run402 4.82.0 → 4.84.0

package/sdk/dist/node/manifest-export.js

@@ -0,0 +1,78 @@
+import { relative, resolve } from "node:path";
+import { LocalError } from "../errors.js";
+export function manifestExportUnsupported(path, reason) {
+    throw new LocalError(`Cannot export ${path}: ${reason}`, "exporting authoring manifest", {
+        code: "MANIFEST_EXPORT_UNSUPPORTED", details: { field_paths: [path], reason },
+        next_actions: [{ type: "edit_manifest", why: "Use supported declarative release inputs, then retry --print-manifest. --print-spec is SDK-native inspection only." }],
+    });
+}
+/** Export relative to the original manifest directory, never the caller's cwd. */
+export function serializeDeployManifest(loaded, baseDir, explicitProject) {
+    if (loaded.config?.env_accessed.length)
+        manifestExportUnsupported("config.env", "evaluated environment values may contain secrets; keep them in the trusted config");
+    const secrets = loaded.spec.secrets;
+    if (secrets && Object.keys(secrets).some((key) => !["require", "delete"].includes(key)))
+        manifestExportUnsupported("secrets", "embedded secret values are not exportable");
+    const aliases = { timeoutSeconds: "timeout_seconds", memoryMb: "memory_mb", contentType: "content_type", requireAuth: "require_auth", requireRole: "require_role", idColumn: "id_column", roleColumn: "role_column", cacheTtl: "cache_ttl", onDeny: "on_deny", signInPath: "sign_in_path", defaultLocale: "default_locale", unknownLocalePolicy: "unknown_locale_policy" };
+    const seen = new Set();
+    function visit(value, path, content = false) {
+        if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number")
+            return value;
+        if (value instanceof Uint8Array)
+            return { data: Buffer.from(value).toString("base64"), encoding: "base64" };
+        if (value instanceof ArrayBuffer)
+            return { data: Buffer.from(value).toString("base64"), encoding: "base64" };
+        if (typeof value !== "object" || value === undefined)
+            return manifestExportUnsupported(path, "executable or non-JSON value");
+        if (seen.has(value))
+            return manifestExportUnsupported(path, "cyclic object");
+        seen.add(value);
+        try {
+            if (Array.isArray(value))
+                return value.map((item, index) => visit(item, `${path}[${index}]`));
+            const record = value;
+            if (record.__source === "fs-file")
+                return { path: relative(baseDir, record.path).split("\\").join("/"), ...(record.contentType ? { content_type: record.contentType } : {}) };
+            if (record.__source === "local-dir")
+                return manifestExportUnsupported(path, "directory enumeration is dynamic; use explicit file entries for a reloadable JSON export");
+            if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+                return manifestExportUnsupported(path, "streams and runtime objects are not declarative JSON");
+            const isNamedMap = /^(functions\.(replace|patch\.set)|site\.(replace|patch\.put))$/.test(path) || path.endsWith(".files");
+            const schemaAliases = path === "i18n" || /^functions\.(?:replace|patch\.set)\.[^.]+(?:\.config|\.requireRole)?$/.test(path) || content;
+            const result = {};
+            for (const [key, child] of Object.entries(record)) {
+                if (child === undefined)
+                    continue;
+                result[isNamedMap || !schemaAliases ? key : aliases[key] ?? key] = visit(child, path ? `${path}.${key}` : key, (isNamedMap && !path.startsWith("functions.")) || path.endsWith(".files") || (key === "source" && /^(functions|assets)\./.test(path)) || (key === "data" && content));
+            }
+            // ContentSource {data: Uint8Array} wraps bytes; its authoring encoding
+            // belongs alongside data, not in a second nested data wrapper.
+            if (record.data instanceof Uint8Array || record.data instanceof ArrayBuffer) {
+                Object.assign(result, visit(record.data, `${path}.data`));
+            }
+            return result;
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    const { project: _project, ...spec } = loaded.spec;
+    const result = visit(spec, "");
+    const project = explicitProject ?? loaded.manifest.project_id ?? loaded.manifest.project;
+    if (project)
+        result.project_id = project;
+    if (loaded.idempotencyKey)
+        result.idempotency_key = loaded.idempotencyKey;
+    if (loaded.verify)
+        result.verify = visit(loaded.verify, "verify");
+    const migrations = result.database?.migrations;
+    loaded.manifest.database?.migrations?.forEach((migration, index) => {
+        const path = migration.sql_path ?? migration.sql_file;
+        if (path && migrations?.[index]) {
+            delete migrations[index].sql;
+            migrations[index].sql_path = relative(baseDir, resolve(baseDir, path)).split("\\").join("/");
+        }
+    });
+    return result;
+}
+//# sourceMappingURL=manifest-export.js.map

package/sdk/dist/node/manifest-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-export.js","sourceRoot":"","sources":["../../src/node/manifest-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,MAAc;IACpE,MAAM,IAAI,UAAU,CAAC,iBAAiB,IAAI,KAAK,MAAM,EAAE,EAAE,8BAA8B,EAAE;QACvF,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE;QAC7E,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,oHAAoH,EAAE,CAAC;KACrK,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,MAAgC,EAAE,OAAe,EAAE,eAA+B;IACxH,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM;QAAE,yBAAyB,CAAC,YAAY,EAAE,mFAAmF,CAAC,CAAC;IACrK,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;IACpC,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,yBAAyB,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IAC3K,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC;IACnY,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,OAAO,GAAG,KAAK;QAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzH,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC5G,IAAI,KAAK,YAAY,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC7G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,yBAAyB,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC;QAC7H,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAc,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxL,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;gBAAE,OAAO,yBAAyB,CAAC,IAAI,EAAE,0FAA0F,CAAC,CAAC;YACxK,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,OAAO,yBAAyB,CAAC,IAAI,EAAE,sDAAsD,CAAC,CAAC;YAC/L,MAAM,UAAU,GAAG,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1H,MAAM,aAAa,GAAG,IAAI,KAAK,MAAM,IAAI,uEAAuE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;YACvI,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAClC,MAAM,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC;YACvR,CAAC;YACD,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,MAAM,CAAC,IAAI,YAAY,UAAU,IAAI,MAAM,CAAC,IAAI,YAAY,WAAW,EAAE,CAAC;gBAC5E,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG,eAAe,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzF,IAAI,OAAO;QAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc;QAAE,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,UAAU,GAAI,MAAM,CAAC,QAAmE,EAAE,UAAU,CAAC;IAC3G,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;QACtD,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;YAC7B,UAAU,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/sdk/dist/node/preflight.d.ts

@@ -0,0 +1,65 @@
+import type { ReleaseSpec } from "../namespaces/deploy.types.js";
+export interface LocalPreflightTarget {
+    project_id: string | null;
+    project_name: string | null;
+    source: "explicit" | "workspace_link" | "manifest" | "create" | "unresolved";
+}
+export declare function describeLocalPreflight(input: {
+    appRoot: string;
+    manifestPath: string | null;
+    spec?: Partial<ReleaseSpec>;
+    authoring?: unknown;
+    entryPoint?: "up" | "deploy apply";
+    target: LocalPreflightTarget;
+    buildDeferred?: boolean;
+    apiBase?: string;
+    profile?: string;
+}): {
+    app_root: string;
+    manifest_path: string | null;
+    gateway_validated: false;
+    target: {
+        api_base: string | null;
+        profile: string | null;
+        project_id: string | null;
+        project_name: string | null;
+        source: "explicit" | "workspace_link" | "manifest" | "create" | "unresolved";
+    };
+    checks: ({
+        name: string;
+        status: string;
+        scope: string | null;
+        evidence_count: number;
+    } | {
+        reason?: string | undefined;
+        name: string;
+        status: string;
+        scope: string;
+        evidence_count: number;
+    })[];
+    warnings: (import("./source-scan.js").SourceScanFinding | {
+        code: string;
+        message: string;
+        pattern: string;
+    })[];
+    summary: {
+        file_references: number | null;
+        functions: number;
+        migrations: number;
+        routes: number;
+    };
+    next_actions: ({
+        why: string;
+        argv: string[];
+        type: string;
+    } | {
+        why: string;
+        sdk_call: string;
+        type: string;
+    })[] | {
+        type: string;
+        safe_to_auto_execute: boolean;
+        why: string;
+    }[];
+};
+//# sourceMappingURL=preflight.d.ts.map

package/sdk/dist/node/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/node/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAIjE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC9E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC/F,UAAU,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC/H;;;;;;;oBARa,MAAM,GAAG,IAAI;sBACX,MAAM,GAAG,IAAI;gBACnB,UAAU,GAAG,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB7E"}

package/sdk/dist/node/preflight.js

@@ -0,0 +1,23 @@
+import { collectLocalFileReferences, collectAuthoringFileReferences } from "./deploy-manifest.js";
+import { scanDeploymentSources } from "./source-scan.js";
+export function describeLocalPreflight(input) {
+    const spec = input.spec ?? {};
+    const refs = input.authoring ? collectAuthoringFileReferences(input.authoring, input.appRoot) : collectLocalFileReferences(spec);
+    const scan = scanDeploymentSources(spec, input.appRoot);
+    const warningRoutes = (spec.routes?.replace ?? []).filter((route) => route.target.type === "function" && spec.functions?.replace && !spec.functions.replace[route.target.name]);
+    const checks = [
+        { name: "manifest", status: "passed", scope: input.manifestPath, evidence_count: 1 },
+        { name: "target_agreement", status: "passed", scope: input.appRoot, evidence_count: input.target.project_id ? 1 : 0 },
+        { name: "file_references", status: input.buildDeferred ? "deferred" : "passed", scope: input.appRoot, evidence_count: input.buildDeferred ? 0 : refs.length, ...(input.buildDeferred ? { reason: "Build commands may produce these files. No build was executed." } : {}) },
+        { name: "source_scan", status: process.env.RUN402_DEPLOY_SKIP_SCAN === "1" ? "skipped" : "passed", scope: scan.scan_root, evidence_count: scan.checked_files, reason: process.env.RUN402_DEPLOY_SKIP_SCAN === "1" ? "Explicit RUN402_DEPLOY_SKIP_SCAN override." : "Selected application source and explicit file references; unrelated applications excluded." },
+        ...["remote_policy", "quota", "cost", "secret_existence", "migration_registry", "content_presence", "base_release_drift"].map((name) => ({ name, status: "deferred", scope: "gateway", evidence_count: 0, reason: "Requires gateway --plan review." })),
+    ];
+    return {
+        app_root: input.appRoot, manifest_path: input.manifestPath, gateway_validated: false,
+        target: { ...input.target, api_base: input.apiBase ?? null, profile: input.profile ?? null }, checks,
+        warnings: [...scan.findings.filter((finding) => finding.severity !== "error"), ...warningRoutes.map((route) => ({ code: "LOCAL_ROUTE_TARGET_UNDECLARED", message: "Route references a function absent from functions.replace; review this target.", pattern: route.pattern }))],
+        summary: { file_references: input.buildDeferred ? null : refs.length, functions: Object.keys(spec.functions?.replace ?? spec.functions?.patch?.set ?? {}).length, migrations: spec.database?.migrations?.length ?? 0, routes: spec.routes?.replace?.length ?? 0 },
+        next_actions: input.target.project_id ? [{ type: "review_plan", ...(input.manifestPath ? { argv: ["run402", ...(input.entryPoint === "deploy apply" ? ["deploy", "apply"] : ["up"]), "--manifest", input.manifestPath, "--project", input.target.project_id, "--plan"] } : { sdk_call: "project(project_id).apply.plan(spec)" }), why: "Review gateway-authoritative policy, cost and current state." }] : [{ type: "select_project", safe_to_auto_execute: false, why: input.target.source === "create" ? "Create intent is selected; the new project must exist before gateway plan review." : "Choose an existing project or an explicit new-project name before deploying." }],
+    };
+}
+//# sourceMappingURL=preflight.js.map

package/sdk/dist/node/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/node/preflight.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAQzD,MAAM,UAAU,sBAAsB,CAAC,KAGtC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChL,MAAM,MAAM,GAAG;QACb,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,EAAE;QACpF,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACrH,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC3Q,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,4FAA4F,EAAE;QACjW,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;KACxP,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,iBAAiB,EAAE,KAAc;QAC7F,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE,MAAM;QACpG,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,gFAAgF,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/Q,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE;QACjQ,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,sCAAsC,EAAE,CAAC,EAAE,GAAG,EAAE,8DAA8D,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,mFAAmF,CAAC,CAAC,CAAC,8EAA8E,EAAE,CAAC;KACnpB,CAAC;AACJ,CAAC"}

package/sdk/dist/node/source-scan.d.ts

@@ -0,0 +1,73 @@
+import type { ReleaseSpec } from "../namespaces/deploy.types.js";
+export interface SourceScanFinding {
+    code: string;
+    severity: string;
+    file: string;
+    line?: number;
+    message: string;
+    canonical_name?: string;
+    [key: string]: unknown;
+}
+interface ScanOptions {
+    excludeFiles?: Set<string>;
+    cwd?: string;
+    filePath?: string;
+    declaredCapabilities?: Set<string> | string[];
+}
+/** Severity ladder for scanner findings. `error` blocks deploy; `warn`
+ *  reports but doesn't block. The `run402 doctor` exit code is non-zero
+ *  whenever any `error`-severity finding is present. */
+export declare const SCAN_SEVERITY: Readonly<{
+    ERROR: "error";
+    WARN: "warn";
+}>;
+/** Scan a single file's content. Returns the array of findings (zero
+ *  or more). Pure / no I/O — tests pass strings directly. */
+export declare function scanFileContent(content: string, opts?: ScanOptions): SourceScanFinding[];
+/** Recursively walk `srcDir` and scan every file with a relevant
+ *  extension. Returns the combined findings list, sorted by file +
+ *  line for stable output. */
+export declare function scanSourceTree(srcDir: string, opts?: ScanOptions): SourceScanFinding[];
+/** Scan an explicit list of on-disk file paths — no directory walk.
+ *  Used by `run402 deploy apply` for manifest/spec/stdin deploys, where
+ *  the artifact is exactly the set of files the manifest references, NOT
+ *  whatever happens to live under cwd/src. Files without a
+ *  scannable extension are ignored; unreadable files become a WARN
+ *  finding (never throw). Returns the combined findings list, sorted by
+ *  file + line for stable output, exactly like `scanSourceTree`. */
+export declare function scanSourceFiles(filePaths: string[], opts?: ScanOptions): SourceScanFinding[];
+/** Convenience for tests: synchronous, no FS access. */
+export declare function _testOnly_hallucinatedNames(): {
+    name: string;
+    canonical: string;
+    origin: string;
+}[];
+export declare function _testOnly_authProperties(): {
+    name: string;
+    canonical: string;
+}[];
+/** Read the union of `capabilities` declared across all function entries in
+ *  `run402.config.json` (the apply spec). Used by the tenant-assertion mint
+ *  check (#8) to suppress the warning when "auth.sessionMint" is declared.
+ *
+ *  Functions live under `functions.replace.<name>` / `functions.set.<name>`
+ *  with `capabilities?: string[]` as a sibling to `config`. Best-effort:
+ *  a missing or malformed config returns an empty set (the scanner then
+ *  warns, which is the safe default — the runtime gate is the hard
+ *  enforcement). Returns a `Set<string>`. */
+export declare function readDeclaredCapabilities(cwd?: string): Set<string>;
+/** Resolve the project's src/ directory. Astro convention is `<root>/src`;
+ *  bare Node projects use `<root>/src` or `<root>`. We prefer `src/` if
+ *  it exists. */
+export declare function resolveScanRoot(cwd?: string): string;
+/** The same selected-app scope gates up/apply and is reported by doctor. */
+export declare function scanDeploymentSources(spec: Partial<ReleaseSpec>, appRoot: string, sourceRoot?: string): {
+    app_root: string;
+    scan_root: string;
+    checked_files: number;
+    explicit_references: number;
+    findings: SourceScanFinding[];
+    errors: SourceScanFinding[];
+};
+export {};
+//# sourceMappingURL=source-scan.d.ts.map

package/sdk/dist/node/source-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-scan.d.ts","sourceRoot":"","sources":["../../src/node/source-scan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAAE;AACrK,UAAU,WAAW;IAAG,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;CAAE;AAsCrI;;wDAEwD;AACxD,eAAO,MAAM,aAAa;;;EAGxB,CAAC;AA2FH;6DAC6D;AAC7D,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,uBAyPtE;AAED;;8BAE8B;AAC9B,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,uBAgCpE;AAED;;;;;;oEAMoE;AACpE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,WAAgB,uBAgC1E;AAiCD,wDAAwD;AACxD,wBAAgB,2BAA2B;;;;IAE1C;AAED,wBAAgB,wBAAwB;;;IAEvC;AAED;;;;;;;;6CAQ6C;AAC7C,wBAAgB,wBAAwB,CAAC,GAAG,SAAgB,eAqB3D;AAED;;iBAEiB;AACjB,wBAAgB,eAAe,CAAC,GAAG,SAAgB,UAQlD;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;;;;;;;EAkBrG"}