@hsuite/smart-engines-cli 1.2.0 → 1.4.0

package/dist/_lib/docker.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Thin, testable wrappers around the `docker` CLI for the trusted-deploy flow.
+ *
+ * Before the trusted-deploy arc the CLI only PRINTED the `docker login` /
+ * `docker push` commands and waited for the developer to run them by hand.
+ * Now the CLI wraps the push so it can RECORD the pushed image's registry
+ * manifest digest — the `imageDigest` field every {@link BuildAttestation}
+ * binds to. The digest must be the value the registry returns for the pushed
+ * tag, not a locally-computed one, so the attestation references the exact
+ * bytes the cluster will pull.
+ *
+ * Every function shells out via `child_process.spawn` with an argv array (never
+ * a shell string), so registry passwords and tags can't be shell-injected.
+ * Secrets (the one-time push password) are fed on stdin, never on argv.
+ */
+import { spawn } from 'child_process';
+/** Registry coordinates returned by `deployment.init` (`BaasInitResponse`). */
+export type RegistryCreds = {
+    server: string;
+    username: string;
+    password: string;
+    repository: string;
+};
+/**
+ * The fully-qualified image reference for a pushed artifact:
+ * `<server>/<repository>:<tag>`.
+ */
+export declare function imageRef(registry: RegistryCreds, tag: string): string;
+/**
+ * `docker login` to the per-app Harbor registry using the one-time push robot
+ * credentials. Password is fed on stdin (`--password-stdin`).
+ *
+ * @throws if docker exits non-zero (login failed).
+ */
+export declare function dockerLogin(registry: RegistryCreds, spawnFn?: typeof spawn): Promise<void>;
+/**
+ * Parse the registry manifest digest from `docker push` output.
+ *
+ * A successful `docker push` prints a summary line of the shape:
+ *   `v0.1.0: digest: sha256:<64hex> size: 1786`
+ * We extract the `sha256:<64hex>` token. This is the registry's MANIFEST
+ * digest for the pushed tag — exactly what the attestation's `imageDigest`
+ * must carry.
+ *
+ * @returns the `sha256:<64hex>` digest, or `null` if no digest line is present.
+ */
+export declare function parsePushDigest(output: string): string | null;
+/**
+ * Pick the `sha256:<64hex>` digest for `<server>/<repository>` out of a parsed
+ * `docker inspect ... .RepoDigests` array. Pure — shared by both the
+ * `spawn`-based {@link inspectImageDigest} and the `execFileSync`-based
+ * `buildAndPush` inspect-fallback in `_lib/baas.ts`, so the matching rule lives
+ * in exactly one place.
+ *
+ * `stdout` is the raw `{{json .RepoDigests}}` output (a JSON string array).
+ * Returns the lower-cased `sha256:<64hex>` of the first entry whose ref matches
+ * `<server>/<repository>@`, or `null` if the JSON is unparseable / no entry
+ * matches.
+ */
+export declare function parseRepoDigests(stdout: string, registry: RegistryCreds): string | null;
+/**
+ * `docker inspect` fallback to recover a pushed image's registry digest from
+ * its `RepoDigests` when the push output didn't surface one (older docker,
+ * buildx drivers, or an externally-run push we're inspecting after the fact).
+ *
+ * Returns the `sha256:<64hex>` portion of the matching `RepoDigests` entry, or
+ * `null` if none matches `<server>/<repository>`.
+ */
+export declare function inspectImageDigest(registry: RegistryCreds, tag: string, spawnFn?: typeof spawn): Promise<string | null>;
+/**
+ * Push the backend image and RECORD its registry manifest digest.
+ *
+ * Runs `docker push <server>/<repository>:<tag>`, parses the digest from the
+ * push summary, and falls back to {@link inspectImageDigest} if the summary
+ * didn't carry one. Throws if the push fails OR if no digest can be recovered
+ * (a deploy must never proceed with an unverifiable artifact reference).
+ *
+ * @returns the `sha256:<64hex>` manifest digest of the pushed tag.
+ * @throws if push exits non-zero, or if no manifest digest can be determined.
+ */
+export declare function dockerPush(registry: RegistryCreds, tag: string, spawnFn?: typeof spawn): Promise<string>;
+//# sourceMappingURL=docker.d.ts.map

package/dist/_lib/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAwCF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAiBvF;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/_lib/docker.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.imageRef = imageRef;
+exports.dockerLogin = dockerLogin;
+exports.parsePushDigest = parsePushDigest;
+exports.parseRepoDigests = parseRepoDigests;
+exports.inspectImageDigest = inspectImageDigest;
+exports.dockerPush = dockerPush;
+/**
+ * Thin, testable wrappers around the `docker` CLI for the trusted-deploy flow.
+ *
+ * Before the trusted-deploy arc the CLI only PRINTED the `docker login` /
+ * `docker push` commands and waited for the developer to run them by hand.
+ * Now the CLI wraps the push so it can RECORD the pushed image's registry
+ * manifest digest — the `imageDigest` field every {@link BuildAttestation}
+ * binds to. The digest must be the value the registry returns for the pushed
+ * tag, not a locally-computed one, so the attestation references the exact
+ * bytes the cluster will pull.
+ *
+ * Every function shells out via `child_process.spawn` with an argv array (never
+ * a shell string), so registry passwords and tags can't be shell-injected.
+ * Secrets (the one-time push password) are fed on stdin, never on argv.
+ */
+const child_process_1 = require("child_process");
+/**
+ * Run `docker <args>` to completion, capturing stdout/stderr. `passwordStdin`,
+ * when set, is written to the child's stdin then the stream is closed — used to
+ * feed `docker login --password-stdin` without the secret ever touching argv or
+ * the process table.
+ *
+ * Injectable `spawnFn` keeps this unit-testable: specs pass a fake that returns
+ * canned output without a real docker daemon.
+ */
+async function runDocker(args, opts = {}) {
+    const spawnImpl = opts.spawnFn ?? child_process_1.spawn;
+    return new Promise((resolvePromise, reject) => {
+        const child = spawnImpl('docker', args, { stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (d) => {
+            stdout += d.toString();
+        });
+        child.stderr?.on('data', (d) => {
+            stderr += d.toString();
+        });
+        child.on('error', (err) => reject(err));
+        child.on('close', (code) => resolvePromise({ code: code ?? 0, stdout, stderr }));
+        if (opts.passwordStdin !== undefined) {
+            child.stdin?.write(opts.passwordStdin);
+        }
+        child.stdin?.end();
+    });
+}
+/**
+ * The fully-qualified image reference for a pushed artifact:
+ * `<server>/<repository>:<tag>`.
+ */
+function imageRef(registry, tag) {
+    return `${registry.server}/${registry.repository}:${tag}`;
+}
+/**
+ * `docker login` to the per-app Harbor registry using the one-time push robot
+ * credentials. Password is fed on stdin (`--password-stdin`).
+ *
+ * @throws if docker exits non-zero (login failed).
+ */
+async function dockerLogin(registry, spawnFn) {
+    const { code, stderr } = await runDocker(['login', registry.server, '-u', registry.username, '--password-stdin'], { passwordStdin: registry.password, spawnFn });
+    if (code !== 0) {
+        throw new Error(`docker login failed (exit ${code}): ${stderr.trim()}`);
+    }
+}
+/**
+ * Parse the registry manifest digest from `docker push` output.
+ *
+ * A successful `docker push` prints a summary line of the shape:
+ *   `v0.1.0: digest: sha256:<64hex> size: 1786`
+ * We extract the `sha256:<64hex>` token. This is the registry's MANIFEST
+ * digest for the pushed tag — exactly what the attestation's `imageDigest`
+ * must carry.
+ *
+ * @returns the `sha256:<64hex>` digest, or `null` if no digest line is present.
+ */
+function parsePushDigest(output) {
+    // `digest:` precedes the manifest digest in docker's push summary.
+    const m = output.match(/digest:\s*(sha256:[a-f0-9]{64})/i);
+    return m ? m[1].toLowerCase() : null;
+}
+/**
+ * Pick the `sha256:<64hex>` digest for `<server>/<repository>` out of a parsed
+ * `docker inspect ... .RepoDigests` array. Pure — shared by both the
+ * `spawn`-based {@link inspectImageDigest} and the `execFileSync`-based
+ * `buildAndPush` inspect-fallback in `_lib/baas.ts`, so the matching rule lives
+ * in exactly one place.
+ *
+ * `stdout` is the raw `{{json .RepoDigests}}` output (a JSON string array).
+ * Returns the lower-cased `sha256:<64hex>` of the first entry whose ref matches
+ * `<server>/<repository>@`, or `null` if the JSON is unparseable / no entry
+ * matches.
+ */
+function parseRepoDigests(stdout, registry) {
+    let repoDigests;
+    try {
+        repoDigests = JSON.parse(stdout.trim());
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(repoDigests))
+        return null;
+    const repoPrefix = `${registry.server}/${registry.repository}@`;
+    for (const rd of repoDigests) {
+        if (typeof rd === 'string' && rd.startsWith(repoPrefix)) {
+            const at = rd.indexOf('@');
+            const digest = rd.slice(at + 1);
+            if (/^sha256:[a-f0-9]{64}$/i.test(digest))
+                return digest.toLowerCase();
+        }
+    }
+    return null;
+}
+/**
+ * `docker inspect` fallback to recover a pushed image's registry digest from
+ * its `RepoDigests` when the push output didn't surface one (older docker,
+ * buildx drivers, or an externally-run push we're inspecting after the fact).
+ *
+ * Returns the `sha256:<64hex>` portion of the matching `RepoDigests` entry, or
+ * `null` if none matches `<server>/<repository>`.
+ */
+async function inspectImageDigest(registry, tag, spawnFn) {
+    const ref = imageRef(registry, tag);
+    const { code, stdout } = await runDocker(['inspect', '--format', '{{json .RepoDigests}}', ref], { spawnFn });
+    if (code !== 0)
+        return null;
+    return parseRepoDigests(stdout, registry);
+}
+/**
+ * Push the backend image and RECORD its registry manifest digest.
+ *
+ * Runs `docker push <server>/<repository>:<tag>`, parses the digest from the
+ * push summary, and falls back to {@link inspectImageDigest} if the summary
+ * didn't carry one. Throws if the push fails OR if no digest can be recovered
+ * (a deploy must never proceed with an unverifiable artifact reference).
+ *
+ * @returns the `sha256:<64hex>` manifest digest of the pushed tag.
+ * @throws if push exits non-zero, or if no manifest digest can be determined.
+ */
+async function dockerPush(registry, tag, spawnFn) {
+    const ref = imageRef(registry, tag);
+    const { code, stdout, stderr } = await runDocker(['push', ref], { spawnFn });
+    if (code !== 0) {
+        throw new Error(`docker push failed (exit ${code}): ${stderr.trim()}`);
+    }
+    const fromPush = parsePushDigest(stdout + '\n' + stderr);
+    if (fromPush)
+        return fromPush;
+    const fromInspect = await inspectImageDigest(registry, tag, spawnFn);
+    if (fromInspect)
+        return fromInspect;
+    throw new Error(`pushed ${ref} but could not determine its registry manifest digest ` +
+        '(no `digest: sha256:...` in push output and no matching RepoDigests). ' +
+        'Re-run with --image-digest <sha256:...> to supply it explicitly.');
+}
+//# sourceMappingURL=docker.js.map

package/dist/_lib/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":";;AAmEA,4BAEC;AAQD,kCAWC;AAaD,0CAIC;AAcD,4CAiBC;AAUD,gDAYC;AAaD,gCAqBC;AAhMD;;;;;;;;;;;;;;GAcG;AACH,iDAAsC;AAatC;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CACtB,IAAc,EACd,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAK,CAAC;IACxC,OAAO,IAAI,OAAO,CAAY,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE,CACxC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpD,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,QAAuB,EAAE,GAAW;IAC3D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAC/B,QAAuB,EACvB,OAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACvE,EAAE,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,mEAAmE;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,MAAc,EAAE,QAAuB;IACtE,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAa,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;IAChE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,SAAS,EAAE,UAAU,EAAE,uBAAuB,EAAE,GAAG,CAAC,EACrD,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,UAAU,CAC9B,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,wDAAwD;QACnE,wEAAwE;QACxE,kEAAkE,CACrE,CAAC;AACJ,CAAC"}

package/dist/_lib/faucet-client.d.ts

@@ -0,0 +1,64 @@
+export type FaucetChallengeResponse = {
+    challengeId: string;
+    message: string;
+    expiresInSeconds: number;
+};
+export type FaucetDispensedResponse = {
+    status: 'dispensed';
+    amount: string;
+    txHash: string;
+    remainingDailyAllowance: string;
+};
+export type FaucetTrustLineRequiredResponse = {
+    status: 'trustline_required';
+    trustLine: {
+        currency: string;
+        issuer: string;
+        limit: string;
+    };
+};
+export type FaucetRateLimitedResponse = {
+    status: 'rate_limited';
+    retryAfterSeconds: number;
+};
+/**
+ * Discriminated union of the three documented `POST /faucet/hsuite` outcomes.
+ * Switch on `.status`.
+ */
+export type FaucetDispenseResponse = FaucetDispensedResponse | FaucetTrustLineRequiredResponse | FaucetRateLimitedResponse;
+export type FaucetStatusResponse = {
+    dispensedToday: string;
+    [key: string]: unknown;
+};
+export type FetchLike = (input: string, init?: any) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+    json(): Promise<unknown>;
+}>;
+export type FaucetClientOptions = {
+    baseUrl: string;
+    fetchImpl?: FetchLike;
+};
+/**
+ * Validator-side HSUITE-testnet faucet HTTP client.
+ *
+ * Adapter over the SDK's {@link SdkFaucetClient}. All HTTP/fetch logic lives in
+ * the SDK's `createHttpClient`; this class only adapts method names + base URL
+ * and (for tests) bridges the injectable `fetchImpl` seam onto the SDK's
+ * `HttpClient` interface.
+ */
+export declare class FaucetClient {
+    private readonly sdk;
+    constructor(opts: FaucetClientOptions);
+    challenge(chain: string, recipientAddress: string): Promise<FaucetChallengeResponse>;
+    dispense(payload: {
+        chain: string;
+        recipientAddress: string;
+        challengeId: string;
+        signature: string;
+        publicKey: string;
+    }): Promise<FaucetDispenseResponse>;
+    status(chain: string, recipientAddress: string): Promise<FaucetStatusResponse>;
+}
+//# sourceMappingURL=faucet-client.d.ts.map

package/dist/_lib/faucet-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"faucet-client.d.ts","sourceRoot":"","sources":["../../src/_lib/faucet-client.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,MAAM,EAAE,oBAAoB,CAAC;IAC7B,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,cAAc,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,+BAA+B,GAC/B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;IAC7D,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;gBAE1B,IAAI,EAAE,mBAAmB;IAW/B,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIpF,QAAQ,CAAC,OAAO,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI7B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAGrF"}

package/dist/_lib/faucet-client.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FaucetClient = void 0;
+/**
+ * Thin CLI adapter over the SDK's faucet client.
+ *
+ * The validator-side `/api/v3/faucet/hsuite/*` surface is already covered by
+ * `FaucetClient` in `@hsuite/smart-engines-sdk`. To avoid the CLI drifting from
+ * the SDK, this file no longer hand-rolls its own `fetch`/HTTP plumbing — it
+ * delegates every call to the SDK client, built on the SDK's shared
+ * `createHttpClient` (whose `baseUrl` carries the `/api/v3` prefix the SDK paths
+ * omit).
+ *
+ * The public shape (class name, method names, response types) is preserved so
+ * the CLI command bodies (`commands/faucet.ts`) and their unit tests are
+ * unchanged. Tests still inject a fake via the constructor's `fetchImpl` seam.
+ */
+const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
+/**
+ * Validator-side HSUITE-testnet faucet HTTP client.
+ *
+ * Adapter over the SDK's {@link SdkFaucetClient}. All HTTP/fetch logic lives in
+ * the SDK's `createHttpClient`; this class only adapts method names + base URL
+ * and (for tests) bridges the injectable `fetchImpl` seam onto the SDK's
+ * `HttpClient` interface.
+ */
+class FaucetClient {
+    sdk;
+    constructor(opts) {
+        // The SDK faucet paths are `/faucet/hsuite/...` — carry the `/api/v3`
+        // prefix on the HttpClient baseUrl so the full URL matches the validator
+        // controller mount.
+        const baseUrl = `${opts.baseUrl.replace(/\/$/, '')}/api/v3`;
+        const http = opts.fetchImpl
+            ? makeFetchBackedHttpClient(baseUrl, opts.fetchImpl)
+            : (0, smart_engines_sdk_1.createHttpClient)({ baseUrl });
+        this.sdk = new smart_engines_sdk_1.FaucetClient(http);
+    }
+    async challenge(chain, recipientAddress) {
+        return this.sdk.requestChallenge(chain, recipientAddress);
+    }
+    async dispense(payload) {
+        return this.sdk.dispense(payload);
+    }
+    async status(chain, recipientAddress) {
+        return this.sdk.getStatus(chain, recipientAddress);
+    }
+}
+exports.FaucetClient = FaucetClient;
+/**
+ * Adapt an injected `fetchImpl` (the CLI's test seam) onto the SDK's
+ * {@link HttpClient} interface so the SDK client can be exercised with a fake
+ * transport. Only the verbs the faucet client uses (`get`/`post`) are
+ * implemented; the rest throw if called.
+ *
+ * Mirrors the SDK's own `createHttpClient` request/error semantics (JSON body,
+ * `${method} ${path} → ${status}` error on non-2xx) so behavior is identical.
+ */
+function makeFetchBackedHttpClient(baseUrl, fetchImpl) {
+    async function send(method, path, body) {
+        const url = `${baseUrl}${path}`;
+        const init = {
+            method,
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        };
+        if (body !== undefined)
+            init.body = JSON.stringify(body);
+        const res = await fetchImpl(url, init);
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new Error(`${method} ${path} → ${res.status}: ${text.slice(0, 500)}`);
+        }
+        return (await res.json());
+    }
+    const unsupported = (verb) => () => {
+        throw new Error(`fetch-backed HttpClient: ${verb} not supported in CLI faucet adapter`);
+    };
+    return {
+        get: (path) => send('GET', path),
+        post: (path, b) => send('POST', path, b),
+        put: unsupported('put'),
+        patch: unsupported('patch'),
+        delete: unsupported('delete'),
+        getText: unsupported('getText'),
+        getBinary: unsupported('getBinary'),
+        getBinaryWithMeta: unsupported('getBinaryWithMeta'),
+        upload: unsupported('upload'),
+        setAuthToken: () => undefined,
+        getAuthToken: () => undefined,
+    };
+}
+//# sourceMappingURL=faucet-client.js.map

package/dist/_lib/faucet-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"faucet-client.js","sourceRoot":"","sources":["../../src/_lib/faucet-client.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;GAaG;AACH,iEAImC;AAuDnC;;;;;;;GAOG;AACH,MAAa,YAAY;IACN,GAAG,CAAkB;IAEtC,YAAY,IAAyB;QACnC,sEAAsE;QACtE,yEAAyE;QACzE,oBAAoB;QACpB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC;QAC5D,MAAM,IAAI,GAAe,IAAI,CAAC,SAAS;YACrC,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACpD,CAAC,CAAC,IAAA,oCAAgB,EAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,IAAI,gCAAe,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,gBAAwB;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAqC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAMd;QACC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAoC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,gBAAwB;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAkC,CAAC;IACtF,CAAC;CACF;AA/BD,oCA+BC;AAED;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,OAAe,EAAE,SAAoB;IACtE,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAQ;YAChB,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC5E,CAAC;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAU,EAAE;QAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,sCAAsC,CAAC,CAAC;IAC1F,CAAC,CAAC;IACF,OAAO;QACL,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,IAAI,CAAI,KAAK,EAAE,IAAI,CAAC;QAC9C,IAAI,EAAE,CAAI,IAAY,EAAE,CAAU,EAAE,EAAE,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,EAAE,WAAW,CAAC,KAAK,CAAsB;QAC5C,KAAK,EAAE,WAAW,CAAC,OAAO,CAAwB;QAClD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAyB;QACrD,OAAO,EAAE,WAAW,CAAC,SAAS,CAA0B;QACxD,SAAS,EAAE,WAAW,CAAC,WAAW,CAA4B;QAC9D,iBAAiB,EAAE,WAAW,CAAC,mBAAmB,CAAoC;QACtF,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAyB;QACrD,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS;QAC7B,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS;KAC9B,CAAC;AACJ,CAAC"}

package/dist/_lib/framework.d.ts

@@ -0,0 +1,59 @@
+/** The frameworks the SDK can build, mirroring `BuildAttestation['framework']`. */
+export type Framework = 'ionic' | 'nestjs';
+/**
+ * The result of classifying a project directory.
+ *
+ * `framework` is the attestation framework; `sdkPackage` is the specific
+ * HSUITE dependency that proved SDK usage (recorded for diagnostics);
+ * `sdkVersion` is the declared semver range of that dependency, used as the
+ * attestation's `sdkVersion` when the installed version can't be resolved.
+ */
+export type FrameworkDetection = {
+    framework: Framework;
+    sdkPackage: string;
+    sdkVersionRange: string;
+};
+/**
+ * Thrown when a deploy target carries no HSUITE SDK dependency. Carrying a
+ * distinct error type lets the deploy command surface the actionable message
+ * AND lets specs assert the abort without string-matching console output.
+ */
+export declare class NoSdkError extends Error {
+    constructor(message: string);
+}
+/**
+ * Classify a project directory's framework, or abort.
+ *
+ * Classification order (most-specific dependency wins):
+ *   1. `@hsuite/native-connect-*` (+ `@ionic/angular`) → `ionic` frontend.
+ *   2. `@hsuite/smart-engines-sdk` (+ `@nestjs/core`)  → `nestjs` backend.
+ *   3. neither HSUITE dependency present                → {@link NoSdkError}.
+ *
+ * The `@ionic/angular` / `@nestjs/core` co-presence is REQUIRED so a project
+ * that merely lists an HSUITE package without the matching framework runtime
+ * is reported precisely rather than silently mis-bucketed.
+ *
+ * @param projectDir - Smart-app project root (the dir containing package.json).
+ * @returns The detected framework + the proving SDK dependency.
+ * @throws {NoSdkError} if no HSUITE SDK dependency is present.
+ * @throws {Error} if the framework runtime that pairs with the HSUITE dep is
+ *   missing (actionable: "add @nestjs/core" / "add @ionic/angular").
+ */
+export declare function detectFramework(projectDir: string): FrameworkDetection;
+/**
+ * Resolve the SDK version the project is actually built against, for the
+ * attestation's `sdkVersion` field.
+ *
+ * Prefers the INSTALLED version (`node_modules/<pkg>/package.json`'s `version`)
+ * because that is the exact code the artifact links; falls back to the declared
+ * semver range from the project `package.json` when `node_modules` isn't
+ * present (e.g. a CI image that built elsewhere). The fallback range is still a
+ * meaningful, signable claim about the intended SDK.
+ *
+ * @param projectDir - Smart-app project root.
+ * @param detection - The result of {@link detectFramework} (carries the package
+ *   name + declared range).
+ * @returns The installed exact version if resolvable, else the declared range.
+ */
+export declare function resolveSdkVersion(projectDir: string, detection: FrameworkDetection): string;
+//# sourceMappingURL=framework.d.ts.map

package/dist/_lib/framework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../src/_lib/framework.ts"],"names":[],"mappings":"AAqBA,mFAAmF;AACnF,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAQ3C;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAOF;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AA8BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CA4CtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,kBAAkB,GAC5B,MAAM,CAgBR"}

package/dist/_lib/framework.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoSdkError = void 0;
+exports.detectFramework = detectFramework;
+exports.resolveSdkVersion = resolveSdkVersion;
+/**
+ * Client-side half of the SDK restriction: prove a deploy target was built
+ * with the HSUITE Smart Engines SDK and classify which framework it uses.
+ *
+ * The trusted-deploy arc signs a {@link BuildAttestation} over every deploy;
+ * one of its fields is `framework: 'ionic' | 'nestjs'`. This module derives
+ * that field — and, critically, ABORTS the deploy when the project carries NO
+ * HSUITE SDK dependency at all. A smart-app that wasn't built against the SDK
+ * has nothing to attest and must never reach the signing path.
+ *
+ * Detection is dependency-driven (reads the project's `package.json`), matching
+ * the real showcase apps:
+ *   - backend  (`apps/showcase/smart-app`):   `@hsuite/smart-engines-sdk` + `@nestjs/core`
+ *   - frontend (`apps/showcase/ionic-dapp`):  `@hsuite/native-connect-*`  + `@ionic/angular`
+ *
+ * This module is PURE I/O-at-the-edge: it reads one file and classifies. No
+ * network, no clock.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+/** The `@hsuite/native-connect-*` packages an Ionic smart-app frontend pulls in. */
+const NATIVE_CONNECT_PREFIX = '@hsuite/native-connect-';
+/** The backend SDK package. Its presence is the nestjs (backend) signal. */
+const BACKEND_SDK = '@hsuite/smart-engines-sdk';
+/**
+ * Thrown when a deploy target carries no HSUITE SDK dependency. Carrying a
+ * distinct error type lets the deploy command surface the actionable message
+ * AND lets specs assert the abort without string-matching console output.
+ */
+class NoSdkError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NoSdkError';
+    }
+}
+exports.NoSdkError = NoSdkError;
+/**
+ * Merge `dependencies` + `devDependencies` into one lookup. Smart-apps declare
+ * the SDK under `dependencies`, but tooling/CI templates occasionally place a
+ * build-time SDK under `devDependencies`; treat both as "the project uses the
+ * SDK" for detection purposes.
+ */
+function allDeps(pkg) {
+    return { ...(pkg.devDependencies ?? {}), ...(pkg.dependencies ?? {}) };
+}
+/**
+ * Read + parse the `package.json` at `projectDir`. Throws a clear error if the
+ * directory has no `package.json` (deploy target must be a real project root).
+ */
+function readPackageJson(projectDir) {
+    const pkgPath = (0, path_1.join)((0, path_1.resolve)(projectDir), 'package.json');
+    if (!(0, fs_1.existsSync)(pkgPath)) {
+        throw new Error(`no package.json found at ${pkgPath} — point --project at the smart-app root`);
+    }
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`failed to parse ${pkgPath}: ${err.message}`);
+    }
+}
+/**
+ * Classify a project directory's framework, or abort.
+ *
+ * Classification order (most-specific dependency wins):
+ *   1. `@hsuite/native-connect-*` (+ `@ionic/angular`) → `ionic` frontend.
+ *   2. `@hsuite/smart-engines-sdk` (+ `@nestjs/core`)  → `nestjs` backend.
+ *   3. neither HSUITE dependency present                → {@link NoSdkError}.
+ *
+ * The `@ionic/angular` / `@nestjs/core` co-presence is REQUIRED so a project
+ * that merely lists an HSUITE package without the matching framework runtime
+ * is reported precisely rather than silently mis-bucketed.
+ *
+ * @param projectDir - Smart-app project root (the dir containing package.json).
+ * @returns The detected framework + the proving SDK dependency.
+ * @throws {NoSdkError} if no HSUITE SDK dependency is present.
+ * @throws {Error} if the framework runtime that pairs with the HSUITE dep is
+ *   missing (actionable: "add @nestjs/core" / "add @ionic/angular").
+ */
+function detectFramework(projectDir) {
+    const pkg = readPackageJson(projectDir);
+    const deps = allDeps(pkg);
+    const names = Object.keys(deps);
+    const nativeConnect = names.find((n) => n.startsWith(NATIVE_CONNECT_PREFIX));
+    const hasBackendSdk = BACKEND_SDK in deps;
+    // No HSUITE SDK dependency of either flavor → abort before any signing.
+    if (!nativeConnect && !hasBackendSdk) {
+        throw new NoSdkError('smart-apps must be built with the HSUITE SDK — install ' +
+            `\`${BACKEND_SDK}\` (NestJS backend) or the \`${NATIVE_CONNECT_PREFIX}*\` ` +
+            'packages (Ionic frontend). See https://docs.hsuite.network/sdk');
+    }
+    // Ionic frontend: native-connect packages present.
+    if (nativeConnect) {
+        if (!('@ionic/angular' in deps)) {
+            throw new Error(`found ${nativeConnect} but no \`@ionic/angular\` — an Ionic smart-app ` +
+                'frontend must depend on @ionic/angular');
+        }
+        return {
+            framework: 'ionic',
+            sdkPackage: nativeConnect,
+            sdkVersionRange: deps[nativeConnect],
+        };
+    }
+    // NestJS backend: smart-engines-sdk present.
+    if (!('@nestjs/core' in deps)) {
+        throw new Error(`found ${BACKEND_SDK} but no \`@nestjs/core\` — a NestJS smart-app ` +
+            'backend must depend on @nestjs/core');
+    }
+    return {
+        framework: 'nestjs',
+        sdkPackage: BACKEND_SDK,
+        sdkVersionRange: deps[BACKEND_SDK],
+    };
+}
+/**
+ * Resolve the SDK version the project is actually built against, for the
+ * attestation's `sdkVersion` field.
+ *
+ * Prefers the INSTALLED version (`node_modules/<pkg>/package.json`'s `version`)
+ * because that is the exact code the artifact links; falls back to the declared
+ * semver range from the project `package.json` when `node_modules` isn't
+ * present (e.g. a CI image that built elsewhere). The fallback range is still a
+ * meaningful, signable claim about the intended SDK.
+ *
+ * @param projectDir - Smart-app project root.
+ * @param detection - The result of {@link detectFramework} (carries the package
+ *   name + declared range).
+ * @returns The installed exact version if resolvable, else the declared range.
+ */
+function resolveSdkVersion(projectDir, detection) {
+    const installed = (0, path_1.join)((0, path_1.resolve)(projectDir), 'node_modules', detection.sdkPackage, 'package.json');
+    if ((0, fs_1.existsSync)(installed)) {
+        try {
+            const pkg = JSON.parse((0, fs_1.readFileSync)(installed, 'utf8'));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch {
+            // fall through to the declared range
+        }
+    }
+    return detection.sdkVersionRange;
+}
+//# sourceMappingURL=framework.js.map

package/dist/_lib/framework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework.js","sourceRoot":"","sources":["../../src/_lib/framework.ts"],"names":[],"mappings":";;;AA2GA,0CA4CC;AAiBD,8CAmBC;AA3LD;;;;;;;;;;;;;;;;;GAiBG;AACH,2BAA8C;AAC9C,+BAAqC;AAKrC,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAqBhD;;;;GAIG;AACH,MAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AALD,gCAKC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,GAAgB;IAC/B,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,IAAA,cAAO,EAAC,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,0CAA0C,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAgB,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,eAAe,CAAC,UAAkB;IAChD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,WAAW,IAAI,IAAI,CAAC;IAE1C,wEAAwE;IACxE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAClB,yDAAyD;YACvD,KAAK,WAAW,gCAAgC,qBAAqB,MAAM;YAC3E,gEAAgE,CACnE,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,SAAS,aAAa,kDAAkD;gBACtE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,aAAa;YACzB,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,SAAS,WAAW,gDAAgD;YAClE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,WAAW;QACvB,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAC/B,UAAkB,EAClB,SAA6B;IAE7B,MAAM,SAAS,GAAG,IAAA,WAAI,EACpB,IAAA,cAAO,EAAC,UAAU,CAAC,EACnB,cAAc,EACd,SAAS,CAAC,UAAU,EACpB,cAAc,CACf,CAAC;IACF,IAAI,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAAyB,CAAC;YAChF,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,eAAe,CAAC;AACnC,CAAC"}

package/dist/_lib/frontend-guard.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fail-closed guard shared by `deploy` and `redeploy`: refuse to ship a
+ * frontend build that still carries unfilled `REPLACE_BEFORE_DEPLOY:<key>`
+ * placeholders (per-deployment config that was never set).
+ *
+ * Such a build refuses to bootstrap in the browser (the SPA's `main.ts` asserts
+ * on the sentinel prefix), and the CLI would otherwise tar+upload it silently —
+ * which is exactly how a non-bootstrapping bundle reached production. Matches
+ * the sentinel VALUE form (`:` followed by a letter) so it does NOT
+ * false-positive on the guard's own comparison literal (`REPLACE_BEFORE_DEPLOY:"`).
+ */
+export declare function assertNoDeploySentinels(dir: string): Promise<void>;
+//# sourceMappingURL=frontend-guard.d.ts.map