@hardkas/accounts 0.12.0-rc.24 → 0.12.0-rc.26

package/dist/{authorizers-YESBCCTJ.js → authorizers-OAGU7NYR.js}

@@ -2,7 +2,7 @@ import {
   LazyAccountAuthorizer,
   PrivateKeyAuthorizer,
   StaticSignatureScriptAuthorizer
-} from "./chunk-PKDTLCCQ.js";
+} from "./chunk-YBCXJBA5.js";
 export {
   LazyAccountAuthorizer,
   PrivateKeyAuthorizer,

package/dist/{chunk-Q22JFUWC.js → chunk-G6PYXAIU.js}

@@ -6,20 +6,288 @@ import {
 } from "./chunk-BNF566PS.js";
 import {
   resolveHardkasAccount
-} from "./chunk-2UQTGGML.js";
-import {
-  KeystoreManager
-} from "./chunk-YLG2NIAU.js";
+} from "./chunk-IRNHRG4N.js";
 
-// src/dev-accounts.ts
+// src/kaspa-wasm-signer.ts
+import { recomputeDeclaredContentHash } from "@hardkas/artifacts";
+import { getNetworkPrefix as getNetworkPrefix2 } from "@hardkas/core";
+
+// src/keystore.ts
 import fs from "fs";
 import path from "path";
 import crypto from "crypto";
-import { deterministicCompare, getNetworkPrefix as getNetworkPrefix2 } from "@hardkas/core";
+import { argon2id } from "hash-wasm";
+import { writeFileAtomic, stripBom } from "@hardkas/core";
+var KeystoreManager = class {
+  /**
+   * Keystore container format version. Separate from ARTIFACT_VERSION.
+   * This versions the encrypted keystore envelope, not HardKAS artifacts.
+   */
+  static KEYSTORE_FORMAT_VERSION = "2.0.0";
+  static KEYSTORE_FORMAT_TYPE = "hardkas.encryptedKeystore.v2";
+  /**
+   * Creates an encrypted keystore from a payload and password.
+   */
+  static async createEncryptedKeystore(payload, password, options) {
+    if (!password) throw new Error("Password cannot be empty.");
+    if (password.length < 8)
+      throw new Error("Password must be at least 8 characters long.");
+    const salt = crypto.randomBytes(16);
+    const nonce = crypto.randomBytes(12);
+    const iterations = options.iterations || 3;
+    const memory = options.memory || 65536;
+    const parallelism = options.parallelism || 1;
+    const derivedKeyHex = await argon2id({
+      password,
+      salt,
+      parallelism,
+      iterations,
+      memorySize: memory,
+      hashLength: 32,
+      // 256 bits for AES-256
+      outputType: "hex"
+    });
+    const derivedKey = Buffer.from(derivedKeyHex, "hex");
+    const cipher = crypto.createCipheriv("aes-256-gcm", derivedKey, nonce);
+    const encryptedPayload = Buffer.concat([
+      cipher.update(JSON.stringify(payload), "utf8"),
+      cipher.final()
+    ]);
+    const tag = cipher.getAuthTag();
+    derivedKey.fill(0);
+    return {
+      version: this.KEYSTORE_FORMAT_VERSION,
+      type: this.KEYSTORE_FORMAT_TYPE,
+      kdf: {
+        algorithm: "argon2id",
+        memory,
+        iterations,
+        parallelism,
+        salt: salt.toString("base64")
+      },
+      cipher: {
+        algorithm: "aes-256-gcm",
+        nonce: nonce.toString("base64"),
+        tag: tag.toString("base64")
+      },
+      encryptedPayload: encryptedPayload.toString("base64"),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      metadata: {
+        label: options.label,
+        network: options.network,
+        address: payload.address
+      }
+    };
+  }
+  /**
+   * Decrypts an encrypted keystore using a password.
+   */
+  static async decryptEncryptedKeystore(keystore, password) {
+    if (keystore.version !== this.KEYSTORE_FORMAT_VERSION) {
+      return {
+        success: false,
+        error: `Unsupported keystore version: ${keystore.version}`
+      };
+    }
+    try {
+      const salt = Buffer.from(keystore.kdf.salt, "base64");
+      const nonce = Buffer.from(keystore.cipher.nonce, "base64");
+      const tag = Buffer.from(keystore.cipher.tag, "base64");
+      const encryptedData = Buffer.from(keystore.encryptedPayload, "base64");
+      const derivedKeyHex = await argon2id({
+        password,
+        salt,
+        parallelism: keystore.kdf.parallelism,
+        iterations: keystore.kdf.iterations,
+        memorySize: keystore.kdf.memory,
+        hashLength: 32,
+        outputType: "hex"
+      });
+      const derivedKey = Buffer.from(derivedKeyHex, "hex");
+      const decipher = crypto.createDecipheriv("aes-256-gcm", derivedKey, nonce);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+      derivedKey.fill(0);
+      const payload = JSON.parse(decrypted.toString("utf8"));
+      return { success: true, payload };
+    } catch (e) {
+      return { success: false, error: "Invalid password or corrupted keystore." };
+    }
+  }
+  /**
+   * Verifies if the password is correct for the keystore.
+   */
+  static async verifyKeystorePassword(keystore, password) {
+    const result = await this.decryptEncryptedKeystore(keystore, password);
+    return result.success;
+  }
+  /**
+   * Changes the password of an encrypted keystore.
+   */
+  static async changeKeystorePassword(keystore, oldPassword, newPassword) {
+    const unlock = await this.decryptEncryptedKeystore(keystore, oldPassword);
+    if (!unlock.success || !unlock.payload) {
+      throw new Error("Invalid current password.");
+    }
+    return this.createEncryptedKeystore(unlock.payload, newPassword, {
+      label: keystore.metadata.label,
+      network: keystore.metadata.network,
+      iterations: keystore.kdf.iterations,
+      memory: keystore.kdf.memory,
+      parallelism: keystore.kdf.parallelism
+    });
+  }
+  /**
+   * Loads an encrypted keystore from the filesystem.
+   */
+  static async loadEncryptedKeystore(filePath) {
+    try {
+      const data = await fs.promises.readFile(filePath, "utf-8");
+      const keystore = JSON.parse(stripBom(data));
+      if (keystore.type !== this.KEYSTORE_FORMAT_TYPE) {
+        throw new Error(`Invalid keystore type: ${keystore.type}`);
+      }
+      return keystore;
+    } catch (e) {
+      throw new Error(
+        `Failed to load keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
+      );
+    }
+  }
+  /**
+   * Saves an encrypted keystore to the filesystem.
+   */
+  static async saveEncryptedKeystore(filePath, keystore) {
+    try {
+      const dir = path.dirname(filePath);
+      if (!fs.existsSync(dir)) {
+        await fs.promises.mkdir(dir, { recursive: true });
+      }
+      await writeFileAtomic(filePath, JSON.stringify(keystore, null, 2), {
+        encoding: "utf-8",
+        mode: 384
+      });
+    } catch (e) {
+      throw new Error(
+        `Failed to save keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
+      );
+    }
+  }
+};
 
-// src/kaspa-wasm-signer.ts
-import { recomputeDeclaredContentHash } from "@hardkas/artifacts";
-import { getNetworkPrefix } from "@hardkas/core";
+// src/dev-accounts.ts
+import fs2 from "fs";
+import path2 from "path";
+import crypto2 from "crypto";
+import { deterministicCompare, getNetworkPrefix, stripBom as stripBom2 } from "@hardkas/core";
+var DEV_ACCOUNTS_PASSWORD = "hardkas-local-dev";
+var SIMNET_DETERMINISTIC_SEED = "hardkas-deterministic-simnet-seed-v1";
+async function ensureDevAccounts(workspaceDir) {
+  const devAccountsDir = path2.join(workspaceDir, ".hardkas", "dev-accounts");
+  if (!fs2.existsSync(devAccountsDir)) {
+    await fs2.promises.mkdir(devAccountsDir, { recursive: true });
+  }
+  await getOrCreateDevAccount(workspaceDir, 0, "alice");
+  await getOrCreateDevAccount(workspaceDir, 1, "bob");
+  await getOrCreateDevAccount(workspaceDir, 2, "carol");
+  await getOrCreateDevAccount(workspaceDir, 3, "dave");
+  await getOrCreateDevAccount(workspaceDir, 4, "erin");
+}
+async function getOrCreateDevAccount(workspaceDir, index, alias) {
+  const devAccountsDir = path2.join(workspaceDir, ".hardkas", "dev-accounts");
+  const filePath = path2.join(devAccountsDir, `${alias}.json`);
+  if (fs2.existsSync(filePath)) {
+    const keystore2 = await KeystoreManager.loadEncryptedKeystore(filePath);
+    const unlock = await KeystoreManager.decryptEncryptedKeystore(
+      keystore2,
+      DEV_ACCOUNTS_PASSWORD
+    );
+    if (!unlock.success || !unlock.payload) {
+      throw new Error(
+        `Failed to decrypt dev account ${alias}. Expected password: ${DEV_ACCOUNTS_PASSWORD}`
+      );
+    }
+    return {
+      address: unlock.payload.address,
+      privateKey: unlock.payload.privateKey,
+      publicKey: unlock.payload.publicKey
+    };
+  }
+  const seedString = `${SIMNET_DETERMINISTIC_SEED}-${index}`;
+  const privateKeyHex = crypto2.createHash("sha256").update(seedString).digest("hex");
+  const network = "simnet";
+  const { loadKaspaWasm: loadKaspaWasm2 } = await import("./signer-backend-LHWY7ULI.js");
+  const kaspaWasm = await loadKaspaWasm2();
+  const kp = new kaspaWasm.PrivateKey(privateKeyHex).toKeypair();
+  const address = kp.toAddress(getNetworkPrefix(network)).toString();
+  const publicKey = kp.publicKey;
+  const privateKey = privateKeyHex;
+  const accountData = {
+    address,
+    privateKey,
+    publicKey
+  };
+  if (!fs2.existsSync(devAccountsDir)) {
+    await fs2.promises.mkdir(devAccountsDir, { recursive: true });
+  }
+  const payload = {
+    address: accountData.address,
+    privateKey: accountData.privateKey,
+    network: "simnet"
+  };
+  if (accountData.publicKey) {
+    payload.publicKey = accountData.publicKey;
+  }
+  const keystore = await KeystoreManager.createEncryptedKeystore(
+    payload,
+    DEV_ACCOUNTS_PASSWORD,
+    {
+      label: alias,
+      network: "simnet"
+    }
+  );
+  await KeystoreManager.saveEncryptedKeystore(filePath, keystore);
+  return accountData;
+}
+function listDevAccountsSync(workspaceDir) {
+  const devAccountsDir = path2.join(workspaceDir, ".hardkas", "dev-accounts");
+  if (!fs2.existsSync(devAccountsDir)) {
+    return [];
+  }
+  const accounts = [];
+  const files = fs2.readdirSync(devAccountsDir);
+  for (const file of files) {
+    if (file.endsWith(".json")) {
+      const name = path2.basename(file, ".json");
+      try {
+        const data = fs2.readFileSync(path2.join(devAccountsDir, file), "utf-8");
+        const keystore = JSON.parse(stripBom2(data));
+        if (keystore.type === "hardkas.encryptedKeystore.v2") {
+          accounts.push({
+            name,
+            address: keystore.metadata?.address || ""
+          });
+        }
+      } catch (e) {
+      }
+    }
+  }
+  accounts.sort((a, b) => deterministicCompare(a.name, b.name));
+  return accounts;
+}
+async function createDevSigner(workspaceDir, accountNameOrAddress) {
+  const account = resolveHardkasAccount({
+    nameOrAddress: accountNameOrAddress,
+    config: { cwd: workspaceDir }
+  });
+  if (account.kind !== "kaspa") {
+    throw new Error(`Account '${accountNameOrAddress}' is not a private key account, cannot create local dev signer.`);
+  }
+  return new KaspaWasmPrivateKeySigner({
+    account,
+    allowMainnet: false
+  });
+}
 
 // src/wasm-transaction.ts
 function assertValueConservation(input) {
@@ -96,6 +364,20 @@ function planOutputsWithChange(plan) {
 }
 
 // src/kaspa-wasm-signer.ts
+var keystoreError = (code, message) => Object.assign(new Error(`${code}: ${message}`), { code });
+async function unlockAccountKeystore(account, password) {
+  const devAccount = account.keystoreKind === "dev-account";
+  const secret = devAccount ? DEV_ACCOUNTS_PASSWORD : password;
+  if (!secret) {
+    throw keystoreError("KEYSTORE_PASSWORD_REQUIRED", `account '${account.name}' is an encrypted keystore and no password was given to open it.`);
+  }
+  const keystore = await KeystoreManager.loadEncryptedKeystore(account.keystorePath);
+  const unlock = await KeystoreManager.decryptEncryptedKeystore(keystore, secret);
+  if (!unlock.success || !unlock.payload?.privateKey) {
+    throw devAccount ? keystoreError("DEV_ACCOUNT_KEY_UNAVAILABLE", `the development keystore of account '${account.name}' does not open.`) : keystoreError("KEYSTORE_PASSWORD_INVALID", `the password does not open the keystore of account '${account.name}' (wrong password, or a damaged keystore).`);
+  }
+  return unlock.payload.privateKey;
+}
 var KaspaWasmPrivateKeySigner = class {
   constructor(options) {
     this.options = options;
@@ -131,16 +413,10 @@ var KaspaWasmPrivateKeySigner = class {
         pkValue = account.privateKey;
       }
       if (!pkValue && account.keystorePath) {
-        try {
-          const KeystoreManager2 = (await import("./keystore-CMWEKGBF.js")).KeystoreManager;
-          const DEV_ACCOUNTS_PASSWORD2 = (await import("./dev-accounts-JTJKQAPV.js")).DEV_ACCOUNTS_PASSWORD;
-          const keystore = await KeystoreManager2.loadEncryptedKeystore(account.keystorePath);
-          const unlock = await KeystoreManager2.decryptEncryptedKeystore(keystore, DEV_ACCOUNTS_PASSWORD2);
-          if (unlock.success && unlock.payload) {
-            pkValue = unlock.payload.privateKey;
-          }
-        } catch (e) {
-        }
+        pkValue = await unlockAccountKeystore(
+          { name: account.name, keystorePath: account.keystorePath, keystoreKind: account.keystoreKind },
+          this.options.keystorePassword
+        );
       }
       if (!pkValue) {
         const err = new Error(`DEV_ACCOUNT_KEY_UNAVAILABLE: Missing required private key for account '${account.name}'.`);
@@ -152,8 +428,8 @@ var KaspaWasmPrivateKeySigner = class {
         err.code = "INVALID_PRIVATE_KEY_MATERIAL";
         throw err;
       }
-      const expectedAddress = new sdk.PrivateKey(pkValue).toKeypair().toAddress(getNetworkPrefix(plan.networkId || "simnet")).toString();
-      const { PrivateKeyAuthorizer } = await import("./authorizers-YESBCCTJ.js");
+      const expectedAddress = new sdk.PrivateKey(pkValue).toKeypair().toAddress(getNetworkPrefix2(plan.networkId || "simnet")).toString();
+      const { PrivateKeyAuthorizer } = await import("./authorizers-OAGU7NYR.js");
       const sourceInputs = plan.inputs || plan.selectedUtxos || [];
       for (let i = 0; i < numInputs; i++) {
         if (!authorizers[i]) {
@@ -332,127 +608,19 @@ function assertSigningNetworkAllowed(input) {
   }
 }
 
-// src/dev-accounts.ts
-var DEV_ACCOUNTS_PASSWORD = "hardkas-local-dev";
-var SIMNET_DETERMINISTIC_SEED = "hardkas-deterministic-simnet-seed-v1";
-async function ensureDevAccounts(workspaceDir) {
-  const devAccountsDir = path.join(workspaceDir, ".hardkas", "dev-accounts");
-  if (!fs.existsSync(devAccountsDir)) {
-    await fs.promises.mkdir(devAccountsDir, { recursive: true });
-  }
-  await getOrCreateDevAccount(workspaceDir, 0, "alice");
-  await getOrCreateDevAccount(workspaceDir, 1, "bob");
-  await getOrCreateDevAccount(workspaceDir, 2, "carol");
-  await getOrCreateDevAccount(workspaceDir, 3, "dave");
-  await getOrCreateDevAccount(workspaceDir, 4, "erin");
-}
-async function getOrCreateDevAccount(workspaceDir, index, alias) {
-  const devAccountsDir = path.join(workspaceDir, ".hardkas", "dev-accounts");
-  const filePath = path.join(devAccountsDir, `${alias}.json`);
-  if (fs.existsSync(filePath)) {
-    const keystore2 = await KeystoreManager.loadEncryptedKeystore(filePath);
-    const unlock = await KeystoreManager.decryptEncryptedKeystore(
-      keystore2,
-      DEV_ACCOUNTS_PASSWORD
-    );
-    if (!unlock.success || !unlock.payload) {
-      throw new Error(
-        `Failed to decrypt dev account ${alias}. Expected password: ${DEV_ACCOUNTS_PASSWORD}`
-      );
-    }
-    return {
-      address: unlock.payload.address,
-      privateKey: unlock.payload.privateKey,
-      publicKey: unlock.payload.publicKey
-    };
-  }
-  const seedString = `${SIMNET_DETERMINISTIC_SEED}-${index}`;
-  const privateKeyHex = crypto.createHash("sha256").update(seedString).digest("hex");
-  const network = "simnet";
-  const { loadKaspaWasm: loadKaspaWasm2 } = await import("./signer-backend-LHWY7ULI.js");
-  const kaspaWasm = await loadKaspaWasm2();
-  const kp = new kaspaWasm.PrivateKey(privateKeyHex).toKeypair();
-  const address = kp.toAddress(getNetworkPrefix2(network)).toString();
-  const publicKey = kp.publicKey;
-  const privateKey = privateKeyHex;
-  const accountData = {
-    address,
-    privateKey,
-    publicKey
-  };
-  if (!fs.existsSync(devAccountsDir)) {
-    await fs.promises.mkdir(devAccountsDir, { recursive: true });
-  }
-  const payload = {
-    address: accountData.address,
-    privateKey: accountData.privateKey,
-    network: "simnet"
-  };
-  if (accountData.publicKey) {
-    payload.publicKey = accountData.publicKey;
-  }
-  const keystore = await KeystoreManager.createEncryptedKeystore(
-    payload,
-    DEV_ACCOUNTS_PASSWORD,
-    {
-      label: alias,
-      network: "simnet"
-    }
-  );
-  await KeystoreManager.saveEncryptedKeystore(filePath, keystore);
-  return accountData;
-}
-function listDevAccountsSync(workspaceDir) {
-  const devAccountsDir = path.join(workspaceDir, ".hardkas", "dev-accounts");
-  if (!fs.existsSync(devAccountsDir)) {
-    return [];
-  }
-  const accounts = [];
-  const files = fs.readdirSync(devAccountsDir);
-  for (const file of files) {
-    if (file.endsWith(".json")) {
-      const name = path.basename(file, ".json");
-      try {
-        const data = fs.readFileSync(path.join(devAccountsDir, file), "utf-8");
-        const keystore = JSON.parse(data);
-        if (keystore.type === "hardkas.encryptedKeystore.v2") {
-          accounts.push({
-            name,
-            address: keystore.metadata?.address || ""
-          });
-        }
-      } catch (e) {
-      }
-    }
-  }
-  accounts.sort((a, b) => deterministicCompare(a.name, b.name));
-  return accounts;
-}
-async function createDevSigner(workspaceDir, accountNameOrAddress) {
-  const account = resolveHardkasAccount({
-    nameOrAddress: accountNameOrAddress,
-    config: { cwd: workspaceDir }
-  });
-  if (account.kind !== "kaspa") {
-    throw new Error(`Account '${accountNameOrAddress}' is not a private key account, cannot create local dev signer.`);
-  }
-  return new KaspaWasmPrivateKeySigner({
-    account,
-    allowMainnet: false
-  });
-}
-
 export {
-  assertValueConservation,
-  createBalancedTransaction,
-  createScriptTransaction,
-  toWasmScriptPublicKey,
-  planOutputsWithChange,
+  KeystoreManager,
   DEV_ACCOUNTS_PASSWORD,
   ensureDevAccounts,
   getOrCreateDevAccount,
   listDevAccountsSync,
   createDevSigner,
+  assertValueConservation,
+  createBalancedTransaction,
+  createScriptTransaction,
+  toWasmScriptPublicKey,
+  planOutputsWithChange,
+  unlockAccountKeystore,
   KaspaWasmPrivateKeySigner,
   assertSigningNetworkAllowed
 };

package/dist/{chunk-2UQTGGML.js → chunk-IRNHRG4N.js}

@@ -2,13 +2,13 @@
 import fs2 from "fs";
 import path2 from "path";
 import { createDeterministicAccounts } from "@hardkas/localnet";
-import { CrossWorldAccountCollisionError, AccountNetworkMismatchError } from "@hardkas/core";
+import { CrossWorldAccountCollisionError, AccountNetworkMismatchError, stripBom as stripBom2 } from "@hardkas/core";
 
 // src/real-accounts.ts
 import fs from "fs";
 import path from "path";
 import util from "util";
-import { writeFileAtomicSync } from "@hardkas/core";
+import { writeFileAtomicSync, stripBom } from "@hardkas/core";
 import {
   HARDKAS_VERSION,
   ARTIFACT_SCHEMAS,
@@ -64,7 +64,7 @@ function loadRealAccountStoreSync(options) {
   }
   try {
     const data = fs.readFileSync(filePath, "utf-8");
-    const store = JSON.parse(data);
+    const store = JSON.parse(stripBom(data));
     for (const a of store.accounts) {
       if ("privateKey" in a && a.privateKey !== void 0) {
         if (a.privateKey === null || a.privateKey === "" || a.privateKey === "[object Object]" || typeof a.privateKey === "object" || typeof a.privateKey === "string" && a.privateKey.includes("__wbg_ptr") || typeof a.privateKey === "object" && "__wbg_ptr" in a.privateKey) {
@@ -326,7 +326,7 @@ function listHardkasAccounts(config, executionTarget) {
         try {
           const name = path2.basename(file, ".json");
           const data = fs2.readFileSync(path2.join(devAccountsDir, file), "utf-8");
-          const keystore = JSON.parse(data);
+          const keystore = JSON.parse(stripBom2(data));
           if (keystore.type === "hardkas.encryptedKeystore.v2") {
             if (!keystore.metadata?.network) {
               throw new AccountNetworkMismatchError({ expected: "known network", actual: "undefined", detail: `at ${path2.join(devAccountsDir, file)}` });
@@ -337,7 +337,8 @@ function listHardkasAccounts(config, executionTarget) {
                 kind: "synthetic",
                 executionMode: "simulator",
                 address: `kaspa:sim_${name}`,
-                keystorePath: path2.join(devAccountsDir, file)
+                keystorePath: path2.join(devAccountsDir, file),
+                keystoreKind: "dev-account"
               });
             } else {
               accounts.set(name, {
@@ -345,7 +346,8 @@ function listHardkasAccounts(config, executionTarget) {
                 kind: "kaspa",
                 network: keystore.metadata.network,
                 address: keystore.payload?.address || keystore.metadata?.address,
-                keystorePath: path2.join(devAccountsDir, file)
+                keystorePath: path2.join(devAccountsDir, file),
+                keystoreKind: "dev-account"
               });
             }
           }
@@ -359,7 +361,7 @@ function listHardkasAccounts(config, executionTarget) {
   if (fs2.existsSync(keystoreJsonPath)) {
     try {
       const data = fs2.readFileSync(keystoreJsonPath, "utf-8");
-      const ks = JSON.parse(data);
+      const ks = JSON.parse(stripBom2(data));
       for (const [name, acc] of Object.entries(ks)) {
         if (acc.type === "simulated") {
           if (targetMode === "simulator") {
@@ -400,7 +402,7 @@ function listHardkasAccounts(config, executionTarget) {
       });
     }
   }
-  const keystoreDir = path2.join(process.cwd(), ".hardkas", "keystore");
+  const keystoreDir = path2.join(workspaceRoot, ".hardkas", "keystore");
   if (fs2.existsSync(keystoreDir)) {
     const files = fs2.readdirSync(keystoreDir);
     for (const file of files) {
@@ -408,7 +410,7 @@ function listHardkasAccounts(config, executionTarget) {
         try {
           const name = path2.basename(file, ".json");
           const data = fs2.readFileSync(path2.join(keystoreDir, file), "utf-8");
-          const keystore = JSON.parse(data);
+          const keystore = JSON.parse(stripBom2(data));
           if (keystore.type === "hardkas.encryptedKeystore.v2") {
             if (!keystore.metadata?.network) {
               throw new AccountNetworkMismatchError({ expected: "known network", actual: "undefined", detail: `at ${path2.join(keystoreDir, file)}` });

package/dist/{chunk-PKDTLCCQ.js → chunk-YBCXJBA5.js}

@@ -62,7 +62,7 @@ var LazyAccountAuthorizer = class {
   accountName;
   workspaceRoot;
   async authorize(context) {
-    const { resolveHardkasAccount } = await import("./resolve-FO4P46YC.js");
+    const { resolveHardkasAccount } = await import("./resolve-FPK6KS5J.js");
     const account = await resolveHardkasAccount({
       nameOrAddress: this.accountName,
       config: { cwd: this.workspaceRoot }
@@ -72,16 +72,11 @@ var LazyAccountAuthorizer = class {
       pkValue = account.privateKey;
     }
     if (!pkValue && account.keystorePath) {
-      try {
-        const { KeystoreManager } = await import("./keystore-CMWEKGBF.js");
-        const { DEV_ACCOUNTS_PASSWORD } = await import("./dev-accounts-JTJKQAPV.js");
-        const keystore = await KeystoreManager.loadEncryptedKeystore(account.keystorePath);
-        const unlock = await KeystoreManager.decryptEncryptedKeystore(keystore, DEV_ACCOUNTS_PASSWORD);
-        if (unlock.success && unlock.payload) {
-          pkValue = unlock.payload.privateKey;
-        }
-      } catch (e) {
-      }
+      const { unlockAccountKeystore } = await import("./kaspa-wasm-signer-RBV2EPB7.js");
+      pkValue = await unlockAccountKeystore(
+        { name: this.accountName, keystorePath: account.keystorePath, keystoreKind: account.keystoreKind },
+        void 0
+      );
     }
     if (!pkValue) {
       throw new Error(`DEV_ACCOUNT_KEY_UNAVAILABLE: Missing required private key for account '${this.accountName}'.`);

package/dist/index.d.ts

@@ -101,6 +101,12 @@ interface HardkasKaspaAccount extends HardkasBaseAccount {
     privateKeyEnv?: string;
     privateKey?: string;
     keystorePath?: string;
+    /**
+     * Set by the resolver for the workspace's development accounts (`.hardkas/dev-accounts/`), whose
+     * keystores use the published development password. Any other keystore opens only with its owner's
+     * password, given explicitly.
+     */
+    keystoreKind?: "dev-account";
     address: string;
 }
 interface HardkasExternalWalletAccount extends HardkasBaseAccount {
@@ -198,6 +204,8 @@ declare function signTxPlanArtifact(input: {
     authorizers?: Readonly<Record<number, TxInputAuthorizer>>;
     config?: HardkasConfig;
     allowMainnet?: boolean;
+    /** The password of the account's keystore, in memory only: never stored, logged or echoed. */
+    keystorePassword?: string;
 }): Promise<SignedTxArtifact>;
 
 interface KaspaSigningBackendStatus {
@@ -607,7 +615,20 @@ interface KaspaWasmSignerOptions {
     account?: HardkasKaspaAccount;
     allowMainnet?: boolean;
     wasmConfig?: WasmProviderConfig;
+    /** The password of the account's keystore, in memory only: never stored, logged or echoed. */
+    keystorePassword?: string;
 }
+/**
+ * Opens the keystore of `account` and returns its private key. A development account (marked by the
+ * resolver for `.hardkas/dev-accounts/`) opens with the published development password; any other
+ * keystore only with `password`, its owner's, given explicitly. Nothing is tried silently: a missing
+ * password is KEYSTORE_PASSWORD_REQUIRED, one that does not open the keystore KEYSTORE_PASSWORD_INVALID.
+ */
+declare function unlockAccountKeystore(account: {
+    name: string;
+    keystorePath: string;
+    keystoreKind?: "dev-account" | undefined;
+}, password: string | undefined): Promise<string>;
 /**
  * Real Kaspa signer using the official WASM SDK (the pinned managed toolchain).
  */
@@ -925,4 +946,4 @@ declare class WalletStateStoreJson {
     nextChangeIndex(walletId: string): number;
 }
 
-export { AddressManager, type BalancedOutput, type ChainType, type CovenantFundingInput, type CovenantGenesisRequest, type CovenantTransactionResult, type CovenantTransitionRequest, type CovenantUtxo, type CreateKaspaWalletOptions, DEV_ACCOUNTS_PASSWORD, type DeriveRequest, type DerivedAddress, type EncryptedKeystoreV2, type EvmExportResult, type GeneratedKaspaDevAccount, type HardkasAccount, type HardkasAccountKind, type HardkasBaseAccount, type HardkasEvmPrivateKeyAccount, type HardkasExternalWalletAccount, type HardkasKaspaAccount, type HardkasSigner, type HardkasSignerKind, type HardkasSyntheticAccount, type HardkasTxPlanSigner, type HelperDeriveRequest, type InputAuthorization, type KaspaKeyGenerator, KaspaSdkKeyGenerator, type KaspaSdkKeyGeneratorOptions, KaspaSdkRealTxSigner, type KaspaSdkRealTxSignerOptions, type KaspaSigningBackendStatus, KaspaWasmPrivateKeySigner, type KaspaWasmSignerOptions, type KeystoreCipherParams, type KeystoreKdfParams, KeystoreManager, type KeystorePayload, type KeystoreUnlockResult, LazyAccountAuthorizer, type NetworkType, type PathRequest, PrivateKeyAuthorizer, type RealAccountStore, type RealDevAccount, type RealTxSigner, type RealTxSigningInput, type RealTxSigningResult, SILVER_SPEND_DRAFT_SCHEMA, type ScriptFundingRequest, type ScriptFundingResult, type ScriptOutput, type SignTxPlanInput, type SignTxPlanResult, type SilverContractUtxo, type SilverDraftArg, type SilverSignatureArg, type SilverSignerSlot, type SilverSpendArg, type SilverSpendDraft, type SilverSpendDraftRequest, type SilverSpendResult, type SilverSweepRequest, SimulatedSigner, StaticSignatureScriptAuthorizer, type TxInputAuthorizationContext, type TxInputAuthorizer, UnsupportedKaspaKeyGenerator, UnsupportedRealKaspaSigner, UnsupportedRealTxSigner, type WalletArtifact, type WalletClaims, type WalletCreateRequest, type WalletImportRequest, WalletManager, WalletManagerImpl, type WalletMetadata, type WalletState, WalletStateStoreJson, type WalletStateStoreOptions, type WasmInputSigner, type WasmProviderConfig, type WasmUtxoEntrySource, type WasmUtxoInput, appendToKeystoreJson, assertAccountCompatible, assertSigningNetworkAllowed, assertValueConservation, attachInspectRedactor, buildCovenantGenesis, buildCovenantTransition, buildScriptFunding, buildSilverSweep, createBalancedTransaction, createDevSigner, createEmptyRealAccountStore, createLocalKaspaWallet, createScriptTransaction, describeAccount, detectCapabilities, ensureDevAccounts, finalizeSilverSpend, getDefaultRealAccountsPath, getKaspaSigningBackendStatus, getOrCreateDevAccount, getRealDevAccount, getRequiredEnv, importRealDevAccount, listDevAccountsSync, listHardkasAccounts, listRealDevAccounts, loadKaspaWasm, loadKaspaWasmSync, loadOrCreateRealAccountStore, loadRealAccountStore, loadRealAccountStoreSync, planOutputsWithChange, prepareEvmAccountExport, prepareSilverSpend, redactAccountForLog, removeRealDevAccount, resolveHardkasAccount, resolveHardkasAccountAddress, resolveRealAccountOrAddress, saveRealAccountStore, signSilverSpend, signTxPlanArtifact, toWasmScriptPublicKey, validateAccountName, validateAddressNetwork, validateAddressPrefix, withKeystoreLock };
+export { AddressManager, type BalancedOutput, type ChainType, type CovenantFundingInput, type CovenantGenesisRequest, type CovenantTransactionResult, type CovenantTransitionRequest, type CovenantUtxo, type CreateKaspaWalletOptions, DEV_ACCOUNTS_PASSWORD, type DeriveRequest, type DerivedAddress, type EncryptedKeystoreV2, type EvmExportResult, type GeneratedKaspaDevAccount, type HardkasAccount, type HardkasAccountKind, type HardkasBaseAccount, type HardkasEvmPrivateKeyAccount, type HardkasExternalWalletAccount, type HardkasKaspaAccount, type HardkasSigner, type HardkasSignerKind, type HardkasSyntheticAccount, type HardkasTxPlanSigner, type HelperDeriveRequest, type InputAuthorization, type KaspaKeyGenerator, KaspaSdkKeyGenerator, type KaspaSdkKeyGeneratorOptions, KaspaSdkRealTxSigner, type KaspaSdkRealTxSignerOptions, type KaspaSigningBackendStatus, KaspaWasmPrivateKeySigner, type KaspaWasmSignerOptions, type KeystoreCipherParams, type KeystoreKdfParams, KeystoreManager, type KeystorePayload, type KeystoreUnlockResult, LazyAccountAuthorizer, type NetworkType, type PathRequest, PrivateKeyAuthorizer, type RealAccountStore, type RealDevAccount, type RealTxSigner, type RealTxSigningInput, type RealTxSigningResult, SILVER_SPEND_DRAFT_SCHEMA, type ScriptFundingRequest, type ScriptFundingResult, type ScriptOutput, type SignTxPlanInput, type SignTxPlanResult, type SilverContractUtxo, type SilverDraftArg, type SilverSignatureArg, type SilverSignerSlot, type SilverSpendArg, type SilverSpendDraft, type SilverSpendDraftRequest, type SilverSpendResult, type SilverSweepRequest, SimulatedSigner, StaticSignatureScriptAuthorizer, type TxInputAuthorizationContext, type TxInputAuthorizer, UnsupportedKaspaKeyGenerator, UnsupportedRealKaspaSigner, UnsupportedRealTxSigner, type WalletArtifact, type WalletClaims, type WalletCreateRequest, type WalletImportRequest, WalletManager, WalletManagerImpl, type WalletMetadata, type WalletState, WalletStateStoreJson, type WalletStateStoreOptions, type WasmInputSigner, type WasmProviderConfig, type WasmUtxoEntrySource, type WasmUtxoInput, appendToKeystoreJson, assertAccountCompatible, assertSigningNetworkAllowed, assertValueConservation, attachInspectRedactor, buildCovenantGenesis, buildCovenantTransition, buildScriptFunding, buildSilverSweep, createBalancedTransaction, createDevSigner, createEmptyRealAccountStore, createLocalKaspaWallet, createScriptTransaction, describeAccount, detectCapabilities, ensureDevAccounts, finalizeSilverSpend, getDefaultRealAccountsPath, getKaspaSigningBackendStatus, getOrCreateDevAccount, getRealDevAccount, getRequiredEnv, importRealDevAccount, listDevAccountsSync, listHardkasAccounts, listRealDevAccounts, loadKaspaWasm, loadKaspaWasmSync, loadOrCreateRealAccountStore, loadRealAccountStore, loadRealAccountStoreSync, planOutputsWithChange, prepareEvmAccountExport, prepareSilverSpend, redactAccountForLog, removeRealDevAccount, resolveHardkasAccount, resolveHardkasAccountAddress, resolveRealAccountOrAddress, saveRealAccountStore, signSilverSpend, signTxPlanArtifact, toWasmScriptPublicKey, unlockAccountKeystore, validateAccountName, validateAddressNetwork, validateAddressPrefix, withKeystoreLock };

package/dist/index.js

@@ -1,6 +1,12 @@
+import {
+  LazyAccountAuthorizer,
+  PrivateKeyAuthorizer,
+  StaticSignatureScriptAuthorizer
+} from "./chunk-YBCXJBA5.js";
 import {
   DEV_ACCOUNTS_PASSWORD,
   KaspaWasmPrivateKeySigner,
+  KeystoreManager,
   assertSigningNetworkAllowed,
   assertValueConservation,
   createBalancedTransaction,
@@ -10,8 +16,9 @@ import {
   getOrCreateDevAccount,
   listDevAccountsSync,
   planOutputsWithChange,
-  toWasmScriptPublicKey
-} from "./chunk-Q22JFUWC.js";
+  toWasmScriptPublicKey,
+  unlockAccountKeystore
+} from "./chunk-G6PYXAIU.js";
 import {
   parseWasmTxToRpc
 } from "./chunk-GM2BY4VS.js";
@@ -43,15 +50,7 @@ import {
   validateAccountName,
   validateAddressNetwork,
   validateAddressPrefix
-} from "./chunk-2UQTGGML.js";
-import {
-  KeystoreManager
-} from "./chunk-YLG2NIAU.js";
-import {
-  LazyAccountAuthorizer,
-  PrivateKeyAuthorizer,
-  StaticSignatureScriptAuthorizer
-} from "./chunk-PKDTLCCQ.js";
+} from "./chunk-IRNHRG4N.js";
 
 // src/simulated.ts
 var SimulatedSigner = class {
@@ -196,6 +195,9 @@ async function signTxPlanArtifact(input) {
     if (input.config?.wasm) {
       signerOptions.wasmConfig = input.config.wasm;
     }
+    if (input.keystorePassword !== void 0) {
+      signerOptions.keystorePassword = input.keystorePassword;
+    }
     const signer = new KaspaWasmPrivateKeySigner(signerOptions);
     const result = await signer.signTxPlan({
       planArtifact,
@@ -784,8 +786,10 @@ var KaspaSdkKeyGenerator = class {
       try {
         return await rawLoader();
       } catch (e) {
+        if (e?.code === "WASM_TOOLCHAIN_NOT_INSTALLED" || e?.code === "WASM_TOOLCHAIN_INTEGRITY_FAILED") throw e;
         const err = new Error(
-          "WALLET_BACKEND_UNAVAILABLE: Kaspa cryptography adapter missing. Real account generation requires WASM execution.\nUse 'hardkas accounts real import' to add a test fixture manually for now."
+          `WALLET_BACKEND_UNAVAILABLE: the Kaspa WASM SDK could not be loaded, so real accounts cannot be generated (${e?.message ?? String(e)}).
+Check it with: hardkas toolchain status`
         );
         err.code = "WALLET_BACKEND_UNAVAILABLE";
         throw err;
@@ -1289,6 +1293,7 @@ export {
   signSilverSpend,
   signTxPlanArtifact,
   toWasmScriptPublicKey,
+  unlockAccountKeystore,
   validateAccountName,
   validateAddressNetwork,
   validateAddressPrefix,

package/dist/kaspa-wasm-signer-RBV2EPB7.js

@@ -0,0 +1,13 @@
+import {
+  KaspaWasmPrivateKeySigner,
+  assertSigningNetworkAllowed,
+  unlockAccountKeystore
+} from "./chunk-G6PYXAIU.js";
+import "./chunk-GM2BY4VS.js";
+import "./chunk-BNF566PS.js";
+import "./chunk-IRNHRG4N.js";
+export {
+  KaspaWasmPrivateKeySigner,
+  assertSigningNetworkAllowed,
+  unlockAccountKeystore
+};

package/dist/{resolve-FO4P46YC.js → resolve-FPK6KS5J.js}

@@ -4,7 +4,7 @@ import {
   listHardkasAccounts,
   resolveHardkasAccount,
   resolveHardkasAccountAddress
-} from "./chunk-2UQTGGML.js";
+} from "./chunk-IRNHRG4N.js";
 export {
   assertAccountCompatible,
   describeAccount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hardkas/accounts",
-  "version": "0.12.0-rc.24",
+  "version": "0.12.0-rc.26",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,11 +23,11 @@
   ],
   "dependencies": {
     "hash-wasm": "^4.12.0",
-    "@hardkas/artifacts": "0.12.0-rc.24",
-    "@hardkas/config": "0.12.0-rc.24",
-    "@hardkas/core": "0.12.0-rc.24",
-    "@hardkas/localnet": "0.12.0-rc.24",
-    "@hardkas/tx-builder": "0.12.0-rc.24"
+    "@hardkas/core": "0.12.0-rc.26",
+    "@hardkas/artifacts": "0.12.0-rc.26",
+    "@hardkas/localnet": "0.12.0-rc.26",
+    "@hardkas/config": "0.12.0-rc.26",
+    "@hardkas/tx-builder": "0.12.0-rc.26"
   },
   "devDependencies": {
     "tsup": "^8.3.5",

package/dist/chunk-YLG2NIAU.js

@@ -1,166 +0,0 @@
-// src/keystore.ts
-import fs from "fs";
-import path from "path";
-import crypto from "crypto";
-import { argon2id } from "hash-wasm";
-import { writeFileAtomic } from "@hardkas/core";
-var KeystoreManager = class {
-  /**
-   * Keystore container format version. Separate from ARTIFACT_VERSION.
-   * This versions the encrypted keystore envelope, not HardKAS artifacts.
-   */
-  static KEYSTORE_FORMAT_VERSION = "2.0.0";
-  static KEYSTORE_FORMAT_TYPE = "hardkas.encryptedKeystore.v2";
-  /**
-   * Creates an encrypted keystore from a payload and password.
-   */
-  static async createEncryptedKeystore(payload, password, options) {
-    if (!password) throw new Error("Password cannot be empty.");
-    if (password.length < 8)
-      throw new Error("Password must be at least 8 characters long.");
-    const salt = crypto.randomBytes(16);
-    const nonce = crypto.randomBytes(12);
-    const iterations = options.iterations || 3;
-    const memory = options.memory || 65536;
-    const parallelism = options.parallelism || 1;
-    const derivedKeyHex = await argon2id({
-      password,
-      salt,
-      parallelism,
-      iterations,
-      memorySize: memory,
-      hashLength: 32,
-      // 256 bits for AES-256
-      outputType: "hex"
-    });
-    const derivedKey = Buffer.from(derivedKeyHex, "hex");
-    const cipher = crypto.createCipheriv("aes-256-gcm", derivedKey, nonce);
-    const encryptedPayload = Buffer.concat([
-      cipher.update(JSON.stringify(payload), "utf8"),
-      cipher.final()
-    ]);
-    const tag = cipher.getAuthTag();
-    derivedKey.fill(0);
-    return {
-      version: this.KEYSTORE_FORMAT_VERSION,
-      type: this.KEYSTORE_FORMAT_TYPE,
-      kdf: {
-        algorithm: "argon2id",
-        memory,
-        iterations,
-        parallelism,
-        salt: salt.toString("base64")
-      },
-      cipher: {
-        algorithm: "aes-256-gcm",
-        nonce: nonce.toString("base64"),
-        tag: tag.toString("base64")
-      },
-      encryptedPayload: encryptedPayload.toString("base64"),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      metadata: {
-        label: options.label,
-        network: options.network,
-        address: payload.address
-      }
-    };
-  }
-  /**
-   * Decrypts an encrypted keystore using a password.
-   */
-  static async decryptEncryptedKeystore(keystore, password) {
-    if (keystore.version !== this.KEYSTORE_FORMAT_VERSION) {
-      return {
-        success: false,
-        error: `Unsupported keystore version: ${keystore.version}`
-      };
-    }
-    try {
-      const salt = Buffer.from(keystore.kdf.salt, "base64");
-      const nonce = Buffer.from(keystore.cipher.nonce, "base64");
-      const tag = Buffer.from(keystore.cipher.tag, "base64");
-      const encryptedData = Buffer.from(keystore.encryptedPayload, "base64");
-      const derivedKeyHex = await argon2id({
-        password,
-        salt,
-        parallelism: keystore.kdf.parallelism,
-        iterations: keystore.kdf.iterations,
-        memorySize: keystore.kdf.memory,
-        hashLength: 32,
-        outputType: "hex"
-      });
-      const derivedKey = Buffer.from(derivedKeyHex, "hex");
-      const decipher = crypto.createDecipheriv("aes-256-gcm", derivedKey, nonce);
-      decipher.setAuthTag(tag);
-      const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
-      derivedKey.fill(0);
-      const payload = JSON.parse(decrypted.toString("utf8"));
-      return { success: true, payload };
-    } catch (e) {
-      return { success: false, error: "Invalid password or corrupted keystore." };
-    }
-  }
-  /**
-   * Verifies if the password is correct for the keystore.
-   */
-  static async verifyKeystorePassword(keystore, password) {
-    const result = await this.decryptEncryptedKeystore(keystore, password);
-    return result.success;
-  }
-  /**
-   * Changes the password of an encrypted keystore.
-   */
-  static async changeKeystorePassword(keystore, oldPassword, newPassword) {
-    const unlock = await this.decryptEncryptedKeystore(keystore, oldPassword);
-    if (!unlock.success || !unlock.payload) {
-      throw new Error("Invalid current password.");
-    }
-    return this.createEncryptedKeystore(unlock.payload, newPassword, {
-      label: keystore.metadata.label,
-      network: keystore.metadata.network,
-      iterations: keystore.kdf.iterations,
-      memory: keystore.kdf.memory,
-      parallelism: keystore.kdf.parallelism
-    });
-  }
-  /**
-   * Loads an encrypted keystore from the filesystem.
-   */
-  static async loadEncryptedKeystore(filePath) {
-    try {
-      const data = await fs.promises.readFile(filePath, "utf-8");
-      const keystore = JSON.parse(data);
-      if (keystore.type !== this.KEYSTORE_FORMAT_TYPE) {
-        throw new Error(`Invalid keystore type: ${keystore.type}`);
-      }
-      return keystore;
-    } catch (e) {
-      throw new Error(
-        `Failed to load keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
-      );
-    }
-  }
-  /**
-   * Saves an encrypted keystore to the filesystem.
-   */
-  static async saveEncryptedKeystore(filePath, keystore) {
-    try {
-      const dir = path.dirname(filePath);
-      if (!fs.existsSync(dir)) {
-        await fs.promises.mkdir(dir, { recursive: true });
-      }
-      await writeFileAtomic(filePath, JSON.stringify(keystore, null, 2), {
-        encoding: "utf-8",
-        mode: 384
-      });
-    } catch (e) {
-      throw new Error(
-        `Failed to save keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
-      );
-    }
-  }
-};
-
-export {
-  KeystoreManager
-};

package/dist/dev-accounts-JTJKQAPV.js

@@ -1,18 +0,0 @@
-import {
-  DEV_ACCOUNTS_PASSWORD,
-  createDevSigner,
-  ensureDevAccounts,
-  getOrCreateDevAccount,
-  listDevAccountsSync
-} from "./chunk-Q22JFUWC.js";
-import "./chunk-GM2BY4VS.js";
-import "./chunk-BNF566PS.js";
-import "./chunk-2UQTGGML.js";
-import "./chunk-YLG2NIAU.js";
-export {
-  DEV_ACCOUNTS_PASSWORD,
-  createDevSigner,
-  ensureDevAccounts,
-  getOrCreateDevAccount,
-  listDevAccountsSync
-};

package/dist/keystore-CMWEKGBF.js

@@ -1,6 +0,0 @@
-import {
-  KeystoreManager
-} from "./chunk-YLG2NIAU.js";
-export {
-  KeystoreManager
-};