v2.6.0

Routed-locale-context i18n

Declare supported locales as a spec.i18n release slice and routed HTTP functions receive a negotiated locale per request via x-run402-locale and x-run402-default-locale headers (omitted entirely when no i18n slice is active — additive-compat for pre-i18n bundles).

{
  "i18n": {
    "defaultLocale": "en",
    "locales": ["en", "es", "fr", "zh-Hant"],
    "detect": ["cookie:wl_locale", "accept-language"]
  }
}

Routed-function read pattern (single-arg (req)):

export default async (req) => {
  const locale = req.headers.get('x-run402-locale');
  const def = req.headers.get('x-run402-default-locale');
  return locale && locale !== def
    ? renderWithTranslations({ locale })
    : renderBase({ locale: def ?? 'en' });
};

What's in this release

• SDK — ReleaseSpec.i18n, I18nSpec, I18nDetectSource types; validateI18nSpec enforces byte-identical defaultLocale, the platform's locale-tag regex /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/, the 50-locale / 10-detect caps, and the RFC 6265 cookie-name grammar before any wire call.
• CLI — run402 deploy apply --manifest run402.deploy.json accepts top-level i18n. New Internationalization section in --help and llms-cli.txt. i18n: null is a deployable clear-the-slice spec.
• MCP — the deploy tool's Zod schema mirrors every platform rule.
• JSON schema — https://run402.com/schemas/release-spec.v1.json now declares the i18n slice for editor autocomplete.
• Agent docs — SKILL.md and openclaw/SKILL.md cover the read pattern and the localStorage-only language-switcher cookie gotcha (apps that persist locale to localStorage only won't be seen by server-side negotiation; mirror to a cookie and declare a cookie:<name> detect source).

Carry-forward semantics

• Omit i18n → carry forward from base release.
• "i18n": null → clear the slice.
• "i18n": { … } → replace.

Not in scope yet

Per-locale CloudFront edge caching, URL-prefix locale routing (/es/about), per-tenant defaultLocale overrides, and r.cache.invalidate() are tracked as future platform changes.

Closes #394.

Packages

• run402-mcp@2.6.0
• run402@2.6.0
• @run402/sdk@2.6.0

All three include SLSA provenance attestations via npm Trusted Publisher OIDC.