@dooer/dooer-test-env 1.0.0

package/bin/index.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+require('../lib/cli')().catch((e) => {
+  // eslint-disable-next-line no-console
+  console.error(`\nERROR: ${e.message}\n`)
+  process.exit(1)
+})

package/discovery-router/Dockerfile

@@ -0,0 +1,18 @@
+FROM node:18-slim
+
+WORKDIR /app
+
+# Built-ins only — no `npm install` needed.
+COPY package.json ./
+COPY server.js ./
+
+# Registry is seeded from / persisted to REGISTRY_FILE (default /registry/registry.json). Mount a
+# volume at /registry so CLI-set overrides survive a container restart.
+ENV PORT=8500 \
+    REGISTRY_FILE=/registry/registry.json \
+    DEFAULT_TARGET_PORT=3000 \
+    DEFAULT_ADDRESS_TEMPLATE="<name>"
+
+EXPOSE 8500
+
+CMD ["node", "server.js"]

package/discovery-router/README.md

@@ -0,0 +1,99 @@
+# discovery-router
+
+A tiny, mutable **Consul-health-API** server for the `dooer-test-env` local stack. It is the routing
+brain of the local environment (ENVIRONMENT-PLAN.md §6): it answers the one endpoint `@dooer/service`
+calls to resolve peers, backed by an in-memory registry the CLI updates as services start, stop, switch
+to local code, or change version — so peers pick up the new location **without restarting**.
+
+It replaces the static `dummy-consul-service` stub. No framework, no dependencies (Node 18 built-ins only).
+
+## Why it looks like Consul
+
+`@dooer/service/lib/get-service.js` resolves a service by fetching
+`http://$CONSUL_HTTP_ADDR/v1/health/service/<name>`, then filtering to nodes whose `Checks` are **all**
+`Status === 'passing'` and reading `Service.Address` + `Service.Port` (and `Service.Tags` for an optional
+`version:` tag). Every service in the stack points `CONSUL_HTTP_ADDR` at this router, so **no service code
+changes** are needed.
+
+### Response shape (`GET /v1/health/service/:name`)
+
+A JSON array with exactly one healthy node:
+
+```json
+[
+  {
+    "Node": { "Node": "discovery-router", "Address": "service-ledger" },
+    "Service": { "ID": "service-ledger", "Service": "service-ledger", "Address": "service-ledger", "Port": 3000, "Tags": [] },
+    "Checks": [{ "Status": "passing", "ServiceName": "service-ledger", "CheckID": "service:service-ledger" }]
+  }
+]
+```
+
+`get-service.js` reads `Service.Address` + `Service.Port` → host `service-ledger:3000`.
+
+## Resolution rules
+
+For a requested name the router returns:
+
+1. **An explicit override** if one is registered (`PUT /registry/:name`) — the service's current real
+   location (a compose container, a chosen published version, or `host.docker.internal:<devport>` when
+   run as local code).
+2. **Otherwise the default template** — `DEFAULT_ADDRESS_TEMPLATE` with `<name>` substituted, on
+   `DEFAULT_TARGET_PORT`. With the defaults that is **`<name>:3000`**, i.e. the service's own compose
+   container DNS name.
+
+### Unknown-name fallback decision
+
+**Unknown names fall back to `<name>:DEFAULT_TARGET_PORT` (compose DNS), they do NOT return `[]`.** This
+is the recommended behaviour from the plan: the stack works out of the box (every compose service is
+reachable by its container name with zero registry config), and explicit overrides win when the CLI
+narrows a name to local code or a specific version. To get "unknown → unresolvable" instead, set
+`DEFAULT_ADDRESS_TEMPLATE` to an address that does not resolve; the router itself always returns a single
+node so the caller fails at connect time rather than at discovery time.
+
+## API
+
+| Method | Path | Body | Purpose |
+|---|---|---|---|
+| `GET` | `/v1/health/service/:name` | — | Consul-shaped array (one passing node) for the effective target. |
+| `GET` | `/registry` | — | `{ overrides, effective, defaults }` — current explicit overrides, their resolved targets, and the default config. |
+| `PUT` | `/registry/:name` | `{ "address": "host", "port": 1234 }` | Set/replace an override. Persisted to `REGISTRY_FILE`. |
+| `DELETE` | `/registry/:name` | — | Remove an override (revert this name to the default template). Persisted. |
+
+Overrides are persisted to `REGISTRY_FILE` on every change, so they survive a restart.
+
+## Config (env)
+
+| Var | Default | Meaning |
+|---|---|---|
+| `PORT` | `8500` | Listen port (Consul's default, so `CONSUL_HTTP_ADDR=discovery-router:8500`). |
+| `REGISTRY_FILE` | `/registry/registry.json` | Seed on start + persistence target for overrides. |
+| `DEFAULT_TARGET_PORT` | `3000` | Port used by the default template (services boot on `DOOER_MICROSERVICE_PORT`=3000). |
+| `DEFAULT_ADDRESS_TEMPLATE` | `<name>` | Address for names without an override; `<name>` → the requested service name. |
+
+## How the CLI / compose use it
+
+- **compose:** one `discovery-router` service; every other service gets `CONSUL_HTTP_ADDR=discovery-router:8500`.
+  A named volume mounted at `/registry` persists overrides.
+- **CLI:** `up` seeds the registry from the running compose services; `service local` / `unlocal` /
+  `deploy` / `stop` call `PUT` / `DELETE /registry/:name` to repoint one name. Use `lib/discovery/client.js`
+  (`setTarget` / `clearTarget` / `list`).
+
+## Registry file format
+
+`name -> { address, port }` (see `registry.example.json`):
+
+```json
+{
+  "service-ai-agents": { "address": "host.docker.internal", "port": 4021 },
+  "service-ledger": { "address": "service-ledger", "port": 3000 }
+}
+```
+
+## Run locally
+
+```bash
+PORT=8500 REGISTRY_FILE=./registry.json node server.js
+curl localhost:8500/v1/health/service/service-ledger
+curl -X PUT localhost:8500/registry/service-ai-agents -d '{"address":"host.docker.internal","port":4021}'
+```

package/discovery-router/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@dooer/dooer-test-env-discovery-router",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Mutable local Consul-health-API router for the dooer-test-env local stack (name -> endpoint).",
+  "license": "UNLICENSED",
+  "bin": {
+    "discovery-router": "server.js"
+  },
+  "scripts": {
+    "start": "node server.js"
+  }
+}

package/discovery-router/registry.example.json

@@ -0,0 +1,5 @@
+{
+  "service-ai-agents": { "address": "host.docker.internal", "port": 4021 },
+  "service-ledger": { "address": "service-ledger", "port": 3000 },
+  "service-graphql": { "address": "service-graphql", "port": 3000 }
+}

package/discovery-router/server.js

@@ -0,0 +1,272 @@
+const http = require('http')
+const fs = require('fs')
+const path = require('path')
+const crypto = require('crypto')
+
+// --- Config (all from env, with compose-friendly defaults) ---------------------------------------
+const PORT = Number(process.env.PORT || 8500)
+const REGISTRY_FILE = process.env.REGISTRY_FILE || '/registry/registry.json'
+const DEFAULT_TARGET_PORT = Number(process.env.DEFAULT_TARGET_PORT || 3000)
+// `<name>` is substituted with the requested service name. Default `<name>` => the compose container's
+// DNS name, so an unknown-but-expected service resolves to `<name>:DEFAULT_TARGET_PORT` out of the box.
+const DEFAULT_ADDRESS_TEMPLATE = process.env.DEFAULT_ADDRESS_TEMPLATE || '<name>'
+
+// --- Registry (mutable, name -> { address, port }) -----------------------------------------------
+// Entries loaded from REGISTRY_FILE are the "overrides": explicit targets that win over the default.
+// Everything not listed falls back to the default template below (compose DNS), so the router works
+// with zero config and the CLI narrows it down as services start / go local / switch version.
+let registry = {}
+
+function loadRegistry() {
+  try {
+    const raw = fs.readFileSync(REGISTRY_FILE, 'utf8')
+    const parsed = JSON.parse(raw)
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      registry = parsed
+    }
+    log('registry-loaded', { file: REGISTRY_FILE, entries: Object.keys(registry).length })
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      log('registry-file-absent', { file: REGISTRY_FILE })
+    } else {
+      log('registry-load-failed', { file: REGISTRY_FILE, error: error.message })
+    }
+  }
+}
+
+function persistRegistry() {
+  try {
+    fs.mkdirSync(path.dirname(REGISTRY_FILE), { recursive: true })
+    fs.writeFileSync(REGISTRY_FILE, `${JSON.stringify(registry, null, 2)}\n`)
+  } catch (error) {
+    log('registry-persist-failed', { file: REGISTRY_FILE, error: error.message })
+  }
+}
+
+// The effective target for a name: an explicit override if present, else the default template.
+function resolveTarget(name) {
+  const override = registry[name]
+  if (override && override.address) {
+    return { address: override.address, port: Number(override.port) || DEFAULT_TARGET_PORT, source: 'override' }
+  }
+  return {
+    address: DEFAULT_ADDRESS_TEMPLATE.replace(/<name>/g, name),
+    port: DEFAULT_TARGET_PORT,
+    source: 'default',
+  }
+}
+
+// The Consul health-API node shape @dooer/service/lib/get-service.js parses: it filters nodes whose
+// Checks are all Status==='passing', then reads Service.Address + Service.Port (and Service.Tags for
+// the optional version tag). We always return exactly one passing node.
+function consulNode(name, { address, port }) {
+  return {
+    Node: { Node: 'discovery-router', Address: address },
+    Service: {
+      ID: name,
+      Service: name,
+      Address: address,
+      Port: port,
+      Tags: [],
+    },
+    Checks: [{ Status: 'passing', ServiceName: name, CheckID: `service:${name}` }],
+  }
+}
+
+// --- Minimal Consul session + KV (single-node leader election) -----------------------------------
+// doode's leader election uses the Consul session + KV lock API (PUT /v1/session/create, then KV
+// acquire). Locally there is exactly ONE instance of each service, so it is always the rightful leader:
+// we grant every session and every lock acquire. This is the difference between a static Consul stub and
+// a working local env (without it, all scheduled/background handlers stay dormant).
+const sessions = new Set()
+const kv = new Map() // key -> { value, session }
+
+function readRaw(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    req.on('data', (c) => chunks.push(c))
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')))
+    req.on('error', reject)
+  })
+}
+
+// returns true if the path was a session/KV request (already responded), false otherwise
+async function handleConsulLock(req, res, url) {
+  const { pathname, searchParams } = url
+  const { method } = req
+
+  if (method === 'PUT' && pathname === '/v1/session/create') {
+    const id = crypto.randomUUID()
+    sessions.add(id)
+    sendJson(res, 200, { ID: id })
+    return true
+  }
+  let m = pathname.match(/^\/v1\/session\/(renew|destroy)\/(.+)$/)
+  if (method === 'PUT' && m) {
+    const id = decodeURIComponent(m[2])
+    if (m[1] === 'destroy') {
+      sessions.delete(id)
+      sendJson(res, 200, true)
+    } else {
+      sendJson(res, 200, [{ ID: id, TTL: '15s', LockDelay: 0, Behavior: 'release' }])
+    }
+    return true
+  }
+  m = pathname.match(/^\/v1\/kv\/(.+)$/)
+  if (m) {
+    const key = decodeURIComponent(m[1])
+    if (method === 'PUT') {
+      const value = await readRaw(req)
+      const acquire = searchParams.get('acquire')
+      const release = searchParams.get('release')
+      if (release) {
+        const cur = kv.get(key)
+        if (cur && cur.session === release) kv.set(key, { value: cur.value, session: null })
+        sendJson(res, 200, true)
+      } else {
+        // single-node: always grant the lock (or plain write)
+        kv.set(key, { value, session: acquire || null })
+        sendJson(res, 200, true)
+      }
+      return true
+    }
+    if (method === 'GET') {
+      const cur = kv.get(key)
+      if (!cur) {
+        sendJson(res, 404, [])
+        return true
+      }
+      sendJson(res, 200, [
+        {
+          Key: key,
+          Value: Buffer.from(cur.value || '').toString('base64'),
+          Session: cur.session || undefined,
+          CreateIndex: 1,
+          ModifyIndex: 1,
+          LockIndex: 1,
+          Flags: 0,
+        },
+      ])
+      return true
+    }
+    if (method === 'DELETE') {
+      kv.delete(key)
+      sendJson(res, 200, true)
+      return true
+    }
+  }
+  return false
+}
+
+// --- HTTP helpers --------------------------------------------------------------------------------
+function log(event, data) {
+  // eslint-disable-next-line no-console
+  console.log(JSON.stringify({ ts: new Date().toISOString(), event, ...data }))
+}
+
+function sendJson(res, statusCode, body) {
+  const payload = JSON.stringify(body)
+  res.writeHead(statusCode, { 'content-type': 'application/json' })
+  res.end(payload)
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    req.on('data', (chunk) => chunks.push(chunk))
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks).toString('utf8')
+      if (!raw) return resolve({})
+      try {
+        return resolve(JSON.parse(raw))
+      } catch (error) {
+        return reject(new Error(`invalid JSON body: ${error.message}`))
+      }
+    })
+    req.on('error', reject)
+  })
+}
+
+// --- Router --------------------------------------------------------------------------------------
+async function handle(req, res) {
+  const url = new URL(req.url, `http://localhost:${PORT}`)
+  const { pathname } = url
+  const { method } = req
+
+  // Consul health API — what @dooer/service calls on every resolve.
+  const healthMatch = pathname.match(/^\/v1\/health\/service\/(.+)$/)
+  if (method === 'GET' && healthMatch) {
+    const name = decodeURIComponent(healthMatch[1])
+    const target = resolveTarget(name)
+    // Always resolvable: unknown names fall back to the compose DNS default (see resolveTarget).
+    return sendJson(res, 200, [consulNode(name, target)])
+  }
+
+  // Consul session + KV (leader election). Returns true if it handled the request.
+  if (pathname.startsWith('/v1/session/') || pathname.startsWith('/v1/kv/')) {
+    if (await handleConsulLock(req, res, url)) return undefined
+  }
+
+  // Admin: list the whole registry (explicit overrides + config that drives the defaults).
+  if (method === 'GET' && pathname === '/registry') {
+    const effective = {}
+    for (const name of Object.keys(registry)) {
+      effective[name] = resolveTarget(name)
+    }
+    return sendJson(res, 200, {
+      overrides: registry,
+      effective,
+      defaults: { addressTemplate: DEFAULT_ADDRESS_TEMPLATE, port: DEFAULT_TARGET_PORT },
+    })
+  }
+
+  const nameMatch = pathname.match(/^\/registry\/(.+)$/)
+  if (nameMatch) {
+    const name = decodeURIComponent(nameMatch[1])
+
+    // Admin: set/replace an override for one service.
+    if (method === 'PUT') {
+      let body
+      try {
+        body = await readBody(req)
+      } catch (error) {
+        return sendJson(res, 400, { error: error.message })
+      }
+      if (!body || typeof body.address !== 'string' || !body.address) {
+        return sendJson(res, 400, { error: 'body must be { address: string, port: number }' })
+      }
+      const port = Number(body.port) || DEFAULT_TARGET_PORT
+      registry[name] = { address: body.address, port }
+      persistRegistry()
+      log('override-set', { name, address: body.address, port })
+      return sendJson(res, 200, { name, ...registry[name] })
+    }
+
+    // Admin: remove an override (revert this name to the default template).
+    if (method === 'DELETE') {
+      const existed = Object.prototype.hasOwnProperty.call(registry, name)
+      delete registry[name]
+      persistRegistry()
+      log('override-cleared', { name, existed })
+      return sendJson(res, 200, { name, cleared: existed, effective: resolveTarget(name) })
+    }
+  }
+
+  return sendJson(res, 404, { error: 'not found' })
+}
+
+const server = http.createServer((req, res) => {
+  const start = Date.now()
+  res.on('finish', () =>
+    log('request', { method: req.method, url: req.url, status: res.statusCode, ms: Date.now() - start })
+  )
+  handle(req, res).catch((error) => {
+    log('handler-error', { url: req.url, error: error.message })
+    if (!res.headersSent) sendJson(res, 500, { error: 'internal error' })
+  })
+})
+
+loadRegistry()
+server.listen(PORT, () => log('listening', { port: PORT, registryFile: REGISTRY_FILE }))
+
+module.exports = { server, resolveTarget, consulNode }

package/lib/account.js

@@ -0,0 +1,120 @@
+// Provision an empty-but-functional test account in the LOCAL DB — the `customer new` command.
+//
+// Mirrors what service-accounts' create-organization + subscriptions.post do, but as direct inserts into
+// the local Postgres (self-contained: no service token / network). Creates exactly what's needed to use the
+// account and nothing else:
+//   - service_accounts.companies             the organization (SE / AB, minimal required columns)
+//   - service_accounts.companies2users       the given user linked as role 'Owner'
+//   - service_accounts.subscriptions         the same active set Ghost Inspector has on staging
+//   - service_accounts."partnerOrganization" the org placed under partner `dooer` by default
+// It does NOT add customer data (ledger, documents, tasks, …) — the account starts empty.
+
+const crypto = require('crypto')
+const { Client } = require('pg')
+
+// Ghost Inspector's active subscription set on staging (Jimmy 2026-09-01).
+const SUBSCRIPTION_TYPES = ['accounting', 'billing', 'salaries', 'sales', 'prebook']
+
+// The partner every new test account is placed under by default (Jimmy 2026-09-01).
+const DEFAULT_PARTNER_DOMAIN = 'dooer'
+
+const uuid = () => crypto.randomUUID()
+// A plausible unique 10-digit Swedish org number (556XXXXXXX) — dev placeholder, not a real registration.
+const orgNumber = () => `556${String(crypto.randomInt(0, 1e7)).padStart(7, '0')}`
+
+// short_name must match ^[a-z0-9][a-z0-9-]+[a-z0-9]$ (service-accounts models/company.js) — the product
+// slugifies the name for it. Mirror that: lowercase, non-alnum → dashes, trim leading/trailing dashes.
+function slugify(name) {
+  let s = String(name)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+  if (s.length < 3) s = `${s || 'org'}-${crypto.randomBytes(2).toString('hex')}`.replace(/^-+/, '')
+  return s
+}
+// Find a slug not already taken (companies.short_name), appending -N like the product's getSlug does.
+async function uniqueSlug(client, name) {
+  const base = slugify(name)
+  for (let i = 0; i < 50; i++) {
+    const candidate = i === 0 ? base : `${base}-${i + 1}`
+    const hit = await client.query('SELECT 1 FROM service_accounts.companies WHERE short_name=$1', [candidate])
+    if (!hit.rowCount) return candidate
+  }
+  return `${base}-${crypto.randomBytes(3).toString('hex')}`
+}
+
+async function createAccount({ local, name, ownerUserId, execute = false } = {}) {
+  if (!name) throw new Error('customer new: a name is required')
+  if (!ownerUserId) throw new Error('customer new: --owner <userId> is required')
+
+  const client = new Client({ ...local, ssl: local.ssl === false ? undefined : { rejectUnauthorized: false } })
+  await client.connect()
+  try {
+    const owner = await client.query('SELECT users_pk, email FROM service_accounts.users WHERE users_pk=$1', [
+      ownerUserId,
+    ])
+    if (!owner.rowCount) throw new Error(`owner user ${ownerUserId} not found in the local DB (run \`db pull\` first?)`)
+
+    const partner = await client.query('SELECT id, name FROM service_accounts.partner WHERE domain=$1', [
+      DEFAULT_PARTNER_DOMAIN,
+    ])
+    if (!partner.rowCount) throw new Error(`partner '${DEFAULT_PARTNER_DOMAIN}' not found in the local DB`)
+
+    const orgId = uuid()
+    const shortName = await uniqueSlug(client, name)
+    const plan = {
+      orgId,
+      name,
+      shortName,
+      owner: owner.rows[0].email,
+      partner: DEFAULT_PARTNER_DOMAIN,
+      subscriptions: SUBSCRIPTION_TYPES,
+    }
+    if (!execute) {
+      console.log('DRY-RUN (pass --execute to create):')
+      console.log(JSON.stringify(plan, null, 2))
+      return plan
+    }
+
+    await client.query('BEGIN')
+    await client.query(
+      `INSERT INTO service_accounts.companies
+         (companies_pk, fk_countries_pk, fk_company_types_pk, company_name, short_name, organization_number,
+          api_uuid, language, "timeZone", currency, inserted_at, updated_at)
+       VALUES ($1,'SE','AB',$2,$3,$4,$5,'sv','Europe/Stockholm','SEK',now(),now())`,
+      [orgId, name, shortName, orgNumber(), uuid()]
+    )
+    await client.query(
+      `INSERT INTO service_accounts.companies2users
+         (fk_companies_pk, fk_users_pk, fk_user_roles_at_companies_pk, api_uuid)
+       VALUES ($1,$2,'Owner',$3)`,
+      [orgId, ownerUserId, uuid()]
+    )
+    for (const type of SUBSCRIPTION_TYPES) {
+      await client.query(
+        `INSERT INTO service_accounts.subscriptions
+           (subscriptions_pk, fk_companies_pk, subscription_type, status, start_date, api_uuid, inserted_at, updated_at)
+         VALUES ($1,$2,$3,'active',now(),$4,now(),now())`,
+        [uuid(), orgId, type, uuid()]
+      )
+    }
+    await client.query(
+      `INSERT INTO service_accounts."partnerOrganization" (id, "partnerId", "organizationId", "createdAt", "updatedAt")
+       VALUES ($1,$2,$3,now(),now())`,
+      [uuid(), partner.rows[0].id, orgId]
+    )
+    await client.query('COMMIT')
+    return plan
+  } catch (e) {
+    try {
+      await client.query('ROLLBACK')
+    } catch (_) {
+      /* ignore */
+    }
+    throw e
+  } finally {
+    await client.end()
+  }
+}
+
+module.exports = { createAccount, SUBSCRIPTION_TYPES }

package/lib/auth-dev-keys.js

@@ -0,0 +1,12 @@
+// The @dooer LOCAL dev auth keypair — the `local` authPublicKey / authPrivateKey shipped (in the clear) in
+// every service's config/configuration.json. NOT a secret: it exists so a dev stack can sign+verify tokens
+// among itself. We force it across the local env because service-accounts (the only signer) falls back to
+// this local private key, while the staging manifests would otherwise make every verifier trust the STAGING
+// public key instead — the "invalid signature" mismatch. authIssuer is "https://example.com/" everywhere, so
+// it needs no override. Values are base64-encoded PEM, exactly as @dooer/config expects them.
+module.exports = {
+  AUTH_PUBLIC_KEY_B64:
+    'LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFyVmZYU1hXVWgvRndZSDcrbGorUwpZeFFHYXFvVENLQTNKN25TanExZUNodG9OcGJOYTA3Q251U055OFpQTWRDWE15ZDhVN2phUk1acFFYT0NHYUwrCkNpM2F1TVlOSVk0NXd5MG1RYXREYUgyZkY0OGE2NTV3MWJHMlZGVlFFVzkvaEJsUGkzRnA2dmN1eWRaYkMyVWsKOHFHdU43dG9FYlZyYWlsWlMxUGliMVl2SzNKNlZ4VnlRRmdXVVkyV1FHNjZIcFp4NEduL3JKdEpEdE1CMFd5aAozOWdVYTREMGtldUhWR1k2ZzRIR2NueHgycjB2ZzBQRlZtQkFsbThPclVhd0YrcDFLRG1HTDVDNnpTZTBkUDkxCjVKVzNUWFJ5ZGthcWErQzZBUzJhazlYUXpQMzZaazNhQ3duOS9ZYW5QS0xqOEZ2T3NVMTU5MzBvL1Npcm1BMTgKZndJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==',
+  AUTH_PRIVATE_KEY_B64:
+    'LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBclZmWFNYV1VoL0Z3WUg3K2xqK1NZeFFHYXFvVENLQTNKN25TanExZUNodG9OcGJOCmEwN0NudVNOeThaUE1kQ1hNeWQ4VTdqYVJNWnBRWE9DR2FMK0NpM2F1TVlOSVk0NXd5MG1RYXREYUgyZkY0OGEKNjU1dzFiRzJWRlZRRVc5L2hCbFBpM0ZwNnZjdXlkWmJDMlVrOHFHdU43dG9FYlZyYWlsWlMxUGliMVl2SzNKNgpWeFZ5UUZnV1VZMldRRzY2SHBaeDRHbi9ySnRKRHRNQjBXeWgzOWdVYTREMGtldUhWR1k2ZzRIR2NueHgycjB2CmcwUEZWbUJBbG04T3JVYXdGK3AxS0RtR0w1QzZ6U2UwZFA5MTVKVzNUWFJ5ZGthcWErQzZBUzJhazlYUXpQMzYKWmszYUN3bjkvWWFuUEtMajhGdk9zVTE1OTMwby9TaXJtQTE4ZndJREFRQUJBb0lCQUd4bFg3VUtGK1dpcjFsSQpVTDkzNVh5Yml4K3NWdGF3Q1kySUFBbEVsR2ZSbDZ0N1JkMXlsUFZ6aXRBQXBJbE1IU0RaOGo4UWV6MUNyWk5HClBmYjJHOUlWdG82Ukdxai9IVlBWcWZTcXVpNWZUOXNWbkFuM1BDd0ZRelVkWEVKcTdOeVlUMHV0a2tSaWFobkIKTjVHNm9BNHgySlgxVlRDdHVBdmM2My9WWnVXamdiVnBCbTRsWXJRekNyalUvOEJzRVIvNXFOVDUvNGNtNHlFNgpyY2JjNHNpUlY5NnZtc040QnNqeWtoczZPTCtoNjFLSWs0TSsyK3JscXZwdGQ0ZjNrNDhRK3M2MGw4eWR0RldUClZ1alM2S1JDbTMyWnFhSlRDcHZxTG16bW5EcTM4RlRDdWF3N0dhMzNPTmNaanBEUnpmWTJ3cUQ3T21sMXZmNnUKbUwvYXlHRUNnWUVBMStHU3RwSXhTcjNLN05TOWhScUVQUnFuMTJLYkRoMnRYcmFZSGZ5SExxWGhKWm9adVZnbQpmdWIzMnNZSndtcGZibGp1SDlpREp4TW9xSWUxSjdxVjNmVkU0OVFyNmtCRGd4M21uWElJSDhjMzFrNG9teFpzCm5BZXd4NFNnSFg2Vldualc1RitkL3Y2U1loS0VKT204MzBTVmdMSXU1WGlmRmlBdHBTY2JTTmtDZ1lFQXpZNkwKakdkdUdaVWhhZ2RYRU5vVk5LcWMxSEdmU29EYi9GdjNlMzJUbUtXeGhIWmhZMDlYTSt4S3d2TlpycVFXZjZ6UAp0ZWRoU1lKMTloVFlXVHBJWjZhbzlFUEF6MG1CbThLbFdITk9sSkxvaEx1bWYxV1QvTzZvY1YvR01FZEpVRHQ0Cnloa3llVHRwVDh0Y29CRm9CL0d4NzNMdTRteW11MWhWNnRwcTJSY0NnWUFwOEl6TUkwS29Qbzc1eTZxMS9SekwKc2k0QlRnckpoMEp6TUE0RlpWWHQzaFFMZGhDaFRWck5OSm5hU3JjQ3FoKzRGRmJPb1FWNXhlTVVPcWthK3NpNgp3amVMKzJBOHRoZG5sWnVENHU5cEhRN2Y5M2MwQ2ZzM3BOYlhMQkRmS2dSaCt5L2tWaDhmdHQxQmFFOTd6RjBCCkV4WG9WclY5cHgxZzh3ZHJHbG5Xb1FLQmdDRVdRY1llMiswSVFUR2s3dEhLbU1FNmVUWUUrQVB4Qy9mcUFjTUIKNnFFV2dxVjB2S1pVbmcvQWlDUXJNWk5YM0RzKzRNeEI2em4rNHVmeVlRU3p5ZlhOTU1Mb3FQOTBzSVVXNXJCLwpGdlg1VTY0UjJuSUNuMmlHTGR6WjhyZlFzYTlWYzFMc2pXQlFQTnBZUEplVFZiQjVxZytGNjRmTXYyWEdpVVhkClZIZVBBb0dBSWJqRlpPM1hpNmxJaENHMDJYWXVrbjZVKzdvK2NKTXE5U1hDczh0MFZrQTllc1gwUkt2L1pidXQKMkhnL2FVMUdYd2IyT1EwdkhCZjJuZDBxYm9iUmdvS3ZTL3Nla0hDZXlFNXVZbk9YQitnMHFVRXMwa3Q2S0I0RAppRU1QQWxZaEgwcnZsRHBHT2ZqcGw4YlhpNXV2bjFyQUZXVGRQclNVcWdhbXA1MWF2OHM9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==',
+}