@hsuite/smart-engines-cli 1.7.0 → 1.8.0

package/README.md

@@ -99,6 +99,42 @@ After this, your smart-app boots in cluster-mode automatically.
 
 ---
 
+## Plaintext transport: HTTPS by default, one explicit opt-in
+
+The CLI mints and carries credentials (`hsuite init`, `hsuite subscribe`), so it
+does not talk plaintext `http://` to a public host. Every command that takes a
+`--server` / `--gateway` — or reaches the validator through
+`_lib/subscription-client.ts` — routes through ONE resolver
+(`src/_lib/transport.ts`); no call site derives the flag from the URL scheme.
+
+| Target | Behaviour |
+|---|---|
+| `https://…` | Accepted |
+| `http://localhost`, `http://127.0.0.1`, `http://[::1]` | Accepted — the local-dev flow needs no flag |
+| `http://<cluster-service>.svc[.cluster.local]` | Deferred to the SDK transport policy (which admits it) |
+| any other `http://…` | **Refused** before the client is built |
+
+A refusal names the opt-in:
+
+```
+  ✗ refusing to send credentials over plaintext http:// to gateway.example.com: the
+    smart-engines transport policy admits plain http:// only toward an in-cluster
+    service name (*.svc, *.cluster.local). Use https://, or re-run with --insecure
+    (or HSUITE_ALLOW_INSECURE=1) to allow it — local development only.
+```
+
+The opt-in is one mechanism, either spelling:
+
+```sh
+hsuite --insecure deploy --manifest ./app.json          # global flag, before or after the subcommand
+HSUITE_ALLOW_INSECURE=1 hsuite deploy --manifest ./app.json
+```
+
+It is global (`--insecure` is registered once on the root program, not per
+command) and applies to every command in the same invocation. The flag sets
+`HSUITE_ALLOW_INSECURE=1`; only the exact value `1` counts. Use it only against
+a host you operate yourself.
+
 ## Deployment commands
 
 Eight commands take a smart-app from a manifest to a running, manageable
@@ -111,10 +147,11 @@ deployment on the cluster. They all share base flags:
 | `--app-id <id>` | `DEPLOYED_APP_ID` → `SUBSCRIPTION_APP_ID` | App to act on |
 
 Every command constructs exactly **one** `BaasClient`
-(`{ hostUrl, appId, pathPrefix: '/host', allowInsecure, timeout }`) and
-authenticates it with the env XRPL signer — connecting straight to the public
-round-robin gateway (no cluster-discovery factory, whose per-cluster hostnames
-aren't reachable from a dev machine).
+(`{ hostUrl, appId, pathPrefix: '/host', allowInsecure, timeout }`, where
+`allowInsecure` comes from the shared resolver above — `undefined` unless the
+target is loopback or opted in) and authenticates it with the env XRPL signer —
+connecting straight to the public round-robin gateway (no cluster-discovery
+factory, whose per-cluster hostnames aren't reachable from a dev machine).
 
 ### The manifest (one canonical shape)
 
@@ -166,8 +203,8 @@ same set the smart-app's env schema reads (`XRPL_*`, `SUBSCRIPTION_APP_ID`,
 deploy-time / CLI-only knobs (e.g. `SUBSCRIPTION_NFT_SERIAL`, `VALIDATOR_API_KEY`)
 are **not** forwarded. The list lives in
 `packages/hsuite-cli/src/_lib/runtime-env.ts` (`RUNTIME_ENV_KEYS`), mirroring the
-smart-app schema (`apps/showcase/smart-app/src/config/env-validation.ts` in the
-hsuite-ecosystem repo).
+smart-app schema (`smart-app/src/config/env-validation.ts` in the
+`HSuiteNetwork/showcase-smart-app` repo).
 
 **Precedence:** the forwarded `.env.local` values are the base;
 **`manifest.backend.env` is overlaid last and WINS** for any key it sets. Use
@@ -264,6 +301,17 @@ The `strategy` field on the manifest/deploy request is **advisory**: a
 `recreate` request is coerced to `RollingUpdate` for multi-replica apps (with a
 warning).
 
+### Image-hygiene gate (HSUITEPT-5)
+
+Right after `docker build` — and before any tag / login / push, also with
+`--skip-build` — `hsuite deploy` scans the built image's compiled output
+(`dist/`, `build/`, `lib/` under the image `WorkingDir`) and **aborts** if it
+ships `.map`, `.d.ts` or `.tsbuildinfo` files: a pentest pulled a customer image
+whose `dist/` read like source. Not skippable. Build the backend with
+`sourceMap` / `declaration` off and `removeComments` on (a production tsconfig),
+or keep those files out of the image (`.dockerignore`). `node_modules/` is never
+scanned.
+
 ### `hsuite deploy` — THE canonical deploy path
 
 `hsuite deploy --manifest <file>` is the **single, canonical path** to deploy a
@@ -404,7 +452,8 @@ hsuite subscribe --env .env.local --tier builder
 ## Companion packages
 
 - **[`@hsuite/smart-engines-sdk`](https://www.npmjs.com/package/@hsuite/smart-engines-sdk)** — the underlying SDK that `hsuite` wraps. Use it directly when you need finer-grained control over auth, BaaS calls, or chain operations.
-- **[hsuite-ecosystem/apps/showcase](https://github.com/HSuiteNetwork/hsuite-ecosystem/tree/main/apps/showcase)** — a reference NestJS backend + Ionic dApp that demonstrate the full integration. Fork it as a starting point.
+- **[showcase-smart-app](https://github.com/HSuiteNetwork/showcase-smart-app)** — a reference NestJS backend + Ionic dApp that demonstrate the full integration.
+- **[boilerplate-smart-app](https://github.com/HSuiteNetwork/boilerplate-smart-app)** — the fork-and-go starting point for a new smart-app.
 
 ---
 

package/dist/__tests__/helpers/fixtures-image-hygiene.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Canned answers for the image-hygiene gate legs every `buildAndPush` runs
+ * (HSUITEPT-5): `docker inspect` → WorkingDir, `docker create` → container id,
+ * `docker cp` → the current {@link hygieneTar}, `docker rm` → nothing.
+ *
+ * Fold into any fake `execFileSync` / `runFn` as its fallthrough
+ * (`return hygieneLeg(file, args)`), so the gate sees a CLEAN image by default
+ * and the suite under test keeps asserting only its own legs. Plant an
+ * offending file with `hygieneTar = tarWith('dist/main.js.map')`.
+ */
+export declare const HYGIENE_CID: string;
+/** Empty archive = clean image. Reassign per test; reset in `beforeEach` where it matters. */
+export declare let hygieneTar: Buffer;
+export declare function setHygieneTar(tar: Buffer): void;
+export declare function hygieneLeg(file: string, args: string[]): unknown;
+/** One-entry ustar archive (enough to plant an offending file). */
+export declare function tarWith(name: string): Buffer;
+//# sourceMappingURL=fixtures-image-hygiene.d.ts.map

package/dist/__tests__/helpers/fixtures-image-hygiene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures-image-hygiene.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/fixtures-image-hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,QAAiB,CAAC;AAE1C,8FAA8F;AAC9F,eAAO,IAAI,UAAU,EAAE,MAA2B,CAAC;AAEnD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhE;AAED,mEAAmE;AACnE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5C"}

package/dist/__tests__/helpers/fixtures-image-hygiene.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hygieneTar = exports.HYGIENE_CID = void 0;
+exports.setHygieneTar = setHygieneTar;
+exports.hygieneLeg = hygieneLeg;
+exports.tarWith = tarWith;
+/**
+ * Canned answers for the image-hygiene gate legs every `buildAndPush` runs
+ * (HSUITEPT-5): `docker inspect` → WorkingDir, `docker create` → container id,
+ * `docker cp` → the current {@link hygieneTar}, `docker rm` → nothing.
+ *
+ * Fold into any fake `execFileSync` / `runFn` as its fallthrough
+ * (`return hygieneLeg(file, args)`), so the gate sees a CLEAN image by default
+ * and the suite under test keeps asserting only its own legs. Plant an
+ * offending file with `hygieneTar = tarWith('dist/main.js.map')`.
+ */
+exports.HYGIENE_CID = 'c'.repeat(64);
+/** Empty archive = clean image. Reassign per test; reset in `beforeEach` where it matters. */
+exports.hygieneTar = Buffer.alloc(1024);
+function setHygieneTar(tar) {
+    exports.hygieneTar = tar;
+}
+function hygieneLeg(file, args) {
+    if (file !== 'docker')
+        return undefined;
+    if (args[0] === 'inspect')
+        return '/app\n';
+    if (args[0] === 'create')
+        return `${exports.HYGIENE_CID}\n`;
+    if (args[0] === 'cp')
+        return exports.hygieneTar;
+    return undefined;
+}
+/** One-entry ustar archive (enough to plant an offending file). */
+function tarWith(name) {
+    const header = Buffer.alloc(512);
+    header.write(name, 0, 100, 'utf8');
+    header.write('00000000000\0', 124, 12, 'ascii');
+    header.write('0', 156, 1, 'ascii');
+    return Buffer.concat([header, Buffer.alloc(1024)]);
+}
+//# sourceMappingURL=fixtures-image-hygiene.js.map

package/dist/__tests__/helpers/fixtures-image-hygiene.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures-image-hygiene.js","sourceRoot":"","sources":["../../../src/__tests__/helpers/fixtures-image-hygiene.ts"],"names":[],"mappings":";;;AAeA,sCAEC;AAED,gCAMC;AAGD,0BAMC;AAlCD;;;;;;;;;GASG;AACU,QAAA,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE1C,8FAA8F;AACnF,QAAA,UAAU,GAAW,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAEnD,SAAgB,aAAa,CAAC,GAAW;IACvC,kBAAU,GAAG,GAAG,CAAC;AACnB,CAAC;AAED,SAAgB,UAAU,CAAC,IAAY,EAAE,IAAc;IACrD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,GAAG,mBAAW,IAAI,CAAC;IACpD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,kBAAU,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mEAAmE;AACnE,SAAgB,OAAO,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/_lib/baas.d.ts

@@ -1,5 +1,6 @@
 import { BaasClient } from '@hsuite/smart-engines-sdk';
 import type { EnvMap } from './env';
+import type { RunFn } from './run-fn';
 /** Default per-app deploy timeout — `init` runs the smart-app entity DKG ceremony. */
 export declare const DEFAULT_DEPLOY_TIMEOUT_MS = 240000;
 /**
@@ -18,23 +19,11 @@ export type RegistryCreds = {
     repository: string;
 };
 /**
- * `execFileSync`-shaped seam. Throwing on a non-zero exit is the contract
- * `execFileSync` provides.
- *
- * The return value MATTERS for stdout-capturing invocations (the `docker push`
- * and `docker inspect` legs in {@link buildAndPush}): `execFileSync` returns the
- * child's stdout, and with `encoding: 'utf8'` that is a `string`. We parse the
- * push summary / `RepoDigests` out of it to recover the pushed manifest digest.
- * Legs run with inherited stdio (build/tag/login) return nothing meaningful.
- * Unit tests supply a fake that returns canned push/inspect stdout.
+ * The shell-out seam. Declared in `./run-fn` so `image-hygiene.ts` can take it
+ * without importing this module back (dependency-cruiser `no-circular`), and
+ * re-exported here because every existing caller imports it from `baas`.
  */
-export type RunFn = (file: string, args: string[], options: {
-    input?: string;
-    stdio?: unknown;
-    env?: NodeJS.ProcessEnv;
-    cwd?: string;
-    encoding?: BufferEncoding;
-}) => unknown;
+export type { RunFn } from './run-fn';
 export type ConnectAndAuthOpts = {
     /** Public gateway/host URL. */
     gateway: string;
@@ -51,7 +40,7 @@ export type ConnectAndAuthOpts = {
     clientFactory?: (config: {
         hostUrl: string;
         appId: string;
-        allowInsecure: boolean;
+        allowInsecure: boolean | undefined;
         pathPrefix: string;
         timeout: number;
     }) => BaasClient;
@@ -88,6 +77,8 @@ export type BuildAndPushOpts = {
     platform?: string;
     /** Test seam — defaults to `execFileSync`. */
     runFn?: RunFn;
+    /** Progress sink for the image-hygiene gate (defaults to silent). */
+    log?: (message: string) => void;
     /** Push retry attempts (round-robin robot-auth can need a couple). Default 6. */
     pushAttempts?: number;
     /**
@@ -125,6 +116,10 @@ export declare function imageTarget(registry: RegistryCreds, tag: string): strin
  *   - optional `<build>` (shell command) in `context`
  *   - `docker build --platform linux/amd64 --provenance=false --sbom=false
  *      -t hsuite-local/<name>:<tag> -f <dockerfile> <context>`
+ *   - image-hygiene gate ({@link assertImageHygiene}, HSUITEPT-5): the built
+ *     image's compiled output must ship no source maps / declarations — runs
+ *     even with `--skip-build` (the image is about to be deployed either way)
+ *     and ABORTS before any tag / login / push
  *   - `docker tag <local> <server>/<repo>:<tag>`
  *   - `docker login <server> -u <username> --password-stdin`  ← username a
  *     DISCRETE argv element; password on stdin

package/dist/_lib/baas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"baas.d.ts","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAIpC,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,KAAK,GAAG,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,KACE,OAAO,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,KAAK,UAAU,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBlF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA4H3D;AAwDD,MAAM,MAAM,eAAe,GAAG;IAC5B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAIzD"}
+{"version":3,"file":"baas.d.ts","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAGpC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAItC,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;QACnC,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,KAAK,UAAU,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBlF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qEAAqE;IACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAmI3D;AAwDD,MAAM,MAAM,eAAe,GAAG;IAC5B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAIzD"}

package/dist/_lib/baas.js

@@ -55,6 +55,8 @@ const child_process_1 = require("child_process");
 const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
 const env_1 = require("./env");
 const docker_1 = require("./docker");
+const image_hygiene_1 = require("./image-hygiene");
+const transport_1 = require("./transport");
 /** Default per-app deploy timeout — `init` runs the smart-app entity DKG ceremony. */
 exports.DEFAULT_DEPLOY_TIMEOUT_MS = 240_000;
 /**
@@ -75,7 +77,7 @@ async function connectAndAuth(opts) {
     const config = {
         hostUrl: opts.gateway,
         appId: opts.appId ?? 'pending',
-        allowInsecure: opts.gateway.startsWith('http://'),
+        allowInsecure: (0, transport_1.resolveAllowInsecure)(opts.gateway),
         pathPrefix: '/host',
         timeout: opts.timeout ?? exports.DEFAULT_DEPLOY_TIMEOUT_MS,
     };
@@ -104,6 +106,10 @@ function imageTarget(registry, tag) {
  *   - optional `<build>` (shell command) in `context`
  *   - `docker build --platform linux/amd64 --provenance=false --sbom=false
  *      -t hsuite-local/<name>:<tag> -f <dockerfile> <context>`
+ *   - image-hygiene gate ({@link assertImageHygiene}, HSUITEPT-5): the built
+ *     image's compiled output must ship no source maps / declarations — runs
+ *     even with `--skip-build` (the image is about to be deployed either way)
+ *     and ABORTS before any tag / login / push
  *   - `docker tag <local> <server>/<repo>:<tag>`
  *   - `docker login <server> -u <username> --password-stdin`  ← username a
  *     DISCRETE argv element; password on stdin
@@ -187,6 +193,12 @@ function buildAndPush(opts) {
             env: dockerEnv,
         });
     }
+    // HSUITEPT-5: never push (or deploy an already-pushed) image whose compiled
+    // output reads like source. Throws `ImageHygieneError` with the offending
+    // entries; nothing below runs. Not skippable — this is the platform-owned
+    // choke point for customer image hygiene, and app-side build config is
+    // never relied on.
+    (0, image_hygiene_1.assertImageHygiene)({ image: localTag, run, env: dockerEnv, log: opts.log });
     // #1679: aim the whole docker sequence at ONE origin when the caller resolved
     // a pin. `opts.registry` itself is left alone — see `pushHost`'s docblock for
     // why collapsing it breaks the downstream fan-out.

package/dist/_lib/baas.js.map

@@ -1 +1 @@
-{"version":3,"file":"baas.js","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":";;;AA0HA,wCAiBC;AAuDD,kCAEC;AAoCD,oCA4HC;AAyED,kCAIC;AAjbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,iDAA6C;AAC7C,iEAAuD;AAEvD,+BAA2C;AAC3C,qCAAkE;AAElE,sFAAsF;AACzE,QAAA,yBAAyB,GAAG,OAAO,CAAC;AAEjD;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,aAAa,CAAC;AAuDpD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iCAAyB;KACnD,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAoDD;;GAEG;AACH,SAAgB,WAAW,CAAC,QAAuB,EAAE,GAAW;IAC9D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,YAAY,CAAC,IAAsB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,MAAM,SAAS,GAAsB;QACnC,GAAG,OAAO,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAuB;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,oEAAoE;QACpE,6DAA6D;QAC7D,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,8BAAsB,CAAC;QACzD,GAAG,CACD,QAAQ,EACR;YACE,OAAO;YACP,YAAY;YACZ,QAAQ;YACR,oBAAoB;YACpB,cAAc;YACd,IAAI;YACJ,QAAQ;YACR,IAAI;YACJ,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,OAAO;SACb,EACD;YACE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,SAAS;SACf,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;QACzD,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,SAAS,GAAG,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrD,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAE/E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,OAAO,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,8EAA8E;IAC9E,6CAA6C;IAC7C,GAAG,CACD,QAAQ,EACR,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACtE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CACrE,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IACxC,IAAI,OAAgB,CAAC;IACrB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,uEAAuE;YACvE,qEAAqE;YACrE,wBAAwB;YACxB,OAAO,GAAG,QAAQ,CAChB,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAC3F,CAAC;YACF,MAAM,GAAG,IAAI,CAAC;YACd,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,cAAe,OAAiB,EAAE,OAAO,IAAI,SAAS,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,wBAAe,EAAC,OAAO,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,IAAI,OAAQ,GAAc,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAQ,GAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,4BAA4B,CACnC,GAAU,EACV,MAAc,EACd,GAAsB,EACtB,UAAyB;IAEzB,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,MAAM,UAAU,GAAG,QAAQ,CACzB,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;QACzD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG;KACJ,CAAC,CACH,CAAC;IACF,MAAM,cAAc,GAAG,IAAA,8BAAqB,EAAC,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,0DAA0D;YACrE,mFAAmF;YACnF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,2BAA2B,UAAU,oBAAoB;YACjF,UAAU,cAAc,2DAA2D;YACnF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAWD;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,IAAqB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC"}
+{"version":3,"file":"baas.js","sourceRoot":"","sources":["../../src/_lib/baas.ts"],"names":[],"mappings":";;;AA6GA,wCAiBC;AAyDD,kCAEC;AAwCD,oCAmIC;AAyED,kCAIC;AAjbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,iDAA6C;AAC7C,iEAAuD;AAEvD,+BAA2C;AAC3C,qCAAkE;AAElE,mDAAqD;AACrD,2CAAmD;AAEnD,sFAAsF;AACzE,QAAA,yBAAyB,GAAG,OAAO,CAAC;AAEjD;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,aAAa,CAAC;AAuCpD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,aAAa,EAAE,IAAA,gCAAoB,EAAC,IAAI,CAAC,OAAO,CAAC;QACjD,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iCAAyB;KACnD,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAsDD;;GAEG;AACH,SAAgB,WAAW,CAAC,QAAuB,EAAE,GAAW;IAC9D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,SAAgB,YAAY,CAAC,IAAsB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,MAAM,SAAS,GAAsB;QACnC,GAAG,OAAO,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAuB;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,oEAAoE;QACpE,6DAA6D;QAC7D,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,8BAAsB,CAAC;QACzD,GAAG,CACD,QAAQ,EACR;YACE,OAAO;YACP,YAAY;YACZ,QAAQ;YACR,oBAAoB;YACpB,cAAc;YACd,IAAI;YACJ,QAAQ;YACR,IAAI;YACJ,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,OAAO;SACb,EACD;YACE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,SAAS;SACf,CACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,mBAAmB;IACnB,IAAA,kCAAkB,EAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;QACzD,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,SAAS,GAAG,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrD,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAE/E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,OAAO,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,8EAA8E;IAC9E,6CAA6C;IAC7C,GAAG,CACD,QAAQ,EACR,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACtE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CACrE,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IACxC,IAAI,OAAgB,CAAC;IACrB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,uEAAuE;YACvE,qEAAqE;YACrE,wBAAwB;YACxB,OAAO,GAAG,QAAQ,CAChB,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAC3F,CAAC;YACF,MAAM,GAAG,IAAI,CAAC;YACd,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,cAAe,OAAiB,EAAE,OAAO,IAAI,SAAS,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,wBAAe,EAAC,OAAO,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,IAAI,OAAQ,GAAc,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAQ,GAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,4BAA4B,CACnC,GAAU,EACV,MAAc,EACd,GAAsB,EACtB,UAAyB;IAEzB,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,MAAM,UAAU,GAAG,QAAQ,CACzB,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;QACzD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG;KACJ,CAAC,CACH,CAAC;IACF,MAAM,cAAc,GAAG,IAAA,8BAAqB,EAAC,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,0DAA0D;YACrE,mFAAmF;YACnF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,2BAA2B,UAAU,oBAAoB;YACjF,UAAU,cAAc,2DAA2D;YACnF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAWD;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,IAAqB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAK,4BAAiC,CAAC;IAC7D,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC"}

package/dist/_lib/framework.js

@@ -15,8 +15,8 @@ exports.resolveSdkVersion = resolveSdkVersion;
  *
  * Detection is dependency-driven (reads the project's `package.json`), matching
  * the real showcase apps:
- *   - backend  (`apps/showcase/smart-app`):   `@hsuite/smart-engines-sdk` + `@nestjs/core`
- *   - frontend (`apps/showcase/ionic-dapp`):  `@hsuite/native-connect-*`  + `@ionic/angular`
+ *   - backend  (`smart-app/` in showcase-smart-app):   `@hsuite/smart-engines-sdk` + `@nestjs/core`
+ *   - frontend (`ionic-dapp/` in showcase-smart-app):  `@hsuite/native-connect-*`  + `@ionic/angular`
  *
  * This module is PURE I/O-at-the-edge: it reads one file and classifies. No
  * network, no clock.

package/dist/_lib/image-hygiene.d.ts

@@ -0,0 +1,36 @@
+import type { RunFn } from './run-fn';
+/** Compiled-output directories a smart-app image conventionally ships under its `WorkingDir`. */
+export declare const IMAGE_HYGIENE_SCAN_DIRS: readonly ["dist", "build", "lib"];
+/** Entry suffixes that must never ship in a customer image. */
+export declare const IMAGE_HYGIENE_FORBIDDEN_SUFFIXES: readonly [".map", ".d.ts", ".tsbuildinfo"];
+/** Thrown when the built image ships source maps / declarations. `violations` lists every entry. */
+export declare class ImageHygieneError extends Error {
+    readonly image: string;
+    readonly violations: string[];
+    constructor(image: string, violations: string[]);
+}
+/**
+ * Entry names of a (ustar / PAX / GNU) tar archive. Contents are skipped by
+ * size; only names are returned. Tolerant: stops at the first zero block or a
+ * truncated header, so a non-archive buffer yields `[]`.
+ */
+export declare function listTarEntries(tar: Buffer): string[];
+/** Entries that must never ship in a customer image. */
+export declare function findImageHygieneViolations(entries: readonly string[]): string[];
+export type AssertImageHygieneOpts = {
+    /** Local image ref to scan (the freshly built `hsuite-local/<name>:<tag>`). */
+    image: string;
+    /** `execFileSync`-shaped seam (see {@link RunFn}). */
+    run: RunFn;
+    /** Env threaded to every docker leg (carries `DOCKER_HOST`). */
+    env: NodeJS.ProcessEnv;
+    /** Progress / warning sink. */
+    log?: (message: string) => void;
+};
+/**
+ * Scan the built image's compiled output and THROW {@link ImageHygieneError}
+ * if it ships source maps, declaration files or tsbuildinfo. See the module
+ * header for the mechanism and the fail-closed contract.
+ */
+export declare function assertImageHygiene(opts: AssertImageHygieneOpts): void;
+//# sourceMappingURL=image-hygiene.d.ts.map

package/dist/_lib/image-hygiene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-hygiene.d.ts","sourceRoot":"","sources":["../../src/_lib/image-hygiene.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,mCAAoC,CAAC;AAEzE,+DAA+D;AAC/D,eAAO,MAAM,gCAAgC,4CAA6C,CAAC;AAqB3F,oGAAoG;AACpG,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE;gBADpB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAAE;CAWhC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BpD;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE/E;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,GAAG,EAAE,KAAK,CAAC;IACX,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAyCrE"}

package/dist/_lib/image-hygiene.js

@@ -0,0 +1,233 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImageHygieneError = exports.IMAGE_HYGIENE_FORBIDDEN_SUFFIXES = exports.IMAGE_HYGIENE_SCAN_DIRS = void 0;
+exports.listTarEntries = listTarEntries;
+exports.findImageHygieneViolations = findImageHygieneViolations;
+exports.assertImageHygiene = assertImageHygiene;
+/**
+ * `hsuite deploy` image-hygiene gate — HSUITEPT-5 (#3245).
+ *
+ * The pentest pulled a customer image whose compiled output shipped 98
+ * `.js.map`, 49 `.d.ts` and JSDoc-preserved `.js` files: the backend read like
+ * source, handing an attacker every guard condition and fallback path before
+ * touching the live app. The registry side (tenant Harbor projects served to
+ * anonymous pullers) is closed in the provisioner; this closes the image side
+ * at the one choke point the platform owns for a customer build — the CLI,
+ * right after `docker build` and BEFORE anything is tagged, logged in, or
+ * pushed. App-side tsconfig/Dockerfile hygiene is never relied on.
+ *
+ * Mechanism (no shell inside the image — a distroless runtime has none):
+ *   docker inspect -f '{{.Config.WorkingDir}}' <image>   → where the app lives
+ *   docker create <image>                               → throwaway container
+ *   docker cp <id>:<workdir>/<dir> -                    → tar of each compiled
+ *                                                          output dir (dist/…)
+ *   docker rm -f <id>                                   → always, even on throw
+ * The tar is parsed for ENTRY NAMES only; contents are never inspected. Only
+ * the conventional compiled-output dirs are scanned, so `node_modules/` (whose
+ * published packages legitimately ship `.d.ts` / `.map`) is never a false hit.
+ *
+ * Fail closed: any offending entry aborts the deploy with the full list and
+ * the fix. An absent output dir is "nothing to scan" (a warning when none of
+ * the conventional dirs exists at all — the gate could not see the app code).
+ * A `docker cp` that fails for any OTHER reason is also fatal — only docker's
+ * own not-found signature means "absent"; anything else is a scan that did not
+ * happen, and the gate must never report one it did not perform.
+ */
+const path_1 = require("path");
+/** Compiled-output directories a smart-app image conventionally ships under its `WorkingDir`. */
+exports.IMAGE_HYGIENE_SCAN_DIRS = ['dist', 'build', 'lib'];
+/** Entry suffixes that must never ship in a customer image. */
+exports.IMAGE_HYGIENE_FORBIDDEN_SUFFIXES = ['.map', '.d.ts', '.tsbuildinfo'];
+/** `docker cp` of a compiled dist/ is a few MB; the default 1 MiB `execFileSync` buffer is not enough. */
+const TAR_MAX_BUFFER_BYTES = 256 * 1024 * 1024;
+/**
+ * Docker's "this path is not in the image" signature — the ONE `docker cp`
+ * failure that legitimately means "nothing to scan". Matched against the
+ * child's stderr, which docker populates for this wording.
+ *
+ * Deliberately NOT also matching a bare `no such file or directory`: that is
+ * the daemon's OS-level errno text, which appears when the READ failed (a
+ * pruned or corrupt overlay2 graph) rather than when the path is absent. The
+ * two must not collapse — a real not-found read as fatal only aborts a deploy
+ * the operator can re-run, while a broken read taken as "absent" silently
+ * disables the gate.
+ */
+const DOCKER_CP_MISSING_RE = /could not find the file/i;
+const TAR_BLOCK = 512;
+/** Thrown when the built image ships source maps / declarations. `violations` lists every entry. */
+class ImageHygieneError extends Error {
+    image;
+    violations;
+    constructor(image, violations) {
+        super(`Image hygiene gate (HSUITEPT-5): ${image} ships ${violations.length} file(s) that expose ` +
+            `the app's source and must not be deployed:\n` +
+            violations.map((v) => `  - ${v}`).join('\n') +
+            `\nBuild the backend with sourceMap/declaration OFF and removeComments ON (a production ` +
+            `tsconfig), or exclude them from the image (.dockerignore), then re-run \`hsuite deploy\`.`);
+        this.image = image;
+        this.violations = violations;
+        this.name = 'ImageHygieneError';
+    }
+}
+exports.ImageHygieneError = ImageHygieneError;
+/**
+ * Entry names of a (ustar / PAX / GNU) tar archive. Contents are skipped by
+ * size; only names are returned. Tolerant: stops at the first zero block or a
+ * truncated header, so a non-archive buffer yields `[]`.
+ */
+function listTarEntries(tar) {
+    const names = [];
+    let pendingLongName = null;
+    for (let off = 0; off + TAR_BLOCK <= tar.length;) {
+        const header = tar.subarray(off, off + TAR_BLOCK);
+        if (header.every((b) => b === 0))
+            break;
+        const size = parseInt(cstr(header, 124, 12) || '0', 8) || 0;
+        const type = String.fromCharCode(header[156] || 0x30);
+        const data = tar.subarray(off + TAR_BLOCK, off + TAR_BLOCK + size);
+        off += TAR_BLOCK + Math.ceil(size / TAR_BLOCK) * TAR_BLOCK;
+        if (type === 'L') {
+            pendingLongName = cstr(data, 0, data.length); // GNU long name
+            continue;
+        }
+        if (type === 'x') {
+            pendingLongName = paxPath(data.toString('utf8')) ?? pendingLongName; // PAX extended header
+            continue;
+        }
+        if (type === 'g')
+            continue; // PAX global header
+        const prefix = cstr(header, 345, 155);
+        const name = cstr(header, 0, 100);
+        names.push(pendingLongName ?? (prefix ? `${prefix}/${name}` : name));
+        pendingLongName = null;
+    }
+    return names;
+}
+/** Entries that must never ship in a customer image. */
+function findImageHygieneViolations(entries) {
+    return entries.filter((e) => exports.IMAGE_HYGIENE_FORBIDDEN_SUFFIXES.some((s) => e.endsWith(s)));
+}
+/**
+ * Scan the built image's compiled output and THROW {@link ImageHygieneError}
+ * if it ships source maps, declaration files or tsbuildinfo. See the module
+ * header for the mechanism and the fail-closed contract.
+ */
+function assertImageHygiene(opts) {
+    const { image, run, env } = opts;
+    const log = opts.log ?? (() => undefined);
+    const utf8 = { stdio: ['ignore', 'pipe', 'inherit'], encoding: 'utf8', env };
+    const workdir = asText(run('docker', ['inspect', '-f', '{{.Config.WorkingDir}}', image], utf8)) || '/';
+    const cid = asText(run('docker', ['create', image], utf8));
+    if (!cid)
+        throw new Error(`image hygiene gate: \`docker create ${image}\` returned no container id`);
+    try {
+        const violations = [];
+        let scanned = 0;
+        for (const dir of exports.IMAGE_HYGIENE_SCAN_DIRS) {
+            const entries = copyOut(run, `${cid}:${path_1.posix.join(workdir, dir)}`, env);
+            if (entries === null)
+                continue;
+            scanned++;
+            const files = entries.filter((e) => !e.endsWith('/'));
+            const bad = findImageHygieneViolations(files);
+            violations.push(...bad);
+            log(`  image hygiene: ${dir}/ — ${files.length} file(s), ${bad.length} offending`);
+        }
+        if (scanned === 0) {
+            log(`  ⚠ image hygiene: no compiled output found under ${workdir} (${exports.IMAGE_HYGIENE_SCAN_DIRS.join('/')}) — ` +
+                `nothing to scan`);
+        }
+        if (violations.length > 0)
+            throw new ImageHygieneError(image, violations);
+    }
+    finally {
+        // Best-effort reaping. A throw from a `finally` REPLACES the in-flight
+        // exception, so an unchecked `docker rm` would mask an `ImageHygieneError`
+        // verdict with a docker error — but a leaked container is still worth a
+        // line rather than being silent.
+        try {
+            run('docker', ['rm', '-f', cid], { stdio: 'ignore', env });
+        }
+        catch (err) {
+            log(`  ⚠ image hygiene: could not remove scan container ${cid}: ${errorText(err)}`);
+        }
+    }
+}
+/**
+ * `docker cp <src> -` → entry names, or `null` when the path genuinely does not
+ * exist in the image.
+ *
+ * FAIL CLOSED: only docker's own not-found signature maps to `null`. Every
+ * other failure — a `maxBuffer` overflow on an unexpectedly huge directory, a
+ * dead container, a dropped daemon — is rethrown, because the gate cannot
+ * distinguish a broken read from an absent directory and must not report a scan
+ * it did not perform. stderr is PIPED rather than discarded so that signature
+ * is actually visible; with stderr `ignore`d, `execFileSync`'s error carries no
+ * docker text and EVERY failure reads as "not found".
+ */
+function copyOut(run, src, env) {
+    let out;
+    try {
+        out = run('docker', ['cp', src, '-'], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env,
+            maxBuffer: TAR_MAX_BUFFER_BYTES,
+        });
+    }
+    catch (err) {
+        const text = errorText(err);
+        if (DOCKER_CP_MISSING_RE.test(text))
+            return null;
+        throw new Error(`image hygiene gate: \`docker cp ${src} -\` failed, so the built image could not be ` +
+            `scanned — refusing to deploy an unscanned image: ${text}`);
+    }
+    // A non-Buffer means the seam decoded the archive, and a utf8 round-trip
+    // corrupts tar bytes into a buffer that parses as empty — a contract
+    // violation that would have read as "clean scan". Fail closed on it.
+    if (!Buffer.isBuffer(out)) {
+        throw new Error(`image hygiene gate: \`docker cp ${src} -\` returned ${typeof out}, not a tar buffer — ` +
+            `the run seam must not set \`encoding\` on this leg`);
+    }
+    return listTarEntries(out);
+}
+/**
+ * Message plus captured stderr of a thrown child-process error, for signature
+ * matching.
+ *
+ * TOTAL by construction: this runs inside `catch` blocks — including the
+ * `finally` that reaps the scan container — and `String()` throws on a
+ * null-prototype object or a hostile `Symbol.toPrimitive`. A throw from here
+ * would REPLACE the in-flight `ImageHygieneError`, i.e. the gate's verdict
+ * would be masked by a logging failure. Unstringifiable input therefore
+ * degrades to a literal rather than propagating.
+ */
+function errorText(err) {
+    try {
+        const stderr = err.stderr;
+        const tail = Buffer.isBuffer(stderr) ? stderr.toString('utf8') : String(stderr ?? '');
+        const head = err instanceof Error ? err.message : String(err);
+        return `${head}\n${tail}`.trim();
+    }
+    catch {
+        return '[unstringifiable error]';
+    }
+}
+function asText(out) {
+    return typeof out === 'string'
+        ? out.trim()
+        : Buffer.isBuffer(out)
+            ? out.toString('utf8').trim()
+            : '';
+}
+/** NUL-terminated ASCII field of a tar header / GNU long-name block. */
+function cstr(buf, start, len) {
+    const slice = buf.subarray(start, start + len);
+    const nul = slice.indexOf(0);
+    return slice.subarray(0, nul === -1 ? slice.length : nul).toString('utf8');
+}
+/** The `path=` record of a PAX extended header (`"<len> path=<value>\n"` lines). */
+function paxPath(pax) {
+    const m = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(pax);
+    return m ? m[1] : null;
+}
+//# sourceMappingURL=image-hygiene.js.map

package/dist/_lib/image-hygiene.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-hygiene.js","sourceRoot":"","sources":["../../src/_lib/image-hygiene.ts"],"names":[],"mappings":";;;AA+EA,wCA0BC;AAGD,gEAEC;AAkBD,gDAyCC;AAzKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,+BAA6B;AAG7B,iGAAiG;AACpF,QAAA,uBAAuB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAEzE,+DAA+D;AAClD,QAAA,gCAAgC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAU,CAAC;AAE3F,0GAA0G;AAC1G,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,oGAAoG;AACpG,MAAa,iBAAkB,SAAQ,KAAK;IAE/B;IACA;IAFX,YACW,KAAa,EACb,UAAoB;QAE7B,KAAK,CACH,oCAAoC,KAAK,UAAU,UAAU,CAAC,MAAM,uBAAuB;YACzF,8CAA8C;YAC9C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5C,yFAAyF;YACzF,2FAA2F,CAC9F,CAAC;QATO,UAAK,GAAL,KAAK,CAAQ;QACb,eAAU,GAAV,UAAU,CAAU;QAS7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAdD,8CAcC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,GAAI,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QACnE,GAAG,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;QAE3D,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,sBAAsB;YAC3F,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS,CAAC,oBAAoB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,SAAgB,0BAA0B,CAAC,OAA0B;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAaD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAA4B;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,GAAG,EAAE,CAAC;IAEtF,MAAM,OAAO,GACX,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG;QACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,6BAA6B,CAAC,CAAC;IAE7F,IAAI,CAAC;QACH,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,+BAAuB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,YAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACxE,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAS;YAC/B,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAC9C,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACxB,GAAG,CAAC,oBAAoB,GAAG,OAAO,KAAK,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,GAAG,CACD,qDAAqD,OAAO,KAAK,+BAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;gBACtG,iBAAiB,CACpB,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,iCAAiC;QACjC,IAAI,CAAC;YACH,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,sDAAsD,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,OAAO,CAAC,GAAU,EAAE,GAAW,EAAE,GAAsB;IAC9D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE;YACpC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,+CAA+C;YACnF,oDAAoD,IAAI,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,iBAAiB,OAAO,GAAG,uBAAuB;YACtF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yBAAyB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,OAAO,GAAG,KAAK,QAAQ;QAC5B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACZ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAC7B,CAAC,CAAC,EAAE,CAAC;AACX,CAAC;AAED,wEAAwE;AACxE,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,oFAAoF;AACpF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC"}