@hardkas/accounts 0.2.2-alpha.1 → 0.3.0-alpha

package/dist/index.d.ts

@@ -187,7 +187,10 @@ interface RealDevAccount {
     readonly name: string;
     readonly address: string;
     readonly publicKey?: string;
+    /** @deprecated Use keystoreRef for encrypted storage. Plaintext keys in this field are considered legacy/unsafe. */
     readonly privateKey?: string;
+    /** Reference to the encrypted keystore file in .hardkas/keystore/ */
+    readonly keystoreRef?: string;
     readonly createdAt: string;
 }
 declare function getDefaultRealAccountsPath(cwd?: string): string;

package/dist/index.js

@@ -21,6 +21,7 @@ import { createDeterministicAccounts } from "@hardkas/localnet";
 // src/real-accounts.ts
 import fs from "fs";
 import path from "path";
+import { writeFileAtomicSync } from "@hardkas/core";
 import { HARDKAS_VERSION, ARTIFACT_SCHEMAS, ARTIFACT_VERSION } from "@hardkas/artifacts";
 function getDefaultRealAccountsPath(cwd = process.cwd()) {
   return path.join(cwd, ".hardkas", "accounts.real.json");
@@ -34,7 +35,7 @@ function createEmptyRealAccountStore() {
     networkId: "simnet",
     mode: "real",
     connectionMode: "node",
-    warning: "Development keys only. Do not use on mainnet. Private keys are stored in plaintext.",
+    warning: "HardKAS: Development account store. Encrypted storage is default. Unsafe plaintext storage is legacy.",
     accounts: []
   };
 }
@@ -45,7 +46,17 @@ function loadRealAccountStoreSync(options) {
   }
   try {
     const data = fs.readFileSync(filePath, "utf-8");
-    return JSON.parse(data);
+    const store = JSON.parse(data);
+    const plaintextAccounts = store.accounts.filter((a) => a.privateKey);
+    if (plaintextAccounts.length > 0) {
+      const names = plaintextAccounts.map((a) => a.name).join(", ");
+      console.warn(`
+  \u26A0\uFE0F  [SECURITY WARNING] Plaintext private keys detected in legacy account store for: ${names}`);
+      console.warn(`     Location: ${filePath}`);
+      console.warn(`     Recommendation: Re-import these accounts using encrypted keystores.
+`);
+    }
+    return store;
   } catch (e) {
     throw new Error(`Failed to load real account store at ${filePath}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -62,12 +73,11 @@ async function loadOrCreateRealAccountStore(options) {
 }
 async function saveRealAccountStore(store, options) {
   const filePath = options?.path || getDefaultRealAccountsPath(options?.cwd);
-  const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
   try {
-    fs.writeFileSync(filePath, JSON.stringify(store, null, 2), "utf-8");
+    writeFileAtomicSync(filePath, JSON.stringify(store, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+    });
   } catch (e) {
     throw new Error(`Failed to save real account store at ${filePath}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -445,7 +455,6 @@ async function signTxPlanArtifact(input) {
       version: "1.0.0-alpha",
       status: "signed",
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      signedId: `signed_${planArtifact.planId}_${Date.now().toString(36)}`,
       txId: result.txId || "",
       // Ensure txId is present
       sourcePlanId: planArtifact.planId,
@@ -459,7 +468,9 @@ async function signTxPlanArtifact(input) {
         payload: result.signedTransaction?.payload || ""
       }
     };
-    artifact.contentHash = calculateContentHash2(artifact);
+    const contentHash = calculateContentHash2(artifact);
+    artifact.signedId = `signed-${contentHash.slice(0, 16)}`;
+    artifact.contentHash = contentHash;
     return artifact;
   }
   if (account.kind === "external-wallet") {
@@ -608,6 +619,7 @@ import fs3 from "fs";
 import path3 from "path";
 import crypto from "crypto";
 import { argon2id } from "hash-wasm";
+import { writeFileAtomic } from "@hardkas/core";
 var KeystoreManager = class {
   /**
    * Keystore container format version. Separate from ARTIFACT_VERSION.
@@ -750,7 +762,10 @@ var KeystoreManager = class {
       if (!fs3.existsSync(dir)) {
         await fs3.promises.mkdir(dir, { recursive: true });
       }
-      await fs3.promises.writeFile(filePath, JSON.stringify(keystore, null, 2), "utf-8");
+      await writeFileAtomic(filePath, JSON.stringify(keystore, null, 2), {
+        encoding: "utf-8",
+        mode: 384
+      });
     } catch (e) {
       throw new Error(`Failed to save keystore at ${filePath}: ${e instanceof Error ? e.message : String(e)}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hardkas/accounts",
-  "version": "0.2.2-alpha.1",
+  "version": "0.3.0-alpha",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -17,10 +17,10 @@
   ],
   "dependencies": {
     "hash-wasm": "^4.12.0",
-    "@hardkas/artifacts": "0.2.2-alpha.1",
-    "@hardkas/config": "0.2.2-alpha.1",
-    "@hardkas/core": "0.2.2-alpha.1",
-    "@hardkas/localnet": "0.2.2-alpha.1"
+    "@hardkas/artifacts": "0.3.0-alpha",
+    "@hardkas/config": "0.3.0-alpha",
+    "@hardkas/localnet": "0.3.0-alpha",
+    "@hardkas/core": "0.3.0-alpha"
   },
   "devDependencies": {
     "tsup": "^8.3.5",