refactor(sdk)!: require x402/viem deps and align sites.deploy signature

Two related surface changes to improve SDK DX before the next minor.

Move @x402/evm, @x402/fetch, mppx, and viem from optionalDependencies
to dependencies in sdk/package.json. Optional deps failed silently on
fresh installs (e.g. npm ci --omit=optional), leaving run402() looking
healthy until the first paid request returned PaymentRequired instead
of auto-paying. Hard deps now fail loudly at install time.

Align sites.deploy with the rest of the SDK: every other method takes
(projectId, opts) with payload inside opts. sites.deploy was the only
outlier at (project, files, opts). New shape is
sites.deploy(projectId, { files, target?, inherit? }). Updates the
MCP tool, CLI, tests, and README example.

BREAKING: @run402/sdk sites.deploy callers must pass files inside the
options object.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MajorTal

README.md

@@ -37,9 +37,9 @@ import { run402 } from "@run402/sdk/node";
 const r = run402();
 const project = await r.projects.provision({ tier: "prototype" });
 await r.blobs.put(project.project_id, "hello.txt", { content: "hi" });
-await r.sites.deploy(project.project_id, [
-  { file: "index.html", data: "<h1>hello</h1>" },
-]);
+await r.sites.deploy(project.project_id, {
+  files: [{ file: "index.html", data: "<h1>hello</h1>" }],
+});
 ```
 
 17 namespaces: `projects`, `blobs`, `functions`, `secrets`, `subdomains`, `domains`, `sites`, `service`, `tier`, `allowance`, `ai`, `auth`, `senderDomain`, `billing`, `apps`, `email` (+ `webhooks`), `contracts`, `admin`.

cli/lib/sites.mjs

@@ -106,7 +106,8 @@ async function deploy(args) {
   allowanceAuthHeaders("/deployments/v1");
 
   try {
-    const data = await getSdk().sites.deploy(projectId, manifest.files, {
+    const data = await getSdk().sites.deploy(projectId, {
+      files: manifest.files,
       target: opts.target,
       inherit: opts.inherit,
     });

sdk/package.json

@@ -25,9 +25,7 @@
   ],
   "dependencies": {
     "@noble/curves": "^2.0.1",
-    "@noble/hashes": "^2.0.1"
-  },
-  "optionalDependencies": {
+    "@noble/hashes": "^2.0.1",
     "@x402/evm": "^2.6.0",
     "@x402/fetch": "^2.6.0",
     "mppx": "^0.4.7",

sdk/src/namespaces/secrets.test.ts

@@ -132,7 +132,7 @@ describe("domains (custom)", () => {
 describe("sites", () => {
   it("deploy POSTs project+files", async () => {
     const { fetch, calls } = mockFetch(() => json({ deployment_id: "dpl_1", url: "https://dpl_1.run402.com" }));
-    await sdk(fetch).sites.deploy("prj_k", [{ file: "index.html", data: "<p>hi</p>" }]);
+    await sdk(fetch).sites.deploy("prj_k", { files: [{ file: "index.html", data: "<p>hi</p>" }] });
     assert.equal(calls[0]!.url, "https://api.test/deployments/v1");
     const body = JSON.parse(calls[0]!.body as string);
     assert.equal(body.project, "prj_k");
@@ -142,7 +142,7 @@ describe("sites", () => {
 
   it("deploy includes inherit when set", async () => {
     const { fetch, calls } = mockFetch(() => json({ deployment_id: "d", url: "u" }));
-    await sdk(fetch).sites.deploy("prj_k", [{ file: "i.html", data: "x" }], { inherit: true, target: "prod" });
+    await sdk(fetch).sites.deploy("prj_k", { files: [{ file: "i.html", data: "x" }], inherit: true, target: "prod" });
     const body = JSON.parse(calls[0]!.body as string);
     assert.equal(body.inherit, true);
     assert.equal(body.target, "prod");

sdk/src/namespaces/sites.ts

@@ -17,6 +17,8 @@ export interface SiteFile {
 }
 
 export interface SiteDeployOptions {
+  /** Files to deploy. Paths are relative to the site root. */
+  files: SiteFile[];
   /** Deployment target label, e.g. `"production"`. */
   target?: string;
   /**
@@ -49,12 +51,8 @@ export class Sites {
    * (x402 in Node when a tier purchase is required; typically free with an
    * active tier).
    */
-  async deploy(
-    project: string,
-    files: SiteFile[],
-    opts: SiteDeployOptions = {},
-  ): Promise<SiteDeployResult> {
-    const body: Record<string, unknown> = { project, files };
+  async deploy(projectId: string, opts: SiteDeployOptions): Promise<SiteDeployResult> {
+    const body: Record<string, unknown> = { project: projectId, files: opts.files };
     if (opts.target !== undefined) body.target = opts.target;
     if (opts.inherit) body.inherit = true;
 

src/tools/deploy-site.ts

@@ -40,11 +40,11 @@ export async function handleDeploySite(args: {
   if ("error" in auth) return auth.error;
 
   try {
-    const body = await getSdk().sites.deploy(
-      args.project,
-      args.files as Array<{ file: string; data: string; encoding?: "utf-8" | "base64" }>,
-      { target: args.target, inherit: args.inherit },
-    );
+    const body = await getSdk().sites.deploy(args.project, {
+      files: args.files as Array<{ file: string; data: string; encoding?: "utf-8" | "base64" }>,
+      target: args.target,
+      inherit: args.inherit,
+    });
 
     // Persist the last deployment ID on the project (MCP-local side effect).
     updateProject(args.project, { last_deployment_id: body.deployment_id });