run402 4.8.0 → 4.10.0

package/lib/secrets.mjs

@@ -1,7 +1,7 @@
 import { readFileSync } from "fs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs, validateRegularFile } from "./argparse.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs, resolveProjectSelector, validateRegularFile, failUnknownSubcommand } from "./argparse.mjs";
 import { editRequestAction } from "./next-actions.mjs";
 
 const HELP = `run402 secrets — Manage project secrets
@@ -10,18 +10,25 @@ Usage:
   run402 secrets <subcommand> [args...]
 
 Subcommands:
-  set    <id> <key> <value> [--file <path>|--stdin]  Set a secret on a project
-  list   <id>                  List all secrets for a project
-  delete <id> <key>            Delete a secret from a project
+  set    <key> (--value <v> | --file <path> | --stdin) [--project <id>]
+                               Set a secret on a project
+  list   [--project <id>]      List all secrets for a project
+  delete <key> [--project <id>]  Delete a secret from a project
+
+Legacy (still supported):
+  run402 secrets set <prj_id> <key> <value>
+  run402 secrets list <prj_id>
+  run402 secrets delete <prj_id> <key>
 
 Examples:
-  printf %s "$STRIPE_KEY" | run402 secrets set prj_abc123 STRIPE_KEY --stdin
-  run402 secrets set prj_abc123 STRIPE_KEY --file ./.secrets/stripe-key
-  run402 secrets set prj_abc123 TLS_CERT --file cert.pem
-  run402 secrets list prj_abc123
-  run402 secrets delete prj_abc123 STRIPE_KEY
+  printf %s "$STRIPE_KEY" | run402 secrets set STRIPE_KEY --stdin --project prj_abc123
+  run402 secrets set STRIPE_KEY --file ./.secrets/stripe-key --project prj_abc123
+  run402 secrets set TLS_CERT --file cert.pem
+  run402 secrets list --project prj_abc123
+  run402 secrets delete STRIPE_KEY --project prj_abc123
 
 Notes:
+  - --project defaults to the active project ('run402 projects use')
   - Secrets are injected as process.env in serverless functions
   - Values are write-only — list returns keys and timestamps only
   - Deploy manifests should declare existing keys with secrets.require; never put values in deploy specs
@@ -31,68 +38,86 @@ const SUB_HELP = {
   set: `run402 secrets set — Set a secret on a project
 
 Usage:
-  run402 secrets set <id> <key> <value>
-  run402 secrets set <id> <key> --file <path>
-  run402 secrets set <id> <key> --stdin
+  run402 secrets set <key> --value <v> [--project <id>]
+  run402 secrets set <key> --file <path> [--project <id>]
+  run402 secrets set <key> --stdin [--project <id>]
+
+Legacy (still supported):
+  run402 secrets set <prj_id> <key> <value>
+  run402 secrets set <key> <value>
 
 Arguments:
-  <id>                Project ID (from 'run402 projects list')
   <key>               Secret key name (exposed as process.env.<key>)
-  <value>             Inline secret value (omit if using --file or --stdin)
 
 Options:
+  --project <id>      Project ID (defaults to the active project)
+  --value <v>         Inline secret value (alternative to the legacy positional)
   --file <path>       Read the secret value from a file instead of inline
                       Use --file - or --file /dev/stdin to read from stdin
   --stdin             Read the secret value from stdin until EOF
 
 Notes:
+  - Provide exactly one value source: --value, --file, --stdin, or the legacy inline positional
   - Secrets are injected as process.env in serverless functions
   - Values are write-only; 'list' cannot verify values by hash
   - Prefer --stdin or --file for real secrets so values do not land in shell history
 
 Examples:
-  printf %s "$STRIPE_KEY" | run402 secrets set prj_abc123 STRIPE_KEY --stdin
-  cat ./.secrets/stripe-key | run402 secrets set prj_abc123 STRIPE_KEY --file -
-  run402 secrets set prj_abc123 STRIPE_KEY --file ./.secrets/stripe-key
-  run402 secrets set prj_abc123 TLS_CERT --file cert.pem
+  printf %s "$STRIPE_KEY" | run402 secrets set STRIPE_KEY --stdin --project prj_abc123
+  cat ./.secrets/stripe-key | run402 secrets set STRIPE_KEY --file - --project prj_abc123
+  run402 secrets set STRIPE_KEY --file ./.secrets/stripe-key
+  run402 secrets set TLS_CERT --file cert.pem --project prj_abc123
 `,
   list: `run402 secrets list — List all secrets for a project
 
 Usage:
-  run402 secrets list <id>
+  run402 secrets list [--project <id>]
 
-Arguments:
-  <id>                Project ID (from 'run402 projects list')
+Legacy (still supported):
+  run402 secrets list <prj_id>
+
+Options:
+  --project <id>      Project ID (defaults to the active project)
 
 Notes:
   - Returns secret keys and timestamps only; raw values and value-derived hashes are never returned
 
 Examples:
-  run402 secrets list prj_abc123
+  run402 secrets list --project prj_abc123
 `,
   delete: `run402 secrets delete — Delete a secret from a project
 
 Usage:
-  run402 secrets delete <id> <key>
+  run402 secrets delete <key> [--project <id>]
+
+Legacy (still supported):
+  run402 secrets delete <prj_id> <key>
 
 Arguments:
-  <id>                Project ID (from 'run402 projects list')
   <key>               Secret key name to remove
 
+Options:
+  --project <id>      Project ID (defaults to the active project)
+
 Examples:
-  run402 secrets delete prj_abc123 STRIPE_KEY
+  run402 secrets delete STRIPE_KEY --project prj_abc123
 `,
 };
 
+const SET_VALUE_FLAGS = ["--file", "--value", "--project"];
+
 export function readSecretValueForSet(parsedArgs, values, readers = {}) {
   const readStdin = readers.readStdin ?? (() => readFileSync(0, "utf-8"));
   const readFile = readers.readFile ?? ((path) => readFileSync(path, "utf-8"));
   const validateFile = readers.validateFile ?? validateRegularFile;
   const file = flagValue(parsedArgs, "--file");
+  const valueFlagPresent = parsedArgs.includes("--value");
+  const valueFlag = valueFlagPresent ? flagValue(parsedArgs, "--value") : null;
   const stdinRequested = parsedArgs.includes("--stdin");
   const stdinFile = isStdinAlias(file);
   const sources = [];
   if (values.length === 1) sources.push("inline");
+  if (valueFlagPresent) sources.push("--value");
   if (file) sources.push(stdinFile ? "--file stdin" : "--file");
   if (stdinRequested) sources.push("--stdin");
 
@@ -101,22 +126,31 @@ export function readSecretValueForSet(parsedArgs, values, readers = {}) {
       code: "BAD_USAGE",
       message: "Provide exactly one secret value source.",
       details: { sources },
-      hint: "Use one of: inline value, --file <path>, or --stdin.",
+      hint: "Use one of: --value <v>, --file <path>, --stdin, or an inline value.",
     });
   }
   if (file && !stdinFile) validateFile(file, "--file");
 
   if (stdinRequested || stdinFile) return readStdin();
+  if (valueFlagPresent) return valueFlag;
   if (file) return readFile(file);
   if (values.length === 1) return values[0];
   return undefined;
 }
 
-async function set(projectId, key, args = []) {
+async function set(projectId, args = []) {
   const parsedArgs = normalizeArgv(args);
-  const valueFlags = ["--file"];
-  assertKnownFlags(parsedArgs, [...valueFlags, "--stdin", "--help", "-h"], valueFlags);
-  const values = positionalArgs(parsedArgs, valueFlags);
+  assertKnownFlags(parsedArgs, [...SET_VALUE_FLAGS, "--stdin", "--help", "-h"], SET_VALUE_FLAGS);
+  const positionals = positionalArgs(parsedArgs, SET_VALUE_FLAGS);
+  const key = positionals[0];
+  if (!key) {
+    fail({
+      code: "BAD_USAGE",
+      message: "Missing <key>.",
+      hint: "run402 secrets set <key> --value <v> [--project <id>]",
+    });
+  }
+  const values = positionals.slice(1);
   if (values.length > 1) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for secrets set: ${values[1]}` });
   }
@@ -172,8 +206,8 @@ function failMissingStdin() {
 
 async function list(projectId, args = []) {
   const parsedArgs = normalizeArgv(args);
-  assertKnownFlags(parsedArgs, ["--help", "-h"]);
-  const extra = positionalArgs(parsedArgs);
+  assertKnownFlags(parsedArgs, ["--project", "--help", "-h"], ["--project"]);
+  const extra = positionalArgs(parsedArgs, ["--project"]);
   if (extra.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for secrets list: ${extra[0]}` });
   }
@@ -192,12 +226,20 @@ async function list(projectId, args = []) {
   }
 }
 
-async function deleteSecret(projectId, key, args = []) {
+async function deleteSecret(projectId, args = []) {
   const parsedArgs = normalizeArgv(args);
-  assertKnownFlags(parsedArgs, ["--help", "-h"]);
-  const extra = positionalArgs(parsedArgs);
-  if (extra.length > 0) {
-    fail({ code: "BAD_USAGE", message: `Unexpected argument for secrets delete: ${extra[0]}` });
+  assertKnownFlags(parsedArgs, ["--project", "--help", "-h"], ["--project"]);
+  const positionals = positionalArgs(parsedArgs, ["--project"]);
+  const key = positionals[0];
+  if (!key) {
+    fail({
+      code: "BAD_USAGE",
+      message: "Missing <key>.",
+      hint: "run402 secrets delete <key> [--project <id>]",
+    });
+  }
+  if (positionals.length > 1) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for secrets delete: ${positionals[1]}` });
   }
   try {
     await getSdk().secrets.delete(projectId, key);
@@ -213,11 +255,27 @@ export async function run(sub, args) {
     console.log(SUB_HELP[sub] || HELP);
     process.exit(0);
   }
+  if (!["set", "list", "delete"].includes(sub)) {
+    failUnknownSubcommand("secrets", sub);
+  }
+  const parsed = normalizeArgv(Array.isArray(args) ? args : []);
   switch (sub) {
-    case "set":    await set(args[0], args[1], args.slice(2)); break;
-    case "list":   await list(args[0], args.slice(1)); break;
-    case "delete": await deleteSecret(args[0], args[1], args.slice(2)); break;
+    case "set": {
+      const { projectId, rest } = resolveProjectSelector(parsed, { valueFlags: SET_VALUE_FLAGS });
+      await set(projectId, rest);
+      break;
+    }
+    case "list": {
+      const { projectId, rest } = resolveProjectSelector(parsed, { valueFlags: ["--project"] });
+      await list(projectId, rest);
+      break;
+    }
+    case "delete": {
+      const { projectId, rest } = resolveProjectSelector(parsed, { valueFlags: ["--project"] });
+      await deleteSecret(projectId, rest);
+      break;
+    }
     default:
-      fail({ code: "UNKNOWN_SUBCOMMAND", message: `Unknown secrets subcommand: ${sub}`, hint: "Run `run402 secrets --help` for usage.", details: { command: "secrets", subcommand: sub } });
+      failUnknownSubcommand("secrets", sub);
   }
 }

package/lib/service.mjs

@@ -1,5 +1,6 @@
 import { getSdk } from "./sdk.mjs";
-import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { failUnknownSubcommand } from "./argparse.mjs";
+import { reportSdkError } from "./sdk-errors.mjs";
 
 const HELP = `run402 service — Run402 service health and availability
 
@@ -70,6 +71,6 @@ export async function run(sub, args) {
     case "status": await status(); break;
     case "health": await health(); break;
     default:
-      fail({ code: "UNKNOWN_SUBCOMMAND", message: `Unknown service subcommand: ${sub}`, hint: "Run `run402 service --help` for usage.", details: { command: "service", subcommand: sub } });
+      failUnknownSubcommand("service", sub);
   }
 }

package/lib/sites.mjs

@@ -6,7 +6,7 @@ import { allowanceAuthHeaders, resolveProjectId, updateProject } from "./config.
 import { resolveFilePathsInManifest } from "./manifest.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs } from "./argparse.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs, failUnknownSubcommand } from "./argparse.mjs";
 
 const SMALL_DIR_THRESHOLD = 5;
 
@@ -364,6 +364,6 @@ export async function run(sub, args) {
     case "deploy":      await deploy(args); break;
     case "deploy-dir":  await deployDir(args); break;
     default:
-      fail({ code: "UNKNOWN_SUBCOMMAND", message: `Unknown sites subcommand: ${sub}`, hint: "Run `run402 sites --help` for usage.", details: { command: "sites", subcommand: sub } });
+      failUnknownSubcommand("sites", sub);
   }
 }

package/lib/snapshots.mjs

@@ -8,24 +8,29 @@ import {
   normalizeArgv,
   parseIntegerFlag,
   positionalArgs,
+  resolveProjectSelector,
+  failUnknownSubcommand,
 } from "./argparse.mjs";
-import { resolveProjectId } from "./config.mjs";
 
 const HELP = `run402 snapshots — Project database restore points
 
 Usage:
-  run402 snapshots create [project-id] [--json]
-  run402 snapshots list [project-id] [--kind <kind>] [--limit <n>] [--after <cursor>] [--json]
-  run402 snapshots get [project-id] <snapshot-id> [--json]
-  run402 snapshots restore [project-id] <snapshot-id> [--include-auth] [--confirm <token>] [--json]
-  run402 snapshots delete [project-id] <snapshot-id> [--json]
+  run402 snapshots create [--project <id>] [--json]
+  run402 snapshots list [--project <id>] [--kind <kind>] [--limit <n>] [--after <cursor>] [--json]
+  run402 snapshots get <snapshot-id> [--project <id>] [--json]
+  run402 snapshots restore <snapshot-id> [--project <id>] [--include-auth] [--confirm <token>] [--json]
+  run402 snapshots delete <snapshot-id> [--project <id>] [--json]
+
+Legacy (still supported): a leading prj_... positional selects the project,
+e.g. run402 snapshots restore prj_abc123 <snapshot-id>. --project defaults to
+the active project.
 
 Restore is a two-step handshake. First call without --confirm to get a
 restore_plan.confirm.token, then re-run with --confirm after reviewing the
 data-loss statement.
 `;
 
-const FLAG_VALUES = ["--kind", "--limit", "--after", "--confirm"];
+const FLAG_VALUES = ["--project", "--kind", "--limit", "--after", "--confirm"];
 const FLAGS = new Set([...FLAG_VALUES, "--include-auth", "--json", "--help", "-h"]);
 const SNAPSHOT_KINDS = ["manual", "pre_migration", "pre_restore", "scheduled"];
 
@@ -44,17 +49,12 @@ export async function run(sub, args = []) {
     case "restore": return restore(rest);
     case "delete": return deleteSnapshot(rest);
     default:
-      fail({
-        code: "UNKNOWN_SUBCOMMAND",
-        message: `Unknown snapshots subcommand: ${sub}`,
-        hint: "Run `run402 snapshots --help` for usage.",
-        details: { command: "snapshots", subcommand: sub },
-      });
+      failUnknownSubcommand("snapshots", sub);
   }
 }
 
 async function create(args) {
-  const projectId = resolveOptionalProject(positionalArgs(args, FLAG_VALUES)[0]);
+  const { projectId } = resolveProjectSelector(args, { valueFlags: FLAG_VALUES });
   try {
     const snapshot = await getSdk().snapshots.create(projectId);
     console.log(JSON.stringify({ ok: snapshot.status === "ready", snapshot }, null, 2));
@@ -64,7 +64,7 @@ async function create(args) {
 }
 
 async function list(args) {
-  const projectId = resolveOptionalProject(positionalArgs(args, FLAG_VALUES)[0]);
+  const { projectId } = resolveProjectSelector(args, { valueFlags: FLAG_VALUES });
   const kind = flagValue(args, "--kind") ?? undefined;
   if (kind !== undefined) assertAllowedValue(kind, SNAPSHOT_KINDS, "--kind");
   const limitFlag = flagValue(args, "--limit");
@@ -124,14 +124,12 @@ async function deleteSnapshot(args) {
   }
 }
 
-function resolveOptionalProject(value) {
-  if (value && String(value).startsWith("prj_")) return value;
-  return resolveProjectId(null);
-}
-
 function resolveProjectAndSnapshot(args, usage) {
-  const pos = positionalArgs(args, FLAG_VALUES);
-  if (pos.length === 1) return { projectId: resolveProjectId(null), snapshotId: pos[0] };
-  if (pos.length === 2 && pos[0].startsWith("prj_")) return { projectId: pos[0], snapshotId: pos[1] };
-  fail({ code: "BAD_USAGE", message: `Usage: ${usage}` });
+  // Canonical: `<snapshot-id> [--project <id>]`; legacy `<prj_id> <snapshot-id>`
+  // still works (requireRestPositional keeps a lone snapshot id that happens to
+  // start with prj_ from being eaten as the project selector).
+  const { projectId, rest } = resolveProjectSelector(args, { valueFlags: FLAG_VALUES, requireRestPositional: true });
+  const pos = positionalArgs(rest, FLAG_VALUES);
+  if (pos.length !== 1) fail({ code: "BAD_USAGE", message: `Usage: ${usage}` });
+  return { projectId, snapshotId: pos[0] };
 }

package/lib/subdomains.mjs

@@ -1,7 +1,7 @@
 import { resolveProject, resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs } from "./argparse.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs, failUnknownSubcommand } from "./argparse.mjs";
 import { cliCommandAction } from "./next-actions.mjs";
 
 const HELP = `run402 subdomains — Manage custom subdomains
@@ -197,6 +197,6 @@ export async function run(sub, args) {
     case "delete": await deleteSubdomain(args); break;
     case "list":   await list(args); break;
     default:
-      fail({ code: "UNKNOWN_SUBCOMMAND", message: `Unknown subdomains subcommand: ${sub}`, hint: "Run `run402 subdomains --help` for usage.", details: { command: "subdomains", subcommand: sub } });
+      failUnknownSubcommand("subdomains", sub);
   }
 }

package/lib/tier.mjs

@@ -1,6 +1,6 @@
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, normalizeArgv, positionalArgs, flagValue } from "./argparse.mjs";
+import { assertKnownFlags, normalizeArgv, positionalArgs, flagValue, failUnknownSubcommand } from "./argparse.mjs";
 import { setTierAction } from "./next-actions.mjs";
 
 const HELP = `run402 tier — Manage your Run402 tier subscription
@@ -160,6 +160,6 @@ export async function run(sub, args) {
     case "status": await status(args); break;
     case "set":    await set(args); break;
     default:
-      fail({ code: "UNKNOWN_SUBCOMMAND", message: `Unknown tier subcommand: ${sub}`, hint: "Run `run402 tier --help` for usage.", details: { command: "tier", subcommand: sub } });
+      failUnknownSubcommand("tier", sub);
   }
 }

package/lib/transfer.mjs

@@ -8,6 +8,7 @@ import {
   normalizeArgv,
   parseIntegerFlag,
   positionalArgs,
+  failUnknownSubcommand,
 } from "./argparse.mjs";
 
 const HELP = `run402 transfer — Project transfer, one noun for wallet, email, and owned-org recipients
@@ -391,6 +392,6 @@ export async function run(sub, args) {
       await cancel(args);
       return;
     default:
-      fail({ code: "UNKNOWN_SUBCOMMAND", message: `Unknown transfer subcommand: ${sub}`, hint: "Run `run402 transfer --help` for usage.", details: { command: "transfer", subcommand: sub } });
+      failUnknownSubcommand("transfer", sub);
   }
 }

package/lib/up.mjs

@@ -72,7 +72,10 @@ Examples:
   run402 up --manifest run402.deploy.ts --require-plan pln_...
 `;
 
-const VERIFY_HELP = `run402 up verify — Rerun app manifest HTTP verification
+const VERIFY_HELP = `run402 up verify — Rerun manifest HTTP verification (verify.http[])
+
+Works for both app manifests (run402.json) and deploy manifests
+(run402.deploy.json / app.json) that declare a top-level verify block.
 
 Usage:
   run402 up verify [repo-or-path] [--project <id>] [--manifest <path>] [--dir <path>] [--name <name>] [--human|--json-stream]
@@ -81,8 +84,9 @@ Options:
   repo-or-path        Local app directory or public Git repository URL. Defaults
                       to the current directory.
   --project <id>      Existing project id. Defaults to .run402/project.json,
-                      run402.json project.id, then active project.
-  --manifest <path>   App manifest path. Defaults to run402.json.
+                      manifest project id, then active project.
+  --manifest <path>   Manifest path. Defaults to run402.json, then
+                      run402.deploy.json, then app.json.
   --dir <path>        Workspace directory to inspect (default: current dir).
   --name <name>       Instance name used only to materialize templated public origins.
   --propagation-budget-s <n>
@@ -393,9 +397,11 @@ async function runVerify(args = []) {
 }
 
 export function shouldExitNonZeroForUpResult(result) {
-  return result?.action === "up" &&
-    result?.mode === "apply" &&
-    result?.result?.app_result?.status === "deployed_unverified";
+  if (result?.action !== "up" || result?.mode !== "apply") return false;
+  if (result?.result?.app_result?.status === "deployed_unverified") return true;
+  // Deploy-manifest verify.http[]: a hard verify failure (not propagation)
+  // mirrors the app path's deployed_unverified exit semantics.
+  return result?.result?.verify?.status === "failed";
 }
 
 function parseExecutionMode(args) {

package/lib/wallets.mjs

@@ -14,6 +14,7 @@
  */
 
 import { writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { failUnknownSubcommand } from "./argparse.mjs";
 import { join } from "node:path";
 import { fail } from "./sdk-errors.mjs";
 import { isValidProfileName, getActiveProfile } from "../core-dist/config.js";
@@ -42,7 +43,7 @@ Usage:
   run402 wallets current              Show the resolved active wallet + how it was selected
   run402 wallets new <name>           Create a new named wallet (key stays local)
   run402 wallets use <name>           Set the global default wallet
-  run402 wallets rename <old> <new>   Rename a wallet (migrates the default's files when old=default)
+  run402 wallets rename <old> --to <new>   Rename a wallet (legacy: rename <old> <new>)
   run402 wallets bind [<name>]        Write ./.run402.json binding this directory to a wallet
   run402 wallets unbind               Remove ./.run402.json
   run402 wallets import <name> --key <path|->   Adopt an existing private key as a named wallet
@@ -174,9 +175,10 @@ function cmdUse(args) {
 }
 
 async function cmdRename(args) {
-  const positionals = args.filter((a) => a && !a.startsWith("-"));
+  const toFlag = flagVal(args, "--to");
+  const positionals = args.filter((a, i) => a && !a.startsWith("-") && args[i - 1] !== "--to");
   const oldName = requireName(positionals[0], "old wallet name");
-  const newName = requireName(positionals[1], "new wallet name");
+  const newName = requireName(toFlag ?? positionals[1], "new wallet name");
   if (newName === DEFAULT) {
     fail({ code: "BAD_WALLET_NAME", message: "Cannot rename a wallet to the reserved name 'default'.", details: { name: newName } });
   }
@@ -339,11 +341,6 @@ export async function run(sub, args = []) {
     case "import": return cmdImport(rest);
     case "rm": return cmdRm(rest);
     default:
-      fail({
-        code: "UNKNOWN_SUBCOMMAND",
-        message: `Unknown wallets subcommand: ${sub}`,
-        hint: "Run `run402 wallets --help` for usage.",
-        details: { command: "wallets", subcommand: sub },
-      });
+      failUnknownSubcommand("wallets", sub);
   }
 }

package/lib/webhook-secret.mjs

@@ -8,8 +8,8 @@
 
 import { allowanceAuthHeaders } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
-import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, normalizeArgv } from "./argparse.mjs";
+import { reportSdkError } from "./sdk-errors.mjs";
+import { assertKnownFlags, normalizeArgv, failUnknownSubcommand } from "./argparse.mjs";
 
 const HELP = `run402 webhook-secret — Manage the operator webhook signing secret
 
@@ -34,12 +34,7 @@ export async function run(sub, args = []) {
     process.exit(0);
   }
   if (sub !== "rotate") {
-    fail({
-      code: "UNKNOWN_SUBCOMMAND",
-      message: `Unknown webhook-secret subcommand: ${sub}`,
-      hint: "Run `run402 webhook-secret --help` for usage.",
-      details: { command: "webhook-secret", subcommand: sub },
-    });
+    failUnknownSubcommand("webhook-secret", sub);
   }
   const parsedArgs = normalizeArgv(args);
   assertKnownFlags(parsedArgs, ["--help", "-h"]);

package/lib/webhooks.mjs

@@ -1,7 +1,7 @@
 import { resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs, validateWebhookUrl } from "./argparse.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs, validateWebhookUrl, failUnknownSubcommand } from "./argparse.mjs";
 
 const HELP = `run402 email webhooks — Manage mailbox webhooks
 
@@ -262,6 +262,6 @@ export async function run(sub, args) {
     case "deliveries": await deliveries(args); break;
     case "redrive":    await redrive(args); break;
     default:
-      fail({ code: "UNKNOWN_SUBCOMMAND", message: `Unknown webhooks action: ${sub}`, hint: "Run `run402 webhooks --help` for usage.", details: { command: "webhooks", subcommand: sub } });
+      failUnknownSubcommand("email webhooks", sub, { label: "webhooks" });
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.8.0",
+  "version": "4.10.0",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/actions.d.ts

@@ -1,5 +1,5 @@
 import type { DeployResult, PlanResponse, ReleaseSpec } from "./namespaces/deploy.types.js";
-import type { Run402AppInstallGraph, Run402AppUpResultEnvelope } from "./app-up.js";
+import type { Run402AppInstallGraph, Run402AppInstallNodeStatus, Run402AppUpResultEnvelope, Run402AppUpVerifyResult } from "./app-up.js";
 import type { ProvisionResult } from "./namespaces/projects.types.js";
 import type { TierName, TierSetResult } from "./namespaces/tier.js";
 import type { Run402ExecutionMode } from "./config.js";
@@ -133,6 +133,18 @@ export interface Run402ActionResult<T = unknown> {
     steps: Run402ActionStep[];
     result?: T;
 }
+/** One post-apply HTTP verification result entry (deploy-manifest `verify.http[]`).
+ *  Same shape as `Run402AppUpResultEnvelope["verification"]["http"][number]`. */
+export interface Run402UpVerificationHttpEntry {
+    id: string;
+    status: Run402AppInstallNodeStatus;
+    path?: string;
+    url?: string;
+    expected_status: number;
+    actual_status?: number | null;
+    propagation_wait_ms?: number;
+    diagnostic?: Record<string, unknown>;
+}
 export interface Run402UpResult {
     project_id: string;
     manifest_path: string;
@@ -142,6 +154,13 @@ export interface Run402UpResult {
     spec?: ReleaseSpec;
     plan?: PlanResponse;
     deploy?: DeployResult;
+    /** Deploy-manifest `verify.http[]` per-check results (app manifests report
+     *  the same shape under `app_result.verification.http[]`). */
+    verification?: {
+        http: Run402UpVerificationHttpEntry[];
+    };
+    /** Deploy-manifest verify rollup (app manifests: `app_result.verify`). */
+    verify?: Run402AppUpVerifyResult;
 }
 export type Run402ProjectsProvisionActionResult = Run402ActionResult<ProvisionResult>;
 export type Run402TierSetActionResult = Run402ActionResult<TierSetResult>;

package/sdk/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;CAIf,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAC1B,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE3C,MAAM,MAAM,iBAAiB,GACzB,kCAAkC,GAClC,wBAAwB,GACxB,mBAAmB,CAAC;AAExB,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,YAAY,CAAC,EAAE,CAAC;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3C,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kGAAkG;IAClG,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,oBAAoB,GAC5B,OAAO,GACP,KAAK,GACL,+BAA+B,CAAC;AAEpC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,oBAAoB,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,oBAAoB,GAC5B,kBAAkB,GAClB,kBAAkB,GAClB,UAAU,GACV,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,GACpB,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,WAAW,GACX,oBAAoB,GACpB,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,GACT,SAAS,GACT,QAAQ,GACR,qBAAqB,CAAC;AAE1B,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAAC;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,mCAAmC,GAC7C,kBAAkB,CAAC,eAAe,CAAC,CAAC;AAEtC,MAAM,MAAM,yBAAyB,GACnC,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAC9B,kBAAkB,CAAC,cAAc,CAAC,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,GAAG,CACD,KAAK,EAAE,kCAAkC,EACzC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAChD,GAAG,CACD,KAAK,EAAE,wBAAwB,EAC/B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,GAAG,CACD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;CAIf,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAC1B,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE3C,MAAM,MAAM,iBAAiB,GACzB,kCAAkC,GAClC,wBAAwB,GACxB,mBAAmB,CAAC;AAExB,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,YAAY,CAAC,EAAE,CAAC;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3C,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kGAAkG;IAClG,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,oBAAoB,GAC5B,OAAO,GACP,KAAK,GACL,+BAA+B,CAAC;AAEpC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,oBAAoB,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,oBAAoB,GAC5B,kBAAkB,GAClB,kBAAkB,GAClB,UAAU,GACV,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,GACpB,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,WAAW,GACX,oBAAoB,GACpB,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,GACT,SAAS,GACT,QAAQ,GACR,qBAAqB,CAAC;AAE1B,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAAC;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,CAAC;CACZ;AAED;iFACiF;AACjF,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;kEAC8D;IAC9D,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,6BAA6B,EAAE,CAAA;KAAE,CAAC;IACzD,0EAA0E;IAC1E,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,MAAM,mCAAmC,GAC7C,kBAAkB,CAAC,eAAe,CAAC,CAAC;AAEtC,MAAM,MAAM,yBAAyB,GACnC,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAC9B,kBAAkB,CAAC,cAAc,CAAC,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,GAAG,CACD,KAAK,EAAE,kCAAkC,EACzC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAChD,GAAG,CACD,KAAK,EAAE,wBAAwB,EAC/B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,GAAG,CACD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3F"}

package/sdk/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,iBAAiB,EAAE,oBAAoB;IACvC,OAAO,EAAE,UAAU;IACnB,EAAE,EAAE,IAAI;CACA,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,iBAAiB,EAAE,oBAAoB;IACvC,OAAO,EAAE,UAAU;IACnB,EAAE,EAAE,IAAI;CACA,CAAC"}

package/sdk/dist/namespaces/projects.d.ts

@@ -103,7 +103,8 @@ export declare class Projects {
      * constraints, and RLS policies.
      */
     getSchema(id: string): Promise<SchemaReport>;
-    /** Run SQL against the project's database using the service key. */
+    /** Run SQL against the project's database using the service key. Returns
+     *  the gateway envelope verbatim: `{ status, schema, rows, row_count, fields }`. */
     sql(id: string, sql: string, params?: unknown[]): Promise<unknown>;
     /** Query or mutate a project table through PostgREST. */
     rest<T = unknown>(id: string, table: string, queryOrOptions?: string | ProjectRestOptions): Promise<T>;