run402 4.106.1 → 4.107.1

package/README.md

@@ -253,7 +253,7 @@ import { db, adminDb, auth, email, ai } from "@run402/functions";
 
 ### Same-origin web routes
 
-`run402 deploy` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `site.embedding.frame_ancestors` (catalog keys, e.g. `["localhost"]`, never raw origins) lets the named embedders put the site in an iframe: the gateway sends `Content-Security-Policy: frame-ancestors http://localhost:* http://127.0.0.1:*` and drops `X-Frame-Options` on every response of the host; omitted on a later apply carries the previous declaration forward, `null` returns to deny, unknown keys fail `INVALID_SPEC` naming the valid ones, and `/_run402/config.json` discloses the effective policy cross-origin so an embedder can check before framing. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Recipe — static home page + SPA shell: a root alias `{ "pattern": "/", "target": { "type": "static", "file": "home.html" } }` (with `home.html` at the site root) serves real static bytes at `GET /` (`route_static_alias`) while unmatched app routes keep the `index.html` shell (`spa_fallback`); expect non-blocking `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn) / `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info) plan lints and verify with `run402 deploy resolve --url https://<your-site>/ --method GET`. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
+`run402 deploy` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `site.embedding.frame_ancestors` (catalog keys, e.g. `["localhost"]`, never raw origins) lets the named embedders put the site in an iframe: the gateway sends `Content-Security-Policy: frame-ancestors http://localhost:* http://127.0.0.1:*` and drops `X-Frame-Options` on every response of the host; omitted on a later apply carries the previous declaration forward, `null` returns to deny, unknown keys fail `INVALID_SPEC` naming the valid ones, and `/_run402/config.json` discloses the effective policy cross-origin so an embedder can check before framing. `site.sign_in_path` (e.g. `"/join"`) names the app's own same-origin sign-in page: a signed-out user reaching MCP authorization (`/_run402/oauth/authorize`) is sent there with `returnTo` appended instead of the hosted `/auth/sign-in`; omitted carries forward, `null` returns to the hosted page, and a value with a query/fragment, `//`, `://`, or a `/_run402/` or `/auth/` prefix fails `INVALID_SPEC` on `site.sign_in_path`. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Recipe — static home page + SPA shell: a root alias `{ "pattern": "/", "target": { "type": "static", "file": "home.html" } }` (with `home.html` at the site root) serves real static bytes at `GET /` (`route_static_alias`) while unmatched app routes keep the `index.html` shell (`spa_fallback`); expect non-blocking `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn) / `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info) plan lints and verify with `run402 deploy resolve --url https://<your-site>/ --method GET`. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
 
 ### Secrets
 

package/lib/functions.mjs

@@ -485,7 +485,10 @@ async function invoke(projectId, name, args) {
   }
   const invokeOpts = { method: opts.method };
   if (requestBody !== undefined && opts.method !== "GET" && opts.method !== "HEAD") {
+    // The body was validated as JSON above. Sent as a raw string it would go
+    // out as text/plain (run402-private#817), so say what it is.
     invokeOpts.body = requestBody;
+    invokeOpts.headers = { "content-type": "application/json" };
   }
   if (opts.idempotencyKey !== undefined) invokeOpts.idempotencyKey = opts.idempotencyKey;
   if (opts.wait) invokeOpts.wait = waitOpts;

package/lib/snapshots.mjs

@@ -15,24 +15,34 @@ import {
 const HELP = `run402 snapshots — Project database restore points
 
 Usage:
-  run402 snapshots create [--project <project_id>] [--json]
+  run402 snapshots create [--label <text>] [--metadata <json>] [--project <project_id>] [--json]
   run402 snapshots list [--project <project_id>] [--kind <kind>] [--limit <n>] [--after <cursor>] [--json]
   run402 snapshots get <snapshot_id> [--project <project_id>] [--json]
-  run402 snapshots restore <snapshot_id> [--project <project_id>] [--include-auth] [--confirm <token>] [--json]
+  run402 snapshots restore <snapshot_id> [--project <project_id>] [--release keep|snapshot] [--include-auth] [--confirm <token>] [--json]
+  run402 snapshots restore-status <snapshot_id> <restore_id> [--project <project_id>] [--json]
   run402 snapshots delete <snapshot_id> [--project <project_id>] [--json]
 
 Legacy (still supported): a leading prj_... positional selects the project,
 e.g. run402 snapshots restore prj_abc123 <snapshot_id>. --project defaults to
 the active project.
 
+--label (1-120 characters) and --metadata (a flat JSON object of string,
+number, boolean, or string-array values, up to 4 KB) are stored with the
+snapshot and survive restores. Never put secrets in metadata.
+
 Restore is a two-step handshake. First call without --confirm to get a
 restore_plan.confirm.token, then re-run with --confirm after reviewing the
-data-loss statement.
+data-loss statement. Pass the same --release and --include-auth both times.
+--release snapshot also puts back the release that was live when the snapshot
+was taken (site, routes, subdomains); the plan's release.warnings lists any
+function whose code does not roll back. The confirmed restore waits for the
+result; restore-status reads a restore by id.
 `;
 
-const FLAG_VALUES = ["--project", "--kind", "--limit", "--after", "--confirm"];
+const FLAG_VALUES = ["--project", "--kind", "--limit", "--after", "--confirm", "--label", "--metadata", "--release"];
 const FLAGS = new Set([...FLAG_VALUES, "--include-auth", "--json", "--help", "-h"]);
 const SNAPSHOT_KINDS = ["manual", "pre_migration", "pre_restore", "scheduled"];
+const RELEASE_MODES = ["keep", "snapshot"];
 
 export async function run(sub, args = []) {
   const all = [sub, ...args].filter(Boolean);
@@ -47,16 +57,48 @@ export async function run(sub, args = []) {
     case "list": return list(rest);
     case "get": return get(rest);
     case "restore": return restore(rest);
+    case "restore-status": return restoreStatus(rest);
     case "delete": return deleteSnapshot(rest);
     default:
       failUnknownSubcommand("snapshots", sub);
   }
 }
 
+function parseMetadataFlag(args) {
+  const raw = flagValue(args, "--metadata");
+  if (raw === null) return undefined;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    fail({
+      code: "BAD_FLAG",
+      message: `--metadata must be a JSON object: ${err instanceof Error ? err.message : String(err)}`,
+      details: { flag: "--metadata" },
+    });
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    fail({ code: "BAD_FLAG", message: "--metadata must be a JSON object", details: { flag: "--metadata" } });
+  }
+  return parsed;
+}
+
+function releaseFlag(args) {
+  const release = flagValue(args, "--release");
+  if (release === null) return undefined;
+  assertAllowedValue(release, RELEASE_MODES, "--release");
+  return release;
+}
+
 async function create(args) {
   const { projectId } = resolveProjectSelector(args, { valueFlags: FLAG_VALUES });
+  const label = flagValue(args, "--label") ?? undefined;
+  const metadata = parseMetadataFlag(args);
   try {
-    const snapshot = await getSdk().snapshots.create(projectId);
+    const snapshot = await getSdk().snapshots.create(projectId, {
+      ...(label !== undefined ? { label } : {}),
+      ...(metadata !== undefined ? { metadata } : {}),
+    });
     console.log(JSON.stringify({ ok: snapshot.status === "ready", snapshot }, null, 2));
   } catch (err) {
     reportSdkError(err);
@@ -94,26 +136,41 @@ async function get(args) {
 async function restore(args) {
   const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots restore [project_id] <snapshot_id> [--confirm <token>]");
   const includeAuth = args.includes("--include-auth");
+  const release = releaseFlag(args);
   const confirm = flagValue(args, "--confirm");
+  const opts = { includeAuth, ...(release !== undefined ? { release } : {}) };
   try {
     if (confirm) {
-      const result = await getSdk().snapshots.restore(projectId, snapshotId, confirm, { includeAuth });
+      const result = await getSdk().snapshots.restore(projectId, snapshotId, confirm, opts);
       console.log(JSON.stringify({ ok: result.status === "ready", restore: result }, null, 2));
       return;
     }
-    const plan = await getSdk().snapshots.restorePlan(projectId, snapshotId, { includeAuth });
+    const plan = await getSdk().snapshots.restorePlan(projectId, snapshotId, opts);
     console.log(JSON.stringify({
       ok: true,
       project_id: projectId,
       snapshot_id: snapshotId,
       ...plan,
-      confirm_command: `run402 snapshots restore ${projectId} ${snapshotId} --confirm ${JSON.stringify(plan.restore_plan.confirm.token)}${includeAuth ? " --include-auth" : ""} --json`,
+      confirm_command: `run402 snapshots restore ${snapshotId} --project ${projectId} --confirm ${JSON.stringify(plan.restore_plan.confirm.token)}${release !== undefined ? ` --release ${release}` : ""}${includeAuth ? " --include-auth" : ""} --json`,
     }, null, 2));
   } catch (err) {
     reportSdkError(err);
   }
 }
 
+async function restoreStatus(args) {
+  const usage = "run402 snapshots restore-status [project_id] <snapshot_id> <restore_id>";
+  const { projectId, rest } = resolveProjectSelector(args, { valueFlags: FLAG_VALUES, requireRestPositional: true });
+  const pos = positionalArgs(rest, FLAG_VALUES);
+  if (pos.length !== 2) fail({ code: "BAD_USAGE", message: `Usage: ${usage}` });
+  try {
+    const restoreRead = await getSdk().snapshots.getRestore(projectId, pos[0], pos[1]);
+    console.log(JSON.stringify({ ok: restoreRead.status !== "failed", restore: restoreRead }, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
 async function deleteSnapshot(args) {
   const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots delete [project_id] <snapshot_id>");
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.106.1",
+  "version": "4.107.1",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAuB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,sBAAsB,EACtB,oBAAoB,EAUpB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAqF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,sEAAsE;QACtE,KAAK,CAAC,EAAE,oBAAoB,CAAC;KACzB,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;KAC3B,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAwoED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC;AA+4ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAuB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,sBAAsB,EACtB,oBAAoB,EAUpB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAqF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,sEAAsE;QACtE,KAAK,CAAC,EAAE,oBAAoB,CAAC;KACzB,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;KAC3B,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AA6oED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC;AAq7ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD"}

package/sdk/dist/namespaces/deploy.js

@@ -1072,19 +1072,22 @@ function siteToCoreSpec(site) {
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
         };
     }
-    // tenant-site-embedding never reaches core: the catalog is gateway-owned and
-    // core validates site keys against its own list.
+    // tenant-site-embedding and site.sign_in_path never reach core: both are
+    // gateway-owned and core validates site keys against its own list.
     return site.public_paths ? { public_paths: site.public_paths } : {};
 }
 function siteToWire(site) {
     // tenant-site-embedding: `null` is a meaningful value on the wire (clear), so
     // it is carried whenever the key is present, unlike public_paths.
+    // site.sign_in_path follows the same rule (`null` clears back to the hosted page).
     const embedding = "embedding" in site && site.embedding !== undefined ? { embedding: site.embedding } : {};
+    const signInPath = "sign_in_path" in site && site.sign_in_path !== undefined ? { sign_in_path: site.sign_in_path } : {};
     if ("replace" in site && site.replace) {
         return {
             replace: fileSetToWire(site.replace),
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
             ...embedding,
+            ...signInPath,
         };
     }
     if ("patch" in site && site.patch) {
@@ -1095,11 +1098,13 @@ function siteToWire(site) {
             },
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
             ...embedding,
+            ...signInPath,
         };
     }
     return {
         ...(site.public_paths ? { public_paths: site.public_paths } : {}),
         ...embedding,
+        ...signInPath,
     };
 }
 function i18nToWire(i18n) {
@@ -2308,7 +2313,7 @@ const FUNCTION_SPEC_FIELDS = new Set([
 const FUNCTION_CONFIG_FIELDS = new Set(["timeoutSeconds", "memoryMb"]);
 const FUNCTION_TRIGGER_FIELDS = new Set(["id", "type", "cron", "timezone", "misfire_policy", "overlap_policy", "mailbox", "events", "run"]);
 const FUNCTION_TRIGGER_RUN_FIELDS = new Set(["event_type", "payload", "retry", "expires_after_seconds"]);
-const SITE_SPEC_FIELDS = new Set(["replace", "patch", "public_paths", "embedding"]);
+const SITE_SPEC_FIELDS = new Set(["replace", "patch", "public_paths", "embedding", "sign_in_path"]);
 const SITE_PATCH_FIELDS = new Set(["put", "delete"]);
 const SITE_PUBLIC_PATHS_FIELDS = new Set(["mode", "replace"]);
 const PUBLIC_STATIC_PATH_FIELDS = new Set(["asset", "cache_class"]);
@@ -2644,6 +2649,28 @@ function validateSiteSpec(site) {
     if (obj.embedding !== undefined) {
         validateSiteEmbeddingSpec(obj.embedding, "site.embedding");
     }
+    if (obj.sign_in_path !== undefined) {
+        validateSiteSignInPath(obj.sign_in_path, "site.sign_in_path");
+    }
+}
+/** site.sign_in_path. Structural check only (the gateway is authoritative on
+ *  the reserved prefixes and the full rule set): a same-origin absolute path
+ *  like "/join", or `null` to clear back to the hosted sign-in page. Omitted
+ *  carries forward. */
+function validateSiteSignInPath(value, resource) {
+    if (value === null)
+        return;
+    const hint = `omit ${resource} to carry the previous value forward or send null to use the hosted sign-in page`;
+    if (typeof value !== "string") {
+        throw invalidSpec(`ReleaseSpec.${resource} must be a same-origin path string (e.g. "/join") or null; ${hint}`, resource);
+    }
+    if (!value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.length > 512 ||
+        value.includes("://") ||
+        /[?#\\\s\u0000-\u001f\u007f]/.test(value)) {
+        throw invalidSpec(`ReleaseSpec.${resource} must be a same-origin path starting with a single "/" (e.g. "/join"), at most 512 characters, with no query, fragment, whitespace, backslash, or scheme; ${hint}`, resource);
+    }
 }
 /** tenant-site-embedding. Structural check only: the catalog is the gateway's
  *  (it names the valid keys in INVALID_SPEC), so a new key never needs an SDK
@@ -3014,6 +3041,10 @@ function hasSiteContent(site) {
     if (site && typeof site === "object" && "embedding" in site && site.embedding !== undefined) {
         return true;
     }
+    // site.sign_in_path: same rule, a value or an explicit null is content.
+    if (site && typeof site === "object" && "sign_in_path" in site && site.sign_in_path !== undefined) {
+        return true;
+    }
     if (!isRecord(site))
         return false;
     if (hasRecordEntries(site.replace))
@@ -3468,6 +3499,10 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
         const embedding = "embedding" in spec.site && spec.site.embedding !== undefined
             ? { embedding: spec.site.embedding }
             : {};
+        // site.sign_in_path: present (string or null) travels as-is.
+        const signInPath = "sign_in_path" in spec.site && spec.site.sign_in_path !== undefined
+            ? { sign_in_path: spec.site.sign_in_path }
+            : {};
         if ("replace" in spec.site && spec.site.replace) {
             const map = await normalizeFileSet(spec.site.replace, rememberRelease);
             // Re-check post-expansion so `dir("dist")` (a LocalDirRef whose keys are
@@ -3477,6 +3512,7 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
                 replace: map,
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
                 ...embedding,
+                ...signInPath,
             };
         }
         else if ("patch" in spec.site && spec.site.patch) {
@@ -3491,12 +3527,14 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
                 patch,
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
                 ...embedding,
+                ...signInPath,
             };
         }
-        else if (publicPaths || "embedding" in embedding) {
+        else if (publicPaths || "embedding" in embedding || "sign_in_path" in signInPath) {
             normalized.site = {
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
                 ...embedding,
+                ...signInPath,
             };
         }
     }