gutterpress 0.10.4 → 0.10.5-beta.1

package/dist/{index-1z8a090c.js → index-3xv7vwv2.js}

@@ -17,7 +17,7 @@ import {
   resolveChromiumExecutable,
   run,
   spawnCapture
-} from "./index-p4yq14qw.js";
+} from "./index-k5hcp8wj.js";
 import {
   gitFs,
   gitScopeFor,
@@ -3978,7 +3978,7 @@ import git from "isomorphic-git";
 // package.json
 var package_default = {
   name: "gutterpress",
-  version: "0.10.4",
+  version: "0.10.5-beta.1",
   description: "Markdown-to-PDF converter for professional print layout using a native Chromium print engine and Ghostscript.",
   author: "itlackey",
   license: "MPL-2.0",
@@ -8032,7 +8032,7 @@ class PdfOutput {
       const rawPdf = pdfxMode ? path8.join(stage, "raw.pdf") : path8.resolve(pdfFile);
       await fsp2.mkdir(path8.dirname(path8.resolve(pdfFile)), { recursive: true });
       log.info("Rendering HTML to PDF via the Gutterpress engine (native Chromium pagination)");
-      const { buildNativePdf } = await import("./engine-pta3yeyt.js");
+      const { buildNativePdf } = await import("./engine-mtyjc4v6.js");
       const engineDiagnostics = await buildNativePdf(htmlFile, rawPdf, {
         title: config.title,
         author: config.authors.length > 0 ? config.authors.join(", ") : undefined,
@@ -8747,24 +8747,24 @@ import { WebSocket, WebSocketServer } from "ws";
 
 // src/lib/open-path.ts
 import { spawn } from "node:child_process";
+function buildOpenPathSpawnSpec(filePath, platform = process.platform) {
+  switch (platform) {
+    case "darwin":
+      return { cmd: "open", args: [filePath], options: { detached: true, stdio: "ignore" } };
+    case "win32":
+      return {
+        cmd: "cmd",
+        args: ["/c", "start", '""', '"' + filePath + '"'],
+        options: { detached: true, stdio: "ignore", windowsVerbatimArguments: true }
+      };
+    default:
+      return { cmd: "xdg-open", args: [filePath], options: { detached: true, stdio: "ignore" } };
+  }
+}
 function openPath(filePath) {
   return new Promise((resolve9, reject) => {
-    let cmd;
-    let args;
-    switch (process.platform) {
-      case "darwin":
-        cmd = "open";
-        args = [filePath];
-        break;
-      case "win32":
-        cmd = "cmd";
-        args = ["/c", "start", "", filePath];
-        break;
-      default:
-        cmd = "xdg-open";
-        args = [filePath];
-    }
-    const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+    const { cmd, args, options } = buildOpenPathSpawnSpec(filePath);
+    const child = spawn(cmd, args, options);
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
@@ -12225,16 +12225,371 @@ function githubApiHeaders(token) {
     "X-GitHub-Api-Version": "2022-11-28"
   };
 }
+// src/lib/publish/google-auth.ts
+import crypto from "node:crypto";
+import http2 from "node:http";
+
+// src/lib/publish/google-errors.ts
+function redactQueryCredentials(text) {
+  return text.replace(/([?&](?:access_token|key)=)[^&\s"']+/gi, "$1(redacted)");
+}
+function parseGoogleApiError(status, body) {
+  const err = body?.error;
+  if (!err || typeof err !== "object")
+    return { status };
+  const e = err;
+  const first = Array.isArray(e.errors) ? e.errors[0] : undefined;
+  const reason = typeof first?.reason === "string" && first.reason ? first.reason : typeof e.status === "string" && e.status ? e.status : undefined;
+  const message = typeof e.message === "string" && e.message.trim() ? redactQueryCredentials(e.message.trim()) : undefined;
+  return { status, ...reason ? { reason } : {}, ...message ? { message } : {} };
+}
+async function readGoogleApiError(res) {
+  const body = await res.json().catch(() => {
+    return;
+  });
+  return parseGoogleApiError(res.status, body);
+}
+var RATE_LIMIT_REASONS = /^(dailyLimitExceeded|userRateLimitExceeded|rateLimitExceeded|quotaExceeded)$/i;
+var PERMISSION_REASONS = /^(insufficientPermissions|insufficientFilePermissions|forbidden|PERMISSION_DENIED)$/i;
+function hintFor(info2) {
+  const reason = info2.reason ?? "";
+  if (/^accessNotConfigured$/i.test(reason)) {
+    return "Google Drive publishing isn't fully set up on this build: the Google Drive API isn't enabled for the app's Google Cloud project, so a maintainer needs to enable it (the link is in Google's message).";
+  }
+  if (/^storageQuotaExceeded$/i.test(reason)) {
+    return "Your Google Drive is full — free up space (or choose a different folder) and try again.";
+  }
+  if (RATE_LIMIT_REASONS.test(reason)) {
+    return "Google Drive is rate-limiting requests right now. Wait a minute and try again.";
+  }
+  if (PERMISSION_REASONS.test(reason) || info2.status === 401) {
+    return "This Google Drive connection doesn't have permission for that — disconnect and connect Google Drive again to re-approve access.";
+  }
+  return;
+}
+function googleApiFailure(what, info2) {
+  const parts = [`${what} (HTTP ${info2.status}${info2.reason ? `, ${info2.reason}` : ""}).`];
+  const hint = hintFor(info2);
+  if (hint)
+    parts.push(hint);
+  if (info2.message)
+    parts.push(`Google said: "${info2.message}"`);
+  let text = parts.join(" ");
+  if (!/\bgoogle\b/i.test(text))
+    text = `Google Drive: ${text}`;
+  return new FriendlyHttpError(text);
+}
+
+// src/lib/publish/google-auth.ts
+var GDRIVE_HOST = "gdrive";
+var GOOGLE_OAUTH_SCOPE = "https://www.googleapis.com/auth/drive.file";
+var AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+var DRIVE_ABOUT_URL = "https://www.googleapis.com/drive/v3/about?fields=user(emailAddress)";
+var REQUEST_TIMEOUT_MS2 = 15000;
+var DEFAULT_FLOW_TIMEOUT_MS = 5 * 60000;
+var OFFLINE_MESSAGE2 = "Couldn't reach Google. Check your connection and try again.";
+var DEFAULT_GOOGLE_CLIENT_ID = "621278203862-2t35qditgvfh0pgosguqu2encf9c2h9j.apps.googleusercontent.com";
+var DEFAULT_GOOGLE_CLIENT_SECRET = "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";
+function resolveClientValue(explicit, env, embedded) {
+  if (explicit !== undefined)
+    return explicit.trim();
+  if (env !== undefined)
+    return env.trim();
+  return embedded;
+}
+function resolveGoogleClientId(explicit) {
+  return resolveClientValue(explicit, process.env.GUTTERPRESS_GOOGLE_CLIENT_ID, DEFAULT_GOOGLE_CLIENT_ID);
+}
+function resolveGoogleClientSecret(explicit) {
+  return resolveClientValue(explicit, process.env.GUTTERPRESS_GOOGLE_CLIENT_SECRET, DEFAULT_GOOGLE_CLIENT_SECRET);
+}
+var GOOGLE_NOT_CONFIGURED_MESSAGE = "Google Drive publishing isn't configured on this build yet. Set GUTTERPRESS_GOOGLE_CLIENT_ID and GUTTERPRESS_GOOGLE_CLIENT_SECRET to enable it.";
+function requireGoogleClientCredentials(clientIdOpt, clientSecretOpt) {
+  const clientId = resolveGoogleClientId(clientIdOpt);
+  const clientSecret = resolveGoogleClientSecret(clientSecretOpt);
+  if (!clientId || !clientSecret) {
+    throw new Error(GOOGLE_NOT_CONFIGURED_MESSAGE);
+  }
+  return { clientId, clientSecret };
+}
+var RECONNECT_MESSAGE = "Your Google Drive connection expired or was revoked. Connect Google Drive again.";
+var DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+var DRIVE_PERMISSION_NOT_GRANTED_MESSAGE = "Google sign-in finished, but it didn't include the Google Drive permission, so Gutterpress can't create or see any files. Connect Google Drive again and allow it.";
+function grantedScopesInclude(scope, wanted) {
+  if (scope === undefined)
+    return true;
+  return scope.split(/\s+/).includes(wanted);
+}
+function b64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function pkceChallengeFromVerifier(verifier) {
+  return b64url(crypto.createHash("sha256").update(verifier).digest());
+}
+async function safeFetch2(fetchImpl, url, init, timeoutMs = REQUEST_TIMEOUT_MS2) {
+  return withFetchTimeout({ timeoutMs, signal: init.signal ?? undefined, offlineMessage: OFFLINE_MESSAGE2 }, (signal) => fetchImpl(url, { ...init, signal }));
+}
+function friendlyTokenError(status, body) {
+  const code = body?.error;
+  if (code === "invalid_grant")
+    return new Error(RECONNECT_MESSAGE);
+  if (code === "invalid_client") {
+    return new Error("Google rejected the app's sign-in credentials. This build's Google OAuth client id/secret may be misconfigured.");
+  }
+  return new FriendlyHttpError(`Google sign-in failed (HTTP ${status}${code ? `: ${code}` : ""}). Please try again.`);
+}
+var SUCCESS_HTML = `<html><body style="font:16px system-ui;padding:3rem"><h2>You're connected</h2><p>Return to Gutterpress — you can close this tab.</p></body></html>`;
+var FAILURE_HTML = `<html><body style="font:16px system-ui;padding:3rem"><h2>Sign-in didn't complete</h2><p>Return to Gutterpress and try again.</p></body></html>`;
+function waitForCallback(server, expectedState, redirectUri, timeoutMs, signal) {
+  return new Promise((resolve9, reject) => {
+    let settled = false;
+    const cleanup = () => {
+      clearTimeout(timer);
+      server.removeListener("request", onRequest);
+      signal?.removeEventListener("abort", onAbort);
+      server.close();
+      server.closeIdleConnections();
+    };
+    const finishResolve = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      resolve9(value);
+    };
+    const finishReject = (err) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      reject(err);
+    };
+    const onRequest = (req, res) => {
+      let url;
+      try {
+        url = new URL(req.url ?? "/", redirectUri);
+      } catch {
+        res.writeHead(400).end();
+        return;
+      }
+      const err = url.searchParams.get("error");
+      const gotState = url.searchParams.get("state");
+      const code = url.searchParams.get("code");
+      if (!err && !code) {
+        res.writeHead(204, { Connection: "close" }).end();
+        return;
+      }
+      const fail = (message) => {
+        res.writeHead(200, { "Content-Type": "text/html", Connection: "close" }).end(FAILURE_HTML);
+        finishReject(new Error(message));
+      };
+      if (err) {
+        fail("Google sign-in was declined. You can connect Google Drive again whenever you're ready.");
+        return;
+      }
+      if (gotState !== expectedState) {
+        fail("Google sign-in failed a security check (state mismatch). Connect Google Drive again.");
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" }).end(SUCCESS_HTML);
+      finishResolve({ code });
+    };
+    const onAbort = () => finishReject(new Error("Google sign-in was canceled."));
+    const timer = setTimeout(() => finishReject(new Error("Google sign-in timed out waiting for the browser. Try again, or use GDRIVE_REFRESH_TOKEN for headless/CI use.")), timeoutMs);
+    server.on("request", onRequest);
+    if (signal) {
+      if (signal.aborted)
+        return onAbort();
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+  });
+}
+
+class GoogleAuthProvider {
+  clientIdOpt;
+  clientSecretOpt;
+  fetchImpl;
+  openBrowser;
+  timeoutMs;
+  bindPort;
+  constructor(options = {}) {
+    this.clientIdOpt = options.clientId;
+    this.clientSecretOpt = options.clientSecret;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.openBrowser = options.openBrowser ?? openPath;
+    this.timeoutMs = options.timeoutMs ?? DEFAULT_FLOW_TIMEOUT_MS;
+    this.bindPort = options.port ?? 0;
+  }
+  async connect(callbacks) {
+    const { clientId, clientSecret } = requireGoogleClientCredentials(this.clientIdOpt, this.clientSecretOpt);
+    const { signal } = callbacks;
+    const verifier = b64url(crypto.randomBytes(32));
+    const state = b64url(crypto.randomBytes(16));
+    const challenge = pkceChallengeFromVerifier(verifier);
+    const server = http2.createServer();
+    await new Promise((resolve9, reject) => {
+      const onListenError = (err) => {
+        reject(new Error(`Couldn't start the local sign-in listener: ${err.message}`));
+      };
+      server.once("error", onListenError);
+      server.listen(this.bindPort, "127.0.0.1", () => {
+        server.removeListener("error", onListenError);
+        resolve9();
+      });
+    });
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : 0;
+    const redirectUri = `http://127.0.0.1:${port}`;
+    const authUrl = `${AUTHORIZATION_ENDPOINT}?` + new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      scope: GOOGLE_OAUTH_SCOPE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state,
+      access_type: "offline",
+      prompt: "consent"
+    }).toString();
+    callbacks.onAuthUrl(authUrl);
+    this.openBrowser(authUrl).catch(() => {});
+    const { code } = await waitForCallback(server, state, redirectUri, this.timeoutMs, signal);
+    const tokenRes = await safeFetch2(this.fetchImpl, TOKEN_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectUri,
+        code_verifier: verifier
+      }).toString(),
+      signal
+    });
+    const tokenBody = await tokenRes.json().catch(() => ({}));
+    if (!tokenRes.ok || !tokenBody.access_token) {
+      throw friendlyTokenError(tokenRes.status, tokenBody);
+    }
+    if (!tokenBody.refresh_token) {
+      throw new Error("Google didn't return a refresh token. Try connecting again — if this keeps happening, revoke Gutterpress's access at myaccount.google.com/permissions and reconnect.");
+    }
+    if (!grantedScopesInclude(tokenBody.scope, DRIVE_FILE_SCOPE)) {
+      throw new Error(DRIVE_PERMISSION_NOT_GRANTED_MESSAGE);
+    }
+    const email = await this.fetchEmail(tokenBody.access_token);
+    return {
+      host: GDRIVE_HOST,
+      kind: "google-oauth",
+      token: tokenBody.refresh_token,
+      ...email ? { username: email, label: `Google Drive — ${email}` } : { label: "Google Drive" },
+      createdAt: Date.now()
+    };
+  }
+  async fetchEmail(accessToken) {
+    let res;
+    try {
+      res = await safeFetch2(this.fetchImpl, DRIVE_ABOUT_URL, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+    } catch {
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      throw googleApiFailure("Google Drive rejected the new connection", await readGoogleApiError(res));
+    }
+    if (!res.ok)
+      return;
+    try {
+      const body = await res.json();
+      return body.user?.emailAddress;
+    } catch {
+      return;
+    }
+  }
+}
+async function revokeGoogleCredential(refreshToken, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  try {
+    await withFetchTimeout({ timeoutMs: 1e4, offlineMessage: OFFLINE_MESSAGE2 }, (signal) => fetchImpl(GOOGLE_REVOKE_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token: refreshToken }).toString(),
+      signal
+    }));
+  } catch {}
+}
+// src/lib/publish/types.ts
+function publishCredentialKey(host, account) {
+  const a = (account ?? "").trim();
+  return a ? `${host}#${a}` : host;
+}
+async function resolvePublishCredential(info2, deps, account = deps.credentialAccount) {
+  const env = deps.env ?? process.env;
+  const fromEnv = info2.credential.envVar ? env[info2.credential.envVar]?.trim() : undefined;
+  if (fromEnv) {
+    return {
+      credential: {
+        host: info2.credential.host,
+        kind: "token",
+        token: fromEnv,
+        createdAt: 0
+      },
+      source: "env"
+    };
+  }
+  const stored = await deps.tokenStore.get(publishCredentialKey(info2.credential.host, account));
+  return stored ? { credential: stored, source: "store" } : null;
+}
+async function publishConnectionStatus(info2, deps, account = deps.credentialAccount) {
+  if (!info2.credential.required)
+    return { connected: true };
+  const resolved = await resolvePublishCredential(info2, deps, account);
+  return resolved ? { connected: true, source: resolved.source } : { connected: false };
+}
+async function listPublishAccounts(info2, deps) {
+  const wantHost = info2.credential.host.trim().toLowerCase();
+  const all = await deps.tokenStore.list();
+  return all.filter((c) => c.host.trim().toLowerCase() === wantHost).map((c) => ({
+    account: (c.username ?? "").trim(),
+    label: c.label ?? (c.username || info2.label),
+    createdAt: c.createdAt
+  }));
+}
+
+// src/lib/publish/connect-google.ts
+async function connectGoogleDrive(options, deps, callbacks) {
+  const provider = new GoogleAuthProvider({
+    clientId: options.clientId,
+    clientSecret: options.clientSecret,
+    fetchImpl: deps.fetch,
+    ...options.openBrowser ? { openBrowser: options.openBrowser } : {}
+  });
+  const credential = await provider.connect(callbacks);
+  const email = credential.username;
+  const account = (options.account ?? "").trim();
+  const key = publishCredentialKey(GDRIVE_HOST, account);
+  const { username: _accountEmailAsUsername, ...credentialWithoutUsername } = credential;
+  await deps.tokenStore.set(key, {
+    ...credentialWithoutUsername,
+    ...account ? { username: account } : {},
+    label: account ? `${account} (${email ?? "Google Drive"})` : credential.label
+  });
+  return { connected: true, ...email ? { email } : {} };
+}
 // src/lib/remote-auth/github-repos.ts
 var API_BASE2 = "https://api.github.com";
-var REQUEST_TIMEOUT_MS2 = 15000;
+var REQUEST_TIMEOUT_MS3 = 15000;
 var PER_PAGE = 100;
 var MAX_PAGES = 50;
-var RECONNECT_MESSAGE = "Your GitHub connection has expired. Reconnect GitHub and try again.";
+var RECONNECT_MESSAGE2 = "Your GitHub connection has expired. Reconnect GitHub and try again.";
 async function apiGet(fetchImpl, url, token) {
-  const res = await withFetchTimeout({ timeoutMs: REQUEST_TIMEOUT_MS2, offlineMessage: OFFLINE_MESSAGE }, (signal) => fetchImpl(url, { method: "GET", headers: githubApiHeaders(token), signal }));
+  const res = await withFetchTimeout({ timeoutMs: REQUEST_TIMEOUT_MS3, offlineMessage: OFFLINE_MESSAGE }, (signal) => fetchImpl(url, { method: "GET", headers: githubApiHeaders(token), signal }));
   if (res.status === 401 || res.status === 403) {
-    throw new Error(RECONNECT_MESSAGE);
+    throw new Error(RECONNECT_MESSAGE2);
   }
   if (!res.ok) {
     throw new Error(`GitHub returned an unexpected error (HTTP ${res.status}). Please try again.`);
@@ -12344,7 +12699,7 @@ function isSmallBody(body) {
 function gitTimeoutError(what, ms) {
   return new Error(`Git network operation timed out after ${Math.round(ms / 1000)}s (${what}); ` + `couldn't reach the remote (ETIMEDOUT).`);
 }
-function withIdleTimeout(http2, idleMs = GIT_HTTP_IDLE_TIMEOUT_MS, uploadMs = GIT_HTTP_UPLOAD_TIMEOUT_MS) {
+function withIdleTimeout(http3, idleMs = GIT_HTTP_IDLE_TIMEOUT_MS, uploadMs = GIT_HTTP_UPLOAD_TIMEOUT_MS) {
   return {
     async request(options) {
       let timer;
@@ -12373,7 +12728,7 @@ function withIdleTimeout(http2, idleMs = GIT_HTTP_IDLE_TIMEOUT_MS, uploadMs = GI
       arm(isLargeUpload ? uploadMs : idleMs, isLargeUpload ? "the upload did not complete" : "the remote did not respond");
       let res;
       try {
-        res = await race(http2.request(options));
+        res = await race(http3.request(options));
       } finally {
         disarm();
       }
@@ -12582,12 +12937,12 @@ async function guardTrackingRef(dir, ref, cache2, fn) {
     throw e;
   }
 }
-async function fetchRemoteTip(dir, branch, transport, http2, cache2) {
+async function fetchRemoteTip(dir, branch, transport, http3, cache2) {
   try {
     const trackingRef = `refs/remotes/${transport.remote}/${branch}`;
     const result = await guardTrackingRef(dir, trackingRef, cache2, () => git2.fetch({
       fs: gitFs,
-      http: http2,
+      http: http3,
       dir,
       cache: cache2,
       remote: transport.remote,
@@ -13202,7 +13557,7 @@ function defaultSleep2(ms) {
   return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function syncProject(options) {
-  const http2 = options.httpClient ?? defaultGitHttp;
+  const http3 = options.httpClient ?? defaultGitHttp;
   const push = options.push ?? true;
   const attempts = Math.max(1, options.retry?.attempts ?? DEFAULT_SYNC_RETRY.attempts);
   const backoffMs = Math.max(0, options.retry?.backoffMs ?? DEFAULT_SYNC_RETRY.backoffMs);
@@ -13239,7 +13594,7 @@ async function syncProject(options) {
       }
       for (let attempt = 0;attempt < attempts; attempt++) {
         logger.info("sync", `sync pass ${attempt + 1}/${attempts}`);
-        const remoteTip = await fetchRemoteTip(dir, branch, transport, http2, cache2);
+        const remoteTip = await fetchRemoteTip(dir, branch, transport, http3, cache2);
         let localTip = await git6.resolveRef({ fs: gitFs, dir, ref: branch });
         if (push || remoteTip !== null && remoteTip !== localTip) {
           const lateSnapshot = await snapshotBeforeAction({
@@ -13312,7 +13667,7 @@ async function syncProject(options) {
         try {
           await git6.push({
             fs: gitFs,
-            http: http2,
+            http: http3,
             dir,
             cache: cache2,
             remote: transport.remote,
@@ -13351,8 +13706,8 @@ async function syncProject(options) {
   });
 }
 // src/lib/publish/run-publish.ts
-import { readdir as readdir11, stat as stat10 } from "node:fs/promises";
-import path26 from "node:path";
+import { readdir as readdir12, stat as stat11 } from "node:fs/promises";
+import path27 from "node:path";
 
 // src/lib/publish/command-runner.ts
 var CAPTURE_LIMIT = 64 * 1024;
@@ -13409,44 +13764,6 @@ async function commandExists(cmd, runCommand = defaultCommandRunner, env) {
   }
 }
 
-// src/lib/publish/types.ts
-function publishCredentialKey(host, account) {
-  const a = (account ?? "").trim();
-  return a ? `${host}#${a}` : host;
-}
-async function resolvePublishCredential(info2, deps, account = deps.credentialAccount) {
-  const env = deps.env ?? process.env;
-  const fromEnv = info2.credential.envVar ? env[info2.credential.envVar]?.trim() : undefined;
-  if (fromEnv) {
-    return {
-      credential: {
-        host: info2.credential.host,
-        kind: "token",
-        token: fromEnv,
-        createdAt: 0
-      },
-      source: "env"
-    };
-  }
-  const stored = await deps.tokenStore.get(publishCredentialKey(info2.credential.host, account));
-  return stored ? { credential: stored, source: "store" } : null;
-}
-async function publishConnectionStatus(info2, deps, account = deps.credentialAccount) {
-  if (!info2.credential.required)
-    return { connected: true };
-  const resolved = await resolvePublishCredential(info2, deps, account);
-  return resolved ? { connected: true, source: resolved.source } : { connected: false };
-}
-async function listPublishAccounts(info2, deps) {
-  const wantHost = info2.credential.host.trim().toLowerCase();
-  const all = await deps.tokenStore.list();
-  return all.filter((c) => c.host.trim().toLowerCase() === wantHost).map((c) => ({
-    account: (c.username ?? "").trim(),
-    label: c.label ?? (c.username || info2.label),
-    createdAt: c.createdAt
-  }));
-}
-
 // src/lib/publish/providers/azure-swa.ts
 var AZURE_SWA_HOST = "azure-swa";
 var info2 = {
@@ -13619,9 +13936,521 @@ var drivethrurpgProvider = {
   }
 };
 
-// src/lib/publish/butler.ts
-import { chmod as chmod2, mkdir as mkdir17, stat as stat9, writeFile as writeFile14 } from "node:fs/promises";
+// src/lib/publish/providers/gdrive.ts
+import { mkdtemp as mkdtemp4, readFile as readFile31, readdir as readdir11, rm as rm9, stat as stat9, writeFile as writeFile14 } from "node:fs/promises";
+import { tmpdir as tmpdir4 } from "node:os";
 import path25 from "node:path";
+import { Zip, ZipDeflate } from "fflate";
+
+// src/lib/publish/google-drive.ts
+import { open as open3 } from "node:fs/promises";
+var TOKEN_ENDPOINT2 = "https://oauth2.googleapis.com/token";
+var DRIVE_API_BASE = "https://www.googleapis.com/drive/v3";
+var DRIVE_UPLOAD_BASE = "https://www.googleapis.com/upload/drive/v3/files";
+var METADATA_TIMEOUT_MS2 = 30000;
+var TOKEN_REFRESH_TIMEOUT_MS = 15000;
+var CHUNK_TIMEOUT_MS = 120000;
+var OFFLINE_MESSAGE3 = "Couldn't reach Google Drive. Check your connection and try again.";
+async function driveFetch(fetchImpl, url, init, timeoutMs = METADATA_TIMEOUT_MS2) {
+  return withFetchTimeout({ timeoutMs, offlineMessage: OFFLINE_MESSAGE3 }, (signal) => fetchImpl(url, { ...init, signal }));
+}
+function authHeaders(accessToken) {
+  return { Authorization: `Bearer ${accessToken}` };
+}
+async function driveFailure(res, what) {
+  return googleApiFailure(what, await readGoogleApiError(res));
+}
+function escapeDriveQueryValue(value) {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+async function refreshAccessToken(fetchImpl, params) {
+  const res = await driveFetch(fetchImpl, TOKEN_ENDPOINT2, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: params.refreshToken,
+      client_id: params.clientId,
+      client_secret: params.clientSecret
+    }).toString()
+  }, TOKEN_REFRESH_TIMEOUT_MS);
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.access_token) {
+    if (body.error === "invalid_grant")
+      throw new Error(RECONNECT_MESSAGE);
+    throw new FriendlyHttpError(`Google rejected the Drive connection (HTTP ${res.status}${body.error ? `: ${body.error}` : ""}). ${RECONNECT_MESSAGE}`);
+  }
+  return { accessToken: body.access_token, expiresIn: body.expires_in ?? 3600 };
+}
+async function driveAbout(fetchImpl, accessToken) {
+  const res = await driveFetch(fetchImpl, `${DRIVE_API_BASE}/about?fields=user(emailAddress),storageQuota`, {
+    method: "GET",
+    headers: authHeaders(accessToken)
+  });
+  if (!res.ok)
+    throw await driveFailure(res, "Couldn't read your Google Drive account info");
+  const body = await res.json();
+  const limit = body.storageQuota?.limit != null ? Number(body.storageQuota.limit) : null;
+  const usage = Number(body.storageQuota?.usage ?? 0);
+  return {
+    email: body.user?.emailAddress,
+    quota: {
+      limitBytes: limit,
+      usageBytes: usage,
+      freeBytes: limit != null ? Math.max(0, limit - usage) : null
+    }
+  };
+}
+var FOLDER_MIME = "application/vnd.google-apps.folder";
+async function listFolders(fetchImpl, accessToken) {
+  const q = `mimeType='${FOLDER_MIME}' and trashed=false`;
+  const all = [];
+  let pageToken;
+  do {
+    const params = new URLSearchParams({
+      q,
+      fields: "nextPageToken,files(id,name)",
+      orderBy: "modifiedTime desc",
+      pageSize: "100"
+    });
+    if (pageToken)
+      params.set("pageToken", pageToken);
+    const res = await driveFetch(fetchImpl, `${DRIVE_API_BASE}/files?${params.toString()}`, {
+      method: "GET",
+      headers: authHeaders(accessToken)
+    });
+    if (!res.ok)
+      throw await driveFailure(res, "Couldn't list Google Drive folders");
+    const body = await res.json();
+    all.push(...body.files ?? []);
+    pageToken = body.nextPageToken;
+  } while (pageToken);
+  return all;
+}
+async function getFolderById(fetchImpl, accessToken, folderId) {
+  const res = await driveFetch(fetchImpl, `${DRIVE_API_BASE}/files/${encodeURIComponent(folderId)}?fields=id,name,trashed,mimeType`, {
+    method: "GET",
+    headers: authHeaders(accessToken)
+  });
+  if (res.status === 404)
+    return null;
+  if (!res.ok)
+    throw await driveFailure(res, "Couldn't look up the Google Drive folder");
+  const body = await res.json();
+  if (body.trashed || body.mimeType !== FOLDER_MIME)
+    return null;
+  return { id: body.id, name: body.name };
+}
+async function createFolder(fetchImpl, accessToken, name) {
+  const res = await driveFetch(fetchImpl, `${DRIVE_API_BASE}/files?fields=id,name`, {
+    method: "POST",
+    headers: { ...authHeaders(accessToken), "Content-Type": "application/json" },
+    body: JSON.stringify({ name, mimeType: FOLDER_MIME })
+  });
+  if (!res.ok)
+    throw await driveFailure(res, `Couldn't create the Google Drive folder "${name}"`);
+  return await res.json();
+}
+async function findFolderByName(fetchImpl, accessToken, name) {
+  const q = `name='${escapeDriveQueryValue(name)}' and mimeType='${FOLDER_MIME}' and trashed=false`;
+  const params = new URLSearchParams({
+    q,
+    fields: "files(id,name)",
+    orderBy: "modifiedTime desc",
+    pageSize: "1"
+  });
+  const res = await driveFetch(fetchImpl, `${DRIVE_API_BASE}/files?${params.toString()}`, {
+    method: "GET",
+    headers: authHeaders(accessToken)
+  });
+  if (!res.ok)
+    throw await driveFailure(res, `Couldn't look up the Google Drive folder "${name}"`);
+  const body = await res.json();
+  return body.files?.[0] ?? null;
+}
+async function ensureFolder(fetchImpl, accessToken, name) {
+  const found = await findFolderByName(fetchImpl, accessToken, name);
+  if (found)
+    return found;
+  return createFolder(fetchImpl, accessToken, name);
+}
+async function findFileInFolder(fetchImpl, accessToken, folderId, name) {
+  const q = `name='${escapeDriveQueryValue(name)}' and '${escapeDriveQueryValue(folderId)}' in parents and trashed=false`;
+  const res = await driveFetch(fetchImpl, `${DRIVE_API_BASE}/files?q=${encodeURIComponent(q)}&fields=files(id,name,webViewLink)&pageSize=1`, { method: "GET", headers: authHeaders(accessToken) });
+  if (!res.ok)
+    throw await driveFailure(res, "Couldn't search the Google Drive folder");
+  const body = await res.json();
+  return body.files?.[0] ?? null;
+}
+var RESUMABLE_CHUNK_SIZE = 8 * 1024 * 1024;
+var MAX_CHUNK_RETRIES = 3;
+var RETRY_BASE_DELAY_MS = 500;
+function defaultSleep3(ms) {
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
+}
+async function startResumableSession(fetchImpl, accessToken, opts) {
+  const mimeType = opts.mimeType ?? "application/pdf";
+  const url = opts.fileId ? `${DRIVE_UPLOAD_BASE}/${encodeURIComponent(opts.fileId)}?uploadType=resumable&fields=id,name,webViewLink` : `${DRIVE_UPLOAD_BASE}?uploadType=resumable&fields=id,name,webViewLink`;
+  const res = await driveFetch(fetchImpl, url, {
+    method: opts.fileId ? "PATCH" : "POST",
+    headers: {
+      ...authHeaders(accessToken),
+      "Content-Type": "application/json; charset=UTF-8",
+      "X-Upload-Content-Type": mimeType,
+      "X-Upload-Content-Length": String(opts.totalBytes)
+    },
+    body: JSON.stringify(opts.fileId ? {} : { name: opts.name, parents: opts.parentFolderId ? [opts.parentFolderId] : undefined })
+  });
+  const session = res.headers.get("location");
+  if (!res.ok || !session)
+    throw await driveFailure(res, "Couldn't start the Google Drive upload");
+  return session;
+}
+async function queryUploadStatus(fetchImpl, sessionUrl, total) {
+  let res;
+  try {
+    res = await driveFetch(fetchImpl, sessionUrl, { method: "PUT", headers: { "Content-Range": `bytes */${total}` } }, CHUNK_TIMEOUT_MS);
+  } catch {
+    return null;
+  }
+  if (res.status === 308) {
+    const range = res.headers.get("range");
+    return { kind: "progress", receivedBytes: range ? Number(range.split("-")[1]) + 1 : 0 };
+  }
+  if (res.status === 200 || res.status === 201) {
+    return { kind: "done", file: await res.json() };
+  }
+  return null;
+}
+async function putChunkWithRetry(fetchImpl, sessionUrl, buf, start, total, maxRetries, sleep) {
+  let attempt = 0;
+  for (;; ) {
+    let res;
+    try {
+      res = await driveFetch(fetchImpl, sessionUrl, {
+        method: "PUT",
+        headers: {
+          "Content-Range": `bytes ${start}-${start + buf.length - 1}/${total}`,
+          "Content-Length": String(buf.length)
+        },
+        body: buf
+      }, CHUNK_TIMEOUT_MS);
+    } catch (e) {
+      if (attempt >= maxRetries)
+        throw e;
+      attempt++;
+      const status = await queryUploadStatus(fetchImpl, sessionUrl, total);
+      if (status?.kind === "done")
+        return { done: true, file: status.file };
+      if (status?.kind === "progress" && status.receivedBytes > start) {
+        const chunkEnd = start + buf.length;
+        if (status.receivedBytes >= chunkEnd) {
+          return { done: false, nextOffset: status.receivedBytes };
+        }
+        buf = buf.subarray(status.receivedBytes - start);
+        start = status.receivedBytes;
+      }
+      await sleep(RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
+      continue;
+    }
+    if (res.status === 308) {
+      const range = res.headers.get("range");
+      const nextOffset = range ? Number(range.split("-")[1]) + 1 : start + buf.length;
+      return { done: false, nextOffset };
+    }
+    if (res.status === 200 || res.status === 201) {
+      return { done: true, file: await res.json() };
+    }
+    if ((res.status === 429 || res.status >= 500) && attempt < maxRetries) {
+      attempt++;
+      const retryAfter = res.headers.get("retry-after");
+      const delayMs = retryAfter ? Number(retryAfter) * 1000 : RETRY_BASE_DELAY_MS * 2 ** (attempt - 1);
+      await sleep(Number.isFinite(delayMs) && delayMs > 0 ? delayMs : RETRY_BASE_DELAY_MS);
+      continue;
+    }
+    throw await driveFailure(res, "Google Drive upload failed");
+  }
+}
+async function resumableUpload(fetchImpl, accessToken, opts) {
+  const chunkSize = opts.chunkSize ?? RESUMABLE_CHUNK_SIZE;
+  const maxRetries = opts.maxRetriesPerChunk ?? MAX_CHUNK_RETRIES;
+  const sleep = opts.sleepImpl ?? defaultSleep3;
+  const sessionUrl = await startResumableSession(fetchImpl, accessToken, opts);
+  const fh = await open3(opts.filePath, "r");
+  try {
+    let offset = 0;
+    for (;; ) {
+      const len = Math.min(chunkSize, opts.totalBytes - offset);
+      const buf = Buffer.allocUnsafe(len);
+      const { bytesRead } = await fh.read(buf, 0, len, offset);
+      if (bytesRead !== len) {
+        throw new FriendlyHttpError(`Couldn't read "${opts.filePath}" while uploading to Google Drive: expected ${len} bytes at offset ${offset} but only read ${bytesRead}. The file may have changed on disk during publish.`);
+      }
+      const result = await putChunkWithRetry(fetchImpl, sessionUrl, buf, offset, opts.totalBytes, maxRetries, sleep);
+      if (result.done) {
+        opts.onProgress?.(opts.totalBytes, opts.totalBytes);
+        return result.file;
+      }
+      offset = result.nextOffset;
+      opts.onProgress?.(Math.min(offset, opts.totalBytes), opts.totalBytes);
+      if (offset >= opts.totalBytes) {
+        throw new FriendlyHttpError("Google Drive accepted every byte but never confirmed the upload. Try publishing again.");
+      }
+    }
+  } finally {
+    await fh.close();
+  }
+}
+
+// src/lib/publish/providers/gdrive.ts
+var DEFAULT_FOLDER_NAME = "Gutterpress";
+var NOT_CONNECTED_MESSAGE = "Google Drive isn't connected. Run `gutterpress publish --provider gdrive --connect` (or set GDRIVE_REFRESH_TOKEN) first.";
+var info4 = {
+  id: "gdrive",
+  label: "Google Drive",
+  kind: "api",
+  format: "pdf",
+  formats: ["pdf", "html"],
+  description: "Upload the finished PDF (or the website export, zipped) to a folder in your Google Drive — publishing again updates the same file, so shared links stay current. Drive delivers files, not live websites; use Azure Static Web Apps to publish the HTML export as a site.",
+  configFields: [{ key: "folder", label: "Drive folder", placeholder: DEFAULT_FOLDER_NAME }],
+  credential: {
+    required: true,
+    host: GDRIVE_HOST,
+    envVar: "GDRIVE_REFRESH_TOKEN",
+    connect: "oauth",
+    hint: "Click Connect Google Drive and approve in your browser — nothing to paste."
+  },
+  destinations: { label: "Folder", canCreate: true }
+};
+function readConfig(req) {
+  const cfg = req.config;
+  return {
+    folder: cfg.folder?.trim() || undefined,
+    folderId: cfg.folderId?.trim() || undefined
+  };
+}
+function formatBytes(bytes) {
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function mintAccessToken(resolved, fetchImpl) {
+  const { clientId, clientSecret } = requireGoogleClientCredentials();
+  const { accessToken } = await refreshAccessToken(fetchImpl, {
+    clientId,
+    clientSecret,
+    refreshToken: resolved.credential.token
+  });
+  return accessToken;
+}
+async function getAccessToken(req) {
+  const resolved = await resolvePublishCredential(info4, req.deps);
+  if (!resolved)
+    throw new Error(NOT_CONNECTED_MESSAGE);
+  const accessToken = await mintAccessToken(resolved, req.deps.fetch ?? globalThis.fetch);
+  return { accessToken, source: resolved.source };
+}
+async function resolveFolder(fetchImpl, accessToken, cfg) {
+  if (cfg.folderId) {
+    const folder = await getFolderById(fetchImpl, accessToken, cfg.folderId);
+    if (!folder) {
+      throw new Error(`The Drive folder recorded in publish.gdrive.folderId ("${cfg.folderId}") can't be found — it may have been trashed or the id copied wrong. Pick the folder again.`);
+    }
+    return folder;
+  }
+  return ensureFolder(fetchImpl, accessToken, cfg.folder || DEFAULT_FOLDER_NAME);
+}
+function folderUrl(id) {
+  return `https://drive.google.com/drive/folders/${id}`;
+}
+function toDestination(folder) {
+  return { id: folder.id, title: folder.name, url: folderUrl(folder.id) };
+}
+var ZIP_CHUNK_BYTES = 64 * 1024;
+function yieldToEventLoop() {
+  return new Promise((resolve9) => setImmediate(resolve9));
+}
+function zipEntriesNonBlocking(entries, opts) {
+  return new Promise((resolve9, reject) => {
+    const chunks = [];
+    let total = 0;
+    let settled = false;
+    const archive = new Zip((err, chunk2, final) => {
+      if (settled)
+        return;
+      if (err) {
+        settled = true;
+        reject(err);
+        return;
+      }
+      if (chunk2) {
+        chunks.push(chunk2);
+        total += chunk2.length;
+      }
+      if (final) {
+        settled = true;
+        const out = new Uint8Array(total);
+        let offset = 0;
+        for (const c of chunks) {
+          out.set(c, offset);
+          offset += c.length;
+        }
+        resolve9(out);
+      }
+    });
+    (async () => {
+      for (const [name, data] of Object.entries(entries)) {
+        const stream = new ZipDeflate(name, opts);
+        archive.add(stream);
+        if (data.length === 0) {
+          stream.push(new Uint8Array(0), true);
+          continue;
+        }
+        for (let offset = 0;offset < data.length; offset += ZIP_CHUNK_BYTES) {
+          const end = Math.min(offset + ZIP_CHUNK_BYTES, data.length);
+          stream.push(data.subarray(offset, end), end >= data.length);
+          await yieldToEventLoop();
+        }
+      }
+      archive.end();
+    })().catch((e) => {
+      if (!settled) {
+        settled = true;
+        reject(e instanceof Error ? e : new Error(String(e)));
+      }
+    });
+  });
+}
+async function collectZipEntries(root, dir, out, onWarn) {
+  const entries = await readdir11(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = path25.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      await collectZipEntries(root, full, out, onWarn);
+    } else if (entry.isFile()) {
+      const rel = path25.relative(root, full).split(path25.sep).join("/");
+      out[rel] = await readFile31(full);
+    } else if (entry.isSymbolicLink()) {
+      const resolved = await stat9(full).catch(() => null);
+      if (resolved?.isFile()) {
+        const rel = path25.relative(root, full).split(path25.sep).join("/");
+        out[rel] = await readFile31(full);
+      } else if (resolved?.isDirectory()) {
+        await collectZipEntries(root, full, out, onWarn);
+      } else {
+        onWarn?.(`Skipped "${path25.relative(root, full)}" in the website export — it's a broken symlink.`);
+      }
+    } else {
+      onWarn?.(`Skipped "${path25.relative(root, full)}" in the website export — not a file, folder, or symlink.`);
+    }
+  }
+}
+async function zipHtmlExport(exportDir, title, onWarn, writeArchiveImpl = writeFile14) {
+  const entries = {};
+  await collectZipEntries(exportDir, exportDir, entries, onWarn);
+  const fileName = `${bookSlug(title)}-website.zip`;
+  const tmpRoot = await mkdtemp4(path25.join(tmpdir4(), "gutterpress-gdrive-"));
+  try {
+    const filePath = path25.join(tmpRoot, fileName);
+    const zipped = await zipEntriesNonBlocking(entries, { level: 6 });
+    await writeArchiveImpl(filePath, zipped);
+    return {
+      filePath,
+      fileName,
+      mimeType: "application/zip",
+      cleanup: () => rm9(tmpRoot, { recursive: true, force: true })
+    };
+  } catch (e) {
+    await rm9(tmpRoot, { recursive: true, force: true }).catch(() => {});
+    throw e;
+  }
+}
+var gdriveProvider = {
+  info: info4,
+  async authenticate(req) {
+    const resolved = await resolvePublishCredential(info4, req.deps);
+    if (!resolved)
+      return { ok: false, message: NOT_CONNECTED_MESSAGE };
+    try {
+      const accessToken = await mintAccessToken(resolved, req.deps.fetch ?? globalThis.fetch);
+      await driveAbout(req.deps.fetch ?? globalThis.fetch, accessToken);
+      return { ok: true, source: resolved.source };
+    } catch (e) {
+      return { ok: false, source: resolved.source, message: e instanceof Error ? e.message : String(e) };
+    }
+  },
+  async preflight(_req) {
+    return [];
+  },
+  async listDestinations(req) {
+    const { accessToken } = await getAccessToken(req);
+    const folders = await listFolders(req.deps.fetch ?? globalThis.fetch, accessToken);
+    return folders.map(toDestination);
+  },
+  async createDestination(req, name) {
+    const { accessToken } = await getAccessToken(req);
+    const folder = await createFolder(req.deps.fetch ?? globalThis.fetch, accessToken, name);
+    return toDestination(folder);
+  },
+  async upload(req) {
+    const fetchImpl = req.deps.fetch ?? globalThis.fetch;
+    const cfg = readConfig(req);
+    const { accessToken } = await getAccessToken(req);
+    const isHtml = req.artifact.format === "html";
+    const source = isHtml ? await zipHtmlExport(req.artifact.path, req.project.title, (msg) => req.deps.onProgress?.(msg)) : {
+      filePath: req.artifact.path,
+      fileName: path25.basename(req.artifact.path),
+      mimeType: "application/pdf",
+      cleanup: async () => {}
+    };
+    try {
+      const artifactStat = await stat9(source.filePath);
+      const about = await driveAbout(fetchImpl, accessToken);
+      if (about.quota.limitBytes != null && about.quota.freeBytes != null) {
+        if (artifactStat.size > about.quota.freeBytes) {
+          throw new Error(`Your Google Drive is full — this ${isHtml ? "website export" : "PDF"} needs ${formatBytes(artifactStat.size)} but only ${formatBytes(about.quota.freeBytes)} is free.`);
+        }
+      }
+      req.deps.onProgress?.("Resolving the Drive folder…");
+      const folder = await resolveFolder(fetchImpl, accessToken, cfg);
+      const fileName = source.fileName;
+      const existing = await findFileInFolder(fetchImpl, accessToken, folder.id, fileName);
+      req.deps.onProgress?.(existing ? `Updating "${fileName}" in "${folder.name}"…` : `Uploading "${fileName}" to "${folder.name}"…`);
+      let lastReported = -1;
+      const file = await resumableUpload(fetchImpl, accessToken, {
+        ...existing ? { fileId: existing.id } : {},
+        name: fileName,
+        parentFolderId: folder.id,
+        filePath: source.filePath,
+        totalBytes: artifactStat.size,
+        mimeType: source.mimeType,
+        onProgress: (uploaded, total) => {
+          const pct = total > 0 ? Math.floor(uploaded / total * 100) : 100;
+          if (pct !== lastReported) {
+            lastReported = pct;
+            req.deps.onProgress?.(`Uploaded ${formatBytes(uploaded)} of ${formatBytes(total)} (${pct}%)…`);
+          }
+        }
+      });
+      return {
+        kind: "published",
+        url: file.webViewLink,
+        detail: `Uploaded "${fileName}" to the "${folder.name}" folder in your Google Drive${existing ? " (updated the existing file)" : ""}.`,
+        followUp: [
+          "To share it, open it in Drive and use the Share button — Gutterpress never changes who can see your files.",
+          isHtml ? "Google Drive stores files, not live websites — download and unzip it to view the export, or publish it as a real site with the Azure Static Web Apps provider." : undefined,
+          cfg.folderId ? undefined : `Tip (CLI): record the folder id in the manifest (publish.gdrive.folderId: "${folder.id}") so renaming the folder in Drive can never break publishing.`
+        ].filter((s) => !!s)
+      };
+    } finally {
+      await source.cleanup();
+    }
+  }
+};
+
+// src/lib/publish/butler.ts
+import { chmod as chmod2, mkdir as mkdir17, stat as stat10, writeFile as writeFile15 } from "node:fs/promises";
+import path26 from "node:path";
 import { unzipSync as unzipSync2 } from "fflate";
 var BUTLER_DOWNLOAD_TIMEOUT_MS = 300000;
 function butlerBrothChannel(platform2 = process.platform, arch2 = process.arch) {
@@ -13641,7 +14470,7 @@ function butlerBinaryName(platform2 = process.platform) {
 }
 async function fileExists2(p) {
   try {
-    return (await stat9(p)).isFile();
+    return (await stat10(p)).isFile();
   } catch {
     return false;
   }
@@ -13658,8 +14487,8 @@ async function ensureButler(deps) {
   }
   if (await commandExists("butler", runCommand, deps.env))
     return "butler";
-  const cacheDir = path25.join(deps.configDir ?? defaultConfigDir(), "tools", "butler");
-  const cached = path25.join(cacheDir, butlerBinaryName());
+  const cacheDir = path26.join(deps.configDir ?? defaultConfigDir(), "tools", "butler");
+  const cached = path26.join(cacheDir, butlerBinaryName());
   if (await fileExists2(cached))
     return cached;
   const channel = butlerBrothChannel();
@@ -13686,9 +14515,9 @@ async function ensureButler(deps) {
   for (const [name, data] of Object.entries(files)) {
     if (name.endsWith("/"))
       continue;
-    const target = path25.join(cacheDir, path25.basename(name));
-    await writeFile14(target, data);
-    if (path25.basename(name) === butlerBinaryName()) {
+    const target = path26.join(cacheDir, path26.basename(name));
+    await writeFile15(target, data);
+    if (path26.basename(name) === butlerBinaryName()) {
       await chmod2(target, 493).catch(() => {});
       foundBinary = true;
     }
@@ -13704,7 +14533,7 @@ async function ensureButler(deps) {
 var ITCH_HOST = "itch.io";
 var TARGET_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 var ITCH_API_TIMEOUT_MS = 15000;
-var info4 = {
+var info5 = {
   id: "itch",
   label: "itch.io",
   kind: "api",
@@ -13722,7 +14551,7 @@ var info4 = {
     hint: "Create an API key under itch.io → Settings → API keys, then paste it here."
   }
 };
-function readConfig(req) {
+function readConfig2(req) {
   const cfg = req.config;
   return {
     target: (cfg.target ?? "").trim(),
@@ -13734,9 +14563,9 @@ function itchProjectUrl(target) {
   return `https://${user}.itch.io/${game}`;
 }
 var itchProvider = {
-  info: info4,
+  info: info5,
   async authenticate(req) {
-    const resolved = await resolvePublishCredential(info4, req.deps);
+    const resolved = await resolvePublishCredential(info5, req.deps);
     if (!resolved) {
       return {
         ok: false,
@@ -13779,7 +14608,7 @@ var itchProvider = {
   },
   async preflight(req) {
     const issues = [];
-    const { target, channel } = readConfig(req);
+    const { target, channel } = readConfig2(req);
     if (!target) {
       issues.push({
         severity: "error",
@@ -13803,8 +14632,8 @@ var itchProvider = {
     return issues;
   },
   async upload(req) {
-    const { target, channel } = readConfig(req);
-    const resolved = await resolvePublishCredential(info4, req.deps);
+    const { target, channel } = readConfig2(req);
+    const resolved = await resolvePublishCredential(info5, req.deps);
     if (!resolved) {
       throw new Error("No itch.io API key found. Connect itch.io (or set BUTLER_API_KEY) first.");
     }
@@ -13832,7 +14661,7 @@ ${tail}` : ""}`);
 
 // src/lib/publish/providers/kdp.ts
 var KDP_URL = "https://kdp.amazon.com/en_US/bookshelf";
-var info5 = {
+var info6 = {
   id: "kdp",
   label: "Amazon KDP",
   kind: "guided",
@@ -13842,7 +14671,7 @@ var info5 = {
   credential: { required: false, host: "kdp.amazon.com" }
 };
 var kdpProvider = {
-  info: info5,
+  info: info6,
   async authenticate() {
     return { ok: true };
   },
@@ -13897,7 +14726,7 @@ function requireValidShop(shop) {
   }
   return shop;
 }
-var info6 = {
+var info7 = {
   id: "shopify",
   label: "Shopify",
   kind: "api",
@@ -13920,7 +14749,7 @@ var info6 = {
     hint: "Create a custom app in Shopify admin (Settings → Apps → Develop apps) with write_products scope, then paste its Admin API access token."
   }
 };
-function readConfig2(req) {
+function readConfig3(req) {
   const cfg = req.config;
   return {
     shop: (cfg.shop ?? "").trim().toLowerCase(),
@@ -13929,9 +14758,9 @@ function readConfig2(req) {
   };
 }
 async function adminGraphQL(req, query, variables = {}) {
-  const { shop: rawShop, apiVersion } = readConfig2(req);
+  const { shop: rawShop, apiVersion } = readConfig3(req);
   const shop = requireValidShop(rawShop);
-  const resolved = await resolvePublishCredential(info6, req.deps);
+  const resolved = await resolvePublishCredential(info7, req.deps);
   if (!resolved) {
     throw new Error("No Shopify access token found. Connect Shopify (or set SHOPIFY_ADMIN_TOKEN) first.");
   }
@@ -13982,9 +14811,9 @@ function userErrorsToMessage(result) {
   return errs?.length ? errs[0].message : null;
 }
 var shopifyProvider = {
-  info: info6,
+  info: info7,
   async authenticate(req) {
-    const resolved = await resolvePublishCredential(info6, req.deps);
+    const resolved = await resolvePublishCredential(info7, req.deps);
     if (!resolved) {
       return {
         ok: false,
@@ -14004,7 +14833,7 @@ var shopifyProvider = {
   },
   async preflight(req) {
     const issues = [];
-    const { shop } = readConfig2(req);
+    const { shop } = readConfig3(req);
     if (!shop) {
       issues.push({
         severity: "error",
@@ -14028,13 +14857,13 @@ var shopifyProvider = {
     return issues;
   },
   async listProducts(req) {
-    const { shop } = readConfig2(req);
+    const { shop } = readConfig3(req);
     const data = await adminGraphQL(req, `{ products(first: 25, sortKey: UPDATED_AT, reverse: true) { nodes { ${PRODUCT_FIELDS} } } }`);
     const nodes = data.products?.nodes ?? [];
     return nodes.map((n) => toProduct(shop, n));
   },
   async updateListing(req, productId, metadata) {
-    const { shop } = readConfig2(req);
+    const { shop } = readConfig3(req);
     const data = await adminGraphQL(req, `mutation($product: ProductUpdateInput!) {
         productUpdate(product: $product) {
           product { ${PRODUCT_FIELDS} }
@@ -14055,7 +14884,7 @@ var shopifyProvider = {
     return toProduct(shop, result.product);
   },
   async upload(req) {
-    const { shop, productId } = readConfig2(req);
+    const { shop, productId } = readConfig3(req);
     const title = req.project.title || "Untitled";
     let product;
     if (productId) {
@@ -14101,7 +14930,8 @@ var PROVIDERS = {
   drivethrurpg: drivethrurpgProvider,
   kdp: kdpProvider,
   "azure-swa": azureSwaProvider,
-  shopify: shopifyProvider
+  shopify: shopifyProvider,
+  gdrive: gdriveProvider
 };
 function listPublishProviders() {
   return Object.values(PROVIDERS).map((p) => p.info);
@@ -14116,6 +14946,15 @@ function publishProviderFor(id) {
 }
 
 // src/lib/publish/run-publish.ts
+function resolvePublishFormat(info8, providerConfig) {
+  if (info8.formats && info8.formats.length > 0) {
+    const configured = typeof providerConfig.format === "string" ? providerConfig.format.trim() : "";
+    if (configured && info8.formats.includes(configured)) {
+      return configured;
+    }
+  }
+  return info8.format;
+}
 async function resolvePublishRequest(options, deps) {
   const provider = publishProviderFor(options.providerId);
   const { manifest, manifestDir } = await loadManifestWithPath(options.manifestPath ?? options.projectDir, { explicit: options.manifestPath !== undefined });
@@ -14126,10 +14965,11 @@ async function resolvePublishRequest(options, deps) {
   const effectiveAccount = bookAccount || deps.credentialAccount;
   const effectiveDeps = effectiveAccount ? { ...deps, credentialAccount: effectiveAccount } : deps;
   const outDir = resolveOutputDir(manifestDir, config.title);
-  const defaultArtifact = provider.info.format === "pdf" ? path26.join(outDir, artifactName(config.title, "pdf")) : outDir;
+  const effectiveFormat = resolvePublishFormat(provider.info, providerConfig);
+  const defaultArtifact = effectiveFormat === "pdf" ? path27.join(outDir, artifactName(config.title, "pdf")) : outDir;
   const artifact = {
-    path: options.artifactPath ? path26.resolve(options.projectDir, options.artifactPath) : defaultArtifact,
-    format: provider.info.format
+    path: options.artifactPath ? path27.resolve(options.projectDir, options.artifactPath) : defaultArtifact,
+    format: effectiveFormat
   };
   return {
     project: {
@@ -14146,7 +14986,7 @@ var PDF_HINT = "Build the PDF first (gutterpress build, or export it from the ap
 var HTML_HINT = "Build the website export first (gutterpress build --format html).";
 async function artifactIssues(artifact) {
   try {
-    const s = await stat10(artifact.path);
+    const s = await stat11(artifact.path);
     if (artifact.format === "pdf" && !s.isFile()) {
       return [
         {
@@ -14192,7 +15032,7 @@ async function artifactIssues(artifact) {
 var BUILD_FINGERPRINT_FILENAME = "build-fingerprint.json";
 async function htmlDirIssues(dir) {
   const issues = [];
-  const isThere = async (rel) => stat10(path26.join(dir, rel)).then(() => true, () => false);
+  const isThere = async (rel) => stat11(path27.join(dir, rel)).then(() => true, () => false);
   if (!await isThere(BOOK_HTML)) {
     issues.push({
       severity: "error",
@@ -14200,13 +15040,13 @@ async function htmlDirIssues(dir) {
       message: `${dir} has no ${BOOK_HTML} — it isn't an HTML export. ${HTML_HINT}`
     });
   }
-  const entries = await readdir11(dir).catch(() => []);
+  const entries = await readdir12(dir).catch(() => []);
   const extras = entries.filter((name) => name.toLowerCase().endsWith(".pdf") || name === BUILD_FINGERPRINT_FILENAME);
   if (extras.length > 0) {
     issues.push({
       severity: "warning",
       id: "publish/html-dir-extras",
-      message: `${dir} also contains ${extras.join(" and ")} — everything in the folder is deployed and becomes publicly downloadable. ` + "Use a dedicated output folder for the website (gutterpress build --format html --out <dir>) if that isn't intended."
+      message: `${dir} also contains ${extras.join(" and ")} — everything in the folder gets bundled and published along with the website. ` + "Use a dedicated output folder for the website (gutterpress build --format html --out <dir>) if that isn't intended."
     });
   }
   return issues;
@@ -14262,14 +15102,17 @@ function overlayStore(inner, key, candidate) {
 }
 async function connectPublishProvider(options, deps) {
   const provider = publishProviderFor(options.providerId);
-  const info7 = provider.info;
-  if (!info7.credential.required) {
-    throw new Error(`${info7.label} needs no API key — just publish when you're ready.`);
+  const info8 = provider.info;
+  if (!info8.credential.required) {
+    throw new Error(`${info8.label} needs no API key — just publish when you're ready.`);
+  }
+  if (info8.credential.connect === "oauth") {
+    throw new Error(`${info8.label} connects through your browser, not a pasted key — run ` + `"gutterpress publish --provider ${info8.id} --connect" or use the desktop app's Connect button.`);
   }
   const token = options.token.trim();
   if (!token)
     throw new Error("Paste an API key first.");
-  const host = info7.credential.host;
+  const host = info8.credential.host;
   const account = (options.account ?? "").trim();
   const key = publishCredentialKey(host, account);
   const candidate = {
@@ -14277,12 +15120,12 @@ async function connectPublishProvider(options, deps) {
     kind: "token",
     token,
     ...account ? { username: account } : {},
-    label: account || info7.label,
+    label: account || info8.label,
     createdAt: Date.now()
   };
   const req = await resolvePublishRequest({
     projectDir: options.projectDir,
-    providerId: info7.id,
+    providerId: info8.id,
     ...options.manifestPath ? { manifestPath: options.manifestPath } : {}
   }, deps);
   const trialDeps = {
@@ -14293,23 +15136,32 @@ async function connectPublishProvider(options, deps) {
   };
   const auth = await provider.authenticate({ ...req, deps: trialDeps });
   if (!auth.ok) {
-    throw new Error(auth.message ?? `${info7.label} didn't accept that key.`);
+    throw new Error(auth.message ?? `${info8.label} didn't accept that key.`);
   }
   await deps.tokenStore.set(key, candidate);
-  return { connected: true, providerId: info7.id };
+  return { connected: true, providerId: info8.id };
+}
+async function disconnectPublishCredential(key, deps, options = {}) {
+  const existing = await deps.tokenStore.get(key);
+  await deps.tokenStore.delete(key);
+  if (existing?.kind === "google-oauth") {
+    const revoke = revokeGoogleCredential(existing.token, { fetchImpl: deps.fetch });
+    if (options.awaitRevoke)
+      await revoke;
+  }
 }
 // src/lib/publish/selections.ts
-import { chmod as chmod3, mkdir as mkdir18, readFile as readFile31, writeFile as writeFile15 } from "node:fs/promises";
-import path27 from "node:path";
+import { chmod as chmod3, mkdir as mkdir18, readFile as readFile32, writeFile as writeFile16 } from "node:fs/promises";
+import path28 from "node:path";
 class PublishSelectionsStore {
   filePath;
   queue = Promise.resolve();
   constructor(filePath) {
-    this.filePath = filePath ?? path27.join(defaultConfigDir(), "publish-selections.json");
+    this.filePath = filePath ?? path28.join(defaultConfigDir(), "publish-selections.json");
   }
   async read() {
     try {
-      const raw = await readFile31(this.filePath, "utf8");
+      const raw = await readFile32(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed === "object") {
         return {
@@ -14322,8 +15174,8 @@ class PublishSelectionsStore {
     return { version: 1, global: {}, projects: {} };
   }
   async write(data) {
-    await mkdir18(path27.dirname(this.filePath), { recursive: true });
-    await writeFile15(this.filePath, JSON.stringify(data, null, 2), {
+    await mkdir18(path28.dirname(this.filePath), { recursive: true });
+    await writeFile16(this.filePath, JSON.stringify(data, null, 2), {
       encoding: "utf8",
       mode: 384
     });
@@ -14425,4 +15277,4 @@ async function setPublishProviderConfig(projectDir, providerId, values) {
   await writeManifestDoc(file, doc);
   return settingsFromDoc(doc);
 }
-export { PRESET_IDS, PRESETS, TARGETS, TARGET_IDS, publishTargetFor, MANIFEST_FILENAMES, hasProjectManifest, loadManifest, loadManifestWithPath, resolveConfig, SYNC_SNAPSHOT_MESSAGE, log, resolveActiveStyles, listProjectStyles, PLUGINS_DIR, ruleRemoteUrls, ruleRiskyProps, ruleSyntax, checkCss, runLint, formatReport, getChecks, getCheckById, resolveCheckSelectors, inspectImage, runChecks, checkToolAvailability, reportMissingTools, executeValidation, executeAndReport, splitOutPath, runBuild, openPath, startPreviewServer, defaultConfigDir, FileTokenStore, extractUrlCredential, getSystemDiagnostics, slugifyProjectName, escapeYamlScalar, scaffoldProject, adoptFolder, BUILT_IN_TEMPLATE_IDS, listBuiltInTemplates, saveProjectAsTemplate, listCustomTemplates, importTemplateFromFolder, SNIPPETS_DIR, extractVariables, substituteVariables, listSnippets, readSnippet, saveSnippet, deleteSnippet, RECOMMENDED_PLUGINS, listProjectPlugins, setPluginEnabled, addNpmPlugin, addLocalPlugin, validateProjectPlugins, THEMES_DIR, BUILT_IN_THEME_IDS, listBuiltInThemes, resolveBuiltInTheme, listProjectThemes, getActiveTheme, getPreviousTheme, revertTheme, applyTheme, importThemeFromFolder, importThemeFromUrl, readThemeCss, removeProjectTheme, importThemeFromFile, setManifestFields, readManifestFields, setActiveStyles, AUTO_SNAPSHOT_MIN_MINUTES, AUTO_SNAPSHOT_MAX_MINUTES, AUTO_SNAPSHOT_DEFAULT_MINUTES, AUTO_SYNC_MIN_MINUTES, AUTO_SYNC_MAX_MINUTES, AUTO_SYNC_DEFAULT_MINUTES, AUTO_SYNC_PUSH_INTERVAL_MINUTES, autoSnapshotDelayMs, autoSyncDelayMs, isGitInternalPath, resolveGitHubClientId, GITHUB_HOST, GitHubAuthProvider, listGitHubRepositories, listRepoBooks, listGitHubBranches, sanitizeCloneFolderName, cloneRepository, isSshRemoteUrl, testRemoteAccess, knownForgeTokenUrl, connectGenericHost, parseRemoteOrigin, forgeKindForHost, diagnoseProjectRemote, syncProject, publishCredentialKey, publishConnectionStatus, listPublishAccounts, listPublishProviders, publishProviderFor, resolvePublishRequest, runPublish, connectPublishProvider, PublishSelectionsStore, readPublishSettings, setPublishProviderConfig };
+export { PRESET_IDS, PRESETS, TARGETS, TARGET_IDS, publishTargetFor, MANIFEST_FILENAMES, hasProjectManifest, loadManifest, loadManifestWithPath, resolveConfig, SYNC_SNAPSHOT_MESSAGE, log, resolveActiveStyles, listProjectStyles, PLUGINS_DIR, ruleRemoteUrls, ruleRiskyProps, ruleSyntax, checkCss, runLint, formatReport, getChecks, getCheckById, resolveCheckSelectors, inspectImage, runChecks, checkToolAvailability, reportMissingTools, executeValidation, executeAndReport, splitOutPath, runBuild, openPath, startPreviewServer, defaultConfigDir, FileTokenStore, extractUrlCredential, getSystemDiagnostics, slugifyProjectName, escapeYamlScalar, scaffoldProject, adoptFolder, BUILT_IN_TEMPLATE_IDS, listBuiltInTemplates, saveProjectAsTemplate, listCustomTemplates, importTemplateFromFolder, SNIPPETS_DIR, extractVariables, substituteVariables, listSnippets, readSnippet, saveSnippet, deleteSnippet, RECOMMENDED_PLUGINS, listProjectPlugins, setPluginEnabled, addNpmPlugin, addLocalPlugin, validateProjectPlugins, THEMES_DIR, BUILT_IN_THEME_IDS, listBuiltInThemes, resolveBuiltInTheme, listProjectThemes, getActiveTheme, getPreviousTheme, revertTheme, applyTheme, importThemeFromFolder, importThemeFromUrl, readThemeCss, removeProjectTheme, importThemeFromFile, setManifestFields, readManifestFields, setActiveStyles, AUTO_SNAPSHOT_MIN_MINUTES, AUTO_SNAPSHOT_MAX_MINUTES, AUTO_SNAPSHOT_DEFAULT_MINUTES, AUTO_SYNC_MIN_MINUTES, AUTO_SYNC_MAX_MINUTES, AUTO_SYNC_DEFAULT_MINUTES, AUTO_SYNC_PUSH_INTERVAL_MINUTES, autoSnapshotDelayMs, autoSyncDelayMs, isGitInternalPath, resolveGitHubClientId, GITHUB_HOST, GitHubAuthProvider, GDRIVE_HOST, resolveGoogleClientId, resolveGoogleClientSecret, GOOGLE_NOT_CONFIGURED_MESSAGE, requireGoogleClientCredentials, pkceChallengeFromVerifier, GoogleAuthProvider, revokeGoogleCredential, publishCredentialKey, publishConnectionStatus, listPublishAccounts, connectGoogleDrive, listGitHubRepositories, listRepoBooks, listGitHubBranches, sanitizeCloneFolderName, cloneRepository, isSshRemoteUrl, testRemoteAccess, knownForgeTokenUrl, connectGenericHost, parseRemoteOrigin, forgeKindForHost, diagnoseProjectRemote, syncProject, listPublishProviders, publishProviderFor, resolvePublishFormat, resolvePublishRequest, runPublish, connectPublishProvider, disconnectPublishCredential, PublishSelectionsStore, readPublishSettings, setPublishProviderConfig };