@hsuite/smart-engines-cli 1.2.1 → 1.4.0

package/README.md

@@ -1,8 +1,8 @@
 # @hsuite/smart-engines-cli
 
 `hsuite` — the developer bootstrap CLI for [Smart Engines V3](https://hsuite.finance).
-Three commands that take you from "empty directory" to "smart-app running
-against the live testnet cluster" in under a minute.
+Takes you from "empty directory" to "smart-app running against the live testnet
+cluster" in under a minute, then manages the deployment's lifecycle.
 
 ```bash
 npm install -g @hsuite/smart-engines-cli
@@ -10,8 +10,14 @@ npm install -g @hsuite/smart-engines-cli
 
 ```
 hsuite init                    # XRPL wallet + faucet + .env.local
-hsuite subscribe --env <file>  # free_testnet smart-app registration on cluster
-hsuite deploy --manifest <f>   # deploy a smart-app from a JSON manifest
+hsuite subscribe --env <file>  # paid smart-app subscription on cluster (tier builder|growth|scale|enterprise)
+
+# deployment lifecycle (manifest-driven):
+hsuite deploy   --manifest <f> # THE canonical path — fresh deploy AND redeploy
+hsuite redeploy --manifest <f> # thin convenience: distinct --app-id / --tag override
+hsuite update   --replicas 3   # patch runtime config (cpu/memory/degree/replicas/env)
+hsuite suspend | resume | delete
+hsuite status [--watch] | list
 ```
 
 XRPL-only. The CLI generates an XRPL keypair, funds it via the testnet
@@ -57,9 +63,8 @@ API_KEY_ENABLED=false
 CORS_ORIGINS=http://localhost:8101,http://localhost:8100,http://localhost:4200
 ...
 
-# Subscription — run `hsuite subscribe` to register a free_testnet smart-app
-SKIP_SUBSCRIPTION_CHECK=true
-SUBSCRIPTION_TIER=free_testnet
+# Subscription — run `hsuite subscribe` to register a paid smart-app. Default tier is builder.
+SUBSCRIPTION_TIER=builder
 # SUBSCRIPTION_APP_ID=          # populated by `hsuite subscribe`
 ```
 
@@ -67,13 +72,15 @@ SUBSCRIPTION_TIER=free_testnet
 
 ## `hsuite subscribe`
 
-Register a `free_testnet` smart-app on the cluster. On testnet, the
-validator explicitly skips the deposit/NFT gate — DKG runs, the smart-app
-goes ACTIVE immediately, and the cluster-issued `appId` becomes your
-smart-app's on-chain identity.
+Register a paid smart-app subscription on the cluster. Every connection is
+paid: pick a tier (`builder | growth | scale | enterprise`, default `builder`),
+the cluster spins up a TSS deposit wallet and returns deposit instructions, and
+the subscription NFT mints once the HSUITE deposit confirms on-chain. DKG runs
+so the cluster-issued `appId` becomes your smart-app's on-chain identity.
 
 ```bash
 hsuite subscribe --env .env.local
+hsuite subscribe --env .env.local --tier growth
 hsuite subscribe --env .env.local --name "My Smart App"
 hsuite subscribe --env .env.local --services database,storage,messaging
 hsuite subscribe --env .env.local --gateway https://my-cluster.example.com
@@ -85,52 +92,263 @@ Flow:
 2. Builds a signer using `ripple-keypairs.sign`
 3. Authenticates via `BaasClient.authenticate({chain: 'xrpl', ...})` against the cluster
 4. Calls `BaasClient.deployment.init({name, port, services})` — the new four-step deploy flow's step 1 (legacy `register()` removed in PR-A); the cluster runs the per-entity DKG ceremony and returns the DKG entityId as `appId`
-5. Appends `SUBSCRIPTION_APP_ID=<appId>` and `APP_ID=<appId>` to your `.env.local`, flips `SKIP_SUBSCRIPTION_CHECK=false`
+5. Appends `SUBSCRIPTION_APP_ID=<appId>` and `APP_ID=<appId>` to your `.env.local`
 
 After this, your smart-app boots in cluster-mode automatically.
 
 ---
 
-## `hsuite deploy`
+## Deployment commands
 
-Deploy a smart-app image from a JSON manifest via the SDK's four-step
-runtime-orchestration flow (`init` → `docker push` → optional
-`uploadFrontend` → `deploy`). Use this for CI pipelines that ship a
-container image to the cluster.
+Eight commands take a smart-app from a manifest to a running, manageable
+deployment on the cluster. They all share base flags:
 
-```bash
-hsuite deploy --manifest ./my-app.json --env .env.local
-hsuite deploy --manifest ./my-app.json --env .env.local --non-interactive   # for CI
-```
+| Flag | Default | Meaning |
+|---|---|---|
+| `--env <file>` | `.env.local` | Env file with the XRPL auth creds |
+| `--gateway <url>` | `https://gateway.testnet.hsuite.network` | Public gateway/host URL |
+| `--app-id <id>` | `DEPLOYED_APP_ID` → `SUBSCRIPTION_APP_ID` | App to act on |
+
+Every command constructs exactly **one** `BaasClient`
+(`{ hostUrl, appId, pathPrefix: '/host', allowInsecure, timeout }`) and
+authenticates it with the env XRPL signer — connecting straight to the public
+round-robin gateway (no cluster-discovery factory, whose per-cluster hostnames
+aren't reachable from a dev machine).
+
+### The manifest (one canonical shape)
 
-`my-app.json`:
+Source of truth: `packages/hsuite-cli/src/_lib/deploy-manifest.ts`.
 
-```json
+Every smart-app is a **NestJS backend**, optionally fronted by an **ionic SPA**.
+The manifest has ONE shape: a required `backend` block plus an optional
+`frontend` block.
+
+```jsonc
 {
   "name": "my-smart-app",
-  "port": 3000,
-  "tag": "v1",
-  "replicas": 1,
-  "services": ["database", "storage", "messaging", "functions"],
-  "env": { "NODE_ENV": "production" },
-  "frontend": { "bundlePath": "./dist/bundle.tar.gz" }
+  "services": ["database", "storage", "messaging", "functions"],  // ('auth'|'database'|'storage'|'functions'|'messaging')[]
+  "degree": 3,                              // clusters to span (>=3; 3 is the floor)
+  "backend": {                              // REQUIRED — the NestJS image
+    "port": 3200,                           // backend listen port, 1..65535, NEVER 8080 (reserved for the edge sidecar)
+    "tag": "v1",                            // image tag (REQUIRED)
+    "replicas": 1,                          // pods per cluster (default 1)
+    "context": ".",                         // docker build context (default '.')
+    "dockerfile": "Dockerfile",             // default 'Dockerfile'
+    "platform": "linux/amd64",              // default 'linux/amd64' (cluster-node arch)
+    "build": "yarn build",                  // optional pre-build shell cmd, run in context
+    "env": { "NODE_ENV": "production" },    // NON-SECRET overrides only — merged over the auto-forwarded .env.local runtime env (manifest wins)
+    "limits": { "cpu": "500m", "memory": "512Mi" }
+  },
+  "frontend": {                             // OPTIONAL — ionic SPA, served by the EDGE sidecar (NOT the backend)
+    "build": "ng build",                    // optional pre-build command
+    "dir": "www",                           // dir to tar into the SPA bundle
+    "bundlePath": null                      // OR a pre-built tarball (wins over `dir`)
+  }
 }
 ```
 
-What the command does, in order:
+#### Runtime env: auto-forwarded from `.env.local` (do NOT hand-copy secrets)
+
+`hsuite deploy` **automatically forwards your `.env.local` runtime creds into the
+deployed container** — so the deployed app runs with the **same identity + config
+it runs with locally**. The deployed smart-app authenticates as **your own XRPL
+wallet** (the `XRPL_SEED` in `.env.local`, whose address holds the subscription
+NFT); there is no separate app identity. You therefore **never hand-copy
+`XRPL_SEED` / `HEDERA_PRIVATE_KEY` / chain creds into a committed manifest** — a
+manual step that, if forgotten, silently shipped a **credential-less, open-mode**
+app (`/baas/status` → `{"mode":"memory","appId":null}`; BaaS routes 503). See
+issue #1564.
+
+**What gets forwarded:** the runtime-relevant keys from your `.env.local` — the
+same set the smart-app's env schema reads (`XRPL_*`, `SUBSCRIPTION_APP_ID`,
+`APP_*`, `VALIDATOR_URL`/`SMART_HOST_URL`, AI/Discord config, …). Purely
+deploy-time / CLI-only knobs (e.g. `SUBSCRIPTION_NFT_SERIAL`, `VALIDATOR_API_KEY`)
+are **not** forwarded. The list lives in
+`packages/hsuite-cli/src/_lib/runtime-env.ts` (`RUNTIME_ENV_KEYS`), mirroring the
+smart-app schema (`apps/showcase/smart-app/src/config/env-validation.ts` in the
+hsuite-ecosystem repo).
+
+**Precedence:** the forwarded `.env.local` values are the base;
+**`manifest.backend.env` is overlaid last and WINS** for any key it sets. Use
+`backend.env` for explicit **non-secret** per-deploy overrides (ports, feature
+flags, Discord/AI endpoints). Secrets flow automatically from `.env.local` and do
+not belong in a committed manifest. Everything lands in the app's **PQC-encrypted
+(kyber-aes-v1) per-app customer-env Secret** — the pod's runtime env, `envFrom`-
+mounted on the backend container. Encryption at rest is the containment boundary;
+no secret is ever written into a committed file.
+
+**Fail-loud:** if a deploy would ship the app **credential-less** (no `XRPL_SEED`
+reaching the container) the CLI **errors** rather than silently booting open mode.
+An intentional open-mode deploy stays valid via the explicit `--allow-open-mode`
+flag, which deliberately **withholds** the seed from the container (open mode)
+while still using it locally to sign the required build attestation.
+
+> The same forwarding + fail-loud applies to `hsuite redeploy`.
+
+Backend-only example (no `frontend` block — the edge proxies all paths to the
+backend):
+
+```jsonc
+{
+  "name": "my-api",
+  "services": ["database"],
+  "degree": 3,
+  "backend": { "port": 3200, "tag": "v1" }
+}
+```
 
-1. **`deployment.init`** — cluster allocates the `appId` (per-entity DKG
-   entityId) and returns ephemeral DOCR push credentials.
-2. **(out-of-band)** the CLI prints the `docker login` + `docker push`
-   commands and waits for Enter (skipped with `--non-interactive`,
-   `CI=true`, or no TTY — the caller is assumed to have completed the
-   push).
-3. **`deployment.uploadFrontend`** — if `frontend.bundlePath` is set, the
-   tarball is uploaded.
-4. **`deployment.deploy`** — the cluster reconciles the requested `tag`
-   + `replicas` + `env` to k8s.
+> Relative `frontend.dir` / `frontend.bundlePath` (and the frontend `build` hook)
+> resolve against the backend's build `context` (the smart-app root) — NOT the
+> directory you ran `hsuite` from. A bare `"public"` means
+> `<smart-app>/public`. `degree` is validated client-side against the host floor
+> (`>= 3`) so a bad value fails with a clear CLI error instead of a server 500.
+
+### Serving model: the public-vs-edge split
+
+Every deployed customer pod has **two containers**:
+
+- The customer **backend** listens on **loopback** at `backend.port` (e.g.
+  `3200`). It is NOT exposed at the pod boundary, and `8080` is **forbidden**
+  for the backend.
+- A platform **edge sidecar** (Caddy) listens on port `8080` — the pod's
+  exposed/Service port. The edge reverse-proxies API requests to the backend on
+  loopback and serves the SPA.
+
+The ionic SPA is served by the **edge sidecar, not the backend**. The optional
+`frontend` block is tarred and uploaded (`uploadFrontend`) into the cluster BaaS
+storage tier, content-addressed by sha256. At pod start a **bundle-fetcher init
+container** fetches that bundle into a shared emptyDir, which the edge serves
+read-only from `/srv/spa`, falling back to the SPA shell (`index.html`) for
+client-side routing. For a **backend-only** app (no `frontend` block) the edge
+proxies all paths to the backend.
+
+> The SPA is also commonly baked into the backend image's own `public/` — but in
+> the deployed pod it is the **edge-served uploaded bundle** that the public sees
+> on port `8080`.
+>
+> (Refs: `apps/smart-deployer/src/reconciler/caddyfile-renderer.service.ts`,
+> `apps/smart-deployer/src/reconciler/k8s-resource-builder.service.ts`.)
+
+### Multi-cluster image distribution
+
+`harbor.testnet.hsuite.network` is **public-DNS round-robin** over the 3 cluster
+ingress IPs, each fronting its own Harbor. A single `docker push` lands the image
+on **only one** cluster. `hsuite deploy` therefore **fans the image out** to every
+cluster Harbor itself, synchronously, BEFORE reconciling: it resolves the
+registry host's A-records, copies the pushed image to each cluster at the
+Registry-v2 level (TLS-SNI pinned to the federated hostname, 401/Bearer token
+auth, blob copy + manifest PUT), then **re-verifies the exact pushed digest is
+served by every cluster and ABORTS the deploy** if any cluster can't be made to
+serve it. This replaces reliance on the (unreliable) Harbor cross-cluster
+replication mesh for customer images — the mesh is no longer load-bearing. The
+push-robot credential is BLS-deterministic and identical on all 3 cluster
+Harbors, which is what lets one credential authenticate the fan-out against every
+cluster. `--skip-distribute` opts out (single-cluster / dev registry).
+(Implementation: `packages/hsuite-cli/src/_lib/registry-fanout.ts`.)
+
+### Deploy strategy (Recreate vs RollingUpdate)
+
+The strategy is driven by replica count
+(`apps/smart-deployer/src/reconciler/k8s-resource-builder.service.ts`
+`buildDeployment`):
+
+- **Single-replica apps (`replicas <= 1`) use `Recreate`.** A single-replica
+  tenant CANNOT surge — the per-tenant `ResourceQuota` only fits one pod — so
+  `RollingUpdate` would deadlock. Pods are stateless (no RWO PVC), so
+  Recreate-in-place is safe.
+- **Multi-replica apps use zero-downtime `RollingUpdate{maxSurge:1,
+  maxUnavailable:0}`.**
+
+The `strategy` field on the manifest/deploy request is **advisory**: a
+`recreate` request is coerced to `RollingUpdate` for multi-replica apps (with a
+warning).
+
+### `hsuite deploy` — THE canonical deploy path
+
+`hsuite deploy --manifest <file>` is the **single, canonical path** to deploy a
+customer smart-app (NestJS backend + optional ionic SPA) across the 3-cluster
+testnet. It handles BOTH a fresh deploy AND a redeploy of an existing/active
+app. There is no hand-rolled `deploy-*.cjs` script and no manual per-cluster
+`docker push` — exactly one path: `hsuite deploy`.
+
+**Mint-first / deploy-last:** the developer's `SUBSCRIPTION_APP_ID` IS the deploy
+target (created + paid by `hsuite subscribe`; `SUBSCRIPTION_APP_ID ==
+DEPLOYED_APP_ID == DKG entityId`). `deploy` **allocates nothing** — it
+authenticates as that id and fetches push creds for it (`pushCredentials`,
+idempotent).
+
+Flow: resolve `SUBSCRIPTION_APP_ID` → `connectAndAuth` → `pushCredentials` →
+docker build+push (backend) → **fan the image out to every cluster Harbor**
+(verify + abort on any miss) → tar + `uploadFrontend` (frontend) → sign a build
+attestation → `deploy()`. Writes `DEPLOYED_APP_ID` to the env file.
 
-The returned `appId` is appended to `.env.local` as `DEPLOYED_APP_ID`.
+```bash
+hsuite deploy --manifest ./my-app.json --env .env.local
+hsuite deploy --manifest ./my-app.json --strategy recreate
+hsuite deploy --manifest ./my-app.json --docker-host unix:///path/docker.sock
+hsuite deploy --manifest ./my-app.json --skip-build --skip-push   # image already pushed
+hsuite deploy --manifest ./my-app.json --skip-distribute          # single-cluster / dev registry
+hsuite deploy --manifest ./my-app.json --subscription-app-id sub_… # override the deploy target
+```
+
+Flags: `--manifest <file>`, `--env <file>` (default `.env.local`), `--project
+<dir>` (SDK/framework detection root), `--gateway <url>`, `--subscription-app-id
+<id>`, `--strategy rolling|recreate`, `--docker-host <host>` (defaults to
+`$DOCKER_HOST`), `--skip-build`, `--skip-push`, `--skip-distribute`,
+`--allow-open-mode` (permit an intentional zero-cred / open-mode deploy; default
+OFF — a subscribed-but-credential-less deploy fails loud), `--non-interactive`.
+
+The docker login uses the init-issued one-time robot creds via
+`execFileSync('docker', ['login', server, '-u', username, '--password-stdin'])`
+— the robot username (`robot$project+name`) is a discrete argv element and the
+password is fed on stdin, so the `$` is never shell-expanded.
+
+### `hsuite redeploy` — thin convenience
+
+`redeploy` is NOT a separate required path — `hsuite deploy` already redeploys an
+existing/active app. `redeploy` is a thin convenience for passing a **distinct
+deployed `--app-id`** and/or a **`--tag` override**. It rebuilds + pushes the
+backend image, fans it out to every cluster (same `--skip-distribute` opt-out),
+re-uploads the SPA bundle when the manifest carries a `frontend` block, then
+`deploy()`s.
+
+```bash
+hsuite redeploy --manifest ./my-app.json --tag v2
+hsuite redeploy --manifest ./my-app.json --app-id app_… --strategy recreate
+hsuite redeploy --manifest ./my-app.json --skip-distribute
+```
+
+### `hsuite update`
+
+Patch runtime config without a new image — at least one field required.
+
+```bash
+hsuite update --cpu 500m --memory 512Mi
+hsuite update --replicas 3 --degree 3
+hsuite update --strategy recreate
+hsuite update --env-set NODE_ENV=production --env-set LOG_LEVEL=info
+```
+
+### `hsuite suspend` / `resume` / `delete`
+
+```bash
+hsuite suspend                 # scale the runtime to zero
+hsuite resume                  # scale it back up
+hsuite delete                  # tear down (confirms; --yes to skip, required when non-TTY)
+hsuite delete --yes
+```
+
+### `hsuite status` / `list`
+
+```bash
+hsuite status                  # state + runtime (runtimeState / replicas / lastError)
+hsuite status --watch          # poll until RUNNING / FAILED
+hsuite status --json
+hsuite list                    # table of {appId, name, status}
+hsuite list --json
+```
+
+The deployed `appId` is appended to `.env.local` as `DEPLOYED_APP_ID`.
 
 ---
 
@@ -141,7 +359,7 @@ mkdir my-smart-app && cd my-smart-app
 npm install -g @hsuite/smart-engines-cli
 
 hsuite init                                  # → .env.local with funded XRPL wallet
-hsuite subscribe --env .env.local            # → free_testnet appId on cluster
+hsuite subscribe --env .env.local            # → paid (builder) subscription appId on cluster
 cat .env.local | grep XRPL_ADDRESS           # → your wallet address
 cat .env.local | grep SUBSCRIPTION_APP_ID    # → your smart-app's DKG entity ID
 ```
@@ -156,30 +374,26 @@ That's it — you now have:
 ## What the CLI does NOT do
 
 - **Pay HCS fees.** The cluster's validator/host pods do that from their own pod-local Hedera operator accounts. The smart-app never sees Hedera credentials.
-- **Mint a subscription NFT for `free_testnet`.** The validator's smart-app service explicitly skips this gate on testnet — the DKG entity ID IS the on-chain registration proof. Paid-tier NFT minting is a separate post-launch flow.
+- **Confirm the HSUITE deposit for you.** `subscribe` creates the subscription and returns deposit instructions, but you fund the TSS deposit wallet yourself; the subscription NFT mints (and the smart-app goes ACTIVE) only once that deposit confirms on-chain.
 - **Configure your smart-app's business logic.** If your smart-app does Hedera-side or Solana-side or any other-chain ops as part of its app logic, that's separate from the dev wallet and you configure it in your app's own code/env.
 
 ---
 
 ## Use programmatically
 
-Each command is exported for scripting:
+The `hsuite` package is a **CLI only** — its entry point (`dist/index.js`) is an executable that parses `process.argv` on load and exposes no importable API. There are no `initWallet` / `subscribeFreeTestnet` / `deploySmartApp` functions to import.
+
+For programmatic access from your own code, use the SDK directly — see [Companion packages](#companion-packages):
 
 ```ts
-import { initWallet, subscribeFreeTestnet, deploySmartApp } from '@hsuite/smart-engines-cli';
-
-await initWallet({
-  out: '.env.local',
-  network: 'testnet',
-  gateway: 'https://v3-testnet-gateway.hsuite.network',
-  fund: true,
-});
-
-await subscribeFreeTestnet({
-  env: '.env.local',
-  gateway: 'https://v3-testnet-gateway.hsuite.network',
-  services: 'database,storage,messaging,functions',
-});
+import { /* ... */ } from '@hsuite/smart-engines-sdk';
+```
+
+To automate the CLI itself, shell out to the `hsuite` binary from your build scripts or CI:
+
+```sh
+hsuite init --out .env.local
+hsuite subscribe --env .env.local --tier builder
 ```
 
 ---

package/dist/_lib/attestation.d.ts

@@ -0,0 +1,45 @@
+import { type BuildAttestation } from '@hsuite/smart-engines-sdk';
+import type { Framework } from './framework';
+/** Everything needed to assemble an attestation, minus `version`/`builtAt`. */
+export type AttestationInputs = {
+    appId: string;
+    developerWallet: string;
+    developerChain: BuildAttestation['developerChain'];
+    framework: Framework;
+    sdkVersion: string;
+    imageDigest: string;
+    /** '' for backend-only apps (no frontend bundle). */
+    bundleSha256: string;
+    cliVersion: string;
+    /** Injectable clock for deterministic tests; defaults to `Date.now()`. */
+    now?: () => number;
+};
+/** A signed attestation: the payload plus the developer's `<pub>.<sig>` string. */
+export type SignedAttestation = {
+    payload: BuildAttestation;
+    signature: string;
+};
+/**
+ * Read this CLI's own version from its `package.json`, for `cliVersion`.
+ *
+ * `__dirname` at runtime is `dist/_lib`, so the package root is two levels up.
+ * Falls back to `'0.0.0'` if it can't be read (mirrors index.ts's getVersion).
+ */
+export declare function readCliVersion(): string;
+/**
+ * Assemble a {@link BuildAttestation} from resolved inputs. Pins `version: '1'`
+ * and stamps `builtAt` from the injectable clock (default `Date.now()`).
+ *
+ * Field order here is cosmetic — the SDK canonicalizer sorts keys before
+ * hashing — but mirrors the type for readability.
+ */
+export declare function assembleAttestation(inputs: AttestationInputs): BuildAttestation;
+/**
+ * Assemble + sign in one step with the developer's XRPL seed, returning the
+ * `{ payload, signature }` envelope the deploy request carries.
+ *
+ * Delegates the signature to the frozen SDK primitive so the bytes the server
+ * verifies are produced by the canonical code path.
+ */
+export declare function assembleAndSign(inputs: AttestationInputs, xrplSeed: string): SignedAttestation;
+//# sourceMappingURL=attestation.d.ts.map

package/dist/_lib/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../src/_lib/attestation.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACnD,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,gBAAgB,CAc/E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,MAAM,GACf,iBAAiB,CAInB"}

package/dist/_lib/attestation.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readCliVersion = readCliVersion;
+exports.assembleAttestation = assembleAttestation;
+exports.assembleAndSign = assembleAndSign;
+/**
+ * CLI-side assembly of a {@link BuildAttestation}.
+ *
+ * The cryptographic primitive (`signAttestation`, the `BuildAttestation` type,
+ * the canonicalizer) lives in `@hsuite/smart-engines-sdk` and is FROZEN — this
+ * module only imports it. The SDK primitive is deliberately clock-free and
+ * pure; the one impure input, `builtAt`, is supplied HERE (the CLI is allowed
+ * to read the clock).
+ *
+ * `assembleAttestation` gathers every field from already-resolved inputs:
+ *   - developerWallet / developerChain : the env XRPL identity (env.ts signer)
+ *   - sdkVersion                       : installed/declared SDK (framework.ts)
+ *   - cliVersion                       : this CLI's package.json version
+ *   - imageDigest                      : the pushed image's manifest digest
+ *   - bundleSha256                     : uploadFrontend's server-computed hash
+ *   - builtAt                          : Date.now() at call time
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const smart_engines_sdk_1 = require("@hsuite/smart-engines-sdk");
+/**
+ * Read this CLI's own version from its `package.json`, for `cliVersion`.
+ *
+ * `__dirname` at runtime is `dist/_lib`, so the package root is two levels up.
+ * Falls back to `'0.0.0'` if it can't be read (mirrors index.ts's getVersion).
+ */
+function readCliVersion() {
+    try {
+        const pkgPath = (0, path_1.join)(__dirname, '..', '..', 'package.json');
+        const pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/**
+ * Assemble a {@link BuildAttestation} from resolved inputs. Pins `version: '1'`
+ * and stamps `builtAt` from the injectable clock (default `Date.now()`).
+ *
+ * Field order here is cosmetic — the SDK canonicalizer sorts keys before
+ * hashing — but mirrors the type for readability.
+ */
+function assembleAttestation(inputs) {
+    const now = inputs.now ?? Date.now;
+    return {
+        version: '1',
+        appId: inputs.appId,
+        developerWallet: inputs.developerWallet,
+        developerChain: inputs.developerChain,
+        framework: inputs.framework,
+        sdkVersion: inputs.sdkVersion,
+        imageDigest: inputs.imageDigest,
+        bundleSha256: inputs.bundleSha256,
+        cliVersion: inputs.cliVersion,
+        builtAt: now(),
+    };
+}
+/**
+ * Assemble + sign in one step with the developer's XRPL seed, returning the
+ * `{ payload, signature }` envelope the deploy request carries.
+ *
+ * Delegates the signature to the frozen SDK primitive so the bytes the server
+ * verifies are produced by the canonical code path.
+ */
+function assembleAndSign(inputs, xrplSeed) {
+    const payload = assembleAttestation(inputs);
+    const signature = (0, smart_engines_sdk_1.signAttestation)(payload, xrplSeed);
+    return { payload, signature };
+}
+//# sourceMappingURL=attestation.js.map

package/dist/_lib/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../../src/_lib/attestation.ts"],"names":[],"mappings":";;AAoDA,wCAQC;AASD,kDAcC;AASD,0CAOC;AAnGD;;;;;;;;;;;;;;;;GAgBG;AACH,2BAAkC;AAClC,+BAA4B;AAC5B,iEAGmC;AAwBnC;;;;;GAKG;AACH,SAAgB,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,MAAyB;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,GAAG,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,MAAyB,EACzB,QAAgB;IAEhB,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAA,mCAAkB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC"}