@hsuite/smart-engines-cli 1.1.0 → 1.2.0

package/dist/commands/verify.d.ts

@@ -0,0 +1,56 @@
+/**
+ * `hsuite verify` — verify a PQC attestation cert (Sig program) OR a Kyber
+ * hybrid envelope (Kyber Arc 11).
+ *
+ * PR 11.1 — Arc 11 (external-verifier surface). Thin Commander wrapper
+ * around `verifyPqcAttestation` from `@hsuite/smart-engines-sdk/pqc-verify`
+ * (PR 11.0) AND `verifyPqcEnvelope` from
+ * `@hsuite/smart-engines-sdk/pqc-verify-envelope` (Kyber Arc 11).
+ *
+ * Four invocation modes:
+ *
+ *   - Direct cert verify (Sig):
+ *       hsuite verify --cert <cert.json> --payload <payload.json>
+ *
+ *   - Fetch-then-verify cert via smart-host proxy (Sig, PR #820):
+ *       hsuite verify --topic-msg <consumer>/<contentHash> --payload <p.json>
+ *
+ *     The proxy endpoint is `GET /api/pqc-attestation/<consumer>/<contentHash>`
+ *     (apps/smart-host/src/pqc-proxy/pqc-attestation-proxy.controller.ts:35),
+ *     keyed by `(consumer, contentHash)` — NOT a Hedera topic-message id.
+ *     The flag name follows the design spec (§4.2) for customer-facing
+ *     parity; the value is the consumer/contentHash slug the proxy actually
+ *     accepts.
+ *
+ *   - Envelope verify (Kyber):
+ *       hsuite verify --envelope <envelope.json>
+ *                     [--expected-label <label>]
+ *                     [--expected-fingerprint <hex>]
+ *
+ *     Observation-only — schema + base64 + timestamp + optional claim
+ *     checks. No decryption, no key access.
+ *
+ *   - Help: hsuite verify --help
+ *
+ * Exit codes:
+ *   0  cert/envelope valid
+ *   1  cert/envelope invalid (specific reason printed to stderr) OR usage error
+ *   2  network / fetch error (only possible in --topic-msg mode)
+ *
+ * @see docs/superpowers/specs/2026-05-27-pqc-arc11-external-verifier-design.md §4.2
+ * @see docs/superpowers/specs/2026-05-29-kyber-mlkem-production-readiness.md §5 Arc 11
+ * @see docs/superpowers/plans/2026-05-27-pqc-arc11-external-verifier-plan.md  PR 11.1
+ */
+import { Command } from 'commander';
+/**
+ * Build a fresh `verify` Command. Commander Command instances accumulate
+ * parsed-option state across `parseAsync` calls, so tests build their own
+ * via this factory to isolate runs; the bin entrypoint calls it once.
+ */
+export declare function buildVerifyCommand(): Command;
+/**
+ * Default command instance used by the bin entrypoint. Tests build their
+ * own via {@link buildVerifyCommand}.
+ */
+export declare const verifyCommand: Command;
+//# sourceMappingURL=verify.d.ts.map

package/dist/commands/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgGpC;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAwM5C;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,SAAuB,CAAC"}

package/dist/commands/verify.js

@@ -0,0 +1,291 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyCommand = void 0;
+exports.buildVerifyCommand = buildVerifyCommand;
+/**
+ * `hsuite verify` — verify a PQC attestation cert (Sig program) OR a Kyber
+ * hybrid envelope (Kyber Arc 11).
+ *
+ * PR 11.1 — Arc 11 (external-verifier surface). Thin Commander wrapper
+ * around `verifyPqcAttestation` from `@hsuite/smart-engines-sdk/pqc-verify`
+ * (PR 11.0) AND `verifyPqcEnvelope` from
+ * `@hsuite/smart-engines-sdk/pqc-verify-envelope` (Kyber Arc 11).
+ *
+ * Four invocation modes:
+ *
+ *   - Direct cert verify (Sig):
+ *       hsuite verify --cert <cert.json> --payload <payload.json>
+ *
+ *   - Fetch-then-verify cert via smart-host proxy (Sig, PR #820):
+ *       hsuite verify --topic-msg <consumer>/<contentHash> --payload <p.json>
+ *
+ *     The proxy endpoint is `GET /api/pqc-attestation/<consumer>/<contentHash>`
+ *     (apps/smart-host/src/pqc-proxy/pqc-attestation-proxy.controller.ts:35),
+ *     keyed by `(consumer, contentHash)` — NOT a Hedera topic-message id.
+ *     The flag name follows the design spec (§4.2) for customer-facing
+ *     parity; the value is the consumer/contentHash slug the proxy actually
+ *     accepts.
+ *
+ *   - Envelope verify (Kyber):
+ *       hsuite verify --envelope <envelope.json>
+ *                     [--expected-label <label>]
+ *                     [--expected-fingerprint <hex>]
+ *
+ *     Observation-only — schema + base64 + timestamp + optional claim
+ *     checks. No decryption, no key access.
+ *
+ *   - Help: hsuite verify --help
+ *
+ * Exit codes:
+ *   0  cert/envelope valid
+ *   1  cert/envelope invalid (specific reason printed to stderr) OR usage error
+ *   2  network / fetch error (only possible in --topic-msg mode)
+ *
+ * @see docs/superpowers/specs/2026-05-27-pqc-arc11-external-verifier-design.md §4.2
+ * @see docs/superpowers/specs/2026-05-29-kyber-mlkem-production-readiness.md §5 Arc 11
+ * @see docs/superpowers/plans/2026-05-27-pqc-arc11-external-verifier-plan.md  PR 11.1
+ */
+const commander_1 = require("commander");
+const chalk_1 = __importDefault(require("chalk"));
+const fs_1 = require("fs");
+const path_1 = require("path");
+// NOTE: imported from the SDK root barrel (not the `pqc-verify` /
+// `pqc-verify-envelope` subpath exports) because the CLI's tsconfig.build.json
+// uses classic `moduleResolution: "node"`, which doesn't honor package.json
+// `exports` subpaths (TS2307 — added in TS 4.7 via `node16`/`nodenext`).
+// The SDK re-exports both helpers from `libs/smartengine-sdk/src/index.ts`,
+// so root-barrel imports resolve cleanly under classic resolution.
+const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
+const cluster_1 = require("../_lib/cluster");
+/**
+ * Slug shape for `--topic-msg`. Matches the proxy controller's two
+ * Param() regexes (CONSUMER_RE + HASH_RE in pqc-attestation-proxy.service.ts).
+ * Surfacing the parse failure as a usage error (exit 1) rather than a fetch
+ * error so the developer fixes the input, not their connectivity.
+ */
+const TOPIC_MSG_SLUG_RE = /^([a-z][a-z0-9-]{0,63})\/([a-f0-9]{64})$/;
+function readJsonFile(label, p) {
+    const abs = (0, path_1.resolve)(p);
+    if (!(0, fs_1.existsSync)(abs)) {
+        throw new Error(`${label} file not found: ${abs}`);
+    }
+    const raw = (0, fs_1.readFileSync)(abs, 'utf8');
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`${label} file is not valid JSON: ${err.message}`);
+    }
+}
+/**
+ * Map the verifier's machine-readable `reason` codes (e.g. `content-hash-mismatch`,
+ * `threshold-not-met`, `schema-invalid: <detail>`) to the human strings the CLI
+ * surfaces. The exit code is the contract; the wording is a developer-facing
+ * affordance, so we humanize "content-hash-mismatch" → "content-hash mismatch"
+ * and strip the verifier's debug suffix (computed=/cert=/verified=/required=).
+ */
+function humanizeReason(reason) {
+    if (!reason)
+        return 'unknown';
+    // Strip trailing debug suffix after first ": " — keeps the kind, drops detail.
+    const head = reason.split(': ')[0];
+    // content-hash-mismatch → content-hash mismatch
+    if (head === 'content-hash-mismatch')
+        return 'content-hash mismatch';
+    // threshold-not-met → threshold not met
+    if (head === 'threshold-not-met')
+        return 'threshold not met';
+    // schema-invalid → schema invalid (preserve original detail when present)
+    if (head === 'schema-invalid') {
+        const detail = reason.slice('schema-invalid'.length);
+        return `schema invalid${detail}`;
+    }
+    // payload-canonicalization-failed → payload canonicalization failed
+    if (head === 'payload-canonicalization-failed') {
+        return 'payload canonicalization failed';
+    }
+    // registry-* → registry <rest>
+    if (head.startsWith('registry-')) {
+        return head.replace(/^registry-/, 'registry ').replace(/-/g, ' ');
+    }
+    // Fallback: hyphens → spaces, keep detail.
+    return reason.replace(/-/g, ' ');
+}
+/**
+ * Fetch a cert from the smart-host proxy. Throws on transport / 5xx;
+ * returns `null` on a missing cert (404 OR `cert: null` payload OR
+ * `status: 'pending' | 'missing'` envelope).
+ */
+async function fetchCertFromProxy(args) {
+    const base = args.server.replace(/\/+$/, '');
+    const url = `${base}/api/pqc-attestation/${args.consumer}/${args.contentHash}`;
+    const resp = await fetch(url);
+    if (resp.status === 404)
+        return null;
+    if (!resp.ok) {
+        throw new Error(`smart-host proxy returned HTTP ${resp.status}`);
+    }
+    const body = (await resp.json());
+    if (body.status && body.status !== 'valid')
+        return null;
+    return body.cert ?? null;
+}
+/**
+ * Build a fresh `verify` Command. Commander Command instances accumulate
+ * parsed-option state across `parseAsync` calls, so tests build their own
+ * via this factory to isolate runs; the bin entrypoint calls it once.
+ */
+function buildVerifyCommand() {
+    const cmd = new commander_1.Command('verify')
+        .description('Verify a PQC attestation cert (Sig) or a Kyber hybrid envelope (Arc 11)')
+        .option('--cert <path>', 'Path to the PQC cert JSON file (direct-verify cert mode)')
+        .option('--topic-msg <consumer/contentHash>', 'Fetch the cert via smart-host proxy at /api/pqc-attestation/<consumer>/<contentHash> then verify')
+        .option('--envelope <path>', 'Path to a Kyber hybrid envelope JSON file (observation-only verify; no decryption)')
+        .option('--payload <path>', 'Path to the JSON payload to verify against (cert modes only)')
+        .option('--expected-label <label>', 'Kyber envelope: REQUIRE the envelope.kdfLabel to equal this value (envelope mode only)')
+        .option('--expected-fingerprint <hex>', 'Kyber envelope: REQUIRE the envelope.recipientPkFingerprint to equal this hex value (envelope mode only)')
+        .option('--server <url>', 'Smart-host base URL for --topic-msg mode (default: $SMART_HOST_URL / $VALIDATOR_URL / public testnet)')
+        .addHelpText('after', `
+Examples:
+  hsuite verify --cert ./cert.json --payload ./payload.json
+  hsuite verify --topic-msg license-envelope/abc...def --payload ./payload.json
+  hsuite verify --envelope ./envelope.json
+  hsuite verify --envelope ./envelope.json --expected-label smart-app-secret-envelope-v1
+
+Exit codes:
+  0  cert/envelope valid
+  1  cert/envelope invalid (with reason on stderr) OR usage error
+  2  network / fetch error (only in --topic-msg mode)
+`)
+        .action(async (opts) => {
+        // ── Envelope mode (Kyber Arc 11) — short-circuits before cert flow ────
+        // Mode is mutually exclusive with --cert/--topic-msg/--payload.
+        const haveEnvelope = !!opts.envelope;
+        if (haveEnvelope) {
+            if (opts.cert || opts.topicMsg || opts.payload) {
+                console.error(chalk_1.default.red('  --envelope is mutually exclusive with --cert/--topic-msg/--payload\n'));
+                cmd.outputHelp();
+                process.exit(1);
+            }
+            let envelopeJson;
+            try {
+                envelopeJson = readJsonFile('envelope', opts.envelope);
+            }
+            catch (err) {
+                console.error(chalk_1.default.red(`  ${err.message}\n`));
+                process.exit(1);
+            }
+            const result = await (0, smart_engines_sdk_1.verifyPqcEnvelope)(envelopeJson, {
+                expectedLabel: opts.expectedLabel,
+                expectedRecipientPkFingerprint: opts.expectedFingerprint,
+            });
+            if (result.valid) {
+                console.log(chalk_1.default.green(`  Envelope valid — version=${result.version}` +
+                    (result.details.kemAlgorithm
+                        ? `, kem=${result.details.kemAlgorithm}`
+                        : '') +
+                    (result.details.kdfLabel
+                        ? `, label='${result.details.kdfLabel}'`
+                        : '')));
+                process.exit(0);
+            }
+            else {
+                console.error(chalk_1.default.red(`  Envelope invalid — ${result.reason}`));
+                process.exit(1);
+            }
+        }
+        // ── Cert-mode flag validation ─────────────────────────────────────────
+        if (!opts.payload) {
+            console.error(chalk_1.default.red('  --payload is required\n'));
+            cmd.outputHelp();
+            process.exit(1);
+        }
+        const haveCert = !!opts.cert;
+        const haveTopicMsg = !!opts.topicMsg;
+        if (!haveCert && !haveTopicMsg) {
+            console.error(chalk_1.default.red('  one of --cert, --topic-msg, or --envelope is required\n'));
+            cmd.outputHelp();
+            process.exit(1);
+        }
+        if (haveCert && haveTopicMsg) {
+            console.error(chalk_1.default.red('  --cert and --topic-msg are mutually exclusive\n'));
+            cmd.outputHelp();
+            process.exit(1);
+        }
+        // ── Load payload (both modes) ─────────────────────────────────────────
+        let payload;
+        try {
+            payload = readJsonFile('payload', opts.payload);
+        }
+        catch (err) {
+            console.error(chalk_1.default.red(`  ${err.message}\n`));
+            process.exit(1);
+        }
+        // ── Resolve cert (direct or proxy-fetched) ────────────────────────────
+        let cert;
+        if (haveCert) {
+            try {
+                cert = readJsonFile('cert', opts.cert);
+            }
+            catch (err) {
+                console.error(chalk_1.default.red(`  ${err.message}\n`));
+                process.exit(1);
+            }
+        }
+        else {
+            const slugMatch = TOPIC_MSG_SLUG_RE.exec(opts.topicMsg);
+            if (!slugMatch) {
+                console.error(chalk_1.default.red('  --topic-msg must be "<consumer>/<contentHash>" where consumer matches /^[a-z][a-z0-9-]{0,63}$/ and contentHash is 64 hex chars\n'));
+                process.exit(1);
+            }
+            const [, consumer, contentHash] = slugMatch;
+            const server = opts.server ??
+                process.env.SMART_HOST_URL ??
+                process.env.VALIDATOR_URL ??
+                cluster_1.DEFAULT_GATEWAY;
+            try {
+                const fetched = await fetchCertFromProxy({
+                    server,
+                    consumer,
+                    contentHash,
+                });
+                if (fetched === null) {
+                    console.error(chalk_1.default.red('  Cert not found on platform\n'));
+                    process.exit(2);
+                }
+                cert = fetched;
+            }
+            catch (err) {
+                console.error(chalk_1.default.red(`  Network error: ${err.message}\n`));
+                process.exit(2);
+            }
+        }
+        // ── Verify ────────────────────────────────────────────────────────────
+        const result = await (0, smart_engines_sdk_1.verifyPqcAttestation)(cert, payload);
+        if (result.valid) {
+            const n = result.verifiedSignerCount ?? 0;
+            // `signers.length` is on the cert (already schema-validated by
+            // verifyPqcAttestation). We pull it back out for the "N of M"
+            // diagnostic without re-parsing.
+            const m = Array.isArray(cert.signers)
+                ? (cert.signers.length)
+                : n;
+            console.log(chalk_1.default.green(`  Cert valid — ${n} of ${m} signers verified, threshold met`));
+            process.exit(0);
+        }
+        else {
+            console.error(chalk_1.default.red(`  Cert invalid — ${humanizeReason(result.reason)}`));
+            process.exit(1);
+        }
+    });
+    return cmd;
+}
+/**
+ * Default command instance used by the bin entrypoint. Tests build their
+ * own via {@link buildVerifyCommand}.
+ */
+exports.verifyCommand = buildVerifyCommand();
+//# sourceMappingURL=verify.js.map

package/dist/commands/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":";;;;;;AAgJA,gDAwMC;AAxVD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,yCAAoC;AACpC,kDAA0B;AAC1B,2BAA8C;AAC9C,+BAA+B;AAC/B,kEAAkE;AAClE,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,mEAAmE;AACnE,iEAAoF;AACpF,6CAAkD;AAElD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AAErE,SAAS,YAAY,CAAC,KAAa,EAAE,CAAS;IAC5C,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,IAAA,eAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,+EAA+E;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,gDAAgD;IAChD,IAAI,IAAI,KAAK,uBAAuB;QAAE,OAAO,uBAAuB,CAAC;IACrE,wCAAwC;IACxC,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IAC7D,0EAA0E;IAC1E,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,iBAAiB,MAAM,EAAE,CAAC;IACnC,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;QAC/C,OAAO,iCAAiC,CAAC;IAC3C,CAAC;IACD,+BAA+B;IAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,2CAA2C;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAUD;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAIjC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,wBAAwB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB;IAChC,MAAM,GAAG,GAAG,IAAI,mBAAO,CAAC,QAAQ,CAAC;SAC9B,WAAW,CACV,yEAAyE,CAC1E;SACA,MAAM,CACL,eAAe,EACf,0DAA0D,CAC3D;SACA,MAAM,CACL,oCAAoC,EACpC,kGAAkG,CACnG;SACA,MAAM,CACL,mBAAmB,EACnB,oFAAoF,CACrF;SACA,MAAM,CACL,kBAAkB,EAClB,8DAA8D,CAC/D;SACA,MAAM,CACL,0BAA0B,EAC1B,wFAAwF,CACzF;SACA,MAAM,CACL,8BAA8B,EAC9B,0GAA0G,CAC3G;SACA,MAAM,CACL,gBAAgB,EAChB,uGAAuG,CACxG;SACA,WAAW,CACV,OAAO,EACP;;;;;;;;;;;CAWL,CACI;SACA,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CACP,wEAAwE,CACzE,CACF,CAAC;gBACF,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,YAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,YAAY,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,qCAAiB,EAAC,YAAY,EAAE;gBACnD,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,8BAA8B,EAAE,IAAI,CAAC,mBAAmB;aACzD,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,KAAK,CACT,8BAA8B,MAAM,CAAC,OAAO,EAAE;oBAC5C,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY;wBAC1B,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;oBACP,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;wBACtB,CAAC,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG;wBACxC,CAAC,CAAC,EAAE,CAAC,CACV,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,CACvE,CAAC;YACF,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAC/D,CAAC;YACF,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,IAAI,IAAa,CAAC;QAClB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CACP,oIAAoI,CACrI,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,SAAS,CAAC;YAC5C,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;gBACX,OAAO,CAAC,GAAG,CAAC,cAAc;gBAC1B,OAAO,CAAC,GAAG,CAAC,aAAa;gBACzB,yBAAe,CAAC;YAElB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC;oBACvC,MAAM;oBACN,QAAQ;oBACR,WAAW;iBACZ,CAAC,CAAC;gBACH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CAAC,oBAAqB,GAAa,CAAC,OAAO,IAAI,CAAC,CAC1D,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAC1C,+DAA+D;YAC/D,8DAA8D;YAC9D,iCAAiC;YACjC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAE,IAA8B,CAAC,OAAO,CAAC;gBAC9D,CAAC,CAAC,CAAE,IAA+B,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnD,CAAC,CAAC,CAAC,CAAC;YACN,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,KAAK,CACT,kBAAkB,CAAC,OAAO,CAAC,kCAAkC,CAC9D,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CACX,eAAK,CAAC,GAAG,CAAC,oBAAoB,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAC/D,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACU,QAAA,aAAa,GAAG,kBAAkB,EAAE,CAAC"}

package/dist/index.d.ts

@@ -4,8 +4,14 @@
  *
  *   hsuite init                    Generate XRPL testnet wallet, fund via
  *                                   faucet, write .env.local.
- *   hsuite subscribe --env <file>  Register a free_testnet smart-app on the
- *                                   cluster (no HSUITE deposit on testnet).
+ *   hsuite subscribe [--tier T]    Mint a subscription NFT via the cluster's
+ *                                   /api/v3/subscription/* surface.
+ *   hsuite renew                   Extend the subscription lock period.
+ *   hsuite upgrade --to-tier T     Upgrade tier (may require a top-up).
+ *   hsuite downgrade --to-tier T   Schedule a downgrade for next renewal.
+ *   hsuite tier-change cancel      Cancel a pending tier change.
+ *   hsuite usage                   Print today's usage + overage info.
+ *   hsuite billing                 Print the billing-ledger entries.
  *   hsuite deploy --manifest <f>   Deploy a smart-app from a JSON manifest.
  *
  * Smart Engines V3 is XRPL-only for smart-app authentication and

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/index.js

@@ -5,8 +5,14 @@
  *
  *   hsuite init                    Generate XRPL testnet wallet, fund via
  *                                   faucet, write .env.local.
- *   hsuite subscribe --env <file>  Register a free_testnet smart-app on the
- *                                   cluster (no HSUITE deposit on testnet).
+ *   hsuite subscribe [--tier T]    Mint a subscription NFT via the cluster's
+ *                                   /api/v3/subscription/* surface.
+ *   hsuite renew                   Extend the subscription lock period.
+ *   hsuite upgrade --to-tier T     Upgrade tier (may require a top-up).
+ *   hsuite downgrade --to-tier T   Schedule a downgrade for next renewal.
+ *   hsuite tier-change cancel      Cancel a pending tier change.
+ *   hsuite usage                   Print today's usage + overage info.
+ *   hsuite billing                 Print the billing-ledger entries.
  *   hsuite deploy --manifest <f>   Deploy a smart-app from a JSON manifest.
  *
  * Smart Engines V3 is XRPL-only for smart-app authentication and
@@ -54,9 +60,15 @@ const path = __importStar(require("path"));
 const init_1 = require("./commands/init");
 const subscribe_1 = require("./commands/subscribe");
 const deploy_1 = require("./commands/deploy");
+const renew_1 = require("./commands/renew");
+const upgrade_1 = require("./commands/upgrade");
+const downgrade_1 = require("./commands/downgrade");
+const usage_1 = require("./commands/usage");
+const billing_1 = require("./commands/billing");
 const governance_1 = require("./commands/governance");
 const hist_balance_1 = require("./commands/hist-balance");
 const personhood_1 = require("./commands/personhood");
+const verify_1 = require("./commands/verify");
 dotenv.config();
 function getVersion() {
     try {
@@ -75,10 +87,17 @@ program
     .version(getVersion());
 program.addCommand(init_1.initCommand);
 program.addCommand(subscribe_1.subscribeCommand);
+program.addCommand(renew_1.renewCommand);
+program.addCommand(upgrade_1.upgradeCommand);
+program.addCommand(downgrade_1.downgradeCommand);
+program.addCommand(upgrade_1.tierChangeCommand);
+program.addCommand(usage_1.usageCommand);
+program.addCommand(billing_1.billingCommand);
 program.addCommand(deploy_1.deployCommand);
 program.addCommand(governance_1.governanceCommand);
 program.addCommand(hist_balance_1.histBalanceCommand);
 program.addCommand(personhood_1.personhoodCommand);
+program.addCommand(verify_1.verifyCommand);
 program.parse(process.argv);
 if (!process.argv.slice(2).length) {
     program.outputHelp();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAEA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAoC;AACpC,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,0CAA8C;AAC9C,oDAAwD;AACxD,8CAAkD;AAClD,sDAA0D;AAC1D,0DAA6D;AAC7D,sDAA0D;AAE1D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,OAAO,WAAW,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAEzB,OAAO,CAAC,UAAU,CAAC,kBAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,4BAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,sBAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,8BAAiB,CAAC,CAAC;AACtC,OAAO,CAAC,UAAU,CAAC,iCAAkB,CAAC,CAAC;AACvC,OAAO,CAAC,UAAU,CAAC,8BAAiB,CAAC,CAAC;AAEtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAEA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAoC;AACpC,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,0CAA8C;AAC9C,oDAAwD;AACxD,8CAAkD;AAClD,4CAAgD;AAChD,gDAAuE;AACvE,oDAAwD;AACxD,4CAAgD;AAChD,gDAAoD;AACpD,sDAA0D;AAC1D,0DAA6D;AAC7D,sDAA0D;AAC1D,8CAAkD;AAElD,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,OAAO,WAAW,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAEzB,OAAO,CAAC,UAAU,CAAC,kBAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,4BAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,oBAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,wBAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,4BAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,2BAAiB,CAAC,CAAC;AACtC,OAAO,CAAC,UAAU,CAAC,oBAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,wBAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,sBAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,8BAAiB,CAAC,CAAC;AACtC,OAAO,CAAC,UAAU,CAAC,iCAAkB,CAAC,CAAC;AACvC,OAAO,CAAC,UAAU,CAAC,8BAAiB,CAAC,CAAC;AACtC,OAAO,CAAC,UAAU,CAAC,sBAAa,CAAC,CAAC;AAElC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hsuite/smart-engines-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "HSuite CLI for smart-app deployment and management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,7 +18,7 @@
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {
-    "@hsuite/smart-engines-sdk": "^3.0.0",
+    "@hsuite/smart-engines-sdk": "^3.4.0",
     "chalk": "^4.1.2",
     "commander": "^11.1.0",
     "dotenv": "^17.2.3",