@hsuite/smart-engines-cli 1.6.0 → 1.8.0

package/dist/_lib/image-hygiene.js

@@ -0,0 +1,233 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImageHygieneError = exports.IMAGE_HYGIENE_FORBIDDEN_SUFFIXES = exports.IMAGE_HYGIENE_SCAN_DIRS = void 0;
+exports.listTarEntries = listTarEntries;
+exports.findImageHygieneViolations = findImageHygieneViolations;
+exports.assertImageHygiene = assertImageHygiene;
+/**
+ * `hsuite deploy` image-hygiene gate — HSUITEPT-5 (#3245).
+ *
+ * The pentest pulled a customer image whose compiled output shipped 98
+ * `.js.map`, 49 `.d.ts` and JSDoc-preserved `.js` files: the backend read like
+ * source, handing an attacker every guard condition and fallback path before
+ * touching the live app. The registry side (tenant Harbor projects served to
+ * anonymous pullers) is closed in the provisioner; this closes the image side
+ * at the one choke point the platform owns for a customer build — the CLI,
+ * right after `docker build` and BEFORE anything is tagged, logged in, or
+ * pushed. App-side tsconfig/Dockerfile hygiene is never relied on.
+ *
+ * Mechanism (no shell inside the image — a distroless runtime has none):
+ *   docker inspect -f '{{.Config.WorkingDir}}' <image>   → where the app lives
+ *   docker create <image>                               → throwaway container
+ *   docker cp <id>:<workdir>/<dir> -                    → tar of each compiled
+ *                                                          output dir (dist/…)
+ *   docker rm -f <id>                                   → always, even on throw
+ * The tar is parsed for ENTRY NAMES only; contents are never inspected. Only
+ * the conventional compiled-output dirs are scanned, so `node_modules/` (whose
+ * published packages legitimately ship `.d.ts` / `.map`) is never a false hit.
+ *
+ * Fail closed: any offending entry aborts the deploy with the full list and
+ * the fix. An absent output dir is "nothing to scan" (a warning when none of
+ * the conventional dirs exists at all — the gate could not see the app code).
+ * A `docker cp` that fails for any OTHER reason is also fatal — only docker's
+ * own not-found signature means "absent"; anything else is a scan that did not
+ * happen, and the gate must never report one it did not perform.
+ */
+const path_1 = require("path");
+/** Compiled-output directories a smart-app image conventionally ships under its `WorkingDir`. */
+exports.IMAGE_HYGIENE_SCAN_DIRS = ['dist', 'build', 'lib'];
+/** Entry suffixes that must never ship in a customer image. */
+exports.IMAGE_HYGIENE_FORBIDDEN_SUFFIXES = ['.map', '.d.ts', '.tsbuildinfo'];
+/** `docker cp` of a compiled dist/ is a few MB; the default 1 MiB `execFileSync` buffer is not enough. */
+const TAR_MAX_BUFFER_BYTES = 256 * 1024 * 1024;
+/**
+ * Docker's "this path is not in the image" signature — the ONE `docker cp`
+ * failure that legitimately means "nothing to scan". Matched against the
+ * child's stderr, which docker populates for this wording.
+ *
+ * Deliberately NOT also matching a bare `no such file or directory`: that is
+ * the daemon's OS-level errno text, which appears when the READ failed (a
+ * pruned or corrupt overlay2 graph) rather than when the path is absent. The
+ * two must not collapse — a real not-found read as fatal only aborts a deploy
+ * the operator can re-run, while a broken read taken as "absent" silently
+ * disables the gate.
+ */
+const DOCKER_CP_MISSING_RE = /could not find the file/i;
+const TAR_BLOCK = 512;
+/** Thrown when the built image ships source maps / declarations. `violations` lists every entry. */
+class ImageHygieneError extends Error {
+    image;
+    violations;
+    constructor(image, violations) {
+        super(`Image hygiene gate (HSUITEPT-5): ${image} ships ${violations.length} file(s) that expose ` +
+            `the app's source and must not be deployed:\n` +
+            violations.map((v) => `  - ${v}`).join('\n') +
+            `\nBuild the backend with sourceMap/declaration OFF and removeComments ON (a production ` +
+            `tsconfig), or exclude them from the image (.dockerignore), then re-run \`hsuite deploy\`.`);
+        this.image = image;
+        this.violations = violations;
+        this.name = 'ImageHygieneError';
+    }
+}
+exports.ImageHygieneError = ImageHygieneError;
+/**
+ * Entry names of a (ustar / PAX / GNU) tar archive. Contents are skipped by
+ * size; only names are returned. Tolerant: stops at the first zero block or a
+ * truncated header, so a non-archive buffer yields `[]`.
+ */
+function listTarEntries(tar) {
+    const names = [];
+    let pendingLongName = null;
+    for (let off = 0; off + TAR_BLOCK <= tar.length;) {
+        const header = tar.subarray(off, off + TAR_BLOCK);
+        if (header.every((b) => b === 0))
+            break;
+        const size = parseInt(cstr(header, 124, 12) || '0', 8) || 0;
+        const type = String.fromCharCode(header[156] || 0x30);
+        const data = tar.subarray(off + TAR_BLOCK, off + TAR_BLOCK + size);
+        off += TAR_BLOCK + Math.ceil(size / TAR_BLOCK) * TAR_BLOCK;
+        if (type === 'L') {
+            pendingLongName = cstr(data, 0, data.length); // GNU long name
+            continue;
+        }
+        if (type === 'x') {
+            pendingLongName = paxPath(data.toString('utf8')) ?? pendingLongName; // PAX extended header
+            continue;
+        }
+        if (type === 'g')
+            continue; // PAX global header
+        const prefix = cstr(header, 345, 155);
+        const name = cstr(header, 0, 100);
+        names.push(pendingLongName ?? (prefix ? `${prefix}/${name}` : name));
+        pendingLongName = null;
+    }
+    return names;
+}
+/** Entries that must never ship in a customer image. */
+function findImageHygieneViolations(entries) {
+    return entries.filter((e) => exports.IMAGE_HYGIENE_FORBIDDEN_SUFFIXES.some((s) => e.endsWith(s)));
+}
+/**
+ * Scan the built image's compiled output and THROW {@link ImageHygieneError}
+ * if it ships source maps, declaration files or tsbuildinfo. See the module
+ * header for the mechanism and the fail-closed contract.
+ */
+function assertImageHygiene(opts) {
+    const { image, run, env } = opts;
+    const log = opts.log ?? (() => undefined);
+    const utf8 = { stdio: ['ignore', 'pipe', 'inherit'], encoding: 'utf8', env };
+    const workdir = asText(run('docker', ['inspect', '-f', '{{.Config.WorkingDir}}', image], utf8)) || '/';
+    const cid = asText(run('docker', ['create', image], utf8));
+    if (!cid)
+        throw new Error(`image hygiene gate: \`docker create ${image}\` returned no container id`);
+    try {
+        const violations = [];
+        let scanned = 0;
+        for (const dir of exports.IMAGE_HYGIENE_SCAN_DIRS) {
+            const entries = copyOut(run, `${cid}:${path_1.posix.join(workdir, dir)}`, env);
+            if (entries === null)
+                continue;
+            scanned++;
+            const files = entries.filter((e) => !e.endsWith('/'));
+            const bad = findImageHygieneViolations(files);
+            violations.push(...bad);
+            log(`  image hygiene: ${dir}/ — ${files.length} file(s), ${bad.length} offending`);
+        }
+        if (scanned === 0) {
+            log(`  ⚠ image hygiene: no compiled output found under ${workdir} (${exports.IMAGE_HYGIENE_SCAN_DIRS.join('/')}) — ` +
+                `nothing to scan`);
+        }
+        if (violations.length > 0)
+            throw new ImageHygieneError(image, violations);
+    }
+    finally {
+        // Best-effort reaping. A throw from a `finally` REPLACES the in-flight
+        // exception, so an unchecked `docker rm` would mask an `ImageHygieneError`
+        // verdict with a docker error — but a leaked container is still worth a
+        // line rather than being silent.
+        try {
+            run('docker', ['rm', '-f', cid], { stdio: 'ignore', env });
+        }
+        catch (err) {
+            log(`  ⚠ image hygiene: could not remove scan container ${cid}: ${errorText(err)}`);
+        }
+    }
+}
+/**
+ * `docker cp <src> -` → entry names, or `null` when the path genuinely does not
+ * exist in the image.
+ *
+ * FAIL CLOSED: only docker's own not-found signature maps to `null`. Every
+ * other failure — a `maxBuffer` overflow on an unexpectedly huge directory, a
+ * dead container, a dropped daemon — is rethrown, because the gate cannot
+ * distinguish a broken read from an absent directory and must not report a scan
+ * it did not perform. stderr is PIPED rather than discarded so that signature
+ * is actually visible; with stderr `ignore`d, `execFileSync`'s error carries no
+ * docker text and EVERY failure reads as "not found".
+ */
+function copyOut(run, src, env) {
+    let out;
+    try {
+        out = run('docker', ['cp', src, '-'], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env,
+            maxBuffer: TAR_MAX_BUFFER_BYTES,
+        });
+    }
+    catch (err) {
+        const text = errorText(err);
+        if (DOCKER_CP_MISSING_RE.test(text))
+            return null;
+        throw new Error(`image hygiene gate: \`docker cp ${src} -\` failed, so the built image could not be ` +
+            `scanned — refusing to deploy an unscanned image: ${text}`);
+    }
+    // A non-Buffer means the seam decoded the archive, and a utf8 round-trip
+    // corrupts tar bytes into a buffer that parses as empty — a contract
+    // violation that would have read as "clean scan". Fail closed on it.
+    if (!Buffer.isBuffer(out)) {
+        throw new Error(`image hygiene gate: \`docker cp ${src} -\` returned ${typeof out}, not a tar buffer — ` +
+            `the run seam must not set \`encoding\` on this leg`);
+    }
+    return listTarEntries(out);
+}
+/**
+ * Message plus captured stderr of a thrown child-process error, for signature
+ * matching.
+ *
+ * TOTAL by construction: this runs inside `catch` blocks — including the
+ * `finally` that reaps the scan container — and `String()` throws on a
+ * null-prototype object or a hostile `Symbol.toPrimitive`. A throw from here
+ * would REPLACE the in-flight `ImageHygieneError`, i.e. the gate's verdict
+ * would be masked by a logging failure. Unstringifiable input therefore
+ * degrades to a literal rather than propagating.
+ */
+function errorText(err) {
+    try {
+        const stderr = err.stderr;
+        const tail = Buffer.isBuffer(stderr) ? stderr.toString('utf8') : String(stderr ?? '');
+        const head = err instanceof Error ? err.message : String(err);
+        return `${head}\n${tail}`.trim();
+    }
+    catch {
+        return '[unstringifiable error]';
+    }
+}
+function asText(out) {
+    return typeof out === 'string'
+        ? out.trim()
+        : Buffer.isBuffer(out)
+            ? out.toString('utf8').trim()
+            : '';
+}
+/** NUL-terminated ASCII field of a tar header / GNU long-name block. */
+function cstr(buf, start, len) {
+    const slice = buf.subarray(start, start + len);
+    const nul = slice.indexOf(0);
+    return slice.subarray(0, nul === -1 ? slice.length : nul).toString('utf8');
+}
+/** The `path=` record of a PAX extended header (`"<len> path=<value>\n"` lines). */
+function paxPath(pax) {
+    const m = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(pax);
+    return m ? m[1] : null;
+}
+//# sourceMappingURL=image-hygiene.js.map

package/dist/_lib/image-hygiene.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-hygiene.js","sourceRoot":"","sources":["../../src/_lib/image-hygiene.ts"],"names":[],"mappings":";;;AA+EA,wCA0BC;AAGD,gEAEC;AAkBD,gDAyCC;AAzKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,+BAA6B;AAG7B,iGAAiG;AACpF,QAAA,uBAAuB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAEzE,+DAA+D;AAClD,QAAA,gCAAgC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAU,CAAC;AAE3F,0GAA0G;AAC1G,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,oGAAoG;AACpG,MAAa,iBAAkB,SAAQ,KAAK;IAE/B;IACA;IAFX,YACW,KAAa,EACb,UAAoB;QAE7B,KAAK,CACH,oCAAoC,KAAK,UAAU,UAAU,CAAC,MAAM,uBAAuB;YACzF,8CAA8C;YAC9C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5C,yFAAyF;YACzF,2FAA2F,CAC9F,CAAC;QATO,UAAK,GAAL,KAAK,CAAQ;QACb,eAAU,GAAV,UAAU,CAAU;QAS7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAdD,8CAcC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,GAAI,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QACnE,GAAG,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;QAE3D,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,sBAAsB;YAC3F,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS,CAAC,oBAAoB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,SAAgB,0BAA0B,CAAC,OAA0B;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAaD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAA4B;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,GAAG,EAAE,CAAC;IAEtF,MAAM,OAAO,GACX,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG;QACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,6BAA6B,CAAC,CAAC;IAE7F,IAAI,CAAC;QACH,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,+BAAuB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,YAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACxE,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAS;YAC/B,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAC9C,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACxB,GAAG,CAAC,oBAAoB,GAAG,OAAO,KAAK,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,GAAG,CACD,qDAAqD,OAAO,KAAK,+BAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;gBACtG,iBAAiB,CACpB,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,iCAAiC;QACjC,IAAI,CAAC;YACH,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,sDAAsD,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,OAAO,CAAC,GAAU,EAAE,GAAW,EAAE,GAAsB;IAC9D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE;YACpC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,+CAA+C;YACnF,oDAAoD,IAAI,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,iBAAiB,OAAO,GAAG,uBAAuB;YACtF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yBAAyB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,OAAO,GAAG,KAAK,QAAQ;QAC5B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACZ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAC7B,CAAC,CAAC,EAAE,CAAC;AACX,CAAC;AAED,wEAAwE;AACxE,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,oFAAoF;AACpF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC"}

package/dist/_lib/run-fn.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The CLI's one shell-out seam, in a module of its own.
+ *
+ * It lives here rather than in `baas.ts` because two modules need it and they
+ * also need each other: `buildAndPush` (baas) calls `assertImageHygiene`
+ * (image-hygiene), and the gate takes the same seam. A type-only import back
+ * into `baas.ts` still forms a cycle as far as dependency-cruiser's
+ * `no-circular` rule is concerned, and a cycle between two modules that are
+ * genuinely layered is a design smell rather than a lint quirk. A leaf module
+ * both can import breaks it with no runtime cost — this file compiles to
+ * nothing.
+ */
+/**
+ * `execFileSync`-shaped seam. Throwing on a non-zero exit is the contract
+ * `execFileSync` provides.
+ *
+ * The return value MATTERS for stdout-capturing invocations (the `docker push`
+ * and `docker inspect` legs in `buildAndPush`, and the `docker cp` tar in the
+ * image-hygiene gate): `execFileSync` returns the child's stdout, and with
+ * `encoding: 'utf8'` that is a `string`. We parse the push summary /
+ * `RepoDigests` out of it to recover the pushed manifest digest. Legs run with
+ * inherited stdio (build/tag/login) return nothing meaningful. Unit tests
+ * supply a fake that returns canned push/inspect stdout.
+ */
+export type RunFn = (file: string, args: string[], options: {
+    input?: string;
+    stdio?: unknown;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    encoding?: BufferEncoding;
+    /** Stdout cap for byte-heavy captures (the image-hygiene `docker cp` tar). */
+    maxBuffer?: number;
+}) => unknown;
+//# sourceMappingURL=run-fn.d.ts.map

package/dist/_lib/run-fn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-fn.d.ts","sourceRoot":"","sources":["../../src/_lib/run-fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,KAAK,GAAG,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,KACE,OAAO,CAAC"}

package/dist/_lib/run-fn.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * The CLI's one shell-out seam, in a module of its own.
+ *
+ * It lives here rather than in `baas.ts` because two modules need it and they
+ * also need each other: `buildAndPush` (baas) calls `assertImageHygiene`
+ * (image-hygiene), and the gate takes the same seam. A type-only import back
+ * into `baas.ts` still forms a cycle as far as dependency-cruiser's
+ * `no-circular` rule is concerned, and a cycle between two modules that are
+ * genuinely layered is a design smell rather than a lint quirk. A leaf module
+ * both can import breaks it with no runtime cost — this file compiles to
+ * nothing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=run-fn.js.map

package/dist/_lib/run-fn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-fn.js","sourceRoot":"","sources":["../../src/_lib/run-fn.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG"}

package/dist/_lib/subscription-client.d.ts

@@ -239,6 +239,26 @@ export declare class SubscriptionClient {
      * `/smart-apps` and the full URL is `${origin}/api/v3/smart-apps`.
      */
     createApp(payload: CreateAppPayload): Promise<CreateAppResponse>;
+    /**
+     * Set the smart-app's `config.customerScope` policy via
+     * `PUT /api/v3/smart-apps/:appId` (`SmartAppController.update`, owner-gated
+     * on `developerWallet`) — the developer-facing lever for smart-host #3228
+     * (Hacken HSUITEPT-6).
+     *
+     * `'strict'` makes the HOST refuse any BaaS data-plane request from this app
+     * that carries no end-user identity, so an app backend that forgets to
+     * forward a customer's session cannot silently run that call with its
+     * tenant-wide authority. `'permissive'` (the default when the field is
+     * absent) restores the pre-#3228 behaviour.
+     *
+     * The validator merges `config` partially (`UpdateSmartAppSchema` →
+     * `SmartAppConfigSchema.partial()`), so this call carries ONLY the policy —
+     * `acceptedLoginChains` and the payment/subscription fields are untouched.
+     */
+    setCustomerScope(appId: string, customerScope: 'strict' | 'permissive'): Promise<{
+        appId: string;
+        configCid?: string;
+    }>;
     request(payload: {
         appId: string;
         developerAccountId: string;

package/dist/_lib/subscription-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-client.d.ts","sourceRoot":"","sources":["../../src/_lib/subscription-client.ts"],"names":[],"mappings":"AAuCA,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KAC/B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,IAAI,GAAG;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;IAC7D,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;gDAE4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAmD;gBAE7D,IAAI,EAAE,yBAAyB;IAsB3C;;;;;;;;;OASG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBnC;;;;;;;;;;;;;;;;OAgBG;YACW,UAAU;IAWxB;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIhE,OAAO,CAAC,OAAO,EAAE;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAMlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAM1D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM1C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAU3E;;;;;;OAMG;IACG,KAAK,CACT,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IASI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOrE,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK5D,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMnD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMxD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,EAAE,MAAM,SAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAMrF"}
+{"version":3,"file":"subscription-client.d.ts","sourceRoot":"","sources":["../../src/_lib/subscription-client.ts"],"names":[],"mappings":"AAwCA,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KAC/B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,IAAI,GAAG;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;IAC7D,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;gDAE4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAmD;gBAE7D,IAAI,EAAE,yBAAyB;IAsB3C;;;;;;;;;OASG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBnC;;;;;;;;;;;;;;;;OAgBG;YACW,UAAU;IAWxB;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAItE;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,QAAQ,GAAG,YAAY,GACrC,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAS3C,OAAO,CAAC,OAAO,EAAE;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAMlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAM1D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM1C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAU3E;;;;;;OAMG;IACG,KAAK,CACT,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IASI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOrE,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK5D,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMnD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMxD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,EAAE,MAAM,SAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAMrF"}

package/dist/_lib/subscription-client.js

@@ -66,6 +66,7 @@ exports.SubscriptionClient = void 0;
  * create route, posting on the same shared `${origin}/api/v3` client.
  */
 const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
+const transport_1 = require("./transport");
 /**
  * Validator-side subscription HTTP client.
  *
@@ -118,7 +119,9 @@ class SubscriptionClient {
         // ripple-keypairs ships with xrpl (a CLI dep); import lazily.
         const kp = await Promise.resolve().then(() => __importStar(require('ripple-keypairs')));
         const { publicKey, privateKey } = kp.deriveKeypair(this.auth.seed);
-        const authClient = new smart_engines_sdk_1.ValidatorAuthClient({ security: { allowInsecure: true } });
+        const authClient = new smart_engines_sdk_1.ValidatorAuthClient({
+            security: { allowInsecure: (0, transport_1.resolveAllowInsecure)(this.origin) },
+        });
         const res = await authClient.authenticateWithSigner(this.origin, this.auth.chain, this.auth.address, publicKey, (challenge) => {
             const messageHex = Buffer.from(challenge, 'utf-8').toString('hex').toUpperCase();
             return kp.sign(messageHex, privateKey);
@@ -177,6 +180,25 @@ class SubscriptionClient {
     async createApp(payload) {
         return this.withReauth(() => this.http.post('/smart-apps', payload));
     }
+    /**
+     * Set the smart-app's `config.customerScope` policy via
+     * `PUT /api/v3/smart-apps/:appId` (`SmartAppController.update`, owner-gated
+     * on `developerWallet`) — the developer-facing lever for smart-host #3228
+     * (Hacken HSUITEPT-6).
+     *
+     * `'strict'` makes the HOST refuse any BaaS data-plane request from this app
+     * that carries no end-user identity, so an app backend that forgets to
+     * forward a customer's session cannot silently run that call with its
+     * tenant-wide authority. `'permissive'` (the default when the field is
+     * absent) restores the pre-#3228 behaviour.
+     *
+     * The validator merges `config` partially (`UpdateSmartAppSchema` →
+     * `SmartAppConfigSchema.partial()`), so this call carries ONLY the policy —
+     * `acceptedLoginChains` and the payment/subscription fields are untouched.
+     */
+    async setCustomerScope(appId, customerScope) {
+        return this.withReauth(() => this.http.put(`/smart-apps/${encodeURIComponent(appId)}`, { config: { customerScope } }));
+    }
     async request(payload) {
         return this.withReauth(() => this.sdk.request(payload));
     }

package/dist/_lib/subscription-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-client.js","sourceRoot":"","sources":["../../src/_lib/subscription-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,iEAMmC;AA6LnC;;;;;;;;GAQG;AACH,MAAa,kBAAkB;IAC7B,iFAAiF;IAChE,MAAM,CAAS;IACf,GAAG,CAAwB;IAC3B,IAAI,CAAa;IACjB,IAAI,CAAoD;IAEzE,YAAY,IAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,4EAA4E;QAC5E,4EAA4E;QAC5E,8CAA8C;QAC9C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,SAAS,CAAC;QACxC,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,OAAO,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS;YACxB,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACpD,CAAC,CAAC,IAAA,oCAAgB,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,sCAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,8DAA8D;QAC9D,MAAM,EAAE,GAAG,wDAAa,iBAAiB,GAAC,CAAC;QAC3C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,uCAAmB,CAAC,EAAE,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,sBAAsB,CACjD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,CAAC,KAA8D,EACxE,IAAI,CAAC,IAAI,CAAC,OAAO,EACjB,SAAS,EACT,CAAC,SAAS,EAAE,EAAE;YACZ,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACjF,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,UAAU,CAAI,EAAoB;QAC9C,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACtD,uEAAuE;YACvE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAoB,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAUb;QACC,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAgB,CAAoD,CAC5F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAmD,CAClF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAqC,CAClE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,cAAuB;QAChD,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CACH,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACb,KAAK;YACL,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAsC,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CACT,KAAa,EACb,MAAe;QAQf,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACpC,KAAK;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CACrD,CAAC;QACF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,MAAc;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CACrC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CACvD,CAAC;QACF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,GAAoC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAA6C,CAC3E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAA4C,CAChF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC;QACjD,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CACH,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAA8C,CAC7F,CAAC;IACJ,CAAC;CACF;AAjND,gDAiNC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,gCAAY,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAW1B;IACC,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,EAAE,QAAQ;QACvB,MAAM,EAAE,GAAG,EAAE,MAAM;QACnB,WAAW,EAAE,GAAG,EAAE,WAAW;QAC7B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,EAAE,mBAAmB;KACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,OAAe,EAAE,SAAoB;IACtE,IAAI,KAAyB,CAAC;IAC9B,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;QACrD,MAAM,IAAI,GAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAU,EAAE;QAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,4CAA4C,CAAC,CAAC;IAChG,CAAC,CAAC;IACF,OAAO;QACL,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,IAAI,CAAI,KAAK,EAAE,IAAI,CAAC;QAC9C,IAAI,EAAE,CAAI,IAAY,EAAE,CAAU,EAAE,EAAE,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,EAAE,WAAW,CAAC,KAAK,CAAsB;QAC5C,KAAK,EAAE,WAAW,CAAC,OAAO,CAAwB;QAClD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAyB;QACrD,OAAO,EAAE,WAAW,CAAC,SAAS,CAA0B;QACxD,SAAS,EAAE,WAAW,CAAC,WAAW,CAA4B;QAC9D,iBAAiB,EAAE,WAAW,CAAC,mBAAmB,CAAoC;QACtF,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAyB;QACrD,YAAY,EAAE,CAAC,CAAqB,EAAE,EAAE;YACtC,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"subscription-client.js","sourceRoot":"","sources":["../../src/_lib/subscription-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,iEAMmC;AACnC,2CAAmD;AA6LnD;;;;;;;;GAQG;AACH,MAAa,kBAAkB;IAC7B,iFAAiF;IAChE,MAAM,CAAS;IACf,GAAG,CAAwB;IAC3B,IAAI,CAAa;IACjB,IAAI,CAAoD;IAEzE,YAAY,IAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,4EAA4E;QAC5E,4EAA4E;QAC5E,8CAA8C;QAC9C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,SAAS,CAAC;QACxC,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,OAAO,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS;YACxB,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACpD,CAAC,CAAC,IAAA,oCAAgB,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,sCAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,8DAA8D;QAC9D,MAAM,EAAE,GAAG,wDAAa,iBAAiB,GAAC,CAAC;QAC3C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,uCAAmB,CAAC;YACzC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAA,gCAAoB,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,sBAAsB,CACjD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,CAAC,KAA8D,EACxE,IAAI,CAAC,IAAI,CAAC,OAAO,EACjB,SAAS,EACT,CAAC,SAAS,EAAE,EAAE;YACZ,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACjF,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,UAAU,CAAI,EAAoB;QAC9C,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACtD,uEAAuE;YACvE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAoB,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,aAAsC;QAEtC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CACX,eAAe,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAC1C,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAUb;QACC,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAgB,CAAoD,CAC5F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAmD,CAClF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAqC,CAClE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,cAAuB;QAChD,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CACH,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACb,KAAK;YACL,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAsC,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CACT,KAAa,EACb,MAAe;QAQf,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACpC,KAAK;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CACrD,CAAC;QACF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,MAAc;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CACrC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CACvD,CAAC;QACF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,GAAoC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAA6C,CAC3E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAA4C,CAChF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC;QACjD,OAAO,IAAI,CAAC,UAAU,CACpB,GAAG,EAAE,CACH,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAA8C,CAC7F,CAAC;IACJ,CAAC;CACF;AA/OD,gDA+OC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,gCAAY,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAW1B;IACC,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,EAAE,QAAQ;QACvB,MAAM,EAAE,GAAG,EAAE,MAAM;QACnB,WAAW,EAAE,GAAG,EAAE,WAAW;QAC7B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,EAAE,mBAAmB;KACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,OAAe,EAAE,SAAoB;IACtE,IAAI,KAAyB,CAAC;IAC9B,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;QACrD,MAAM,IAAI,GAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAU,EAAE;QAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,4CAA4C,CAAC,CAAC;IAChG,CAAC,CAAC;IACF,OAAO;QACL,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,IAAI,CAAI,KAAK,EAAE,IAAI,CAAC;QAC9C,IAAI,EAAE,CAAI,IAAY,EAAE,CAAU,EAAE,EAAE,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,EAAE,WAAW,CAAC,KAAK,CAAsB;QAC5C,KAAK,EAAE,WAAW,CAAC,OAAO,CAAwB;QAClD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAyB;QACrD,OAAO,EAAE,WAAW,CAAC,SAAS,CAA0B;QACxD,SAAS,EAAE,WAAW,CAAC,WAAW,CAA4B;QAC9D,iBAAiB,EAAE,WAAW,CAAC,mBAAmB,CAAoC;QACtF,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAyB;QACrD,YAAY,EAAE,CAAC,CAAqB,EAAE,EAAE;YACtC,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;KAC1B,CAAC;AACJ,CAAC"}

package/dist/_lib/transport.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The CLI's ONE transport-policy adapter (HSUITEPT-16 residue, #3276).
+ *
+ * `libs/smartengine-sdk/src/transport-policy.ts` (landed in #3258) admits
+ * plain `http://` only toward a Kubernetes in-cluster service name (`*.svc`,
+ * `*.cluster.local`); everything else requires an explicit `allowInsecure`.
+ * The CLI used to DERIVE that flag from the URL scheme
+ * (`server.startsWith('http://')`), which asserted the flag for a public
+ * plaintext host too — so `hsuite --server http://gateway.example.com` sent the
+ * wallet-signed session and `X-API-Key` in cleartext, and the SDK could not
+ * refuse because the CLI had already opted in. The CLI is the tool that mints
+ * and carries credentials (`hsuite init`, `hsuite subscribe`), so that
+ * derivation was the whole exposure, one layer up.
+ *
+ * Every CLI site that builds an SDK client routes through
+ * {@link resolveAllowInsecure} instead. It adds the two things the SDK policy
+ * deliberately does not cover, and re-implements nothing:
+ *
+ *   - `true` for a LOOPBACK target (`localhost`, `127.0.0.1`, `::1`) — the
+ *     documented `hsuite --server http://localhost:3000` local-dev flow;
+ *   - `true` when the operator opted in explicitly, via the global `--insecure`
+ *     flag (wired once, in `src/index.ts`) or `HSUITE_ALLOW_INSECURE=1`.
+ *
+ * Everything else goes back to the SDK: a target the policy admits without the
+ * flag (https, in-cluster service name) gets `undefined` — "pass nothing, you
+ * decide" — and a target it would refuse is refused HERE, before any credential
+ * is signed or sent, with a message naming the CLI opt-in. The in-cluster
+ * suffix list is NOT copied: whether to refuse is decided by asking
+ * `plaintextRejection`, the policy function itself.
+ */
+import type { Command } from 'commander';
+/** Env-var spelling of the opt-in; the value must be exactly `'1'`. */
+export declare const INSECURE_OPT_IN_ENV = "HSUITE_ALLOW_INSECURE";
+/** The global flag spelling of the opt-in (registered on the root program). */
+export declare const INSECURE_OPT_IN_FLAG = "--insecure";
+/** True when `hostname` names the local machine (loopback). */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/** True when the operator opted into plaintext explicitly (`HSUITE_ALLOW_INSECURE=1`). */
+export declare function insecureOptIn(): boolean;
+/**
+ * Register the ONE opt-in flag on the ROOT program, and normalise it into
+ * {@link INSECURE_OPT_IN_ENV} — the single channel {@link resolveAllowInsecure}
+ * reads. Called once, from `src/index.ts`; never re-added per command.
+ *
+ * Declaring it on the root is what makes `hsuite --insecure …` and
+ * `hsuite deploy --insecure …` the same mechanism: commander's `preAction`
+ * hooks fire up the command chain, so this runs before any action body.
+ */
+export declare function installInsecureOptIn(program: Command): void;
+/**
+ * The `allowInsecure` value to hand an SDK client built against `target`:
+ *
+ *   - `true` — loopback, or the operator opted in;
+ *   - `undefined` — the SDK transport policy decides;
+ *   - throws — plaintext to a public host with no opt-in. Nothing is
+ *     constructed and no credential is signed.
+ *
+ * Read the module header before adding a caller: this is the only place in
+ * `packages/hsuite-cli` allowed to produce an `allowInsecure` value.
+ */
+export declare function resolveAllowInsecure(target: string): boolean | undefined;
+//# sourceMappingURL=transport.d.ts.map

package/dist/_lib/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/_lib/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAejD,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAY3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CA2BxE"}

package/dist/_lib/transport.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * The CLI's ONE transport-policy adapter (HSUITEPT-16 residue, #3276).
+ *
+ * `libs/smartengine-sdk/src/transport-policy.ts` (landed in #3258) admits
+ * plain `http://` only toward a Kubernetes in-cluster service name (`*.svc`,
+ * `*.cluster.local`); everything else requires an explicit `allowInsecure`.
+ * The CLI used to DERIVE that flag from the URL scheme
+ * (`server.startsWith('http://')`), which asserted the flag for a public
+ * plaintext host too — so `hsuite --server http://gateway.example.com` sent the
+ * wallet-signed session and `X-API-Key` in cleartext, and the SDK could not
+ * refuse because the CLI had already opted in. The CLI is the tool that mints
+ * and carries credentials (`hsuite init`, `hsuite subscribe`), so that
+ * derivation was the whole exposure, one layer up.
+ *
+ * Every CLI site that builds an SDK client routes through
+ * {@link resolveAllowInsecure} instead. It adds the two things the SDK policy
+ * deliberately does not cover, and re-implements nothing:
+ *
+ *   - `true` for a LOOPBACK target (`localhost`, `127.0.0.1`, `::1`) — the
+ *     documented `hsuite --server http://localhost:3000` local-dev flow;
+ *   - `true` when the operator opted in explicitly, via the global `--insecure`
+ *     flag (wired once, in `src/index.ts`) or `HSUITE_ALLOW_INSECURE=1`.
+ *
+ * Everything else goes back to the SDK: a target the policy admits without the
+ * flag (https, in-cluster service name) gets `undefined` — "pass nothing, you
+ * decide" — and a target it would refuse is refused HERE, before any credential
+ * is signed or sent, with a message naming the CLI opt-in. The in-cluster
+ * suffix list is NOT copied: whether to refuse is decided by asking
+ * `plaintextRejection`, the policy function itself.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSECURE_OPT_IN_FLAG = exports.INSECURE_OPT_IN_ENV = void 0;
+exports.isLoopbackHostname = isLoopbackHostname;
+exports.insecureOptIn = insecureOptIn;
+exports.installInsecureOptIn = installInsecureOptIn;
+exports.resolveAllowInsecure = resolveAllowInsecure;
+const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
+/** Env-var spelling of the opt-in; the value must be exactly `'1'`. */
+exports.INSECURE_OPT_IN_ENV = 'HSUITE_ALLOW_INSECURE';
+/** The global flag spelling of the opt-in (registered on the root program). */
+exports.INSECURE_OPT_IN_FLAG = '--insecure';
+/**
+ * Hostnames that can only ever name the machine the CLI runs on. Exact match,
+ * never a suffix — `localhost.evil.example` is a public name and must not be
+ * mistaken for the local-dev escape hatch.
+ */
+const LOOPBACK_HOSTNAMES = new Set([
+    'localhost',
+    '127.0.0.1',
+    '::1',
+    // WHATWG `URL.hostname` keeps the brackets on an IPv6 literal.
+    '[::1]',
+]);
+/** True when `hostname` names the local machine (loopback). */
+function isLoopbackHostname(hostname) {
+    return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
+}
+/** True when the operator opted into plaintext explicitly (`HSUITE_ALLOW_INSECURE=1`). */
+function insecureOptIn() {
+    return process.env[exports.INSECURE_OPT_IN_ENV] === '1';
+}
+/**
+ * Register the ONE opt-in flag on the ROOT program, and normalise it into
+ * {@link INSECURE_OPT_IN_ENV} — the single channel {@link resolveAllowInsecure}
+ * reads. Called once, from `src/index.ts`; never re-added per command.
+ *
+ * Declaring it on the root is what makes `hsuite --insecure …` and
+ * `hsuite deploy --insecure …` the same mechanism: commander's `preAction`
+ * hooks fire up the command chain, so this runs before any action body.
+ */
+function installInsecureOptIn(program) {
+    program
+        .option(exports.INSECURE_OPT_IN_FLAG, 'Allow plaintext http:// to a non-loopback host (local development only; ' +
+        `equivalent to ${exports.INSECURE_OPT_IN_ENV}=1)`)
+        .hook('preAction', (thisCommand) => {
+        // The resolver lives in plain modules, not just commander actions, so the
+        // environment is the one channel both spellings meet in.
+        if (thisCommand.opts().insecure)
+            process.env[exports.INSECURE_OPT_IN_ENV] = '1';
+    });
+}
+/**
+ * The `allowInsecure` value to hand an SDK client built against `target`:
+ *
+ *   - `true` — loopback, or the operator opted in;
+ *   - `undefined` — the SDK transport policy decides;
+ *   - throws — plaintext to a public host with no opt-in. Nothing is
+ *     constructed and no credential is signed.
+ *
+ * Read the module header before adding a caller: this is the only place in
+ * `packages/hsuite-cli` allowed to produce an `allowInsecure` value.
+ */
+function resolveAllowInsecure(target) {
+    if (insecureOptIn())
+        return true;
+    let parsed;
+    try {
+        parsed = new URL(target);
+    }
+    catch {
+        // Not a URL we can reason about — leave the diagnosis to the SDK, whose
+        // error surface for a malformed base URL is the one callers already render.
+        return undefined;
+    }
+    if (isLoopbackHostname(parsed.hostname))
+        return true;
+    // Ask the policy, with the flag off, what it would decide. `null` means the
+    // SDK admits this target on its own (https, or an in-cluster service name) —
+    // so pass nothing and let it. A reason means the SDK would refuse; refuse
+    // here instead, where the CLI can name its own opt-in.
+    if ((0, smart_engines_sdk_1.plaintextRejection)(parsed, false) === null)
+        return undefined;
+    throw new Error(`refusing to send credentials over plaintext http:// to ${parsed.hostname}: ` +
+        'the smart-engines transport policy admits plain http:// only toward an ' +
+        'in-cluster service name (*.svc, *.cluster.local). Use https://, or re-run ' +
+        `with ${exports.INSECURE_OPT_IN_FLAG} (or ${exports.INSECURE_OPT_IN_ENV}=1) to allow it — ` +
+        'local development only.');
+}
+//# sourceMappingURL=transport.js.map

package/dist/_lib/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/_lib/transport.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AAyBH,gDAEC;AAGD,sCAEC;AAWD,oDAYC;AAaD,oDA2BC;AA5FD,iEAA+D;AAE/D,uEAAuE;AAC1D,QAAA,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,+EAA+E;AAClE,QAAA,oBAAoB,GAAG,YAAY,CAAC;AAEjD;;;;GAIG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,WAAW;IACX,KAAK;IACL,+DAA+D;IAC/D,OAAO;CACR,CAAC,CAAC;AAEH,+DAA+D;AAC/D,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,0FAA0F;AAC1F,SAAgB,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,2BAAmB,CAAC,KAAK,GAAG,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,MAAM,CACL,4BAAoB,EACpB,0EAA0E;QACxE,iBAAiB,2BAAmB,KAAK,CAC5C;SACA,IAAI,CAAC,WAAW,EAAE,CAAC,WAAoB,EAAE,EAAE;QAC1C,0EAA0E;QAC1E,yDAAyD;QACzD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,2BAAmB,CAAC,GAAG,GAAG,CAAC;IAC1E,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IACjD,IAAI,aAAa,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,4EAA4E;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,IAAA,sCAAkB,EAAC,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEjE,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,QAAQ,IAAI;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,QAAQ,4BAAoB,QAAQ,2BAAmB,oBAAoB;QAC3E,yBAAyB,CAC5B,CAAC;AACJ,CAAC"}