run402 1.54.3 → 1.54.4

package/lib/argparse.mjs

@@ -1,3 +1,4 @@
+import { existsSync, statSync } from "node:fs";
 import { fail } from "./sdk-errors.mjs";
 import { resolveProjectId } from "./config.mjs";
 
@@ -143,6 +144,46 @@ export function validateWebhookUrl(url, fieldName = "--url") {
   }
 }
 
+/**
+ * Validate that a CLI flag pointing at a filesystem path resolves to an
+ * existing regular file. Replaces the GH-195 inline pattern that was
+ * duplicated across `functions deploy`, `secrets set`, `projects sql`,
+ * and `projects apply-expose` (GH-233).
+ *
+ * Without this guard, `readFileSync` against a missing path leaks a raw
+ * `node:fs` ENOENT/EISDIR stack to stderr (with the V8 source pointer),
+ * which violates the CLI's structured-error contract.
+ *
+ * No-op: this helper is meant to be called only when the flag is set.
+ * Callers handle the optional/required dichotomy themselves.
+ *
+ * On failure: `fail()` writes a `FILE_NOT_FOUND` or `NOT_A_FILE` envelope
+ * to stderr and exits 1.
+ *
+ * @param {string} path - The filesystem path captured from the flag.
+ * @param {string} fieldName - The flag name for the envelope (default "--file").
+ */
+export function validateRegularFile(path, fieldName = "--file") {
+  if (!existsSync(path)) {
+    fail({
+      code: "FILE_NOT_FOUND",
+      message: `File not found: ${path}`,
+      field: fieldName,
+      path,
+      hint: `Check that ${fieldName} points to an existing file.`,
+    });
+  }
+  const stat = statSync(path);
+  if (!stat.isFile()) {
+    fail({
+      code: "NOT_A_FILE",
+      message: `${fieldName} points to a ${stat.isDirectory() ? "directory" : "non-regular file"}: ${path}`,
+      field: fieldName,
+      path,
+    });
+  }
+}
+
 export function positionalArgs(args = [], flagsWithValues = []) {
   const valueFlags = new Set(flagsWithValues);
   const out = [];

package/lib/deploy-v2.mjs

@@ -166,6 +166,43 @@ async function applyCmd(args) {
     });
   }
 
+  // GH-232: Reject empty specs client-side. Without this guard,
+  // `run402 deploy apply --spec '{}'` (and `--manifest <empty>`) would silently
+  // send an empty ReleaseSpec to /deploy/v2/plans with no signal that nothing
+  // was deployed. This mirrors the GH-185 guard already in place for the
+  // legacy `run402 deploy --manifest` path.
+  //
+  // `deploy apply` is v2-only — only meaningful keys are the v2 ReleaseSpec
+  // shape (database, site, functions, secrets, subdomains, domains).
+  // For object-typed sections the "container is non-empty" check isn't enough
+  // — `site:{replace:{}}` has one key but ships nothing. We recurse one level
+  // so any object whose own values are all empty containers is still empty.
+  const meaningful = ["database", "site", "functions", "secrets", "subdomains", "domains"];
+  function hasContent(v) {
+    if (v == null) return false;
+    if (Array.isArray(v)) return v.length > 0;
+    if (typeof v === "object") {
+      const keys = Object.keys(v);
+      if (keys.length === 0) return false;
+      return keys.some((k) => hasContent(v[k]));
+    }
+    if (typeof v === "string") return v.length > 0;
+    return true;
+  }
+  const hasMeaningfulContent = spec && typeof spec === "object" && !Array.isArray(spec) && meaningful.some((key) => hasContent(spec[key]));
+  if (!hasMeaningfulContent) {
+    fail({
+      code: "MANIFEST_EMPTY",
+      message: `Manifest contains no deployable sections. Expected at least one of: ${meaningful.join(", ")}`,
+      hint: "Did you mean to write a 'site.replace' or 'database.migrations' block? See https://run402.com/schemas/manifest.v1.json",
+      details: {
+        field: opts.manifest ? "manifest" : opts.spec ? "spec" : "stdin",
+        ...(opts.manifest ? { path: resolve(opts.manifest) } : {}),
+        meaningful_keys: meaningful,
+      },
+    });
+  }
+
   if (opts.manifest) resolveFileDataPaths(spec, dirname(resolve(opts.manifest)));
 
   if (opts.project && spec.project_id && spec.project_id !== opts.project) {

package/lib/functions.mjs

@@ -1,8 +1,8 @@
-import { readFileSync, existsSync, statSync } from "fs";
+import { readFileSync } from "fs";
 import { findProject, API } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, hasHelp, normalizeArgv, parseIntegerFlag } from "./argparse.mjs";
+import { assertKnownFlags, hasHelp, normalizeArgv, parseIntegerFlag, validateRegularFile } from "./argparse.mjs";
 
 const HELP = `run402 functions — Manage serverless functions
 
@@ -181,24 +181,7 @@ async function deploy(projectId, name, args) {
   if (!opts.file) {
     fail({ code: "BAD_USAGE", message: "Missing --file <file>" });
   }
-  if (!existsSync(opts.file)) {
-    fail({
-      code: "FILE_NOT_FOUND",
-      message: `File not found: ${opts.file}`,
-      field: "--file",
-      path: opts.file,
-      hint: "Check that --file points to an existing source file.",
-    });
-  }
-  const stat = statSync(opts.file);
-  if (!stat.isFile()) {
-    fail({
-      code: "NOT_A_FILE",
-      message: `--file points to a ${stat.isDirectory() ? "directory" : "non-regular file"}: ${opts.file}`,
-      field: "--file",
-      path: opts.file,
-    });
-  }
+  validateRegularFile(opts.file, "--file");
   const code = readFileSync(opts.file, "utf-8");
 
   const deployOpts = { name, code };

package/lib/projects.mjs

@@ -2,7 +2,7 @@ import { readFileSync } from "fs";
 import { findProject, loadKeyStore, API, allowanceAuthHeaders, resolveProjectId, getActiveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail, parseFlagJson } from "./sdk-errors.mjs";
-import { assertKnownFlags, failBadProjectId, hasHelp, normalizeArgv, positionalArgs, resolvePositionalProject } from "./argparse.mjs";
+import { assertKnownFlags, failBadProjectId, hasHelp, normalizeArgv, positionalArgs, resolvePositionalProject, validateRegularFile } from "./argparse.mjs";
 
 const HELP = `run402 projects — Manage your deployed Run402 projects
 
@@ -175,13 +175,14 @@ async function provision(args) {
 }
 
 async function applyExpose(projectId, args = []) {
-  const p = findProject(projectId);
   let file = null;
   let inline = null;
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--file" && args[i + 1]) { file = args[++i]; }
     else if (!inline && !args[i].startsWith("--")) { inline = args[i]; }
   }
+  if (file) validateRegularFile(file, "--file");
+  const p = findProject(projectId);
   const raw = file ? readFileSync(file, "utf-8") : inline;
   if (!raw) {
     fail({
@@ -252,7 +253,6 @@ async function keys(projectId) {
 }
 
 async function sqlCmd(projectId, args = []) {
-  const p = findProject(projectId);
   let file = null;
   let query = null;
   let paramsRaw = null;
@@ -261,6 +261,8 @@ async function sqlCmd(projectId, args = []) {
     else if (args[i] === "--params" && args[i + 1]) { paramsRaw = args[++i]; }
     else if (!query && !args[i].startsWith("--")) { query = args[i]; }
   }
+  if (file) validateRegularFile(file, "--file");
+  const p = findProject(projectId);
   const sql = file ? readFileSync(file, "utf-8") : query;
   if (!sql) {
     fail({

package/lib/secrets.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from "fs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { validateRegularFile } from "./argparse.mjs";
 
 const HELP = `run402 secrets — Manage project secrets
 
@@ -82,6 +83,7 @@ async function set(projectId, key, args = []) {
     if (args[i] === "--file" && args[i + 1]) { file = args[++i]; }
     else if (!value && !args[i].startsWith("--")) { value = args[i]; }
   }
+  if (file) validateRegularFile(file, "--file");
   const val = file ? readFileSync(file, "utf-8") : value;
   if (!val) {
     fail({

package/lib/subdomains.mjs

@@ -10,7 +10,7 @@ Usage:
 Subcommands:
   claim  <name> [--project <id>] [--deployment <id>]   Claim a subdomain
   delete <name> --confirm [--project <id>]              Release a subdomain. Requires --confirm.
-  list   [<id>]                                         List subdomains for a project
+  list   [<id>] | list --project <id>                   List subdomains for a project
 
 Options default to the active project and its last deployment when omitted.
 Legacy syntax 'claim <deployment_id> <name>' is still supported.
@@ -151,8 +151,24 @@ async function deleteSubdomain(allArgs) {
   }
 }
 
-async function list(projectIdArg) {
-  const projectId = resolveProjectId(projectIdArg);
+function parseProjectFlag(args) {
+  let project = null;
+  const rest = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--project" && args[i + 1]) { project = args[++i]; }
+    else { rest.push(args[i]); }
+  }
+  return { project, rest };
+}
+
+async function list(args) {
+  const argList = Array.isArray(args) ? args : [];
+  const { project, rest } = parseProjectFlag(argList);
+  // Either --project <id> or a positional id is accepted; --project wins
+  // when both are supplied. Falls back to the active project when neither
+  // is given. Keeps backward-compat with the legacy `subdomains list <id>`
+  // form (GH-231; mirrors the GH-209 fix for `domains list`).
+  const projectId = resolveProjectId(project || rest[0]);
   try {
     const data = await getSdk().subdomains.list(projectId);
     console.log(JSON.stringify(data, null, 2));
@@ -177,7 +193,7 @@ export async function run(sub, args) {
       break;
     }
     case "delete": await deleteSubdomain(args); break;
-    case "list":   await list(args[0]); break;
+    case "list":   await list(args); break;
     default:
       console.error(`Unknown subcommand: ${sub}\n`);
       console.log(HELP);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "1.54.3",
+  "version": "1.54.4",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {