@hsuite/smart-engines-sdk 3.3.0 → 3.4.0

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # Changelog
 
+## 3.4.0 — 2026-05-31
+
+**Production-readiness arc.** Closes the audit gap identified after 3.3.0 shipped: ~55 of ~110 third-party-facing server endpoints were wrapped; this release brings coverage to ~95/110 (the remaining ~15 are intentionally internal — operator / DKG ceremony / harbor admin). SDK test suite grew from 477 → 637 (+160 tests).
+
+Shipped as 7 stacked PRs (#995, #997, #998, #999, #1000, #1002, #1003).
+
+### Breaking changes
+
+- **`baas.messaging.setPresence` / `getPresence` / `removePresence`** — signatures now take `channel` as the first argument. The previous appId-scoped paths returned 404 server-side, so behaviourally the breakage is `404 → works`.
+- **`baas.storage.listFiles`** — pagination option renamed `skip` → `offset` to match the server query-string. The previous `skip` value was silently dropped.
+- **`baas.storage.getFile`** — `@deprecated`, now forwards to `download`. The previous endpoint never resolved server-side.
+- **Gateway response types realigned** — `HealthResponse`, `GatewayStatusResponse`, `GatewayReadinessResponse`, `GatewayMetricsResponse`, `HostInfo`, `RegisterHostRequest`, `VerificationMethod`, `DnsRecordType` all rewritten to match what `apps/smart-gateway` actually returns. Compile-time errors surface latent caller bugs; previous types were fabricated.
+- **`baas.agents.fund` / `trade` / `withdraw`** — return type changed from `{ success; txId? }` to `PreparedTransactionResponse` envelope (sovereignty flow). Callers can now reach the prepared transaction bytes; previously unreachable through the declared type.
+- **`tss.signMPC`** — `chain` parameter restricted to literal `'hedera'`. Other chains were never wired server-side and silently 404'd.
+- **`Rules.module.agent`** — removed. Server retired `AgentOrganism` in Arc 6 Phase 6.5; SDK module factory was silently no-op'ing on the cluster.
+
+### Fixed — BaaS endpoint paths that 404'd in production (PR #995)
+
+`apps/smart-host` requires `:appId` in every BaaS path; the SDK omitted it on 9 methods plus used the wrong verb on one:
+
+- `storage.download` / `getMetadata` / `exists` / `getUsage` — all now correctly prefixed with `:appId`.
+- `functions.invoke` / `get` / `update` / `delete` / `getLogs` / `list` — same fix.
+- `messaging.setPresence` / `getPresence` / `removePresence` — channel-scoped per server.
+- `agents.updateRules` — verb corrected `PUT` → `PATCH`.
+- `db.listCollections` — path corrected to `/collections`.
+- `db.createCollection` / `dropCollection` — new wrappers for endpoints that lacked SDK methods.
+
+Regression spec `libs/smartengine-sdk/src/baas/endpoint-paths.spec.ts` pins every fixed URL + verb.
+
+Plumbing: `HttpClient` gained a `patch` method (previously missing) to unblock all PATCH-based endpoints across the SDK.
+
+### Added — `client.dao` (PR #998)
+
+Full typed wrapper over the ~30 endpoints registered by `apps/smart-validator/src/dao/dao.controller.ts`. The largest single missing surface from the audit.
+
+- **Lifecycle** — `create`, `list`, `get`, `getWithProposals`.
+- **Proposals** — `listProposals`, `createProposal`, `prepareProposal`, `signProposal`, `prepareVote`, `submitVote`, `vote`, `execute`, plus `getVotes` / `getResults` / `getVoteCounts` / `getVoterRecord`.
+- **Treasury** — `getTreasury`, `getTreasuryHistory`.
+- **Members** — `listMembers`, `addMember`, `removeMember`, `claimMemberNft`, `getMemberNft`.
+- **`client.dao.dashboard`** — per-user rollups (`getStats`, `getActiveProposals`, `getVoteHistory`, `getActivity`, `getPendingActions`, `getImpact`).
+
+### Added — Hedera TSS + Async TSS + NFT prepare paths (PR #999)
+
+- **`client.hedera.tss`** — six TSS-signed immediate-execute endpoints (cluster signs + submits in one round-trip): `createAccount`, `updateMemo`, `createTopic`, `submitMessage`, `createToken`, `mintToken`.
+- **`client.tss`** — async workflow: `createEntityAsync`, `reshareClusterAsync`, `getJob(jobId)`, `signForApp(appId, ...)`.
+- **`client.transactions`** — four NFT prepare paths for Polkadot pallet-nfts + Solana Metaplex: `prepareNftCollectionCreate`, `prepareNftSetMetadata`, `prepareNftCollectionSetMetadata`, `prepareNftCollectionLock`.
+- **`client.xrpl`** — `prepareAccountSetup` (two-step `SignerListSet` + `DisableMaster` for XRPL sovereignty).
+
+### Added — Six new sub-clients (PR #1000)
+
+- **`client.bridge`** — 8 cross-chain bridge endpoints (`create`, `list`, `get`, `port`, `return`, `getStatus`, `getSupply`, `listClaims`).
+- **`client.resources`** — quota / consumption / nodes: 8 endpoints (`getSummary`, `getConsumption`, `getHistory`, `getLedger`, `getStatus`, `getBreakdown`, `listNodes`, `getNode`).
+- **`client.envelope`** — `encrypt` / `decrypt` (third-party crypto utility).
+- **`client.tokens`** — token-migration: `migrate`, `listMigrations`, `getMigration`, `getMigrationsForToken`, `getDetails`. The last collides with `client.getTokenInfo` at Nest route registration; documented as a known limitation.
+- **`client.operator`** — read-only operator-funding: `getBalance`, `getTopup`.
+- **`client.subscription`** — extended with `downgrade`, `upgrade`, `cancelTierChange`, `getActiveFor`, `getUsage`, `getUsageStatus`, `getBilling`, `mintCustomer`.
+
+### Added — Rules-engine parity (PR #1002)
+
+- **8 canonical server-mirror templates** field-for-field with `libs/validator-rules-builder/src/templates`: `Rules.template.utilityToken`, `daoGovernedToken`, `soulboundNft`, `subscriptionNft`, `membershipNft`, `managedAccount`, `systemTopic`, `appTopic`. Sits alongside the existing higher-altitude composers (`fairLaunch`, `tradingAgent`, etc.) so devs pick altitude.
+- **12 fluent builder methods** on `BaseRuleBuilder`: `withLimits`, `withRateLimiter`, `withSnapshot`, `withCooldown`, `withApprovalThreshold` (canonical atoms now first-class on token/account/topic); molecule shortcuts `withSwap`, `withAirdrop`, `withVesting`, `withStreaming`, `withGovernanceModule`; plus Phase-6.6 AI atoms `withMaxTradesPerWindow` and `withRequireStructuredOutput` on `AgentRulesBuilder`.
+- **`baas.rules.simulate(req)`** confirmed present and tested against `POST /api/rules/simulate`.
+
+**Server-side follow-up required**: the 12 new molecule module types (`swap`, `airdrop`, `vesting`, `streaming`, `governance`, `max-trades-per-window`, `require-structured-output`, etc.) will **fail-closed** at the cluster until `libs/rules-engine/src/modules/builtin-modules.ts` registers them. Today only `launchpad / dex / dao / staking-pool` are registered.
+
+### Added — Discovery extras + Deployment KEK / webhook / metrics (PR #1003)
+
+- **`client.discovery`** — `listAllClusters` (full set, not just active), `getClusterByNode(nodeId)`, plus `client.discovery.platformImages` sub-namespace: `list`, `listEnvelopes`, `get`, `getVersion`, `verify`.
+- **`baas.deployment`** — `setWebhook(appId, url)` (returns per-tenant HMAC secret), `getMetrics(appId)` (Prometheus text/plain — `HttpClient.getText` plumbing added to bypass JSON.parse), `rotateKek(appId)`, `revokeKek(appId, version)` (ADR-011 Phase 6 KEK rotation surface).
+
+### Verified
+
+- `yarn jest`: 637 passing + 1 skipped = 638 total (was 477 in 3.3.0).
+- `yarn build:tsc`: clean (`tsc --skipLibCheck --declaration`).
+
 ## 3.3.0 — 2026-05-29
 
 **Smart-App Rules SDK arc.** Adds a complete canonical-rule authoring surface