run402 1.69.2 → 1.69.3

package/README.md

@@ -130,7 +130,7 @@ import { db, adminDb, getUser, email, ai } from "@run402/functions";
 
 ### Same-origin web routes
 
-`run402 deploy apply` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
+`run402 deploy apply` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
 
 ### Secrets
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "1.69.2",
+  "version": "1.69.3",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/type-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-contract.d.ts","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AA0KA,OAAO,EAAE,CAAC"}
+{"version":3,"file":"type-contract.d.ts","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AA0LA,OAAO,EAAE,CAAC"}

package/sdk/dist/type-contract.js

@@ -16,11 +16,19 @@ const _KnownRouteResolveLiteral = "route_function";
 const _KnownRouteStaticAliasResolveLiteral = "route_static_alias";
 const _KnownRouteMethodMissResolveLiteral = "route_method_miss";
 const _KnownActiveReleaseMissingResolveLiteral = "active_release_missing";
+const _KnownUnsupportedManifestResolveLiteral = "unsupported_manifest_version";
 const _FutureResolveMatch = "future_gateway_match";
 const _KnownResolveAuthorizationResult = "missing_cas_object";
+const _KnownUnsupportedManifestAuthorizationResult = "unsupported_manifest_version";
 const _FutureResolveAuthorizationResult = "future_authorization_result";
+const _KnownActiveReleaseMissingFallbackState = "active_release_missing";
+const _KnownUnsupportedManifestFallbackState = "unsupported_manifest_version";
+const _KnownNegativeCacheHitFallbackState = "negative_cache_hit";
+const _FutureResolveFallbackState = "future_fallback_state";
 // @ts-expect-error unknown literals are not part of the known authorization-result union
 const _NoUnknownKnownResolveAuthorizationResult = "future_authorization_result";
+// @ts-expect-error unknown literals are not part of the known fallback-state union
+const _NoUnknownKnownResolveFallbackState = "future_fallback_state";
 // @ts-expect-error implicit mode cannot carry a replace map
 const _NoImplicitPublicPathReplace = {
     mode: "implicit",
@@ -32,8 +40,14 @@ void _KnownRouteResolveLiteral;
 void _KnownRouteStaticAliasResolveLiteral;
 void _KnownRouteMethodMissResolveLiteral;
 void _KnownActiveReleaseMissingResolveLiteral;
+void _KnownUnsupportedManifestResolveLiteral;
 void _FutureResolveMatch;
 void _KnownResolveAuthorizationResult;
+void _KnownUnsupportedManifestAuthorizationResult;
 void _FutureResolveAuthorizationResult;
+void _KnownActiveReleaseMissingFallbackState;
+void _KnownUnsupportedManifestFallbackState;
+void _KnownNegativeCacheHitFallbackState;
+void _FutureResolveFallbackState;
 export {};
 //# sourceMappingURL=type-contract.js.map

package/sdk/dist/type-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"type-contract.js","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AAoHA,MAAM,wBAAwB,GAAyB;IACrD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;CACtE,CAAC;AACF,MAAM,uBAAuB,GAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC3E,MAAM,mBAAmB,GAAwB;IAC/C,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;CAChD,CAAC;AACF,KAAK,wBAAwB,CAAC;AAC9B,KAAK,uBAAuB,CAAC;AAC7B,KAAK,mBAAmB,CAAC;AACzB,KAAM,IAA2C,CAAC;AAClD,KAAM,IAA8C,CAAC;AACrD,KAAM,IAAgD,CAAC;AAgBvD,MAAM,yBAAyB,GAA4B,gBAAgB,CAAC;AAC5E,MAAM,oCAAoC,GAA4B,oBAAoB,CAAC;AAC3F,MAAM,mCAAmC,GAA4B,mBAAmB,CAAC;AACzF,MAAM,wCAAwC,GAA4B,wBAAwB,CAAC;AACnG,MAAM,mBAAmB,GAAuB,sBAAsB,CAAC;AACvE,MAAM,gCAAgC,GAA0C,oBAAoB,CAAC;AACrG,MAAM,iCAAiC,GAAqC,6BAA6B,CAAC;AAC1G,yFAAyF;AACzF,MAAM,yCAAyC,GAA0C,6BAA6B,CAAC;AACvH,4DAA4D;AAC5D,MAAM,4BAA4B,GAAwB;IACxD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;CACjD,CAAC;AAEF,KAAM,IAA0C,CAAC;AACjD,KAAM,IAAsC,CAAC;AAC7C,KAAK,yBAAyB,CAAC;AAC/B,KAAK,oCAAoC,CAAC;AAC1C,KAAK,mCAAmC,CAAC;AACzC,KAAK,wCAAwC,CAAC;AAC9C,KAAK,mBAAmB,CAAC;AACzB,KAAK,gCAAgC,CAAC;AACtC,KAAK,iCAAiC,CAAC"}
+{"version":3,"file":"type-contract.js","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AAsHA,MAAM,wBAAwB,GAAyB;IACrD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;CACtE,CAAC;AACF,MAAM,uBAAuB,GAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC3E,MAAM,mBAAmB,GAAwB;IAC/C,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;CAChD,CAAC;AACF,KAAK,wBAAwB,CAAC;AAC9B,KAAK,uBAAuB,CAAC;AAC7B,KAAK,mBAAmB,CAAC;AACzB,KAAM,IAA2C,CAAC;AAClD,KAAM,IAA8C,CAAC;AACrD,KAAM,IAAgD,CAAC;AAgBvD,MAAM,yBAAyB,GAA4B,gBAAgB,CAAC;AAC5E,MAAM,oCAAoC,GAA4B,oBAAoB,CAAC;AAC3F,MAAM,mCAAmC,GAA4B,mBAAmB,CAAC;AACzF,MAAM,wCAAwC,GAA4B,wBAAwB,CAAC;AACnG,MAAM,uCAAuC,GAA4B,8BAA8B,CAAC;AACxG,MAAM,mBAAmB,GAAuB,sBAAsB,CAAC;AACvE,MAAM,gCAAgC,GAA0C,oBAAoB,CAAC;AACrG,MAAM,4CAA4C,GAA0C,8BAA8B,CAAC;AAC3H,MAAM,iCAAiC,GAAqC,6BAA6B,CAAC;AAC1G,MAAM,uCAAuC,GAAoC,wBAAwB,CAAC;AAC1G,MAAM,sCAAsC,GAAoC,8BAA8B,CAAC;AAC/G,MAAM,mCAAmC,GAAoC,oBAAoB,CAAC;AAClG,MAAM,2BAA2B,GAA+B,uBAAuB,CAAC;AACxF,yFAAyF;AACzF,MAAM,yCAAyC,GAA0C,6BAA6B,CAAC;AACvH,mFAAmF;AACnF,MAAM,mCAAmC,GAAoC,uBAAuB,CAAC;AACrG,4DAA4D;AAC5D,MAAM,4BAA4B,GAAwB;IACxD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;CACjD,CAAC;AAEF,KAAM,IAA0C,CAAC;AACjD,KAAM,IAAsC,CAAC;AAC7C,KAAK,yBAAyB,CAAC;AAC/B,KAAK,oCAAoC,CAAC;AAC1C,KAAK,mCAAmC,CAAC;AACzC,KAAK,wCAAwC,CAAC;AAC9C,KAAK,uCAAuC,CAAC;AAC7C,KAAK,mBAAmB,CAAC;AACzB,KAAK,gCAAgC,CAAC;AACtC,KAAK,4CAA4C,CAAC;AAClD,KAAK,iCAAiC,CAAC;AACvC,KAAK,uCAAuC,CAAC;AAC7C,KAAK,sCAAsC,CAAC;AAC5C,KAAK,mCAAmC,CAAC;AACzC,KAAK,2BAA2B,CAAC"}