@hsuite/smart-engines-cli 1.2.0 → 1.4.0

package/dist/commands/app-lifecycle.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteCommand = exports.resumeCommand = exports.suspendCommand = void 0;
+exports.runLifecycle = runLifecycle;
+/**
+ * `hsuite suspend` / `resume` / `delete` — runtime lifecycle controls for a
+ * deployed app.
+ *
+ *   - suspend → scale the runtime to zero (`deployment.suspend`).
+ *   - resume  → scale it back up (`deployment.resume`).
+ *   - delete  → tear the namespace down (`deployment.delete`). Destructive, so
+ *     it confirms first UNLESS `--yes` is passed or stdin is not a TTY
+ *     (non-interactive contexts must opt in explicitly via `--yes`).
+ */
+const commander_1 = require("commander");
+const chalk_1 = __importDefault(require("chalk"));
+const readline = __importStar(require("readline"));
+const env_1 = require("../_lib/env");
+const subscription_env_1 = require("../_lib/subscription-env");
+const cluster_1 = require("../_lib/cluster");
+const baas_1 = require("../_lib/baas");
+/** Default y/N confirmation over stdin. Returns false on EOF / non-`y`. */
+async function defaultConfirm(message) {
+    // Non-TTY: never auto-confirm a destructive op — require --yes.
+    if (!process.stdin.isTTY)
+        return false;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await new Promise((res) => rl.question(`${message} [y/N] `, res));
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/** Pure orchestration body — exported for unit tests. */
+async function runLifecycle(opts) {
+    const env = (0, env_1.readEnv)(opts.envPath);
+    // Auth IDENTITY (subscription) ≠ management TARGET (deployed app). See status.ts.
+    // Resolve the subscription appId up front so a missing-subscription error
+    // fails fast — BEFORE the destructive confirmation prompt.
+    const appId = (0, subscription_env_1.requireAppId)(env, { appId: opts.appId });
+    const subscriptionAppId = (0, subscription_env_1.requireSubscriptionAppId)(env, {
+        subscriptionAppId: opts.subscriptionAppId,
+    });
+    if (opts.action === 'delete' && !opts.yes) {
+        const confirm = opts.confirmFn ?? defaultConfirm;
+        const ok = await confirm(`Delete app ${appId}? This tears down its namespace.`);
+        if (!ok) {
+            return { appId, performed: false };
+        }
+    }
+    const client = await (0, baas_1.connectAndAuth)({
+        gateway: opts.gateway,
+        env,
+        appId: subscriptionAppId,
+        clientFactory: opts.clientFactory,
+    });
+    if (opts.action === 'suspend')
+        await client.deployment.suspend(appId);
+    else if (opts.action === 'resume')
+        await client.deployment.resume(appId);
+    else
+        await client.deployment.delete(appId);
+    return { appId, performed: true };
+}
+/** Build a lifecycle command (suspend/resume share a shape; delete adds --yes). */
+function lifecycleCommand(action) {
+    const cmd = new commander_1.Command(action)
+        .description(action === 'suspend'
+        ? 'Suspend a deployed app (scale to zero)'
+        : action === 'resume'
+            ? 'Resume a suspended app (scale back up)'
+            : 'Delete a deployed app (tear down its namespace)')
+        .option('--env <file>', 'Env file with auth creds', '.env.local')
+        .option('--gateway <url>', 'Smart-engines gateway URL', cluster_1.DEFAULT_GATEWAY)
+        .option('--app-id <id>', 'App to act on (else DEPLOYED_APP_ID / SUBSCRIPTION_APP_ID)')
+        .option('--subscription-app-id <id>', 'Subscription appId to authenticate as (else SUBSCRIPTION_APP_ID)');
+    if (action === 'delete') {
+        cmd.option('--yes', 'Skip the confirmation prompt', false);
+    }
+    cmd.action(async (opts) => {
+        console.log(chalk_1.default.bold.cyan(`\n  hsuite ${action}\n`));
+        try {
+            const { appId, performed } = await runLifecycle({
+                action,
+                envPath: opts.env,
+                gateway: opts.gateway,
+                appId: opts.appId,
+                subscriptionAppId: opts.subscriptionAppId,
+                yes: opts.yes,
+            });
+            if (!performed) {
+                console.log(chalk_1.default.yellow('  aborted (not confirmed)\n'));
+                return;
+            }
+            console.log(chalk_1.default.bold.green(`\n  ✓ ${action}: ${appId}\n`));
+        }
+        catch (err) {
+            console.error(chalk_1.default.red(`\n  ✗ ${err.message}\n`));
+            process.exit(1);
+        }
+    });
+    return cmd;
+}
+exports.suspendCommand = lifecycleCommand('suspend');
+exports.resumeCommand = lifecycleCommand('resume');
+exports.deleteCommand = lifecycleCommand('delete');
+//# sourceMappingURL=app-lifecycle.js.map

package/dist/commands/app-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-lifecycle.js","sourceRoot":"","sources":["../../src/commands/app-lifecycle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,oCAgCC;AAlFD;;;;;;;;;GASG;AACH,yCAAoC;AACpC,kDAA0B;AAC1B,mDAAqC;AAErC,qCAAsC;AACtC,+DAAkF;AAClF,6CAAkD;AAClD,uCAA8C;AAmB9C,2EAA2E;AAC3E,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,gEAAgE;IAChE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QACzF,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,yDAAyD;AAClD,KAAK,UAAU,YAAY,CAChC,IAAmB;IAEnB,MAAM,GAAG,GAAG,IAAA,aAAO,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,kFAAkF;IAClF,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,KAAK,GAAG,IAAA,+BAAY,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,IAAA,2CAAwB,EAAC,GAAG,EAAE;QACtD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,KAAK,kCAAkC,CAAC,CAAC;QAChF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAc,EAAC;QAClC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG;QACH,KAAK,EAAE,iBAAiB;QACxB,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SACjE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;QACpE,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,MAAuB;IAC/C,MAAM,GAAG,GAAG,IAAI,mBAAO,CAAC,MAAM,CAAC;SAC5B,WAAW,CACV,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,MAAM,KAAK,QAAQ;YACnB,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,iDAAiD,CACxD;SACA,MAAM,CAAC,cAAc,EAAE,0BAA0B,EAAE,YAAY,CAAC;SAChE,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,yBAAe,CAAC;SACvE,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CACL,4BAA4B,EAC5B,kEAAkE,CACnE,CAAC;IAEJ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,8BAA8B,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC;gBAC9C,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,GAAG;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAEY,QAAA,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAC7C,QAAA,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAC3C,QAAA,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC"}

package/dist/commands/ci.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Granular CI subcommands for the trusted-deploy flow.
+ *
+ * `hsuite deploy` runs the whole pipeline interactively. CI pipelines want the
+ * steps as separable, non-interactive units that pass artifacts between jobs:
+ *
+ *   hsuite build  --project <dir>                  # detect framework + SDK gate, run build
+ *   hsuite push   --server .. --repository .. --tag ..  # wrap docker push, print digest
+ *   hsuite sign   --project <dir> --app-id .. --image-digest .. [--bundle-sha256 ..] --out att.json
+ *   hsuite deploy --manifest m.json --attestation att.json   # deploy with the pre-made attestation
+ *
+ * Each command is non-interactive and exits non-zero on failure so a CI runner
+ * can gate on it.
+ */
+import { Command } from 'commander';
+/**
+ * `hsuite build` — run the project's build, gated on the SDK/framework check.
+ *
+ * The SDK gate runs FIRST: a project with no HSUITE SDK dependency aborts
+ * before any build work, mirroring the deploy-time gate. Then the project's own
+ * `build` script runs (yarn by default; `--npm` to use npm), so CI gets one
+ * command that both validates and builds.
+ */
+export declare const buildCommand: Command;
+/**
+ * `hsuite push` — wrap `docker push` and print the recorded manifest digest.
+ *
+ * Registry coords come from `hsuite deploy`'s `init` step (or a prior
+ * `hsuite deploy --no-push` dry-run that printed them). The push password is
+ * read from `$HARBOR_PUSH_PASSWORD` (never an argv flag) so it doesn't leak
+ * into CI logs or the process table.
+ */
+export declare const pushCommand: Command;
+/**
+ * `hsuite sign` — assemble + sign a {@link BuildAttestation} and emit the
+ * `{ payload, signature }` JSON.
+ *
+ * Framework + sdkVersion are detected from `--project`; the artifact references
+ * (`--image-digest`, `--bundle-sha256`) come from the `push` / `uploadFrontend`
+ * steps. The developer identity + seed come from the env file. Writes to
+ * `--out` (or stdout when `--out` is omitted) so a later `deploy --attestation`
+ * consumes it.
+ */
+export declare const signCommand: Command;
+//# sourceMappingURL=ci.d.ts.map

package/dist/commands/ci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../src/commands/ci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,SA+BrB,CAAC;AAEL;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,SA6BpB,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,SAoDpB,CAAC"}

package/dist/commands/ci.js

@@ -0,0 +1,174 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signCommand = exports.pushCommand = exports.buildCommand = void 0;
+/**
+ * Granular CI subcommands for the trusted-deploy flow.
+ *
+ * `hsuite deploy` runs the whole pipeline interactively. CI pipelines want the
+ * steps as separable, non-interactive units that pass artifacts between jobs:
+ *
+ *   hsuite build  --project <dir>                  # detect framework + SDK gate, run build
+ *   hsuite push   --server .. --repository .. --tag ..  # wrap docker push, print digest
+ *   hsuite sign   --project <dir> --app-id .. --image-digest .. [--bundle-sha256 ..] --out att.json
+ *   hsuite deploy --manifest m.json --attestation att.json   # deploy with the pre-made attestation
+ *
+ * Each command is non-interactive and exits non-zero on failure so a CI runner
+ * can gate on it.
+ */
+const commander_1 = require("commander");
+const chalk_1 = __importDefault(require("chalk"));
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const env_1 = require("../_lib/env");
+const framework_1 = require("../_lib/framework");
+const docker_1 = require("../_lib/docker");
+const attestation_1 = require("../_lib/attestation");
+/**
+ * `hsuite build` — run the project's build, gated on the SDK/framework check.
+ *
+ * The SDK gate runs FIRST: a project with no HSUITE SDK dependency aborts
+ * before any build work, mirroring the deploy-time gate. Then the project's own
+ * `build` script runs (yarn by default; `--npm` to use npm), so CI gets one
+ * command that both validates and builds.
+ */
+exports.buildCommand = new commander_1.Command('build')
+    .description('Detect framework + SDK (abort if absent), then run the project build')
+    .option('--project <dir>', 'Smart-app project root', '.')
+    .option('--npm', 'Use `npm run build` instead of `yarn build`', false)
+    .option('--skip-build', 'Only run the framework/SDK detection gate, do not build', false)
+    .action(async (opts) => {
+    let detection;
+    try {
+        detection = (0, framework_1.detectFramework)(opts.project);
+    }
+    catch (err) {
+        if (err instanceof framework_1.NoSdkError) {
+            console.error(chalk_1.default.red(`\n  ✗ ${err.message}\n`));
+        }
+        else {
+            console.error(chalk_1.default.red(`\n  ✗ ${err.message}\n`));
+        }
+        process.exit(1);
+    }
+    const sdkVersion = (0, framework_1.resolveSdkVersion)(opts.project, detection);
+    console.log(chalk_1.default.green(`  ✓ ${detection.framework} smart-app (sdk ${sdkVersion}, via ${detection.sdkPackage})`));
+    if (opts.skipBuild)
+        return;
+    const [cmd, args] = opts.npm ? ['npm', ['run', 'build']] : ['yarn', ['build']];
+    const code = await runTo(cmd, args, (0, path_1.resolve)(opts.project));
+    if (code !== 0) {
+        console.error(chalk_1.default.red(`  build failed (exit ${code})`));
+        process.exit(1);
+    }
+    console.log(chalk_1.default.bold.green('\n  ✓ build complete\n'));
+});
+/**
+ * `hsuite push` — wrap `docker push` and print the recorded manifest digest.
+ *
+ * Registry coords come from `hsuite deploy`'s `init` step (or a prior
+ * `hsuite deploy --no-push` dry-run that printed them). The push password is
+ * read from `$HARBOR_PUSH_PASSWORD` (never an argv flag) so it doesn't leak
+ * into CI logs or the process table.
+ */
+exports.pushCommand = new commander_1.Command('push')
+    .description('docker login + push the backend image; print its manifest digest')
+    .requiredOption('--server <host>', 'Registry host (init.registry.server)')
+    .requiredOption('--username <user>', 'Push robot user (init.registry.username)')
+    .requiredOption('--repository <repo>', 'Per-app repository (init.registry.repository)')
+    .requiredOption('--tag <tag>', 'Image tag to push')
+    .action(async (opts) => {
+    const password = process.env.HARBOR_PUSH_PASSWORD;
+    if (!password) {
+        console.error(chalk_1.default.red('  set $HARBOR_PUSH_PASSWORD (the init-issued one-time push secret)'));
+        process.exit(1);
+    }
+    const registry = {
+        server: opts.server,
+        username: opts.username,
+        password,
+        repository: opts.repository,
+    };
+    try {
+        await (0, docker_1.dockerLogin)(registry);
+        const digest = await (0, docker_1.dockerPush)(registry, opts.tag);
+        // Print the bare digest on stdout so CI can capture it: DIGEST=$(hsuite push ...)
+        console.log(digest);
+    }
+    catch (err) {
+        console.error(chalk_1.default.red(`  ${err.message}`));
+        process.exit(1);
+    }
+});
+/**
+ * `hsuite sign` — assemble + sign a {@link BuildAttestation} and emit the
+ * `{ payload, signature }` JSON.
+ *
+ * Framework + sdkVersion are detected from `--project`; the artifact references
+ * (`--image-digest`, `--bundle-sha256`) come from the `push` / `uploadFrontend`
+ * steps. The developer identity + seed come from the env file. Writes to
+ * `--out` (or stdout when `--out` is omitted) so a later `deploy --attestation`
+ * consumes it.
+ */
+exports.signCommand = new commander_1.Command('sign')
+    .description('Assemble + sign a BuildAttestation; emit { payload, signature } JSON')
+    .requiredOption('--app-id <id>', 'The appId the artifact deploys under')
+    .requiredOption('--image-digest <digest>', 'Pushed backend manifest digest (sha256:...)')
+    .option('--bundle-sha256 <hash>', "Frontend bundle SHA-256 (uploadFrontend's value); '' for backend-only", '')
+    .option('--project <dir>', 'Smart-app project root (for framework + SDK version)', '.')
+    .option('--env <file>', 'Env file with the XRPL identity + seed', '.env.local')
+    .option('--out <file>', 'Write the signed attestation here (default: stdout)')
+    .action((opts) => {
+    let detection;
+    try {
+        detection = (0, framework_1.detectFramework)(opts.project);
+    }
+    catch (err) {
+        if (err instanceof framework_1.NoSdkError) {
+            console.error(chalk_1.default.red(`\n  ✗ ${err.message}\n`));
+        }
+        else {
+            console.error(chalk_1.default.red(`\n  ✗ ${err.message}\n`));
+        }
+        process.exit(1);
+    }
+    const sdkVersion = (0, framework_1.resolveSdkVersion)(opts.project, detection);
+    const env = (0, env_1.readEnv)(opts.env);
+    const signer = (0, env_1.buildSignerFromEnv)(env);
+    const seed = env.get('XRPL_SEED');
+    if (!seed) {
+        console.error(chalk_1.default.red('  XRPL_SEED required to sign the attestation'));
+        process.exit(1);
+    }
+    const signed = (0, attestation_1.assembleAndSign)({
+        appId: opts.appId,
+        developerWallet: signer.walletAddress,
+        developerChain: signer.chain,
+        framework: detection.framework,
+        sdkVersion,
+        imageDigest: opts.imageDigest,
+        bundleSha256: opts.bundleSha256,
+        cliVersion: (0, attestation_1.readCliVersion)(),
+    }, seed);
+    const json = JSON.stringify(signed, null, 2);
+    if (opts.out) {
+        (0, fs_1.writeFileSync)((0, path_1.resolve)(opts.out), json + '\n');
+        console.error(chalk_1.default.green(`  ✓ wrote ${(0, path_1.resolve)(opts.out)}`));
+    }
+    else {
+        // Emit on stdout so it can be redirected/piped.
+        process.stdout.write(json + '\n');
+    }
+});
+/** Run a command to completion in `cwd`, inheriting stdio. Resolves its code. */
+function runTo(cmd, args, cwd) {
+    return new Promise((resolvePromise, reject) => {
+        const child = (0, child_process_1.spawn)(cmd, args, { cwd, stdio: 'inherit' });
+        child.on('error', reject);
+        child.on('close', (code) => resolvePromise(code ?? 0));
+    });
+}
+//# sourceMappingURL=ci.js.map

package/dist/commands/ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../../src/commands/ci.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;GAaG;AACH,yCAAoC;AACpC,kDAA0B;AAC1B,iDAAsC;AACtC,2BAAmC;AACnC,+BAA+B;AAE/B,qCAA0D;AAC1D,iDAAmF;AACnF,2CAA6E;AAC7E,qDAI6B;AAE7B;;;;;;;GAOG;AACU,QAAA,YAAY,GAAG,IAAI,mBAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,sEAAsE,CAAC;KACnF,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,GAAG,CAAC;KACxD,MAAM,CAAC,OAAO,EAAE,6CAA6C,EAAE,KAAK,CAAC;KACrE,MAAM,CAAC,cAAc,EAAE,yDAAyD,EAAE,KAAK,CAAC;KACxF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,IAAA,2BAAe,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAU,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,IAAA,6BAAiB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,SAAS,mBAAmB,UAAU,SAAS,SAAS,CAAC,UAAU,GAAG,CAAC,CACrG,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO;IAE3B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAA,cAAO,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEL;;;;;;;GAOG;AACU,QAAA,WAAW,GAAG,IAAI,mBAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,kEAAkE,CAAC;KAC/E,cAAc,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACzE,cAAc,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;KAC/E,cAAc,CAAC,qBAAqB,EAAE,+CAA+C,CAAC;KACtF,cAAc,CAAC,aAAa,EAAE,mBAAmB,CAAC;KAClD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAkB;QAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAA,oBAAW,EAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,kFAAkF;QAClF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACU,QAAA,WAAW,GAAG,IAAI,mBAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,sEAAsE,CAAC;KACnF,cAAc,CAAC,eAAe,EAAE,sCAAsC,CAAC;KACvE,cAAc,CAAC,yBAAyB,EAAE,6CAA6C,CAAC;KACxF,MAAM,CAAC,wBAAwB,EAAE,uEAAuE,EAAE,EAAE,CAAC;KAC7G,MAAM,CAAC,iBAAiB,EAAE,sDAAsD,EAAE,GAAG,CAAC;KACtF,MAAM,CAAC,cAAc,EAAE,wCAAwC,EAAE,YAAY,CAAC;KAC9E,MAAM,CAAC,cAAc,EAAE,qDAAqD,CAAC;KAC7E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACf,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,IAAA,2BAAe,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAU,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,IAAA,6BAAiB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,IAAA,aAAO,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAsB,IAAA,6BAAe,EAC/C;QACE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,eAAe,EAAE,MAAM,CAAC,aAAa;QACrC,cAAc,EAAE,MAAM,CAAC,KAAK;QAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU;QACV,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,IAAA,4BAAc,GAAE;KAC7B,EACD,IAAI,CACL,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAA,kBAAa,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,KAAK,CAAC,aAAa,IAAA,cAAO,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,gDAAgD;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AACjF,SAAS,KAAK,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/deploy-manifest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Back-compat re-export shim.
+ *
+ * The canonical deploy-manifest schema + loader live in `../_lib/deploy-manifest`
+ * (the single-shape manifest: a required `backend` + an optional `frontend`).
+ * This module re-exports it so any importer that still references
+ * `./deploy-manifest` keeps working. `loadManifest` is retained as an alias of
+ * the new `parseManifest`.
+ */
+export { parseManifest, parseManifest as loadManifest, validateManifest, type Manifest, type ManifestBackend, type ManifestFrontend, } from '../_lib/deploy-manifest';
+//# sourceMappingURL=deploy-manifest.d.ts.map

package/dist/commands/deploy-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,aAAa,EACb,aAAa,IAAI,YAAY,EAC7B,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC"}

package/dist/commands/deploy-manifest.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateManifest = exports.loadManifest = exports.parseManifest = void 0;
+/**
+ * Back-compat re-export shim.
+ *
+ * The canonical deploy-manifest schema + loader live in `../_lib/deploy-manifest`
+ * (the single-shape manifest: a required `backend` + an optional `frontend`).
+ * This module re-exports it so any importer that still references
+ * `./deploy-manifest` keeps working. `loadManifest` is retained as an alias of
+ * the new `parseManifest`.
+ */
+var deploy_manifest_1 = require("../_lib/deploy-manifest");
+Object.defineProperty(exports, "parseManifest", { enumerable: true, get: function () { return deploy_manifest_1.parseManifest; } });
+Object.defineProperty(exports, "loadManifest", { enumerable: true, get: function () { return deploy_manifest_1.parseManifest; } });
+Object.defineProperty(exports, "validateManifest", { enumerable: true, get: function () { return deploy_manifest_1.validateManifest; } });
+//# sourceMappingURL=deploy-manifest.js.map

package/dist/commands/deploy-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-manifest.js","sourceRoot":"","sources":["../../src/commands/deploy-manifest.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,2DAOiC;AAN/B,gHAAA,aAAa,OAAA;AACb,+GAAA,aAAa,OAAgB;AAC7B,mHAAA,gBAAgB,OAAA"}

package/dist/commands/deploy.d.ts

@@ -1,19 +1,78 @@
 /**
- * `hsuite deploy` — Deploy a smart-app from a JSON manifest.
+ * `hsuite deploy` — clean, manifest-driven deploy of a smart-app.
  *
- * Implements the four-step runtime-deploy flow defined in
- * `docs/superpowers/specs/2026-05-14-smart-app-runtime-orchestration-design.md` §6.1:
+ * Order of operations (the canonical flow, plus the trusted-deploy attestation
+ * the host requires by default):
  *
- *   1. `init`                    → server allocates appId + ephemeral DOCR creds
- *   2. (out-of-band, manual)     → customer `docker push <repo>:<tag>`
- *   3. `uploadFrontend` (opt.)   → tarball with the SPA bundle
- *   4. `deploy`                  → server reconciles to k8s
+ *   1. parse manifest            → ONE canonical shape (backend required)
+ *   2. detect framework + SDK    → ABORT if the project has no HSUITE SDK
+ *   3. connectAndAuth            → the ONE `new BaasClient` (no discovery factory)
+ *   4. init                      → server allocates appId + ephemeral registry creds
+ *   5. docker build + push       → backend image
+ *   6. tar + uploadFrontend      → SPA bundle (when a `frontend` block is present)
+ *   7. assemble + sign           → BuildAttestation signed with the dev's XRPL key
+ *   8. deploy                    → reconcile to k8s ({ tag, port, replicas, degree,
+ *                                  env, resources, strategy, attestation })
  *
- * The manifest schema widens to include `image`, `port`, `tag`, `replicas`,
- * `env`, and an optional `frontend.bundlePath`. Between init and deploy the
- * CLI prints the docker push command and waits for Enter (skipped in CI /
- * with `--non-interactive`).
+ * Every smart-app has a NestJS backend; the optional SPA (`frontend`) is served
+ * by that backend out of its own `public/`. There is no SPA-only path.
+ *
+ * All docker/tar shell-outs go through the injectable seams in `_lib/baas.ts`
+ * so unit tests never invoke docker for real.
  */
 import { Command } from 'commander';
+import { connectAndAuth, type RunFn } from '../_lib/baas';
+export type DeployOpts = {
+    manifestPath: string;
+    envPath: string;
+    gateway: string;
+    projectDir: string;
+    strategy?: 'rolling' | 'recreate';
+    dockerHost?: string;
+    skipBuild?: boolean;
+    skipPush?: boolean;
+    /** Skip the multi-cluster image fan-out (single-cluster / dev registry). */
+    skipDistribute?: boolean;
+    /**
+     * The developer's subscription appId — under mint-first/deploy-last this is
+     * BOTH the auth identity AND the deploy target (`SUBSCRIPTION_APP_ID ==
+     * DEPLOYED_APP_ID == DKG entityId`, minted by `hsuite subscribe`). `deploy`
+     * allocates nothing; it authenticates as this id and fetches push creds for
+     * it via `pushCredentials`.
+     */
+    subscriptionAppId?: string;
+    /**
+     * Opt-in escape hatch for an intentional zero-cred / open-mode deploy (e.g. a
+     * fork demo with no subscription). When false (default), a deploy whose
+     * resolved container env carries no `XRPL_SEED` FAILS LOUD rather than
+     * silently shipping an open-mode app (issue #1564). `--allow-open-mode` sets it.
+     */
+    allowOpenMode?: boolean;
+    /**
+     * Block until the runtime settles (RUNNING / FAILED) after `deploy()` instead
+     * of exiting on the returned URL — which is not live until the pods converge.
+     * Default true; `--no-wait` opts out. Exits non-zero on a FAILED runtime.
+     */
+    wait?: boolean;
+    waitIntervalMs?: number;
+    waitMaxPolls?: number;
+    clientFactory?: Parameters<typeof connectAndAuth>[0]['clientFactory'];
+    runFn?: RunFn;
+    /** Injectable sleep for the await-RUNNING poll (tests). */
+    sleep?: (ms: number) => Promise<void>;
+};
+export type DeployResult = {
+    appId: string;
+    /** Deploy URL returned by `deploy()`. */
+    url: string;
+};
+/**
+ * Pure orchestration body — exported for unit tests. Throws on every error
+ * path; the command-level action wraps this and exits the process.
+ */
+export declare function runDeploy(opts: DeployOpts): Promise<DeployResult>;
+/**
+ * `hsuite deploy` commander command — thin action over {@link runDeploy}.
+ */
 export declare const deployCommand: Command;
 //# sourceMappingURL=deploy.d.ts.map

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgEpC,eAAO,MAAM,aAAa,SAiJtB,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,OAAO,EACL,cAAc,EAGd,KAAK,KAAK,EACX,MAAM,cAAc,CAAC;AAgBtB,MAAM,MAAM,UAAU,GAAG;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACtE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,2DAA2D;IAC3D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAmKvE;AAuED;;GAEG;AACH,eAAO,MAAM,aAAa,SA+CtB,CAAC"}