@hsuite/smart-engines-cli 1.2.0 → 1.4.0

package/dist/_lib/runtime-env.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Runtime-env forwarding for `hsuite deploy` / `hsuite redeploy` (issue #1564).
+ *
+ * THE BUG THIS FIXES
+ * ------------------
+ * The CLI reads the developer's `.env.local` (`--env`) ONLY for deploy-time auth
+ * + build-attestation signing. It never forwarded those runtime vars into the
+ * deployed container — the deployed container's env came SOLELY from
+ * `manifest.backend.env`. So a subscribed app deployed credential-less: the
+ * smart-app's `BaaSAuthService` found no `XRPL_SEED` and silently booted
+ * OPEN / in-memory mode (`/baas/status` → `{"mode":"memory","appId":null}`).
+ *
+ * THE FIX
+ * -------
+ * On deploy, the runtime-relevant vars from `.env.local` are merged into the
+ * customer-env the deployer mirrors into the per-app k8s Secret, so the deployed
+ * app runs with the SAME identity + config it runs with locally. The identity is
+ * the developer's OWN XRPL wallet (`XRPL_SEED` in `.env.local`, whose address
+ * holds the subscription NFT) — there is NO separate app / protocol identity.
+ *
+ * WHAT COUNTS AS "RUNTIME-RELEVANT"
+ * ---------------------------------
+ * The source of truth is the smart-app env schema
+ * (`apps/showcase/smart-app/src/config/env-validation.ts` in the hsuite-ecosystem
+ * repo). {@link RUNTIME_ENV_KEYS} mirrors that key set. Anything not in the set —
+ * purely deploy-time / CLI-only knobs the container never reads
+ * (`DEPLOYED_APP_ID` book-keeping, `SUBSCRIPTION_NFT_SERIAL`, `VALIDATOR_API_KEY`,
+ * docker/build flags, etc.) — is NOT forwarded.
+ *
+ * The customer-env Secret is PQC-encrypted (kyber-aes-v1) at rest — that is the
+ * containment boundary. No secret is ever written into a committed manifest.
+ */
+import type { EnvMap } from './env';
+/**
+ * Runtime env keys forwarded from `.env.local` into the deployed customer-env.
+ *
+ * MIRRORS the smart-app `EnvSchema`
+ * (`apps/showcase/smart-app/src/config/env-validation.ts`). Keep this in lockstep
+ * with that schema: a key the smart-app reads at runtime but that is absent here
+ * would not reach the container (the #1564 class of bug), and a key here that the
+ * smart-app never reads is harmless noise in the Secret.
+ *
+ * Deliberately EXCLUDES purely deploy-time / CLI-only vars that the deployed
+ * container never consumes:
+ *   - `SUBSCRIPTION_NFT_SERIAL`  — a `hsuite subscribe` book-keeping value.
+ *   - `VALIDATOR_API_KEY` / `SMART_HOST_API_KEY` — the in-cluster app authenticates
+ *     as its wallet (Web3 challenge-response); a raw API key is a deploy-time /
+ *     local-only convenience, not a container runtime credential, and the deployer
+ *     injects the mediated `SMART_HOST_URL` / `APP_TOKEN` via the cluster-env
+ *     Secret. (Forwarding a raw validator key would also widen the tenant's
+ *     credential surface for no runtime benefit.)
+ */
+export declare const RUNTIME_ENV_KEYS: readonly string[];
+/**
+ * Env keys whose presence makes the deployed app boot in cluster (subscribed)
+ * mode rather than open / in-memory mode. The smart-app's `BaaSAuthService`
+ * builds its signer from `XRPL_SEED` (`createXrplWeb3Signer(seed)`), so a missing
+ * `XRPL_SEED` in the container is exactly the #1564 open-mode footgun.
+ */
+export declare const CLUSTER_MODE_REQUIRED_KEYS: readonly string[];
+export interface ResolveRuntimeEnvInput {
+    /** The parsed `.env.local` (developer runtime + deploy-time creds). */
+    env: EnvMap;
+    /** `manifest.backend.env` — explicit, committed, NON-secret overrides. */
+    manifestEnv?: Record<string, string>;
+    /**
+     * Opt-in escape hatch for an intentional OPEN-MODE deploy — e.g. a zero-cred
+     * fork demo the developer wants to run unsubscribed/in-memory.
+     *
+     * When true, the developer's `XRPL_SEED` is DELIBERATELY WITHHELD from the
+     * forwarded container env (so the deployed app boots open/in-memory mode), and
+     * the fail-loud {@link OpenModeDeployError} is suppressed. The seed still exists
+     * in `.env.local` for the local deploy-time work (auth + attestation signing) —
+     * it is just not injected into the running container.
+     *
+     * When false (the default), the developer's runtime creds — including
+     * `XRPL_SEED` — are forwarded so the deployed app runs cluster/subscribed mode,
+     * and a resolved env with no `XRPL_SEED` throws {@link OpenModeDeployError}
+     * rather than silently shipping open mode.
+     */
+    allowOpenMode?: boolean;
+    /**
+     * Optional sink for non-fatal advisories (e.g. a secret-shaped key found in the
+     * committed manifest surface). Injected by the command so warnings surface to
+     * the operator; omitted in unit tests that assert the pure merge.
+     */
+    warn?: (message: string) => void;
+}
+/**
+ * A subscribed-but-credential-less deploy was blocked. Thrown by
+ * {@link resolveRuntimeEnv} when the resolved container env carries no
+ * `XRPL_SEED` and `allowOpenMode` is not set — so a deploy never SILENTLY ships
+ * an open-mode app (the #1564 invisible failure). The remedy (populate
+ * `.env.local` via `hsuite init` + `hsuite subscribe`, or opt in explicitly) is
+ * on the message.
+ */
+export declare class OpenModeDeployError extends Error {
+    constructor(missing: readonly string[]);
+}
+/**
+ * Resolve the runtime env the deployed container should receive.
+ *
+ * Merge + precedence (issue #1564, criterion "define + document the precedence"):
+ *   1. Start from the runtime-relevant vars in `.env.local` (secrets like
+ *      `XRPL_SEED` + app config) — {@link RUNTIME_ENV_KEYS} filtered.
+ *   2. Overlay `manifest.backend.env` LAST, so an explicitly-set manifest key
+ *      WINS. The manifest is the committed, explicit override surface for
+ *      NON-secret config (ports, feature flags, Discord/AI endpoints); secrets
+ *      are supplied automatically by `.env.local` and never need to be
+ *      hand-written into a committed manifest.
+ *
+ * Rationale for manifest-wins: a value a developer deliberately typed into the
+ * manifest is an intentional per-deploy override and must not be silently shadowed
+ * by whatever happens to sit in their local `.env.local`. Secrets, by contrast,
+ * are NOT expected in the manifest — they flow from `.env.local` — so the two
+ * surfaces do not normally collide on secret keys.
+ *
+ * Fail-loud (criterion "a subscribed-but-credential-less deploy fails loudly"):
+ * if the merged result has no `XRPL_SEED` and `allowOpenMode` is not set, throws
+ * {@link OpenModeDeployError} rather than shipping a silent open-mode app.
+ *
+ * @throws {OpenModeDeployError} when the resolved env is credential-less and
+ *   `allowOpenMode` is not set.
+ */
+export declare function resolveRuntimeEnv(input: ResolveRuntimeEnvInput): Record<string, string>;
+//# sourceMappingURL=runtime-env.d.ts.map

package/dist/_lib/runtime-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../../src/_lib/runtime-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAEpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EA4C7C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAAkB,CAAC;AAE3E,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAWD;;;;;;;GAOG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,SAAS,MAAM,EAAE;CAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiDxB"}

package/dist/_lib/runtime-env.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenModeDeployError = exports.CLUSTER_MODE_REQUIRED_KEYS = exports.RUNTIME_ENV_KEYS = void 0;
+exports.resolveRuntimeEnv = resolveRuntimeEnv;
+/**
+ * Runtime env keys forwarded from `.env.local` into the deployed customer-env.
+ *
+ * MIRRORS the smart-app `EnvSchema`
+ * (`apps/showcase/smart-app/src/config/env-validation.ts`). Keep this in lockstep
+ * with that schema: a key the smart-app reads at runtime but that is absent here
+ * would not reach the container (the #1564 class of bug), and a key here that the
+ * smart-app never reads is harmless noise in the Secret.
+ *
+ * Deliberately EXCLUDES purely deploy-time / CLI-only vars that the deployed
+ * container never consumes:
+ *   - `SUBSCRIPTION_NFT_SERIAL`  — a `hsuite subscribe` book-keeping value.
+ *   - `VALIDATOR_API_KEY` / `SMART_HOST_API_KEY` — the in-cluster app authenticates
+ *     as its wallet (Web3 challenge-response); a raw API key is a deploy-time /
+ *     local-only convenience, not a container runtime credential, and the deployer
+ *     injects the mediated `SMART_HOST_URL` / `APP_TOKEN` via the cluster-env
+ *     Secret. (Forwarding a raw validator key would also widen the tenant's
+ *     credential surface for no runtime benefit.)
+ */
+exports.RUNTIME_ENV_KEYS = [
+    // Application
+    'NODE_ENV',
+    'PORT',
+    'APP_ID',
+    'APP_NAME',
+    'APP_DESCRIPTION',
+    // CORS
+    'CORS_ORIGINS',
+    // XRPL — the developer's own wallet identity (holds the subscription NFT).
+    'XRPL_NETWORK',
+    'XRPL_ADDRESS',
+    'XRPL_SEED',
+    'XRPL_PUBLIC_KEY',
+    // Subscription binding
+    'SUBSCRIPTION_APP_ID',
+    'DEPLOYED_APP_ID',
+    // Cluster connection (the deployer also injects mediated in-cluster URLs via
+    // the cluster-env Secret; a developer override still forwards here).
+    'VALIDATOR_URL',
+    'SMART_HOST_URL',
+    // Agent AI / templates
+    'AI_PROVIDER',
+    'AI_MODEL',
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_MODEL',
+    'OPENAI_API_KEY',
+    'GEMINI_API_KEY',
+    'AI_BASE_URL',
+    'AI_API_KEY',
+    'AI_MAX_TOKENS',
+    'DISCORD_WEBHOOK_URL',
+    'WEATHER_PAYOUT_ADDRESS',
+    // Misc runtime
+    'REQUEST_TIMEOUT',
+    'DEBUG',
+    // Subscription behaviour
+    'AUTO_SUBSCRIBE',
+    'SUBSCRIPTION_TIER',
+    // NOTE: `DEV_MODE` / `ALLOW_INSECURE` are deliberately NOT forwarded — they are
+    // local-dev safety toggles, and a stale `DEV_MODE=true` / `ALLOW_INSECURE=true`
+    // sitting in a developer's `.env.local` must not silently propagate into a live
+    // deployment. A deploy that genuinely needs one can set it explicitly (and
+    // intentionally) via `manifest.backend.env`.
+];
+/**
+ * Env keys whose presence makes the deployed app boot in cluster (subscribed)
+ * mode rather than open / in-memory mode. The smart-app's `BaaSAuthService`
+ * builds its signer from `XRPL_SEED` (`createXrplWeb3Signer(seed)`), so a missing
+ * `XRPL_SEED` in the container is exactly the #1564 open-mode footgun.
+ */
+exports.CLUSTER_MODE_REQUIRED_KEYS = ['XRPL_SEED'];
+/**
+ * Heuristic: does a key name look like a secret? Used only to WARN when such a
+ * key appears in `manifest.backend.env` — the committed, typically git-tracked
+ * surface — since secrets are meant to flow from `.env.local`, not the manifest.
+ */
+function looksLikeSecretKey(key) {
+    return /(_SEED|_PRIVATE_KEY|_API_KEY|_SECRET|_TOKEN|_PASSWORD|_MNEMONIC)$/.test(key);
+}
+/**
+ * A subscribed-but-credential-less deploy was blocked. Thrown by
+ * {@link resolveRuntimeEnv} when the resolved container env carries no
+ * `XRPL_SEED` and `allowOpenMode` is not set — so a deploy never SILENTLY ships
+ * an open-mode app (the #1564 invisible failure). The remedy (populate
+ * `.env.local` via `hsuite init` + `hsuite subscribe`, or opt in explicitly) is
+ * on the message.
+ */
+class OpenModeDeployError extends Error {
+    constructor(missing) {
+        super(`Refusing to deploy an OPEN-MODE (credential-less) app: the resolved ` +
+            `container env is missing ${missing.join(', ')}. The deployed smart-app ` +
+            `authenticates as YOUR XRPL wallet (the XRPL_SEED in --env), which holds ` +
+            `the subscription NFT; without it the app boots in-memory/unsubscribed ` +
+            `and BaaS routes 503. Run \`hsuite init\` + \`hsuite subscribe\` so ` +
+            `.env.local carries the creds, or pass --allow-open-mode for an ` +
+            `intentional zero-cred fork deploy.`);
+        this.name = 'OpenModeDeployError';
+    }
+}
+exports.OpenModeDeployError = OpenModeDeployError;
+/**
+ * Resolve the runtime env the deployed container should receive.
+ *
+ * Merge + precedence (issue #1564, criterion "define + document the precedence"):
+ *   1. Start from the runtime-relevant vars in `.env.local` (secrets like
+ *      `XRPL_SEED` + app config) — {@link RUNTIME_ENV_KEYS} filtered.
+ *   2. Overlay `manifest.backend.env` LAST, so an explicitly-set manifest key
+ *      WINS. The manifest is the committed, explicit override surface for
+ *      NON-secret config (ports, feature flags, Discord/AI endpoints); secrets
+ *      are supplied automatically by `.env.local` and never need to be
+ *      hand-written into a committed manifest.
+ *
+ * Rationale for manifest-wins: a value a developer deliberately typed into the
+ * manifest is an intentional per-deploy override and must not be silently shadowed
+ * by whatever happens to sit in their local `.env.local`. Secrets, by contrast,
+ * are NOT expected in the manifest — they flow from `.env.local` — so the two
+ * surfaces do not normally collide on secret keys.
+ *
+ * Fail-loud (criterion "a subscribed-but-credential-less deploy fails loudly"):
+ * if the merged result has no `XRPL_SEED` and `allowOpenMode` is not set, throws
+ * {@link OpenModeDeployError} rather than shipping a silent open-mode app.
+ *
+ * @throws {OpenModeDeployError} when the resolved env is credential-less and
+ *   `allowOpenMode` is not set.
+ */
+function resolveRuntimeEnv(input) {
+    const { env, manifestEnv = {}, allowOpenMode = false, warn } = input;
+    const merged = {};
+    // 1. Runtime-relevant vars from .env.local (only keys the smart-app reads).
+    //    Under an explicit open-mode deploy, the cluster-mode secrets (XRPL_SEED)
+    //    are DELIBERATELY WITHHELD from the container so it boots open/in-memory —
+    //    the seed still exists locally for attestation, it is just not injected.
+    const withhold = allowOpenMode ? new Set(exports.CLUSTER_MODE_REQUIRED_KEYS) : new Set();
+    for (const key of exports.RUNTIME_ENV_KEYS) {
+        if (withhold.has(key))
+            continue;
+        const val = env.get(key);
+        if (val !== undefined && val !== '') {
+            merged[key] = val;
+        }
+    }
+    // 2. manifest.backend.env wins (explicit, committed, non-secret overrides).
+    //    NOTE: manifest keys are NOT bounded by RUNTIME_ENV_KEYS — the manifest is
+    //    the explicit, developer-authored, committed override surface, so a
+    //    manifest-only key (e.g. a custom feature flag) passes through verbatim.
+    //    The allowlist governs only the `.env.local` source (step 1). An empty
+    //    manifest value is forwarded as-is (an explicit author choice), unlike an
+    //    empty `.env.local` value which is dropped in step 1.
+    for (const [key, val] of Object.entries(manifestEnv)) {
+        if (warn && looksLikeSecretKey(key)) {
+            warn(`manifest.backend.env sets a secret-shaped key "${key}" — the manifest is ` +
+                `typically git-committed. Secrets should live in your --env file ` +
+                `(.env.local), which is forwarded automatically; only NON-secret ` +
+                `overrides belong in the manifest.`);
+        }
+        merged[key] = val;
+    }
+    // 3. Fail loud on a credential-less (open-mode) deploy unless opted in — so a
+    //    subscribed app never SILENTLY ships open mode (the #1564 invisible bug).
+    if (!allowOpenMode) {
+        const missing = exports.CLUSTER_MODE_REQUIRED_KEYS.filter((k) => merged[k] === undefined || merged[k] === '');
+        if (missing.length > 0) {
+            throw new OpenModeDeployError(missing);
+        }
+    }
+    return merged;
+}
+//# sourceMappingURL=runtime-env.js.map

package/dist/_lib/runtime-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../../src/_lib/runtime-env.ts"],"names":[],"mappings":";;;AAiMA,8CAmDC;AAlND;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,gBAAgB,GAAsB;IACjD,cAAc;IACd,UAAU;IACV,MAAM;IACN,QAAQ;IACR,UAAU;IACV,iBAAiB;IACjB,OAAO;IACP,cAAc;IACd,2EAA2E;IAC3E,cAAc;IACd,cAAc;IACd,WAAW;IACX,iBAAiB;IACjB,uBAAuB;IACvB,qBAAqB;IACrB,iBAAiB;IACjB,6EAA6E;IAC7E,qEAAqE;IACrE,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB,aAAa;IACb,UAAU;IACV,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,iBAAiB;IACjB,OAAO;IACP,yBAAyB;IACzB,gBAAgB;IAChB,mBAAmB;IACnB,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,2EAA2E;IAC3E,6CAA6C;CAC9C,CAAC;AAEF;;;;;GAKG;AACU,QAAA,0BAA0B,GAAsB,CAAC,WAAW,CAAC,CAAC;AA+B3E;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,mEAAmE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAA0B;QACpC,KAAK,CACH,sEAAsE;YACpE,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,iEAAiE;YACjE,oCAAoC,CACvC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAbD,kDAaC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,iBAAiB,CAC/B,KAA6B;IAE7B,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,aAAa,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAErE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,kCAA0B,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,wBAAgB,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,0DAA0D;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CACF,kDAAkD,GAAG,sBAAsB;gBACzE,kEAAkE;gBAClE,kEAAkE;gBAClE,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,kCAA0B,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CACnD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/_lib/subscription-client.d.ts

@@ -1,20 +1,52 @@
-/**
- * Thin HTTP client for the validator-side `/api/v3/subscription/*` surface.
- *
- * Wraps the routes implemented in `apps/smart-validator/src/subscription/
- * subscription.controller.ts`. The endpoints are `@Public()` and live on
- * the same gateway URL the CLI's `init` writes to env as `VALIDATOR_URL`.
- *
- * Kept dependency-free (uses global `fetch`) so the CLI command bodies
- * stay small and easy to unit-test with the standard `jest.fn()` mock
- * pattern. Tests inject a fake `fetch` via the constructor.
- */
 export type DepositInstructions = {
     walletAddress: string;
     tokenId: string;
     amount: string;
     chain: string;
 };
+/**
+ * Canonical `ValidatorRules` block — what the validator's mandatory creation
+ * gate (`EntityCreationOrchestrator`) parses against `ValidatorRulesSchema`
+ * before it will create any entity. Kept as a structural type here so the CLI
+ * has no runtime dependency on `@hsuite/smart-engines-shared`.
+ */
+export type ValidatorRules = Record<string, unknown> & {
+    version: string;
+    type: 'account' | 'token' | 'topic' | 'agent';
+    created: string;
+};
+/**
+ * Smart-app create payload — mirrors `CreateSmartAppSchema`
+ * (apps/smart-validator/src/smart-app/dto/create-smart-app.dto.ts).
+ */
+export type CreateAppPayload = {
+    name: string;
+    services: string[];
+    config: Record<string, unknown>;
+    tier: string;
+    networks: string[];
+    /**
+     * Optional — mirrors `CreateSmartAppSchema.validatorRules` (`.optional()`).
+     * When omitted the validator's create factory synthesizes the canonical
+     * security-first default (the standard deployment path). `hsuite subscribe`
+     * leaves it unset so the default applies.
+     */
+    validatorRules?: ValidatorRules;
+};
+/**
+ * Response from `POST /api/v3/smart-apps` (SmartAppController.create).
+ */
+export type CreateAppResponse = {
+    appId: string;
+    name: string;
+    status: string;
+    services: string[];
+    createdAt?: string;
+    configCid?: string;
+    blsPubKeyHex?: string;
+    subscriptionId?: string;
+    depositInstructions?: DepositInstructions;
+};
 export type SubscriptionRequestResponse = {
     success: boolean;
     subscriptionId?: string;
@@ -32,6 +64,20 @@ export type SubscriptionStatusResponse = {
     appName?: string;
     status?: string;
     subscriptionNftSerial?: number | string;
+    /**
+     * Per-chain minted-NFT coordinates exposed by the validator once the
+     * subscription NFT is minted. For XRPL this carries the NFTokenID, the
+     * issuing account (the cluster SignerList issuer), and the sell-offer tx id —
+     * enough for the CLI to resolve + accept the brokered sell offer WITHOUT a
+     * manual `--nft-issuer` flag.
+     */
+    chainNfts?: {
+        xrpl?: {
+            nftId?: string;
+            issuerAddress?: string;
+            offerTxId?: string;
+        };
+    };
     expiresAt?: string | number;
     remainingBalance?: string;
     createdAt?: string | number;
@@ -114,17 +160,85 @@ export type FetchLike = (input: string, init?: any) => Promise<{
 export type SubscriptionClientOptions = {
     baseUrl: string;
     fetchImpl?: FetchLike;
+    /** HTTP request timeout in ms. Defaults to 180_000 (deposit-account creation
+     * is a synchronous multi-step on-chain ceremony; the SDK's 30s default is too
+     * short on a slow public XRPL endpoint). */
+    requestTimeoutMs?: number;
+    /**
+     * Optional web3-auth creds. When set, `authenticate()` obtains a validator
+     * bearer session (the subscription routes are session-guarded since P4d, so
+     * `request`/`mint` 401 without it).
+     */
+    auth?: {
+        chain: string;
+        address: string;
+        seed: string;
+    };
 };
 /**
  * Validator-side subscription HTTP client.
  *
- * All routes match the controller at
- * apps/smart-validator/src/subscription/subscription.controller.ts.
+ * Adapter over the SDK's {@link SdkSubscriptionClient} + {@link ValidatorAuthClient}.
+ * All HTTP/fetch + auth logic lives in the SDK; this class only adapts method
+ * names + base URL, flattens the SDK's `pendingTierChange` envelope onto the
+ * flat `effectiveAt`/`depositInstructions` the CLI consumers read, and (for
+ * tests) bridges the injectable `fetchImpl` seam onto the SDK transport.
  */
 export declare class SubscriptionClient {
-    private readonly baseUrl;
-    private readonly fetchImpl;
+    /** Validator origin WITHOUT the /api/v3 prefix (auth routes are un-prefixed). */
+    private readonly origin;
+    private readonly sdk;
+    private readonly http;
+    private readonly auth?;
     constructor(opts: SubscriptionClientOptions);
+    /**
+     * Web3-auth against the validator: challenge → sign → authenticate → bearer.
+     * The validator auth controller is mounted WITHOUT the `/api` prefix
+     * (`/auth/validator/...`). Call before request/mint; no-op without creds.
+     *
+     * Delegates to the SDK's {@link ValidatorAuthClient} for the
+     * challenge/authenticate round-trip; signing stays here (ripple-keypairs)
+     * because it owns the dev wallet seed. The resulting bearer is attached to
+     * the shared HTTP client via `setAuthToken`, so subsequent SDK calls carry it.
+     */
+    authenticate(): Promise<void>;
+    /**
+     * Run a bearer-authenticated call with transparent re-auth on token expiry.
+     *
+     * The deposit-account creation behind `POST /subscription/request` is a
+     * synchronous multi-step on-chain ceremony (~60-90s on a slow public XRPL
+     * endpoint — see the constructor's timeout note). The validator session
+     * bearer obtained in {@link authenticate} can expire DURING that window, so
+     * the next session-guarded call (`status`/`mint`) comes back 401
+     * "Invalid or expired authentication token" and the CLI's post-payment NFT
+     * mint/accept steps never run.
+     *
+     * This wrapper makes every bearer call robust to ANY request duration (not
+     * just a fixed-but-longer TTL): on a 401 / expired-token error it re-runs
+     * {@link authenticate} (re-signs a fresh challenge → fresh bearer) ONCE and
+     * retries the call. A second failure surfaces unchanged. No-op re-auth (no
+     * creds configured) is skipped — a retry without a fresh bearer can't help.
+     */
+    private withReauth;
+    /**
+     * Create the canonical smart-app entity via `POST /api/v3/smart-apps`
+     * (`SmartAppController.create`) — runs the per-entity DKG ceremony to derive
+     * `entityId` AND creates the paid pending-deposit subscription on that id,
+     * returning `{ appId: entityId, depositInstructions, subscriptionId }`.
+     *
+     * The MINT-FIRST entry point for `hsuite subscribe`: the returned `entityId`
+     * becomes the subscription appId end-to-end (no throwaway `app-${uuid}`).
+     * Auth-gated (developer session) — uses the same validator bearer obtained by
+     * {@link authenticate}, and reuses the long request timeout (the synchronous
+     * DKG ceremony + on-chain deposit-account funding exceeds the SDK's 30s
+     * default). Wrapped in {@link withReauth} so a session expiry during the slow
+     * ceremony re-signs + retries once.
+     *
+     * Posts on the shared `${origin}/api/v3` client (the same base the
+     * subscription calls use), so the path is the controller-relative
+     * `/smart-apps` and the full URL is `${origin}/api/v3/smart-apps`.
+     */
+    createApp(payload: CreateAppPayload): Promise<CreateAppResponse>;
     request(payload: {
         appId: string;
         developerAccountId: string;
@@ -145,8 +259,5 @@ export declare class SubscriptionClient {
     usage(appId: string): Promise<UsageSummaryResponse>;
     usageStatus(appId: string): Promise<UsageStatusResponse>;
     billing(appId: string, limit?: number, offset?: number): Promise<BillingLedgerResponse>;
-    private post;
-    private get;
-    private send;
 }
 //# sourceMappingURL=subscription-client.d.ts.map

package/dist/_lib/subscription-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-client.d.ts","sourceRoot":"","sources":["../../src/_lib/subscription-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KAC/B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,IAAI,GAAG;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;IAC7D,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,IAAI,EAAE,yBAAyB;IAOrC,OAAO,CAAC,OAAO,EAAE;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAIlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAM1D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO1C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAOrE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOrE,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAM5D,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMnD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMxD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,EAAE,MAAM,SAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAOtE,IAAI;YAIJ,GAAG;YAIH,IAAI;CAenB"}
+{"version":3,"file":"subscription-client.d.ts","sourceRoot":"","sources":["../../src/_lib/subscription-client.ts"],"names":[],"mappings":"AAuCA,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KAC/B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,IAAI,GAAG;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;IAC7D,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;gDAE4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAmD;gBAE7D,IAAI,EAAE,yBAAyB;IAsB3C;;;;;;;;;OASG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBnC;;;;;;;;;;;;;;;;OAgBG;YACW,UAAU;IAWxB;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIhE,OAAO,CAAC,OAAO,EAAE;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAMlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAM1D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM1C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAUrE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOrE,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK5D,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMnD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMxD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,EAAE,MAAM,SAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAMrF"}