drop2run 0.8.0 → 0.10.0

package/README.md

@@ -29,6 +29,12 @@ drop2run pause [site]                        Take a site off the air, keeping it
 drop2run resume [site]                       Put a paused site back on the air
 drop2run rollback <deployId> [--site X]      Put an earlier version back live
 drop2run rm <site> --yes                     Delete a site and everything on it
+drop2run comments [site]                     Read the comments left on a site's pages
+drop2run comments reply <thread> <text>      Answer a thread as the owner [--resolve]
+drop2run comments resolve|reopen <thread>    Resolve a thread, or open it again
+drop2run people [site]                       Who the site is shared with
+drop2run invite <email>... [--role comment]  Share it with people; each is emailed
+drop2run uninvite <email>                    Take someone off the list
 drop2run token list                          List your access tokens
 drop2run whoami                              Check the token and whose it is
 drop2run where                               Show which token source is in use
@@ -37,6 +43,35 @@ drop2run --version                           Print the version
 
 `--json` on any command prints machine-readable output instead of text.
 
+## Sharing for review
+
+```bash
+drop2run invite dana@example.com --role comment --site calm-cedar   # emailed an invitation
+drop2run set invite-only on --site calm-cedar                        # only the list gets in
+drop2run set comments invited --site calm-cedar                      # the people invited to comment can
+```
+
+`drop2run people` shows the list and `drop2run uninvite` takes someone off it. `set comments anyone` lets
+anybody signed in comment instead, on a site you keep public or behind a password. Both are plan features,
+refused with the reason where the plan lacks them.
+
+## Comments
+
+On a plan that includes comments, people viewing a site can pin comments to its pages. `drop2run comments`
+reads them — each thread's id, page, the words it points at, and every comment — with `--status
+open|resolved|all` and `--path /page` to narrow it. The owner of the account can answer from here:
+
+```bash
+drop2run comments calm-cedar                                   # open threads
+drop2run deploy dist                                           # publish the fix first
+drop2run comments reply 01JTHREAD... "Fixed — please check" --site calm-cedar
+```
+
+The reply shows on the page under your name, as one typed there would, and the people in the thread are
+emailed.
+It leaves the thread open unless `--resolve` is given, so the person who raised it can check the fix and
+resolve it themselves. `comments resolve` and `comments reopen` change a thread's state on its own.
+
 ## Which site a command acts on
 
 `--subdomain` creates one under the name you give; otherwise `--site`, then `drop2run.json`, then a new

package/dist/index.js

@@ -190,10 +190,7 @@ async function folderFromListing(credentials, siteId, subdomain) {
 }
 async function getSite(credentials, siteId) {
   const [site, invitedOnly] = await Promise.all([
-    call(
-      credentials,
-      `sites/${encodeURIComponent(siteId)}`
-    ),
+    call(credentials, `sites/${encodeURIComponent(siteId)}`),
     readInvitedOnly(credentials, siteId)
   ]);
   const folderId = site.folderId !== void 0 ? site.folderId : await folderFromListing(credentials, site.siteId, site.subdomain);
@@ -215,6 +212,8 @@ async function getSite(credentials, siteId) {
     expiresAt: site.expiresAt,
     expiryAction: actionOf(site.expiresAt, site.expiryAction ?? ""),
     scheduledExpiryAvailable: site.scheduledExpiryAvailable,
+    comments: audienceOf(site.commentAudience),
+    commentsAvailable: site.feedbackAvailable === true,
     folderId,
     deploys: site.deploys.map((deploy2) => ({
       deployId: deploy2.deployId,
@@ -239,9 +238,11 @@ async function updateSiteSettings(credentials, siteId, change) {
   if (change.expiryAction !== void 0) body.expiryAction = change.expiryAction;
   if (change.formsEnabled !== void 0) body.formsEnabled = change.formsEnabled;
   if (change.folderId !== void 0) body.folderId = change.folderId;
+  if (change.invitedOnly !== void 0) body.invitedOnly = change.invitedOnly;
+  if (change.comments !== void 0) body.commentAudience = API_AUDIENCE[change.comments];
   if (Object.keys(body).length === 0) throw new Error("Nothing to change — name a setting.");
   const wasInvitedOnly = change.password !== void 0 && change.password !== "" ? await readInvitedOnly(credentials, siteId) : null;
-  const settings = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
+  const { commentAudience, ...settings } = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
     method: "PATCH",
     body: JSON.stringify(body)
   });
@@ -250,9 +251,19 @@ async function updateSiteSettings(credentials, siteId, change) {
     ...settings,
     expiryAction: actionOf(settings.expiresAt, settings.expiryAction ?? ""),
     invitedOnly,
+    comments: audienceOf(commentAudience),
     replacedInviteOnly: wasInvitedOnly === true && invitedOnly === false
   };
 }
+const API_AUDIENCE = {
+  off: "Off",
+  invited: "Invited",
+  anyone: "Anyone"
+};
+function audienceOf(value) {
+  const lower = value?.toLowerCase();
+  return lower === "off" || lower === "invited" || lower === "anyone" ? lower : null;
+}
 async function setSitePaused(credentials, siteId, action) {
   const state = await call(
     credentials,
@@ -344,6 +355,61 @@ const ROOT_FOLDER = "root";
 async function resolveFolderTarget(credentials, folder) {
   return folder.trim().toLowerCase() === ROOT_FOLDER ? ROOT_FOLDER : await resolveFolder(credentials, folder);
 }
+async function listComments(credentials, siteId, query = {}) {
+  const search = new URLSearchParams();
+  if (query.status !== void 0) search.set("status", query.status);
+  if (query.path !== void 0) search.set("path", query.path);
+  if (query.since !== void 0) search.set("since", String(query.since));
+  if (query.page !== void 0) search.set("page", String(query.page));
+  const encoded = search.toString();
+  const suffix = encoded === "" ? "" : `?${encoded}`;
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads${suffix}`
+  );
+}
+async function replyToComment(credentials, siteId, threadId, body, resolve2 = false) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/comments`,
+    { method: "POST", body: JSON.stringify({ body, resolve: resolve2 }) }
+  );
+}
+async function setCommentResolved(credentials, siteId, threadId, resolved) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/feedback/threads/${encodeURIComponent(threadId)}/${resolved ? "resolve" : "reopen"}`,
+    { method: "POST" }
+  );
+}
+const PEOPLE_PER_REQUEST = 50;
+async function listPeople(credentials, siteId) {
+  const page = await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers?pageSize=${PEOPLE_PER_REQUEST}`);
+  return {
+    invitedOnly: page.invitedOnly,
+    total: page.total,
+    limit: page.limit,
+    people: page.viewers.map((row) => ({
+      email: row.email,
+      role: enumName(row.role),
+      owner: row.owner,
+      status: enumName(row.status)
+    }))
+  };
+}
+async function invitePeople(credentials, siteId, emails, role) {
+  return await call(credentials, `sites/${encodeURIComponent(siteId)}/viewers`, {
+    method: "POST",
+    body: JSON.stringify({ emails, role: role === "comment" ? "Comment" : "View", notify: true })
+  });
+}
+async function removePerson(credentials, siteId, email) {
+  await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/viewers?email=${encodeURIComponent(email)}`,
+    { method: "DELETE" }
+  );
+}
 const VERSIONS_LISTED = 10;
 function servingModeOf$1(site) {
   if (site.spaMode) return "spa";
@@ -372,6 +438,7 @@ function describeSite(site, folderPath) {
     `  mode      ${servingModeOf$1(site)}${site.modeIsManual ? "" : " (detected on each publish)"}`,
     `  password  ${site.passwordProtected ? "on" : "off"}${unavailable(site.passwordProtectionAvailable)}`,
     `  forms     ${site.formsEnabled ? "on" : "off"}${unavailable(site.formsAvailable)}`,
+    `  comments  ${site.comments ?? "unknown"}${unavailable(site.commentsAvailable)}`,
     `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
     `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
     "",
@@ -847,13 +914,14 @@ const FILE_TYPES = [
     reader: true,
     editable: true
   },
-  // Source the viewer highlights. A link straight to one of these hands over the file.
+  // Source the viewer highlights. Inside a documents site a link straight to one opens it in the
+  // reader; on an ordinary site, and with `?raw`, it hands over the file.
   {
     ext: ".css",
     mime: "text/css; charset=utf-8",
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   {
@@ -861,7 +929,7 @@ const FILE_TYPES = [
     mime: "text/javascript; charset=utf-8",
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   {
@@ -869,7 +937,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -877,7 +945,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -885,7 +953,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -893,19 +961,18 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   // The languages an assistant writes most, beyond the web's own. Same row as `.ts`: shown as source
-  // when somebody opens one in the reader or publishes it on its own, handed over as a file when a
-  // link names it directly, and no media type — adding one changes what a browser does with a
+  // in the reader, handed over as a file with `?raw` or on an ordinary site, and no media type — adding one changes what a browser does with a
   // published file, which I10 makes a decision of its own rather than a side effect of this list.
   {
     ext: ".py",
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -913,7 +980,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -921,7 +988,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -929,7 +996,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -937,7 +1004,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -945,7 +1012,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -953,7 +1020,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -961,7 +1028,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -969,7 +1036,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -977,7 +1044,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -985,7 +1052,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -993,7 +1060,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -1001,7 +1068,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -1009,7 +1076,7 @@ const FILE_TYPES = [
     mime: null,
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: false
   },
   {
@@ -1017,7 +1084,7 @@ const FILE_TYPES = [
     mime: "application/xml",
     kind: "code",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   // Pictures, shown with an img element.
@@ -1088,25 +1155,25 @@ const FILE_TYPES = [
     reader: false,
     editable: false
   },
-  // A customer's own pages. Never rendered inside the reader.
+  // A customer's own pages. Inside a documents site a navigation opens the reader, which frames the
+  // page; `?raw` and every ordinary site serve the page itself.
   {
     ext: ".html",
     mime: "text/html; charset=utf-8",
     kind: "html",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   {
-    // ⚠️ No media type, and that is the state of the code rather than a decision: `TYPES` in
-    // `headers.ts` has never held `htm`, so a published `.htm` is served as octet-stream and
-    // downloads instead of rendering. Recorded here rather than fixed, because this table was
-    // introduced as a refactor and a refactor that changes what a URL answers is not one.
+    // An HTML page in every respect the Worker decides by extension: media type, the revalidated
+    // cache policy invariant I7 requires, and the badge's `isHtml`. Missing from `TYPES` it used to
+    // download, which inside the reader meant a frame that downloaded instead of showing a page.
     ext: ".htm",
-    mime: null,
+    mime: "text/html; charset=utf-8",
     kind: "html",
     document: false,
-    reader: false,
+    reader: true,
     editable: true
   },
   // Everything below renders as nothing — the viewer offers a download — but still needs a media
@@ -2498,7 +2565,9 @@ const SETTINGS_USAGE = [
   "  password                    Read from stdin, or typed at a hidden prompt",
   "  forms on|off                Whether its forms accept submissions",
   "  expires <ISO 8601 instant>  When it comes down; add --then delete to delete rather than pause",
-  "  folder <path|id|root>       Which folder it is filed in"
+  "  folder <path|id|root>       Which folder it is filed in",
+  "  invite-only on|off          Whether only the people on its list can open it",
+  "  comments off|invited|anyone Who may comment on its pages"
 ].join("\n");
 function settingChange(setting, values, then) {
   const value = setting === "name" ? values.join(" ").trim() : values[0];
@@ -2546,6 +2615,14 @@ function settingChange(setting, values, then) {
     }
     case "folder":
       return value ? { folder: value } : needs("Clients/Acme");
+    case "invite-only":
+      if (value === "on" || value === "off") return { change: { invitedOnly: value === "on" } };
+      return { refusal: "`set invite-only` takes `on` or `off`." };
+    case "comments":
+      if (value === "off" || value === "invited" || value === "anyone") {
+        return { change: { comments: value } };
+      }
+      return { refusal: "`set comments` takes `off`, `invited` or `anyone`." };
     default:
       return {
         refusal: `${setting === void 0 ? "Name a setting." : `\`${setting}\` is not a setting.`} Settings:
@@ -2623,9 +2700,14 @@ async function applied(credentials, siteId, subdomain, change) {
       `  access    ${accessOf(settings)}`,
       `  mode      ${servingModeOf$1(settings)}`,
       `  forms     ${settings.formsEnabled ? "on" : "off"}`,
+      `  comments  ${settings.comments ?? "unknown"}`,
       `  takedown  ${takedown}`,
       ...settings.replacedInviteOnly ? [
-        "The password replaced invite-only: the people on its list can no longer get in without it. The list is kept for if you switch back in the dashboard."
+        "The password replaced invite-only: the people on its list can no longer get in without it. The list is kept; `drop2run set invite-only on` switches back."
+      ] : [],
+      // The one combination that reads as on and does nothing, which the API keeps on purpose.
+      ...settings.comments === "invited" && settings.invitedOnly === false ? [
+        "Comments are for invited people, but the site is not invite-only, so nobody can comment yet. Run `drop2run set invite-only on`, or `drop2run set comments anyone`."
       ] : [],
       settings.live ? "Reaching every edge takes up to about a minute." : "Nothing is published yet, so this applies from the first publish."
     ].join("\n"),
@@ -2651,6 +2733,162 @@ async function tokens() {
     return failure(error instanceof Error ? error.message : String(error));
   }
 }
+async function people(site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const target = siteOr(site, "drop2run people <subdomain>");
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const list2 = await listPeople(found.credentials, summary.siteId);
+    const head = `${list2.total} of ${list2.limit} on ${summary.subdomain}'s list. ` + (list2.invitedOnly ? "Only they can open it." : "It is not invite-only, so anybody with the link can open it — `drop2run set invite-only on`.");
+    const rows = list2.people.map(
+      (person) => `${person.email}	${person.role}${person.owner ? ", owner" : ""}	${person.status}`
+    );
+    return { text: [head, ...rows].join("\n"), json: list2, code: 0 };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function invite(emails, site, role) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  if (emails.length === 0)
+    return failure("Name at least one address: `drop2run invite dana@example.com`.");
+  if (role !== void 0 && role !== "view" && role !== "comment") {
+    return failure("`--role` is `view` or `comment`.");
+  }
+  const target = siteOr(site, "drop2run invite <email> --site <subdomain>");
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const invited = await invitePeople(
+      found.credentials,
+      summary.siteId,
+      emails,
+      role === "comment" ? "comment" : "view"
+    );
+    const list2 = await listPeople(found.credentials, summary.siteId);
+    return {
+      text: [
+        invited.added.length === 0 ? `Nobody new on ${summary.subdomain}'s list.` : `Invited ${invited.added.join(", ")} to ${summary.subdomain} — each was emailed.`,
+        ...invited.alreadyListed.length === 0 ? [] : [`Already on the list, not emailed again: ${invited.alreadyListed.join(", ")}.`],
+        ...list2.invitedOnly ? [] : [
+          "The site is not invite-only yet, so the list does not decide who opens it. `drop2run set invite-only on` does."
+        ]
+      ].join("\n"),
+      json: invited,
+      code: 0
+    };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+async function uninvite(email, site) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  if (email === void 0)
+    return failure("Name the address: `drop2run uninvite dana@example.com`.");
+  const target = siteOr(site, "drop2run uninvite <email> --site <subdomain>");
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    await removePerson(found.credentials, summary.siteId, email);
+    return { text: `Removed ${email} from ${summary.subdomain}'s list.`, json: { email }, code: 0 };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+const COMMENTS_USAGE = [
+  "  drop2run comments [site] [--status open|resolved|all] [--path /page]",
+  "  drop2run comments reply <thread> <text> [--resolve] [--site X]",
+  "  drop2run comments resolve|reopen <thread> [--site X]"
+].join("\n");
+async function comments(subcommand, rest, site, options) {
+  const found = credentialsOr();
+  if ("result" in found) return found.result;
+  const acting = subcommand === "reply" || subcommand === "resolve" || subcommand === "reopen";
+  if (!acting) {
+    const status = options.status ?? "open";
+    if (status !== "open" && status !== "resolved" && status !== "all") {
+      return failure(
+        `\`--status\` is open, resolved or all, not "${status}".
+
+${COMMENTS_USAGE}`
+      );
+    }
+    const target2 = siteOr(subcommand ?? site, "drop2run comments <subdomain>");
+    if ("result" in target2) return target2.result;
+    try {
+      const summary = await findSite(found.credentials, target2.named);
+      const read = await listComments(found.credentials, summary.siteId, {
+        status,
+        path: options.path
+      });
+      return {
+        text: describeComments(read.threads, status, summary.subdomain, read.more),
+        json: read,
+        code: 0
+      };
+    } catch (error) {
+      return failure(error instanceof Error ? error.message : String(error));
+    }
+  }
+  const [thread, ...words] = rest;
+  if (thread === void 0)
+    return failure(`Name the thread, from \`drop2run comments\`.
+
+${COMMENTS_USAGE}`);
+  const body = words.join(" ").trim();
+  if (subcommand === "reply" && body === "") {
+    return failure(`Write the reply after the thread id.
+
+${COMMENTS_USAGE}`);
+  }
+  const target = siteOr(site, `drop2run comments ${subcommand} <thread> --site <subdomain>`);
+  if ("result" in target) return target.result;
+  try {
+    const summary = await findSite(found.credentials, target.named);
+    const answered = subcommand === "reply" ? await replyToComment(
+      found.credentials,
+      summary.siteId,
+      thread,
+      body,
+      options.resolve === true
+    ) : await setCommentResolved(
+      found.credentials,
+      summary.siteId,
+      thread,
+      subcommand === "resolve"
+    );
+    const done = subcommand === "reply" ? `Replied on ${answered.path}${answered.resolvedAt === null ? "" : " and resolved the thread"}.` : `${subcommand === "resolve" ? "Resolved" : "Reopened"} the thread on ${answered.path}.`;
+    return { text: `${done}
+${answered.url}`, json: answered, code: 0 };
+  } catch (error) {
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+function describeComments(threads, status, subdomain, more) {
+  const which = status === "all" ? "" : `${status} `;
+  if (threads.length === 0) return `No ${which}comment threads on ${subdomain}.`;
+  const heading = `${threads.length} ${which}comment ${threads.length === 1 ? "thread" : "threads"} on ${subdomain}` + (more ? " (more follow; `--json` shows the cursor)." : ".");
+  const blocks = threads.map((thread) => {
+    const where2 = thread.place.quote ?? (thread.place.snippet || null);
+    const flags = [
+      ...thread.resolvedAt === null ? [] : ["resolved"],
+      ...thread.outdated ? ["earlier version"] : []
+    ];
+    return [
+      `${thread.id}  ${thread.path}${where2 === null ? "" : `  "${where2}"`}` + (flags.length === 0 ? "" : `  (${flags.join(", ")})`),
+      ...thread.comments.map((comment) => {
+        const who = comment.author.owner ? `${comment.author.name} (owner)` : comment.author.name;
+        return `  ${who}: ${comment.body.replace(/\s*\n\s*/g, " ")}`;
+      }),
+      `  ${thread.url}`
+    ].join("\n");
+  });
+  return [heading, ...blocks].join("\n\n");
+}
 function day(iso) {
   const parsed = new Date(iso);
   return Number.isNaN(parsed.getTime()) ? iso : parsed.toISOString().slice(0, 10);
@@ -2691,6 +2929,12 @@ const HELP = `drop2run — publish a static site from the command line
   drop2run resume [site]                       Put a paused site back on the air
   drop2run rollback <deployId> [--site X]      Put an earlier version back live
   drop2run rm <site> --yes                     Delete a site and everything on it
+  drop2run people [site]                       Who the site is shared with
+  drop2run invite <email>... [--role comment]  Share it with people; each is emailed
+  drop2run uninvite <email>                    Take someone off the list
+  drop2run comments [site]                     Read the comments left on a site's pages
+  drop2run comments reply <thread> <text>      Answer a thread as the owner [--resolve]
+  drop2run comments resolve|reopen <thread>    Resolve a thread, or open it again
   drop2run token list                          List your access tokens
   drop2run whoami                              Check the token and whose it is
   drop2run where                               Show which token source is in use
@@ -2706,6 +2950,17 @@ Flags
   --yes          Confirm a deletion, which cannot be undone
   --then X       What \`set expires\` does when the date arrives: pause
                  (the default, keeps the files) or delete (needs --yes)
+  --status X     Which comment threads: open (the default), resolved or all
+  --path X       Only the comments on one page, such as /pricing
+  --resolve      Resolve the thread with the reply (\`comments reply\` only)
+  --role X       What invited people may do: view (the default) or comment
+
+Comments
+  \`comments reply\`, \`resolve\` and \`reopen\` act on --site, else the site in
+  drop2run.json, and only the account's owner can use them. Deploy the fix
+  before replying that it is fixed. A reply leaves the thread open unless
+  --resolve is given, so the person who raised it can check the fix and
+  resolve it themselves.
 
 Settings
   set name <text>               What the dashboard calls the site; put a
@@ -2717,6 +2972,11 @@ Settings
   set forms on|off              Whether its forms accept submissions
   set expires <ISO 8601>        Take it down then, e.g. 2026-12-31T09:00:00Z
   set folder <path|id|root>     Move it to a folder, or root for the top level
+  set invite-only on|off        Only the people on its list (\`invite\`) can open it;
+                                replaces a password
+  set comments off|invited|anyone
+                                Who may comment: nobody, people invited to
+                                comment, or anybody signed in
 
   \`set\` and \`unset\` act on --site, else the site in drop2run.json. A
   setting your plan does not include is refused with the reason, and
@@ -2749,7 +3009,7 @@ function flagValue(args, flag) {
   const value = args[at + 1];
   return value === void 0 || value.startsWith("-") ? void 0 : value;
 }
-const VALUE_FLAGS = ["--site", "--subdomain", "--folder", "--then"];
+const VALUE_FLAGS = ["--site", "--subdomain", "--folder", "--then", "--status", "--path", "--role"];
 function positionals(argv) {
   const found = [];
   for (let at = 0; at < argv.length; at++) {
@@ -2798,7 +3058,7 @@ async function run(commandLine) {
   const positional = [...positionals(argv), ...literal];
   const [command, ...rest] = positional;
   if (argv.includes("--version")) {
-    const { version } = await import("./package-BycuI1VJ.js").then(
+    const { version } = await import("./package-CGI7Yt81.js").then(
       (module) => module.default
     );
     return { text: version, json: { version }, code: 0 };
@@ -2828,11 +3088,17 @@ async function run(commandLine) {
     argv.includes("--device"),
     argv.includes("--yes"),
     { subdomain, folder },
-    then
+    then,
+    {
+      status: flagValue(argv, "--status"),
+      path: flagValue(argv, "--path"),
+      resolve: argv.includes("--resolve")
+    },
+    flagValue(argv, "--role")
   );
   return json ? { ...result, text: JSON.stringify(result.json, null, 2) } : result;
 }
-async function dispatch(command, rest, site, json, device, confirmed, newSite = {}, then = void 0) {
+async function dispatch(command, rest, site, json, device, confirmed, newSite = {}, then = void 0, commentOptions = {}, role = void 0) {
   switch (command) {
     case "login": {
       const print = json ? () => {
@@ -2869,8 +3135,16 @@ async function dispatch(command, rest, site, json, device, confirmed, newSite =
       return await pauseOrResume(command, rest[0] ?? site);
     case "rollback":
       return await rollback(rest[0], site);
+    case "people":
+      return await people(rest[0] ?? site);
+    case "invite":
+      return await invite(rest, site, role);
+    case "uninvite":
+      return await uninvite(rest[0], site);
     case "rm":
       return await remove(rest[0] ?? site, confirmed);
+    case "comments":
+      return await comments(rest[0], rest.slice(1), site, commentOptions);
     case "token":
     case "tokens":
       return rest[0] === void 0 || rest[0] === "list" ? await tokens() : {

package/dist/{package-BycuI1VJ.js → package-CGI7Yt81.js}

@@ -1,5 +1,5 @@
 const name = "drop2run";
-const version = "0.8.0";
+const version = "0.10.0";
 const description = "Publish a page, a folder of documents or a built site to Drop2Run from the command line.";
 const license = "MIT";
 const type = "module";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "drop2run",
-	"version": "0.8.0",
+	"version": "0.10.0",
 	"description": "Publish a page, a folder of documents or a built site to Drop2Run from the command line.",
 	"license": "MIT",
 	"type": "module",