v4.143.0

Phone apps: Google sign-in and push

Run402 apps with their own Android app (iPhone later) can now sign people in with Google and send them push notifications. Both use keys from your own Google and Firebase projects.

Native Google sign-in

• run402 auth settings --google-client-ids <web-client-id>,<android-client-id> (r.auth.settings(projectId, { google_client_ids })) lists the Google OAuth client IDs your phone apps sign in with: the web client ID the app passes to Google, and each Android or iOS client ID (one per signing certificate), at most 10.
• none ([]) turns native sign-in off, and leaving the flag out keeps the current list.
• The app signs in at POST /auth/v1/native-sessions with the ID token from the phone's own Google sheet. The person is the same user as with Google sign-in on the web, and the session's Bearer reaches auth.user() on the app's routed paths.

Push to your own phone app

• run402 push fcm set --service-account <file.json> (r.push.setFcmCredential(projectId, serviceAccount)) gives Run402 the app's Firebase service-account key. The key is checked with Google before it is stored and is never returned.
• run402 push fcm remove (r.push.removeFcmCredential) removes the key and every device registered under it.
• A phone app signed in with native sign-in registers its Firebase token at POST /_run402/push/devices, and the same push.send then reaches it.
• run402 push status gains providers.fcm and devices. Each delivery in --message carries kind: "web" | "native".
• setFcmCredential refuses on the MCP sandbox with SECRET_REQUIRES_CLI, so a run snippet hands you the CLI command instead.

Functions send to phones with push.send({ data, ... }) from @run402/functions 4.21.0.