run402 4.130.4 → 4.131.0

package/lib/assets.mjs

@@ -362,7 +362,7 @@ const VALID_SORTS = new Set(["key:asc", "createdAt:asc", "createdAt:desc"]);
 function parseSortFlag(raw) {
   if (typeof raw !== "string" || !VALID_SORTS.has(raw)) {
     fail({
-      code: "BAD_FLAG",
+      code: "INVALID_SORT",
       message: `--sort must be one of: ${[...VALID_SORTS].join(", ")} — got: ${raw}`,
       details: { flag: "--sort", value: raw },
     });
@@ -390,7 +390,7 @@ function applyFilterFlag(filter, raw) {
   const value = raw.slice(eq + 1);
   if (!VALID_FILTER_KEYS.has(key)) {
     fail({
-      code: "BAD_FLAG",
+      code: "INVALID_FILTER_KEY",
       message: `--filter key ${key} not in: ${[...VALID_FILTER_KEYS].join(", ")}`,
       details: { flag: "--filter", key },
     });
@@ -398,7 +398,7 @@ function applyFilterFlag(filter, raw) {
   if (key === "is_image") {
     if (value !== "true" && value !== "false") {
       fail({
-        code: "BAD_FLAG",
+        code: "INVALID_FILTER_KEY",
         message: `--filter is_image must be 'true' or 'false', got: ${value}`,
       });
     }
@@ -407,7 +407,7 @@ function applyFilterFlag(filter, raw) {
     const n = Number(value);
     if (!Number.isSafeInteger(n) || n < 0) {
       fail({
-        code: "BAD_FLAG",
+        code: "INVALID_FILTER_KEY",
         message: `--filter ${key} must be a non-negative integer, got: ${value}`,
       });
     }
@@ -415,7 +415,7 @@ function applyFilterFlag(filter, raw) {
   } else {
     if (value.length === 0) {
       fail({
-        code: "BAD_FLAG",
+        code: "INVALID_FILTER_KEY",
         message: `--filter ${key} must be a non-empty string`,
       });
     }

package/lib/ci.mjs

@@ -21,7 +21,7 @@ const { version: RUN402_VERSION } = JSON.parse(
 const HELP = `run402 ci — Manage CI/OIDC deploy bindings
 
 Usage:
-  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
+  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path> | --no-workflow] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
   run402 ci list [--project <project_id>]
   run402 ci revoke <binding_id>
   run402 ci set-asset-scopes <binding_id> <scope1> [<scope2> ...]
@@ -37,16 +37,19 @@ const SUB_HELP = {
   link: `run402 ci link github — Link GitHub Actions OIDC for run402 deploy
 
 Usage:
-  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
+  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path> | --no-workflow] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
 
 Options:
   --project <project_id>          Project ID (defaults to the active project)
   --manifest <path>       Manifest path used by the generated workflow (default: run402.deploy.json)
-  --repo <owner/repo>     GitHub repo (default: inferred from origin remote)
+  --repo <owner/repo>     GitHub repo as owner/repo, owner@<id>/repo@<id> (the spelling of an immutable
+                          OIDC subject, which also gives the repository id) or a github.com URL
+                          (default: inferred from origin remote)
   --branch <name>         Branch subject and push trigger (default: current branch)
   --environment <name>    GitHub environment subject; adds job.environment
   --repository-id <repository_id>    Numeric GitHub repository id when API lookup is unavailable
   --workflow <path>       Workflow path (default: .github/workflows/run402-deploy.yml)
+  --no-workflow           Create the binding only, for a repository whose workflow already runs run402 deploy
   --expires-at <iso>      Optional binding expiration timestamp
   --route-scope <pattern> Optional exact path or final wildcard route scope, repeatable (examples: /admin, /api/*)
   --force                 Overwrite an existing workflow file
@@ -107,8 +110,8 @@ function parseFlags(args, allowed, { repeatable = new Set() } = {}) {
         details: { flag: arg },
       });
     }
-    if (arg === "--force") {
-      flags.force = true;
+    if (arg === "--force" || arg === "--no-workflow") {
+      flags[arg.slice(2).replace(/-/g, "_")] = true;
       continue;
     }
     if (!args[i + 1] || args[i + 1].startsWith("--")) {
@@ -181,6 +184,21 @@ function parseGithubRemote(remote) {
   return null;
 }
 
+// `@` and `:` cannot appear in a GitHub owner or repository name.
+const GITHUB_REPO_NAME = /^[^/\s@:]+\/[^/\s@:]+$/;
+const GITHUB_REPO_IMMUTABLE = /^([^/\s@:]+)@(\d+)\/([^/\s@:]+)@(\d+)$/;
+
+// --repo takes the repository however the owner has it: owner/repo, the
+// owner@<owner_id>/repo@<repo_id> spelling of GitHub's immutable OIDC subject
+// (which also carries the repository id), or a github.com URL. The binding is
+// always written in the name form; the gateway matches either spelling.
+function resolveRepo(value) {
+  const immutable = GITHUB_REPO_IMMUTABLE.exec(value);
+  if (immutable) return { repo: `${immutable[1]}/${immutable[3]}`, repoId: immutable[4] };
+  const repo = parseGithubRemote(value) || value;
+  return GITHUB_REPO_NAME.test(repo) ? { repo, repoId: null } : null;
+}
+
 function inferBranch() {
   return git(["branch", "--show-current"]);
 }
@@ -259,6 +277,7 @@ async function linkGithub(args) {
     "--environment",
     "--repository-id",
     "--workflow",
+    "--no-workflow",
     "--expires-at",
     "--route-scope",
     "--force",
@@ -277,18 +296,41 @@ async function linkGithub(args) {
     });
   }
 
+  if (flags.no_workflow) {
+    const clash = ["--workflow", "--manifest", "--force"].find((flag) => flags[flag.slice(2)] !== undefined);
+    if (clash) {
+      fail({
+        code: "BAD_USAGE",
+        message: `--no-workflow writes no workflow, so ${clash} has nothing to apply to.`,
+        details: { flag: clash },
+      });
+    }
+  }
+
   const projectId = resolveProjectId(flags.project);
-  const repo = flags.repo || inferRepo();
-  if (!repo || !/^[^/\s]+\/[^/\s]+$/.test(repo)) {
+  const resolved = resolveRepo(flags.repo || inferRepo() || "");
+  if (!resolved) {
     fail({
       code: "GITHUB_REPO_REQUIRED",
-      message: "Could not infer GitHub owner/repo from git remote origin.",
+      message: flags.repo
+        ? `--repo must be owner/repo, owner@<id>/repo@<id> or a github.com URL; got ${JSON.stringify(flags.repo)}.`
+        : "Could not infer GitHub owner/repo from git remote origin.",
       hint: "Pass --repo <owner/repo>.",
     });
   }
+  const { repo } = resolved;
+  if (resolved.repoId && flags.repository_id && resolved.repoId !== flags.repository_id) {
+    fail({
+      code: "GITHUB_REPOSITORY_ID_CONFLICT",
+      message: `--repo names repository id ${resolved.repoId}, but --repository-id is ${flags.repository_id}.`,
+      hint: "Drop --repository-id, or pass the --repo of the repository it names.",
+      details: { repo, repo_id_in_repo: resolved.repoId, repository_id: flags.repository_id },
+    });
+  }
   const branch = flags.environment ? (flags.branch || inferBranch() || null) : (flags.branch || inferBranch());
   const subject = buildSubject(repo, { branch, environment: flags.environment });
-  const repositoryId = flags.repository_id || await fetchGithubRepositoryId(repo);
+  const repositoryIdProvided = flags.repository_id || resolved.repoId;
+  const repositoryId = repositoryIdProvided || await fetchGithubRepositoryId(repo);
   if (!repositoryId) {
     fail({
       code: "GITHUB_REPOSITORY_ID_REQUIRED",
@@ -298,9 +340,9 @@ async function linkGithub(args) {
     });
   }
 
-  const workflowPath = flags.workflow || ".github/workflows/run402-deploy.yml";
-  const absWorkflowPath = resolve(process.cwd(), workflowPath);
-  if (existsSync(absWorkflowPath) && !flags.force) {
+  const workflowPath = flags.no_workflow ? null : flags.workflow || ".github/workflows/run402-deploy.yml";
+  const absWorkflowPath = workflowPath && resolve(process.cwd(), workflowPath);
+  if (absWorkflowPath && existsSync(absWorkflowPath) && !flags.force) {
     fail({
       code: "WORKFLOW_EXISTS",
       message: `Workflow already exists: ${workflowPath}`,
@@ -309,7 +351,7 @@ async function linkGithub(args) {
     });
   }
 
-  const manifest = flags.manifest || "run402.deploy.json";
+  const manifest = flags.no_workflow ? null : flags.manifest || "run402.deploy.json";
   const routeScopes = Array.isArray(flags.route_scope) ? flags.route_scope : [];
   const nonce = randomBytes(16).toString("hex");
   const values = {
@@ -334,7 +376,7 @@ async function linkGithub(args) {
     });
   }
 
-  const workflow = generateWorkflow({
+  const workflow = workflowPath && generateWorkflow({
     branch,
     environment: flags.environment || null,
     manifest,
@@ -348,8 +390,10 @@ async function linkGithub(args) {
       signed_delegation: signedDelegation,
     });
     const outputRouteScopes = Array.isArray(binding.route_scopes) ? binding.route_scopes : [];
-    mkdirSync(dirname(absWorkflowPath), { recursive: true });
-    writeFileSync(absWorkflowPath, workflow, { encoding: "utf8", mode: 0o644 });
+    if (absWorkflowPath) {
+      mkdirSync(dirname(absWorkflowPath), { recursive: true });
+      writeFileSync(absWorkflowPath, workflow, { encoding: "utf8", mode: 0o644 });
+    }
     console.log(JSON.stringify({
       binding_id: binding.id,
       project_id: projectId,
@@ -359,12 +403,14 @@ async function linkGithub(args) {
       allowed_actions: [...V1_CI_ALLOWED_ACTIONS],
       route_scopes: outputRouteScopes,
       github_repository_id: repositoryId,
-      github_repository_id_status: flags.repository_id ? "provided" : "verified",
+      github_repository_id_status: repositoryIdProvided ? "provided" : "verified",
       workflow_path: workflowPath,
       manifest_path: manifest,
       run402_version: RUN402_VERSION,
       delegation_chain_id: DEFAULT_CI_DELEGATION_CHAIN_ID,
-      bootstrap_caveat: "Commit the generated workflow and manifest before expecting GitHub Actions deploys.",
+      bootstrap_caveat: workflowPath
+        ? "Commit the generated workflow and manifest before expecting GitHub Actions deploys."
+        : "No workflow was written (--no-workflow): the repository's existing workflow deploys once it runs run402 deploy with permissions: id-token: write; re-run it.",
       consent_summary: [
         "This binding lets matching GitHub Actions workflows deploy site, function, and database changes to the project.",
         outputRouteScopes.length > 0

package/lib/deploy-v2.mjs

@@ -1501,7 +1501,7 @@ const CI_DEPLOY_ERROR_GUIDANCE = {
     ],
   },
   access_denied: {
-    hint: "The OIDC token was valid, but no active Run402 CI binding allowed this workflow.",
+    hint: "No active binding on this project matches this workflow's OIDC subject (details.subject); next_actions names the command that links it.",
     next_actions: [
       editRequestAction("run402 ci list --project <prj_...>", "Inspect active CI bindings for this project."),
       editRequestAction("run402 ci link github", "Link this repository, branch, and environment to Run402."),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.130.4",
+  "version": "4.131.0",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/vault-surface.json

@@ -1,5 +1,5 @@
 {
-  "surface_version": "4.130.4",
+  "surface_version": "4.131.0",
   "verbs": [
     "repos create",
     "repos list",