been revoked or expired — create another at https://app.dropto.run/account/tokens." : `The API answered ${response.status}.`
+      response.status === 401 || response.status === 204 ? "This token is not valid any more. It may have been revoked or expired — create another at https://app.dropto.run/account/tokens." : `The API answered ${response.status}.`
     );
   }
   const me = await response.json();
@@ -2040,7 +2338,7 @@ async function deployCommand(directory, site, report = silentProgress, newSite =
   const target = newSite.subdomain === void 0 ? site ?? project?.siteId : void 0;
   if (newSite.folder !== void 0 && target !== void 0 && project !== null) {
     return failure(
-      `This folder's ${PROJECT_FILE} already publishes to ${project.subdomain || project.siteId}, and \`--folder\` only files a new site. Move that site from the dashboard, or add \`--subdomain\` to create a new one in the folder.`
+      `This folder's ${PROJECT_FILE} already publishes to ${project.subdomain || project.siteId}, and \`--folder\` only files a new site. Move that site with \`drop2run set folder <path>\`, or add \`--subdomain\` to create a new one in the folder.`
     );
   }
   try {
@@ -2052,9 +2350,11 @@ async function deployCommand(directory, site, report = silentProgress, newSite =
       newSite
     );
     const what = result.unchanged ? "Already up to date — nothing needed publishing." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
+    const mode = describeMode(result);
     return {
       text: `${what}
-${result.url}`,
+${result.url}${mode === null ? "" : `
+${mode}`}`,
       json: result,
       code: 0
     };
@@ -2169,6 +2469,197 @@ async function open(site, launch = openBrowser) {
     return failure(error instanceof Error ? error.message : String(error));
   }
 }
+function siteOr(site, usage) {
+  const named = site ?? readProject()?.siteId;
+  return named === void 0 ? {
+    result: failure(
+      `Name the site: \`${usage}\`, or run this in a folder with a ${PROJECT_FILE}.`
+    )
+  } : { named };
+}
+async function info(site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, "drop2run info <subdomain>");
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const detail = await getSite(found.credentials, summary.siteId);
+    const folderPath = detail.folderId === null ? void 0 : (await listFolders(found.credentials)).find(
+      (folder) => folder.folderId === detail.folderId
+    )?.path;
+    return {
+      text: describeSite(detail, folderPath),
+      json: { ...detail, mode: servingModeOf$1(detail), folderPath: folderPath ?? null },
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function pauseOrResume(action, site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, `drop2run ${action} <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const state = await setSitePaused(found.credentials, summary.siteId, action);
+    return {
+      text: action === "resume" ? `${state.subdomain} is back on the air.
+${summary.url}` : state.status === "paused" ? `Paused ${state.subdomain}. Its files and subdomain are kept; \`drop2run resume\` puts it back.` : (
+        // A site Drop2Run suspended stays suspended: the pause is recorded for when that lifts,
+        // and promising `resume` here would be promising something the API refuses.
+        `${state.subdomain} is ${state.status}, not paused by you, so \`drop2run resume\` cannot bring it back. The pause is recorded and applies if that is lifted.`
+      ),
+      json: state,
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+const SETTINGS_USAGE = [
+  "  name <text>                 What the dashboard calls the site",
+  "  mode static|spa|docs        How it serves files",
+  "  password                    Read from stdin, or typed at a hidden prompt",
+  "  forms on|off                Whether its forms accept submissions",
+  "  expires <ISO 8601 instant>  When it comes down; add --then delete to delete rather than pause",
+  "  folder <path|id|root>       Which folder it is filed in"
+].join("\n");
+function settingChange(setting, values, then) {
+  const value = setting === "name" ? values.join(" ").trim() : values[0];
+  const needs = (example) => ({
+    refusal: `\`set ${setting}\` needs a value, for example \`drop2run set ${setting} ${example}\`.`
+  });
+  if (then !== void 0 && setting !== "expires") {
+    return { refusal: "`--then` only applies to `set expires`." };
+  }
+  if (setting !== "name" && setting !== "password" && values.length > 1) {
+    return {
+      refusal: `\`set ${setting}\` takes one value, and "${values.slice(1).join(" ")}" is extra. Name the site with \`--site <subdomain>\`.`
+    };
+  }
+  switch (setting) {
+    case "name":
+      return value ? { change: { name: value } } : needs('"Launch notes"');
+    case "mode":
+      if (value === "static" || value === "spa" || value === "docs") {
+        return { change: { mode: value } };
+      }
+      return { refusal: "`set mode` takes `static`, `spa` or `docs`." };
+    case "forms":
+      if (value === "on" || value === "off") return { change: { formsEnabled: value === "on" } };
+      return { refusal: "`set forms` takes `on` or `off`." };
+    case "password": {
+      if (value !== void 0) {
+        return {
+          refusal: '`set password` does not take the password as an argument, where it would stay in your shell history. Run `drop2run set password` and type it, or pipe it in: `printf %s "$SITE_PASSWORD" | drop2run set password`.'
+        };
+      }
+      return { password: true };
+    }
+    case "expires": {
+      if (value === void 0) return needs("2026-12-31T09:00:00Z");
+      if (then !== void 0 && then !== "pause" && then !== "delete") {
+        return { refusal: "`--then` takes `pause` or `delete`." };
+      }
+      return {
+        change: {
+          expiresAt: value,
+          ...then === void 0 ? {} : { expiryAction: then }
+        }
+      };
+    }
+    case "folder":
+      return value ? { folder: value } : needs("Clients/Acme");
+    default:
+      return {
+        refusal: `${setting === void 0 ? "Name a setting." : `\`${setting}\` is not a setting.`} Settings:
+${SETTINGS_USAGE}`
+      };
+  }
+}
+async function set(site, setting, values, options, readPassword = () => readSecret("Password for visitors: ")) {
+  const parsed = settingChange(setting, values, options.then);
+  if ("refusal" in parsed) return failure(parsed.refusal);
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, `drop2run set ${setting} … --site <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    let change;
+    if ("folder" in parsed) {
+      change = { folderId: await resolveFolderTarget(found.credentials, parsed.folder) };
+    } else if ("password" in parsed) {
+      const password = await readPassword();
+      if (password === "") {
+        return failure("No password was given. To remove one, run `drop2run unset password`.");
+      }
+      change = { password };
+    } else {
+      change = parsed.change;
+    }
+    if (change.expiryAction === "delete" && !options.confirmed) {
+      return failure(
+        `This would delete ${summary.subdomain} and every version published to it when ${change.expiresAt} arrives, with no way back then.
+Add --yes if that is what you want, or leave out --then to pause it instead.`
+      );
+    }
+    return await applied(found.credentials, summary.siteId, summary.subdomain, change);
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function unset(site, setting, extra = []) {
+  if (extra.length > 0) {
+    return failure(
+      `\`unset ${setting}\` takes nothing after it, and "${extra.join(" ")}" is extra. Name the site with \`--site <subdomain>\`.`
+    );
+  }
+  const clear = /* @__PURE__ */ new Map([
+    ["name", { name: "" }],
+    ["password", { password: "" }],
+    ["expires", { expiresAt: "" }]
+  ]);
+  const change = setting === void 0 ? void 0 : clear.get(setting);
+  if (change === void 0) {
+    return failure(
+      "`unset` clears `name`, `password` or `expires`. To file the site at the top level, run `drop2run set folder root`."
+    );
+  }
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, `drop2run unset ${setting} --site <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    return await applied(found.credentials, summary.siteId, summary.subdomain, change);
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function applied(credentials, siteId, subdomain, change) {
+  const settings = await updateSiteSettings(credentials, siteId, change);
+  const takedown = settings.expiresAt === null ? "none" : `${settings.expiresAt} (${settings.expiryAction})`;
+  return {
+    text: [
+      `Updated ${subdomain}.`,
+      `  name      ${settings.name ?? "(none)"}`,
+      `  access    ${accessOf(settings)}`,
+      `  mode      ${servingModeOf$1(settings)}`,
+      `  forms     ${settings.formsEnabled ? "on" : "off"}`,
+      `  takedown  ${takedown}`,
+      ...settings.replacedInviteOnly ? [
+        "The password replaced invite-only: the people on its list can no longer get in without it. The list is kept for if you switch back in the dashboard."
+      ] : [],
+      settings.live ? "Reaching every edge takes up to about a minute." : "Nothing is published yet, so this applies from the first publish."
+    ].join("\n"),
+    json: { ...settings, mode: servingModeOf$1(settings) },
+    code: 0
+  };
+}
 async function tokens() {
   const found = credentialsOr();
   if ("result" in found) return found.result;
@@ -2187,6 +2678,96 @@ async function tokens() {
     return failure(error instanceof Error ? error.message : String(error));
   }
 }
+const COMMENTS_USAGE = [
+  "  drop2run comments [site] [--status open|resolved|all] [--path /page]",
+  "  drop2run comments reply <thread> <text> [--resolve] [--site X]",
+  "  drop2run comments resolve|reopen <thread> [--site X]"
+].join("\n");
+async function comments(subcommand, rest, site, options) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const acting = subcommand === "reply" || subcommand === "resolve" || subcommand === "reopen";
+  if (!acting) {
+    const status = options.status ?? "open";
+    if (status !== "open" && status !== "resolved" && status !== "all") {
+      return failure(
+        `\`--status\` is open, resolved or all, not "${status}".
+
+${COMMENTS_USAGE}`
+      );
+    }
+    const target2 = siteOr(subcommand ?? site, "drop2run comments <subdomain>");
+    if ("result" in target2) return target2.result;
+    try {
+      const summary = await findSite(found.credentials, target2.named);
+      const read = await listComments(found.credentials, summary.siteId, {
+        status,
+        path: options.path
+      });
+      return {
+        text: describeComments(read.threads, status, summary.subdomain, read.more),
+        json: read,
+        code: 0
+      };
+    } catch (error) {
+      return failure(error instanceof Error ? error.message : String(error));
+    }
+  }
+  const [thread, ...words] = rest;
+  if (thread === void 0)
+    return failure(`Name the thread, from \`drop2run comments\`.
+
+${COMMENTS_USAGE}`);
+  const body = words.join(" ").trim();
+  if (subcommand === "reply" && body === "") {
+    return failure(`Write the reply after the thread id.
+
+${COMMENTS_USAGE}`);
+  }
+  const target = siteOr(site, `drop2run comments ${subcommand} <thread> --site <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const answered = subcommand === "reply" ? await replyToComment(
+      found.credentials,
+      summary.siteId,
+      thread,
+      body,
+      options.resolve === true
+    ) : await setCommentResolved(
+      found.credentials,
+      summary.siteId,
+      thread,
+      subcommand === "resolve"
+    );
+    const done = subcommand === "reply" ? `Replied on ${answered.path}${answered.resolvedAt === null ? "" : " and resolved the thread"}.` : `${subcommand === "resolve" ? "Resolved" : "Reopened"} the thread on ${answered.path}.`;
+    return { text: `${done}
+${answered.url}`, json: answered, code: 0 };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+function describeComments(threads, status, subdomain, more) {
+  const which = status === "all" ? "" : `${status} `;
+  if (threads.length === 0) return `No ${which}comment threads on ${subdomain}.`;
+  const heading = `${threads.length} ${which}comment ${threads.length === 1 ? "thread" : "threads"} on ${subdomain}` + (more ? " (more follow; `--json` shows the cursor)." : ".");
+  const blocks = threads.map((thread) => {
+    const where2 = thread.place.quote ?? (thread.place.snippet || null);
+    const flags = [
+      ...thread.resolvedAt === null ? [] : ["resolved"],
+      ...thread.outdated ? ["earlier version"] : []
+    ];
+    return [
+      `${thread.id}  ${thread.path}${where2 === null ? "" : `  "${where2}"`}` + (flags.length === 0 ? "" : `  (${flags.join(", ")})`),
+      ...thread.comments.map((comment) => {
+        const who = comment.author.owner ? `${comment.author.name} (owner)` : comment.author.name;
+        return `  ${who}: ${comment.body.replace(/\s*\n\s*/g, " ")}`;
+      }),
+      `  ${thread.url}`
+    ].join("\n");
+  });
+  return [heading, ...blocks].join("\n\n");
+}
 function day(iso) {
   const parsed = new Date(iso);
   return Number.isNaN(parsed.getTime()) ? iso : parsed.toISOString().slice(0, 10);
@@ -2220,8 +2801,16 @@ const HELP = `drop2run — publish a static site from the command line
   drop2run ls                                  List your sites
   drop2run folders                             List your folders, as --folder takes them
   drop2run open [site]                         Open a site in a browser
+  drop2run info [site]                         Show a site's settings and versions
+  drop2run set <setting> <value> [--site X]    Change one setting (see Settings below)
+  drop2run unset name|password|expires         Clear a name, a password or a takedown
+  drop2run pause [site]                        Take a site off the air, keeping its files
+  drop2run resume [site]                       Put a paused site back on the air
   drop2run rollback <deployId> [--site X]      Put an earlier version back live
   drop2run rm <site> --yes                     Delete a site and everything on it
+  drop2run comments [site]                     Read the comments left on a site's pages
+  drop2run comments reply <thread> <text>      Answer a thread as the owner [--resolve]
+  drop2run comments resolve|reopen <thread>    Resolve a thread, or open it again
   drop2run token list                          List your access tokens
   drop2run whoami                              Check the token and whose it is
   drop2run where                               Show which token source is in use
@@ -2235,6 +2824,33 @@ Flags
                  or a folder id (init and deploy only)
   --device       Sign in by approving a code on another machine
   --yes          Confirm a deletion, which cannot be undone
+  --then X       What \`set expires\` does when the date arrives: pause
+                 (the default, keeps the files) or delete (needs --yes)
+  --status X     Which comment threads: open (the default), resolved or all
+  --path X       Only the comments on one page, such as /pricing
+  --resolve      Resolve the thread with the reply (\`comments reply\` only)
+
+Comments
+  \`comments reply\`, \`resolve\` and \`reopen\` act on --site, else the site in
+  drop2run.json, and only the account's owner can use them. Deploy the fix
+  before replying that it is fixed. A reply leaves the thread open unless
+  --resolve is given, so the person who raised it can check the fix and
+  resolve it themselves.
+
+Settings
+  set name <text>               What the dashboard calls the site; put a
+                                name with words starting "-" after --
+  set mode static|spa|docs      static answers 404 for a missing path, spa
+                                falls back to index.html, docs uses the viewer
+  set password                  Typed at a hidden prompt, or piped in:
+                                printf %s "$PW" | drop2run set password
+  set forms on|off              Whether its forms accept submissions
+  set expires <ISO 8601>        Take it down then, e.g. 2026-12-31T09:00:00Z
+  set folder <path|id|root>     Move it to a folder, or root for the top level
+
+  \`set\` and \`unset\` act on --site, else the site in drop2run.json. A
+  setting your plan does not include is refused with the reason, and
+  \`info\` says which ones those are.
 
 Where a site comes from
   --subdomain creates one under the name you give. Otherwise: --site, then
@@ -2263,7 +2879,7 @@ function flagValue(args, flag) {
   const value = args[at + 1];
   return value === void 0 || value.startsWith("-") ? void 0 : value;
 }
-const VALUE_FLAGS = ["--site", "--subdomain", "--folder"];
+const VALUE_FLAGS = ["--site", "--subdomain", "--folder", "--then", "--status", "--path"];
 function positionals(argv) {
   const found = [];
   for (let at = 0; at < argv.length; at++) {
@@ -2287,7 +2903,7 @@ const SUBDOMAIN_FLAG = {
 const FOLDER_FLAG = {
   flag: "--folder",
   example: "Clients/Acme",
-  effect: "`--folder` only files a new one — move an existing site from the dashboard",
+  effect: "`--folder` only files a new one — move an existing site with `drop2run set folder`",
   elsewhere: (command) => command === "ls" || command === "list" ? " `drop2run folders` lists them." : ""
 };
 function newSiteFlagProblem(argv, command, site, value, described) {
@@ -2304,12 +2920,15 @@ function newSiteFlagProblem(argv, command, site, value, described) {
   }
   return void 0;
 }
-async function run(argv) {
+async function run(commandLine) {
+  const end = commandLine.indexOf("--");
+  const argv = end === -1 ? commandLine : commandLine.slice(0, end);
+  const literal = end === -1 ? [] : commandLine.slice(end + 1);
   const json = argv.includes("--json");
-  const positional = positionals(argv);
+  const positional = [...positionals(argv), ...literal];
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-D8mWS-nC.js").then(
+    const { version } = await import("./package-LdzYr7IV.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };
@@ -2325,6 +2944,12 @@ async function run(argv) {
     const failed = { text: refusal, json: { error: refusal }, code: 1 };
     return json ? { ...failed, text: JSON.stringify(failed.json, null, 2) } : failed;
   }
+  const then = flagValue(argv, "--then");
+  if (argv.includes("--then") && then === void 0) {
+    const message = "`--then` needs a value: `--then pause` or `--then delete`.";
+    const failed = { text: message, json: { error: message }, code: 1 };
+    return json ? { ...failed, text: JSON.stringify(failed.json, null, 2) } : failed;
+  }
   const result = await dispatch(
     command,
     rest,
@@ -2332,11 +2957,17 @@ async function run(argv) {
     json,
     argv.includes("--device"),
     argv.includes("--yes"),
-    { subdomain, folder }
+    { subdomain, folder },
+    then,
+    {
+      status: flagValue(argv, "--status"),
+      path: flagValue(argv, "--path"),
+      resolve: argv.includes("--resolve")
+    }
   );
   return json ? { ...result, text: JSON.stringify(result.json, null, 2) } : result;
 }
-async function dispatch(command, rest, site, json, device, confirmed, newSite = {}) {
+async function dispatch(command, rest, site, json, device, confirmed, newSite = {}, then = void 0, commentOptions = {}) {
   switch (command) {
     case "login": {
       const print = json ? () => {
@@ -2362,10 +2993,21 @@ async function dispatch(command, rest, site, json, device, confirmed, newSite =
       return await folders();
     case "open":
       return await open(rest[0] ?? site);
+    case "info":
+      return await info(rest[0] ?? site);
+    case "set":
+      return await set(site, rest[0], rest.slice(1), { then, confirmed });
+    case "unset":
+      return await unset(site, rest[0], rest.slice(1));
+    case "pause":
+    case "resume":
+      return await pauseOrResume(command, rest[0] ?? site);
     case "rollback":
       return await rollback(rest[0], site);
     case "rm":
       return await remove(rest[0] ?? site, confirmed);
+    case "comments":
+      return await comments(rest[0], rest.slice(1), site, commentOptions);
     case "token":
     case "tokens":
       return rest[0] === void 0 || rest[0] === "list" ? await tokens() : {

package/dist/{package-D8mWS-nC.js → package-LdzYr7IV.js}

@@ -1,5 +1,5 @@
 const name = "drop2run";
-const version = "0.7.0";
+const version = "0.9.0";
 const description = "Publish a page, a folder of documents or a built site to Drop2Run from the command line.";
 const license = "MIT";
 const type = "module";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "drop2run",
-	"version": "0.7.0",
+	"version": "0.9.0",
 	"description": "Publish a page, a folder of documents or a built site to Drop2Run from the command line.",
 	"license": "MIT",
 	"type": "module",