run402-mcp 4.0.1 → 4.0.3

package/sdk/dist/namespaces/snapshots.types.d.ts

@@ -0,0 +1,79 @@
+export type ProjectSnapshotKind = "manual" | "pre_migration" | "pre_restore" | "scheduled";
+export type ProjectSnapshotProfile = "snapshot";
+export type ProjectSnapshotStatus = "running" | "ready" | "failed" | "expired";
+export interface SnapshotNextAction {
+    type: string;
+    command?: string;
+    message: string;
+    [key: string]: unknown;
+}
+export interface ProjectSnapshotDto {
+    snapshot_id: string;
+    operation_id: string;
+    project_id: string;
+    kind: ProjectSnapshotKind | (string & {});
+    profile: ProjectSnapshotProfile | (string & {});
+    status: ProjectSnapshotStatus | (string & {});
+    manifest_sha256: string | null;
+    size_bytes: number;
+    live_release_id: string | null;
+    captured_at: string | null;
+    expires_at: string | null;
+    error: unknown | null;
+    created_at: string;
+    updated_at: string;
+    next_actions: SnapshotNextAction[];
+}
+export interface ProjectSnapshotsListOptions {
+    limit?: number;
+    after?: string;
+    kind?: ProjectSnapshotKind | (string & {});
+}
+export interface ProjectSnapshotsListResult {
+    snapshots: ProjectSnapshotDto[];
+    has_more: boolean;
+    next_cursor: string | null;
+}
+export interface SnapshotRestoreOptions {
+    includeAuth?: boolean;
+}
+export interface SnapshotRestorePlanEnvelope {
+    restore_plan: SnapshotRestorePlan;
+}
+export interface SnapshotRestorePlan {
+    snapshot_id: string;
+    project_id: string;
+    snapshot_at: string;
+    data_loss_statement: string;
+    auth: {
+        mode: "not_restored" | "restore_on_confirm" | (string & {});
+        users: number;
+        passkeys: number;
+        message: string;
+    };
+    release: {
+        snapshot_live_release_id: string | null;
+        current_live_release_id: string | null;
+    };
+    target: {
+        current_schema_slot: string;
+        behavior: "offline_materialize_then_atomic_flip" | (string & {});
+    };
+    confirm: {
+        token: string;
+        expires_at: string;
+    };
+    next_actions: SnapshotNextAction[];
+}
+export interface SnapshotRestoreResult {
+    operation_id: string;
+    project_id: string;
+    snapshot_id: string;
+    pre_restore_snapshot_id: string;
+    old_schema_slot: string;
+    new_schema_slot: string;
+    migration_registry_rows: number;
+    status: "ready" | (string & {});
+    next_actions: SnapshotNextAction[];
+}
+//# sourceMappingURL=snapshots.types.d.ts.map

package/sdk/dist/namespaces/snapshots.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshots.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/snapshots.types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,eAAe,GAAG,aAAa,GAAG,WAAW,CAAC;AAC3F,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAChD,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC1C,OAAO,EAAE,sBAAsB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,qBAAqB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,mBAAmB,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,cAAc,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;KACxC,CAAC;IACF,MAAM,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,QAAQ,EAAE,sCAAsC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KAClE,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChC,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC"}

package/sdk/dist/namespaces/snapshots.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=snapshots.types.js.map

package/sdk/dist/namespaces/snapshots.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshots.types.js","sourceRoot":"","sources":["../../src/namespaces/snapshots.types.ts"],"names":[],"mappings":""}

package/sdk/dist/node/actions-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions-node.d.ts","sourceRoot":"","sources":["../../src/node/actions-node.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAIV,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EAGb,kCAAkC,EAClC,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACf,MAAM,eAAe,CAAC;AAiBvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAY,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGrE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA8GD;;;GAGG;AACH,qBAAa,WAAY,YAAW,aAAa;;IAE7C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,kBAAuB;IAG1C,GAAG,CACP,KAAK,EAAE,kCAAkC,EACzC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACzC,GAAG,CACP,KAAK,EAAE,wBAAwB,EAC/B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACvC,GAAG,CACP,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAmCxC,EAAE,CACN,KAAK,GAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAM,EAC7C,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;CAq/C/C"}
+{"version":3,"file":"actions-node.d.ts","sourceRoot":"","sources":["../../src/node/actions-node.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAIV,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EAGb,kCAAkC,EAClC,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACf,MAAM,eAAe,CAAC;AAmBvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAS1C,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAY,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGrE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAiKD;;;GAGG;AACH,qBAAa,WAAY,YAAW,aAAa;;IAE7C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,kBAAuB;IAG1C,GAAG,CACP,KAAK,EAAE,kCAAkC,EACzC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACzC,GAAG,CACP,KAAK,EAAE,wBAAwB,EAC/B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACvC,GAAG,CACP,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAmCxC,EAAE,CACN,KAAK,GAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAM,EAC7C,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;CAkvD/C"}

package/sdk/dist/node/actions-node.js

@@ -55,6 +55,14 @@ const TIER_RANK = {
     hobby: 2,
     team: 3,
 };
+const DEFAULT_PROPAGATION_BUDGET_SECONDS = 120;
+const EDGE_PROPAGATION_FRESH_WINDOW_MS = 300_000;
+const EDGE_PROPAGATION_TYPICAL_SECONDS = 60;
+const VERIFY_SENTINEL_CODES = new Set([
+    "SUBDOMAIN_NOT_CONFIGURED",
+    "HOST_NOT_CONFIGURED",
+    "NO_SITE_DEPLOYED",
+]);
 const execFileAsync = promisify(execFile);
 /**
  * Node implementation of the action runner. The public CLI should treat this
@@ -168,6 +176,9 @@ export class NodeActions {
         const workspaceDir = source.workspaceDir;
         const manifest = await this.#discoverAndValidateManifest(input, workspaceDir, source.metadata, run);
         if (manifest.manifestKind === "app") {
+            if (input.verifyOnly) {
+                return this.#verifyAppManifestOnly(input, manifest, workspaceDir, run, startedAt);
+            }
             const block = this.#firstAppUpBlock(input, manifest, run);
             const appResult = this.#planAppUpResult(input, manifest, run, {
                 startedAt,
@@ -496,6 +507,72 @@ export class NodeActions {
             blockedNodeId: block.nodeId,
         });
     }
+    async #verifyAppManifestOnly(input, manifest, workspaceDir, run, startedAt) {
+        if (!manifest.appSpec || !manifest.appGraph) {
+            throw run.error("Internal error: app manifest did not produce an install graph.", "RUN402_ACTION_INTERNAL");
+        }
+        if ((manifest.appSpec.verify?.http ?? []).length === 0) {
+            throw run.error("App manifest does not define verify.http checks.", "VERIFY_CHECKS_REQUIRED", { manifest_path: manifest.manifestPath });
+        }
+        const resolved = await this.#resolveProjectForVerify(input, manifest, workspaceDir, run);
+        const projectKeys = await this.sdk.projects.keys(resolved.projectId);
+        const publicOrigin = appPublicOrigin(input, manifest.appSpec) ?? projectKeys.site_url ?? null;
+        const scoped = await this.sdk.project(resolved.projectId);
+        const verification = await this.#verifyAppHttp(manifest.appSpec, publicOrigin, run, {
+            projectId: resolved.projectId,
+            claimedHosts: new Set(),
+            bindings: [],
+            propagationBudgetMs: propagationBudgetMs(input),
+            propagationWait: input.propagationWait !== false,
+            resolve: (opts) => scoped.apply.resolve(opts),
+        });
+        markAppGraphNodesForVerify(manifest.appGraph, verification);
+        const appStatus = verification.ok
+            ? "succeeded"
+            : verification.propagationPending
+                ? "propagation_pending"
+                : "deployed_unverified";
+        const appResult = createRun402AppUpResult({
+            graph: manifest.appGraph,
+            manifest_path: manifest.manifestPath,
+            status: appStatus,
+            started_at: startedAt,
+            dry_run: false,
+            project_id: resolved.projectId,
+            project_name: input.name ?? manifest.appSpec.project.name ?? resolved.link?.name ?? null,
+            public_origin: publicOrigin,
+            diagnostics: verification.diagnostics,
+            next_actions: verification.nextAction ? [verification.nextAction] : [],
+            verify: appVerifyResult(verification),
+            approval_policy: {
+                yes: run.approval === "yes",
+                allow_prune: input.allowPrune === true,
+                max_spend_usd: input.maxSpendUsd ?? null,
+                build_mode: input.buildMode ?? manifest.appSpec.build?.mode ?? null,
+                shell_build_approved: input.allowShellBuild === true,
+            },
+        });
+        for (const check of appResult.verification.http) {
+            const actual = verification.results.get(check.id);
+            if (actual !== undefined) {
+                check.actual_status = actual.status;
+                check.propagation_wait_ms = actual.propagationWaitMs;
+                if (actual.diagnostic)
+                    check.diagnostic = actual.diagnostic;
+                check.status = actual.ok
+                    ? "succeeded"
+                    : actual.propagationPending
+                        ? "propagation_pending"
+                        : "failed";
+            }
+        }
+        return run.result({
+            project_id: resolved.projectId,
+            manifest_path: manifest.manifestPath,
+            app_graph: manifest.appGraph,
+            app_result: appResult,
+        });
+    }
     #firstAppUpBlock(input, manifest, run) {
         const nameBlock = missingRequiredName(input, manifest);
         if (nameBlock)
@@ -666,12 +743,25 @@ export class NodeActions {
             });
             const webhooks = await this.#ensureAppWebhooks(resolved.projectId, manifest.appSpec, resources, run);
             resources.webhooks = webhooks;
-            const verification = await this.#verifyAppHttp(manifest.appSpec, publicOrigin, run);
-            markAppGraphNodes(manifest.appGraph, verification.ok ? "succeeded" : "failed");
+            const verifyContext = {
+                projectId: resolved.projectId,
+                claimedHosts: claimedHostsFromRelease(normalized.spec, publicOrigin),
+                bindings: deploy.subdomain_bindings ?? [],
+                propagationBudgetMs: propagationBudgetMs(input),
+                propagationWait: input.propagationWait !== false,
+                resolve: (opts) => scoped.apply.resolve(opts),
+            };
+            const verification = await this.#verifyAppHttp(manifest.appSpec, publicOrigin, run, verifyContext);
+            markAppGraphNodesForVerify(manifest.appGraph, verification);
+            const appStatus = verification.ok
+                ? "succeeded"
+                : verification.propagationPending
+                    ? "propagation_pending"
+                    : "deployed_unverified";
             const appResult = createRun402AppUpResult({
                 graph: manifest.appGraph,
                 manifest_path: manifest.manifestPath,
-                status: verification.ok ? "succeeded" : "deployed_unverified",
+                status: appStatus,
                 started_at: startedAt,
                 dry_run: false,
                 project_id: resolved.projectId,
@@ -679,6 +769,8 @@ export class NodeActions {
                 public_origin: publicOrigin,
                 operation_id: deploy.operation_id ?? null,
                 diagnostics: verification.diagnostics,
+                next_actions: verification.nextAction ? [verification.nextAction] : [],
+                verify: appVerifyResult(verification),
                 approval_policy: {
                     yes: run.approval === "yes",
                     allow_prune: input.allowPrune === true,
@@ -694,8 +786,15 @@ export class NodeActions {
             for (const check of appResult.verification.http) {
                 const actual = verification.results.get(check.id);
                 if (actual !== undefined) {
-                    check.actual_status = actual;
-                    check.status = actual === check.expected_status ? "succeeded" : "failed";
+                    check.actual_status = actual.status;
+                    check.propagation_wait_ms = actual.propagationWaitMs;
+                    if (actual.diagnostic)
+                        check.diagnostic = actual.diagnostic;
+                    check.status = actual.ok
+                        ? "succeeded"
+                        : actual.propagationPending
+                            ? "propagation_pending"
+                            : "failed";
                 }
             }
             await this.#recordAppInstallState({
@@ -993,24 +1092,39 @@ export class NodeActions {
         run.setState(step, "succeeded", { webhooks });
         return webhooks;
     }
-    async #verifyAppHttp(spec, publicOrigin, run) {
+    async #verifyAppHttp(spec, publicOrigin, run, context) {
         const checks = spec.verify?.http ?? [];
         const results = new Map();
         const diagnostics = [];
-        if (checks.length === 0)
-            return { ok: true, results, diagnostics };
+        const warnings = [];
+        let nextAction = null;
+        let propagationWaitMs = 0;
+        if (checks.length === 0) {
+            return { ok: true, propagationPending: false, results, diagnostics, warnings, nextAction, propagationWaitMs };
+        }
         const step = run.addStep({
             action: "app.verify",
             description: "Verify app HTTP checks",
             mutation: false,
             auto: true,
-            details: { count: checks.length },
+            details: {
+                count: checks.length,
+                propagation_budget_s: Math.floor(context.propagationBudgetMs / 1000),
+                propagation_wait: context.propagationWait,
+            },
         });
         run.setState(step, "running");
+        const verifyStarted = Date.now();
         for (const check of checks) {
             const url = check.url ?? (publicOrigin && check.path ? new URL(check.path, publicOrigin).toString() : null);
             if (!url) {
-                results.set(check.id, null);
+                results.set(check.id, {
+                    id: check.id,
+                    ok: false,
+                    propagationPending: false,
+                    status: null,
+                    propagationWaitMs: 0,
+                });
                 diagnostics.push({
                     code: "VERIFY_FAILED",
                     severity: "error",
@@ -1021,34 +1135,111 @@ export class NodeActions {
             }
             const retries = Math.max(1, check.retries ?? 1);
             let status = null;
-            for (let attempt = 0; attempt < retries; attempt++) {
-                try {
-                    const res = await fetch(url, { method: "GET" });
-                    status = res.status;
-                    if (status === check.expect.status)
-                        break;
+            let attempt = 0;
+            let propagationAttempts = 0;
+            let checkPropagationWaitMs = 0;
+            let pendingDiagnosis = null;
+            while (true) {
+                const observed = await fetchAppVerifyUrl(url);
+                status = observed.status;
+                const classification = await classifyAppVerifyAttempt({
+                    attempt: observed,
+                    check,
+                    url,
+                    context,
+                });
+                if (classification.kind === "success") {
+                    results.set(check.id, {
+                        id: check.id,
+                        ok: true,
+                        propagationPending: false,
+                        status,
+                        propagationWaitMs: checkPropagationWaitMs,
+                    });
+                    break;
                 }
-                catch {
-                    status = null;
+                if (classification.kind === "propagating") {
+                    propagationAttempts += 1;
+                    pendingDiagnosis = classification.diagnosis ?? null;
+                    const elapsed = Date.now() - verifyStarted;
+                    const remaining = Math.max(0, context.propagationBudgetMs - elapsed);
+                    run.setState(step, "running", {
+                        verify_event: "propagating",
+                        check_id: check.id,
+                        url,
+                        reason: classification.reason ?? "edge_propagation",
+                        binding_age_s: classification.bindingAgeSeconds ?? null,
+                        typical_s: EDGE_PROPAGATION_TYPICAL_SECONDS,
+                        budget_remaining_s: Math.ceil(remaining / 1000),
+                        propagation_wait_ms: propagationWaitMs,
+                        edge_propagation: classification.edge ?? pendingDiagnosis?.edge_propagation ?? null,
+                    });
+                    if (!context.propagationWait || remaining <= 0) {
+                        const warning = propagationWarning(check.id, url, classification, remaining);
+                        warnings.push(warning);
+                        diagnostics.push(warning);
+                        nextAction ??= verifyNextAction();
+                        results.set(check.id, {
+                            id: check.id,
+                            ok: false,
+                            propagationPending: true,
+                            status,
+                            propagationWaitMs: checkPropagationWaitMs,
+                            ...(pendingDiagnosis ? { diagnostic: { edge_propagation: pendingDiagnosis.edge_propagation ?? null, resolve: pendingDiagnosis } } : {}),
+                        });
+                        break;
+                    }
+                    const sleepMs = Math.min(remaining, propagationBackoffMs(propagationAttempts));
+                    await delay(sleepMs);
+                    propagationWaitMs += sleepMs;
+                    checkPropagationWaitMs += sleepMs;
+                    continue;
                 }
-                if (attempt + 1 < retries)
+                attempt += 1;
+                if (attempt < retries) {
                     await delay(1_000);
-            }
-            results.set(check.id, status);
-            if (status !== check.expect.status) {
+                    continue;
+                }
+                const diagnosis = classification.diagnosis ?? await diagnoseAppVerifyFailure(context, url, check);
                 diagnostics.push({
                     code: "VERIFY_FAILED",
                     severity: "error",
                     node_id: `verify.http.${check.id}`,
                     message: `HTTP verification ${check.id} expected ${check.expect.status}, got ${status ?? "network_error"}.`,
-                    details: { url, expected_status: check.expect.status, actual_status: status },
+                    details: {
+                        url,
+                        expected_status: check.expect.status,
+                        actual_status: status,
+                        ...(observed.error ? { error: observed.error } : {}),
+                        ...(diagnosis ? { resolve: diagnosis, edge_propagation: diagnosis.edge_propagation ?? null } : {}),
+                    },
                 });
+                results.set(check.id, {
+                    id: check.id,
+                    ok: false,
+                    propagationPending: false,
+                    status,
+                    propagationWaitMs: checkPropagationWaitMs,
+                    ...(diagnosis ? { diagnostic: { edge_propagation: diagnosis.edge_propagation ?? null, resolve: diagnosis } } : {}),
+                });
+                break;
             }
         }
-        run.setState(step, diagnostics.length === 0 ? "succeeded" : "failed", {
-            checks: Object.fromEntries(results),
+        const propagationPending = [...results.values()].some((result) => result.propagationPending);
+        const failed = [...results.values()].some((result) => !result.ok && !result.propagationPending);
+        run.setState(step, failed ? "failed" : propagationPending ? "propagation_pending" : "succeeded", {
+            checks: Object.fromEntries([...results].map(([id, result]) => [id, result.status])),
+            propagation_wait_ms: propagationWaitMs,
         });
-        return { ok: diagnostics.length === 0, results, diagnostics };
+        return {
+            ok: !failed && !propagationPending,
+            propagationPending,
+            results,
+            diagnostics,
+            warnings,
+            nextAction,
+            propagationWaitMs,
+        };
     }
     async #ensureAllowance(run, opts = { fund: false }) {
         const status = await this.sdk.allowance.status();
@@ -1339,6 +1530,51 @@ export class NodeActions {
         }
         throw run.error("No project is configured for this workspace. Pass --project, add project_id to the manifest, or pass --name to create one.", "RUN402_PROJECT_REQUIRED", { link_path: linkPath, manifest_path: manifest.manifestPath });
     }
+    async #resolveProjectForVerify(input, manifest, workspaceDir, run) {
+        const linkPath = join(workspaceDir, ".run402", "project.json");
+        const link = await readWorkspaceProjectLink(linkPath);
+        const step = run.addStep({
+            action: "project.resolve",
+            description: "Resolve project for app verification",
+            mutation: false,
+            auto: true,
+            details: {
+                explicit_project_id: input.projectId ?? null,
+                linked_project_id: link?.project_id ?? null,
+                manifest_project_id: manifest.manifestProjectId ?? manifest.appSpec?.project.id ?? null,
+                verify_only: true,
+            },
+        });
+        run.setState(step, "running");
+        const projectId = input.projectId ?? link?.project_id ?? manifest.manifestProjectId ?? manifest.appSpec?.project.id ?? await this.sdk.projects.active();
+        if (!projectId) {
+            throw run.error("`run402 up verify` needs an existing project. Pass --project, keep .run402/project.json, add project.id to run402.json, or select an active project.", "RUN402_PROJECT_REQUIRED", { link_path: linkPath, manifest_path: manifest.manifestPath, verify_only: true });
+        }
+        run.setState(step, "succeeded", {
+            project_id: projectId,
+            source: input.projectId
+                ? "explicit"
+                : link?.project_id
+                    ? "workspace_link"
+                    : manifest.manifestProjectId ?? manifest.appSpec?.project.id
+                        ? "manifest"
+                        : "active",
+            link_path: linkPath,
+        });
+        return {
+            projectId,
+            source: input.projectId
+                ? "explicit"
+                : link?.project_id
+                    ? "workspace_link"
+                    : manifest.manifestProjectId ?? manifest.appSpec?.project.id
+                        ? "manifest"
+                        : "active",
+            link,
+            linkPath,
+            shouldWriteLink: false,
+        };
+    }
     async #findNameCollision(name, orgId) {
         const result = await this.sdk.projects.list(orgId ? { org: orgId } : {});
         const normalized = name.trim().toLowerCase();
@@ -1582,6 +1818,204 @@ function markAppGraphNodes(graph, status) {
         node.status = status;
     }
 }
+function markAppGraphNodesForVerify(graph, verification) {
+    const terminal = verification.ok || verification.propagationPending ? "succeeded" : "failed";
+    markAppGraphNodes(graph, terminal);
+    for (const node of graph.nodes) {
+        if (node.kind !== "verify.http")
+            continue;
+        const id = node.id.replace(/^verify\.http\./, "");
+        const result = verification.results.get(id);
+        if (!result)
+            continue;
+        node.status = result.ok
+            ? "succeeded"
+            : result.propagationPending
+                ? "propagation_pending"
+                : "failed";
+    }
+}
+function appVerifyResult(verification) {
+    return {
+        status: verification.ok
+            ? "verified"
+            : verification.propagationPending
+                ? "propagation_pending"
+                : "failed",
+        warnings: verification.warnings,
+        next_action: verification.nextAction,
+        propagation_wait_ms: verification.propagationWaitMs,
+    };
+}
+function propagationBudgetMs(input) {
+    const seconds = input.propagationBudgetSeconds ?? DEFAULT_PROPAGATION_BUDGET_SECONDS;
+    if (!Number.isFinite(seconds) || seconds < 0)
+        return DEFAULT_PROPAGATION_BUDGET_SECONDS * 1000;
+    return Math.floor(seconds * 1000);
+}
+async function fetchAppVerifyUrl(url) {
+    try {
+        const res = await fetch(url, { method: "GET" });
+        const text = await res.text().catch(() => "");
+        return {
+            status: res.status,
+            edgeCode: edgeCodeFromBody(text),
+            edgeHeader: res.headers.get("x-run402-edge"),
+            error: null,
+        };
+    }
+    catch (err) {
+        return {
+            status: null,
+            edgeCode: null,
+            edgeHeader: null,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+function edgeCodeFromBody(text) {
+    if (!text || text.length > 4096)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        const code = typeof parsed.code === "string"
+            ? parsed.code
+            : typeof parsed.error?.code === "string"
+                ? parsed.error.code
+                : null;
+        return code && VERIFY_SENTINEL_CODES.has(code) ? code : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function classifyAppVerifyAttempt(input) {
+    if (input.attempt.status === input.check.expect.status) {
+        return { kind: "success" };
+    }
+    const host = hostnameFromUrl(input.url);
+    const freshness = host ? freshnessForHost(input.context, host) : { fresh: false, ageSeconds: null };
+    if (freshness.fresh &&
+        (input.attempt.edgeCode !== null ||
+            input.attempt.edgeHeader === "kvs-miss" ||
+            input.attempt.edgeHeader === "kv-miss")) {
+        return {
+            kind: "propagating",
+            reason: input.attempt.edgeCode ?? input.attempt.edgeHeader ?? "edge_miss",
+            bindingAgeSeconds: freshness.ageSeconds,
+        };
+    }
+    const diagnosis = await diagnoseAppVerifyFailure(input.context, input.url, input.check);
+    const edge = diagnosis?.edge_propagation ?? null;
+    if (edge && edge.status !== "settled") {
+        return {
+            kind: "propagating",
+            reason: edge.status,
+            bindingAgeSeconds: bindingAgeSeconds(edge.claimed_at),
+            edge,
+            diagnosis,
+        };
+    }
+    return { kind: "failed", diagnosis };
+}
+async function diagnoseAppVerifyFailure(context, url, check) {
+    if (!context.resolve)
+        return null;
+    try {
+        return await context.resolve({
+            project: context.projectId,
+            url,
+            method: "GET",
+        });
+    }
+    catch {
+        try {
+            return await context.resolve({
+                project: context.projectId,
+                url,
+                method: String(check.expect.status) === "405" ? "POST" : "GET",
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function propagationWarning(checkId, url, classification, remainingMs) {
+    const edge = classification.edge;
+    const visibleBy = edge?.expected_visible_by ? ` Expected visible by ${edge.expected_visible_by}.` : "";
+    const reason = classification.reason ?? edge?.status ?? "edge_propagation";
+    return {
+        code: "VERIFY_PROPAGATION_PENDING",
+        severity: "warning",
+        node_id: `verify.http.${checkId}`,
+        message: `HTTP verification ${checkId} is waiting on edge propagation for ${url} (${reason}).${visibleBy}`,
+        details: {
+            url,
+            reason,
+            binding_age_s: classification.bindingAgeSeconds ?? null,
+            typical_s: EDGE_PROPAGATION_TYPICAL_SECONDS,
+            budget_remaining_s: Math.ceil(Math.max(0, remainingMs) / 1000),
+            edge_propagation: edge ?? null,
+        },
+    };
+}
+function verifyNextAction() {
+    return {
+        type: "retry_verify",
+        code: "VERIFY_PROPAGATION_PENDING",
+        message: "Rerun app verification after edge propagation settles.",
+        command: "run402 up verify",
+        argv: ["run402", "up", "verify"],
+    };
+}
+function propagationBackoffMs(attempt) {
+    const base = Math.min(10_000, 1_000 * 2 ** Math.min(4, attempt - 1));
+    const jitter = Math.floor(Math.random() * 250);
+    return base + jitter;
+}
+function hostnameFromUrl(url) {
+    try {
+        return new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function freshnessForHost(context, host) {
+    const normalized = host.toLowerCase();
+    const binding = context.bindings.find((candidate) => candidate.host.toLowerCase() === normalized);
+    const ageSeconds = binding ? bindingAgeSeconds(binding.claimed_at) : null;
+    if (context.claimedHosts.has(normalized))
+        return { fresh: true, ageSeconds };
+    if (ageSeconds === null)
+        return { fresh: false, ageSeconds: null };
+    return { fresh: ageSeconds * 1000 < EDGE_PROPAGATION_FRESH_WINDOW_MS, ageSeconds };
+}
+function bindingAgeSeconds(claimedAtIso) {
+    if (!claimedAtIso)
+        return null;
+    const ms = Date.parse(claimedAtIso);
+    if (!Number.isFinite(ms))
+        return null;
+    return Math.max(0, Math.floor((Date.now() - ms) / 1000));
+}
+function claimedHostsFromRelease(spec, publicOrigin) {
+    const hosts = new Set();
+    const subdomains = spec.subdomains;
+    for (const value of [...arrayOfStrings(subdomains?.set), ...arrayOfStrings(subdomains?.add)]) {
+        hosts.add(`${value}.run402.com`.toLowerCase());
+    }
+    if (publicOrigin) {
+        const host = hostnameFromUrl(publicOrigin);
+        if (host)
+            hosts.add(host);
+    }
+    return hosts;
+}
+function arrayOfStrings(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
 function applyResourceStateToAppResult(appResult, resources) {
     for (const [name, mailbox] of Object.entries(resources.mailboxes)) {
         if (!appResult.resources.mailboxes[name])