@ckb-firewall/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 digitaldrreamer and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,108 @@
+# @ckb-firewall/cli
+
+[![npm](https://img.shields.io/npm/v/@ckb-firewall/cli)](https://www.npmjs.com/package/@ckb-firewall/cli)
+![License](https://img.shields.io/badge/license-MIT-blue.svg)
+
+Command-line tooling for inspecting and governing the [CKB Transaction Firewall](https://github.com/digitaldrreamer/ckb-transaction-firewall) blacklist registry.
+
+Node 20+. ESM only.
+
+## Install
+
+```bash
+npm install -g @ckb-firewall/cli
+```
+
+Or use the one-line installer (handles Node version checks and PATH setup):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/digitaldrreamer/ckb-transaction-firewall/main/scripts/install-cli.sh | bash
+```
+
+## Commands
+
+### `ckb-firewall inspect`
+
+Display the current blacklist entries from the live testnet registry cell.
+
+```bash
+ckb-firewall inspect
+```
+
+Options: `--rpc-url`, `--registry-tx`, `--registry-index` (defaults point at the canonical testnet cell).
+
+---
+
+### Quick path — testnet/dev
+
+These commands produce a signed transaction file ready for `ckb-cli`. They use placeholder governance witnesses and are intended for testnet experimentation and development.
+
+```bash
+# Add a lock-args to the blacklist
+ckb-firewall add --lock-args 0xabc123...
+
+# Remove a lock-args from the blacklist
+ckb-firewall remove --lock-args 0xabc123...
+```
+
+Both commands are interactive when flags are omitted. Both accept `--sign` to sign and submit in one step via `ckb-cli`.
+
+---
+
+### Full governance flow
+
+The full flow creates an auditable, community-reviewed proposal with a 72-hour review window, validator voting, and 3-of-5 multisig signing before anything is executed on-chain.
+
+**1. Create a proposal**
+
+```bash
+ckb-firewall propose
+```
+
+Prompts for action (add/remove), lock args, threat classification, severity, evidence, rationale, and proposer identity. Stores the proposal locally (`~/.ckb-firewall/proposals/`) and prints the proposal ID.
+
+**2. Vote on proposals**
+
+```bash
+ckb-firewall vote --proposal <id> --vote yes --validator alice
+```
+
+Interactive when flags are omitted. Requires a minimum of 3 yes votes before signing is allowed.
+
+**3. List proposals**
+
+```bash
+ckb-firewall proposals
+ckb-firewall proposals --status voting
+ckb-firewall proposals --status approved
+```
+
+Shows a table with status, vote tally, signature count, and review window countdown.
+
+**4. Sign an approved proposal**
+
+```bash
+ckb-firewall sign --proposal <id> --signer-index 0
+```
+
+Prompts for a 32-byte secp256k1 private key (password-masked). Falls back to a deterministic dev key for testnet use. Signing is only allowed after the 72-hour review window has passed and the vote threshold is met.
+
+**5. Execute on-chain**
+
+```bash
+ckb-firewall execute --proposal <id>
+```
+
+Builds and writes a governance transaction JSON file. Add `--sign` to sign and submit via `ckb-cli` in one step.
+
+---
+
+## Testnet defaults
+
+All commands default to the canonical testnet registry cell. See [`docs/deployments/testnet.registry.json`](https://github.com/digitaldrreamer/ckb-transaction-firewall/blob/main/docs/deployments/testnet.registry.json) for the exact cell outpoint and script identity.
+
+## More
+
+- [CKB Transaction Firewall](https://github.com/digitaldrreamer/ckb-transaction-firewall) — contracts, TypeScript SDK, Rust SDK, governance docs, testnet deployment
+- [Governance model](https://github.com/digitaldrreamer/ckb-transaction-firewall/blob/main/docs/governance.md)
+- [Architecture and trust model](https://github.com/digitaldrreamer/ckb-transaction-firewall/blob/main/docs/architecture.md)

package/dist/commands/add.d.ts

@@ -0,0 +1,13 @@
+export interface AddOptions {
+    lockArgs?: string;
+    expiresAt: string;
+    rpcUrl: string;
+    registryTx: string;
+    registryIndex: string;
+    txOut: string;
+    sign: boolean;
+    fromAccount: string;
+}
+export declare function addCommand(opts: AddOptions): Promise<void>;
+export declare function addDefaults(): Partial<AddOptions>;
+//# sourceMappingURL=add.d.ts.map

package/dist/commands/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AA0DD,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwMhE;AAED,wBAAgB,WAAW,IAAI,OAAO,CAAC,UAAU,CAAC,CAUjD"}

package/dist/commands/add.js

@@ -0,0 +1,247 @@
+import { writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import chalk from "chalk";
+import logSymbols from "log-symbols";
+import ora from "ora";
+import inquirer from "inquirer";
+import { parseRegistryPayload } from "@ckb-firewall/sdk";
+import { getLiveCell } from "../lib/rpc.js";
+import { encodeRegistryPayload, insertSorted, bytesToHex, hexToBytes, strip0x, } from "../lib/blkl.js";
+import { ckbBlake2b, buildGov1Witness, buildWitnessArgs, placeholderSigners, } from "../lib/witness.js";
+import { TESTNET_RPC_URL, TESTNET_REGISTRY_CELL, TESTNET_CONTRACT_OUTPOINTS, SECP256K1_DEP_GROUP, } from "../lib/defaults.js";
+import { printHints } from "../lib/hints.js";
+function isValidHex(value) {
+    const clean = strip0x(value);
+    return clean.length > 0 && /^[0-9a-fA-F]+$/.test(clean) && clean.length % 2 === 0;
+}
+function normaliseHex(value) {
+    return `0x${strip0x(value).toLowerCase()}`;
+}
+async function promptLockArgs() {
+    const { lockArgs } = await inquirer.prompt([
+        {
+            type: "input",
+            name: "lockArgs",
+            message: "Lock args to blacklist (0x-prefixed hex):",
+            validate(input) {
+                if (!input.trim())
+                    return "Lock args cannot be empty.";
+                if (!isValidHex(input.trim()))
+                    return "Must be valid even-length hex (e.g. 0xabc123...).";
+                return true;
+            },
+        },
+    ]);
+    return lockArgs.trim();
+}
+async function promptExpiresAt() {
+    const { choice } = await inquirer.prompt([
+        {
+            type: "list",
+            name: "choice",
+            message: "Expiry:",
+            choices: [
+                { name: "Never (permanent listing)", value: "never" },
+                { name: "Custom unix timestamp", value: "custom" },
+            ],
+        },
+    ]);
+    if (choice === "never")
+        return "0";
+    const { ts } = await inquirer.prompt([
+        {
+            type: "input",
+            name: "ts",
+            message: "Expiry (unix timestamp in seconds):",
+            validate(input) {
+                const n = Number(input.trim());
+                if (!Number.isFinite(n) || n <= 0)
+                    return "Enter a positive integer.";
+                return true;
+            },
+        },
+    ]);
+    return ts.trim();
+}
+export async function addCommand(opts) {
+    const rpcUrl = opts.rpcUrl;
+    const txHash = opts.registryTx;
+    const index = Number.parseInt(opts.registryIndex, 10);
+    if (!Number.isInteger(index) || index < 0) {
+        console.error(logSymbols.error, chalk.red("--registry-index must be a non-negative integer."));
+        process.exit(1);
+    }
+    // ── interactive prompts when args are missing ────────────────────────────
+    let rawLockArgs = opts.lockArgs?.trim() ?? "";
+    if (!rawLockArgs) {
+        console.log();
+        rawLockArgs = await promptLockArgs();
+    }
+    else if (!isValidHex(rawLockArgs)) {
+        console.error(logSymbols.error, chalk.red(`Invalid --lock-args: "${rawLockArgs}". Must be even-length hex (e.g. 0xabc123...).`));
+        process.exit(1);
+    }
+    const lockArgs = normaliseHex(rawLockArgs);
+    // If expiresAt is still the default "0", optionally prompt (skip if running non-interactively).
+    let expiresAtStr = opts.expiresAt;
+    if (expiresAtStr === "0" && !opts.lockArgs && process.stdin.isTTY) {
+        expiresAtStr = await promptExpiresAt();
+    }
+    if (!/^\d+$/.test(expiresAtStr.trim())) {
+        console.error(logSymbols.error, chalk.red("--expires-at must be a non-negative integer (unix timestamp, or 0 for never)."));
+        process.exit(1);
+    }
+    const expiresAt = BigInt(expiresAtStr.trim());
+    // ── fetch registry ───────────────────────────────────────────────────────
+    const spinner = ora("Fetching current registry cell").start();
+    let cell;
+    try {
+        cell = await getLiveCell(rpcUrl, txHash, index);
+        spinner.succeed("Registry cell loaded");
+    }
+    catch (err) {
+        spinner.fail("Could not fetch the registry cell");
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(chalk.red(`\n  ${msg}`));
+        console.error(chalk.dim("  Check that your RPC node is reachable and the cell outpoint is correct."));
+        process.exit(1);
+    }
+    // ── parse current payload ────────────────────────────────────────────────
+    let currentPayload;
+    try {
+        currentPayload = parseRegistryPayload(cell.data);
+    }
+    catch {
+        console.error(logSymbols.error, chalk.red("The registry cell does not contain a valid BLKL v1 payload."));
+        console.error(chalk.dim("  Pass --registry-tx and --registry-index to point at the correct cell."));
+        process.exit(1);
+    }
+    // ── duplicate check ──────────────────────────────────────────────────────
+    if (currentPayload.entries.some((e) => strip0x(e.identifier).toLowerCase() === strip0x(lockArgs).toLowerCase())) {
+        console.log();
+        console.log(logSymbols.warning, chalk.yellow(`${lockArgs} is already in the registry. Nothing to do.`));
+        console.log();
+        process.exit(0);
+    }
+    // ── build new payload ────────────────────────────────────────────────────
+    const newEntries = insertSorted(currentPayload.entries, { identifier: lockArgs, expiresAt });
+    const newPayload = { version: currentPayload.version, entries: newEntries };
+    const newBlkl = encodeRegistryPayload(newPayload);
+    const oldBlkl = hexToBytes(cell.data);
+    console.log();
+    console.log(chalk.bold("Proposed change:"));
+    console.log(`  ${logSymbols.success} Add   ${chalk.green(lockArgs)}`);
+    console.log(`  Expires: ${expiresAt === 0n ? "never" : new Date(Number(expiresAt) * 1000).toISOString()}`);
+    console.log(`  Registry size: ${currentPayload.entries.length} → ${newEntries.length} entries`);
+    console.log();
+    // ── build governance witness ─────────────────────────────────────────────
+    const proposalData = new TextEncoder().encode(`add:${lockArgs}:${expiresAt}:${Date.now()}`);
+    const proposalIdHash = ckbBlake2b(proposalData);
+    const voteDigestHash = ckbBlake2b(proposalIdHash);
+    const oldRoot = ckbBlake2b(oldBlkl);
+    const newRoot = ckbBlake2b(newBlkl);
+    const gov1 = buildGov1Witness({
+        proposalIdHash,
+        voteDigestHash,
+        oldRoot,
+        newRoot,
+        signers: placeholderSigners(3),
+    });
+    const witnessBytes = buildWitnessArgs({
+        lock: new Uint8Array(65),
+        inputType: gov1,
+    });
+    // ── build transaction ────────────────────────────────────────────────────
+    const txJson = {
+        transaction: {
+            version: "0x0",
+            cell_deps: [
+                { out_point: { tx_hash: SECP256K1_DEP_GROUP.txHash, index: "0x0" }, dep_type: "dep_group" },
+                {
+                    out_point: {
+                        tx_hash: TESTNET_CONTRACT_OUTPOINTS.blacklistRegistry.txHash,
+                        index: `0x${TESTNET_CONTRACT_OUTPOINTS.blacklistRegistry.index.toString(16)}`,
+                    },
+                    dep_type: "code",
+                },
+            ],
+            header_deps: [],
+            inputs: [
+                { since: "0x0", previous_output: { tx_hash: cell.txHash, index: `0x${cell.index.toString(16)}` } },
+            ],
+            outputs: [{ capacity: cell.capacity, lock: cell.lock, type: cell.type }],
+            outputs_data: [bytesToHex(newBlkl)],
+            witnesses: [bytesToHex(witnessBytes)],
+        },
+        multisig_configs: {},
+        signatures: {},
+    };
+    const txOut = opts.txOut;
+    writeFileSync(txOut, JSON.stringify(txJson, null, 2) + "\n");
+    console.log(logSymbols.success, `Transaction written to ${chalk.bold(txOut)}`);
+    console.log();
+    // ── sign / submit ────────────────────────────────────────────────────────
+    if (!opts.sign) {
+        console.log("Sign and submit with ckb-cli:");
+        console.log(chalk.dim(`  ckb-cli wallet sign-txs --tx-file ${txOut} --from-account <your-address>\n` +
+            `  ckb-cli wallet apply-txs --tx-file ${txOut}`));
+        console.log();
+        printHints("add");
+        return;
+    }
+    let fromAccount = opts.fromAccount;
+    if (!fromAccount && process.stdin.isTTY) {
+        const { account } = await inquirer.prompt([
+            {
+                type: "input",
+                name: "account",
+                message: "Governance account address (ckb-cli --from-account):",
+                validate: (v) => v.trim().length > 0 || "Account address is required.",
+            },
+        ]);
+        fromAccount = account.trim();
+    }
+    if (!fromAccount) {
+        console.error(logSymbols.error, chalk.red("--from-account is required when using --sign."));
+        process.exit(1);
+    }
+    const { proceed } = await inquirer.prompt([
+        {
+            type: "confirm",
+            name: "proceed",
+            message: `Sign and submit the transaction using account ${fromAccount}?`,
+            default: false,
+        },
+    ]);
+    if (!proceed) {
+        console.log("Aborted.");
+        return;
+    }
+    const signSpinner = ora("Signing with ckb-cli").start();
+    try {
+        execFileSync("ckb-cli", ["wallet", "sign-txs", "--tx-file", txOut, "--from-account", fromAccount], { stdio: "inherit" });
+        signSpinner.succeed("Signed");
+        const submitSpinner = ora("Submitting").start();
+        execFileSync("ckb-cli", ["wallet", "apply-txs", "--tx-file", txOut], { stdio: "inherit" });
+        submitSpinner.succeed("Submitted");
+        printHints("add");
+    }
+    catch (err) {
+        signSpinner.fail("ckb-cli failed");
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        console.error(chalk.dim(`  You can sign manually: ckb-cli wallet sign-txs --tx-file ${txOut} --from-account ${fromAccount}`));
+        process.exit(1);
+    }
+}
+export function addDefaults() {
+    return {
+        expiresAt: "0",
+        rpcUrl: TESTNET_RPC_URL,
+        registryTx: TESTNET_REGISTRY_CELL.txHash,
+        registryIndex: String(TESTNET_REGISTRY_CELL.index),
+        txOut: "gov_add_tx.json",
+        sign: false,
+        fromAccount: "",
+    };
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAa7C,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAuB;QAC/D;YACE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,2CAA2C;YACpD,QAAQ,CAAC,KAAa;gBACpB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;oBAAE,OAAO,4BAA4B,CAAC;gBACvD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAC3B,OAAO,mDAAmD,CAAC;gBAC7D,OAAO,IAAI,CAAC;YACd,CAAC;SACF;KACF,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAqB;QAC3D;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE;gBACrD,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;aACnD;SACF;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IAEnC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAiB;QACnD;YACE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,qCAAqC;YAC9C,QAAQ,CAAC,KAAa;gBACpB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,2BAA2B,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;SACF;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAE5E,IAAI,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,CAAC;SAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CACX,UAAU,CAAC,KAAK,EAChB,KAAK,CAAC,GAAG,CAAC,yBAAyB,WAAW,gDAAgD,CAAC,CAChG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAE3C,gGAAgG;IAChG,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,IAAI,YAAY,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClE,YAAY,GAAG,MAAM,eAAe,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC,CAAC;QAC5H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9C,4EAA4E;IAE5E,MAAM,OAAO,GAAG,GAAG,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9D,IAAI,IAA6C,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAE5E,IAAI,cAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CACX,UAAU,CAAC,KAAK,EAChB,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CACzE,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAE5E,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChH,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,6CAA6C,CAAC,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAE5E,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CACT,cAAc,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,oBAAoB,cAAc,CAAC,OAAO,CAAC,MAAM,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,4EAA4E;IAE5E,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,cAAc;QACd,cAAc;QACd,OAAO;QACP,OAAO;QACP,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,gBAAgB,CAAC;QACpC,IAAI,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;QACxB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,4EAA4E;IAE5E,MAAM,MAAM,GAAG;QACb,WAAW,EAAE;YACX,OAAO,EAAE,KAAK;YACd,SAAS,EAAE;gBACT,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;gBAC3F;oBACE,SAAS,EAAE;wBACT,OAAO,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,MAAM;wBAC5D,KAAK,EAAE,KAAK,0BAA0B,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;qBAC9E;oBACD,QAAQ,EAAE,MAAM;iBACjB;aACF;YACD,WAAW,EAAE,EAAE;YACf,MAAM,EAAE;gBACN,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE;aACnG;YACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACxE,YAAY,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACnC,SAAS,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;SACtC;QACD,gBAAgB,EAAE,EAAE;QACpB,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,0BAA0B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,4EAA4E;IAE5E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uCAAuC,KAAK,kCAAkC;YAC9E,wCAAwC,KAAK,EAAE,CAChD,CACF,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAsB;YAC7D;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,sDAAsD;gBAC/D,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,8BAA8B;aAC/E;SACF,CAAC,CAAC;QACH,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAuB;QAC9D;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,iDAAiD,WAAW,GAAG;YACxE,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAElD,MAAM,WAAW,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACzH,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8DAA8D,KAAK,mBAAmB,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,qBAAqB,CAAC,MAAM;QACxC,aAAa,EAAE,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAClD,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC"}

package/dist/commands/execute.d.ts

@@ -0,0 +1,12 @@
+export interface ExecuteOptions {
+    proposal?: string;
+    rpcUrl: string;
+    registryTx: string;
+    registryIndex: string;
+    txOut: string;
+    sign: boolean;
+    fromAccount: string;
+}
+export declare function executeCommand(opts: ExecuteOptions): Promise<void>;
+export declare function executeDefaults(): Partial<ExecuteOptions>;
+//# sourceMappingURL=execute.d.ts.map

package/dist/commands/execute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/commands/execute.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAuOxE;AAED,wBAAgB,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC,CASzD"}

package/dist/commands/execute.js

@@ -0,0 +1,229 @@
+import { writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import chalk from "chalk";
+import logSymbols from "log-symbols";
+import ora from "ora";
+import inquirer from "inquirer";
+import { parseRegistryPayload } from "@ckb-firewall/sdk";
+import { getLiveCell } from "../lib/rpc.js";
+import { loadProposal, saveProposal, listProposals, isReviewWindowPassed, isVoteApproved, isReadyToExecute, SIG_THRESHOLD, } from "../lib/proposals.js";
+import { encodeRegistryPayload, insertSorted, removeEntry, bytesToHex, hexToBytes, strip0x, } from "../lib/blkl.js";
+import { ckbBlake2b, buildGov1Witness, buildWitnessArgs, } from "../lib/witness.js";
+import { TESTNET_RPC_URL, TESTNET_REGISTRY_CELL, TESTNET_CONTRACT_OUTPOINTS, SECP256K1_DEP_GROUP, } from "../lib/defaults.js";
+import { printHints } from "../lib/hints.js";
+export async function executeCommand(opts) {
+    // ── select proposal ──────────────────────────────────────────────────────
+    let proposalId = opts.proposal?.trim() ?? "";
+    if (!proposalId) {
+        const ready = listProposals().filter(isReadyToExecute);
+        if (ready.length === 0) {
+            console.log(logSymbols.warning, chalk.yellow("No proposals are ready to execute."));
+            console.log(chalk.dim("  A proposal needs: review window passed + vote threshold + 3 signatures."));
+            process.exit(0);
+        }
+        const { chosen } = await inquirer.prompt([
+            {
+                type: "list",
+                name: "chosen",
+                message: "Select proposal to execute:",
+                choices: ready.map((p) => ({
+                    name: `${chalk.bold(p.id)}  ${p.action} ${p.lockArgs.slice(0, 24)}…`,
+                    value: p.id,
+                })),
+            },
+        ]);
+        proposalId = chosen;
+    }
+    const proposal = loadProposal(proposalId);
+    // ── checks ───────────────────────────────────────────────────────────────
+    if (proposal.status === "executed") {
+        console.log(logSymbols.success, chalk.green(`Already executed — tx: ${proposal.txHash ?? "unknown"}`));
+        process.exit(0);
+    }
+    if (!isReviewWindowPassed(proposal)) {
+        const ms = new Date(proposal.reviewWindowEndsAt).getTime() - Date.now();
+        const h = Math.floor(ms / 3_600_000);
+        console.log(logSymbols.error, chalk.red(`Review window not passed — ${h}h remaining.`));
+        process.exit(1);
+    }
+    if (!isVoteApproved(proposal)) {
+        console.log(logSymbols.error, chalk.red("Vote threshold not met."));
+        console.log(chalk.dim(`  Use: ckb-firewall vote --proposal ${proposal.id}`));
+        process.exit(1);
+    }
+    if (proposal.signatures.length < SIG_THRESHOLD) {
+        console.log(logSymbols.error, chalk.red(`Only ${proposal.signatures.length}/${SIG_THRESHOLD} signatures — need more.`));
+        console.log(chalk.dim(`  Use: ckb-firewall sign --proposal ${proposal.id}`));
+        process.exit(1);
+    }
+    // ── fetch current registry cell ──────────────────────────────────────────
+    const registryIndex = Number.parseInt(opts.registryIndex, 10);
+    if (!Number.isInteger(registryIndex) || registryIndex < 0) {
+        console.error(logSymbols.error, chalk.red("--registry-index must be a non-negative integer."));
+        process.exit(1);
+    }
+    const spinner = ora("Fetching current registry cell").start();
+    let cell;
+    try {
+        cell = await getLiveCell(opts.rpcUrl, opts.registryTx, registryIndex);
+        spinner.succeed("Registry cell loaded");
+    }
+    catch (err) {
+        spinner.fail("Could not fetch registry cell");
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exit(1);
+    }
+    let currentPayload;
+    try {
+        currentPayload = parseRegistryPayload(cell.data);
+    }
+    catch {
+        console.error(logSymbols.error, chalk.red("Registry cell does not contain a valid BLKL payload."));
+        process.exit(1);
+    }
+    // ── build new BLKL payload ────────────────────────────────────────────────
+    const oldBlkl = hexToBytes(cell.data);
+    let newEntries;
+    if (proposal.action === "add") {
+        if (currentPayload.entries.some((e) => strip0x(e.identifier).toLowerCase() === strip0x(proposal.lockArgs).toLowerCase())) {
+            console.log(logSymbols.warning, chalk.yellow(`${proposal.lockArgs} is already in the registry.`));
+            process.exit(0);
+        }
+        newEntries = insertSorted(currentPayload.entries, {
+            identifier: proposal.lockArgs,
+            expiresAt: BigInt(proposal.expiresAt),
+        });
+    }
+    else {
+        newEntries = removeEntry(currentPayload.entries, proposal.lockArgs);
+        if (newEntries.length === currentPayload.entries.length) {
+            console.log(logSymbols.warning, chalk.yellow(`${proposal.lockArgs} is not in the registry.`));
+            process.exit(0);
+        }
+    }
+    const newPayload = { version: currentPayload.version, entries: newEntries };
+    const newBlkl = encodeRegistryPayload(newPayload);
+    // ── build GOV1 witness with real signatures ───────────────────────────────
+    const proposalIdBytes = hexToBytes(proposal.proposalIdHash);
+    const voteDigestBytes = hexToBytes(proposal.voteDigestHash);
+    const oldRoot = ckbBlake2b(oldBlkl);
+    const newRoot = ckbBlake2b(newBlkl);
+    const signers = proposal.signatures.slice(0, SIG_THRESHOLD).map((s) => ({
+        index: s.signerIndex,
+        sig: hexToBytes(s.signature),
+    }));
+    const gov1 = buildGov1Witness({
+        proposalIdHash: proposalIdBytes,
+        voteDigestHash: voteDigestBytes,
+        oldRoot,
+        newRoot,
+        signers,
+    });
+    const witnessBytes = buildWitnessArgs({
+        lock: new Uint8Array(65),
+        inputType: gov1,
+    });
+    // ── summary ───────────────────────────────────────────────────────────────
+    console.log();
+    console.log(chalk.bold("Executing proposal:"), proposal.id);
+    console.log(`  Action:     ${proposal.action === "add" ? chalk.green("add") : chalk.red("remove")} ${proposal.lockArgs}`);
+    console.log(`  Proposer:   ${proposal.proposer}`);
+    console.log(`  Signers:    ${signers.map((s) => `#${s.index}`).join(", ")}`);
+    console.log(`  Old → new:  ${currentPayload.entries.length} → ${newEntries.length} entries`);
+    console.log();
+    // ── build tx JSON ────────────────────────────────────────────────────────
+    const txJson = {
+        transaction: {
+            version: "0x0",
+            cell_deps: [
+                { out_point: { tx_hash: SECP256K1_DEP_GROUP.txHash, index: "0x0" }, dep_type: "dep_group" },
+                {
+                    out_point: {
+                        tx_hash: TESTNET_CONTRACT_OUTPOINTS.blacklistRegistry.txHash,
+                        index: `0x${TESTNET_CONTRACT_OUTPOINTS.blacklistRegistry.index.toString(16)}`,
+                    },
+                    dep_type: "code",
+                },
+            ],
+            header_deps: [],
+            inputs: [
+                { since: "0x0", previous_output: { tx_hash: cell.txHash, index: `0x${cell.index.toString(16)}` } },
+            ],
+            outputs: [{ capacity: cell.capacity, lock: cell.lock, type: cell.type }],
+            outputs_data: [bytesToHex(newBlkl)],
+            witnesses: [bytesToHex(witnessBytes)],
+        },
+        multisig_configs: {},
+        signatures: {},
+    };
+    const txOut = opts.txOut;
+    writeFileSync(txOut, JSON.stringify(txJson, null, 2) + "\n");
+    console.log(logSymbols.success, `Transaction written to ${chalk.bold(txOut)}`);
+    console.log();
+    // ── sign / submit ────────────────────────────────────────────────────────
+    if (!opts.sign) {
+        console.log("Sign and submit with ckb-cli:");
+        console.log(chalk.dim(`  ckb-cli wallet sign-txs --tx-file ${txOut} --from-account <address>\n` +
+            `  ckb-cli wallet apply-txs --tx-file ${txOut}`));
+        console.log();
+        printHints("execute");
+        return;
+    }
+    let fromAccount = opts.fromAccount;
+    if (!fromAccount && process.stdin.isTTY) {
+        const { account } = await inquirer.prompt([
+            {
+                type: "input",
+                name: "account",
+                message: "Governance account address (ckb-cli --from-account):",
+                validate: (v) => v.trim().length > 0 || "Required.",
+            },
+        ]);
+        fromAccount = account.trim();
+    }
+    if (!fromAccount) {
+        console.error(logSymbols.error, chalk.red("--from-account is required when using --sign."));
+        process.exit(1);
+    }
+    const { proceed } = await inquirer.prompt([
+        { type: "confirm", name: "proceed", message: "Sign and submit?", default: false },
+    ]);
+    if (!proceed) {
+        console.log("Aborted.");
+        return;
+    }
+    const signSpinner = ora("Signing with ckb-cli").start();
+    try {
+        execFileSync("ckb-cli", ["wallet", "sign-txs", "--tx-file", txOut, "--from-account", fromAccount], { stdio: "inherit" });
+        signSpinner.succeed("Signed");
+        const submitSpinner = ora("Submitting").start();
+        const output = execFileSync("ckb-cli", ["wallet", "apply-txs", "--tx-file", txOut], { encoding: "utf8" });
+        submitSpinner.succeed("Submitted");
+        const txHash = output.match(/0x[a-fA-F0-9]{64}/)?.[0];
+        if (txHash) {
+            proposal.status = "executed";
+            proposal.txHash = txHash;
+            saveProposal(proposal);
+            console.log();
+            console.log(logSymbols.success, chalk.green("Registry updated on-chain."));
+            console.log(`  Tx: ${chalk.bold(txHash)}`);
+            printHints("execute");
+        }
+    }
+    catch (err) {
+        signSpinner.fail("ckb-cli failed");
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exit(1);
+    }
+}
+export function executeDefaults() {
+    return {
+        rpcUrl: TESTNET_RPC_URL,
+        registryTx: TESTNET_REGISTRY_CELL.txHash,
+        registryIndex: String(TESTNET_REGISTRY_CELL.index),
+        txOut: "gov_execute_tx.json",
+        sign: false,
+        fromAccount: "",
+    };
+}
+//# sourceMappingURL=execute.js.map