run402 1.60.1 → 1.60.3

package/lib/deploy-v2.mjs

@@ -24,8 +24,8 @@
  */
 
 import { readFileSync } from "node:fs";
-import { resolve, dirname, isAbsolute, join } from "node:path";
-import { githubActionsCredentials } from "#sdk/node";
+import { resolve, dirname, isAbsolute } from "node:path";
+import { githubActionsCredentials, normalizeDeployManifest } from "#sdk/node";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { API, allowanceAuthHeaders, getActiveProjectId, resolveProjectId } from "./config.mjs";
@@ -206,11 +206,12 @@ async function applyCmd(args) {
   }
 
   let raw;
+  let manifestPath = null;
   if (opts.spec) {
     raw = opts.spec;
   } else if (opts.manifest) {
     try {
-      const manifestPath = isAbsolute(opts.manifest) ? opts.manifest : resolve(process.cwd(), opts.manifest);
+      manifestPath = isAbsolute(opts.manifest) ? opts.manifest : resolve(process.cwd(), opts.manifest);
       raw = readFileSync(manifestPath, "utf-8");
     } catch (err) {
       fail({
@@ -235,7 +236,7 @@ async function applyCmd(args) {
   }
   rejectLegacySecretManifest(spec, {
     source: opts.manifest ? "manifest" : opts.spec ? "spec" : "stdin",
-    ...(opts.manifest ? { path: resolve(opts.manifest) } : {}),
+    ...(manifestPath ? { path: manifestPath } : {}),
   });
 
   // GH-232: Reject empty specs client-side. Without this guard,
@@ -269,38 +270,44 @@ async function applyCmd(args) {
       hint: "Did you mean to write a 'site.replace' or 'database.migrations' block? See https://run402.com/schemas/manifest.v1.json",
       details: {
         field: opts.manifest ? "manifest" : opts.spec ? "spec" : "stdin",
-        ...(opts.manifest ? { path: resolve(opts.manifest) } : {}),
+        ...(manifestPath ? { path: manifestPath } : {}),
         meaningful_keys: meaningful,
       },
     });
   }
 
-  if (opts.manifest) resolveFileDataPaths(spec, dirname(resolve(opts.manifest)));
-
-  if (opts.project && spec.project_id && spec.project_id !== opts.project) {
+  const manifestProject = spec.project ?? spec.project_id;
+  if (opts.project && manifestProject && manifestProject !== opts.project) {
     fail({
       code: "BAD_USAGE",
-      message: `project_id conflict: spec.project_id=${spec.project_id} but --project=${opts.project}`,
-      details: { spec_project_id: spec.project_id, flag_project_id: opts.project },
+      message: `project_id conflict: manifest project=${manifestProject} but --project=${opts.project}`,
+      details: { spec_project_id: manifestProject, flag_project_id: opts.project },
     });
   }
-  if (opts.project) spec.project_id = opts.project;
   const useGithubActionsOidc = hasGithubActionsOidcEnv();
-  if (!spec.project_id) {
-    spec.project_id = useGithubActionsOidc ? resolveCiProjectId() : resolveProjectId(null);
+  let defaultProject;
+  if (!opts.project && !manifestProject) {
+    defaultProject = useGithubActionsOidc ? resolveCiProjectId() : resolveProjectId(null);
+  }
+
+  let normalizedManifest;
+  try {
+    normalizedManifest = await normalizeDeployManifest(spec, {
+      baseDir: manifestPath ? dirname(manifestPath) : process.cwd(),
+      ...(opts.project ? { project: opts.project } : {}),
+      ...(defaultProject ? { defaultProject } : {}),
+    });
+  } catch (err) {
+    reportSdkError(err);
   }
 
-  // Translate { project_id, ... } envelope → ReleaseSpec ({ project, ... })
-  // The SDK ReleaseSpec uses `project` rather than `project_id`; both shapes
-  // are accepted at the manifest layer (project_id is friendlier for agents
-  // sharing JSON manifests with the MCP tool).
-  const releaseSpec = mapManifestToReleaseSpec(spec);
-  const idempotencyKey = spec.idempotency_key;
+  const releaseSpec = normalizedManifest.spec;
+  const idempotencyKey = normalizedManifest.idempotencyKey;
 
   let sdkOpts;
   if (useGithubActionsOidc) {
     sdkOpts = {
-      credentials: githubActionsCredentials({ projectId: spec.project_id, apiBase: API }),
+      credentials: githubActionsCredentials({ projectId: releaseSpec.project, apiBase: API }),
       disablePaidFetch: true,
     };
   } else {
@@ -668,174 +675,3 @@ function parsePositiveInt(value, flag) {
   }
   return parsed;
 }
-
-// ─── Manifest → ReleaseSpec ──────────────────────────────────────────────────
-
-function mapManifestToReleaseSpec(spec) {
-  const out = { project: spec.project_id };
-  if (spec.base !== undefined) out.base = spec.base;
-  if (spec.subdomains !== undefined) out.subdomains = spec.subdomains;
-  if (spec.secrets !== undefined) out.secrets = spec.secrets;
-  if (spec.routes !== undefined) out.routes = spec.routes;
-  if (spec.checks !== undefined) out.checks = spec.checks;
-
-  if (spec.database) {
-    out.database = {};
-    if (spec.database.expose !== undefined) out.database.expose = spec.database.expose;
-    if (spec.database.zero_downtime !== undefined) out.database.zero_downtime = spec.database.zero_downtime;
-    if (spec.database.migrations) {
-      out.database.migrations = spec.database.migrations.map((m) => {
-        const mm = { id: m.id };
-        if (m.sql !== undefined) mm.sql = m.sql;
-        if (m.sql_ref !== undefined) mm.sql_ref = m.sql_ref;
-        if (m.checksum !== undefined) mm.checksum = m.checksum;
-        if (m.transaction !== undefined) mm.transaction = m.transaction;
-        return mm;
-      });
-    }
-  }
-
-  if (spec.functions) {
-    out.functions = {};
-    if (spec.functions.replace) out.functions.replace = mapFunctionMap(spec.functions.replace);
-    if (spec.functions.patch) {
-      out.functions.patch = {};
-      if (spec.functions.patch.set) out.functions.patch.set = mapFunctionMap(spec.functions.patch.set);
-      if (spec.functions.patch.delete) out.functions.patch.delete = spec.functions.patch.delete;
-    }
-  }
-
-  if (spec.site) {
-    if (spec.site.replace) {
-      out.site = { replace: mapFileMap(spec.site.replace) };
-    } else if (spec.site.patch) {
-      const patch = {};
-      if (spec.site.patch.put) patch.put = mapFileMap(spec.site.patch.put);
-      if (spec.site.patch.delete) patch.delete = spec.site.patch.delete;
-      out.site = { patch };
-    }
-  }
-
-  return out;
-}
-
-function mapFunctionMap(map) {
-  const out = {};
-  for (const [name, fn] of Object.entries(map)) {
-    const f = {};
-    if (fn.runtime) f.runtime = fn.runtime;
-    if (fn.source !== undefined) f.source = fileEntryToContentSource(fn.source);
-    if (fn.files) f.files = mapFileMap(fn.files);
-    if (fn.entrypoint !== undefined) f.entrypoint = fn.entrypoint;
-    if (fn.config !== undefined) f.config = fn.config;
-    if (fn.schedule !== undefined) f.schedule = fn.schedule;
-    out[name] = f;
-  }
-  return out;
-}
-
-function mapFileMap(map) {
-  const out = {};
-  for (const [path, entry] of Object.entries(map)) {
-    out[path] = fileEntryToContentSource(entry);
-  }
-  return out;
-}
-
-function fileEntryToContentSource(entry) {
-  if (entry === null || entry === undefined) return entry;
-  if (typeof entry === "string") return entry;
-  if (entry instanceof Uint8Array) return entry;
-  if (typeof entry === "object") {
-    if (entry.encoding === "base64" && typeof entry.data === "string") {
-      const bytes = Buffer.from(entry.data, "base64");
-      const u8 = new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-      return entry.contentType ? { data: u8, contentType: entry.contentType } : u8;
-    }
-    if (typeof entry.data === "string") {
-      return entry.contentType ? { data: entry.data, contentType: entry.contentType } : entry.data;
-    }
-    // Pre-resolved ContentRef shape — pass through.
-    if (typeof entry.sha256 === "string" && typeof entry.size === "number") {
-      return entry;
-    }
-  }
-  return entry;
-}
-
-/**
- * Resolve any `{ "path": "..." }` entries in the manifest to inline data.
- * Mirrors the legacy deploy.mjs behavior so `run402 deploy apply` accepts
- * the same files-with-paths shape that `run402 deploy` does today.
- */
-function resolveFileDataPaths(spec, baseDir) {
-  // Site files
-  if (spec.site?.replace) resolveMap(spec.site.replace, baseDir);
-  if (spec.site?.patch?.put) resolveMap(spec.site.patch.put, baseDir);
-  // Function files
-  const visitFns = (fnMap) => {
-    if (!fnMap) return;
-    for (const fn of Object.values(fnMap)) {
-      if (fn.source && typeof fn.source === "object" && fn.source.path) {
-        const resolved = readFileEntry(fn.source, baseDir);
-        if (resolved) fn.source = resolved;
-      }
-      if (fn.files) resolveMap(fn.files, baseDir);
-    }
-  };
-  visitFns(spec.functions?.replace);
-  visitFns(spec.functions?.patch?.set);
-  // Migration sql_path / sql_file
-  if (spec.database?.migrations) {
-    for (const m of spec.database.migrations) {
-      if (!m.sql && m.sql_path) {
-        try {
-          const p = isAbsolute(m.sql_path) ? m.sql_path : join(baseDir, m.sql_path);
-          m.sql = readFileSync(p, "utf-8");
-          delete m.sql_path;
-        } catch (err) {
-          fail({
-            code: "BAD_USAGE",
-            message: `Failed to read migration sql_path '${m.sql_path}': ${err.message}`,
-            details: { migration_id: m.id, sql_path: m.sql_path },
-          });
-        }
-      }
-    }
-  }
-}
-
-function resolveMap(map, baseDir) {
-  for (const [key, entry] of Object.entries(map)) {
-    if (entry && typeof entry === "object" && typeof entry.path === "string" && entry.data === undefined) {
-      const resolved = readFileEntry(entry, baseDir);
-      if (resolved) map[key] = resolved;
-    }
-  }
-}
-
-function readFileEntry(entry, baseDir) {
-  try {
-    const p = isAbsolute(entry.path) ? entry.path : join(baseDir, entry.path);
-    const buf = readFileSync(p);
-    const out = {};
-    // Detect text vs binary via simple UTF-8 round-trip; mirrors the bundle
-    // deploy behavior. Image/font types get base64; HTML/CSS/JS stay UTF-8.
-    const looksTextual = !entry.contentType?.match(/^(image|font|application\/(pdf|wasm|octet-stream|zip))/);
-    if (looksTextual) {
-      out.data = buf.toString("utf-8");
-      out.encoding = "utf-8";
-    } else {
-      out.data = buf.toString("base64");
-      out.encoding = "base64";
-    }
-    if (entry.contentType) out.contentType = entry.contentType;
-    return out;
-  } catch (err) {
-    fail({
-      code: "BAD_USAGE",
-      message: `Failed to read file '${entry.path}': ${err.message}`,
-      details: { path: entry.path },
-    });
-  }
-}

package/lib/deploy.mjs

@@ -4,6 +4,7 @@ import { resolveProjectId } from "./config.mjs";
 import { resolveFilePathsInManifest, resolveMigrationsFile } from "./manifest.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { normalizeDeployManifest } from "#sdk/node";
 
 const HELP = `run402 deploy — Deploy to an existing project on Run402
 
@@ -347,10 +348,26 @@ export async function run(args) {
     manifest.project_id = resolveProjectId(null);
   }
 
-  // Strip fields that aren't part of the bundleDeploy contract.
   const projectId = manifest.project_id;
-  delete manifest.project_id;
   delete manifest.name;
+
+  if (isV2Manifest(manifest)) {
+    try {
+      const normalized = await normalizeDeployManifest(manifest, {
+        baseDir: opts.manifest ? dirname(resolve(opts.manifest)) : process.cwd(),
+      });
+      const result = await getSdk().deploy.apply(normalized.spec, {
+        idempotencyKey: normalized.idempotencyKey,
+      });
+      console.log(JSON.stringify({ project_id: projectId, ...result }, null, 2));
+    } catch (err) {
+      reportSdkError(err);
+    }
+    return;
+  }
+
+  // Strip fields that aren't part of the bundleDeploy contract.
+  delete manifest.project_id;
   delete manifest.migrations_file;
 
   try {
@@ -360,3 +377,19 @@ export async function run(args) {
     reportSdkError(err);
   }
 }
+
+function isV2Manifest(manifest) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) return false;
+  if (manifest.database !== undefined) return true;
+  if (manifest.site !== undefined) return true;
+  if (manifest.subdomains !== undefined) return true;
+  if (manifest.routes !== undefined) return true;
+  if (manifest.checks !== undefined) return true;
+  if (manifest.secrets && typeof manifest.secrets === "object" && !Array.isArray(manifest.secrets)) {
+    return true;
+  }
+  if (manifest.functions && typeof manifest.functions === "object" && !Array.isArray(manifest.functions)) {
+    return true;
+  }
+  return false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "1.60.1",
+  "version": "1.60.3",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/deploy.js

@@ -764,6 +764,43 @@ async function startInternal(client, spec, opts) {
         },
     };
 }
+const RELEASE_SPEC_FIELDS = new Set([
+    "project",
+    "base",
+    "database",
+    "secrets",
+    "functions",
+    "site",
+    "subdomains",
+    "routes",
+    "checks",
+]);
+const DEPLOYABLE_SPEC_FIELDS = [
+    "database",
+    "site",
+    "functions",
+    "secrets",
+    "subdomains",
+    "routes",
+    "checks",
+];
+const BASE_SPEC_FIELDS = new Set(["release", "release_id"]);
+const DATABASE_SPEC_FIELDS = new Set(["migrations", "expose", "zero_downtime"]);
+const MIGRATION_SPEC_FIELDS = new Set(["id", "checksum", "sql", "sql_ref", "transaction"]);
+const FUNCTIONS_SPEC_FIELDS = new Set(["replace", "patch"]);
+const FUNCTIONS_PATCH_FIELDS = new Set(["set", "delete"]);
+const FUNCTION_SPEC_FIELDS = new Set([
+    "runtime",
+    "source",
+    "files",
+    "entrypoint",
+    "config",
+    "schedule",
+]);
+const FUNCTION_CONFIG_FIELDS = new Set(["timeoutSeconds", "memoryMb"]);
+const SITE_SPEC_FIELDS = new Set(["replace", "patch"]);
+const SITE_PATCH_FIELDS = new Set(["put", "delete"]);
+const SUBDOMAINS_SPEC_FIELDS = new Set(["set", "add", "remove"]);
 function validateSpec(spec) {
     if (!spec || typeof spec !== "object") {
         throw new Run402DeployError("ReleaseSpec must be an object", {
@@ -775,6 +812,11 @@ function validateSpec(spec) {
             context: "validating spec",
         });
     }
+    const raw = spec;
+    validateKnownFields(raw, "spec", RELEASE_SPEC_FIELDS, {
+        project_id: "Use `project` in ReleaseSpec, or call `loadDeployManifest()` / `normalizeDeployManifest()` for MCP/CLI-style manifests.",
+        subdomain: "Use `subdomains: { set: [name] }`.",
+    });
     if (!spec.project || typeof spec.project !== "string") {
         throw new Run402DeployError("ReleaseSpec.project is required", {
             code: "INVALID_SPEC",
@@ -785,7 +827,17 @@ function validateSpec(spec) {
             context: "validating spec",
         });
     }
-    if (spec.subdomains?.set && spec.subdomains.set.length > 1) {
+    validateBaseSpec(raw.base);
+    validateDatabaseSpec(raw.database);
+    validateFunctionsSpec(raw.functions);
+    validateSiteSpec(raw.site);
+    validateSubdomainsSpec(raw.subdomains);
+    validateRoutesSpec(raw.routes);
+    validateChecksSpec(raw.checks);
+    validateSecretsSpec(raw.secrets);
+    const subdomains = raw.subdomains;
+    const set = subdomains?.set;
+    if (set && set.length > 1) {
         throw new Run402DeployError("subdomains.set accepts at most one subdomain per project; multi-subdomain support is not yet available", {
             code: "SUBDOMAIN_MULTI_NOT_SUPPORTED",
             phase: "validate",
@@ -795,7 +847,211 @@ function validateSpec(spec) {
             context: "validating spec",
         });
     }
-    validateSecretsSpec(spec.secrets);
+    if (!hasDeployableContent(raw)) {
+        throw new Run402DeployError(`ReleaseSpec contains no deployable sections. Expected at least one non-empty section: ${DEPLOYABLE_SPEC_FIELDS.join(", ")}`, {
+            code: "MANIFEST_EMPTY",
+            phase: "validate",
+            resource: "spec",
+            retryable: false,
+            fix: { action: "set_field", path: "site.replace" },
+            body: { deployable_fields: DEPLOYABLE_SPEC_FIELDS },
+            context: "validating spec",
+        });
+    }
+}
+function validateBaseSpec(base) {
+    if (base === undefined)
+        return;
+    const obj = requireObject(base, "base");
+    validateKnownFields(obj, "base", BASE_SPEC_FIELDS);
+    if (hasOwn(obj, "release") && hasOwn(obj, "release_id")) {
+        throw invalidSpec("ReleaseSpec.base must use either release or release_id, not both", "base");
+    }
+}
+function validateDatabaseSpec(database) {
+    if (database === undefined)
+        return;
+    const obj = requireObject(database, "database");
+    validateKnownFields(obj, "database", DATABASE_SPEC_FIELDS);
+    if (obj.migrations !== undefined) {
+        if (!Array.isArray(obj.migrations)) {
+            throw invalidSpec("ReleaseSpec.database.migrations must be an array", "database.migrations");
+        }
+        for (const [index, migration] of obj.migrations.entries()) {
+            const m = requireObject(migration, `database.migrations.${index}`);
+            validateKnownFields(m, `database.migrations.${index}`, MIGRATION_SPEC_FIELDS);
+        }
+    }
+    if (obj.expose !== undefined) {
+        requireObject(obj.expose, "database.expose");
+    }
+}
+function validateFunctionsSpec(functions) {
+    if (functions === undefined)
+        return;
+    const obj = requireObject(functions, "functions");
+    validateKnownFields(obj, "functions", FUNCTIONS_SPEC_FIELDS);
+    if (obj.replace !== undefined) {
+        validateFunctionMap(obj.replace, "functions.replace");
+    }
+    if (obj.patch !== undefined) {
+        const patch = requireObject(obj.patch, "functions.patch");
+        validateKnownFields(patch, "functions.patch", FUNCTIONS_PATCH_FIELDS);
+        if (patch.set !== undefined)
+            validateFunctionMap(patch.set, "functions.patch.set");
+        if (patch.delete !== undefined)
+            validateStringArray(patch.delete, "functions.patch.delete");
+    }
+}
+function validateFunctionMap(value, resource) {
+    const map = requireObject(value, resource);
+    for (const [name, fn] of Object.entries(map)) {
+        const entry = requireObject(fn, `${resource}.${name}`);
+        validateKnownFields(entry, `${resource}.${name}`, FUNCTION_SPEC_FIELDS);
+        if (entry.config !== undefined) {
+            const config = requireObject(entry.config, `${resource}.${name}.config`);
+            validateKnownFields(config, `${resource}.${name}.config`, FUNCTION_CONFIG_FIELDS);
+        }
+        if (entry.files !== undefined) {
+            requireObject(entry.files, `${resource}.${name}.files`);
+        }
+    }
+}
+function validateSiteSpec(site) {
+    if (site === undefined)
+        return;
+    const obj = requireObject(site, "site");
+    validateKnownFields(obj, "site", SITE_SPEC_FIELDS, {
+        file: "Use `site.replace` or `site.patch.put` with a path-keyed file map.",
+        files: "Use `site.replace` or `site.patch.put` with a path-keyed file map.",
+    });
+    if (hasOwn(obj, "replace") && hasOwn(obj, "patch")) {
+        throw invalidSpec("ReleaseSpec.site must use either replace or patch, not both", "site");
+    }
+    if (obj.replace !== undefined) {
+        requireObject(obj.replace, "site.replace");
+    }
+    if (obj.patch !== undefined) {
+        const patch = requireObject(obj.patch, "site.patch");
+        validateKnownFields(patch, "site.patch", SITE_PATCH_FIELDS);
+        if (patch.put !== undefined)
+            requireObject(patch.put, "site.patch.put");
+        if (patch.delete !== undefined)
+            validateStringArray(patch.delete, "site.patch.delete");
+    }
+}
+function validateSubdomainsSpec(subdomains) {
+    if (subdomains === undefined)
+        return;
+    const obj = requireObject(subdomains, "subdomains");
+    validateKnownFields(obj, "subdomains", SUBDOMAINS_SPEC_FIELDS);
+    if (obj.set !== undefined)
+        validateStringArray(obj.set, "subdomains.set");
+    if (obj.add !== undefined)
+        validateStringArray(obj.add, "subdomains.add");
+    if (obj.remove !== undefined)
+        validateStringArray(obj.remove, "subdomains.remove");
+}
+function validateRoutesSpec(routes) {
+    if (routes === undefined)
+        return;
+    requireObject(routes, "routes");
+}
+function validateChecksSpec(checks) {
+    if (checks === undefined)
+        return;
+    if (!Array.isArray(checks)) {
+        throw invalidSpec("ReleaseSpec.checks must be an array", "checks");
+    }
+}
+function validateKnownFields(obj, resource, allowed, hints = {}) {
+    for (const key of Object.keys(obj)) {
+        if (allowed.has(key))
+            continue;
+        const field = resource === "spec" ? `spec.${key}` : `${resource}.${key}`;
+        const hint = hints[key] ? ` ${hints[key]}` : "";
+        throw invalidSpec(`Unknown ReleaseSpec field: ${field}.${hint}`, field);
+    }
+}
+function requireObject(value, resource) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw invalidSpec(`ReleaseSpec.${resource} must be an object`, resource);
+    }
+    return value;
+}
+function validateStringArray(value, resource) {
+    if (!Array.isArray(value)) {
+        throw invalidSpec(`ReleaseSpec.${resource} must be an array`, resource);
+    }
+    if (value.some((entry) => typeof entry !== "string")) {
+        throw invalidSpec(`ReleaseSpec.${resource} entries must be strings`, resource);
+    }
+}
+function hasDeployableContent(spec) {
+    return (hasDatabaseContent(spec.database) ||
+        hasSiteContent(spec.site) ||
+        hasFunctionsContent(spec.functions) ||
+        hasSecretsContent(spec.secrets) ||
+        hasSubdomainsContent(spec.subdomains) ||
+        hasRecordEntries(spec.routes) ||
+        hasArrayEntries(spec.checks));
+}
+function hasDatabaseContent(database) {
+    if (!isRecord(database))
+        return false;
+    return hasArrayEntries(database.migrations) || hasRecordEntries(database.expose);
+}
+function hasSiteContent(site) {
+    if (!isRecord(site))
+        return false;
+    if (hasRecordEntries(site.replace))
+        return true;
+    if (!isRecord(site.patch))
+        return false;
+    return hasRecordEntries(site.patch.put) || hasArrayEntries(site.patch.delete);
+}
+function hasFunctionsContent(functions) {
+    if (!isRecord(functions))
+        return false;
+    if (hasRecordEntries(functions.replace))
+        return true;
+    if (!isRecord(functions.patch))
+        return false;
+    return hasRecordEntries(functions.patch.set) || hasArrayEntries(functions.patch.delete);
+}
+function hasSecretsContent(secrets) {
+    if (!isRecord(secrets))
+        return false;
+    return hasArrayEntries(secrets.require) || hasArrayEntries(secrets.delete);
+}
+function hasSubdomainsContent(subdomains) {
+    if (!isRecord(subdomains))
+        return false;
+    return (hasArrayEntries(subdomains.set) ||
+        hasArrayEntries(subdomains.add) ||
+        hasArrayEntries(subdomains.remove));
+}
+function hasRecordEntries(value) {
+    return isRecord(value) && Object.keys(value).length > 0;
+}
+function hasArrayEntries(value) {
+    return Array.isArray(value) && value.length > 0;
+}
+function hasOwn(obj, key) {
+    return Object.prototype.hasOwnProperty.call(obj, key);
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function invalidSpec(message, resource) {
+    return new Run402DeployError(message, {
+        code: "INVALID_SPEC",
+        phase: "validate",
+        resource,
+        retryable: false,
+        fix: { action: "set_field", path: resource.replace(/^spec\./, "") },
+        context: "validating spec",
+    });
 }
 function normalizePlanResponse(plan) {
     const raw = plan;