@hsuite/smart-engines-cli 1.5.1 → 1.6.0

package/dist/_lib/cluster-convergence.js

@@ -0,0 +1,381 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.probeClusterRuntimes = probeClusterRuntimes;
+exports.assertClustersConverged = assertClustersConverged;
+exports.waitForClusterConvergence = waitForClusterConvergence;
+/**
+ * Per-cluster post-deploy convergence gate (#2787).
+ *
+ * ## Why this exists
+ *
+ * A deploy reaches exactly ONE cluster. `gateway.<domain>` is public-DNS
+ * round-robin over the three cluster ingresses, each fronting an INDEPENDENT
+ * smart-host + Mongo, and the runtime record is replicated to the peers
+ * asynchronously (the validator's `runtime.attached` fan-out). When that
+ * replication misses a cluster, nothing notices: the CLI polls the same
+ * round-robin name, gets a `RUNNING` from whichever cluster answers, and prints
+ * `✓ redeployed`.
+ *
+ * That is not hypothetical. On testnet 2026-08-22 (#2787) repeated
+ * `hsuite redeploy --tag v12` runs converged sn2 and sn3 and never sn1: sn1 kept
+ * a build-attestation pinning the PREVIOUS digest, its deployer refused the new
+ * image on every reconcile, and it served nothing for that app while the load
+ * balancer kept sending it a third of the traffic. Every run reported success.
+ *
+ * ## How it checks
+ *
+ * Round-robin polling cannot attribute an answer to a cluster, so we address the
+ * clusters directly: resolve the gateway's A-records and dial each ingress IP
+ * with TLS SNI + the HTTP `Host` header pinned to the gateway hostname — exactly
+ * the transport the registry fan-out already uses for the three Harbors
+ * ({@link defaultTransport}). Each cluster then:
+ *   1. names itself on the `@Public()` `GET /api/v3/cluster/health` route, and
+ *   2. issues its OWN session bearer (the XRPL web3 challenge/verify handshake —
+ *      a session minted on one cluster is not valid on its peers), which is then
+ *      used to read that cluster's own `…/deployment/apps/:appId/status`.
+ *
+ * The result is one observation per cluster, which {@link assertClustersConverged}
+ * turns into a hard error naming the cluster and both digests.
+ *
+ * ## What a PASS here does and does not mean (#2887)
+ *
+ * A pass means: every cluster the gateway advertises answered, and each one's
+ * runtime RECORD names the image ref this run deployed. It does NOT mean the
+ * running container's digest was verified — `runtime.image` is the desired-state
+ * ref the host attached, and no field on the status read path carries the
+ * `@sha256:` the deployer pins at apply time. Anything short of one answer per
+ * advertised cluster is an evidence gap and fails loudly rather than passing.
+ *
+ * Read-only: the probe issues auth handshakes and GETs, never a deploy.
+ */
+const registry_fanout_1 = require("./registry-fanout");
+/** The host API is mounted behind this prefix on the gateway (matches `connectAndAuth`). */
+const HOST_PATH_PREFIX = '/host';
+/**
+ * Ask EVERY cluster behind the gateway what it has deployed for `appId`.
+ *
+ * One observation per resolved ingress IP, in endpoint order. A cluster that
+ * cannot be reached or authenticated yields `reachable: false` with `error` set
+ * — never a throw at the per-cluster level, so {@link assertClustersConverged}
+ * can weigh WHICH clusters gave evidence against how many were expected.
+ *
+ * #2887: a DNS failure is NOT one of those soft outcomes. It used to log
+ * `skipping the check` and return `[]`, and an empty observation list then fell
+ * straight through the old `observations.length <= 1` short-circuit in
+ * `assertClustersConverged` — so "I could not find the clusters" was reported
+ * as "the clusters agree". Not being able to enumerate the mesh is a total
+ * evidence gap; it throws, and {@link waitForClusterConvergence} gives it the
+ * same retry budget as any other transient fault before failing loudly.
+ */
+async function probeClusterRuntimes(opts) {
+    const host = (0, registry_fanout_1.registryHostOf)(opts.gateway);
+    const transport = opts.transport ?? (0, registry_fanout_1.defaultTransport)(host);
+    const timeoutMs = opts.timeoutMs ?? registry_fanout_1.DEFAULT_PROBE_TIMEOUT_MS;
+    const endpoints = opts.endpoints ?? (await (0, registry_fanout_1.resolveClusterEndpoints)(host, opts.resolve4));
+    return Promise.all(endpoints.map((ip) => probeOne(ip, { ...opts, transport, timeoutMs })));
+}
+async function probeOne(ip, opts) {
+    const send = (req) => (0, registry_fanout_1.withRequestTimeout)(opts.transport(req), opts.timeoutMs, `${req.method} ${req.path} on ${ip}`);
+    // 1. Who is this? Best-effort — a cluster that won't name itself is still
+    //    worth probing, it just gets reported by IP.
+    let clusterId = null;
+    try {
+        const health = await send({ ip, method: 'GET', path: '/api/v3/cluster/health' });
+        if (health.status === 200) {
+            const body = parseJson(health);
+            const id = body?.clusterId;
+            if (typeof id === 'string' && id)
+                clusterId = id;
+        }
+    }
+    catch {
+        // fall through — the status read below decides reachability
+    }
+    // 2. This cluster's OWN session. Sessions are per-cluster: a bearer minted on
+    //    a peer 401s here, which is exactly why the round-robin client cannot be
+    //    reused for a per-cluster read.
+    //    Cached across the retry polls of `waitForClusterConvergence`.
+    let token = opts.tokenCache?.get(ip);
+    // Only a REUSED bearer can have outlived its session; one minted a moment ago
+    // 401ing means something else is wrong and re-minting would just repeat it.
+    const tokenWasReused = token !== undefined;
+    if (!token) {
+        try {
+            token = await authenticateAgainst(ip, send, opts);
+            opts.tokenCache?.set(ip, token);
+        }
+        catch (err) {
+            return { ip, clusterId, reachable: false, error: `auth: ${err.message}` };
+        }
+    }
+    // 3. What does THIS cluster have deployed?
+    const statusPath = `${HOST_PATH_PREFIX}/api/v3/baas/deployment/apps/${encodeURIComponent(opts.appId)}/status`;
+    const readStatus = (bearer) => send({
+        ip,
+        method: 'GET',
+        path: statusPath,
+        headers: { Authorization: `Bearer ${bearer}`, Accept: 'application/json' },
+    });
+    try {
+        let res = await readStatus(token);
+        // A cached bearer can outlive its session. Re-mint once rather than let the
+        // 401 degrade into "unreachable" — an unreachable cluster is EXCLUDED from
+        // the divergence check, so a silently-expired token would weaken the gate.
+        if (res.status === 401 && tokenWasReused && opts.tokenCache) {
+            opts.tokenCache.delete(ip);
+            token = await authenticateAgainst(ip, send, opts);
+            opts.tokenCache.set(ip, token);
+            res = await readStatus(token);
+        }
+        if (res.status === 404) {
+            return { ip, clusterId, reachable: true, error: 'no runtime record on this cluster' };
+        }
+        if (res.status !== 200) {
+            return { ip, clusterId, reachable: false, error: `status read HTTP ${res.status}` };
+        }
+        const body = parseJson(res);
+        if (!body)
+            return { ip, clusterId, reachable: false, error: 'status read: malformed JSON' };
+        const obs = { ip, clusterId, reachable: true };
+        if (body.state !== undefined)
+            obs.state = body.state;
+        if (body.runtime?.image !== undefined)
+            obs.image = body.runtime.image;
+        if (body.runtime?.runtimeState !== undefined)
+            obs.runtimeState = body.runtime.runtimeState;
+        if (body.runtime?.lastError)
+            obs.lastError = body.runtime.lastError;
+        return obs;
+    }
+    catch (err) {
+        return { ip, clusterId, reachable: false, error: err.message };
+    }
+}
+/** Run the web3 challenge/verify handshake against ONE cluster; returns its bearer. */
+async function authenticateAgainst(ip, send, opts) {
+    const challengeRes = await send({
+        ip,
+        method: 'POST',
+        path: `${HOST_PATH_PREFIX}/api/v3/baas/auth/challenge`,
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: Buffer.from(JSON.stringify({
+            chain: opts.signer.chain,
+            walletAddress: opts.signer.walletAddress,
+            appId: opts.authAppId,
+        })),
+    });
+    const challenge = parseJson(challengeRes);
+    if (challengeRes.status >= 400 || !challenge?.challengeId || !challenge.message) {
+        throw new Error(`challenge HTTP ${challengeRes.status}`);
+    }
+    const signature = await opts.signer.signFn(challenge.message);
+    const verifyRes = await send({
+        ip,
+        method: 'POST',
+        path: `${HOST_PATH_PREFIX}/api/v3/baas/auth/verify`,
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: Buffer.from(JSON.stringify({
+            challengeId: challenge.challengeId,
+            signature,
+            publicKey: opts.signer.publicKey,
+        })),
+    });
+    const verified = parseJson(verifyRes);
+    if (verifyRes.status >= 400 || !verified?.token) {
+        throw new Error(`verify HTTP ${verifyRes.status}`);
+    }
+    return verified.token;
+}
+/**
+ * Throw unless EVERY cluster the gateway advertises answered, and every answer
+ * is the image this run deployed.
+ *
+ * Divergence is: a cluster pinned to a different image, a cluster whose runtime
+ * is `FAILED`, or a cluster with no runtime record at all. The error names each
+ * diverged cluster, what it is stuck on, and the digest this run attested — so
+ * the operator sees both sides of the mismatch instead of `✓ deployed`.
+ *
+ * ## Full evidence is required (#2887)
+ *
+ * This gate previously excluded unreachable clusters from the comparison and
+ * passed on whatever was left, short-circuiting entirely at
+ * `observations.length <= 1`. Both rules turned MISSING evidence into a pass:
+ * one matching answer out of three clusters read as "converged", and an empty
+ * probe (the gateway failing to resolve) read as "converged" too. Measured on
+ * testnet 2026-08-27: a deploy printed `✓ deployed` while `kubectl` showed sn1
+ * on `app:v33` and sn2 + sn3 still on `app:v32`.
+ *
+ * "I could not reach 2 of 3 clusters" and "all 3 clusters agree" are different
+ * sentences and only one of them is a pass. Transient faults are absorbed by
+ * the retry budget in {@link waitForClusterConvergence}, not by lowering the
+ * bar here; a mesh that is knowingly unreachable from the developer's network
+ * has `--skip-cluster-check`, which at least says so out loud.
+ *
+ * The one genuine no-op left: `expectedClusters <= 1`. A single-cluster / dev
+ * gateway has nothing to diverge from — the same rule the image fan-out
+ * applies at `endpoints.length <= 1`.
+ *
+ * ## What this can and cannot see
+ *
+ * `observation.image` is the per-cluster runtime RECORD (`runtime.image`,
+ * written by the host's `attachRuntime` call and read back through
+ * `GET …/deployment/apps/:appId/status`). It is a desired-state tag ref, not
+ * the digest of the container actually running: nothing on that read path
+ * surfaces the `@sha256:` the deployer pins at apply time. So this gate catches
+ * a cluster on the WRONG TAG or a `FAILED` reconcile, and cannot catch a
+ * cluster serving a different artifact under the same tag. Closing that needs
+ * the deployer's resolved digest surfaced in the runtime projection
+ * (smart-deployer → validator `runtime/status` → smart-host → SDK) — tracked
+ * separately; do not paper over it here with a comparison that has no digest
+ * to compare.
+ */
+function assertClustersConverged(args) {
+    if (args.expectedClusters <= 1)
+        return;
+    const reachable = args.observations.filter((o) => o.reachable);
+    // MISSING evidence is not evidence of convergence. Anything short of one
+    // answer per advertised cluster leaves clusters we know nothing about, and
+    // passing on the remainder is exactly the silent success this gate exists to
+    // remove.
+    if (reachable.length < args.expectedClusters) {
+        const silent = args.observations.filter((o) => !o.reachable);
+        const missing = args.expectedClusters - args.observations.length;
+        // `detail` is never empty here: entering this branch means
+        // `reachable.length < expectedClusters`, so either some observation is
+        // unreachable (→ a `silent` entry) or there are fewer observations than
+        // expected (→ `missing > 0`). No `|| 'no detail'` fallback, which would be
+        // a branch that cannot fire — the exact shape this PR removes elsewhere.
+        const detail = [
+            ...silent.map((o) => `${safe(o.clusterId) ?? o.ip}=${safe(o.error) ?? 'no answer'}`),
+            ...(missing > 0 ? [`${missing} endpoint(s) never probed`] : []),
+        ];
+        throw new Error(`cluster convergence UNVERIFIED for ${args.appId}: only ${reachable.length} of ` +
+            `${args.expectedClusters} clusters answered the per-cluster status probe (` +
+            detail.join(', ') +
+            `). A cluster that gives no answer is one this deploy cannot vouch for — it may be ` +
+            `serving an older release while the load balancer keeps routing to it. Refusing to ` +
+            `report success without full evidence — re-run, or pass --skip-cluster-check if the ` +
+            `mesh is knowingly unreachable from here (#2787/#2887).`);
+    }
+    const diverged = reachable.filter((o) => o.image !== args.expectedImage || o.runtimeState === 'FAILED');
+    if (diverged.length === 0)
+        return;
+    const detail = diverged
+        .map((o) => {
+        const who = o.clusterId ? `${safe(o.clusterId)} (${o.ip})` : o.ip;
+        const bits = [
+            `image=${safe(o.image) ?? '<none>'}`,
+            `runtimeState=${safe(o.runtimeState) ?? '<none>'}`,
+        ];
+        if (o.error)
+            bits.push(`probe=${safe(o.error)}`);
+        if (o.lastError)
+            bits.push(`lastError=${safe(o.lastError)}`);
+        return `    - ${who}: ${bits.join(' ')}`;
+    })
+        .join('\n');
+    throw new Error(`cluster divergence after deploying ${args.appId}: ${diverged.length} of ` +
+        `${reachable.length} reachable clusters did not converge on ${args.expectedImage} ` +
+        `(attested digest ${args.attestedDigest}).\n${detail}\n` +
+        '  A cluster that keeps an older runtime record serves the OLD release (or nothing) ' +
+        'while the load balancer keeps routing to it, and it does not self-heal: the clusters ' +
+        'hold independent records and a deploy call reaches only the one the gateway picked. ' +
+        'Re-run the redeploy until this check passes — each run is another draw, and a run ' +
+        'that lands on the stuck cluster overwrites its record (a `build-attestation digest ' +
+        'MISMATCH` above is a STALE attestation on that cluster, not a bad image) (#2787).');
+}
+/**
+ * Probe every cluster until they all run the deployed image, or the budget is
+ * exhausted — then throw ({@link assertClustersConverged}).
+ *
+ * The retry budget exists because peer replication is asynchronous: a cluster
+ * that simply hasn't caught up yet must not fail a healthy deploy. A cluster
+ * that is genuinely STUCK (a stale build-attestation, a crash-looping image)
+ * does not converge within any budget, which is the case this gate is for.
+ *
+ * #2887: the budget now covers the EVIDENCE-gathering failures too — a gateway
+ * that won't resolve, or clusters that won't answer. Those used to be reported
+ * as a pass; they are retried like any other transient fault and then fail
+ * loudly, because a check with no evidence has no verdict to give.
+ *
+ * The gateway is resolved ONCE and the answer threaded through every poll, so
+ * the expected cluster count is fixed for the whole wait. Re-resolving each
+ * poll would let a short round-robin answer shrink the expectation to match the
+ * clusters that happened to reply — the exact vacuity being removed.
+ */
+async function waitForClusterConvergence(opts) {
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const interval = opts.intervalMs ?? 5000;
+    const maxPolls = opts.maxPolls ?? 6;
+    const log = opts.log ?? (() => undefined);
+    const host = (0, registry_fanout_1.registryHostOf)(opts.gateway);
+    const tokenCache = opts.tokenCache ?? new Map();
+    let endpoints = opts.endpoints ?? null;
+    for (let poll = 0;; poll++) {
+        const last = poll >= maxPolls - 1;
+        try {
+            if (!endpoints) {
+                const resolved = await (0, registry_fanout_1.resolveClusterEndpoints)(host, opts.resolve4);
+                // An EMPTY answer is a total evidence gap, not a single-cluster mesh.
+                // `expectedClusters: 0` would slip past the `<= 1` no-op below and turn
+                // the whole gate off — the one input that must not do that. Real
+                // `dns.resolve4` throws ENODATA rather than returning `[]`, but the
+                // resolver is an injectable seam and this is the gate's own off-switch.
+                if (resolved.length === 0) {
+                    throw new Error(`cluster convergence UNVERIFIED for ${opts.appId}: ${host} returned no cluster ` +
+                        'endpoints to probe, so there is no evidence any cluster runs ' +
+                        `${opts.expectedImage}. Refusing to report success — re-run, or pass ` +
+                        '--skip-cluster-check if the mesh is knowingly unreachable from here (#2887).');
+                }
+                endpoints = resolved;
+            }
+            const observations = await probeClusterRuntimes({ ...opts, endpoints, tokenCache });
+            assertClustersConverged({
+                appId: opts.appId,
+                expectedImage: opts.expectedImage,
+                attestedDigest: opts.attestedDigest,
+                expectedClusters: endpoints.length,
+                observations,
+            });
+            return observations;
+        }
+        catch (err) {
+            if (last)
+                throw err;
+            // Name the actual reason: "not converged yet" and "could not gather the
+            // evidence" are different problems and the retry log used to claim the
+            // first for both. Through `safe()` — the reason can carry a cluster's own
+            // `error` text, and this line prints to the operator's terminal on every
+            // poll (same display-safety rule as the assertion messages below).
+            const reason = safe(err?.message?.split('\n')[0] ?? String(err));
+            log(`  converge: ${opts.expectedImage} not confirmed on every cluster yet ` +
+                `(attempt ${poll + 1}/${maxPolls}: ${reason ?? 'unknown'}); re-checking in ${interval}ms`);
+            await sleep(interval);
+        }
+    }
+}
+/**
+ * Make a server-controlled string safe to print. `clusterId`, `image`,
+ * `runtimeState` and `lastError` all come verbatim from a cluster's JSON, and
+ * these error messages go straight to the operator's terminal via
+ * `console.error(chalk.red(...))` — so a compromised cluster would otherwise
+ * inject ANSI/control sequences into the console on every run against it.
+ * Strips C0/C1 control characters and bounds the length.
+ */
+function safe(v) {
+    if (v === undefined || v === null)
+        return undefined;
+    // eslint-disable-next-line no-control-regex
+    const stripped = v.replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').trim();
+    return stripped.length > 400 ? `${stripped.slice(0, 400)}…` : stripped;
+}
+/** Parse a JSON response body; `null` when it isn't JSON. */
+function parseJson(res) {
+    try {
+        return JSON.parse(res.body.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=cluster-convergence.js.map

package/dist/_lib/cluster-convergence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-convergence.js","sourceRoot":"","sources":["../../src/_lib/cluster-convergence.ts"],"names":[],"mappings":";;AAuIA,oDAYC;AA2LD,0DA0DC;AAkCD,8DAuDC;AAjeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,uDAS2B;AAE3B,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,OAAO,CAAC;AA8DjC;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,IAAI,GAAG,IAAA,gCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,kCAAgB,EAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,0CAAwB,CAAC;IAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAA,yCAAuB,EAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEzF,OAAO,OAAO,CAAC,GAAG,CAChB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,EAAU,EACV,IAAoF;IAEpF,MAAM,IAAI,GAAG,CAAC,GAAoB,EAA6B,EAAE,CAC/D,IAAA,oCAAkB,EAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;IAEhG,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAI,IAAuC,EAAE,SAAS,CAAC;YAC/D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE;gBAAE,SAAS,GAAG,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,oCAAoC;IACpC,mEAAmE;IACnE,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAU,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,UAAU,GAAG,GAAG,gBAAgB,gCAAgC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9G,MAAM,UAAU,GAAG,CAAC,MAAc,EAA6B,EAAE,CAC/D,IAAI,CAAC;QACH,EAAE;QACF,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAC3E,CAAC,CAAC;IACL,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC/B,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAGlB,CAAC;QACT,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAC5F,MAAM,GAAG,GAA8B,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3F,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,mBAAmB,CAChC,EAAU,EACV,IAAyD,EACzD,IAA8B;IAE9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC;QAC9B,EAAE;QACF,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,gBAAgB,6BAA6B;QACtD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,MAAM,CAAC,IAAI,CACf,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,KAAK,EAAE,IAAI,CAAC,SAAS;SACtB,CAAC,CACH;KACF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAsD,CAAC;IAC/F,IAAI,YAAY,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC;QAC3B,EAAE;QACF,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,gBAAgB,0BAA0B;QACnD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,MAAM,CAAC,IAAI,CACf,IAAI,CAAC,SAAS,CAAC;YACb,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;SACjC,CAAC,CACH;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAA8B,CAAC;IACnE,IAAI,SAAS,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,SAAgB,uBAAuB,CAAC,IAAyB;IAC/D,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC;QAAE,OAAO;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,UAAU;IACV,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QACjE,2DAA2D;QAC3D,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,MAAM,GAAG;YACb,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;YACpF,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,KAAK,UAAU,SAAS,CAAC,MAAM,MAAM;YAC9E,GAAG,IAAI,CAAC,gBAAgB,mDAAmD;YAC3E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACjB,oFAAoF;YACpF,oFAAoF;YACpF,qFAAqF;YACrF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,KAAK,QAAQ,CACrE,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,MAAM,GAAG,QAAQ;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG;YACX,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,EAAE;YACpC,gBAAgB,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,QAAQ,EAAE;SACnD,CAAC;QACF,IAAI,CAAC,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO,SAAS,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,MAAM;QACxE,GAAG,SAAS,CAAC,MAAM,2CAA2C,IAAI,CAAC,aAAa,GAAG;QACnF,oBAAoB,IAAI,CAAC,cAAc,OAAO,MAAM,IAAI;QACxD,qFAAqF;QACrF,uFAAuF;QACvF,sFAAsF;QACtF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF,CACtF,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;;;GAkBG;AACI,KAAK,UAAU,yBAAyB,CAC7C,IAAmC;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAA,gCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,GAAG,EAAkB,CAAC;IAChE,IAAI,SAAS,GAAoB,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACxD,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAuB,EAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpE,sEAAsE;gBACtE,wEAAwE;gBACxE,iEAAiE;gBACjE,oEAAoE;gBACpE,wEAAwE;gBACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,KAAK,KAAK,IAAI,uBAAuB;wBAC9E,+DAA+D;wBAC/D,GAAG,IAAI,CAAC,aAAa,iDAAiD;wBACtE,8EAA8E,CACjF,CAAC;gBACJ,CAAC;gBACD,SAAS,GAAG,QAAQ,CAAC;YACvB,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACpF,uBAAuB,CAAC;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,gBAAgB,EAAE,SAAS,CAAC,MAAM;gBAClC,YAAY;aACb,CAAC,CAAC;YACH,OAAO,YAAY,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI;gBAAE,MAAM,GAAG,CAAC;YACpB,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,MAAM,GAAG,IAAI,CAAE,GAAa,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5E,GAAG,CACD,eAAe,IAAI,CAAC,aAAa,sCAAsC;gBACrE,YAAY,IAAI,GAAG,CAAC,IAAI,QAAQ,KAAK,MAAM,IAAI,SAAS,qBAAqB,QAAQ,IAAI,CAC5F,CAAC;YACF,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,CAA4B;IACxC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC;AAED,6DAA6D;AAC7D,SAAS,SAAS,CAAC,GAAqB;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/_lib/deploy-manifest.d.ts

@@ -1,4 +1,19 @@
 type BaasService = 'auth' | 'database' | 'storage' | 'functions' | 'messaging';
+/**
+ * One external destination the smart-app declares it needs to reach (#2912).
+ *
+ * Tenant egress is default-deny: a pod that declares nothing can reach DNS and
+ * the platform BaaS endpoint, and nothing else. Declaring a destination is a
+ * REQUEST, not a grant — the cluster operator's destination allow-list decides
+ * whether it is honored, and a destination outside that list is dropped at
+ * reconcile time (visible in the tenant NetworkPolicy's annotations).
+ */
+export type ManifestEgress = {
+    /** Bare lowercase DNS hostname — no scheme, port, path or wildcard. */
+    host: string;
+    /** TCP port on `host`. Defaults to 443. */
+    port?: number;
+};
 /** Backend build + push + deploy inputs. REQUIRED — every smart-app has one. */
 export type ManifestBackend = {
     /** Backend listen port inside the customer container (1..65535, never 8080). */
@@ -26,6 +41,13 @@ export type ManifestBackend = {
         cpu?: string;
         memory?: string;
     };
+    /**
+     * External hosts this app needs to reach (#2912). Optional; omitting it
+     * leaves whatever the app previously declared in place, so a redeploy from
+     * a manifest that predates this field never revokes working egress. To
+     * revoke, declare an explicit empty array.
+     */
+    egress?: ManifestEgress[];
 };
 /**
  * Frontend tar + upload inputs. OPTIONAL — present iff the smart-app ships a
@@ -65,5 +87,15 @@ export type Manifest = {
 export declare function parseManifest(path: string): Manifest;
 /** Validate an already-parsed manifest object. Shared by file + programmatic callers. */
 export declare function validateManifest(raw: unknown): Manifest;
+/**
+ * Resolve `manifest.backend.egress[]` into the wire shape the deploy API takes
+ * — every entry's port made explicit. Returns `undefined` when the manifest
+ * declares nothing, which the server reads as "leave the stored declaration
+ * alone" (as opposed to `[]`, which clears it).
+ */
+export declare function resolveEgress(manifest: Manifest): Array<{
+    host: string;
+    port: number;
+}> | undefined;
 export {};
 //# sourceMappingURL=deploy-manifest.d.ts.map

package/dist/_lib/deploy-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/_lib/deploy-manifest.ts"],"names":[],"mappings":"AAmBA,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAK/E,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAYpD;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA4CvD"}
+{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/_lib/deploy-manifest.ts"],"names":[],"mappings":"AAmBA,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAyB/E;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAYpD;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA8CvD;AA+CD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,QAAQ,GACjB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAInD"}

package/dist/_lib/deploy-manifest.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseManifest = parseManifest;
 exports.validateManifest = validateManifest;
+exports.resolveEgress = resolveEgress;
 /**
  * Shared smart-app deploy manifest schema + loader.
  *
@@ -22,6 +23,22 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 /** Lowest decentralization degree the host accepts (genesis cluster floor). */
 const MIN_DEGREE = 3;
+/**
+ * Default TCP port for a declared egress destination when the manifest entry
+ * omits one. HTTPS is what a smart-app dials in practice; anything else has to
+ * be stated.
+ */
+const DEFAULT_EGRESS_PORT = 443;
+/**
+ * Mirror of `DeployAppDto`'s hostname rule (smart-host,
+ * `apps/smart-host/src/deployment/dto/deploy-app.dto.ts`) — SSoT lives there;
+ * this copy exists so a typo fails at `hsuite deploy` with a message naming
+ * the manifest field, not as an opaque server 400 halfway through a build.
+ * Keep the two in step, exactly as `MIN_DEGREE` mirrors the DTO's degree floor.
+ */
+const EGRESS_HOST_REGEX = /^(?=.{1,253}$)(?!\d+\.\d+\.\d+\.\d+$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/** Largest tier's destination cap — the DTO's schema-level ceiling. */
+const MAX_EGRESS_ENTRIES = 50;
 /**
  * Parse + validate a deploy manifest from a JSON file.
  *
@@ -82,6 +99,60 @@ function validateManifest(raw) {
     if (frontend && !frontend.dir && !frontend.bundlePath) {
         throw new Error('manifest.frontend requires `dir` or `bundlePath`');
     }
+    validateEgress(backend.egress);
     return raw;
 }
+/**
+ * Validate `manifest.backend.egress[]` (#2912).
+ *
+ * Fails on the shapes a developer actually types — a URL, a `host:port`
+ * string, a wildcard, an IP literal — with a message that names the entry, so
+ * the mistake surfaces before the docker build rather than as a server 400
+ * after it. `undefined` is valid and means "don't touch the declaration".
+ */
+function validateEgress(value) {
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value)) {
+        throw new Error('manifest.backend.egress must be an array when present');
+    }
+    if (value.length > MAX_EGRESS_ENTRIES) {
+        throw new Error(`manifest.backend.egress has ${value.length} entries; at most ${MAX_EGRESS_ENTRIES} ` +
+            `are accepted (your subscription tier may allow fewer)`);
+    }
+    const seen = new Set();
+    for (const [i, entry] of value.entries()) {
+        const at = `manifest.backend.egress[${i}]`;
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            throw new Error(`${at} must be an object like { "host": "api.example.com", "port": 443 }`);
+        }
+        const { host, port } = entry;
+        if (typeof host !== 'string' || !EGRESS_HOST_REGEX.test(host)) {
+            throw new Error(`${at}.host must be a bare lowercase DNS hostname (e.g. "api.example.com") — ` +
+                `no scheme, port, path or wildcard; got ${JSON.stringify(host)}`);
+        }
+        if (port !== undefined) {
+            if (typeof port !== 'number' || !Number.isInteger(port) || port < 1 || port > 65535) {
+                throw new Error(`${at}.port must be an integer 1-65535; got ${JSON.stringify(port)}`);
+            }
+        }
+        const key = `${host}:${port ?? DEFAULT_EGRESS_PORT}`;
+        if (seen.has(key)) {
+            throw new Error(`${at} duplicates an earlier destination (${key})`);
+        }
+        seen.add(key);
+    }
+}
+/**
+ * Resolve `manifest.backend.egress[]` into the wire shape the deploy API takes
+ * — every entry's port made explicit. Returns `undefined` when the manifest
+ * declares nothing, which the server reads as "leave the stored declaration
+ * alone" (as opposed to `[]`, which clears it).
+ */
+function resolveEgress(manifest) {
+    const declared = manifest.backend.egress;
+    if (declared === undefined)
+        return undefined;
+    return declared.map((e) => ({ host: e.host, port: e.port ?? DEFAULT_EGRESS_PORT }));
+}
 //# sourceMappingURL=deploy-manifest.js.map

package/dist/_lib/deploy-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-manifest.js","sourceRoot":"","sources":["../../src/_lib/deploy-manifest.ts"],"names":[],"mappings":";;AAuFA,sCAYC;AAGD,4CA4CC;AAlJD;;;;;;;;;;;;;;;GAeG;AACH,2BAA8C;AAC9C,+BAA+B;AAI/B,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,CAAC;AA0DrB;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,CAAC,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,0BAA0B,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAA+C,CAAC;IAEnE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,GAAe,CAAC;AACzB,CAAC"}
+{"version":3,"file":"deploy-manifest.js","sourceRoot":"","sources":["../../src/_lib/deploy-manifest.ts"],"names":[],"mappings":";;AAkIA,sCAYC;AAGD,4CA8CC;AAqDD,sCAMC;AA1PD;;;;;;;;;;;;;;;GAeG;AACH,2BAA8C;AAC9C,+BAA+B;AAI/B,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,uHAAuH,CAAC;AAE1H,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAiF9B;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,CAAC,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,0BAA0B,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAA+C,CAAC;IAEnE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B,OAAO,GAAe,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,qBAAqB,kBAAkB,GAAG;YACnF,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,2BAA2B,CAAC,GAAG,CAAC;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,oEAAoE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAA2C,CAAC;QACnE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,yEAAyE;gBAC5E,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,yCAAyC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,uCAAuC,GAAG,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,QAAkB;IAElB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC"}

package/dist/_lib/docker.d.ts

@@ -46,37 +46,49 @@ export declare function dockerLogin(registry: RegistryCreds, spawnFn?: typeof sp
  */
 export declare function parsePushDigest(output: string): string | null;
 /**
- * Pick the `sha256:<64hex>` digest for `<server>/<repository>` out of a parsed
- * `docker inspect ... .RepoDigests` array. Pure — shared by both the
- * `spawn`-based {@link inspectImageDigest} and the `execFileSync`-based
- * `buildAndPush` inspect-fallback in `_lib/baas.ts`, so the matching rule lives
- * in exactly one place.
+ * Parse the top-level manifest digest from `docker buildx imagetools inspect
+ * <ref>` output. `imagetools inspect` queries the REGISTRY (not the local
+ * daemon cache), so this is the authoritative `sha256:<64hex>` the registry
+ * serves for the tag — the value the attestation must bind.
  *
- * `stdout` is the raw `{{json .RepoDigests}}` output (a JSON string array).
- * Returns the lower-cased `sha256:<64hex>` of the first entry whose ref matches
- * `<server>/<repository>@`, or `null` if the JSON is unparseable / no entry
- * matches.
+ * The default (non-`--raw`) report prints a top-level block:
+ *   `Name:      <ref>`
+ *   `MediaType: application/vnd.docker.distribution.manifest.v2+json`
+ *   `Digest:    sha256:<64hex>`
+ * We match the FIRST `Digest:` line — the top-level manifest digest. (Per-arch
+ * child digests appear only under a later `Manifests:` block for a multi-arch
+ * index, which the single-arch amd64 deploy flow never produces.)
+ *
+ * @returns the lower-cased `sha256:<64hex>` digest, or `null` if absent.
  */
-export declare function parseRepoDigests(stdout: string, registry: RegistryCreds): string | null;
+export declare function parseImagetoolsDigest(output: string): string | null;
 /**
- * `docker inspect` fallback to recover a pushed image's registry digest from
- * its `RepoDigests` when the push output didn't surface one (older docker,
- * buildx drivers, or an externally-run push we're inspecting after the fact).
+ * Resolve the digest the REGISTRY currently serves for `<server>/<repository>:
+ * <tag>` via `docker buildx imagetools inspect`. Authoritative: it hits the
+ * registry, so — unlike a local `docker inspect ... .RepoDigests` read — a
+ * prior push of the same tag or a round-robin retry can never leave a STALE
+ * value here (#1679).
  *
- * Returns the `sha256:<64hex>` portion of the matching `RepoDigests` entry, or
- * `null` if none matches `<server>/<repository>`.
+ * @returns the `sha256:<64hex>` registry digest, or `null` if it could not be
+ *   resolved (imagetools unavailable / registry unreachable / no digest line).
  */
-export declare function inspectImageDigest(registry: RegistryCreds, tag: string, spawnFn?: typeof spawn): Promise<string | null>;
+export declare function inspectRegistryDigest(registry: RegistryCreds, tag: string, spawnFn?: typeof spawn): Promise<string | null>;
 /**
- * Push the backend image and RECORD its registry manifest digest.
+ * Push the backend image and RECORD the digest the registry serves for it.
  *
- * Runs `docker push <server>/<repository>:<tag>`, parses the digest from the
- * push summary, and falls back to {@link inspectImageDigest} if the summary
- * didn't carry one. Throws if the push fails OR if no digest can be recovered
- * (a deploy must never proceed with an unverifiable artifact reference).
+ * Runs `docker push <server>/<repository>:<tag>`, then resolves the pushed
+ * tag's digest from the REGISTRY via {@link inspectRegistryDigest} (NOT the
+ * local daemon cache). The `digest: sha256:...` line from the push summary,
+ * when present, is cross-checked against the registry digest and a MISMATCH is
+ * a hard error — that is the #1679 failure mode (a DNS-round-robin split /
+ * same-tag re-push surfacing a stale local digest that disagrees with what
+ * Harbor actually stored). Throws if the push fails, if the registry digest
+ * can't be resolved, or on a push/registry mismatch — a deploy must never
+ * proceed with an unverifiable or stale artifact reference.
  *
- * @returns the `sha256:<64hex>` manifest digest of the pushed tag.
- * @throws if push exits non-zero, or if no manifest digest can be determined.
+ * @returns the `sha256:<64hex>` registry manifest digest of the pushed tag.
+ * @throws if push exits non-zero, the registry digest is unresolvable, or the
+ *   push-summary digest disagrees with the registry.
  */
 export declare function dockerPush(registry: RegistryCreds, tag: string, spawnFn?: typeof spawn): Promise<string>;
 //# sourceMappingURL=docker.d.ts.map