run402 4.87.0 → 4.88.0

package/README.md

@@ -249,7 +249,7 @@ import { db, adminDb, auth, email, ai } from "@run402/functions";
 
 ### Same-origin web routes
 
-`run402 deploy apply` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Recipe — static home page + SPA shell: a root alias `{ "pattern": "/", "target": { "type": "static", "file": "home.html" } }` (with `home.html` at the site root) serves real static bytes at `GET /` (`route_static_alias`) while unmatched app routes keep the `index.html` shell (`spa_fallback`); expect non-blocking `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn) / `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info) plan lints and verify with `run402 deploy resolve --url https://<your-site>/ --method GET`. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
+`run402 deploy apply` accepts `site.public_paths` for clean static browser URLs and `routes.replace` for function ingress or exact method-aware static aliases. Release asset paths such as `events.html` are distinct from public paths such as `/events`: prefer `{ "site": { "replace": { "events.html": { "data": "<h1>Events</h1>" } }, "public_paths": { "mode": "explicit", "replace": { "/events": { "asset": "events.html" } } } } }` for ordinary clean static URLs. In explicit mode `/events.html` is not public unless separately declared; `mode: "implicit"` restores filename-derived reachability and can widen access. `site.embedding.frame_ancestors` (catalog keys, e.g. `["localhost"]`, never raw origins) lets the named embedders put the site in an iframe: the gateway sends `Content-Security-Policy: frame-ancestors http://localhost:* http://127.0.0.1:*` and drops `X-Frame-Options` on every response of the host; omitted on a later apply carries the previous declaration forward, `null` returns to deny, unknown keys fail `INVALID_SPEC` naming the valid ones, and `/_run402/config.json` discloses the effective policy cross-origin so an embedder can check before framing. `routes.replace` is an array of route entries, not a path-keyed map. Use exact `/admin` plus final-wildcard `/admin/*` for a routed section root, narrow `/api/*` methods such as `["GET","POST","OPTIONS"]`, POST-only `/login` function routes, and exact static route targets like `{ "pattern": "/events", "methods": ["GET","HEAD"], "target": { "type": "static", "file": "events.html" } }` only for route-table alias behavior. Static route `file` is a release asset path, not a public path, URL, CAS hash, rewrite, or redirect. Recipe — static home page + SPA shell: a root alias `{ "pattern": "/", "target": { "type": "static", "file": "home.html" } }` (with `home.html` at the site root) serves real static bytes at `GET /` (`route_static_alias`) while unmatched app routes keep the `index.html` shell (`spa_fallback`); expect non-blocking `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn) / `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info) plan lints and verify with `run402 deploy resolve --url https://<your-site>/ --method GET`. Routed functions use Node 22 Fetch Request -> Response; `req.url` is the full public URL on managed subdomains, deployment hosts, and verified custom domains. Direct `/functions/v1/:name` remains API-key protected. Known resolve literals include `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. Release inventories may include `static_public_paths` with `public_path`, `asset_path`, `reachability_authority`, and `direct`; resolve may return the same reachability fields plus `authorization_result`, `cas_object`, `response_variant`, and route/static fields like `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`. Static route target warnings include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and the backing `asset_path`. Runtime route failure codes to branch on: `ROUTE_MANIFEST_LOAD_FAILED`, `ROUTED_INVOKE_WORKER_SECRET_MISSING`, `ROUTED_INVOKE_AUTH_FAILED`, `ROUTED_ROUTE_STALE`, `ROUTE_METHOD_NOT_ALLOWED`, and `ROUTED_RESPONSE_TOO_LARGE`.
 
 ### Secrets
 

package/gitvault-surface.json

@@ -1,5 +1,5 @@
 {
-  "surface_version": "4.87.0",
+  "surface_version": "4.88.0",
   "verbs": [
     "repos create",
     "repos list",

package/lib/image.mjs

@@ -2,6 +2,8 @@ import { writeFileSync } from "fs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { assertAllowedValue, assertKnownFlags, flagValue, normalizeArgv, positionalArgs, failUnknownSubcommand } from "./argparse.mjs";
+import { resolveOrg } from "./org-context.mjs";
+import { nextAction } from "./next-actions.mjs";
 
 const HELP = `run402 image — Generate AI images via x402 micropayments
 
@@ -13,7 +15,9 @@ Options:
   --output <file>     Save image to file (e.g. output.png)
                       If omitted, returns base64 JSON to stdout
   --org <org_id>      The paying organization when the wallet belongs to more
-                      than one (Lightning rail); x402 ignores it
+                      than one (Lightning rail); x402 ignores it. Omitted, it
+                      is the current org (RUN402_ORG, the .run402.json binding,
+                      run402 org use, or the active project's owning org)
   --help, -h          Show this help message
 
 Examples:
@@ -47,7 +51,9 @@ Options:
   --output <file>     Save image to file (e.g. output.png). If omitted,
                       returns base64 JSON to stdout.
   --org <org_id>      The paying organization when the wallet belongs to more
-                      than one (Lightning rail); x402 ignores it
+                      than one (Lightning rail); x402 ignores it. Omitted, it
+                      is the current org (RUN402_ORG, the .run402.json binding,
+                      run402 org use, or the active project's owning org)
 
 Notes:
   - Requires a funded allowance (run402 allowance create && run402 allowance fund)
@@ -104,8 +110,17 @@ export async function run(sub, args) {
   }
   assertAllowedValue(opts.aspect, ["square", "landscape", "portrait"], "--aspect");
 
+  // The paying organization rides the ONE shared org chain (--org, then
+  // RUN402_ORG / RUN402_ROOM / RUN402_PROJECT_ID, then the .run402.json
+  // binding, then `org use` / the active project's owning org). Only the
+  // Lightning rail reads it — a multi-org principal is refused
+  // ORGANIZATION_SELECTION_REQUIRED without one — and x402 ignores it, so
+  // resolving it is never a reason to refuse an x402 purchase: `optional`
+  // answers null rather than ORG_REQUIRED when the chain is empty.
+  const org = await resolveOrg({ org: opts.org }, { cmd: "image", optional: true });
+
   try {
-    const data = await getSdk().ai.generateImage({ prompt: opts.prompt, aspect: opts.aspect, ...(opts.org ? { orgId: opts.org } : {}) });
+    const data = await getSdk().ai.generateImage({ prompt: opts.prompt, aspect: opts.aspect, ...(org ? { orgId: org.orgId } : {}) });
     if (opts.output) {
       const buf = Buffer.from(data.image, "base64");
       writeFileSync(opts.output, buf);
@@ -114,6 +129,45 @@ export async function run(sub, args) {
       console.log(JSON.stringify({ aspect: data.aspect, content_type: data.content_type, image: data.image }));
     }
   } catch (err) {
+    reportOrgSelectionError(err, org);
     reportSdkError(err);
   }
 }
+
+/**
+ * The Lightning rail's two org refusals, explained in the CLI's own words:
+ * `ORGANIZATION_SELECTION_REQUIRED` (no org named, and the SDK found no
+ * single local match among the gateway's candidates) and the 403 the
+ * gateway answers when the resolved org is one the principal cannot bill.
+ * Both name where the org came from and how to name another one.
+ */
+function reportOrgSelectionError(err, org) {
+  const code = err?.code;
+  const details = err?.details && typeof err.details === "object" ? err.details : {};
+  if (code === "ORGANIZATION_SELECTION_REQUIRED") {
+    const ids = Array.isArray(details.organization_ids) ? details.organization_ids : [];
+    fail({
+      code,
+      message: err.message,
+      hint:
+        `Pass --org <org_id> (one of: ${ids.join(", ") || "run402 org list"}) or select a current organization with ` +
+        "run402 org use <org_id>. Only the Lightning rail needs it; x402 ignores it.",
+      details: { ...details, organization_ids: ids, org_source: org?.source ?? null, org_source_detail: org?.sourceDetail ?? null },
+      next_actions: err.nextActions ?? [
+        nextAction("edit_request", { command: 'run402 image generate "<prompt>" --org <org_id>', why: "Name the paying organization on this call." }),
+        nextAction("edit_request", { command: "run402 org use <org_id>", why: "Select a current organization for this profile." }),
+      ],
+    });
+  }
+  if (err?.status === 403 && org && details.org_id === org.orgId && org.source !== "flag") {
+    fail({
+      code: code ?? "FORBIDDEN",
+      message: err.message,
+      hint:
+        `The paying organization ${org.orgId} came from ${org.sourceDetail} (${org.source}) and this principal holds no billing role there. ` +
+        "Pass --org <org_id> for an organization you can bill, or run: run402 org use <org_id>",
+      details: { ...details, org_source: org.source, org_source_detail: org.sourceDetail },
+      next_actions: err.nextActions,
+    });
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.87.0",
+  "version": "4.88.0",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/dist/credentials.d.ts

@@ -125,6 +125,14 @@ export interface CredentialsProvider {
     setActiveProject?(id: string): Promise<void>;
     /** Get the active/default project id from local state. Optional. */
     getActiveProject?(): Promise<string | null>;
+    /**
+     * Get the active/current organization id from local state (the CLI's
+     * `run402 org use`). Optional. Read by the SDK only to disambiguate a
+     * gateway `ORGANIZATION_SELECTION_REQUIRED` answer (the MPP Lightning
+     * rail's paying organization when the principal belongs to several); it
+     * is never sent unprompted and never an authorization input.
+     */
+    getActiveOrg?(): Promise<string | null>;
     /** Read the local allowance (wallet). Optional — sandbox providers may omit. */
     readAllowance?(): Promise<AllowanceData | null>;
     /** Persist the local allowance. Optional. */

package/sdk/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IACpC,4HAA4H;IAC5H,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,YAAY,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,gBAAgB,GAChB,sBAAsB,GACtB,yBAAyB,GACzB,0BAA0B,GAC1B,yBAAyB,CAAC;AAE9B,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,+BAA+B;IAC/B,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,mBAAmB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAE1F;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAEhE;;;OAGG;IACH,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAErD,qGAAqG;IACrG,sBAAsB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAEhE;;;OAGG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,kGAAkG;IAClG,aAAa,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE,oEAAoE;IACpE,aAAa,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C,kEAAkE;IAClE,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C,oEAAoE;IACpE,gBAAgB,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5C,gFAAgF;IAChF,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEhD,6CAA6C;IAC7C,aAAa,CAAC,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,oHAAoH;IACpH,eAAe,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3C,6FAA6F;IAC7F,gBAAgB,CAAC,IAAI,MAAM,CAAC;IAE5B,+EAA+E;IAC/E,6BAA6B,CAAC,IAAI,0BAA0B,CAAC;IAE7D;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACtD"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IACpC,4HAA4H;IAC5H,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,YAAY,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,gBAAgB,GAChB,sBAAsB,GACtB,yBAAyB,GACzB,0BAA0B,GAC1B,yBAAyB,CAAC;AAE9B,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,+BAA+B;IAC/B,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,mBAAmB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAE1F;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAEhE;;;OAGG;IACH,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAErD,qGAAqG;IACrG,sBAAsB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAEhE;;;OAGG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,kGAAkG;IAClG,aAAa,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE,oEAAoE;IACpE,aAAa,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C,kEAAkE;IAClE,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C,oEAAoE;IACpE,gBAAgB,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5C;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAExC,gFAAgF;IAChF,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEhD,6CAA6C;IAC7C,aAAa,CAAC,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,oHAAoH;IACpH,eAAe,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3C,6FAA6F;IAC7F,gBAAgB,CAAC,IAAI,MAAM,CAAC;IAE5B,+EAA+E;IAC/E,6BAA6B,CAAC,IAAI,0BAA0B,CAAC;IAE7D;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACtD"}

package/sdk/dist/namespaces/ai.d.ts

@@ -34,11 +34,23 @@ export interface GenerateImageOptions {
     aspect?: ImageAspect;
     /**
      * The paying organization. Needed only on the MPP Lightning rail when the
-     * calling principal belongs to more than one organization (the gateway
-     * answers `ORGANIZATION_SELECTION_REQUIRED` otherwise); x402 ignores it.
+     * calling principal belongs to more than one organization; x402 ignores it.
+     *
+     * When omitted and the gateway answers `ORGANIZATION_SELECTION_REQUIRED`,
+     * the SDK retries ONCE with the one candidate from
+     * `details.organization_ids` that matches a local context — the
+     * provider's active organization (`run402 org use`) or the active
+     * project's cached owning org, else any locally stored project's owning
+     * org. Zero or several matches surface the error with the candidate ids
+     * and a next action naming `--org` / `orgId`. Nothing is ever inferred
+     * from membership count alone.
      */
     orgId?: string;
 }
+/** The gateway's answer when a multi-org principal names no paying org on the Lightning rail. */
+export declare const ORGANIZATION_SELECTION_REQUIRED = "ORGANIZATION_SELECTION_REQUIRED";
+/** `details.organization_ids` off an `ORGANIZATION_SELECTION_REQUIRED` error, else `[]`. */
+export declare function organizationCandidatesFromError(err: unknown): string[];
 export interface GenerateImageResult {
     /** Base64-encoded bytes. */
     image: string;
@@ -65,8 +77,10 @@ export declare class Ai {
     /** Get AI translation usage for the current billing cycle. */
     usage(projectId: string): Promise<AiUsageResult>;
     /**
-     * Generate an image from a text prompt. Costs $0.03 USDC via x402.
-     * No project scope — payment flows through the allowance-based fetch.
+     * Generate an image from a text prompt. Costs $0.03 via x402, MPP on
+     * Tempo, or MPP Lightning. No project scope — payment flows through the
+     * allowance-based fetch. See {@link GenerateImageOptions.orgId} for how a
+     * multi-org principal's paying organization is chosen on Lightning.
      */
     generateImage(opts: GenerateImageOptions): Promise<GenerateImageResult>;
 }

package/sdk/dist/namespaces/ai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../src/namespaces/ai.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAI9D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AAG9D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACnC;AAED,qBAAa,EAAE;IACD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,yEAAyE;IACnE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAepF,mFAAmF;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAWxE,8DAA8D;IACxD,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAStD;;;OAGG;IACG,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAkB9E"}
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../src/namespaces/ai.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAK9D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AAG9D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,eAAO,MAAM,+BAA+B,oCAAoC,CAAC;AAEjF,4FAA4F;AAC5F,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAOtE;AAED,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACnC;AAED,qBAAa,EAAE;IACD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,yEAAyE;IACnE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAepF,mFAAmF;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAWxE,8DAA8D;IACxD,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAStD;;;;;OAKG;IACG,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAoB9E"}

package/sdk/dist/namespaces/ai.js

@@ -2,9 +2,21 @@
  * `ai` namespace — project-scoped AI add-ons (translation, moderation) and
  * wallet-scoped image generation.
  */
-import { LocalError } from "../errors.js";
+import { ApiError, LocalError, isRun402Error } from "../errors.js";
 import { requireProjectCredentials } from "../project-credentials.js";
 const IMAGE_ASPECTS = ["square", "landscape", "portrait"];
+/** The gateway's answer when a multi-org principal names no paying org on the Lightning rail. */
+export const ORGANIZATION_SELECTION_REQUIRED = "ORGANIZATION_SELECTION_REQUIRED";
+/** `details.organization_ids` off an `ORGANIZATION_SELECTION_REQUIRED` error, else `[]`. */
+export function organizationCandidatesFromError(err) {
+    if (!isRun402Error(err) || err.code !== ORGANIZATION_SELECTION_REQUIRED)
+        return [];
+    const details = err.details;
+    const ids = details && typeof details === "object" && !Array.isArray(details)
+        ? details.organization_ids
+        : undefined;
+    return Array.isArray(ids) ? ids.filter((id) => typeof id === "string" && id.length > 0) : [];
+}
 export class Ai {
     client;
     constructor(client) {
@@ -44,20 +56,128 @@ export class Ai {
         });
     }
     /**
-     * Generate an image from a text prompt. Costs $0.03 USDC via x402.
-     * No project scope — payment flows through the allowance-based fetch.
+     * Generate an image from a text prompt. Costs $0.03 via x402, MPP on
+     * Tempo, or MPP Lightning. No project scope — payment flows through the
+     * allowance-based fetch. See {@link GenerateImageOptions.orgId} for how a
+     * multi-org principal's paying organization is chosen on Lightning.
      */
     async generateImage(opts) {
         const aspect = opts.aspect ?? "square";
         if (!IMAGE_ASPECTS.includes(aspect)) {
             throw new LocalError(`aspect must be one of: ${IMAGE_ASPECTS.join(", ")}`, "generating image");
         }
-        // requestWithResponse, not request: the settlement receipt rides the
-        // RESPONSE, and `request` discards everything but the body — which is
-        // exactly how a caller could buy an image with no way to learn which
-        // network the money moved on.
-        const res = await this.client.requestWithResponse("/generate-image/v1", { method: "POST", body: { prompt: opts.prompt, aspect, ...(opts.orgId ? { org_id: opts.orgId } : {}) }, context: "generating image" });
-        return { ...res.body, payment: res.settlement ?? null };
+        try {
+            return await postGenerateImage(this.client, opts.prompt, aspect, opts.orgId);
+        }
+        catch (err) {
+            // Only an UNNAMED org is disambiguated: a caller-named org that the
+            // gateway still refuses is the caller's answer to keep.
+            const candidates = opts.orgId ? [] : organizationCandidatesFromError(err);
+            if (candidates.length === 0)
+                throw err;
+            const matched = await matchKnownOrganization(this.client, candidates);
+            if (matched.chosen)
+                return postGenerateImage(this.client, opts.prompt, aspect, matched.chosen);
+            throw organizationSelectionError(err, candidates, matched.matches);
+        }
+    }
+}
+// Module-level, not class-private: `ScopedRun402`'s drift test enumerates
+// every runtime method on a namespace, and a TypeScript `private` is public
+// at runtime.
+async function postGenerateImage(client, prompt, aspect, orgId) {
+    // requestWithResponse, not request: the settlement receipt rides the
+    // RESPONSE, and `request` discards everything but the body — which is
+    // exactly how a caller could buy an image with no way to learn which
+    // network the money moved on.
+    const res = await client.requestWithResponse("/generate-image/v1", { method: "POST", body: { prompt, aspect, ...(orgId ? { org_id: orgId } : {}) }, context: "generating image" });
+    return { ...res.body, payment: res.settlement ?? null };
+}
+/**
+ * Intersect the gateway's candidates with what this machine already knows,
+ * most deliberate context first: the SELECTED pair (active org, active
+ * project's cached owning org) decides when exactly one candidate matches
+ * it; only when it names nothing do the STORED projects' owning orgs get a
+ * say, again only when exactly one candidate matches. Every read is local
+ * and best-effort — a provider without the optional methods, or a read that
+ * throws, contributes nothing rather than failing the purchase.
+ */
+async function matchKnownOrganization(client, candidates) {
+    const creds = client.credentials;
+    const selected = new Set();
+    const activeOrg = await optionalRead(() => creds.getActiveOrg?.call(creds));
+    if (activeOrg)
+        selected.add(activeOrg);
+    const activeProject = await optionalRead(() => creds.getActiveProject?.call(creds));
+    if (activeProject) {
+        const owning = orgIdOf(await optionalRead(() => client.getProjectCredentials(activeProject)));
+        if (owning)
+            selected.add(owning);
     }
+    const stored = new Set();
+    const listed = await optionalRead(() => creds.listProjectCredentials?.call(creds));
+    for (const entry of Object.values(listed ?? {})) {
+        const owning = orgIdOf(entry);
+        if (owning)
+            stored.add(owning);
+    }
+    const inSelected = candidates.filter((id) => selected.has(id));
+    if (inSelected.length === 1)
+        return { chosen: inSelected[0], matches: inSelected };
+    if (inSelected.length > 1)
+        return { chosen: null, matches: inSelected };
+    const inStored = candidates.filter((id) => stored.has(id));
+    return { chosen: inStored.length === 1 ? inStored[0] : null, matches: inStored };
+}
+async function optionalRead(read) {
+    try {
+        const value = await read();
+        return value === undefined ? null : value;
+    }
+    catch {
+        return null;
+    }
+}
+function orgIdOf(entry) {
+    const orgId = entry && typeof entry === "object" ? entry.org_id : undefined;
+    return typeof orgId === "string" && orgId.length > 0 ? orgId : null;
+}
+/**
+ * The gateway's `ORGANIZATION_SELECTION_REQUIRED` answer, re-thrown with the
+ * candidates named in the message and a next action that says how to name
+ * the paying organization. Status, code, and the raw envelope are kept.
+ */
+function organizationSelectionError(err, candidates, matches) {
+    const envelope = err.body && typeof err.body === "object" && !Array.isArray(err.body)
+        ? err.body
+        : {};
+    const details = envelope.details && typeof envelope.details === "object" && !Array.isArray(envelope.details)
+        ? envelope.details
+        : {};
+    const reason = matches.length > 1
+        ? `${matches.length} of them (${matches.join(", ")}) match this machine's local context, so none was chosen`
+        : "none of them matches this machine's local context (run402 org use, the active project, or a stored project)";
+    const message = `The paying organization is required: this principal belongs to ${candidates.length} organizations ` +
+        `(${candidates.join(", ")}) and ${reason}; name one with orgId (CLI: --org <org_id>) while generating image (HTTP ${err.status ?? 400})`;
+    const nextActions = [
+        {
+            type: "edit_request",
+            command: "run402 image generate \"<prompt>\" --org <org_id>",
+            why: "Name the paying organization on this call (SDK: generateImage({ orgId })). Candidates are in details.organization_ids.",
+        },
+        {
+            type: "edit_request",
+            command: "run402 org use <org_id>",
+            why: "Select a current organization for this profile so every later call inherits it.",
+        },
+        ...(Array.isArray(envelope.next_actions) ? envelope.next_actions : []),
+    ];
+    return new ApiError(message, err.status, {
+        ...envelope,
+        message,
+        code: ORGANIZATION_SELECTION_REQUIRED,
+        details: { ...details, organization_ids: candidates, matched_organization_ids: matches },
+        next_actions: nextActions,
+    }, "generating image");
 }
 //# sourceMappingURL=ai.js.map

package/sdk/dist/namespaces/ai.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai.js","sourceRoot":"","sources":["../../src/namespaces/ai.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAgCtE,MAAM,aAAa,GAA2B,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AA8BlF,MAAM,OAAO,EAAE;IACgB;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,yEAAyE;IACzE,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,IAAsB;QACvD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAE5F,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAE9C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,kBAAkB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI;YACJ,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,IAAY;QAC5C,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAE9F,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAiB,iBAAiB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAE7F,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAgB,cAAc,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,IAA0B;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;QACvC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAClB,0BAA0B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpD,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,8BAA8B;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC/C,oBAAoB,EACpB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CACtI,CAAC;QACF,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"ai.js","sourceRoot":"","sources":["../../src/namespaces/ai.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAgCtE,MAAM,aAAa,GAA2B,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAqBlF,iGAAiG;AACjG,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAEjF,4FAA4F;AAC5F,MAAM,UAAU,+BAA+B,CAAC,GAAY;IAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,+BAA+B;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3E,CAAC,CAAE,OAA0C,CAAC,gBAAgB;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAmBD,MAAM,OAAO,EAAE;IACgB;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,yEAAyE;IACzE,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,IAAsB;QACvD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAE5F,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAE9C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,kBAAkB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI;YACJ,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,IAAY;QAC5C,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAE9F,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAiB,iBAAiB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAE7F,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAgB,cAAc,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,IAA0B;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;QACvC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAClB,0BAA0B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpD,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,wDAAwD;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;YAC1E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,GAAG,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/F,MAAM,0BAA0B,CAAC,GAAkB,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,cAAc;AAEd,KAAK,UAAU,iBAAiB,CAC9B,MAAc,EACd,MAAc,EACd,MAAmB,EACnB,KAAyB;IAEzB,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAC1C,oBAAoB,EACpB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAC/G,CAAC;IACF,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,UAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS;QAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9F,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACpF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,YAAY,CAAI,IAAsC;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA8B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,GAAgB,EAAE,UAAoB,EAAE,OAAiB;IAC3F,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnF,CAAC,CAAE,GAAG,CAAC,IAAgC;QACvC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC1G,CAAC,CAAE,QAAQ,CAAC,OAAmC;QAC/C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D;QAC5G,CAAC,CAAC,6GAA6G,CAAC;IAClH,MAAM,OAAO,GACX,kEAAkE,UAAU,CAAC,MAAM,iBAAiB;QACpG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,4EAA4E,GAAG,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC;IAC3I,MAAM,WAAW,GAAiB;QAChC;YACE,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mDAAmD;YAC5D,GAAG,EAAE,wHAAwH;SAC9H;QACD;YACE,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,yBAAyB;YAClC,GAAG,EAAE,iFAAiF;SACvF;QACD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,YAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,OAAO,IAAI,QAAQ,CACjB,OAAO,EACP,GAAG,CAAC,MAAM,EACV;QACE,GAAG,QAAQ;QACX,OAAO;QACP,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,wBAAwB,EAAE,OAAO,EAAE;QACxF,YAAY,EAAE,WAAW;KAC1B,EACD,kBAAkB,CACnB,CAAC;AACJ,CAAC"}

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAsB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,yBAAyB,EACzB,uBAAuB,EAUvB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,4EAA4E;QAC5E,QAAQ,CAAC,EAAE,uBAAuB,CAAC;KAC/B,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,EAAE,yBAAyB,CAAC;KACjC,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAyjED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAsB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,yBAAyB,EACzB,uBAAuB,EAUvB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,4EAA4E;QAC5E,QAAQ,CAAC,EAAE,uBAAuB,CAAC;KAC/B,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,EAAE,yBAAyB,CAAC;KACjC,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAmkED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}

package/sdk/dist/namespaces/deploy.js

@@ -1068,13 +1068,19 @@ function siteToCoreSpec(site) {
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
         };
     }
-    return { public_paths: site.public_paths };
+    // tenant-site-embedding never reaches core: the catalog is gateway-owned and
+    // core validates site keys against its own list.
+    return site.public_paths ? { public_paths: site.public_paths } : {};
 }
 function siteToWire(site) {
+    // tenant-site-embedding: `null` is a meaningful value on the wire (clear), so
+    // it is carried whenever the key is present, unlike public_paths.
+    const embedding = "embedding" in site && site.embedding !== undefined ? { embedding: site.embedding } : {};
     if ("replace" in site && site.replace) {
         return {
             replace: fileSetToWire(site.replace),
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
+            ...embedding,
         };
     }
     if ("patch" in site && site.patch) {
@@ -1084,9 +1090,13 @@ function siteToWire(site) {
                 ...(site.patch.delete ? { delete: site.patch.delete } : {}),
             },
             ...(site.public_paths ? { public_paths: site.public_paths } : {}),
+            ...embedding,
         };
     }
-    return { public_paths: site.public_paths };
+    return {
+        ...(site.public_paths ? { public_paths: site.public_paths } : {}),
+        ...embedding,
+    };
 }
 function i18nToWire(i18n) {
     return {
@@ -2231,7 +2241,7 @@ const FUNCTION_SPEC_FIELDS = new Set([
 const FUNCTION_CONFIG_FIELDS = new Set(["timeoutSeconds", "memoryMb"]);
 const FUNCTION_TRIGGER_FIELDS = new Set(["id", "type", "cron", "timezone", "misfire_policy", "overlap_policy", "mailbox", "events", "run"]);
 const FUNCTION_TRIGGER_RUN_FIELDS = new Set(["event_type", "payload", "retry", "expires_after_seconds"]);
-const SITE_SPEC_FIELDS = new Set(["replace", "patch", "public_paths"]);
+const SITE_SPEC_FIELDS = new Set(["replace", "patch", "public_paths", "embedding"]);
 const SITE_PATCH_FIELDS = new Set(["put", "delete"]);
 const SITE_PUBLIC_PATHS_FIELDS = new Set(["mode", "replace"]);
 const PUBLIC_STATIC_PATH_FIELDS = new Set(["asset", "cache_class"]);
@@ -2565,6 +2575,22 @@ function validateSiteSpec(site) {
     if (obj.public_paths !== undefined) {
         validateSitePublicPathsSpec(obj.public_paths, "site.public_paths");
     }
+    if (obj.embedding !== undefined) {
+        validateSiteEmbeddingSpec(obj.embedding, "site.embedding");
+    }
+}
+/** tenant-site-embedding. Structural check only: the catalog is the gateway's
+ *  (it names the valid keys in INVALID_SPEC), so a new key never needs an SDK
+ *  release. `null` clears; omitted carries forward. */
+function validateSiteEmbeddingSpec(value, resource) {
+    if (value === null)
+        return;
+    const obj = requireObject(value, resource);
+    validateKnownFields(obj, resource, new Set(["frame_ancestors"]));
+    if (!Array.isArray(obj.frame_ancestors) || obj.frame_ancestors.length === 0) {
+        throw invalidSpec(`ReleaseSpec.${resource}.frame_ancestors must be a non-empty array of embedding catalog keys (e.g. ["localhost"]); omit ${resource} to carry the previous declaration forward or send null to deny`, `${resource}.frame_ancestors`);
+    }
+    validateStringArray(obj.frame_ancestors, `${resource}.frame_ancestors`);
 }
 function validateSitePublicPathsSpec(value, resource) {
     const obj = requireObject(value, resource);
@@ -2917,6 +2943,11 @@ function hasDatabaseContent(database) {
     return hasArrayEntries(database.migrations) || hasRecordEntries(database.expose);
 }
 function hasSiteContent(site) {
+    // tenant-site-embedding: a declaration (or an explicit null that clears one)
+    // is deploy content on its own, like a public_paths-only site.
+    if (site && typeof site === "object" && "embedding" in site && site.embedding !== undefined) {
+        return true;
+    }
     if (!isRecord(site))
         return false;
     if (hasRecordEntries(site.replace))
@@ -3366,6 +3397,10 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
     }
     if (spec.site) {
         const publicPaths = "public_paths" in spec.site ? spec.site.public_paths : undefined;
+        // tenant-site-embedding: present (object or null) travels as-is.
+        const embedding = "embedding" in spec.site && spec.site.embedding !== undefined
+            ? { embedding: spec.site.embedding }
+            : {};
         if ("replace" in spec.site && spec.site.replace) {
             const map = await normalizeFileSet(spec.site.replace, rememberRelease);
             // Re-check post-expansion so `dir("dist")` (a LocalDirRef whose keys are
@@ -3374,6 +3409,7 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
             normalized.site = {
                 replace: map,
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
+                ...embedding,
             };
         }
         else if ("patch" in spec.site && spec.site.patch) {
@@ -3387,10 +3423,14 @@ async function normalizeReleaseSpec(client, spec, opts = {}) {
             normalized.site = {
                 patch,
                 ...(publicPaths ? { public_paths: publicPaths } : {}),
+                ...embedding,
             };
         }
-        else if (publicPaths) {
-            normalized.site = { public_paths: publicPaths };
+        else if (publicPaths || "embedding" in embedding) {
+            normalized.site = {
+                ...(publicPaths ? { public_paths: publicPaths } : {}),
+                ...embedding,
+            };
         }
     }
     // v1.48 unified-apply: asset slice normalization. Mirrors the site