I want to have some control over how the input directory is processed.
publish() takes the input directory and scans its immediate contents.
Files are copied to the output directory, and publish is applied to
the subdirectories again.

I added the convention that, if a subdirectory starts with an
underscore, the contents are to be copied to the .well-known
directory instead. The contents are assumed to be files and the script
will fail if it contains a subdirectory.

I have added a limit to how deep the script will recurse into the input
directory. This is currently not exposed to the user.

According to Bluesky the DID value is not sensitive:

    Step 3 above contains all of the information you’ll need to add to
    your domain. The DID value is public and not sensitive information.

Source: https://bsky.social/about/blog/4-28-2023-domain-handle-tutorial
Note that this value is accessible through a browser anyway.

Adding it to the website source files will help redeploy the website if
necessary.