run402 4.109.1 → 4.110.1

package/README.md

@@ -253,7 +253,7 @@ import { db, adminDb, auth, email, ai } from "@run402/functions";
 
 ### Same-origin web routes
 
-`run402 deploy` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `site.embedding.frame_ancestors` (catalog keys, e.g. `["localhost"]`, never raw origins) lets the named embedders put the site in an iframe: the gateway sends `Content-Security-Policy: frame-ancestors http://localhost:* http://127.0.0.1:*` and drops `X-Frame-Options` on every response of the host; omitted on a later apply carries the previous declaration forward, `null` returns to deny, unknown keys fail `INVALID_SPEC` naming the valid ones, and `/_run402/config.json` discloses the effective policy cross-origin so an embedder can check before framing. `site.sign_in_path` (e.g. `"/join"`) names the app's own same-origin sign-in page: a signed-out user reaching MCP authorization (`/_run402/oauth/authorize`) is sent there with `returnTo` appended instead of the hosted `/auth/sign-in`; omitted carries forward, `null` returns to the hosted page, and a value with a query/fragment, `//`, `://`, or a `/_run402/` or `/auth/` prefix fails `INVALID_SPEC` on `site.sign_in_path`. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Recipe — static home page + SPA shell: a root alias `{ "pattern": "/", "target": { "type": "static", "file": "home.html" } }` (with `home.html` at the site root) serves real static bytes at `GET /` (`route_static_alias`) while unmatched app routes keep the `index.html` shell (`spa_fallback`); expect non-blocking `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn) / `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info) plan lints and verify with `run402 deploy resolve --url https://<your-site>/ --method GET`. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
+`run402 deploy` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `site.embedding.frame_ancestors` (catalog keys, e.g. `["localhost"]`, never raw origins) lets the named embedders put the site in an iframe: the gateway sends `Content-Security-Policy: frame-ancestors http://localhost:* http://127.0.0.1:*` and drops `X-Frame-Options` on every response of the host; omitted on a later apply carries the previous declaration forward, `null` returns to deny, unknown keys fail `INVALID_SPEC` naming the valid ones, and `/_run402/config.json` discloses the effective policy cross-origin so an embedder can check before framing. `site.sign_in_path` (e.g. `"/join"`) names the app's own same-origin sign-in page: a signed-out user reaching MCP authorization (`/_run402/oauth/authorize`) is sent there with `returnTo` appended instead of the hosted `/auth/sign-in`; omitted carries forward, `null` returns to the hosted page, and a value with a query/fragment, `//`, `://`, or a `/_run402/` or `/auth/` prefix fails `INVALID_SPEC` on `site.sign_in_path`. `site.noindex: true` adds `X-Robots-Tag: noindex, nofollow, nosnippet` to every response of the host; omitted carries forward, `false` or `null` makes the host indexable again, and anything but a boolean or `null` fails `INVALID_SPEC` on `site.noindex`. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Recipe — static home page + SPA shell: a root alias `{ "pattern": "/", "target": { "type": "static", "file": "home.html" } }` (with `home.html` at the site root) serves real static bytes at `GET /` (`route_static_alias`) while unmatched app routes keep the `index.html` shell (`spa_fallback`); expect non-blocking `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn) / `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info) plan lints and verify with `run402 deploy resolve --url https://<your-site>/ --method GET`. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
 
 ### Secrets
 

package/lib/deploy-v2.mjs

@@ -1589,21 +1589,29 @@ const SITE_BULK_REMOVAL_CODE = "DESTRUCTIVE_SITE_BULK_REMOVAL";
 
 /**
  * Reads the SDK's `details.removed_paths_summary` on a bulk site-removal
- * warning and says whether the removal drops pages or only renames
- * content-hashed build bundles (the routine framework-rebuild case).
+ * warning and says whether the counted removals drop pages or are only
+ * content-hashed build bundles.
+ *
+ * A gateway that sends `details.replaced_fingerprinted` has already left
+ * out bundles the build replaces in the same directory (renames), so any
+ * hashed bundle still counted has no replacement there. An older gateway
+ * or a Core target counts renames too.
  */
 function siteRemovalGuidance(warnings) {
   const warning = warnings?.find((w) => w?.code === SITE_BULK_REMOVAL_CODE);
   if (!warning) return null;
   const summary = warning.details?.removed_paths_summary;
-  const where = "Per-path detail is in warnings[].affected and warnings[].details.removed_paths_summary.";
+  const where = "Per-path detail is in warnings[].affected and warnings[].details.";
   if (!summary || typeof summary.total !== "number") {
     return { hint: `This deploy removes more than ten percent of the live site's paths. ${where} Acknowledge ${SITE_BULK_REMOVAL_CODE} only if those removals are intended.` };
   }
   if (summary.only_content_hashed_build_assets) {
     const example = Array.isArray(warning.affected) && warning.affected[0] ? ` (e.g. ${warning.affected[0]})` : "";
+    const gatewayPairsRenames = typeof warning.details?.replaced_fingerprinted === "number";
     return {
-      hint: `All ${summary.total} removed site paths are content-hashed build assets${example}, which a rebuild renames; no HTML pages are removed. If this deploy is a rebuild of the same site, acknowledging ${SITE_BULK_REMOVAL_CODE} is safe. ${where}`,
+      hint: gatewayPairsRenames
+        ? `All ${summary.total} counted removals are content-hashed build assets${example} that this build does not replace in the same directory; no HTML pages are removed. That is usually a rebuild that merged or dropped bundles. Acknowledge ${SITE_BULK_REMOVAL_CODE} once nothing outside this build still loads them. ${where}`
+        : `All ${summary.total} removed site paths are content-hashed build assets${example}, which a rebuild renames or merges; no HTML pages are removed. If this deploy is a rebuild of the same site, acknowledging ${SITE_BULK_REMOVAL_CODE} is safe. ${where}`,
     };
   }
   const pageList = Array.isArray(summary.page_paths) && summary.page_paths.length > 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.109.1",
+  "version": "4.110.1",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAwB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,sBAAsB,EACtB,oBAAoB,EAUpB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAyG3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAmD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,sEAAsE;QACtE,KAAK,CAAC,EAAE,oBAAoB,CAAC;KACzB,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;KAC3B,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AA+qED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC;AA05ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAwB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,sBAAsB,EACtB,oBAAoB,EAUpB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAyG3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAmD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,sEAAsE;QACtE,KAAK,CAAC,EAAE,oBAAoB,CAAC;KACzB,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;KAC3B,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAyqED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC;AAm7ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD"}

package/sdk/dist/namespaces/deploy.js

@@ -1103,22 +1103,26 @@ function siteToCoreSpec(site) {
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
         };
     }
-    // tenant-site-embedding and site.sign_in_path never reach core: both are
-    // gateway-owned and core validates site keys against its own list.
+    // tenant-site-embedding, site.sign_in_path, and site.noindex never reach
+    // core: all three are gateway-owned and core validates site keys against
+    // its own list.
     return site.public_paths ? { public_paths: site.public_paths } : {};
 }
 function siteToWire(site) {
     // tenant-site-embedding: `null` is a meaningful value on the wire (clear), so
     // it is carried whenever the key is present, unlike public_paths.
-    // site.sign_in_path follows the same rule (`null` clears back to the hosted page).
+    // site.sign_in_path follows the same rule (`null` clears back to the hosted page),
+    // and so does site.noindex (`false` or `null` clears back to indexable).
     const embedding = "embedding" in site && site.embedding !== undefined ? { embedding: site.embedding } : {};
     const signInPath = "sign_in_path" in site && site.sign_in_path !== undefined ? { sign_in_path: site.sign_in_path } : {};
+    const noindex = "noindex" in site && site.noindex !== undefined ? { noindex: site.noindex } : {};
     if ("replace" in site && site.replace) {
         return {
             replace: fileSetToWire(site.replace),
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
             ...embedding,
             ...signInPath,
+            ...noindex,
         };
     }
     if ("patch" in site && site.patch) {
@@ -1130,12 +1134,14 @@ function siteToWire(site) {
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
             ...embedding,
             ...signInPath,
+            ...noindex,
         };
     }
     return {
         ...(site.public_paths ? { public_paths: site.public_paths } : {}),
         ...embedding,
         ...signInPath,
+        ...noindex,
     };
 }
 function i18nToWire(i18n) {
@@ -1654,7 +1660,7 @@ async function commitInternal(client, planId, idempotencyKey, project, requiredP
                 : {}),
             context: "committing deploy",
         });
-        return await sendCommitRecoveringLostResponse(client, send, operationId, project, tries);
+        return await sendCommitWithRetry(send, tries);
     }
     catch (err) {
         const translated = translateDeployError(err, "commit", planId, operationId ?? null);
@@ -1667,38 +1673,34 @@ async function commitInternal(client, planId, idempotencyKey, project, requiredP
     }
 }
 /**
- * Send a deploy commit, recovering when a 502/503/504 or a dropped connection
- * loses the response. The commit may still have reached the gateway (a long
- * commit can outlive the connection that carried it), and a second commit
- * while the first is running would drive the state machine twice. So read the
- * operation first: once it has left `planning`/`uploading` the commit landed,
- * and the caller follows the operation; otherwise the commit never arrived and
- * is sent again. Without an operation id to read, the failure surfaces as is.
- * `tries.attempts` counts the commits sent, for the error's retry metadata.
+ * Send a deploy commit, re-sending when a 502/503/504 or a dropped connection
+ * loses the response. Re-sending is safe because a plan commits once: the
+ * gateway answers a commit of a plan whose operation is already running with
+ * `status: "running"` (the caller follows the operation) and a finished one
+ * with its stored result, and Run402 Core answers `commit_in_progress` while
+ * the first commit runs, which is re-sent the same way. `tries.attempts`
+ * counts the commits sent, for the error's retry metadata.
  */
-async function sendCommitRecoveringLostResponse(client, send, operationId, projectId, tries) {
+async function sendCommitWithRetry(send, tries) {
     for (let attempt = 1;; attempt++) {
         tries.attempts = attempt;
         try {
             return await send();
         }
         catch (err) {
-            if (!operationId || !projectId || !isTransientGatewayFailure(err) || attempt >= DEPLOY_COMMIT_MAX_ATTEMPTS)
+            if (!isRetryableCommitFailure(err) || attempt >= DEPLOY_COMMIT_MAX_ATTEMPTS)
                 throw err;
             await sleep(DEPLOY_COMMIT_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
-            let snapshot;
-            try {
-                snapshot = await client.request(`/apply/v1/operations/${encodeURIComponent(operationId)}`, { headers: await apikeyHeaders(client, projectId), context: "fetching deploy operation" });
-            }
-            catch {
-                throw err;
-            }
-            if (snapshot.status !== "planning" && snapshot.status !== "uploading") {
-                return { operation_id: operationId, status: "running" };
-            }
         }
     }
 }
+function isRetryableCommitFailure(err) {
+    if (isTransientGatewayFailure(err))
+        return true;
+    // Run402 Core: another commit of this plan is still running.
+    return isRun402Error(err) && err.status === 409 &&
+        err.body?.error === "commit_in_progress";
+}
 async function uploadMissing(client, projectId, presence, byteReaders, emit) {
     // Surface CAS dedup hits so agents can distinguish "N files were already
     // present" from "nothing happened". The gateway reports both present and
@@ -2371,7 +2373,7 @@ const FUNCTION_SPEC_FIELDS = new Set([
 const FUNCTION_CONFIG_FIELDS = new Set(["timeoutSeconds", "memoryMb"]);
 const FUNCTION_TRIGGER_FIELDS = new Set(["id", "type", "cron", "timezone", "misfire_policy", "overlap_policy", "mailbox", "events", "run"]);
 const FUNCTION_TRIGGER_RUN_FIELDS = new Set(["event_type", "payload", "retry", "expires_after_seconds"]);
-const SITE_SPEC_FIELDS = new Set(["replace", "patch", "public_paths", "embedding", "sign_in_path"]);
+const SITE_SPEC_FIELDS = new Set(["replace", "patch", "public_paths", "embedding", "sign_in_path", "noindex"]);
 const SITE_PATCH_FIELDS = new Set(["put", "delete"]);
 const SITE_PUBLIC_PATHS_FIELDS = new Set(["mode", "replace"]);
 const PUBLIC_STATIC_PATH_FIELDS = new Set(["asset", "cache_class"]);
@@ -2710,6 +2712,17 @@ function validateSiteSpec(site) {
     if (obj.sign_in_path !== undefined) {
         validateSiteSignInPath(obj.sign_in_path, "site.sign_in_path");
     }
+    if (obj.noindex !== undefined) {
+        validateSiteNoindex(obj.noindex, "site.noindex");
+    }
+}
+/** site.noindex. `true` = every response of the host carries
+ *  `X-Robots-Tag: noindex, nofollow, nosnippet`; `false` or `null` clears back
+ *  to indexable; omitted carries forward. */
+function validateSiteNoindex(value, resource) {
+    if (value === null || typeof value === "boolean")
+        return;
+    throw invalidSpec(`ReleaseSpec.${resource} must be true, false, or null; send true to add X-Robots-Tag: noindex, nofollow, nosnippet to every response of the host, false or null to make it indexable again, or omit ${resource} to carry the previous value forward`, resource);
 }
 /** site.sign_in_path. Structural check only (the gateway is authoritative on
  *  the reserved prefixes and the full rule set): a same-origin absolute path
@@ -3089,6 +3102,10 @@ function hasSiteContent(site) {
     if (site && typeof site === "object" && "sign_in_path" in site && site.sign_in_path !== undefined) {
         return true;
     }
+    // site.noindex: same rule, true/false/null is content.
+    if (site && typeof site === "object" && "noindex" in site && site.noindex !== undefined) {
+        return true;
+    }
     if (!isRecord(site))
         return false;
     if (hasRecordEntries(site.replace))
@@ -3545,6 +3562,10 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
         const signInPath = "sign_in_path" in spec.site && spec.site.sign_in_path !== undefined
             ? { sign_in_path: spec.site.sign_in_path }
             : {};
+        // site.noindex: present (boolean or null) travels as-is.
+        const noindex = "noindex" in spec.site && spec.site.noindex !== undefined
+            ? { noindex: spec.site.noindex }
+            : {};
         if ("replace" in spec.site && spec.site.replace) {
             const map = await normalizeFileSet(spec.site.replace, rememberRelease);
             // Re-check post-expansion so `dir("dist")` (a LocalDirRef whose keys are
@@ -3555,6 +3576,7 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
                 ...embedding,
                 ...signInPath,
+                ...noindex,
             };
         }
         else if ("patch" in spec.site && spec.site.patch) {
@@ -3570,13 +3592,15 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
                 ...embedding,
                 ...signInPath,
+                ...noindex,
             };
         }
-        else if (publicPaths || "embedding" in embedding || "sign_in_path" in signInPath) {
+        else if (publicPaths || "embedding" in embedding || "sign_in_path" in signInPath || "noindex" in noindex) {
             normalized.site = {
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
                 ...embedding,
                 ...signInPath,
+                ...noindex,
             };
         }
     }