@hsuite/smart-engines-cli 1.5.1 → 1.5.2

package/README.md

@@ -278,9 +278,11 @@ authenticates as that id and fetches push creds for it (`pushCredentials`,
 idempotent).
 
 Flow: resolve `SUBSCRIPTION_APP_ID` → `connectAndAuth` → `pushCredentials` →
-docker build+push (backend) → **fan the image out to every cluster Harbor**
-(verify + abort on any miss) → tar + `uploadFrontend` (frontend) → sign a build
-attestation → `deploy()`. Writes `DEPLOYED_APP_ID` to the env file.
+tar + `uploadFrontend` (frontend, when present — **before** the backend image
+build, since the backend `Dockerfile` `COPY`s the frontend hook's gitignored
+output, #2788) → docker build+push (backend) → **fan the image out to every
+cluster Harbor** (verify + abort on any miss) → sign a build attestation →
+`deploy()`. Writes `DEPLOYED_APP_ID` to the env file.
 
 ```bash
 hsuite deploy --manifest ./my-app.json --env .env.local

package/dist/_lib/baas.d.ts

@@ -90,6 +90,26 @@ export type BuildAndPushOpts = {
     runFn?: RunFn;
     /** Push retry attempts (round-robin robot-auth can need a couple). Default 6. */
     pushAttempts?: number;
+    /**
+     * SINGLE-ORIGIN registry host to aim the `tag` → `login` → `push` →
+     * `imagetools inspect` sequence at, instead of `registry.server` (#1679).
+     *
+     * `registry.server` is the round-robin name over three INDEPENDENT Harbors; a
+     * chunked blob upload that hops clusters mid-session dies (`blob upload
+     * invalid`), because the uploaded bytes live on the originating cluster's own
+     * RWO PVC. Resolve this with `resolvePushOrigin` (`_lib/registry-fanout.ts`),
+     * which asks the mesh for the name it publishes for itself.
+     *
+     * LOAD-BEARING: this pins the DOCKER SEQUENCE ONLY. `registry.server` is
+     * never rewritten — `resolveAttestationDigest` / `fanOutPushedImage` derive
+     * their per-cluster target list from it, and a collapsed single-origin value
+     * makes the fan-out resolve one endpoint and SILENTLY skip
+     * (`endpoints.length <= 1`), leaving two clusters unable to pull the image.
+     *
+     * Ignored when `skipPush` is set: nothing is uploaded, so the bytes are
+     * wherever a prior push left them and any cluster may answer the digest read.
+     */
+    pushHost?: string;
 };
 /**
  * The fully-qualified target image reference: `<server>/<repository>:<tag>`.
@@ -114,10 +134,13 @@ export declare function imageTarget(registry: RegistryCreds, tag: string): strin
  * ref. The build attestation's `imageDigest` must carry this digest: the host
  * binds it to the digest Harbor serves for the tag with strict equality, so a
  * tag-form ref is rejected once `requireSignature` is enforced. The digest is
- * read from the `docker push` summary ({@link parsePushDigest}); if the summary
- * lacked one (older docker / buildx drivers / `--skip-push`), it falls back to a
- * `docker inspect ... .RepoDigests` parse ({@link parseRepoDigests}). Throws if
- * no digest can be recovered — a deploy must never proceed with an unverifiable
+ * resolved from the REGISTRY via `docker buildx imagetools inspect`
+ * ({@link inspectRegistryDigestOrThrow}) — the authoritative value Harbor
+ * serves — NOT the local daemon cache. The `docker push` summary digest
+ * ({@link parsePushDigest}), when present, is cross-checked against it and a
+ * mismatch is a hard error (#1679: a stale local digest / cross-cluster push
+ * split). Throws if no registry digest can be resolved or if it disagrees with
+ * the push summary — a deploy must never proceed with an unverifiable or stale
  * artifact reference.
  *
  * NOTE: for a single-arch (linux/amd64, the platform standard) push the push

package/dist/_lib/baas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"baas.d.ts","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAIpC,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,KAAK,GAAG,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,KACE,OAAO,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,KAAK,UAAU,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBlF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA4G3D;AAsCD,MAAM,MAAM,eAAe,GAAG;IAC5B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAIzD"}
+{"version":3,"file":"baas.d.ts","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAIpC,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,KAAK,GAAG,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,KACE,OAAO,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,KAAK,UAAU,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBlF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA4H3D;AAwDD,MAAM,MAAM,eAAe,GAAG;IAC5B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAIzD"}

package/dist/_lib/baas.js

@@ -40,13 +40,16 @@ exports.tarFrontend = tarFrontend;
  * (`--password-stdin`), never on argv. Both accept an injectable `runFn`
  * (default `execFileSync`) so unit tests never invoke docker for real.
  *
- * {@link buildAndPush} additionally CAPTURES the `docker push` stdout (rather
- * than inheriting it) so it can recover the pushed image's `sha256:<64hex>`
- * registry manifest digest — via {@link parsePushDigest}, falling back to a
- * `docker inspect ... .RepoDigests` parse ({@link parseRepoDigests}). That
- * digest is the value the build attestation's `imageDigest` must carry: the
- * host binds it to the digest Harbor serves for the tag with STRICT equality,
- * so a tag-form ref would be rejected once `requireSignature` is enforced.
+ * {@link buildAndPush} records the pushed image's `sha256:<64hex>` registry
+ * manifest digest by resolving it from the REGISTRY via `docker buildx
+ * imagetools inspect` ({@link parseImagetoolsDigest}) — NOT from the local
+ * daemon cache, which a same-tag re-push or a DNS-round-robin retry can leave
+ * STALE (#1679). The `digest:` line the push summary carries (captured stdout,
+ * {@link parsePushDigest}) is cross-checked against the registry digest; a
+ * mismatch is a hard error. That digest is the value the build attestation's
+ * `imageDigest` must carry: the host binds it to the digest Harbor serves for
+ * the tag with STRICT equality, so a stale/tag-form ref would be rejected once
+ * `requireSignature` is enforced.
  */
 const child_process_1 = require("child_process");
 const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
@@ -110,10 +113,13 @@ function imageTarget(registry, tag) {
  * ref. The build attestation's `imageDigest` must carry this digest: the host
  * binds it to the digest Harbor serves for the tag with strict equality, so a
  * tag-form ref is rejected once `requireSignature` is enforced. The digest is
- * read from the `docker push` summary ({@link parsePushDigest}); if the summary
- * lacked one (older docker / buildx drivers / `--skip-push`), it falls back to a
- * `docker inspect ... .RepoDigests` parse ({@link parseRepoDigests}). Throws if
- * no digest can be recovered — a deploy must never proceed with an unverifiable
+ * resolved from the REGISTRY via `docker buildx imagetools inspect`
+ * ({@link inspectRegistryDigestOrThrow}) — the authoritative value Harbor
+ * serves — NOT the local daemon cache. The `docker push` summary digest
+ * ({@link parsePushDigest}), when present, is cross-checked against it and a
+ * mismatch is a hard error (#1679: a stale local digest / cross-cluster push
+ * split). Throws if no registry digest can be resolved or if it disagrees with
+ * the push summary — a deploy must never proceed with an unverifiable or stale
  * artifact reference.
  *
  * NOTE: for a single-arch (linux/amd64, the platform standard) push the push
@@ -181,41 +187,53 @@ function buildAndPush(opts) {
             env: dockerEnv,
         });
     }
-    const target = imageTarget(opts.registry, opts.tag);
+    // #1679: aim the whole docker sequence at ONE origin when the caller resolved
+    // a pin. `opts.registry` itself is left alone — see `pushHost`'s docblock for
+    // why collapsing it breaks the downstream fan-out.
+    const pinnedHost = !opts.skipPush && opts.pushHost ? opts.pushHost : null;
+    const target = pinnedHost
+        ? `${pinnedHost}/${opts.registry.repository}:${opts.tag}`
+        : imageTarget(opts.registry, opts.tag);
+    // docker keys stored credentials by registry HOST, so the login must name the
+    // same host the push dials or the pinned push goes out unauthenticated.
+    const loginHost = pinnedHost ?? opts.registry.server;
     run('docker', ['tag', localTag, target], { stdio: 'inherit', env: dockerEnv });
     if (opts.skipPush) {
         // Nothing was pushed this run, but the image is asserted present at the
-        // registry — recover its digest from `RepoDigests` so the attestation is
-        // still bound to the real artifact.
-        return inspectDigestOrThrow(run, target, dockerEnv, opts.registry, opts.tag);
+        // registry — resolve its digest from the registry (`buildx imagetools
+        // inspect`) so the attestation is bound to what Harbor actually serves.
+        return inspectRegistryDigestOrThrow(run, target, dockerEnv, null);
     }
     // CRITICAL: username is a discrete argv element (no shell, no `$` expansion);
     // password via stdin. See the module header.
-    run('docker', ['login', opts.registry.server, '-u', opts.registry.username, '--password-stdin'], { input: opts.registry.password, stdio: loginStdio, env: dockerEnv });
+    run('docker', ['login', loginHost, '-u', opts.registry.username, '--password-stdin'], { input: opts.registry.password, stdio: loginStdio, env: dockerEnv });
+    // Push with a retry budget (Harbor round-robin robot-auth occasionally 401s
+    // the first hit). Digest RESOLUTION happens AFTER a push succeeds — outside
+    // the retry loop — so a registry-verify failure or a digest mismatch surfaces
+    // as its own hard error rather than being masked as a push retry.
     const attempts = opts.pushAttempts ?? 6;
     let lastErr;
+    let pushOut = '';
+    let pushed = false;
     for (let i = 1; i <= attempts; i++) {
         try {
             // Capture stdout (encoding 'utf8' → a string) so `parsePushDigest` can
-            // read the `… : digest: sha256:<64hex> size: …` summary line.
-            const pushOut = run('docker', ['push', target], {
-                stdio: captureStdio,
-                encoding: 'utf8',
-                env: dockerEnv,
-            });
-            const fromPush = (0, docker_1.parsePushDigest)(asStdout(pushOut));
-            if (fromPush)
-                return fromPush;
-            // Push succeeded but the summary carried no digest (older docker / buildx
-            // drivers). Recover it from `RepoDigests`.
-            return inspectDigestOrThrow(run, target, dockerEnv, opts.registry, opts.tag);
+            // read the `… : digest: sha256:<64hex> size: …` summary line for the
+            // registry cross-check.
+            pushOut = asStdout(run('docker', ['push', target], { stdio: captureStdio, encoding: 'utf8', env: dockerEnv }));
+            pushed = true;
+            break;
         }
         catch (err) {
             lastErr = err;
-            // Harbor round-robin robot-auth occasionally 401s the first hit; retry.
         }
     }
-    throw new Error(`docker push failed after ${attempts} attempts: ${lastErr?.message ?? 'unknown'}`);
+    if (!pushed) {
+        throw new Error(`docker push failed after ${attempts} attempts: ${lastErr?.message ?? 'unknown'}`);
+    }
+    // AUTHORITATIVE: bind the attestation to the digest the registry serves for
+    // the tag, cross-checked against the push summary (mismatch ⇒ throw, #1679).
+    return inspectRegistryDigestOrThrow(run, target, dockerEnv, (0, docker_1.parsePushDigest)(pushOut));
 }
 /** Coerce a `runFn` stdout return (string under `encoding:'utf8'`, else Buffer) to a string. */
 function asStdout(out) {
@@ -226,23 +244,39 @@ function asStdout(out) {
     return '';
 }
 /**
- * `docker inspect --format '{{json .RepoDigests}}' <target>` via the shared
- * `runFn` seam, returning the `sha256:<64hex>` digest for `<server>/<repo>` (the
- * inspect-fallback path of {@link buildAndPush}). Throws if no matching digest
- * is present — a deploy must never proceed with an unverifiable artifact ref.
+ * Resolve the digest the REGISTRY serves for `<target>` via `docker buildx
+ * imagetools inspect` (the shared `runFn` seam), and — when a `pushDigest` from
+ * the push summary is supplied — assert they agree. `imagetools inspect` queries
+ * the registry, so unlike a local `docker inspect ... .RepoDigests` read it can
+ * never return a STALE same-tag digest (#1679).
+ *
+ * Throws if the registry digest can't be resolved, or if it disagrees with the
+ * push-summary digest — a deploy must never proceed with an unverifiable or
+ * stale artifact reference.
  */
-function inspectDigestOrThrow(run, target, env, registry, tag) {
-    const inspectOut = asStdout(run('docker', ['inspect', '--format', '{{json .RepoDigests}}', target], {
+function inspectRegistryDigestOrThrow(run, target, env, pushDigest) {
+    // Name the ref we ACTUALLY inspected. Under a #1679 push pin that is the
+    // single-origin target, NOT `registry.server`/<repo>:<tag> — a failure naming
+    // the round-robin host while the pinned host is what failed sends the reader
+    // to the wrong cluster.
+    const ref = target;
+    const inspectOut = asStdout(run('docker', ['buildx', 'imagetools', 'inspect', target], {
         stdio: ['ignore', 'pipe', 'ignore'],
         encoding: 'utf8',
         env,
     }));
-    const digest = (0, docker_1.parseRepoDigests)(inspectOut, registry);
-    if (digest)
-        return digest;
-    throw new Error(`pushed ${registry.server}/${registry.repository}:${tag} but could not determine its ` +
-        'registry manifest digest (no `digest: sha256:...` in push output and no matching ' +
-        'RepoDigests from `docker inspect`).');
+    const registryDigest = (0, docker_1.parseImagetoolsDigest)(inspectOut);
+    if (!registryDigest) {
+        throw new Error(`pushed ${ref} but could not resolve its registry manifest digest via ` +
+            '`docker buildx imagetools inspect` (registry unreachable or buildx unavailable). ' +
+            'Refusing to attest an unverifiable artifact reference.');
+    }
+    if (pushDigest && pushDigest !== registryDigest) {
+        throw new Error(`digest mismatch for ${ref}: push summary reported ${pushDigest} but the registry ` +
+            `serves ${registryDigest} (stale local digest / cross-cluster push split, #1679). ` +
+            'Refusing to attest a digest the registry does not serve.');
+    }
+    return registryDigest;
 }
 /**
  * Tar a frontend `dir` into a plain `.tar` at `out` (the smart-host accepts a

package/dist/_lib/baas.js.map

@@ -1 +1 @@
-{"version":3,"file":"baas.js","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":";;;AAuHA,wCAiBC;AAmCD,kCAEC;AAiCD,oCA4GC;AAuDD,kCAIC;AArXD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,iDAA6C;AAC7C,iEAAuD;AAEvD,+BAA2C;AAC3C,qCAA6D;AAE7D,sFAAsF;AACzE,QAAA,yBAAyB,GAAG,OAAO,CAAC;AAEjD;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,aAAa,CAAC;AAuDpD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iCAAyB;KACnD,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAgCD;;GAEG;AACH,SAAgB,WAAW,CAAC,QAAuB,EAAE,GAAW;IAC9D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,YAAY,CAAC,IAAsB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,MAAM,SAAS,GAAsB;QACnC,GAAG,OAAO,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAuB;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,oEAAoE;QACpE,6DAA6D;QAC7D,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,8BAAsB,CAAC;QACzD,GAAG,CACD,QAAQ,EACR;YACE,OAAO;YACP,YAAY;YACZ,QAAQ;YACR,oBAAoB;YACpB,cAAc;YACd,IAAI;YACJ,QAAQ;YACR,IAAI;YACJ,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,OAAO;SACb,EACD;YACE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,SAAS;SACf,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAE/E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,wEAAwE;QACxE,yEAAyE;QACzE,oCAAoC;QACpC,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,8EAA8E;IAC9E,6CAA6C;IAC7C,GAAG,CACD,QAAQ,EACR,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACjF,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CACrE,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IACxC,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;gBAC9C,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,wBAAe,EAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,0EAA0E;YAC1E,2CAA2C;YAC3C,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,cAAe,OAAiB,EAAE,OAAO,IAAI,SAAS,EAAE,CAC7F,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,IAAI,OAAQ,GAAc,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAQ,GAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,GAAU,EACV,MAAc,EACd,GAAsB,EACtB,QAAuB,EACvB,GAAW;IAEX,MAAM,UAAU,GAAG,QAAQ,CACzB,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE;QACtE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG;KACJ,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,yBAAgB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,KAAK,CACb,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,+BAA+B;QACpF,mFAAmF;QACnF,qCAAqC,CACxC,CAAC;AACJ,CAAC;AAWD;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,IAAqB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC"}
+{"version":3,"file":"baas.js","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":";;;AA0HA,wCAiBC;AAuDD,kCAEC;AAoCD,oCA4HC;AAyED,kCAIC;AAjbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,iDAA6C;AAC7C,iEAAuD;AAEvD,+BAA2C;AAC3C,qCAAkE;AAElE,sFAAsF;AACzE,QAAA,yBAAyB,GAAG,OAAO,CAAC;AAEjD;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,aAAa,CAAC;AAuDpD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iCAAyB;KACnD,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAoDD;;GAEG;AACH,SAAgB,WAAW,CAAC,QAAuB,EAAE,GAAW;IAC9D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,YAAY,CAAC,IAAsB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,MAAM,SAAS,GAAsB;QACnC,GAAG,OAAO,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAuB;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,oEAAoE;QACpE,6DAA6D;QAC7D,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,8BAAsB,CAAC;QACzD,GAAG,CACD,QAAQ,EACR;YACE,OAAO;YACP,YAAY;YACZ,QAAQ;YACR,oBAAoB;YACpB,cAAc;YACd,IAAI;YACJ,QAAQ;YACR,IAAI;YACJ,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,OAAO;SACb,EACD;YACE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,SAAS;SACf,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;QACzD,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,SAAS,GAAG,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrD,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAE/E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,OAAO,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,8EAA8E;IAC9E,6CAA6C;IAC7C,GAAG,CACD,QAAQ,EACR,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACtE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CACrE,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IACxC,IAAI,OAAgB,CAAC;IACrB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,uEAAuE;YACvE,qEAAqE;YACrE,wBAAwB;YACxB,OAAO,GAAG,QAAQ,CAChB,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAC3F,CAAC;YACF,MAAM,GAAG,IAAI,CAAC;YACd,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,cAAe,OAAiB,EAAE,OAAO,IAAI,SAAS,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,wBAAe,EAAC,OAAO,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,IAAI,OAAQ,GAAc,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAQ,GAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,4BAA4B,CACnC,GAAU,EACV,MAAc,EACd,GAAsB,EACtB,UAAyB;IAEzB,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,MAAM,UAAU,GAAG,QAAQ,CACzB,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;QACzD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG;KACJ,CAAC,CACH,CAAC;IACF,MAAM,cAAc,GAAG,IAAA,8BAAqB,EAAC,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,0DAA0D;YACrE,mFAAmF;YACnF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,2BAA2B,UAAU,oBAAoB;YACjF,UAAU,cAAc,2DAA2D;YACnF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAWD;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,IAAqB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC"}

package/dist/_lib/cluster-convergence.d.ts

@@ -0,0 +1,214 @@
+/**
+ * Per-cluster post-deploy convergence gate (#2787).
+ *
+ * ## Why this exists
+ *
+ * A deploy reaches exactly ONE cluster. `gateway.<domain>` is public-DNS
+ * round-robin over the three cluster ingresses, each fronting an INDEPENDENT
+ * smart-host + Mongo, and the runtime record is replicated to the peers
+ * asynchronously (the validator's `runtime.attached` fan-out). When that
+ * replication misses a cluster, nothing notices: the CLI polls the same
+ * round-robin name, gets a `RUNNING` from whichever cluster answers, and prints
+ * `✓ redeployed`.
+ *
+ * That is not hypothetical. On testnet 2026-08-22 (#2787) repeated
+ * `hsuite redeploy --tag v12` runs converged sn2 and sn3 and never sn1: sn1 kept
+ * a build-attestation pinning the PREVIOUS digest, its deployer refused the new
+ * image on every reconcile, and it served nothing for that app while the load
+ * balancer kept sending it a third of the traffic. Every run reported success.
+ *
+ * ## How it checks
+ *
+ * Round-robin polling cannot attribute an answer to a cluster, so we address the
+ * clusters directly: resolve the gateway's A-records and dial each ingress IP
+ * with TLS SNI + the HTTP `Host` header pinned to the gateway hostname — exactly
+ * the transport the registry fan-out already uses for the three Harbors
+ * ({@link defaultTransport}). Each cluster then:
+ *   1. names itself on the `@Public()` `GET /api/v3/cluster/health` route, and
+ *   2. issues its OWN session bearer (the XRPL web3 challenge/verify handshake —
+ *      a session minted on one cluster is not valid on its peers), which is then
+ *      used to read that cluster's own `…/deployment/apps/:appId/status`.
+ *
+ * The result is one observation per cluster, which {@link assertClustersConverged}
+ * turns into a hard error naming the cluster and both digests.
+ *
+ * ## What a PASS here does and does not mean (#2887)
+ *
+ * A pass means: every cluster the gateway advertises answered, and each one's
+ * runtime RECORD names the image ref this run deployed. It does NOT mean the
+ * running container's digest was verified — `runtime.image` is the desired-state
+ * ref the host attached, and no field on the status read path carries the
+ * `@sha256:` the deployer pins at apply time. Anything short of one answer per
+ * advertised cluster is an evidence gap and fails loudly rather than passing.
+ *
+ * Read-only: the probe issues auth handshakes and GETs, never a deploy.
+ */
+import { type RegistryTransport } from './registry-fanout';
+/** What ONE cluster reports about the app. */
+export type ClusterRuntimeObservation = {
+    /** Cluster-ingress address dialled. */
+    ip: string;
+    /** Self-reported `CLUSTER_ID` (`sn1`…), or `null` when the cluster didn't name itself. */
+    clusterId: string | null;
+    /** Did this cluster answer the authenticated status read at all? */
+    reachable: boolean;
+    /** App lifecycle state (`ACTIVE` / `SUSPENDED` / …). */
+    state?: string;
+    /** Runtime state as THIS cluster's deployer sees it. */
+    runtimeState?: string;
+    /** Image ref THIS cluster has pinned — the field that exposes the divergence. */
+    image?: string;
+    /** This cluster's own reconcile error (carries the digest MISMATCH text). */
+    lastError?: string;
+    /** Probe-level failure (unreachable / auth failed / malformed answer). */
+    error?: string;
+};
+/** XRPL (or other chain) signer — same shape `buildSignerFromEnv` returns. */
+export type ConvergenceSigner = {
+    chain: string;
+    walletAddress: string;
+    publicKey: string;
+    signFn: (message: string) => string | Promise<string>;
+};
+export type ProbeClusterRuntimesOpts = {
+    /** Public gateway URL (`https://gateway.<domain>`) — the round-robin name. */
+    gateway: string;
+    /** Management TARGET — the deployed app to read on every cluster. */
+    appId: string;
+    /** Auth IDENTITY — the developer's subscription appId (challenge context). */
+    authAppId: string;
+    /** Developer signer used for the per-cluster web3 handshake. */
+    signer: ConvergenceSigner;
+    /** Per-request timeout (ms). Default 10s. */
+    timeoutMs?: number;
+    /** Test seam — the pinned HTTPS transport. Defaults to {@link defaultTransport}. */
+    transport?: RegistryTransport;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+    /**
+     * Already-resolved cluster ingress IPs. {@link waitForClusterConvergence}
+     * resolves the gateway ONCE and threads the answer through every poll, so the
+     * expected cluster count cannot drift mid-wait (round-robin DNS can return a
+     * short answer, and a shrinking expectation would quietly re-open the
+     * partial-evidence hole this gate exists to close).
+     */
+    endpoints?: string[];
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+    /**
+     * Bearer cache keyed by cluster IP, shared across the retry polls of
+     * {@link waitForClusterConvergence} so a 6-poll wait mints 3 sessions, not 18.
+     */
+    tokenCache?: Map<string, string>;
+};
+/**
+ * Ask EVERY cluster behind the gateway what it has deployed for `appId`.
+ *
+ * One observation per resolved ingress IP, in endpoint order. A cluster that
+ * cannot be reached or authenticated yields `reachable: false` with `error` set
+ * — never a throw at the per-cluster level, so {@link assertClustersConverged}
+ * can weigh WHICH clusters gave evidence against how many were expected.
+ *
+ * #2887: a DNS failure is NOT one of those soft outcomes. It used to log
+ * `skipping the check` and return `[]`, and an empty observation list then fell
+ * straight through the old `observations.length <= 1` short-circuit in
+ * `assertClustersConverged` — so "I could not find the clusters" was reported
+ * as "the clusters agree". Not being able to enumerate the mesh is a total
+ * evidence gap; it throws, and {@link waitForClusterConvergence} gives it the
+ * same retry budget as any other transient fault before failing loudly.
+ */
+export declare function probeClusterRuntimes(opts: ProbeClusterRuntimesOpts): Promise<ClusterRuntimeObservation[]>;
+export type AssertConvergedArgs = {
+    appId: string;
+    /** The image ref this run deployed (`<server>/<repo>:<tag>`). */
+    expectedImage: string;
+    /** The digest this run attested — half of the pair an error message must carry. */
+    attestedDigest: string;
+    /**
+     * How many INDEPENDENT clusters the gateway advertises — the number of
+     * answers a converged verdict requires. Sourced from the gateway's A-records
+     * by {@link waitForClusterConvergence}, NOT from `observations.length`:
+     * deriving it from the answers we happened to get is what made the old gate
+     * vacuous (#2887). REQUIRED, deliberately — an optional field with a
+     * permissive default is how this hole would grow back.
+     */
+    expectedClusters: number;
+    observations: ClusterRuntimeObservation[];
+};
+/**
+ * Throw unless EVERY cluster the gateway advertises answered, and every answer
+ * is the image this run deployed.
+ *
+ * Divergence is: a cluster pinned to a different image, a cluster whose runtime
+ * is `FAILED`, or a cluster with no runtime record at all. The error names each
+ * diverged cluster, what it is stuck on, and the digest this run attested — so
+ * the operator sees both sides of the mismatch instead of `✓ deployed`.
+ *
+ * ## Full evidence is required (#2887)
+ *
+ * This gate previously excluded unreachable clusters from the comparison and
+ * passed on whatever was left, short-circuiting entirely at
+ * `observations.length <= 1`. Both rules turned MISSING evidence into a pass:
+ * one matching answer out of three clusters read as "converged", and an empty
+ * probe (the gateway failing to resolve) read as "converged" too. Measured on
+ * testnet 2026-08-27: a deploy printed `✓ deployed` while `kubectl` showed sn1
+ * on `app:v33` and sn2 + sn3 still on `app:v32`.
+ *
+ * "I could not reach 2 of 3 clusters" and "all 3 clusters agree" are different
+ * sentences and only one of them is a pass. Transient faults are absorbed by
+ * the retry budget in {@link waitForClusterConvergence}, not by lowering the
+ * bar here; a mesh that is knowingly unreachable from the developer's network
+ * has `--skip-cluster-check`, which at least says so out loud.
+ *
+ * The one genuine no-op left: `expectedClusters <= 1`. A single-cluster / dev
+ * gateway has nothing to diverge from — the same rule the image fan-out
+ * applies at `endpoints.length <= 1`.
+ *
+ * ## What this can and cannot see
+ *
+ * `observation.image` is the per-cluster runtime RECORD (`runtime.image`,
+ * written by the host's `attachRuntime` call and read back through
+ * `GET …/deployment/apps/:appId/status`). It is a desired-state tag ref, not
+ * the digest of the container actually running: nothing on that read path
+ * surfaces the `@sha256:` the deployer pins at apply time. So this gate catches
+ * a cluster on the WRONG TAG or a `FAILED` reconcile, and cannot catch a
+ * cluster serving a different artifact under the same tag. Closing that needs
+ * the deployer's resolved digest surfaced in the runtime projection
+ * (smart-deployer → validator `runtime/status` → smart-host → SDK) — tracked
+ * separately; do not paper over it here with a comparison that has no digest
+ * to compare.
+ */
+export declare function assertClustersConverged(args: AssertConvergedArgs): void;
+export type WaitForClusterConvergenceOpts = ProbeClusterRuntimesOpts & {
+    /** The image ref this run deployed (`<server>/<repo>:<tag>`). */
+    expectedImage: string;
+    /** The digest this run attested. */
+    attestedDigest: string;
+    /** Delay between convergence polls (ms). Default 5s. */
+    intervalMs?: number;
+    /** Poll budget. Default 6 (~30s) — replication lag, not a wait-for-RUNNING. */
+    maxPolls?: number;
+    /** Injectable sleep for tests. */
+    sleep?: (ms: number) => Promise<void>;
+};
+/**
+ * Probe every cluster until they all run the deployed image, or the budget is
+ * exhausted — then throw ({@link assertClustersConverged}).
+ *
+ * The retry budget exists because peer replication is asynchronous: a cluster
+ * that simply hasn't caught up yet must not fail a healthy deploy. A cluster
+ * that is genuinely STUCK (a stale build-attestation, a crash-looping image)
+ * does not converge within any budget, which is the case this gate is for.
+ *
+ * #2887: the budget now covers the EVIDENCE-gathering failures too — a gateway
+ * that won't resolve, or clusters that won't answer. Those used to be reported
+ * as a pass; they are retried like any other transient fault and then fail
+ * loudly, because a check with no evidence has no verdict to give.
+ *
+ * The gateway is resolved ONCE and the answer threaded through every poll, so
+ * the expected cluster count is fixed for the whole wait. Re-resolving each
+ * poll would let a short round-robin answer shrink the expectation to match the
+ * clusters that happened to reply — the exact vacuity being removed.
+ */
+export declare function waitForClusterConvergence(opts: WaitForClusterConvergenceOpts): Promise<ClusterRuntimeObservation[]>;
+//# sourceMappingURL=cluster-convergence.d.ts.map

package/dist/_lib/cluster-convergence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-convergence.d.ts","sourceRoot":"","sources":["../../src/_lib/cluster-convergence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAQL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAK3B,8CAA8C;AAC9C,MAAM,MAAM,yBAAyB,GAAG;IACtC,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,0FAA0F;IAC1F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,MAAM,EAAE,iBAAiB,CAAC;IAC1B,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAUtC;AA8HD,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,yBAAyB,EAAE,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA0DvE;AAED,MAAM,MAAM,6BAA6B,GAAG,wBAAwB,GAAG;IACrE,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAqDtC"}