@hsuite/smart-engines-cli 1.2.1 → 1.4.0

package/dist/_lib/baas.d.ts

@@ -0,0 +1,147 @@
+import { BaasClient } from '@hsuite/smart-engines-sdk';
+import type { EnvMap } from './env';
+/** Default per-app deploy timeout — `init` runs the smart-app entity DKG ceremony. */
+export declare const DEFAULT_DEPLOY_TIMEOUT_MS = 240000;
+/**
+ * Target build platform for the backend image. The cluster nodes are amd64, so
+ * a single-arch `linux/amd64` image is the standard — never a multi-arch OCI
+ * index. See {@link buildAndPush} for why this is load-bearing (an arm64 build
+ * host with the buildkit/containerd snapshotter otherwise emits an arm64-only
+ * provenance-attested OCI index the amd64 nodes can't pull/run).
+ */
+export declare const DEFAULT_BUILD_PLATFORM = "linux/amd64";
+/** Registry coordinates returned by `deployment.init` (`BaasInitResponse`). */
+export type RegistryCreds = {
+    server: string;
+    username: string;
+    password: string;
+    repository: string;
+};
+/**
+ * `execFileSync`-shaped seam. Throwing on a non-zero exit is the contract
+ * `execFileSync` provides.
+ *
+ * The return value MATTERS for stdout-capturing invocations (the `docker push`
+ * and `docker inspect` legs in {@link buildAndPush}): `execFileSync` returns the
+ * child's stdout, and with `encoding: 'utf8'` that is a `string`. We parse the
+ * push summary / `RepoDigests` out of it to recover the pushed manifest digest.
+ * Legs run with inherited stdio (build/tag/login) return nothing meaningful.
+ * Unit tests supply a fake that returns canned push/inspect stdout.
+ */
+export type RunFn = (file: string, args: string[], options: {
+    input?: string;
+    stdio?: unknown;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    encoding?: BufferEncoding;
+}) => unknown;
+export type ConnectAndAuthOpts = {
+    /** Public gateway/host URL. */
+    gateway: string;
+    /** Parsed env (XRPL signer is built from it). */
+    env: EnvMap;
+    /** Existing appId to bind the client to. Falls back to `'pending'`. */
+    appId?: string;
+    /** Request timeout (ms). Defaults to {@link DEFAULT_DEPLOY_TIMEOUT_MS}. */
+    timeout?: number;
+    /**
+     * Test seam — build the client (and auth on it) without a real `new
+     * BaasClient`. Defaults to the real single-construction path.
+     */
+    clientFactory?: (config: {
+        hostUrl: string;
+        appId: string;
+        allowInsecure: boolean;
+        pathPrefix: string;
+        timeout: number;
+    }) => BaasClient;
+};
+/**
+ * Construct the ONE {@link BaasClient} and authenticate it with the env XRPL
+ * signer. Returns the authenticated client. Throws on a missing signer or an
+ * auth failure (the command-level action renders + exits).
+ */
+export declare function connectAndAuth(opts: ConnectAndAuthOpts): Promise<BaasClient>;
+export type BuildAndPushOpts = {
+    registry: RegistryCreds;
+    tag: string;
+    /** Docker build context directory. */
+    context: string;
+    /** Dockerfile path (relative to `context` or absolute). */
+    dockerfile: string;
+    /** Optional pre-build command (e.g. `yarn build`), run in `context`. */
+    build?: string;
+    /** Skip the `docker build` (image already built locally under the local tag). */
+    skipBuild?: boolean;
+    /** Skip the `docker push` (image already present at the registry). */
+    skipPush?: boolean;
+    /** `DOCKER_HOST` to thread to every docker invocation (defaults to env). */
+    dockerHost?: string;
+    /** App name — used to compose the deterministic local tag. */
+    name: string;
+    /**
+     * Target build platform. Defaults to {@link DEFAULT_BUILD_PLATFORM}
+     * (`linux/amd64`, the cluster-node standard). Overridable via the manifest's
+     * `backend.platform` only if a customer genuinely targets a different arch —
+     * the default is correct for every testnet/mainnet node today.
+     */
+    platform?: string;
+    /** Test seam — defaults to `execFileSync`. */
+    runFn?: RunFn;
+    /** Push retry attempts (round-robin robot-auth can need a couple). Default 6. */
+    pushAttempts?: number;
+};
+/**
+ * The fully-qualified target image reference: `<server>/<repository>:<tag>`.
+ */
+export declare function imageTarget(registry: RegistryCreds, tag: string): string;
+/**
+ * Build the backend image, tag it for the per-app Harbor repo, log in with the
+ * init-issued robot creds, push (with retries), and RECORD the pushed image's
+ * `sha256:<64hex>` registry manifest digest.
+ *
+ * Mirrors the working `deploy-v9.cjs` docker leg exactly, plus the single-arch
+ * pin (below):
+ *   - optional `<build>` (shell command) in `context`
+ *   - `docker build --platform linux/amd64 --provenance=false --sbom=false
+ *      -t hsuite-local/<name>:<tag> -f <dockerfile> <context>`
+ *   - `docker tag <local> <server>/<repo>:<tag>`
+ *   - `docker login <server> -u <username> --password-stdin`  ← username a
+ *     DISCRETE argv element; password on stdin
+ *   - `docker push <target>` retried up to `pushAttempts` times, stdout CAPTURED
+ *
+ * Returns the pushed image's `sha256:<64hex>` manifest digest — NOT the tag-form
+ * ref. The build attestation's `imageDigest` must carry this digest: the host
+ * binds it to the digest Harbor serves for the tag with strict equality, so a
+ * tag-form ref is rejected once `requireSignature` is enforced. The digest is
+ * read from the `docker push` summary ({@link parsePushDigest}); if the summary
+ * lacked one (older docker / buildx drivers / `--skip-push`), it falls back to a
+ * `docker inspect ... .RepoDigests` parse ({@link parseRepoDigests}). Throws if
+ * no digest can be recovered — a deploy must never proceed with an unverifiable
+ * artifact reference.
+ *
+ * NOTE: for a single-arch (linux/amd64, the platform standard) push the push
+ * summary digest IS the artifact digest Harbor serves. A multi-arch / manifest-
+ * list push could surface the LIST digest here, which may differ from the
+ * per-arch artifact digest the host resolves — out of scope for the single-arch
+ * deploy flow.
+ */
+export declare function buildAndPush(opts: BuildAndPushOpts): string;
+export type TarFrontendOpts = {
+    /** Directory whose contents become the SPA bundle. */
+    dir: string;
+    /** Output tarball path. */
+    out: string;
+    /** Test seam — defaults to `execFileSync`. */
+    runFn?: RunFn;
+};
+/**
+ * Tar a frontend `dir` into a plain `.tar` at `out` (the smart-host accepts a
+ * plain tar; it content-addresses + mounts it read-only). `-C <dir> .` tars the
+ * directory CONTENTS, not the directory itself, so the SPA's `index.html` lands
+ * at the bundle root where the edge sidecar serves `/srv/spa`.
+ *
+ * Returns `out`.
+ */
+export declare function tarFrontend(opts: TarFrontendOpts): string;
+//# sourceMappingURL=baas.d.ts.map

package/dist/_lib/baas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baas.d.ts","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAIpC,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,KAAK,GAAG,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,KACE,OAAO,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,KAAK,UAAU,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBlF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA4G3D;AAsCD,MAAM,MAAM,eAAe,GAAG;IAC5B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAIzD"}

package/dist/_lib/baas.js

@@ -0,0 +1,260 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BUILD_PLATFORM = exports.DEFAULT_DEPLOY_TIMEOUT_MS = void 0;
+exports.connectAndAuth = connectAndAuth;
+exports.imageTarget = imageTarget;
+exports.buildAndPush = buildAndPush;
+exports.tarFrontend = tarFrontend;
+/**
+ * The ONE place the CLI constructs + authenticates a {@link BaasClient}, plus
+ * the injectable docker/tar shell-out seams the deploy commands use.
+ *
+ * ## Single client construction
+ *
+ * Every deploy-family command (`deploy`, `redeploy`, `update`, `suspend`,
+ * `resume`, `delete`, `status`, `list`) routes through {@link connectAndAuth}.
+ * It does exactly one `new BaasClient({ hostUrl, appId, allowInsecure,
+ * pathPrefix: '/host', timeout })` and authenticates with the env XRPL signer.
+ *
+ * We deliberately do NOT use the SDK's `BaasClient.connectToCluster(...)`
+ * discovery factory here: it fetches `/api/v3/discovery/clusters` and random-
+ * picks a cluster, whose per-cluster gateway hostnames are not public DNS and
+ * so are unreachable from a developer machine. The public round-robin
+ * `gateway.testnet.hsuite.network` (DEFAULT_GATEWAY) is the correct, reachable
+ * entrypoint. The discovery factory stays in the SDK for in-cluster consumers;
+ * the CLI just doesn't use it. (Matches the working showcase scratch
+ * `deploy-v9.cjs`.)
+ *
+ * The `clientFactory` parameter is the unit-test seam (mirrors faucet.ts's
+ * `xrplClientFactory`): specs inject a fake so no real `new BaasClient` /
+ * network call happens.
+ *
+ * ## Docker / tar seams
+ *
+ * {@link buildAndPush} and {@link tarFrontend} shell out via `execFileSync`
+ * with the argv passed as a discrete array — NEVER a shell string. This is
+ * load-bearing for the Harbor robot login: robot usernames are
+ * `robot$<project>+<name>`, and a shell-interpolated `-u "robot$project+name"`
+ * would expand `$project` to empty → a corrupted username → 401. `execFileSync`
+ * runs no shell, so `$` is literal. The push password is fed on stdin
+ * (`--password-stdin`), never on argv. Both accept an injectable `runFn`
+ * (default `execFileSync`) so unit tests never invoke docker for real.
+ *
+ * {@link buildAndPush} additionally CAPTURES the `docker push` stdout (rather
+ * than inheriting it) so it can recover the pushed image's `sha256:<64hex>`
+ * registry manifest digest — via {@link parsePushDigest}, falling back to a
+ * `docker inspect ... .RepoDigests` parse ({@link parseRepoDigests}). That
+ * digest is the value the build attestation's `imageDigest` must carry: the
+ * host binds it to the digest Harbor serves for the tag with STRICT equality,
+ * so a tag-form ref would be rejected once `requireSignature` is enforced.
+ */
+const child_process_1 = require("child_process");
+const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
+const env_1 = require("./env");
+const docker_1 = require("./docker");
+/** Default per-app deploy timeout — `init` runs the smart-app entity DKG ceremony. */
+exports.DEFAULT_DEPLOY_TIMEOUT_MS = 240_000;
+/**
+ * Target build platform for the backend image. The cluster nodes are amd64, so
+ * a single-arch `linux/amd64` image is the standard — never a multi-arch OCI
+ * index. See {@link buildAndPush} for why this is load-bearing (an arm64 build
+ * host with the buildkit/containerd snapshotter otherwise emits an arm64-only
+ * provenance-attested OCI index the amd64 nodes can't pull/run).
+ */
+exports.DEFAULT_BUILD_PLATFORM = 'linux/amd64';
+/**
+ * Construct the ONE {@link BaasClient} and authenticate it with the env XRPL
+ * signer. Returns the authenticated client. Throws on a missing signer or an
+ * auth failure (the command-level action renders + exits).
+ */
+async function connectAndAuth(opts) {
+    const signer = (0, env_1.buildSignerFromEnv)(opts.env);
+    const config = {
+        hostUrl: opts.gateway,
+        appId: opts.appId ?? 'pending',
+        allowInsecure: opts.gateway.startsWith('http://'),
+        pathPrefix: '/host',
+        timeout: opts.timeout ?? exports.DEFAULT_DEPLOY_TIMEOUT_MS,
+    };
+    const client = (opts.clientFactory ?? ((c) => new smart_engines_sdk_1.BaasClient(c)))(config);
+    await client.authenticate({
+        chain: signer.chain,
+        walletAddress: signer.walletAddress,
+        publicKey: signer.publicKey,
+        signFn: signer.signFn,
+    });
+    return client;
+}
+/**
+ * The fully-qualified target image reference: `<server>/<repository>:<tag>`.
+ */
+function imageTarget(registry, tag) {
+    return `${registry.server}/${registry.repository}:${tag}`;
+}
+/**
+ * Build the backend image, tag it for the per-app Harbor repo, log in with the
+ * init-issued robot creds, push (with retries), and RECORD the pushed image's
+ * `sha256:<64hex>` registry manifest digest.
+ *
+ * Mirrors the working `deploy-v9.cjs` docker leg exactly, plus the single-arch
+ * pin (below):
+ *   - optional `<build>` (shell command) in `context`
+ *   - `docker build --platform linux/amd64 --provenance=false --sbom=false
+ *      -t hsuite-local/<name>:<tag> -f <dockerfile> <context>`
+ *   - `docker tag <local> <server>/<repo>:<tag>`
+ *   - `docker login <server> -u <username> --password-stdin`  ← username a
+ *     DISCRETE argv element; password on stdin
+ *   - `docker push <target>` retried up to `pushAttempts` times, stdout CAPTURED
+ *
+ * Returns the pushed image's `sha256:<64hex>` manifest digest — NOT the tag-form
+ * ref. The build attestation's `imageDigest` must carry this digest: the host
+ * binds it to the digest Harbor serves for the tag with strict equality, so a
+ * tag-form ref is rejected once `requireSignature` is enforced. The digest is
+ * read from the `docker push` summary ({@link parsePushDigest}); if the summary
+ * lacked one (older docker / buildx drivers / `--skip-push`), it falls back to a
+ * `docker inspect ... .RepoDigests` parse ({@link parseRepoDigests}). Throws if
+ * no digest can be recovered — a deploy must never proceed with an unverifiable
+ * artifact reference.
+ *
+ * NOTE: for a single-arch (linux/amd64, the platform standard) push the push
+ * summary digest IS the artifact digest Harbor serves. A multi-arch / manifest-
+ * list push could surface the LIST digest here, which may differ from the
+ * per-arch artifact digest the host resolves — out of scope for the single-arch
+ * deploy flow.
+ */
+function buildAndPush(opts) {
+    const run = opts.runFn ?? child_process_1.execFileSync;
+    const dockerEnv = {
+        ...process.env,
+        ...(opts.dockerHost ? { DOCKER_HOST: opts.dockerHost } : {}),
+    };
+    // Login feeds the password on stdin → stdin must be a pipe; stderr inherits.
+    const loginStdio = ['pipe', 'inherit', 'inherit'];
+    // Push CAPTURES stdout so we can parse the `digest: sha256:...` summary; build
+    // output still inherits (we only need the push summary, not build logs).
+    const captureStdio = ['ignore', 'pipe', 'inherit'];
+    // Optional pre-build (the manifest's `backend.build`). Shell command — run via
+    // the shell since it's a user-authored build string, not an argv. No secrets.
+    // CRITICAL: run it IN `context` (the smart-app dir). Setting `PWD` alone does
+    // NOT change the child's working directory — `sh -c` inherits the parent's
+    // real cwd, so a relative build like `tsc` would compile whatever repo the CLI
+    // happens to be invoked from (e.g. smart-engines) instead of the smart-app.
+    // `cwd` is the actual chdir; we keep `PWD` in sync so shells report it right.
+    if (opts.build && !opts.skipBuild) {
+        run('sh', ['-c', opts.build], {
+            stdio: 'inherit',
+            cwd: opts.context,
+            env: { ...dockerEnv, PWD: opts.context },
+        });
+    }
+    const localTag = `hsuite-local/${opts.name}:${opts.tag}`;
+    if (!opts.skipBuild) {
+        // Run the build IN `context` too: a relative `dockerfile` and any relative
+        // paths inside it resolve against the child's cwd, not the CLI's cwd.
+        //
+        // SINGLE-ARCH amd64 (load-bearing): the cluster nodes are amd64. Without
+        // `--platform` a buildkit/containerd-snapshotter build host (Colima / Apple
+        // Silicon) builds for the HOST arch (arm64). `--provenance=false
+        // --sbom=false` suppress the buildkit attestation manifests that otherwise
+        // turn the push into a multi-manifest OCI image INDEX (arm64 child +
+        // `unknown/unknown` attestation, NO linux/amd64 child) — the pod then can't
+        // pull/run on amd64 nodes. With these flags buildkit emits a single
+        // `linux/amd64` image manifest whose push digest is a normal
+        // `sha256:<64hex>` equal to what Harbor serves. The flags are buildx/
+        // buildkit-specific; the classic (non-buildkit) builder ignores them and
+        // never emits an index anyway, so the invocation is robust on both.
+        const platform = opts.platform ?? exports.DEFAULT_BUILD_PLATFORM;
+        run('docker', [
+            'build',
+            '--platform',
+            platform,
+            '--provenance=false',
+            '--sbom=false',
+            '-t',
+            localTag,
+            '-f',
+            opts.dockerfile,
+            opts.context,
+        ], {
+            stdio: 'inherit',
+            cwd: opts.context,
+            env: dockerEnv,
+        });
+    }
+    const target = imageTarget(opts.registry, opts.tag);
+    run('docker', ['tag', localTag, target], { stdio: 'inherit', env: dockerEnv });
+    if (opts.skipPush) {
+        // Nothing was pushed this run, but the image is asserted present at the
+        // registry — recover its digest from `RepoDigests` so the attestation is
+        // still bound to the real artifact.
+        return inspectDigestOrThrow(run, target, dockerEnv, opts.registry, opts.tag);
+    }
+    // CRITICAL: username is a discrete argv element (no shell, no `$` expansion);
+    // password via stdin. See the module header.
+    run('docker', ['login', opts.registry.server, '-u', opts.registry.username, '--password-stdin'], { input: opts.registry.password, stdio: loginStdio, env: dockerEnv });
+    const attempts = opts.pushAttempts ?? 6;
+    let lastErr;
+    for (let i = 1; i <= attempts; i++) {
+        try {
+            // Capture stdout (encoding 'utf8' → a string) so `parsePushDigest` can
+            // read the `… : digest: sha256:<64hex> size: …` summary line.
+            const pushOut = run('docker', ['push', target], {
+                stdio: captureStdio,
+                encoding: 'utf8',
+                env: dockerEnv,
+            });
+            const fromPush = (0, docker_1.parsePushDigest)(asStdout(pushOut));
+            if (fromPush)
+                return fromPush;
+            // Push succeeded but the summary carried no digest (older docker / buildx
+            // drivers). Recover it from `RepoDigests`.
+            return inspectDigestOrThrow(run, target, dockerEnv, opts.registry, opts.tag);
+        }
+        catch (err) {
+            lastErr = err;
+            // Harbor round-robin robot-auth occasionally 401s the first hit; retry.
+        }
+    }
+    throw new Error(`docker push failed after ${attempts} attempts: ${lastErr?.message ?? 'unknown'}`);
+}
+/** Coerce a `runFn` stdout return (string under `encoding:'utf8'`, else Buffer) to a string. */
+function asStdout(out) {
+    if (typeof out === 'string')
+        return out;
+    if (out && typeof out.toString === 'function')
+        return out.toString('utf8');
+    return '';
+}
+/**
+ * `docker inspect --format '{{json .RepoDigests}}' <target>` via the shared
+ * `runFn` seam, returning the `sha256:<64hex>` digest for `<server>/<repo>` (the
+ * inspect-fallback path of {@link buildAndPush}). Throws if no matching digest
+ * is present — a deploy must never proceed with an unverifiable artifact ref.
+ */
+function inspectDigestOrThrow(run, target, env, registry, tag) {
+    const inspectOut = asStdout(run('docker', ['inspect', '--format', '{{json .RepoDigests}}', target], {
+        stdio: ['ignore', 'pipe', 'ignore'],
+        encoding: 'utf8',
+        env,
+    }));
+    const digest = (0, docker_1.parseRepoDigests)(inspectOut, registry);
+    if (digest)
+        return digest;
+    throw new Error(`pushed ${registry.server}/${registry.repository}:${tag} but could not determine its ` +
+        'registry manifest digest (no `digest: sha256:...` in push output and no matching ' +
+        'RepoDigests from `docker inspect`).');
+}
+/**
+ * Tar a frontend `dir` into a plain `.tar` at `out` (the smart-host accepts a
+ * plain tar; it content-addresses + mounts it read-only). `-C <dir> .` tars the
+ * directory CONTENTS, not the directory itself, so the SPA's `index.html` lands
+ * at the bundle root where the edge sidecar serves `/srv/spa`.
+ *
+ * Returns `out`.
+ */
+function tarFrontend(opts) {
+    const run = opts.runFn ?? child_process_1.execFileSync;
+    run('tar', ['-cf', opts.out, '-C', opts.dir, '.'], { stdio: 'inherit' });
+    return opts.out;
+}
+//# sourceMappingURL=baas.js.map

package/dist/_lib/baas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baas.js","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":";;;AAuHA,wCAiBC;AAmCD,kCAEC;AAiCD,oCA4GC;AAuDD,kCAIC;AArXD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,iDAA6C;AAC7C,iEAAuD;AAEvD,+BAA2C;AAC3C,qCAA6D;AAE7D,sFAAsF;AACzE,QAAA,yBAAyB,GAAG,OAAO,CAAC;AAEjD;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,aAAa,CAAC;AAuDpD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iCAAyB;KACnD,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAgCD;;GAEG;AACH,SAAgB,WAAW,CAAC,QAAuB,EAAE,GAAW;IAC9D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,YAAY,CAAC,IAAsB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,MAAM,SAAS,GAAsB;QACnC,GAAG,OAAO,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAuB;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,oEAAoE;QACpE,6DAA6D;QAC7D,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,8BAAsB,CAAC;QACzD,GAAG,CACD,QAAQ,EACR;YACE,OAAO;YACP,YAAY;YACZ,QAAQ;YACR,oBAAoB;YACpB,cAAc;YACd,IAAI;YACJ,QAAQ;YACR,IAAI;YACJ,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,OAAO;SACb,EACD;YACE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,SAAS;SACf,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAE/E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,wEAAwE;QACxE,yEAAyE;QACzE,oCAAoC;QACpC,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,8EAA8E;IAC9E,6CAA6C;IAC7C,GAAG,CACD,QAAQ,EACR,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACjF,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CACrE,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IACxC,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;gBAC9C,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,wBAAe,EAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,0EAA0E;YAC1E,2CAA2C;YAC3C,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,cAAe,OAAiB,EAAE,OAAO,IAAI,SAAS,EAAE,CAC7F,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,IAAI,OAAQ,GAAc,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAQ,GAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,GAAU,EACV,MAAc,EACd,GAAsB,EACtB,QAAuB,EACvB,GAAW;IAEX,MAAM,UAAU,GAAG,QAAQ,CACzB,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE;QACtE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG;KACJ,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,yBAAgB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,KAAK,CACb,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,+BAA+B;QACpF,mFAAmF;QACnF,qCAAqC,CACxC,CAAC;AACJ,CAAC;AAWD;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,IAAqB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC"}

package/dist/_lib/cluster.d.ts

@@ -2,13 +2,13 @@
  * Cluster bootstrap constants.
  *
  * The CLI bootstraps against the public round-robin host
- * `gateway.testnet.hsuite.network` — 3 DNS A-records over the 3 genesis
- * cluster ingress LBs (HANDOFF arc-v13-do-deploy §11).
+ * `gateway.testnet.hsuite.network` — DNS A-records over the genesis cluster
+ * ingress LBs.
  *
- * Decentralized cluster discovery itself is no longer implemented here:
- * the canonical `BaasClient.connectToCluster({ bootstrap: [...] })` factory
- * in `@hsuite/smart-engines-sdk` (3.4.0+) owns it, and the CLI consumes
- * that factory rather than maintaining a parallel discovery path.
+ * Decentralized cluster discovery is owned by the canonical
+ * `BaasClient.connectToCluster({ bootstrap: [...] })` factory in
+ * `@hsuite/smart-engines-sdk`; the CLI consumes that factory rather than
+ * maintaining a parallel discovery path.
  */
 /** Public SDK-bootstrap host for the Smart Engines testnet. */
 export declare const DEFAULT_GATEWAY = "https://gateway.testnet.hsuite.network";

package/dist/_lib/cluster.js

@@ -3,13 +3,13 @@
  * Cluster bootstrap constants.
  *
  * The CLI bootstraps against the public round-robin host
- * `gateway.testnet.hsuite.network` — 3 DNS A-records over the 3 genesis
- * cluster ingress LBs (HANDOFF arc-v13-do-deploy §11).
+ * `gateway.testnet.hsuite.network` — DNS A-records over the genesis cluster
+ * ingress LBs.
  *
- * Decentralized cluster discovery itself is no longer implemented here:
- * the canonical `BaasClient.connectToCluster({ bootstrap: [...] })` factory
- * in `@hsuite/smart-engines-sdk` (3.4.0+) owns it, and the CLI consumes
- * that factory rather than maintaining a parallel discovery path.
+ * Decentralized cluster discovery is owned by the canonical
+ * `BaasClient.connectToCluster({ bootstrap: [...] })` factory in
+ * `@hsuite/smart-engines-sdk`; the CLI consumes that factory rather than
+ * maintaining a parallel discovery path.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_GATEWAY = void 0;

package/dist/_lib/deploy-manifest.d.ts

@@ -0,0 +1,69 @@
+type BaasService = 'auth' | 'database' | 'storage' | 'functions' | 'messaging';
+/** Backend build + push + deploy inputs. REQUIRED — every smart-app has one. */
+export type ManifestBackend = {
+    /** Backend listen port inside the customer container (1..65535, never 8080). */
+    port: number;
+    /** Image tag (the part after the colon in the Harbor ref). */
+    tag: string;
+    /** Pod replica count (per cluster). Default 1. */
+    replicas?: number;
+    /** Docker build context directory. Default '.'. */
+    context?: string;
+    /** Dockerfile path (relative to `context`). Default 'Dockerfile'. */
+    dockerfile?: string;
+    /**
+     * Target build platform passed to `docker build --platform`. Default
+     * `linux/amd64` (the cluster-node arch). Override only when targeting a
+     * different node arch — the default is correct for every node today.
+     */
+    platform?: string;
+    /** Optional pre-build command run in `context` before `docker build`. */
+    build?: string;
+    /** Customer-provided env (mirrored to a k8s Secret at reconcile time). */
+    env?: Record<string, string>;
+    /** Resource caps, clamped against the tenant ResourceQuota at deploy time. */
+    limits?: {
+        cpu?: string;
+        memory?: string;
+    };
+};
+/**
+ * Frontend tar + upload inputs. OPTIONAL — present iff the smart-app ships a
+ * static SPA for its NestJS backend to serve out of `public/`. Relative `dir` /
+ * `bundlePath` resolve against the backend's build `context` (the smart-app
+ * root), NOT the CLI's process.cwd().
+ */
+export type ManifestFrontend = {
+    /** Optional pre-build command run before tarring `dir` (e.g. `ng build`). */
+    build?: string;
+    /** Directory to tar into the SPA bundle (e.g. `www` / `dist` / `public`). */
+    dir?: string;
+    /** Pre-built tarball path; takes precedence over `dir` when set. */
+    bundlePath?: string | null;
+};
+/**
+ * Deploy manifest schema — ONE canonical shape.
+ *
+ * Required: `name`, `services[]`, `backend` (with `port` + `tag`).
+ * `frontend` is optional (present iff the app ships a SPA bundle).
+ */
+export type Manifest = {
+    name: string;
+    services: BaasService[];
+    /** Number of clusters to deploy across (>=3 default); distinct from replicas. */
+    degree?: number;
+    backend: ManifestBackend;
+    frontend?: ManifestFrontend;
+};
+/**
+ * Parse + validate a deploy manifest from a JSON file.
+ *
+ * @throws if the file is missing or fails schema validation. The error message
+ *   names the offending field so a malformed manifest fails loudly here rather
+ *   than as an opaque server 400/500 mid-deploy.
+ */
+export declare function parseManifest(path: string): Manifest;
+/** Validate an already-parsed manifest object. Shared by file + programmatic callers. */
+export declare function validateManifest(raw: unknown): Manifest;
+export {};
+//# sourceMappingURL=deploy-manifest.d.ts.map

package/dist/_lib/deploy-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/_lib/deploy-manifest.ts"],"names":[],"mappings":"AAmBA,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAK/E,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAYpD;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA4CvD"}

package/dist/_lib/deploy-manifest.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseManifest = parseManifest;
+exports.validateManifest = validateManifest;
+/**
+ * Shared smart-app deploy manifest schema + loader.
+ *
+ * The manifest is the single declarative input to `hsuite deploy` /
+ * `hsuite redeploy`. There is ONE canonical shape: every smart-app has a NestJS
+ * `backend` container image, and MAY additionally ship a static SPA that the
+ * backend serves out of its own `public/` (so the SPA rides along inside the
+ * backend image / bundle — there is no SPA-only runtime on the platform).
+ *
+ *   - `backend` (REQUIRED) → docker build → push the backend image.
+ *   - `frontend` (OPTIONAL) → if present, tar + `uploadFrontend` the bundle.
+ *   - then `deploy(...)` → reconcile to k8s.
+ *
+ * `name`, `services[]` and `backend` (with `port` + `tag`) are required;
+ * everything else is optional with documented defaults.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+/** Lowest decentralization degree the host accepts (genesis cluster floor). */
+const MIN_DEGREE = 3;
+/**
+ * Parse + validate a deploy manifest from a JSON file.
+ *
+ * @throws if the file is missing or fails schema validation. The error message
+ *   names the offending field so a malformed manifest fails loudly here rather
+ *   than as an opaque server 400/500 mid-deploy.
+ */
+function parseManifest(path) {
+    const manifestPath = (0, path_1.resolve)(path);
+    if (!(0, fs_1.existsSync)(manifestPath)) {
+        throw new Error(`manifest not found: ${manifestPath}`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse((0, fs_1.readFileSync)(manifestPath, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`manifest is not valid JSON: ${err.message}`);
+    }
+    return validateManifest(raw);
+}
+/** Validate an already-parsed manifest object. Shared by file + programmatic callers. */
+function validateManifest(raw) {
+    if (typeof raw !== 'object' || raw === null) {
+        throw new Error('manifest must be a JSON object');
+    }
+    const m = raw;
+    if (typeof m.name !== 'string' || !m.name) {
+        throw new Error('manifest.name is required (string)');
+    }
+    if (!Array.isArray(m.services)) {
+        throw new Error('manifest.services[] is required (array)');
+    }
+    if (m.degree !== undefined) {
+        if (typeof m.degree !== 'number' || !Number.isInteger(m.degree)) {
+            throw new Error('manifest.degree must be an integer when present');
+        }
+        // Mirror the host DTO floor (DeployAppDto: z.number().int().min(3)) so a
+        // too-low degree fails here with a clear CLI message instead of a Zod 500.
+        if (m.degree < MIN_DEGREE) {
+            throw new Error(`manifest.degree must be >= ${MIN_DEGREE} (genesis cluster floor)`);
+        }
+    }
+    const backend = m.backend;
+    const frontend = m.frontend;
+    if (!backend || typeof backend !== 'object') {
+        throw new Error('manifest.backend is required (object with port + tag)');
+    }
+    if (typeof backend.port !== 'number') {
+        throw new Error('manifest.backend.port is required (number)');
+    }
+    if (backend.port === 8080) {
+        throw new Error('manifest.backend.port 8080 is reserved for the edge sidecar');
+    }
+    if (typeof backend.tag !== 'string' || !backend.tag) {
+        throw new Error('manifest.backend.tag is required (string)');
+    }
+    if (frontend && !frontend.dir && !frontend.bundlePath) {
+        throw new Error('manifest.frontend requires `dir` or `bundlePath`');
+    }
+    return raw;
+}
+//# sourceMappingURL=deploy-manifest.js.map

package/dist/_lib/deploy-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-manifest.js","sourceRoot":"","sources":["../../src/_lib/deploy-manifest.ts"],"names":[],"mappings":";;AAuFA,sCAYC;AAGD,4CA4CC;AAlJD;;;;;;;;;;;;;;;GAeG;AACH,2BAA8C;AAC9C,+BAA+B;AAI/B,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,CAAC;AA0DrB;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,CAAC,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,0BAA0B,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAA+C,CAAC;IAEnE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,GAAe,CAAC;AACzB,CAAC"}