@hsuite/smart-engines-cli 1.2.1 → 1.4.2

package/dist/_lib/frontend-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-guard.d.ts","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxE"}

package/dist/_lib/frontend-guard.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNoDeploySentinels = assertNoDeploySentinels;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Fail-closed guard shared by `deploy` and `redeploy`: refuse to ship a
+ * frontend build that still carries unfilled `REPLACE_BEFORE_DEPLOY:<key>`
+ * placeholders (per-deployment config that was never set).
+ *
+ * Such a build refuses to bootstrap in the browser (the SPA's `main.ts` asserts
+ * on the sentinel prefix), and the CLI would otherwise tar+upload it silently —
+ * which is exactly how a non-bootstrapping bundle reached production. Matches
+ * the sentinel VALUE form (`:` followed by a letter) so it does NOT
+ * false-positive on the guard's own comparison literal (`REPLACE_BEFORE_DEPLOY:"`).
+ */
+async function assertNoDeploySentinels(dir) {
+    const SENTINEL = /REPLACE_BEFORE_DEPLOY:[A-Za-z]/;
+    const TEXT_EXT = /\.(js|mjs|cjs|html|css|json|txt|map|webmanifest)$/i;
+    const hits = [];
+    const walk = async (d) => {
+        for (const ent of await fs_1.promises.readdir(d, { withFileTypes: true })) {
+            const p = (0, path_1.join)(d, ent.name);
+            if (ent.isDirectory())
+                await walk(p);
+            else if (TEXT_EXT.test(ent.name)) {
+                const m = (await fs_1.promises.readFile(p, 'utf8')).match(SENTINEL);
+                if (m)
+                    hits.push(`${(0, path_1.relative)(dir, p)} (${m[0]}…)`);
+            }
+        }
+    };
+    await walk(dir);
+    if (hits.length) {
+        throw new Error(`frontend still contains REPLACE_BEFORE_DEPLOY placeholders — fill your ` +
+            `per-deployment config (e.g. environment.prod.ts) and rebuild before deploying. ` +
+            `Offending: ${hits.slice(0, 5).join(', ')}` +
+            (hits.length > 5 ? `, +${hits.length - 5} more` : ''));
+    }
+}
+//# sourceMappingURL=frontend-guard.js.map

package/dist/_lib/frontend-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-guard.js","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":";;AAcA,0DAuBC;AArCD,2BAAoC;AACpC,+BAAsC;AAEtC;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAW;IACvD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,aAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;iBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,iFAAiF;YACjF,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/_lib/registry-fanout.d.ts

@@ -0,0 +1,178 @@
+import { Buffer } from 'buffer';
+/** A request against one cluster's Harbor Registry-v2 API. `path` is always `/v2/...` (or `/token...`). */
+export type RegistryRequest = {
+    ip: string;
+    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH';
+    path: string;
+    headers?: Record<string, string>;
+    body?: Buffer;
+};
+/** A Registry-v2 response. Header keys are lower-cased by the default transport. */
+export type RegistryResponse = {
+    status: number;
+    headers: Record<string, string>;
+    body: Buffer;
+};
+/**
+ * The injectable network seam. The default implementation
+ * ({@link defaultTransport}) dials `req.ip:443` with TLS `servername` =
+ * the federated host and an added `Host` header = the federated host, with
+ * verification ON. Tests inject a fake — no real network.
+ */
+export type RegistryTransport = (req: RegistryRequest) => Promise<RegistryResponse>;
+/** A fan-out target — just the cluster-ingress IP. (Kept as a type for call-site clarity.) */
+export type FanOutTarget = {
+    ip: string;
+};
+/** Per-endpoint outcome of {@link ensureImageOnClusters}. */
+export type FanOutReport = {
+    targets: Array<{
+        ip: string;
+        outcome: 'present' | 'copied' | 'failed';
+        error?: string;
+    }>;
+};
+export type EnsureImageOpts = {
+    host: string;
+    repository: string;
+    tag: string;
+    /** The `sha256:<64hex>` manifest digest the push produced — the SSoT for present/verify. */
+    digest: string;
+    username: string;
+    password: string;
+    /** Cluster-ingress IPs (e.g. from {@link resolveClusterEndpoints}). */
+    endpoints: string[];
+    /** Test seam — defaults to {@link defaultTransport} bound to `host`. */
+    transport?: RegistryTransport;
+};
+/** A parsed `WWW-Authenticate: Bearer ...` token challenge. `realm` is mandatory. */
+export type AuthChallenge = {
+    realm: string;
+    service?: string;
+    scope?: string;
+};
+/**
+ * Parse a `Bearer realm="...",service="...",scope="..."` challenge. Pure.
+ *
+ * Returns `null` for a non-Bearer scheme or a Bearer challenge missing the
+ * mandatory `realm` (without a realm there is nowhere to fetch a token from).
+ */
+export declare function parseAuthChallenge(wwwAuthenticate: string): AuthChallenge | null;
+/**
+ * DNS-resolve the federated host's A-records into the de-duplicated, sorted list
+ * of cluster-ingress IPs to fan out across. Injectable `resolve4` for tests;
+ * defaults to `dns.promises.resolve4`.
+ */
+export declare function resolveClusterEndpoints(host: string, resolve4?: (h: string) => Promise<string[]>): Promise<string[]>;
+/**
+ * Real {@link RegistryTransport}: HTTPS to `req.ip:443` with TLS SNI + HTTP
+ * `Host` pinned to `host`, verification ON. All registry paths are `/v2/...`;
+ * absolute token-realm URLs are handled by {@link fetchAbsolute}.
+ */
+export declare function defaultTransport(host: string): RegistryTransport;
+/**
+ * Fan out an already-pushed image to every cluster Harbor and prove it landed
+ * on all of them. See the module header for the full algorithm. Throws if no
+ * endpoint serves the digest to copy from, or if re-verification finds any
+ * endpoint not serving the pushed digest (the error names the failed IPs).
+ */
+export declare function ensureImageOnClusters(opts: EnsureImageOpts): Promise<FanOutReport>;
+/** Options for {@link resolveRegistryDigest}. */
+export type ResolveRegistryDigestOpts = {
+    /** Federated Harbor host, e.g. `harbor.testnet.hsuite.network` (no scheme/port). */
+    host: string;
+    /** Repository path, e.g. `hsuite-customers-<appId>/app`. */
+    repository: string;
+    /** The pushed tag to resolve to its canonical served digest. */
+    tag: string;
+    username: string;
+    password: string;
+    /** Test seam — the registry transport (defaults to {@link defaultTransport}). */
+    transport?: RegistryTransport;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+};
+/**
+ * Resolve the CANONICAL manifest digest the registry serves for `<repo>:<tag>`
+ * — the value returned in the `Docker-Content-Digest` response header on a
+ * `HEAD /v2/<repo>/manifests/<tag>`.
+ *
+ * ## Why this is the digest to ATTEST (issue #1589)
+ *
+ * The `docker push` summary reports the digest of the manifest the *local*
+ * client holds. With a containerd image store (Colima / buildkit snapshotter),
+ * that is an OCI image manifest, but Harbor stores + re-serves the tag under a
+ * DIFFERENT canonical digest (a re-serialized Docker schema2 manifest) — the
+ * push-summary digest and the tag's served digest disagree. The deployer pins +
+ * the fan-out re-verify BOTH key off the tag's served `Docker-Content-Digest`
+ * ({@link CustomerImageDigestResolverService} does the identical HEAD). So the
+ * CLI must attest THIS registry-truth digest, not the push-summary one, and feed
+ * the SAME value to the fan-out — then attested == fanned-out == deployer-resolved
+ * by construction.
+ *
+ * This is the exact resolution the deployer performs, so it is authoritative for
+ * the strict-equality attestation gate. Returns the `sha256:<64hex>` served
+ * digest, or `null` when the registry can't be probed (caller decides whether to
+ * fall back to the push-summary digest — a fail-soft, not a fail-open: the
+ * deployer still re-verifies).
+ */
+export declare function resolveRegistryDigest(opts: ResolveRegistryDigestOpts): Promise<string | null>;
+/** Registry coordinates a push produced (shape of `BaasInitResponse.registry`). */
+export type FanOutRegistry = {
+    server: string;
+    username: string;
+    password: string;
+    repository: string;
+};
+export type ResolveAttestationDigestOpts = {
+    registry: FanOutRegistry;
+    tag: string;
+    /** The `sha256:<64hex>` digest the local `docker push` reported. */
+    pushDigest: string;
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+    /** Test seam — the registry transport. */
+    transport?: RegistryTransport;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+};
+/**
+ * Decide the digest to ATTEST (and to feed the fan-out): the digest Harbor
+ * SERVES for `<repo>:<tag>`, resolved the same way the deployer does. Falls back
+ * to the local `docker push` summary digest ONLY if the registry can't be probed
+ * (offline / dev registry / transient) — a fail-SOFT, never a fail-open, because
+ * the deployer independently re-verifies the served digest against the attested
+ * one before it pins the pod.
+ *
+ * See {@link resolveRegistryDigest} for why the served digest — not the push
+ * summary — is authoritative for the #1445 strict-equality gate (issue #1589).
+ */
+export declare function resolveAttestationDigest(opts: ResolveAttestationDigestOpts): Promise<string>;
+export type FanOutPushedImageOpts = {
+    registry: FanOutRegistry;
+    tag: string;
+    /** The `sha256:<64hex>` digest the push produced. */
+    digest: string;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+    /** Test seam — the registry transport. */
+    transport?: RegistryTransport;
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+};
+/**
+ * The deploy-time entrypoint: take an image just pushed to the federated host
+ * (landed on ONE cluster) and guarantee it is present on EVERY cluster Harbor.
+ *
+ * Resolves the registry host's A-records into the cluster-ingress set, then:
+ *   - 0/1 endpoint (a non-federated or local/dev registry, or DNS that doesn't
+ *     fan out) → nothing to distribute; returns `null`.
+ *   - ≥2 endpoints → {@link ensureImageOnClusters}, which copies + re-verifies
+ *     and THROWS if any cluster ends up not serving the pushed digest.
+ *
+ * A DNS resolution failure is treated as "single-target" (logged, returns
+ * `null`) rather than fatal: a real federated push has already proven the host
+ * resolves, so a failure here means a dev/local registry where fan-out is moot.
+ */
+export declare function fanOutPushedImage(opts: FanOutPushedImageOpts): Promise<FanOutReport | null>;
+//# sourceMappingURL=registry-fanout.d.ts.map

package/dist/_lib/registry-fanout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-fanout.d.ts","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAmChC,2GAA2G;AAC3G,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEpF,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1F,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgBhF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAA0B,GAClE,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA6BhE;AAwHD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FxF;AA8ED,iDAAiD;AACjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+B9B"}