gutterpress 0.10.4 → 0.10.5-beta.1

package/dist/{index-cm4dywtk.js → index-ja0p4w5f.js}

@@ -4,7 +4,7 @@ import {
   launchChromium,
   marginBoxAlign,
   marginBoxRectPt
-} from "./index-p4yq14qw.js";
+} from "./index-k5hcp8wj.js";
 
 // src/engine/compiler/build.ts
 import { readFile } from "node:fs/promises";

package/dist/{index-p4yq14qw.js → index-k5hcp8wj.js}

@@ -593,7 +593,7 @@ import { fileURLToPath } from "node:url";
 var favicon_default = "./favicon-wkbm9cjn.ico";
 
 // src/assets/manifest.schema.json
-var manifest_schema_default = "./manifest.schema-084rxtwp.json";
+var manifest_schema_default = "./manifest.schema-hn6ac0ae.json";
 
 // src/assets/preview/scripts/preview-interface.js
 var preview_interface_default = "./preview-interface-9rwz21yw.js";

package/dist/index.js

@@ -9,8 +9,11 @@ import {
   BUILT_IN_TEMPLATE_IDS,
   BUILT_IN_THEME_IDS,
   FileTokenStore,
+  GDRIVE_HOST,
   GITHUB_HOST,
+  GOOGLE_NOT_CONFIGURED_MESSAGE,
   GitHubAuthProvider,
+  GoogleAuthProvider,
   MANIFEST_FILENAMES,
   PLUGINS_DIR,
   PRESETS,
@@ -32,10 +35,12 @@ import {
   checkToolAvailability,
   cloneRepository,
   connectGenericHost,
+  connectGoogleDrive,
   connectPublishProvider,
   defaultConfigDir,
   deleteSnippet,
   diagnoseProjectRemote,
+  disconnectPublishCredential,
   escapeYamlScalar,
   executeAndReport,
   executeValidation,
@@ -74,6 +79,7 @@ import {
   log,
   openPath,
   parseRemoteOrigin,
+  pkceChallengeFromVerifier,
   publishConnectionStatus,
   publishCredentialKey,
   publishProviderFor,
@@ -84,13 +90,18 @@ import {
   readThemeCss,
   removeProjectTheme,
   reportMissingTools,
+  requireGoogleClientCredentials,
   resolveActiveStyles,
   resolveBuiltInTheme,
   resolveCheckSelectors,
   resolveConfig,
   resolveGitHubClientId,
+  resolveGoogleClientId,
+  resolveGoogleClientSecret,
+  resolvePublishFormat,
   resolvePublishRequest,
   revertTheme,
+  revokeGoogleCredential,
   ruleRemoteUrls,
   ruleRiskyProps,
   ruleSyntax,
@@ -113,15 +124,15 @@ import {
   syncProject,
   testRemoteAccess,
   validateProjectPlugins
-} from "./index-1z8a090c.js";
+} from "./index-3xv7vwv2.js";
 import {
   BUILD_DIAGNOSTIC_CODES
-} from "./index-cm4dywtk.js";
+} from "./index-ja0p4w5f.js";
 import {
   BuildError,
   DEFAULT_PRINT_OPTS,
   readyProbeExpr
-} from "./index-p4yq14qw.js";
+} from "./index-k5hcp8wj.js";
 import {
   AUTO_SNAPSHOT_MESSAGE,
   HISTORY_PAGE_LIMIT,
@@ -162,15 +173,20 @@ export {
   ruleSyntax,
   ruleRiskyProps,
   ruleRemoteUrls,
+  revokeGoogleCredential,
   revertTheme,
   restoreVersionWithBackup,
   resolvePublishRequest,
+  resolvePublishFormat,
   resolveLogger,
+  resolveGoogleClientSecret,
+  resolveGoogleClientId,
   resolveGitHubClientId,
   resolveConfig,
   resolveCheckSelectors,
   resolveBuiltInTheme,
   resolveActiveStyles,
+  requireGoogleClientCredentials,
   reportMissingTools,
   repoSubPath,
   repoRootForSource,
@@ -185,6 +201,7 @@ export {
   publishCredentialKey,
   publishConnectionStatus,
   providerFor,
+  pkceChallengeFromVerifier,
   parseRemoteOrigin,
   openPath,
   log,
@@ -225,11 +242,13 @@ export {
   executeValidation,
   executeAndReport,
   escapeYamlScalar,
+  disconnectPublishCredential,
   diagnoseProjectRemote,
   detectProjectSource,
   deleteSnippet,
   defaultConfigDir,
   connectPublishProvider,
+  connectGoogleDrive,
   connectGenericHost,
   cloneRepository,
   checkToolAvailability,
@@ -254,8 +273,11 @@ export {
   PLUGINS_DIR,
   MANIFEST_FILENAMES,
   HISTORY_PAGE_LIMIT,
+  GoogleAuthProvider,
   GitHubAuthProvider,
+  GOOGLE_NOT_CONFIGURED_MESSAGE,
   GITHUB_HOST,
+  GDRIVE_HOST,
   FileTokenStore,
   DEFAULT_PRINT_OPTS,
   BuildError,

package/dist/lib/markdown/gutterpress-css.d.ts

@@ -38,8 +38,16 @@
  *                   (shape-outside; the pipeline mirrors the src into
  *                   --gp-shape because CSS url() contexts can't read
  *                   attr()). Floats only; inert elsewhere.
- *   .gp-pin       — pins within the nearest @page/@spread container;
- *                   centered on both axes unless combined with the edge
+ *   .gp-pin       — pins within its nearest POSITIONED ANCESTOR, falling
+ *                   back to the page/spread. Core gives `.page`/`.spread`
+ *                   `position: relative` (markers.js MARKER_CSS), so with no
+ *                   other positioned ancestor in between that is the page —
+ *                   the common case. A theme that positions something closer
+ *                   (a `.section` card, a component shell) becomes the pin's
+ *                   frame instead, BY DESIGN: that is how a pin is scoped to
+ *                   a card rather than a sheet. Page-level furniture must
+ *                   therefore be authored outside such a wrapper.
+ *                   Centered on both axes unless combined with the edge
  *                   modifiers .gp-top/.gp-bottom/.gp-left/.gp-right.
  *   .gp-flush     — with .gp-pin + an edge, the art sits on the PAPER's
  *                   edge rather than on the text block's. No CSS rule here:

package/dist/lib/open-path.d.ts

@@ -1,3 +1,30 @@
+export interface OpenPathSpawnSpec {
+    cmd: string;
+    args: string[];
+    options: {
+        detached: boolean;
+        stdio: "ignore";
+        windowsVerbatimArguments?: boolean;
+    };
+}
+/**
+ * Build the {cmd, args, options} triple openPath() spawns, without actually
+ * spawning anything — kept separate so the win32 quoting can be unit tested
+ * on non-Windows CI/dev machines.
+ *
+ * win32 note: Node's default argv-to-command-line quoting (libuv) only
+ * quotes an argument if it contains a space/tab/quote character. A bare
+ * URL like a Google OAuth auth link has no spaces (everything is
+ * percent-encoded) but does contain unescaped "&" between query params, so
+ * libuv would pass it UNQUOTED. cmd.exe's own parser then treats the first
+ * unescaped "&" as a command separator, truncating the URL. The fix is the
+ * well-established Node technique for this cmd.exe/start quirk: pass
+ * `windowsVerbatimArguments: true` (which disables Node's own quoting
+ * entirely) and do the quoting ourselves — an empty quoted string for the
+ * `start` window-title placeholder, and the target wrapped in quotes so
+ * `start` doesn't mistake an unquoted first token for the title.
+ */
+export declare function buildOpenPathSpawnSpec(filePath: string, platform?: NodeJS.Platform): OpenPathSpawnSpec;
 /**
  * Open a file in the user's default OS desktop. Detached + unref'd so the
  * caller can exit immediately without waiting on the desktop process.

package/dist/lib/publish/connect-google.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Shared Google Drive connect flow (#221) — the ONE implementation behind
+ * both the CLI's `--connect` branch and (Phase 2) the desktop's connect
+ * route, mirroring how `connect.ts` is shared for pasted-token providers.
+ *
+ * Unlike `connectPublishProvider` (verify-before-store for a PASTED token),
+ * this flow is verify-by-construction: `GoogleAuthProvider.connect()` only
+ * returns a credential after a successful token exchange, so there is no
+ * separate "try it against the platform" step — storing it IS the proof.
+ */
+import { type GoogleHostCallbacks } from "./google-auth.ts";
+import { type PublishDeps } from "./types.ts";
+export interface ConnectGoogleDriveOptions {
+    /**
+     * Optional account label for a NAMED credential (two Google accounts) —
+     * stored under the compound `gdrive#<account>` key, same mechanism as
+     * every other provider's named accounts (types.ts `publishCredentialKey`).
+     */
+    account?: string;
+    /** Explicit client id/secret overrides (tests; advanced use). */
+    clientId?: string;
+    clientSecret?: string;
+    /** Override the system-browser opener (tests; advanced use). */
+    openBrowser?: (url: string) => Promise<void>;
+}
+export interface ConnectGoogleDriveResult {
+    connected: true;
+    /** The connected account's email, when Google returned one. */
+    email?: string;
+}
+/**
+ * Run the loopback+PKCE flow and store the resulting refresh-token credential.
+ */
+export declare function connectGoogleDrive(options: ConnectGoogleDriveOptions, deps: PublishDeps, callbacks: GoogleHostCallbacks): Promise<ConnectGoogleDriveResult>;

package/dist/lib/publish/connect.d.ts

@@ -21,3 +21,26 @@ export declare function connectPublishProvider(options: ConnectPublishProviderOp
     connected: true;
     providerId: string;
 }>;
+export interface DisconnectPublishCredentialOptions {
+    /**
+     * Await the best-effort revoke before returning. The CLI passes `true` (a
+     * one-shot process can afford to wait before printing success); the
+     * desktop's disconnect routes leave this `false` (the default) so "Remove
+     * this key" resolves immediately even offline, with the revoke — which
+     * carries its own ~10s network timeout — running in the background.
+     */
+    awaitRevoke?: boolean;
+}
+/**
+ * Delete a stored credential by its TokenStore key, one implementation
+ * shared by every disconnect entry point (the CLI's `--disconnect`, and the
+ * desktop's publish:disconnect + remote:disconnectHost routes — this key
+ * shape covers both a publish provider's compound `<host>#<account>` key and
+ * a plain remote-host key). The local delete always happens; before it, when
+ * the stored credential's `kind` supports a provider-side revoke (today only
+ * `google-oauth`, via `revokeGoogleCredential` — the same slot a future
+ * revocable oauth provider would use), a best-effort revoke is attempted.
+ * `revokeGoogleCredential` never throws, so a failed revoke can never block
+ * or fail the local delete.
+ */
+export declare function disconnectPublishCredential(key: string, deps: Pick<PublishDeps, "tokenStore" | "fetch">, options?: DisconnectPublishCredentialOptions): Promise<void>;

package/dist/lib/publish/google-auth.d.ts

@@ -0,0 +1,104 @@
+import type { HostCredential } from "../remote-auth/token-store.ts";
+/** Logical TokenStore host key for the stored refresh-token credential. */
+export declare const GDRIVE_HOST = "gdrive";
+export declare const GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+export declare const OFFLINE_MESSAGE = "Couldn't reach Google. Check your connection and try again.";
+/** Client id resolution — see {@link resolveClientValue}. */
+export declare function resolveGoogleClientId(explicit?: string): string;
+/** Client secret resolution — see {@link resolveClientValue}, and the module
+ * header re: why a Google installed-app "secret" is safe to embed as a
+ * default (ADR 0011) — this is deliberately NOT the GitHub rule. */
+export declare function resolveGoogleClientSecret(explicit?: string): string;
+/** Friendly, load-bearing product decision (see task brief): fail EARLY and
+ * clearly when this build has no Google OAuth client configured, rather than
+ * starting a loopback listener that can never complete an exchange. */
+export declare const GOOGLE_NOT_CONFIGURED_MESSAGE = "Google Drive publishing isn't configured on this build yet. Set GUTTERPRESS_GOOGLE_CLIENT_ID and GUTTERPRESS_GOOGLE_CLIENT_SECRET to enable it.";
+/** Resolve + require both Google OAuth client credentials, or throw the
+ * friendly not-configured error. Shared by {@link GoogleAuthProvider.connect}
+ * and the Drive client's token refresh (both need id+secret). */
+export declare function requireGoogleClientCredentials(clientIdOpt?: string, clientSecretOpt?: string): {
+    clientId: string;
+    clientSecret: string;
+};
+/** D4: a revoked/expired refresh token maps to one friendly reconnect message. */
+export declare const RECONNECT_MESSAGE = "Your Google Drive connection expired or was revoked. Connect Google Drive again.";
+/** The one scope the provider needs — and the only one it requests (D1). */
+export declare const DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+/**
+ * Backstop for a token issued without the Drive scope. With a single scope
+ * requested (see GOOGLE_OAUTH_SCOPE) Google's consent screen has nothing to
+ * partially grant, so this should not happen — but Google's own guidance is
+ * to read the token response's `scope` rather than assume, and a sign-in
+ * that "succeeds" without Drive access would otherwise surface only as a
+ * bare 403 on the author's first publish.
+ */
+export declare const DRIVE_PERMISSION_NOT_GRANTED_MESSAGE = "Google sign-in finished, but it didn't include the Google Drive permission, so Gutterpress can't create or see any files. Connect Google Drive again and allow it.";
+/** Whether a token response's granted `scope` list includes `wanted`. An
+ * ABSENT field is treated as unknown (true): Google always sends it, and if
+ * it ever didn't, the about.get call right after connect still catches an
+ * insufficient grant with Google's own reason (see `fetchEmail`). */
+export declare function grantedScopesInclude(scope: string | undefined, wanted: string): boolean;
+/** Host-supplied callbacks for the interactive connect flow. There is no
+ * "user code" to display (unlike the GitHub device flow) — just the URL the
+ * browser was (or should be) sent to, and an optional cancellation signal. */
+export interface GoogleHostCallbacks {
+    /** Called once with the auth URL, so the host UI can show a "browser
+     * didn't open? click here" fallback link while waiting. */
+    onAuthUrl(url: string): void;
+    /** Optional cancellation (user closed the dialog / pressed Ctrl+C). */
+    signal?: AbortSignal;
+}
+export interface GoogleAuthProviderOptions {
+    /** Explicit client id (overrides env + default). */
+    clientId?: string;
+    /** Explicit client secret (overrides env + default). */
+    clientSecret?: string;
+    /** Injectable fetch for tests. Defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    /** Opens the auth URL in the user's default browser. Defaults to the CLI's
+     * `openPath()` (system browser opener). Tests inject a no-op so they never
+     * spawn a real browser process. Failure to open is non-fatal — `onAuthUrl`
+     * already handed the host UI the URL as a fallback link. */
+    openBrowser?: (url: string) => Promise<void>;
+    /** Overall deadline (ms) waiting for the browser redirect. Default 5 min. */
+    timeoutMs?: number;
+    /** Test-only: bind the loopback listener to this exact port instead of an
+     * OS-assigned ephemeral one (0). Lets tests deterministically force a bind
+     * failure (EADDRINUSE) by pre-binding the port themselves. Never set this
+     * in production — an OS-assigned port is what makes the loopback flow work
+     * without a fixed-port conflict. */
+    port?: number;
+}
+/** PKCE S256 challenge derivation — exported as a pure helper so tests can
+ * verify the verifier/challenge relationship independently of the flow. */
+export declare function pkceChallengeFromVerifier(verifier: string): string;
+/** Google OAuth loopback+PKCE credential acquisition (D2/D3). */
+export declare class GoogleAuthProvider {
+    private readonly clientIdOpt;
+    private readonly clientSecretOpt;
+    private readonly fetchImpl;
+    private readonly openBrowser;
+    private readonly timeoutMs;
+    private readonly bindPort;
+    constructor(options?: GoogleAuthProviderOptions);
+    connect(callbacks: GoogleHostCallbacks): Promise<HostCredential>;
+    /**
+     * Email lookup after auth, via Drive's `about.get` — which doubles as the
+     * first real Drive API call the new token makes. A 401/403 answer here is
+     * NOT best-effort: it means the token can't use the Drive API at all (the
+     * common case is `accessNotConfigured` — the Drive API isn't enabled for
+     * the OAuth client's Cloud project, ADR 0011), so storing the credential
+     * would only defer the failure to the author's first publish, as a bare
+     * "HTTP 403" with nothing to act on — exactly the trap the 0.10.5 bring-up
+     * hit. Fail connect right here, with Google's reason, and store nothing.
+     * Everything else (a network blip, a 5xx, a body without the field) stays
+     * non-fatal, mirroring GitHubAuthProvider's fetchUsername precedent: the
+     * email is only a label.
+     */
+    private fetchEmail;
+}
+/** Best-effort revoke at Google (used by disconnect, D4/D6). Never throws —
+ * a failed revoke must not block the local credential from being deleted. */
+export declare function revokeGoogleCredential(refreshToken: string, options?: {
+    fetchImpl?: typeof fetch;
+}): Promise<void>;

package/dist/lib/publish/google-drive.d.ts

@@ -0,0 +1,88 @@
+export declare const OFFLINE_MESSAGE = "Couldn't reach Google Drive. Check your connection and try again.";
+/**
+ * Escape a value for safe interpolation into a Drive API `q` search string.
+ * Drive's query grammar uses single-quoted string literals with `\'` and
+ * `\\` as the only escapes — an unescaped `'` in a folder/file name would
+ * otherwise terminate the literal early and let the rest of the name be
+ * interpreted as query syntax.
+ */
+export declare function escapeDriveQueryValue(value: string): string;
+export interface RefreshedToken {
+    accessToken: string;
+    expiresIn: number;
+}
+/** Mint a fresh access token from the stored refresh token. Maps Google's
+ * `invalid_grant` to the D4 reconnect message; never logs the token values. */
+export declare function refreshAccessToken(fetchImpl: typeof fetch, params: {
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+}): Promise<RefreshedToken>;
+export interface DriveQuota {
+    /** null = unlimited (Workspace accounts with no cap report this). */
+    limitBytes: number | null;
+    usageBytes: number;
+    freeBytes: number | null;
+}
+export interface DriveAbout {
+    email?: string;
+    quota: DriveQuota;
+}
+export declare function driveAbout(fetchImpl: typeof fetch, accessToken: string): Promise<DriveAbout>;
+export interface DriveFolder {
+    id: string;
+    name: string;
+}
+/** App-visible folders (drive.file scope: only ones this app created), most
+ * recently modified first. Follows `nextPageToken` and accumulates every
+ * page — an author with more than one page of app-created folders would
+ * otherwise see the destinations picker silently miss folders past the
+ * first 100. (`ensureFolder`'s find-by-name lookup uses its own single
+ * server-side query, {@link findFolderByName} below, and doesn't paginate.) */
+export declare function listFolders(fetchImpl: typeof fetch, accessToken: string): Promise<DriveFolder[]>;
+/** Look up one folder by id (for verifying a manifest-recorded `folderId`
+ * still exists and isn't trashed). Returns null when it's gone. */
+export declare function getFolderById(fetchImpl: typeof fetch, accessToken: string, folderId: string): Promise<DriveFolder | null>;
+/** Create a folder at My Drive root. */
+export declare function createFolder(fetchImpl: typeof fetch, accessToken: string, name: string): Promise<DriveFolder>;
+/** Find-or-create a folder by name at My Drive root (D5's name-resolution
+ * path, used when the manifest has no recorded `folderId` yet). One query,
+ * not a client-side scan of every app-created folder — see
+ * {@link findFolderByName}. */
+export declare function ensureFolder(fetchImpl: typeof fetch, accessToken: string, name: string): Promise<DriveFolder>;
+export interface DriveFile {
+    id: string;
+    name: string;
+    webViewLink?: string;
+}
+/** Find a file by exact basename inside one folder (app-visible files only,
+ * not trashed) — the D6 update-in-place lookup. */
+export declare function findFileInFolder(fetchImpl: typeof fetch, accessToken: string, folderId: string, name: string): Promise<DriveFile | null>;
+/** Must be a multiple of 256 KiB (Drive's resumable-upload chunk requirement). */
+export declare const RESUMABLE_CHUNK_SIZE: number;
+export interface ResumableUploadOptions {
+    /** Existing file id → update (PATCH); omitted → create (POST). */
+    fileId?: string;
+    /** Only used on create — the file's Drive name and parent folder. */
+    name: string;
+    parentFolderId?: string;
+    /** Local path to read the artifact from — read incrementally, never
+     * loaded whole into memory. */
+    filePath: string;
+    totalBytes: number;
+    mimeType?: string;
+    onProgress?: (uploadedBytes: number, totalBytes: number) => void;
+    /** Bytes per chunk. Default {@link RESUMABLE_CHUNK_SIZE}; must stay a
+     * multiple of 256 KiB (Drive requirement) for any override (tests only). */
+    chunkSize?: number;
+    maxRetriesPerChunk?: number;
+    /** Injectable sleep for tests (so backoff tests run instantly). */
+    sleepImpl?: (ms: number) => Promise<void>;
+}
+/**
+ * Resumable upload: start a session, PUT chunks read incrementally from disk,
+ * follow `308 Resume Incomplete` + `Range` resumes, retry a failed chunk with
+ * backoff, and report progress. Used both for creating a new file (no
+ * `fileId`) and updating one in place (D6).
+ */
+export declare function resumableUpload(fetchImpl: typeof fetch, accessToken: string, opts: ResumableUploadOptions): Promise<DriveFile>;

package/dist/lib/publish/google-errors.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Google API failure decoding for the `gdrive` publish provider (#221) — the
+ * ONE place a non-OK Drive response becomes an author-facing message.
+ *
+ * Google answers every failed API call with a JSON body of the shape
+ *   { error: { code, message, status?, errors?: [{ reason, message, domain }] } }
+ * and `reason` is the only field that says WHY. Reporting just "HTTP 403" —
+ * as the first cut did — left an author with nothing to act on and a
+ * maintainer reading the app log with nothing to diagnose. The 0.10.5
+ * bring-up hit exactly that: a freshly registered OAuth client whose Cloud
+ * project had the Drive API disabled, every call answering
+ * `403 accessNotConfigured`, and the app saying only "HTTP 403". This module
+ * keeps the reason and Google's own message (which, for that case, carries
+ * the enable-it link with the project id) and maps the well-known reasons to
+ * a sentence that says what to do.
+ *
+ * Invariant: every message produced here names "Google" as prose. The
+ * desktop's publish error allowlist (electron/server-bridge/friendly-errors.ts,
+ * `\bgoogle\b`) keys on that to pass a lib message through to the author
+ * verbatim instead of masking it behind "See the app log for details" — which
+ * is what happened to "Couldn't create the Drive folder …" before this module
+ * existed.
+ *
+ * Token-free by construction: Google's error messages describe the API,
+ * project, scope, or quota — never the bearer token — and a Drive error body
+ * does not echo the request URL. `redactQueryCredentials` is belt-and-braces
+ * for the one shape that could ever carry one.
+ */
+import { FriendlyHttpError } from "../fetch-timeout.ts";
+export interface GoogleApiErrorInfo {
+    status: number;
+    /** Google's machine reason (`accessNotConfigured`, `insufficientPermissions`, …), when present. */
+    reason?: string;
+    /** Google's human-readable message, when present. */
+    message?: string;
+}
+/** Decode Google's standard error envelope. Tolerates any body shape — a
+ * non-JSON or unexpected body just yields the bare status. */
+export declare function parseGoogleApiError(status: number, body: unknown): GoogleApiErrorInfo;
+/** Read a non-OK response's body once and decode it. */
+export declare function readGoogleApiError(res: Response): Promise<GoogleApiErrorInfo>;
+/**
+ * Build the author-facing error for a failed Google API call: `what` is the
+ * caller's "Couldn't …" phrase; the status and Google's reason follow in
+ * parentheses, then the what-to-do hint for a known reason, then Google's own
+ * message. Always a {@link FriendlyHttpError} (passes through
+ * `withFetchTimeout` unwrapped, like every other Drive failure).
+ */
+export declare function googleApiFailure(what: string, info: GoogleApiErrorInfo): FriendlyHttpError;

package/dist/lib/publish/providers/gdrive.d.ts

@@ -0,0 +1,25 @@
+import { type PublishProvider } from "../types.ts";
+/** What actually gets uploaded: a local file path + the Drive-visible name.
+ * For the PDF format this IS the artifact; for HTML (D8) it's the zipped
+ * export, in a temp file `cleanup` removes once the upload finishes (or
+ * fails) — the upload path itself doesn't care which one it got. */
+interface UploadSource {
+    filePath: string;
+    fileName: string;
+    mimeType: string;
+    cleanup: () => Promise<void>;
+}
+/**
+ * Package the HTML export directory into a single ZIP (D8: Drive is file
+ * delivery, not web hosting — no N-file folder mirroring). Built via
+ * `zipEntriesNonBlocking` (fflate is already a dependency, see
+ * theme-import.ts for the sibling unzip-side usage) so building the archive
+ * doesn't block the event loop, then written to a temp file so the existing
+ * file-based `resumableUpload` (google-drive.ts) can read it incrementally
+ * like any other artifact. Note this is true only of the UPLOAD step — the
+ * ZIP-BUILD step above necessarily holds the whole compressed archive in
+ * memory before it's written out below.
+ */
+export declare function zipHtmlExport(exportDir: string, title: string, onWarn?: (message: string) => void, writeArchiveImpl?: (filePath: string, data: Uint8Array) => Promise<void>): Promise<UploadSource>;
+export declare const gdriveProvider: PublishProvider;
+export {};

package/dist/lib/publish/run-publish.d.ts

@@ -1,4 +1,4 @@
-import type { PreflightIssue, PublishDeps, PublishOutcome, PublishRequest } from "./types.ts";
+import type { PreflightIssue, PublishArtifactFormat, PublishDeps, PublishOutcome, PublishProviderInfo, PublishRequest } from "./types.ts";
 export interface RunPublishOptions {
     projectDir: string;
     providerId: string;
@@ -20,6 +20,19 @@ export interface RunPublishResult {
     /** Friendly failure summary when `ok` is false. */
     error?: string;
 }
+/**
+ * Compute the EFFECTIVE artifact format for a publish request (#221 phase 3,
+ * D8). Every provider except gdrive declares only a single fixed
+ * `info.format` and has no `info.formats` array — for those, this function
+ * always returns `info.format`, so their behavior is byte-for-byte
+ * unaffected by this change. For a provider that DOES declare `formats`
+ * (currently only gdrive: `["pdf", "html"]`), the author's manifest
+ * `publish.<id>.format` selects the effective one — but only when it's a
+ * value the provider actually declares; an unset, invalid, or typo'd value
+ * is IGNORED and falls back to `info.format` rather than blocking publish
+ * with a preflight error over one bad manifest field.
+ */
+export declare function resolvePublishFormat(info: PublishProviderInfo, providerConfig: Record<string, unknown>): PublishArtifactFormat;
 /**
  * Resolve the {@link PublishRequest} for a provider from the project's
  * manifest — shared by `runPublish` and by hosts that call individual

package/dist/lib/publish/types.d.ts

@@ -33,7 +33,7 @@ export interface PublishConfigField {
 }
 /** Stable provider identifiers: the `--provider` values AND the manifest
  * `publish.<id>` keys — one spelling everywhere. */
-export type PublishProviderId = "itch" | "drivethrurpg" | "kdp" | "azure-swa" | "shopify";
+export type PublishProviderId = "itch" | "drivethrurpg" | "kdp" | "azure-swa" | "shopify" | "gdrive";
 /**
  * How the provider integrates:
  *   - "api"    — real programmatic upload (itch.io, Azure SWA, Shopify)
@@ -49,8 +49,20 @@ export interface PublishProviderInfo {
     /** Human name ("itch.io"). */
     label: string;
     kind: PublishProviderKind;
-    /** The artifact format this provider publishes. */
+    /** The artifact format this provider publishes BY DEFAULT — and, for every
+     * provider except those declaring {@link formats}, the ONLY one it ever
+     * publishes. */
     format: PublishArtifactFormat;
+    /**
+     * Formats this provider can ALSO publish, when it supports more than one
+     * (#221 phase 3, D8 — currently only gdrive: `["pdf", "html"]`). Absent for
+     * every other provider, which keeps them on the single fixed `format`
+     * above with no behavior change. When present, the author's manifest
+     * `publish.<id>.format` (validated against this list) picks the EFFECTIVE
+     * format for one publish request — see `run-publish.ts`'s
+     * `resolvePublishFormat`.
+     */
+    formats?: PublishArtifactFormat[];
     /** One-line author-facing description of what publishing here does. */
     description: string;
     /** The provider's author-editable manifest settings. */
@@ -69,6 +81,30 @@ export interface PublishProviderInfo {
         tokenUrl?: string;
         /** Author-facing hint ("Paste an API key from …"). */
         hint?: string;
+        /**
+         * How the credential is acquired. "token" (default, and every provider's
+         * behavior before this field existed): the author pastes an API key,
+         * verified by {@link connectPublishProvider}(pasted-token flow). "oauth":
+         * there is no key to paste — the credential comes from an interactive
+         * browser consent flow (see `google-auth.ts`'s `GoogleAuthProvider` for
+         * the gdrive precedent). UIs branch on this to swap the paste-a-key form
+         * for a "Connect …" button; {@link connectPublishProvider} REJECTS oauth
+         * providers outright so the old paste-a-token path can never store an
+         * unverifiable credential for one (#221).
+         */
+        connect?: "token" | "oauth";
+    };
+    /**
+     * Present when the provider has a notion of "existing places to publish
+     * into" that a UI can let the author pick or create (gdrive: Drive
+     * folders) — precedent: the existing optional `listProducts`. `label` is
+     * the author-facing noun ("Folder"); `canCreate` says whether
+     * {@link PublishProvider.createDestination} is implemented. Absent for
+     * providers with no such concept.
+     */
+    destinations?: {
+        label: string;
+        canCreate: boolean;
     };
 }
 /** The project being published (resolved from the manifest by the orchestrator). */
@@ -218,6 +254,14 @@ export interface PublishProvider {
     listProducts?(req: PublishRequest): Promise<PublishProduct[]>;
     /** Update an existing listing's metadata. API providers only. */
     updateListing?(req: PublishRequest, productId: string, metadata: PublishListingMetadata): Promise<PublishProduct>;
+    /**
+     * Existing places this provider can publish into (gdrive: app-visible
+     * Drive folders). UIs render a picker when this is implemented — see
+     * {@link PublishProviderInfo.destinations}.
+     */
+    listDestinations?(req: PublishRequest): Promise<PublishProduct[]>;
+    /** Create a new destination (gdrive: a Drive folder at My Drive root). */
+    createDestination?(req: PublishRequest, name: string): Promise<PublishProduct>;
 }
 /**
  * Resolve the credential for a provider: the CI env var wins, then the token

package/dist/lib/remote-auth/token-store.d.ts

@@ -3,7 +3,7 @@ export interface HostCredential {
     /** Remote host the credential authenticates against, e.g. "github.com". */
     host: string;
     /** How the credential was acquired (drives re-auth UX, not transport). */
-    kind: "github-oauth" | "token";
+    kind: "github-oauth" | "token" | "google-oauth";
     /** The secret token value. NEVER log this. */
     token: string;
     /** Login/username associated with the token, when known. */

package/dist/{lint-gmymvnm3.js → lint-kzvbrn3d.js}

@@ -1,16 +1,16 @@
 import {
   MANIFEST_FILENAMES,
   runLint
-} from "./cli-zddg7r27.js";
+} from "./cli-5w9y6r2f.js";
 import {
   log
-} from "./cli-h617210r.js";
+} from "./cli-nb902265.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-d613m9n5.js";
-import"./cli-7hay1r0h.js";
+} from "./cli-xewqry0j.js";
+import"./cli-0t4zfevc.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES