@vqh2602/mini-app-sdk 1.0.7 → 1.0.8

package/README.md

@@ -218,3 +218,12 @@ Sau khi sửa SDK trong repository, chạy `npm run build:miniapps` từ thư m
 ### Timeout khi chờ người dùng
 
 Native và simulator mặc định chờ tối đa 5 phút cho quét QR/mã vạch, camera, chọn ảnh/video/file, ghi âm, hộp thoại quyền và checkout; các action khác chờ tối đa 60 giây. Huỷ thao tác từ giao diện native vẫn trả lỗi `CANCELLED` ngay. `timeoutMs` khi khởi tạo SDK hoặc tham số thứ ba của `transport.invoke` sẽ ghi đè mặc định này. Playground dùng chính sách của SDK, không ép timeout 8 giây.
+
+## Sinh trắc học
+
+Dùng `superApp.auth.checkBiometrics()` để kiểm tra hỗ trợ và thiết lập; nếu
+`canAuthenticate === true`, gọi `superApp.auth.authenticateBiometric({ reason: "Xác thực để tiếp tục" })`
+và chỉ tiếp tục khi `authenticated === true`. Host tự kiểm tra lại trước khi mở
+hộp thoại hệ thống; yêu cầu phiên SuperApp đang đăng nhập.
+
+[Hợp đồng API, lỗi và ví dụ đầy đủ](../docs/authentication.md#xác-thực-sinh-trắc-học-trong-mini-app).

package/bin/simulator.js

@@ -19,6 +19,7 @@ Usage: superapp-simulator [options]
 
 Options:
   --port <number>    Port to run simulator on (default: 5175)
+  --host <string>    Host interface to bind to (default: 127.0.0.1)
   -h, --help         Show this help message
 `);
   process.exit(0);
@@ -27,6 +28,9 @@ Options:
 const portIndex = args.indexOf('--port');
 const port = portIndex !== -1 && args[portIndex + 1] ? parseInt(args[portIndex + 1], 10) : 5175;
 
+const hostIndex = args.indexOf('--host');
+const host = hostIndex !== -1 && args[hostIndex + 1] ? args[hostIndex + 1] : '127.0.0.1';
+
 const MIME_TYPES = {
   '.html': 'text/html; charset=utf-8',
   '.js': 'application/javascript; charset=utf-8',
@@ -39,9 +43,35 @@ const MIME_TYPES = {
   '.woff2': 'font/woff2',
 };
 
+function isAllowedCorsOrigin(origin) {
+  if (!origin || typeof origin !== 'string') return false;
+  try {
+    const url = new URL(origin);
+    return (
+      url.hostname === 'localhost' ||
+      url.hostname === '127.0.0.1' ||
+      url.hostname === '[::1]' ||
+      url.hostname.endsWith('.localhost')
+    );
+  } catch (_) {
+    return false;
+  }
+}
+
 const server = http.createServer((req, res) => {
-  res.setHeader('Access-Control-Allow-Origin', '*');
-  res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+  // Restricted CORS policy: only allow trusted local origins
+  const reqOrigin = req.headers.origin;
+  if (reqOrigin && isAllowedCorsOrigin(reqOrigin)) {
+    res.setHeader('Access-Control-Allow-Origin', reqOrigin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, x-tenant-id');
+    res.setHeader('Vary', 'Origin');
+  }
+
+  // Security Headers
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
 
   if (req.method === 'OPTIONS') {
     res.writeHead(204);
@@ -49,7 +79,7 @@ const server = http.createServer((req, res) => {
     return;
   }
 
-  const parsedUrl = new URL(req.url, `http://localhost:${port}`);
+  const parsedUrl = new URL(req.url, `http://${host}:${port}`);
   let pathname = parsedUrl.pathname;
   let filePath = path.join(distDir, pathname);
 
@@ -89,7 +119,7 @@ server.on('error', (err) => {
   }
 });
 
-server.listen(port, () => {
-  console.log(`\n📱 \x1b[36mSuperApp Browser Simulator\x1b[0m is running at: \x1b[1mhttp://localhost:${port}\x1b[0m`);
-  console.log(`🔗 Open with target Mini App: \x1b[32mhttp://localhost:${port}/?url=http://localhost:3000\x1b[0m\n`);
+server.listen(port, host, () => {
+  console.log(`\n📱 \x1b[36mSuperApp Browser Simulator\x1b[0m is running at: \x1b[1mhttp://${host}:${port}\x1b[0m`);
+  console.log(`🔗 Open with target Mini App: \x1b[32mhttp://${host}:${port}/?url=http://localhost:3000\x1b[0m\n`);
 });

package/dist/cli/commands/dev.d.ts

@@ -1,6 +1,7 @@
 export interface DevCommandOptions {
     port?: string;
     simulatorPort?: string;
+    host?: string;
     open?: boolean;
     noSimulator?: boolean;
 }

package/dist/cli/commands/dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/dev.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,SAAS,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC9E"}
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/dev.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,SAAS,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwC9E"}

package/dist/cli/commands/dev.js

@@ -6,19 +6,20 @@ export async function devServer(options = {}) {
     const manifest = loadManifest();
     const port = options.port || '3000';
     const simulatorPort = options.simulatorPort || '5175';
+    const host = options.host || '127.0.0.1';
     logger.title(`Khởi chạy Mini App Development Server`);
     logger.info(`Đang chạy ứng dụng: ${manifest.name} (${manifest.appId})`);
     let simServer = null;
     if (!options.noSimulator) {
         try {
-            simServer = startSimulatorServer(parseInt(simulatorPort, 10));
+            simServer = startSimulatorServer(parseInt(simulatorPort, 10), host);
         }
         catch (e) {
             logger.warn(`Không thể khởi chạy Simulator trên cổng ${simulatorPort}`);
         }
     }
     logger.info(`Vite Server: http://localhost:${port}`);
-    logger.info(`Browser Simulator: http://localhost:${simulatorPort}/?url=http://localhost:${port}`);
+    logger.info(`Browser Simulator: http://${host}:${simulatorPort}/?url=http://localhost:${port}`);
     const child = spawn('npx', ['vite', '--port', port], {
         stdio: 'inherit',
         shell: true,

package/dist/cli/commands/dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../../src/cli/commands/dev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAS1D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA6B,EAAE;IAC7D,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IACpC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAEtD,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;IAExE,IAAI,SAAS,GAAQ,IAAI,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,2CAA2C,aAAa,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,uCAAuC,aAAa,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QACnD,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../../src/cli/commands/dev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA6B,EAAE;IAC7D,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IACpC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAEzC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;IAExE,IAAI,SAAS,GAAQ,IAAI,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,2CAA2C,aAAa,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,IAAI,aAAa,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAEhG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QACnD,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/simulator.d.ts

@@ -1,5 +1,6 @@
 export interface SimulatorCommandOptions {
     port?: string;
+    host?: string;
     appUrl?: string;
 }
 export declare function runSimulator(options?: SimulatorCommandOptions): Promise<void>;

package/dist/cli/commands/simulator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simulator.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/simulator.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAavF"}
+{"version":3,"file":"simulator.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/simulator.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAcvF"}

package/dist/cli/commands/simulator.js

@@ -2,10 +2,11 @@ import { startSimulatorServer } from '../utils/server.js';
 import { logger } from '../utils/logger.js';
 export async function runSimulator(options = {}) {
     const port = parseInt(options.port || '5175', 10);
+    const host = options.host || '127.0.0.1';
     const appUrl = options.appUrl || 'http://localhost:3000';
     logger.title(`Khởi chạy SuperApp Browser Simulator & DevTools`);
-    startSimulatorServer(port);
-    logger.info(`Để kết nối với Mini App, mở: http://localhost:${port}/?url=${encodeURIComponent(appUrl)}`);
+    startSimulatorServer(port, host);
+    logger.info(`Để kết nối với Mini App, mở: http://${host}:${port}/?url=${encodeURIComponent(appUrl)}`);
     process.on('SIGINT', () => {
         logger.info('Đang dừng Browser Simulator...');
         process.exit(0);

package/dist/cli/commands/simulator.js.map

@@ -1 +1 @@
-{"version":3,"file":"simulator.js","sourceRoot":"","sources":["../../../src/cli/commands/simulator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAO5C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAmC,EAAE;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAuB,CAAC;IAEzD,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAChE,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC,iDAAiD,IAAI,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAExG,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"simulator.js","sourceRoot":"","sources":["../../../src/cli/commands/simulator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQ5C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAmC,EAAE;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAuB,CAAC;IAEzD,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAChE,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEjC,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,IAAI,IAAI,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEtG,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/upload.d.ts

@@ -2,8 +2,11 @@ export interface UploadCommandOptions {
     registry?: string;
     tenantId?: string;
     actorId?: string;
+    token?: string;
+    secret?: string;
     submit?: boolean;
     notes?: string;
+    cwd?: string;
 }
 export declare function uploadProject(options?: UploadCommandOptions): Promise<void>;
 //# sourceMappingURL=upload.d.ts.map

package/dist/cli/commands/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/upload.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgHrF"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/upload.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmIrF"}

package/dist/cli/commands/upload.js

@@ -2,13 +2,36 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { loadManifest } from '../utils/config.js';
 import { logger } from '../utils/logger.js';
+import { buildRequestHeaders, resolveCredentials } from '../utils/auth.js';
 export async function uploadProject(options = {}) {
-    const manifest = loadManifest();
+    const cwd = options.cwd || process.cwd();
+    const manifest = loadManifest(cwd);
     const registryUrl = options.registry || process.env.SUPERAPP_REGISTRY_URL || 'http://localhost:3000';
-    const tenantId = options.tenantId || 'tenant_001';
-    const actorId = options.actorId || 'dev_partner_001';
+    const credentials = resolveCredentials(options);
     logger.title(`Tải lên SuperApp Dynamic Registry: ${manifest.name}`);
-    const distPath = path.resolve(process.cwd(), 'dist');
+    // Validate authentication requirement
+    const isLocalRegistry = registryUrl.startsWith('http://localhost') ||
+        registryUrl.startsWith('http://127.0.0.1') ||
+        registryUrl.startsWith('http://[::1]');
+    if (!credentials.token && !credentials.secret) {
+        if (!isLocalRegistry) {
+            const authError = 'Lỗi bảo mật: Tải lên server remote yêu cầu xác thực. Vui lòng cung cấp Access Token qua cờ --token <token> hoặc biến môi trường SUPERAPP_API_TOKEN.';
+            logger.error(authError);
+            throw new Error(authError);
+        }
+        else {
+            logger.warn('⚠️  Đang tải lên registry local không có token xác thực. Trong môi trường production, backend sẽ từ chối x-tenant-id / x-user-id không có Bearer token hợp lệ.');
+        }
+    }
+    else {
+        const authMechanisms = [];
+        if (credentials.token)
+            authMechanisms.push('Bearer Token (OAuth/JWT)');
+        if (credentials.secret)
+            authMechanisms.push('HMAC-SHA256 Payload Signature');
+        logger.success(`Đã kích hoạt cơ chế xác thực: ${authMechanisms.join(' + ')}`);
+    }
+    const distPath = path.resolve(cwd, 'dist');
     const metaPath = path.join(distPath, 'bundle-meta.json');
     if (!fs.existsSync(metaPath)) {
         logger.warn('Chưa tìm thấy bundle đã build. Đang tự động chạy build trước...');
@@ -17,7 +40,7 @@ export async function uploadProject(options = {}) {
     }
     const bundleMeta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
     logger.step(1, 3, `Đang kết nối đến Dynamic Registry Backend: ${registryUrl}`);
-    logger.info(`Tenant ID: ${tenantId}`);
+    logger.info(`Tenant ID: ${credentials.tenantId}`);
     logger.info(`App ID: ${manifest.appId} (v${manifest.version})`);
     // Payload aligning with backend RegistryService
     const updatePayload = {
@@ -38,28 +61,25 @@ export async function uploadProject(options = {}) {
     try {
         // 1. Check or update draft
         logger.step(2, 3, `Cập nhật bản thảo (Draft) lên Registry...`);
+        const updateHeaders = buildRequestHeaders(credentials, updatePayload);
         const updateRes = await fetch(`${registryUrl}/api/v1/registry/apps/${manifest.appId}`, {
             method: 'PUT',
-            headers: {
-                'Content-Type': 'application/json',
-                'x-tenant-id': tenantId,
-            },
+            headers: updateHeaders,
             body: JSON.stringify(updatePayload),
         });
         if (!updateRes.ok) {
             // If 404, create new draft
             if (updateRes.status === 404) {
                 logger.info(`Mini App chưa tồn tại. Đang tạo mới bản ghi ứng dụng...`);
+                const createPayload = {
+                    appId: manifest.appId,
+                    ...updatePayload,
+                };
+                const createHeaders = buildRequestHeaders(credentials, createPayload);
                 const createRes = await fetch(`${registryUrl}/api/v1/registry/apps`, {
                     method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        'x-tenant-id': tenantId,
-                    },
-                    body: JSON.stringify({
-                        appId: manifest.appId,
-                        ...updatePayload,
-                    }),
+                    headers: createHeaders,
+                    body: JSON.stringify(createPayload),
                 });
                 if (!createRes.ok) {
                     const errText = await createRes.text();
@@ -75,17 +95,15 @@ export async function uploadProject(options = {}) {
         // 2. Submit for review if requested
         if (options.submit) {
             logger.step(3, 3, `Gửi yêu cầu xét duyệt phiên bản ${manifest.version}...`);
+            const submitPayload = {
+                version: manifest.version,
+                changelog: options.notes || `Phát hành phiên bản ${manifest.version} từ Mini App CLI`,
+            };
+            const submitHeaders = buildRequestHeaders(credentials, submitPayload);
             const submitRes = await fetch(`${registryUrl}/api/v1/registry/apps/${manifest.appId}/submit`, {
                 method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'x-tenant-id': tenantId,
-                    'x-user-id': actorId,
-                },
-                body: JSON.stringify({
-                    version: manifest.version,
-                    changelog: options.notes || `Phát hành phiên bản ${manifest.version} từ Mini App CLI`,
-                }),
+                headers: submitHeaders,
+                body: JSON.stringify(submitPayload),
             });
             if (!submitRes.ok) {
                 const errText = await submitRes.text();
@@ -101,7 +119,7 @@ export async function uploadProject(options = {}) {
     }
     catch (err) {
         logger.error('Lỗi khi tải lên SuperApp Registry:', err.message);
-        process.exit(1);
+        throw err;
     }
 }
 //# sourceMappingURL=upload.js.map

package/dist/cli/commands/upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/cli/commands/upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAU5C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAgC,EAAE;IACpE,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,uBAAuB,CAAC;IACrG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,iBAAiB,CAAC;IAErD,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAEzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC/E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAElE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,8CAA8C,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAEhE,gDAAgD;IAChD,MAAM,aAAa,GAAG;QACpB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,WAAW;QAC1C,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;QACvC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;QAC/B,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE;YACX,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,SAAS;YAC5C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC;KACF,CAAC;IAEF,IAAI,CAAC;QACH,2BAA2B;QAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,yBAAyB,QAAQ,CAAC,KAAK,EAAE,EAAE;YACrF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,QAAQ;aACxB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,2BAA2B;YAC3B,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;gBACvE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,uBAAuB,EAAE;oBACnE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,QAAQ;qBACxB;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,GAAG,aAAa;qBACjB,CAAC;iBACH,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAEzD,oCAAoC;QACpC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,mCAAmC,QAAQ,CAAC,OAAO,KAAK,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,yBAAyB,QAAQ,CAAC,KAAK,SAAS,EAAE;gBAC5F,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,QAAQ;oBACvB,WAAW,EAAE,OAAO;iBACrB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,uBAAuB,QAAQ,CAAC,OAAO,kBAAkB;iBACtF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;YACnF,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,+BAA+B,QAAQ,CAAC,OAAO,yBAAyB,CAAC,CAAC;YACzF,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,kEAAkE,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/cli/commands/upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAa3E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAgC,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,uBAAuB,CAAC;IACrG,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpE,sCAAsC;IACtC,MAAM,eAAe,GACnB,WAAW,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAC1C,WAAW,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAC1C,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAEzC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,SAAS,GACb,qJAAqJ,CAAC;YACxJ,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,gKAAgK,CACjK,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,IAAI,WAAW,CAAC,KAAK;YAAE,cAAc,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvE,IAAI,WAAW,CAAC,MAAM;YAAE,cAAc,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7E,MAAM,CAAC,OAAO,CAAC,iCAAiC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAEzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC/E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAElE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,8CAA8C,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,CAAC,cAAc,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAEhE,gDAAgD;IAChD,MAAM,aAAa,GAAG;QACpB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,WAAW;QAC1C,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;QACvC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;QAC/B,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE;YACX,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,SAAS;YAC5C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC;KACF,CAAC;IAEF,IAAI,CAAC;QACH,2BAA2B;QAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,yBAAyB,QAAQ,CAAC,KAAK,EAAE,EAAE;YACrF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,2BAA2B;YAC3B,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;gBACvE,MAAM,aAAa,GAAG;oBACpB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,GAAG,aAAa;iBACjB,CAAC;gBACF,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;gBACtE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,uBAAuB,EAAE;oBACnE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,aAAa;oBACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;iBACpC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAEzD,oCAAoC;QACpC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,mCAAmC,QAAQ,CAAC,OAAO,KAAK,CAAC,CAAC;YAC5E,MAAM,aAAa,GAAG;gBACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,uBAAuB,QAAQ,CAAC,OAAO,kBAAkB;aACtF,CAAC;YACF,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,yBAAyB,QAAQ,CAAC,KAAK,SAAS,EAAE;gBAC5F,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;YACnF,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,+BAA+B,QAAQ,CAAC,OAAO,yBAAyB,CAAC,CAAC;YACzF,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,kEAAkE,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/cli/index.js

@@ -9,7 +9,7 @@ const program = new Command();
 program
     .name('miniapp')
     .description('SuperApp Mini App Developer CLI: Create, Dev, Build, and Upload')
-    .version('1.0.7');
+    .version('1.0.8');
 program
     .command('create <project-name>')
     .description('Khởi tạo một dự án Mini App mới từ mẫu chuẩn SuperApp')
@@ -22,6 +22,7 @@ program
     .description('Khởi chạy Development Server và mở Browser Simulator')
     .option('-p, --port <port>', 'Cổng Vite dev server', '3000')
     .option('-s, --simulator-port <port>', 'Cổng Browser Simulator', '5175')
+    .option('-H, --host <host>', 'Host interface để bind Simulator (mặc định: 127.0.0.1 loopback)', '127.0.0.1')
     .option('--open', 'Tự động mở trình duyệt')
     .option('--no-simulator', 'Không khởi chạy Browser Simulator kèm theo')
     .action((options) => {
@@ -31,6 +32,7 @@ program
     .command('simulator')
     .description('Khởi chạy Browser Simulator & DevTools độc lập')
     .option('-p, --port <port>', 'Cổng Browser Simulator', '5175')
+    .option('-H, --host <host>', 'Host interface để bind Simulator (mặc định: 127.0.0.1 loopback)', '127.0.0.1')
     .option('-u, --app-url <url>', 'Địa chỉ Mini App đang chạy để kết nối', 'http://localhost:3000')
     .action((options) => {
     runSimulator(options);
@@ -46,6 +48,8 @@ program
     .command('upload')
     .description('Tải lên bản nháp hoặc gửi xét duyệt Mini App lên Dynamic Registry Backend')
     .option('-r, --registry <url>', 'Địa chỉ backend registry API', 'http://localhost:3000')
+    .option('-k, --token <token>', 'Access Token hoặc Developer API Token (Bearer)')
+    .option('-s, --secret <secret>', 'Developer Secret Key dùng để ký điện tử (HMAC-SHA256)')
     .option('-t, --tenant-id <tenantId>', 'Mã định danh Tenant', 'tenant_001')
     .option('-a, --actor-id <actorId>', 'Mã người thực hiện tải lên', 'dev_partner_001')
     .option('--submit', 'Gửi trực tiếp vào hàng đợi xét duyệt (SUBMITTED)')

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,iEAAiE,CAAC;KAC9E,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,uBAAuB,CAAC;KAChC,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,2BAA2B,EAAE,oCAAoC,EAAE,YAAY,CAAC;KACvF,MAAM,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IAC/B,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,CAAC;KAC3D,MAAM,CAAC,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,CAAC;KACvE,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;KAC1C,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;KACtE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,SAAS,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,CAAC;KAC7D,MAAM,CAAC,qBAAqB,EAAE,uCAAuC,EAAE,uBAAuB,CAAC;KAC/F,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,CAAC;KACnE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2EAA2E,CAAC;KACxF,MAAM,CAAC,sBAAsB,EAAE,8BAA8B,EAAE,uBAAuB,CAAC;KACvF,MAAM,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,YAAY,CAAC;KACzE,MAAM,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,iBAAiB,CAAC;KACnF,MAAM,CAAC,UAAU,EAAE,kDAAkD,CAAC;KACtE,MAAM,CAAC,qBAAqB,EAAE,8BAA8B,CAAC;KAC7D,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,aAAa,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,GAAG,EAAE;IACX,SAAS,EAAE,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,iEAAiE,CAAC;KAC9E,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,uBAAuB,CAAC;KAChC,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,2BAA2B,EAAE,oCAAoC,EAAE,YAAY,CAAC;KACvF,MAAM,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IAC/B,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,CAAC;KAC3D,MAAM,CAAC,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,CAAC;KACvE,MAAM,CAAC,mBAAmB,EAAE,iEAAiE,EAAE,WAAW,CAAC;KAC3G,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;KAC1C,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;KACtE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,SAAS,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,iEAAiE,EAAE,WAAW,CAAC;KAC3G,MAAM,CAAC,qBAAqB,EAAE,uCAAuC,EAAE,uBAAuB,CAAC;KAC/F,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,CAAC;KACnE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2EAA2E,CAAC;KACxF,MAAM,CAAC,sBAAsB,EAAE,8BAA8B,EAAE,uBAAuB,CAAC;KACvF,MAAM,CAAC,qBAAqB,EAAE,gDAAgD,CAAC;KAC/E,MAAM,CAAC,uBAAuB,EAAE,uDAAuD,CAAC;KACxF,MAAM,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,YAAY,CAAC;KACzE,MAAM,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,iBAAiB,CAAC;KACnF,MAAM,CAAC,UAAU,EAAE,kDAAkD,CAAC;KACtE,MAAM,CAAC,qBAAqB,EAAE,8BAA8B,CAAC;KAC7D,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,aAAa,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,GAAG,EAAE;IACX,SAAS,EAAE,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/cli/utils/auth.d.ts

@@ -0,0 +1,34 @@
+export interface DeveloperCredentials {
+    token?: string;
+    secret?: string;
+    tenantId?: string;
+    actorId?: string;
+}
+export declare function computeHmacSha256(secret: string, data: string): string;
+/**
+ * Searches for locally stored developer credentials in standard CLI paths:
+ * 1. Current working directory: .superapprc, .superapp/credentials.json
+ * 2. User home directory: ~/.superapp/credentials.json, ~/.superapprc
+ */
+export declare function loadStoredCredentials(cwd?: string): DeveloperCredentials;
+/**
+ * Resolves developer credentials with priority:
+ * 1. CLI explicit options
+ * 2. Environment variables (SUPERAPP_API_TOKEN, SUPERAPP_API_SECRET, etc.)
+ * 3. Stored credentials file (~/.superapp/credentials.json)
+ * 4. Default fallback identifiers for local sandbox
+ */
+export declare function resolveCredentials(cliOptions?: {
+    token?: string;
+    secret?: string;
+    tenantId?: string;
+    actorId?: string;
+}): DeveloperCredentials;
+/**
+ * Builds standard secure headers for registry HTTP requests:
+ * - Authorization: Bearer <token> (JWT / OAuth token)
+ * - x-signature & x-signature-timestamp: HMAC-SHA256 signature for payload integrity
+ * - Contextual x-tenant-id and x-user-id
+ */
+export declare function buildRequestHeaders(credentials: DeveloperCredentials, payload?: any, additionalHeaders?: Record<string, string>): Record<string, string>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/utils/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAsB,GAAG,oBAAoB,CA0BvF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,GAAE;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,oBAAoB,CA6B5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,oBAAoB,EACjC,OAAO,CAAC,EAAE,GAAG,EACb,iBAAiB,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB"}

package/dist/cli/utils/auth.js

@@ -0,0 +1,99 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+export function computeHmacSha256(secret, data) {
+    return crypto.createHmac('sha256', secret).update(data).digest('hex');
+}
+/**
+ * Searches for locally stored developer credentials in standard CLI paths:
+ * 1. Current working directory: .superapprc, .superapp/credentials.json
+ * 2. User home directory: ~/.superapp/credentials.json, ~/.superapprc
+ */
+export function loadStoredCredentials(cwd = process.cwd()) {
+    const candidates = [
+        path.join(cwd, '.superapprc'),
+        path.join(cwd, '.superapp', 'credentials.json'),
+        path.join(os.homedir(), '.superapp', 'credentials.json'),
+        path.join(os.homedir(), '.superapprc'),
+    ];
+    for (const filePath of candidates) {
+        if (fs.existsSync(filePath)) {
+            try {
+                const raw = fs.readFileSync(filePath, 'utf-8');
+                const parsed = JSON.parse(raw);
+                if (parsed && typeof parsed === 'object') {
+                    return {
+                        token: parsed.token || parsed.apiToken || parsed.accessToken,
+                        secret: parsed.secret || parsed.apiSecret,
+                        tenantId: parsed.tenantId,
+                        actorId: parsed.actorId || parsed.userId,
+                    };
+                }
+            }
+            catch (_) { }
+        }
+    }
+    return {};
+}
+/**
+ * Resolves developer credentials with priority:
+ * 1. CLI explicit options
+ * 2. Environment variables (SUPERAPP_API_TOKEN, SUPERAPP_API_SECRET, etc.)
+ * 3. Stored credentials file (~/.superapp/credentials.json)
+ * 4. Default fallback identifiers for local sandbox
+ */
+export function resolveCredentials(cliOptions = {}) {
+    const fileCreds = loadStoredCredentials();
+    const token = cliOptions.token ||
+        process.env.SUPERAPP_API_TOKEN ||
+        process.env.SUPERAPP_DEVELOPER_TOKEN ||
+        process.env.SUPERAPP_AUTH_TOKEN ||
+        fileCreds.token;
+    const secret = cliOptions.secret ||
+        process.env.SUPERAPP_API_SECRET ||
+        fileCreds.secret;
+    const tenantId = cliOptions.tenantId ||
+        process.env.SUPERAPP_TENANT_ID ||
+        fileCreds.tenantId ||
+        'tenant_001';
+    const actorId = cliOptions.actorId ||
+        process.env.SUPERAPP_ACTOR_ID ||
+        process.env.SUPERAPP_USER_ID ||
+        fileCreds.actorId ||
+        'dev_partner_001';
+    return { token, secret, tenantId, actorId };
+}
+/**
+ * Builds standard secure headers for registry HTTP requests:
+ * - Authorization: Bearer <token> (JWT / OAuth token)
+ * - x-signature & x-signature-timestamp: HMAC-SHA256 signature for payload integrity
+ * - Contextual x-tenant-id and x-user-id
+ */
+export function buildRequestHeaders(credentials, payload, additionalHeaders = {}) {
+    const headers = {
+        'Content-Type': 'application/json',
+        ...additionalHeaders,
+    };
+    // 1. Bearer Token Authentication
+    if (credentials.token) {
+        headers['Authorization'] = `Bearer ${credentials.token}`;
+    }
+    // 2. Cryptographic signature (HMAC-SHA256)
+    if (credentials.secret) {
+        const timestamp = Date.now().toString();
+        const payloadStr = payload ? (typeof payload === 'string' ? payload : JSON.stringify(payload)) : '';
+        const signature = computeHmacSha256(credentials.secret, `${timestamp}.${payloadStr}`);
+        headers['x-signature-timestamp'] = timestamp;
+        headers['x-signature'] = `sha256=${signature}`;
+    }
+    // 3. Contextual identifiers
+    if (credentials.tenantId) {
+        headers['x-tenant-id'] = credentials.tenantId;
+    }
+    if (credentials.actorId) {
+        headers['x-user-id'] = credentials.actorId;
+    }
+    return headers;
+}
+//# sourceMappingURL=auth.js.map

package/dist/cli/utils/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY;IAC5D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC/D,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,kBAAkB,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC;KACvC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzC,OAAO;wBACL,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW;wBAC5D,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;wBACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM;qBACzC,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAK/B,EAAE;IACJ,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;IAE1C,MAAM,KAAK,GACT,UAAU,CAAC,KAAK;QAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,SAAS,CAAC,KAAK,CAAC;IAElB,MAAM,MAAM,GACV,UAAU,CAAC,MAAM;QACjB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,SAAS,CAAC,MAAM,CAAC;IAEnB,MAAM,QAAQ,GACZ,UAAU,CAAC,QAAQ;QACnB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,SAAS,CAAC,QAAQ;QAClB,YAAY,CAAC;IAEf,MAAM,OAAO,GACX,UAAU,CAAC,OAAO;QAClB,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,SAAS,CAAC,OAAO;QACjB,iBAAiB,CAAC;IAEpB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAiC,EACjC,OAAa,EACb,oBAA4C,EAAE;IAE9C,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,iBAAiB;KACrB,CAAC;IAEF,iCAAiC;IACjC,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3D,CAAC;IAED,2CAA2C;IAC3C,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,uBAAuB,CAAC,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,SAAS,EAAE,CAAC;IACjD,CAAC;IAED,4BAA4B;IAC5B,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;IAChD,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC;IAC7C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/utils/server.d.ts

@@ -1,3 +1,17 @@
 import http from 'node:http';
-export declare function startSimulatorServer(port?: number): http.Server;
+/**
+ * Validates whether the incoming Origin header is a trusted local development origin.
+ * Prevents arbitrary external websites from reading simulator assets via cross-origin requests.
+ */
+export declare function isAllowedCorsOrigin(origin: string): boolean;
+/**
+ * Validates whether a target Mini App URL is safe to be embedded in the Simulator iframe.
+ * Allows local development URLs (http://localhost, http://127.0.0.1) and HTTPS web apps.
+ * Strictly blocks dangerous schemes (javascript:, data:, file:, blob:) and embedded credentials.
+ */
+export declare function isAllowedMiniAppUrl(rawUrl: string): boolean;
+/**
+ * Starts the Browser Simulator HTTP server strictly bound to localhost (127.0.0.1) by default.
+ */
+export declare function startSimulatorServer(port?: number, host?: string): http.Server;
 //# sourceMappingURL=server.d.ts.map

package/dist/cli/utils/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAkB7B,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,MAAa,GAAG,IAAI,CAAC,MAAM,CA2ErE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAkB7B;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAa3D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA0B3D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,MAAa,EAAE,IAAI,GAAE,MAAoB,GAAG,IAAI,CAAC,MAAM,CAuFjG"}