@hardkas/cli 0.2.2-alpha.1 → 0.3.0-alpha

package/dist/index.js

@@ -1,10 +1,21 @@
 #!/usr/bin/env node
+import {
+  acquirePassword
+} from "./chunk-ZM2NBOAE.js";
+import {
+  inspectDeployment,
+  listAllDeployments,
+  showDeploymentHistory,
+  trackDeployment,
+  verifyDeploymentStatus
+} from "./chunk-KA5CAWI2.js";
 import {
   UI,
-  handleError
-} from "./chunk-AQWQW5ZG.js";
+  handleError,
+  handleLockError
+} from "./chunk-K7XPWWIO.js";
 
-// src/index.ts
+// src/program.ts
 import { Command } from "commander";
 
 // src/runners/up-runner.ts
@@ -71,35 +82,43 @@ async function runUp() {
 // src/commands/init.ts
 function registerInitCommands(program) {
   program.command("init").description(`Initialize a new HardKAS project ${UI.maturity("stable")}`).argument("[name]", "Project name or directory").option("--force", "Overwrite existing hardkas.config.ts", false).action(async (name, options) => {
+    let targetDir = process.cwd();
+    const path15 = await import("path");
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
+    if (name) {
+      targetDir = path15.join(process.cwd(), name);
+    }
     try {
-      const fs10 = await import("fs");
-      const path12 = await import("path");
-      let targetDir = process.cwd();
-      if (name) {
-        targetDir = path12.join(process.cwd(), name);
-        if (!fs10.existsSync(targetDir)) {
-          fs10.mkdirSync(targetDir, { recursive: true });
+      await withLock2({
+        rootDir: targetDir,
+        name: "workspace",
+        command: `hardkas init ${name || ""}`
+      }, async () => {
+        const fs12 = await import("fs");
+        const { writeFileAtomicSync } = await import("@hardkas/core");
+        if (name && !fs12.existsSync(targetDir)) {
+          fs12.mkdirSync(targetDir, { recursive: true });
         }
-      }
-      const configFile = path12.join(targetDir, "hardkas.config.ts");
-      const pkgFile = path12.join(targetDir, "package.json");
-      if (fs10.existsSync(configFile) && !options.force) {
-        UI.warning(`hardkas.config.ts already exists in ${name || "current directory"}. Use --force to overwrite.`);
-        return;
-      }
-      if (!fs10.existsSync(pkgFile)) {
-        const pkgTemplate = {
-          name: name || "hardkas-project",
-          version: "1.0.0",
-          type: "module",
-          dependencies: {
-            "@hardkas/sdk": "latest"
-          }
-        };
-        fs10.writeFileSync(pkgFile, JSON.stringify(pkgTemplate, null, 2), "utf-8");
-        UI.info("Created: package.json");
-      }
-      const template = `import { defineHardkasConfig } from "@hardkas/sdk";
+        const configFile = path15.join(targetDir, "hardkas.config.ts");
+        const pkgFile = path15.join(targetDir, "package.json");
+        if (fs12.existsSync(configFile) && !options.force) {
+          UI.warning(`hardkas.config.ts already exists in ${name || "current directory"}. Use --force to overwrite.`);
+          return;
+        }
+        if (!fs12.existsSync(pkgFile)) {
+          const pkgTemplate = {
+            name: name || "hardkas-project",
+            version: "1.0.0",
+            type: "module",
+            dependencies: {
+              "@hardkas/sdk": "latest"
+            }
+          };
+          writeFileAtomicSync(pkgFile, JSON.stringify(pkgTemplate, null, 2), { encoding: "utf-8" });
+          UI.info("Created: package.json");
+        }
+        const template = `import { defineHardkasConfig } from "@hardkas/sdk";
 
 export default defineHardkasConfig({
   // HardKAS v0.2.2-alpha Configuration
@@ -120,34 +139,35 @@ export default defineHardkasConfig({
   accounts: {
     alice: {
       kind: "simulated",
-      address: "kaspa:sim_alice"
+      address: "kaspasim:sim_alice"
     },
     bob: {
       kind: "simulated",
-      address: "kaspa:sim_bob"
+      address: "kaspasim:sim_bob"
     }
   }
 });
 `;
-      fs10.writeFileSync(configFile, template, "utf-8");
-      const gitIgnoreFile = path12.join(targetDir, ".gitignore");
-      const gitIgnoreEntry = "\n# HardKAS local storage\n.hardkas/\n";
-      if (!fs10.existsSync(gitIgnoreFile)) {
-        fs10.writeFileSync(gitIgnoreFile, gitIgnoreEntry, "utf-8");
-        UI.info("Created: .gitignore");
-      } else {
-        const content = fs10.readFileSync(gitIgnoreFile, "utf-8");
-        if (!content.includes(".hardkas/")) {
-          fs10.appendFileSync(gitIgnoreFile, gitIgnoreEntry, "utf-8");
-          UI.info("Updated: .gitignore (added .hardkas/)");
+        writeFileAtomicSync(configFile, template, { encoding: "utf-8" });
+        const gitIgnoreFile = path15.join(targetDir, ".gitignore");
+        const gitIgnoreEntry = "\n# HardKAS local storage\n.hardkas/\n";
+        if (!fs12.existsSync(gitIgnoreFile)) {
+          writeFileAtomicSync(gitIgnoreFile, gitIgnoreEntry, { encoding: "utf-8" });
+          UI.info("Created: .gitignore");
+        } else {
+          const content = fs12.readFileSync(gitIgnoreFile, "utf-8");
+          if (!content.includes(".hardkas/")) {
+            fs12.appendFileSync(gitIgnoreFile, gitIgnoreEntry, "utf-8");
+            UI.info("Updated: .gitignore (added .hardkas/)");
+          }
         }
-      }
-      UI.success(`HardKAS project '${name || "current"}' initialized successfully.`);
-      if (name) UI.info(`Project folder: ${targetDir}`);
-      UI.info(`Created: hardkas.config.ts (v0.2-alpha)`);
-      UI.footer(`Run 'cd ${name || "."}' and then 'hardkas up' to start.`);
+        UI.success(`HardKAS project '${name || "current"}' initialized successfully.`);
+        if (name) UI.info(`Project folder: ${targetDir}`);
+        UI.info(`Created: hardkas.config.ts (v0.2-alpha)`);
+        UI.footer(`Run 'cd ${name || "."}' and then 'hardkas up' to start.`);
+      });
     } catch (e) {
-      handleError(e, "Initialization failed");
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
@@ -340,6 +360,22 @@ async function runTxSign(input) {
   const { planArtifact, accountName, config, allowMainnetSigning } = input;
   const targetAccountName = accountName || planArtifact.from.accountName || planArtifact.from.input || planArtifact.from.address;
   const account = resolveHardkasAccount({ nameOrAddress: targetAccountName, config });
+  const artifactNetwork = planArtifact.networkId;
+  const accountAddressNetwork = getNetworkFromAddress(account.address || "");
+  const activeProfileNetwork = config.defaultNetwork;
+  if (artifactNetwork === "mainnet") {
+    UI.warning("CRITICAL: You are signing a transaction for MAINNET.");
+    UI.info("HardKAS is developer infrastructure, not production custody software.");
+    UI.info("Do not use high-value mainnet keys in this environment.");
+    if (!allowMainnetSigning) {
+      throw new Error("Mainnet signing is blocked. Use --allow-mainnet-signing if you understand the risks.");
+    }
+  }
+  if (artifactNetwork !== accountAddressNetwork && accountAddressNetwork !== "unknown") {
+    if (artifactNetwork === "mainnet" || accountAddressNetwork === "mainnet") {
+      throw new Error(`Network mismatch: Plan is for '${artifactNetwork}' but account is for '${accountAddressNetwork}'. Refusing to sign.`);
+    }
+  }
   const signedArtifact = await signTxPlanArtifact({
     planArtifact,
     account,
@@ -348,6 +384,12 @@ async function runTxSign(input) {
   });
   return signedArtifact;
 }
+function getNetworkFromAddress(address) {
+  if (address.startsWith("kaspa:")) return "mainnet";
+  if (address.startsWith("kaspatest:")) return "testnet-10";
+  if (address.startsWith("kaspasim:")) return "simnet";
+  return "unknown";
+}
 
 // src/runners/tx-send-runner.ts
 import {
@@ -436,7 +478,7 @@ async function runTxSend(input) {
       to: { address: signedArtifact.to.address },
       amountSompi: signedArtifact.amountSompi,
       feeSompi: simResult.receipt.feeSompi,
-      daaScore: simResult.receipt.daaScore.toString(),
+      daaScore: simResult.receipt.daaScore?.toString() || "0",
       submittedAt: simResult.receipt.createdAt,
       confirmedAt: simResult.receipt.createdAt,
       rpcUrl: "simulated://local"
@@ -497,7 +539,7 @@ Receipt: ${receiptPath}`
       amountSompi: signedArtifact.amountSompi,
       feeSompi: signedArtifact.metadata?.estimatedFeeSompi || "0",
       submittedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      rpcUrl
+      ...rpcUrl ? { rpcUrl } : {}
     };
     return {
       accepted: !!result.accepted,
@@ -681,108 +723,148 @@ async function runTxReceipt(input) {
 // src/commands/tx.ts
 function registerTxCommands(program) {
   const tx = program.command("tx").description("L1 Transaction commands");
-  tx.command("profile <path>").description("Show detailed mass and fee breakdown for a transaction plan").action(async (path12) => {
+  tx.command("profile <path>").description(`Show detailed mass and fee breakdown for a transaction plan ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (path15, options) => {
     try {
-      await runTxProfile({ path: path12 });
+      await runTxProfile({ path: path15, ...options });
     } catch (e) {
       handleError(e);
       process.exitCode = 1;
     }
   });
-  tx.command("plan").description(`Build a transaction plan artifact ${UI.maturity("stable")}`).option("--from <accountOrAddress>", "Sender account name or address").option("--to <address>", "Recipient address").option("--amount <kas>", "Amount in KAS").option("--network <name>", "Kaspa network name", "simnet").option("--fee-rate <sompiPerMass>", "Fee rate in sompi per mass", "1").option("--url <url>", "RPC URL (optional override)").option("--out <path>", "Save plan as artifact JSON").option("--json", "Output as JSON", false).action(async (options) => {
+  tx.command("plan").description(`Build a transaction plan artifact ${UI.maturity("stable")}`).option("--from <accountOrAddress>", "Sender account name or address").option("--to <address>", "Recipient address").option("--amount <kas>", "Amount in KAS").option("--network <name>", "Kaspa network name", "simnet").option("--fee-rate <sompiPerMass>", "Fee rate in sompi per mass", "1").option("--url <url>", "RPC URL (optional override)").option("--out <path>", "Save plan as artifact JSON").option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const { loadHardkasConfig: loadHardkasConfig5 } = await import("@hardkas/config");
-      const { writeArtifact: writeArtifact4, formatTxPlanArtifact } = await import("@hardkas/artifacts");
-      const loaded = await loadHardkasConfig5();
-      const artifact = await runTxPlan({
-        from: options.from || "alice",
-        to: options.to || "bob",
-        amount: options.amount || "1",
-        networkId: options.network,
-        feeRate: options.feeRate,
-        config: loaded.config,
-        ...options.url ? { url: options.url } : {}
-      });
-      if (options.out) await writeArtifact4(options.out, artifact);
-      if (options.json) console.log(JSON.stringify(artifact, bigIntReplacer, 2));
-      else {
-        console.log(formatTxPlanArtifact(artifact));
-        if (options.out) console.log(`
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "artifacts",
+        command: "hardkas tx plan",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const { loadHardkasConfig: loadHardkasConfig15 } = await import("@hardkas/config");
+        const { writeArtifact: writeArtifact4, formatTxPlanArtifact } = await import("@hardkas/artifacts");
+        const loaded = await loadHardkasConfig15();
+        const artifact = await runTxPlan({
+          from: options.from || "alice",
+          to: options.to || "bob",
+          amount: options.amount || "1",
+          networkId: options.network,
+          feeRate: options.feeRate,
+          config: loaded.config,
+          ...options.url ? { url: options.url } : {}
+        });
+        if (options.out) await writeArtifact4(options.out, artifact);
+        if (options.json) console.log(JSON.stringify(artifact, bigIntReplacer, 2));
+        else {
+          console.log(formatTxPlanArtifact(artifact));
+          if (options.out) console.log(`
 Artifact saved to: ${options.out}`);
-      }
+        }
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  tx.command("sign <planPath>").description(`Sign a transaction plan artifact ${UI.maturity("stable")}`).option("--account <name>", "Account name to sign with").option("--out <path>", "Save signed artifact JSON").option("--allow-mainnet-signing", "Allow signing for mainnet", false).option("--json", "Output as JSON", false).action(async (planPath, options) => {
+  tx.command("sign <planPath>").description(`Sign a transaction plan artifact ${UI.maturity("stable")}`).option("--account <name>", "Account name to sign with").option("--out <path>", "Save signed artifact JSON").option("--allow-mainnet-signing", "Allow signing for mainnet", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).action(async (planPath, options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const { readTxPlanArtifact, writeArtifact: writeArtifact4, formatSignedTxArtifact } = await import("@hardkas/artifacts");
-      const { loadHardkasConfig: loadHardkasConfig5 } = await import("@hardkas/config");
-      const planArtifact = await readTxPlanArtifact(planPath);
-      const loaded = await loadHardkasConfig5();
-      const signedArtifact = await runTxSign({
-        planArtifact,
-        ...options.account ? { accountName: options.account } : {},
-        config: loaded.config,
-        allowMainnetSigning: options.allowMainnetSigning
-      });
-      if (options.out) await writeArtifact4(options.out, signedArtifact);
-      if (options.json) console.log(JSON.stringify(signedArtifact, bigIntReplacer, 2));
-      else {
-        console.log(formatSignedTxArtifact(signedArtifact));
-        if (options.out) console.log(`
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "artifacts",
+        command: "hardkas tx sign",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const { readTxPlanArtifact, writeArtifact: writeArtifact4, formatSignedTxArtifact } = await import("@hardkas/artifacts");
+        const { loadHardkasConfig: loadHardkasConfig15 } = await import("@hardkas/config");
+        const planArtifact = await readTxPlanArtifact(planPath);
+        const loaded = await loadHardkasConfig15();
+        const signedArtifact = await runTxSign({
+          planArtifact,
+          ...options.account ? { accountName: options.account } : {},
+          config: loaded.config,
+          allowMainnetSigning: options.allowMainnetSigning
+        });
+        if (options.out) await writeArtifact4(options.out, signedArtifact);
+        if (options.json) console.log(JSON.stringify(signedArtifact, bigIntReplacer, 2));
+        else {
+          console.log(formatSignedTxArtifact(signedArtifact));
+          if (options.out) console.log(`
 Signed artifact saved to: ${options.out}`);
-      }
+        }
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  tx.command("send [signedPath]").description(`Broadcast a signed transaction or send directly ${UI.maturity("stable")}`).option("--from <accountOrAddress>", "Sender (shortcut mode)").option("--to <address>", "Recipient (shortcut mode)").option("--amount <kas>", "Amount in KAS (shortcut mode)").option("--network <name>", "Network name", "simnet").option("--url <url>", "RPC URL (optional override)").option("--yes", "Confirm broadcast", false).option("--json", "Output as JSON", false).action(async (signedPath, options) => {
+  tx.command("send [signedPath]").description(`Broadcast a signed transaction or send directly ${UI.maturity("stable")}`).option("--from <accountOrAddress>", "Sender (shortcut mode)").option("--to <address>", "Recipient (shortcut mode)").option("--amount <kas>", "Amount in KAS (shortcut mode)").option("--network <name>", "Network name", "simnet").option("--url <url>", "RPC URL (optional override)").option("--yes", "Confirm broadcast", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).option("--track <label>", "Auto-track deployment with this label").action(async (signedPath, options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const { loadHardkasConfig: loadHardkasConfig5 } = await import("@hardkas/config");
-      const loaded = await loadHardkasConfig5();
-      if (signedPath) {
-        const { readSignedTxArtifact } = await import("@hardkas/artifacts");
-        const signedArtifact = await readSignedTxArtifact(signedPath);
-        if (!options.yes && signedArtifact.networkId !== "simnet") {
-          console.log(`Transaction is for network: ${signedArtifact.networkId}`);
-          console.log("Run with --yes to broadcast.");
-          return;
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "artifacts",
+        command: "hardkas tx send",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const { loadHardkasConfig: loadHardkasConfig15 } = await import("@hardkas/config");
+        const loaded = await loadHardkasConfig15();
+        if (signedPath) {
+          const { readSignedTxArtifact } = await import("@hardkas/artifacts");
+          const signedArtifact = await readSignedTxArtifact(signedPath);
+          if (!options.yes && signedArtifact.networkId !== "simnet") {
+            console.log(`Transaction is for network: ${signedArtifact.networkId}`);
+            console.log("Run with --yes to broadcast.");
+            return;
+          }
+          const result = await runTxSend({
+            signedArtifact,
+            network: options.network,
+            config: loaded.config,
+            ...options.url ? { url: options.url } : {}
+          });
+          if (options.json) console.log(JSON.stringify(result, bigIntReplacer, 2));
+          else console.log(result.formatted);
+          if (options.track && result.accepted) {
+            const { trackDeployment: trackDeployment2 } = await import("./deployment-runners-GEICABEH.js");
+            await trackDeployment2({
+              label: options.track,
+              network: result.networkName,
+              txId: result.txId,
+              plan: signedArtifact.sourcePlanId,
+              status: result.receipt.status === "confirmed" ? "confirmed" : "sent"
+            });
+          }
+        } else if (options.from && options.to && options.amount) {
+          const result = await runTxFlow({
+            ...options,
+            amount: options.amount,
+            from: options.from,
+            to: options.to,
+            send: true,
+            feeRate: "1",
+            // Default fee rate for shortcut
+            config: loaded.config,
+            ...options.url ? { url: options.url } : {}
+          });
+          if (options.json) console.log(JSON.stringify(result, bigIntReplacer, 2));
+          else console.log(result.steps.send.artifact?.formatted || "Flow completed");
+        } else {
+          console.error("Provide a path to a signed artifact or use --from, --to, --amount.");
+          process.exitCode = 1;
         }
-        const result = await runTxSend({
-          signedArtifact,
-          network: options.network,
-          config: loaded.config,
-          ...options.url ? { url: options.url } : {}
-        });
-        if (options.json) console.log(JSON.stringify(result, bigIntReplacer, 2));
-        else console.log(result.formatted);
-      } else if (options.from && options.to && options.amount) {
-        const result = await runTxFlow({
-          ...options,
-          amount: options.amount,
-          from: options.from,
-          to: options.to,
-          send: true,
-          feeRate: "1",
-          // Default fee rate for shortcut
-          config: loaded.config,
-          ...options.url ? { url: options.url } : {}
-        });
-        if (options.json) console.log(JSON.stringify(result, bigIntReplacer, 2));
-        else console.log(result.steps.send.artifact?.formatted || "Flow completed");
-      } else {
-        console.error("Provide a path to a signed artifact or use --from, --to, --amount.");
-        process.exitCode = 1;
-      }
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  tx.command("receipt <txId>").description("Show transaction receipt").option("--json", "Output as JSON", false).action(async (txId, options) => {
+  tx.command("receipt <txId>").description(`Show transaction receipt ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (txId, options) => {
     try {
       const result = await runTxReceipt({ txId });
       if (options.json) console.log(JSON.stringify(result.receipt, bigIntReplacer, 2));
@@ -792,19 +874,19 @@ Signed artifact saved to: ${options.out}`);
       process.exitCode = 1;
     }
   });
-  tx.command("verify <path>").description(`Perform deep semantic verification of a transaction plan ${UI.maturity("preview")}`).option("--json", "Output as JSON", false).action(async (path12, options) => {
-    const { runTxVerify } = await import("./tx-verify-runner-Z5M2JDRI.js");
-    await runTxVerify({ path: path12, ...options });
+  tx.command("verify <path>").description(`Perform deep semantic verification of a transaction plan ${UI.maturity("preview")}`).option("--json", "Output as JSON", false).action(async (path15, options) => {
+    const { runTxVerify } = await import("./tx-verify-runner-6EGY5ZN4.js");
+    await runTxVerify({ path: path15, ...options });
   });
   tx.command("trace <txId>").description(`Reconstruct the full operational trace of a transaction ${UI.maturity("research")}`).action(async (txId) => {
-    const { UI: UI2 } = await import("./ui-OVK5PX6H.js");
+    const { UI: UI2 } = await import("./ui-SUYOHGGP.js");
     UI2.error("Tracing is temporarily disabled while the query API stabilizes.");
     process.exitCode = 1;
   });
 }
 
 // src/runners/artifact-verify-runner.ts
-import { verifyArtifactIntegrity, verifyArtifactSemantics } from "@hardkas/artifacts";
+import { verifyArtifactIntegrity, verifyArtifactSemantics, verifyArtifactReplay } from "@hardkas/artifacts";
 import path4 from "path";
 import fs3 from "fs";
 async function runArtifactVerify(options) {
@@ -828,8 +910,11 @@ async function runArtifactVerify(options) {
   let result = await verifyArtifactIntegrity(absolutePath);
   const artifact = JSON.parse(fs3.readFileSync(absolutePath, "utf-8"));
   const semanticResult = verifyArtifactSemantics(artifact, { strict: options.strict ?? false });
+  const replayResult = await verifyArtifactReplay(artifact, { strict: options.strict ?? false });
   result.issues.push(...semanticResult.issues);
+  result.issues.push(...replayResult.issues);
   result.errors.push(...semanticResult.errors);
+  result.errors.push(...replayResult.errors);
   result.ok = result.ok && semanticResult.ok;
   if (options.json) {
     console.log(JSON.stringify(result, null, 2));
@@ -844,11 +929,22 @@ async function runArtifactVerify(options) {
     if (options.strict) {
       console.log(`
 Operational Audit (STRICT):`);
-      const feeAudit = verifyArtifactSemantics(artifact, { strict: true });
-      if (feeAudit.ok) {
-        UI.success("  \u2713 Economic invariants verified.");
+      if (semanticResult.ok) {
+        UI.success("  \u2713 Economic & Lineage invariants verified.");
+      } else {
+        UI.error("  \u2717 Semantic invariants VIOLATED.");
+      }
+    }
+    console.log(`
+Replay Verification:`);
+    if (replayResult.ok) {
+      UI.success("  \u2713 Replay verified.");
+    } else {
+      const replayIssue = replayResult.issues.find((i) => i.code === "REPLAY_UNSUPPORTED_CHECK");
+      if (replayIssue) {
+        UI.warning("  \u26A0 REPLAY UNSUPPORTED (Consensus simulation skipped)");
       } else {
-        UI.error("  \u2717 Economic invariants VIOLATED.");
+        UI.error("  \u2717 Replay verification FAILED.");
       }
     }
   } else {
@@ -985,7 +1081,8 @@ async function runArtifactExplain(options) {
   if (explanation.security.strictOk) {
     UI.success("  \u2713 No critical integrity violations detected.");
   } else {
-    UI.error("  \u2717 SECUIRTY WARNINGS DETECTED.");
+    UI.error("  \u2717 SECURITY WARNINGS DETECTED.");
+    process.exitCode = 1;
   }
   if (explanation.security.issues.length > 0) {
     explanation.security.issues.forEach((issue) => {
@@ -999,26 +1096,26 @@ async function runArtifactExplain(options) {
 // src/commands/artifact.ts
 function registerArtifactCommands(program) {
   const artifactCmd = program.command("artifact").description("Manage HardKAS artifacts");
-  artifactCmd.command("verify <path>").description(`Verify an artifact's integrity and schema ${UI.maturity("stable")}`).option("--json", "Output results as JSON", false).option("--recursive", "Recursively verify all artifacts in a directory", false).option("--strict", "Perform deep semantic and operational safety verification", false).action(async (path12, options) => {
+  artifactCmd.command("verify <path>").description(`Verify an artifact's integrity and schema ${UI.maturity("stable")}`).option("--json", "Output results as JSON", false).option("--recursive", "Recursively verify all artifacts in a directory", false).option("--strict", "Perform deep semantic and operational safety verification", false).action(async (path15, options) => {
     try {
-      await runArtifactVerify({ path: path12, ...options });
+      await runArtifactVerify({ path: path15, ...options });
     } catch (e) {
       handleError(e);
       process.exitCode = 1;
     }
   });
-  artifactCmd.command("explain <path>").description(`Provide a human-readable operational summary of an artifact ${UI.maturity("preview")}`).action(async (path12) => {
+  artifactCmd.command("explain <path>").description(`Provide a human-readable operational summary of an artifact ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (path15, options) => {
     try {
-      await runArtifactExplain({ path: path12 });
+      await runArtifactExplain({ path: path15, ...options });
     } catch (e) {
       handleError(e);
       process.exitCode = 1;
     }
   });
-  artifactCmd.command("lineage <path>").description(`Show the provenance and operational history of an artifact ${UI.maturity("preview")}`).action(async (path12) => {
+  artifactCmd.command("lineage <path>").description(`Show the provenance and operational history of an artifact ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (path15, options) => {
     try {
-      const { runArtifactLineage } = await import("./artifact-lineage-runner-RJWQ3R3X.js");
-      await runArtifactLineage({ path: path12 });
+      const { runArtifactLineage } = await import("./artifact-lineage-runner-TY4YTE6H.js");
+      await runArtifactLineage({ path: path15 });
     } catch (e) {
       handleError(e);
       process.exitCode = 1;
@@ -1029,22 +1126,22 @@ function registerArtifactCommands(program) {
 // src/commands/replay.ts
 function registerReplayCommands(program) {
   const replayCmd = program.command("replay").description("Manage HardKAS transaction replays");
-  replayCmd.command("verify <path>").description("Verify replay invariants for a directory of artifacts").action(async (path12) => {
-    const { runReplayVerify } = await import("./replay-verify-runner-UMYALHNT.js");
-    await runReplayVerify({ path: path12 });
+  replayCmd.command("verify <path>").description(`Verify replay invariants for a directory of artifacts ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (path15, options) => {
+    const { runReplayVerify } = await import("./replay-verify-runner-Y3RARVD7.js");
+    await runReplayVerify({ path: path15, ...options });
   });
 }
 
 // src/commands/snapshot.ts
 function registerSnapshotCommands(program) {
   const snapshotCmd = program.command("snapshot").description("Manage HardKAS localnet snapshots");
-  snapshotCmd.command("verify <idOrName>").description("Verify the integrity of a snapshot").action(async (idOrName) => {
-    const { runSnapshotVerify } = await import("./snapshot-verify-runner-BWRW3NUW.js");
-    await runSnapshotVerify({ idOrName });
+  snapshotCmd.command("verify <idOrName>").description(`Verify the integrity of a snapshot ${UI.maturity("preview")}`).option("--json", "Output as JSON", false).action(async (idOrName, options) => {
+    const { runSnapshotVerify } = await import("./snapshot-verify-runner-PGMADWLN.js");
+    await runSnapshotVerify({ idOrName, ...options });
   });
-  snapshotCmd.command("restore <idOrName>").description("Restore localnet state from a snapshot").action(async (idOrName) => {
-    const { runSnapshotRestore } = await import("./snapshot-restore-runner-QNAADGBX.js");
-    await runSnapshotRestore({ idOrName });
+  snapshotCmd.command("restore <idOrName>").description(`Restore localnet state from a snapshot ${UI.maturity("preview")}`).option("--json", "Output as JSON", false).action(async (idOrName, options) => {
+    const { runSnapshotRestore } = await import("./snapshot-restore-runner-KIJNPLDV.js");
+    await runSnapshotRestore({ idOrName, ...options });
   });
 }
 
@@ -1230,7 +1327,7 @@ function registerRpcCommands(program) {
     }
   });
   rpcCmd.command("doctor").description("Run comprehensive RPC diagnostics").option("--endpoints <urls...>", "Specific endpoints to audit").action(async (options) => {
-    const { runRpcDoctor } = await import("./rpc-doctor-runner-ERWXOXSE.js");
+    const { runRpcDoctor } = await import("./rpc-doctor-runner-V7H7AAX4.js");
     try {
       await runRpcDoctor(options);
     } catch (e) {
@@ -1265,7 +1362,7 @@ function registerDagCommands(program) {
   const dagCmd = program.command("dag").description("Simulate blockDAG operations (Localnet only)");
   dagCmd.command("status").description("View current DAG status").action(async () => {
     try {
-      const { runDagStatus } = await import("./dag-runners-YQDHD7U6.js");
+      const { runDagStatus } = await import("./dag-runners-NLBYR7I7.js");
       await runDagStatus();
     } catch (e) {
       handleError(e);
@@ -1274,7 +1371,7 @@ function registerDagCommands(program) {
   });
   dagCmd.command("simulate-reorg").description("Simulate a DAG reorg").option("--depth <n>", "Reorg depth", "1").action(async (options) => {
     try {
-      const { runDagSimulateReorg } = await import("./dag-runners-YQDHD7U6.js");
+      const { runDagSimulateReorg } = await import("./dag-runners-NLBYR7I7.js");
       await runDagSimulateReorg({ depth: parseInt(options.depth) });
     } catch (e) {
       handleError(e);
@@ -1318,21 +1415,58 @@ import {
   loadOrCreateRealAccountStore,
   saveRealAccountStore as saveRealAccountStore2,
   importRealDevAccount,
-  KaspaSdkKeyGenerator
+  KaspaSdkKeyGenerator,
+  KeystoreManager
 } from "@hardkas/accounts";
+import path6 from "path";
 async function runAccountsRealGenerate(options = {}) {
   const generator = new KaspaSdkKeyGenerator(options.networkId ? { networkId: options.networkId } : {});
   const count = options.count || 1;
   let store = await loadOrCreateRealAccountStore();
   const generatedAccounts = [];
+  let password = "";
+  if (!options.unsafePlaintext) {
+    password = await acquirePassword({
+      stdin: options.passwordStdin,
+      env: options.passwordEnv,
+      message: `Enter password to encrypt ${count} new account(s):`
+    });
+    if (!password) throw new Error("Password is required for encrypted storage.");
+  } else {
+    UI.warning("LEGACY MODE: Generating accounts in plaintext is unsafe.");
+    if (!options.yes) {
+      const confirmed = await UI.confirm("Are you sure you want to store these keys in plaintext?");
+      if (!confirmed) throw new Error("Generation cancelled.");
+    }
+  }
   for (let i = 0; i < count; i++) {
     const name = count === 1 && options.name ? options.name : options.name ? `${options.name}${i + 1}` : `account${i}`;
     const generated = await generator.generateAccount(options.networkId ? { networkId: options.networkId } : {});
+    let keystoreRef;
+    if (!options.unsafePlaintext) {
+      const keystore = await KeystoreManager.createEncryptedKeystore(
+        {
+          address: generated.address,
+          privateKey: generated.privateKey,
+          network: options.networkId || "simnet"
+        },
+        password,
+        {
+          label: name,
+          network: options.networkId || "simnet"
+        }
+      );
+      const keystoreDir = path6.join(process.cwd(), ".hardkas", "keystore");
+      const filePath = path6.join(keystoreDir, `${name}.json`);
+      await KeystoreManager.saveEncryptedKeystore(filePath, keystore);
+      keystoreRef = `.hardkas/keystore/${name}.json`;
+    }
     store = importRealDevAccount(store, {
       name,
       address: generated.address,
       ...generated.publicKey ? { publicKey: generated.publicKey } : {},
-      ...generated.privateKey ? { privateKey: generated.privateKey } : {}
+      ...options.unsafePlaintext && generated.privateKey ? { privateKey: generated.privateKey } : {},
+      ...keystoreRef ? { keystoreRef } : {}
     });
     generatedAccounts.push(store.accounts[store.accounts.length - 1]);
   }
@@ -1414,11 +1548,13 @@ async function runAccountsFund(options) {
   const loadedConfig = await loadHardkasConfig3({});
   const address = resolveHardkasAccountAddress2(options.identifier, loadedConfig.config);
   const networkId = loadedConfig.config.defaultNetwork || "simnet";
+  const networkConfig = loadedConfig.config.networks?.[networkId];
+  const isSimulated = networkId === "simulated" || networkId === "localnet" || networkConfig?.kind === "simulated";
   const allowedNetworks = ["simnet", "localnet", "dev", "simulated"];
-  if (!allowedNetworks.includes(networkId)) {
+  if (!allowedNetworks.includes(networkId) && !isSimulated) {
     throw new Error(`Faucet/Funding is only allowed on development networks (${allowedNetworks.join(", ")}). Current network is: ${networkId}`);
   }
-  if (networkId === "simulated" || networkId === "localnet") {
+  if (isSimulated) {
     const state = await loadOrCreateLocalnetState2();
     const amount = options.amountSompi || 1000n * 100000000n;
     const newState = fundAddress(state, { address, amountSompi: amount });
@@ -1443,11 +1579,11 @@ Hint: Start your node with 'hardkas node start --miningaddr ${address}' to mine
 // src/commands/accounts.ts
 function registerAccountsCommands(program) {
   const accountsCmd = program.command("accounts").description("Manage HardKAS accounts");
-  accountsCmd.command("list").description("List available HardKAS accounts").option("--config <path>", "Path to config file").option("--json", "Output as JSON", false).action(async (options) => {
-    const { loadHardkasConfig: loadHardkasConfig5 } = await import("@hardkas/config");
+  accountsCmd.command("list").description(`List available HardKAS accounts ${UI.maturity("stable")}`).option("--config <path>", "Path to config file").option("--json", "Output as JSON", false).action(async (options) => {
+    const { loadHardkasConfig: loadHardkasConfig15 } = await import("@hardkas/config");
     const { listHardkasAccounts: listHardkasAccounts2, describeAccount } = await import("@hardkas/accounts");
     try {
-      const loaded = await loadHardkasConfig5(options.config ? { configPath: options.config } : {});
+      const loaded = await loadHardkasConfig15(options.config ? { configPath: options.config } : {});
       const accounts = listHardkasAccounts2(loaded.config);
       if (options.json) {
         console.log(JSON.stringify(accounts.map((a) => describeAccount(a)), null, 2));
@@ -1465,70 +1601,117 @@ function registerAccountsCommands(program) {
     }
   });
   const realAccountsCmd = accountsCmd.command("real").description("Persistent dev account store (L1)");
-  realAccountsCmd.command("init").description("Initialize real dev account store").option("--force", "Overwrite existing store", false).option("--json", "Output as JSON", false).action(async (options) => {
+  realAccountsCmd.command("init").description(`Initialize real dev account store ${UI.maturity("stable")}`).option("--force", "Overwrite existing store", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const result = await runAccountsRealInit({ force: options.force });
-      if (options.json) console.log(JSON.stringify(result, null, 2));
-      else console.log(result.formatted);
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "accounts",
+        command: "hardkas accounts real init",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const result = await runAccountsRealInit({ force: options.force });
+        if (options.json) console.log(JSON.stringify(result, null, 2));
+        else console.log(result.formatted);
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  realAccountsCmd.command("import").description("Import an account into the persistent store").option("--name <name>", "Account name").option("--address <address>", "Kaspa address").option("--private-key <hex>", "Private key (plaintext, discouraged)").option("--encrypted", "Import as encrypted keystore (recommended)", false).option("--json", "Output as JSON", false).action(async (options) => {
+  realAccountsCmd.command("import").description(`Import an account into the persistent store ${UI.maturity("stable")}`).option("--name <name>", "Account name").option("--address <address>", "Kaspa address").option("--private-key <hex>", "Deprecated. Unsafe: may leak through shell history. Prefer --private-key-stdin or --private-key-env.").option("--private-key-stdin", "Read private key from stdin", false).option("--private-key-env <env>", "Read private key from environment variable").option("--password-stdin", "Read keystore password from stdin (safe)", false).option("--password-env <env>", "Read keystore password from environment variable (safe)").option("--unsafe-plaintext", "Store private key in plaintext (legacy/discouraged)", false).option("--yes", "Skip confirmation for unsafe operations", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const { runAccountsKeystoreImport } = await import("./accounts-keystore-runners-MCJIAGZ4.js");
-      const result = await runAccountsKeystoreImport(options);
-      if (options.json) console.log(JSON.stringify(result, null, 2));
-      else console.log(result.formatted);
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "accounts",
+        command: "hardkas accounts real import",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const { runAccountsKeystoreImport } = await import("./accounts-keystore-runners-QYSNZMZV.js");
+        const result = await runAccountsKeystoreImport(options);
+        if (options.json) console.log(JSON.stringify(result, null, 2));
+        else console.log(result.formatted);
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  realAccountsCmd.command("unlock <name>").description(`Verify keystore access ${UI.maturity("internal")}`).action(async (name) => {
+  realAccountsCmd.command("session-open <name>").alias("unlock").description(`Verify keystore access and record signing intent ${UI.maturity("internal")}`).option("--password-stdin", "Read password from stdin", false).option("--password-env <env>", "Read password from environment variable").option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (name, options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const { runAccountsKeystoreUnlock } = await import("./accounts-keystore-runners-MCJIAGZ4.js");
-      await runAccountsKeystoreUnlock({ name });
-      console.log(`
-  \u2713 Access to account '${name}' verified.`);
-      console.log(`  (Note: HardKAS CLI is stateless. Password will be required again for signing operations.)
-`);
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "accounts",
+        command: `hardkas accounts real session-open ${name}`,
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const { runAccountsSessionOpen } = await import("./accounts-keystore-runners-QYSNZMZV.js");
+        await runAccountsSessionOpen({ name, ...options });
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  realAccountsCmd.command("lock <name>").description(`[DEPRECATED] Lock an account ${UI.maturity("internal")}`).action(async (name) => {
+  realAccountsCmd.command("session-close <name>").alias("lock").description(`Clear the local dev signing session marker ${UI.maturity("internal")}`).action(async (name) => {
     console.log(`
   \u2139 Account '${name}' session clear (redundant).`);
     console.log(`    The CLI is already stateless. No secrets are stored in memory between commands.
 `);
   });
-  realAccountsCmd.command("change-password <name>").description("Change password for an encrypted account").action(async (name) => {
+  realAccountsCmd.command("change-password <name>").description(`Change password for an encrypted account ${UI.maturity("stable")}`).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (name, options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const { runAccountsKeystoreChangePassword } = await import("./accounts-keystore-runners-MCJIAGZ4.js");
-      await runAccountsKeystoreChangePassword({ name });
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "accounts",
+        command: `hardkas accounts real change-password ${name}`,
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const { runAccountsKeystoreChangePassword } = await import("./accounts-keystore-runners-QYSNZMZV.js");
+        await runAccountsKeystoreChangePassword({ name });
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  realAccountsCmd.command("generate").description("Generate new real dev account(s) using Kaspa SDK").option("--name <name>", "Base name for account(s)").option("--count <number>", "Number of accounts to generate", "1").option("--network <network>", "Kaspa network (simnet, testnet-10, mainnet)", "simnet").option("--json", "Output as JSON", false).action(async (options) => {
+  realAccountsCmd.command("generate").description(`Generate new real dev account(s) using Kaspa SDK ${UI.maturity("stable")}`).option("--name <name>", "Base name for account(s)").option("--count <number>", "Number of accounts to generate", "1").option("--network <network>", "Kaspa network (simnet, testnet-10, mainnet)", "simnet").option("--password-stdin", "Read keystore password from stdin", false).option("--password-env <env>", "Read keystore password from environment variable").option("--unsafe-plaintext", "Generate accounts in plaintext (legacy/discouraged)", false).option("--yes", "Skip confirmation for unsafe operations", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const result = await runAccountsRealGenerate({
-        ...options.name ? { name: options.name } : {},
-        count: parseInt(options.count, 10),
-        networkId: options.network
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "accounts",
+        command: "hardkas accounts real generate",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const result = await runAccountsRealGenerate({
+          ...options.name ? { name: options.name } : {},
+          count: parseInt(options.count, 10),
+          networkId: options.network,
+          ...options
+        });
+        if (options.json) console.log(JSON.stringify(result.accounts, null, 2));
+        else console.log(result.formatted);
       });
-      if (options.json) console.log(JSON.stringify(result.accounts, null, 2));
-      else console.log(result.formatted);
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  accountsCmd.command("balance <identifier>").description("Show account balance").option("--network <name>", "Network name (simnet, localnet, etc.)").option("--url <rpc-url>", "Explicit RPC URL").option("--json", "Output as JSON", false).action(async (identifier, options) => {
+  accountsCmd.command("balance <identifier>").description(`Show account balance ${UI.maturity("stable")}`).option("--network <name>", "Network name (simnet, localnet, etc.)").option("--url <rpc-url>", "Explicit RPC URL").option("--json", "Output as JSON", false).action(async (identifier, options) => {
     try {
       const result = await runAccountsBalance({ identifier, network: options.network ?? "simnet", url: options.url ?? "" });
       if (options.json) {
@@ -1560,8 +1743,10 @@ Account:  ${result.name}`);
 
 // src/runners/l2-networks-runner.ts
 import { listL2Profiles } from "@hardkas/l2";
+import { loadHardkasConfig as loadHardkasConfig4 } from "@hardkas/config";
 async function runL2Networks(options = {}) {
-  const profiles = listL2Profiles();
+  const loaded = await loadHardkasConfig4();
+  const profiles = listL2Profiles(loaded.config.l2?.networks);
   if (options.json) {
     console.log(JSON.stringify(profiles, null, 2));
     return;
@@ -1572,20 +1757,30 @@ async function runL2Networks(options = {}) {
     console.log("No L2 profiles found.");
     return;
   }
+  console.log(`${"name".padEnd(16)} ${"source".padEnd(14)} ${"type".padEnd(20)} ${"bridge".padEnd(10)} ${"exit"}`);
+  console.log("\u2500".repeat(70));
   for (const p of profiles) {
     const bridge = p.security.bridgePhase;
     const exit = p.security.trustlessExit ? "yes" : "no";
-    console.log(`${p.name.padEnd(8)} ${p.displayName.padEnd(8)} ${p.type.padEnd(18)} gas: ${p.gasToken.padEnd(8)} bridge: ${bridge.padEnd(8)} trustless exit: ${exit}`);
+    const source = p.source;
+    console.log(`${p.name.padEnd(16)} ${source.padEnd(14)} ${p.type.padEnd(20)} ${bridge.padEnd(10)} ${exit}`);
   }
 }
 
 // src/runners/l2-profile-show-runner.ts
-import { getL2Profile } from "@hardkas/l2";
+import { resolveL2Profile } from "@hardkas/l2";
+import { loadHardkasConfig as loadHardkasConfig5 } from "@hardkas/config";
 async function runL2ProfileShow(options) {
-  const profile = getL2Profile(options.name);
-  if (!profile) {
-    throw new Error(`L2 profile '${options.name}' not found.`);
-  }
+  const loaded = await loadHardkasConfig5();
+  const name = options.name || options.network;
+  const profile = resolveL2Profile({
+    name,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {},
+      ...options.chainId !== void 0 ? { chainId: options.chainId } : {}
+    }
+  });
   if (options.json) {
     console.log(JSON.stringify(profile, null, 2));
     return;
@@ -1593,10 +1788,13 @@ async function runL2ProfileShow(options) {
   console.log("L2 profile");
   console.log("");
   console.log(`Name:        ${profile.name}`);
+  console.log(`Source:      ${profile.source}`);
   console.log(`Display:     ${profile.displayName}`);
   console.log(`Type:        ${profile.type}`);
   console.log(`Settlement:  ${profile.settlementLayer === "kaspa" ? "Kaspa L1" : profile.settlementLayer}`);
   console.log(`Execution:   ${profile.executionLayer === "evm" ? "EVM L2" : profile.executionLayer}`);
+  console.log(`Chain ID:    ${profile.chainId || "unknown"}`);
+  console.log(`RPC URL:     ${profile.rpcUrl || "unknown"}`);
   console.log(`Gas token:   ${profile.gasToken}`);
   console.log(`Bridge:      ${profile.security.bridgePhase}`);
   console.log(`Trustless exit: ${profile.security.trustlessExit ? "yes" : "no"}`);
@@ -1611,22 +1809,48 @@ async function runL2ProfileShow(options) {
 }
 
 // src/runners/l2-profile-validate-runner.ts
-import { getL2Profile as getL2Profile2, validateL2Profile } from "@hardkas/l2";
+import { resolveL2Profile as resolveL2Profile2, validateL2Profile, EvmJsonRpcClient } from "@hardkas/l2";
+import { loadHardkasConfig as loadHardkasConfig6 } from "@hardkas/config";
 async function runL2ProfileValidate(options) {
-  const profile = getL2Profile2(options.name);
-  if (!profile) {
-    throw new Error(`L2 profile '${options.name}' not found.`);
-  }
+  const loaded = await loadHardkasConfig6();
+  const name = options.name || options.network;
+  const profile = resolveL2Profile2({
+    name,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {}
+    }
+  });
   const result = validateL2Profile(profile);
+  const errors = [...result.errors];
+  let rpcVerified = false;
+  if (profile.rpcUrl) {
+    try {
+      const client = new EvmJsonRpcClient({ url: profile.rpcUrl });
+      const remoteChainId = await client.getChainId();
+      if (profile.chainId !== void 0 && profile.chainId !== remoteChainId) {
+        errors.push(`Chain ID mismatch: Profile configured for ${profile.chainId} but RPC returned ${remoteChainId}`);
+      } else {
+        rpcVerified = true;
+      }
+    } catch (e) {
+    }
+  }
+  const finalOk = errors.length === 0;
   if (options.json) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify({ ok: finalOk, errors, profile, rpcVerified }, null, 2));
     return;
   }
-  if (result.ok) {
-    console.log(`L2 profile '${options.name}' is VALID.`);
+  if (finalOk) {
+    console.log(`\u2713 L2 profile '${profile.name}' (${profile.source}) is VALID.`);
+    if (rpcVerified) {
+      console.log(`  RPC connectivity verified for chainId ${profile.chainId}`);
+    } else if (profile.rpcUrl) {
+      console.log(`  Note: RPC URL '${profile.rpcUrl}' is configured but currently unreachable.`);
+    }
   } else {
-    console.log(`L2 profile '${options.name}' is INVALID:`);
-    for (const err of result.errors) {
+    console.log(`\u2717 L2 profile '${profile.name}' is INVALID:`);
+    for (const err of errors) {
       console.log(`  - ${err}`);
     }
     process.exit(1);
@@ -1635,13 +1859,14 @@ async function runL2ProfileValidate(options) {
 
 // src/runners/l2-tx-runners.ts
 import fs5 from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 import {
-  getL2Profile as getL2Profile3,
-  EvmJsonRpcClient,
+  resolveL2Profile as resolveL2Profile3,
+  EvmJsonRpcClient as EvmJsonRpcClient2,
   toHexQuantity,
   normalizeEvmTransactionReceipt
 } from "@hardkas/l2";
+import { loadHardkasConfig as loadHardkasConfig7 } from "@hardkas/config";
 import {
   assertValidIgraTxPlanArtifact,
   assertValidIgraSignedTxArtifact,
@@ -1661,16 +1886,20 @@ import {
   resolveRealAccountOrAddress
 } from "@hardkas/accounts";
 async function runL2TxBuild(options) {
-  const networkName = options.network ?? "igra";
-  const profile = getL2Profile3(networkName);
-  if (!profile) {
-    throw new Error(`L2 profile '${networkName}' not found.`);
-  }
-  const rpcUrl = options.url ?? profile.rpcUrl;
+  const loaded = await loadHardkasConfig7();
+  const profile = resolveL2Profile3({
+    name: options.network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {},
+      ...options.chainId !== void 0 ? { chainId: options.chainId } : {}
+    }
+  });
+  const rpcUrl = profile.rpcUrl;
   if (!rpcUrl) {
-    throw new Error(`No L2 RPC URL configured for network '${networkName}'. Pass --url <rpcUrl>.`);
+    throw new Error(`No L2 RPC URL configured for network '${profile.name}'. Pass --url <rpcUrl>.`);
   }
-  const client = new EvmJsonRpcClient({ url: rpcUrl });
+  const client = new EvmJsonRpcClient2({ url: rpcUrl });
   if (options.from) assertEvmAddress(options.from, "from");
   if (!options.to) {
     throw new Error("Missing 'to' address. For this phase, 'to' is required.");
@@ -1729,26 +1958,26 @@ async function runL2TxBuild(options) {
   artifact.contentHash = hash;
   assertValidIgraTxPlanArtifact(artifact);
   const outDir = options.outDir || "plans";
-  const sanitizedDir = path6.normalize(outDir).replace(/^(\.\.[\/\\])+/, "");
+  const sanitizedDir = path7.normalize(outDir).replace(/^(\.\.[\/\\])+/, "");
   await fs5.mkdir(sanitizedDir, { recursive: true });
-  const artifactPath = path6.join(sanitizedDir, `${planId}.igra.plan.json`);
+  const artifactPath = path7.join(sanitizedDir, `${planId}.igra.plan.json`);
   await writeArtifact2(artifactPath, artifact);
   if (options.json) {
     console.log(JSON.stringify({
       networkId: profile.name,
-      l2Network: networkName,
-      chainId,
+      l2Network: profile.name,
+      chainId: profile.chainId,
       planId,
       artifactPath,
       artifact
     }, null, 2));
     return;
   }
-  console.log(`${profile.displayName} L2 transaction plan built`);
+  console.log(`${profile.displayName} L2 transaction plan built (${profile.source})`);
   console.log("");
   console.log(`Plan ID:    ${planId}`);
-  console.log(`Network:    ${networkName}`);
-  console.log(`Chain ID:   ${chainId}`);
+  console.log(`Network:    ${profile.name}`);
+  console.log(`Chain ID:   ${profile.chainId}`);
   console.log(`Mode:       l2-rpc`);
   if (options.from) console.log(`From:       ${options.from}`);
   console.log(`To:         ${options.to}`);
@@ -1843,9 +2072,9 @@ async function runL2TxSign(options) {
   artifact.contentHash = hash;
   assertValidIgraSignedTxArtifact(artifact);
   const outDir = options.outDir || "signed";
-  const sanitizedDir = path6.normalize(outDir).replace(/^(\.\.[\/\\])+/, "");
+  const sanitizedDir = path7.normalize(outDir).replace(/^(\.\.[\/\\])+/, "");
   await fs5.mkdir(sanitizedDir, { recursive: true });
-  const artifactPath = path6.join(sanitizedDir, `${signedId}.igra.signed.json`);
+  const artifactPath = path7.join(sanitizedDir, `${signedId}.igra.signed.json`);
   await writeArtifact2(artifactPath, artifact);
   if (options.json) {
     console.log(JSON.stringify({
@@ -1878,53 +2107,50 @@ async function runL2TxSign(options) {
   console.log("  This is an Igra L2 EVM signed transaction, not a Kaspa L1 UTXO transaction.");
 }
 async function runL2TxSend(options) {
+  const loaded = await loadHardkasConfig7();
   const artifactData = await readArtifact2(options.signedPath);
   assertValidIgraSignedTxArtifact(artifactData);
   const artifact = artifactData;
-  if (artifact.schema !== ARTIFACT_SCHEMAS2.IGRA_SIGNED_TX) {
-    throw new Error(`Invalid signed artifact schema: ${artifact.schema}`);
+  const profile = resolveL2Profile3({
+    name: options.network || artifact.l2Network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {},
+      ...options.chainId !== void 0 ? { chainId: options.chainId } : {}
+    }
+  });
+  const isMainnet = profile.name === "mainnet" || profile.name.includes("mainnet") || artifact.networkId === "mainnet" || artifact.chainId === 1 || profile.chainId === 1;
+  if (isMainnet) {
+    throw new Error("L2 mainnet broadcast is disabled in HardKAS v0.2-alpha.");
   }
-  if (artifact.mode !== "l2-rpc") {
-    throw new Error(`Invalid artifact mode: ${artifact.mode} (expected 'l2-rpc')`);
+  if (!options.yes) {
+    console.log("\n  L2 broadcast cancelled: --yes flag is required for this phase.");
+    process.exit(0);
   }
-  if (artifact.status !== "signed") {
-    throw new Error(`Invalid artifact status: ${artifact.status} (expected 'signed')`);
+  const rpcUrl = options.url ?? profile.rpcUrl;
+  if (!rpcUrl) {
+    throw new Error(`No L2 RPC URL configured for network '${profile.name}'. Pass --url <rpcUrl>.`);
   }
-  if (!options.yes) {
+  const client = new EvmJsonRpcClient2({ url: rpcUrl });
+  const remoteChainId = await client.getChainId();
+  if (profile.chainId !== void 0 && String(remoteChainId) !== String(profile.chainId)) {
     console.log("");
-    console.log("Refusing to submit Igra L2 transaction without --yes.");
+    console.log("Refusing to submit Igra L2 transaction: profile chainId does not match RPC endpoint.");
     console.log("");
-    console.log("Reason:");
-    console.log("  This operation broadcasts a signed L2 transaction.");
+    console.log(`Profile chainId: ${profile.chainId}`);
+    console.log(`RPC chainId:      ${remoteChainId}`);
     console.log("");
-    console.log("Use:");
-    console.log(`  hardkas l2 tx send ${options.signedPath} --yes`);
+    console.log("Suggestion:");
+    console.log("  Check --url and --network.");
     process.exit(1);
   }
-  const networkName = options.network ?? artifact.l2Network ?? "igra";
-  const profile = getL2Profile3(networkName);
-  if (!profile) {
-    throw new Error(`L2 profile '${networkName}' not found.`);
-  }
-  const isMainnet = networkName === "mainnet" || profile.name.includes("mainnet") || artifact.networkId === "mainnet" || artifact.chainId === 1;
-  if (isMainnet) {
-    throw new Error("L2 mainnet broadcast is disabled in HardKAS v0.2-alpha.");
-  }
-  const rpcUrl = options.url ?? profile.rpcUrl;
-  if (!rpcUrl) {
-    throw new Error(`No L2 RPC URL configured for network '${networkName}'. Pass --url <rpcUrl>.`);
-  }
-  const client = new EvmJsonRpcClient({ url: rpcUrl });
-  const remoteChainId = await client.getChainId();
-  if (remoteChainId !== artifact.chainId) {
+  if (String(remoteChainId) !== String(artifact.chainId)) {
     console.log("");
     console.log("Refusing to submit Igra L2 transaction: signed artifact chainId does not match RPC endpoint.");
     console.log("");
     console.log(`Artifact chainId: ${artifact.chainId}`);
     console.log(`RPC chainId:      ${remoteChainId}`);
     console.log("");
-    console.log("Suggestion:");
-    console.log("  Check --url and --network.");
     process.exit(1);
   }
   const txHash = await client.sendRawTransaction(artifact.rawTransaction);
@@ -1943,14 +2169,14 @@ async function runL2TxSend(options) {
     status: "submitted"
   };
   assertValidIgraTxReceiptArtifact(receipt);
-  const receiptDir = path6.join(".hardkas", "l2-receipts");
+  const receiptDir = path7.join(".hardkas", "l2-receipts");
   await fs5.mkdir(receiptDir, { recursive: true });
-  const receiptPath = path6.join(receiptDir, `${txHash}.igra.receipt.json`);
+  const receiptPath = path7.join(receiptDir, `${txHash}.igra.receipt.json`);
   await writeArtifact2(receiptPath, receipt);
   if (options.json) {
     console.log(JSON.stringify({
       networkId: artifact.networkId,
-      l2Network: networkName,
+      l2Network: profile.name,
       chainId: artifact.chainId,
       rpcUrl,
       txHash,
@@ -1963,8 +2189,8 @@ async function runL2TxSend(options) {
   console.log("Igra L2 transaction submitted");
   console.log("");
   console.log(`Tx hash:   ${txHash}`);
-  console.log(`Network:   ${networkName}`);
-  console.log(`Chain ID:  ${artifact.chainId}`);
+  console.log(`Network:   ${profile.name} (${profile.source})`);
+  console.log(`Chain ID:  ${profile.chainId}`);
   console.log(`Mode:      l2-rpc`);
   console.log(`Source:    ${options.signedPath}`);
   console.log(`RPC:       ${rpcUrl}`);
@@ -1974,23 +2200,29 @@ async function runL2TxSend(options) {
   console.log("");
   console.log("Next:");
   console.log("  Check receipt:");
-  console.log(`    hardkas l2 tx receipt ${txHash} --network ${networkName}`);
+  console.log(`    hardkas l2 tx receipt ${txHash} --network ${profile.name}`);
   console.log("");
   console.log("Warning:");
   console.log("  This is an Igra L2 EVM transaction, not a Kaspa L1 UTXO transaction.");
 }
 async function runL2TxReceipt(options) {
+  const loaded = await loadHardkasConfig7();
   let localReceipt;
   try {
     localReceipt = await loadIgraTxReceiptArtifact(options.txHash);
   } catch (e) {
   }
-  const networkName = options.network ?? localReceipt?.l2Network ?? "igra";
-  const profile = getL2Profile3(networkName);
-  const rpcUrl = options.url ?? profile?.rpcUrl;
+  const profile = resolveL2Profile3({
+    name: options.network || localReceipt?.l2Network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {}
+    }
+  });
+  const rpcUrl = profile.rpcUrl;
   let remoteReceipt = null;
   if (rpcUrl) {
-    const client = new EvmJsonRpcClient({ url: rpcUrl });
+    const client = new EvmJsonRpcClient2({ url: rpcUrl });
     const raw = await client.getTransactionReceipt(options.txHash);
     remoteReceipt = normalizeEvmTransactionReceipt(raw);
   }
@@ -2001,7 +2233,7 @@ async function runL2TxReceipt(options) {
   if (options.json) {
     console.log(JSON.stringify({
       networkId: localReceipt?.networkId ?? "igra",
-      l2Network: networkName,
+      l2Network: profile.name,
       chainId: localReceipt?.chainId,
       rpcUrl,
       txHash: options.txHash,
@@ -2014,7 +2246,7 @@ async function runL2TxReceipt(options) {
   console.log("Igra L2 transaction receipt");
   console.log("");
   console.log(`Tx hash:   ${options.txHash}`);
-  console.log(`Network:   ${networkName}`);
+  console.log(`Network:   ${profile.name} (${profile.source})`);
   if (localReceipt) {
     console.log(`Chain ID:  ${localReceipt.chainId}`);
     console.log(`Local:     found`);
@@ -2037,20 +2269,26 @@ async function runL2TxReceipt(options) {
   console.log("  This is an Igra L2 EVM transaction receipt, not a Kaspa L1 transaction.");
 }
 async function runL2TxStatus(options) {
-  const networkName = options.network ?? "igra";
-  const profile = getL2Profile3(networkName);
-  const rpcUrl = options.url ?? profile?.rpcUrl;
+  const loaded = await loadHardkasConfig7();
+  const profile = resolveL2Profile3({
+    name: options.network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {}
+    }
+  });
+  const rpcUrl = profile.rpcUrl;
   if (!rpcUrl) {
-    throw new Error(`No L2 RPC URL configured for network '${networkName}'. Pass --url <rpcUrl>.`);
+    throw new Error(`No L2 RPC URL configured for network '${profile.name}'. Pass --url <rpcUrl>.`);
   }
-  const client = new EvmJsonRpcClient({ url: rpcUrl });
+  const client = new EvmJsonRpcClient2({ url: rpcUrl });
   const raw = await client.getTransactionReceipt(options.txHash);
   const remoteReceipt = normalizeEvmTransactionReceipt(raw);
   const status = remoteReceipt?.status ?? "pending";
   if (options.json) {
     console.log(JSON.stringify({
-      networkId: profile?.name ?? networkName,
-      l2Network: networkName,
+      networkId: profile.name,
+      l2Network: profile.name,
       rpcUrl,
       txHash: options.txHash,
       status,
@@ -2061,7 +2299,7 @@ async function runL2TxStatus(options) {
   console.log("Igra L2 transaction status");
   console.log("");
   console.log(`Tx hash:   ${options.txHash}`);
-  console.log(`Network:   ${networkName}`);
+  console.log(`Network:   ${profile.name} (${profile.source})`);
   console.log(`Status:    ${status}`);
   if (remoteReceipt) {
     console.log(`Block:     ${remoteReceipt.blockNumber ?? "unknown"}`);
@@ -2081,13 +2319,14 @@ function assertHexData(data, field) {
 
 // src/runners/l2-contract-runners.ts
 import fs6 from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 import {
-  getL2Profile as getL2Profile4,
-  EvmJsonRpcClient as EvmJsonRpcClient2,
+  resolveL2Profile as resolveL2Profile4,
+  EvmJsonRpcClient as EvmJsonRpcClient3,
   toHexQuantity as toHexQuantity2,
   encodeConstructorArgs
 } from "@hardkas/l2";
+import { loadHardkasConfig as loadHardkasConfig8 } from "@hardkas/config";
 import {
   assertValidIgraTxPlanArtifact as assertValidIgraTxPlanArtifact2,
   writeArtifact as writeArtifact3,
@@ -2097,16 +2336,19 @@ import {
   calculateContentHash as calculateContentHash2
 } from "@hardkas/artifacts";
 async function runL2ContractDeployPlan(options) {
-  const networkName = options.network ?? "igra";
-  const profile = getL2Profile4(networkName);
-  if (!profile) {
-    throw new Error(`L2 profile '${networkName}' not found.`);
-  }
-  const rpcUrl = options.url ?? profile.rpcUrl;
+  const loaded = await loadHardkasConfig8();
+  const profile = resolveL2Profile4({
+    name: options.network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {}
+    }
+  });
+  const rpcUrl = profile.rpcUrl;
   if (!rpcUrl) {
-    throw new Error(`No L2 RPC URL configured for network '${networkName}'. Pass --url <rpcUrl>.`);
+    throw new Error(`No L2 RPC URL configured for network '${profile.name}'. Pass --url <rpcUrl>.`);
   }
-  const client = new EvmJsonRpcClient2({ url: rpcUrl });
+  const client = new EvmJsonRpcClient3({ url: rpcUrl });
   assertEvmAddress2(options.from, "from");
   if (!options.bytecode || options.bytecode === "0x") {
     throw new Error("Missing or empty bytecode. Provide non-empty 0x-prefixed hex.");
@@ -2168,26 +2410,26 @@ async function runL2ContractDeployPlan(options) {
   artifact.contentHash = hash;
   assertValidIgraTxPlanArtifact2(artifact);
   const outDir = options.outDir || "plans";
-  const sanitizedDir = path7.normalize(outDir).replace(/^(\.\.[\/\\])+/, "");
+  const sanitizedDir = path8.normalize(outDir).replace(/^(\.\.[\/\\])+/, "");
   await fs6.mkdir(sanitizedDir, { recursive: true });
-  const artifactPath = path7.join(sanitizedDir, `${planId}.igra.deploy.plan.json`);
+  const artifactPath = path8.join(sanitizedDir, `${planId}.igra.deploy.plan.json`);
   await writeArtifact3(artifactPath, artifact);
   if (options.json) {
     console.log(JSON.stringify({
       networkId: profile.name,
-      l2Network: networkName,
-      chainId,
+      l2Network: profile.name,
+      chainId: profile.chainId,
       planId,
       artifactPath,
       artifact
     }, null, 2));
     return;
   }
-  console.log(`Igra L2 contract deploy plan built`);
+  console.log(`Igra L2 contract deploy plan built (${profile.source})`);
   console.log("");
   console.log(`Plan ID:    ${planId}`);
-  console.log(`Network:    ${networkName}`);
-  console.log(`Chain ID:   ${chainId}`);
+  console.log(`Network:    ${profile.name}`);
+  console.log(`Chain ID:   ${profile.chainId}`);
   console.log(`Mode:       l2-rpc`);
   console.log(`From:       ${options.from}`);
   console.log(`Type:       contract-deploy`);
@@ -2220,18 +2462,24 @@ function assertHexData2(data, field) {
 }
 
 // src/runners/l2-bridge-runners.ts
-import { getL2BridgeAssumptions } from "@hardkas/l2";
+import { resolveL2Profile as resolveL2Profile5 } from "@hardkas/l2";
+import { HARDKAS_VERSION as HARDKAS_VERSION4 } from "@hardkas/artifacts";
+import { loadHardkasConfig as loadHardkasConfig9 } from "@hardkas/config";
 async function runL2BridgeStatus(options) {
-  const networkName = options.network ?? "igra";
-  const assumptions = getL2BridgeAssumptions(networkName);
-  if (!assumptions) {
-    throw new Error(`No bridge assumptions found for network '${networkName}'.`);
-  }
+  const loaded = await loadHardkasConfig9();
+  const profile = resolveL2Profile5({
+    name: options.network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {}
+    }
+  });
+  const assumptions = mapProfileToAssumptions(profile);
   if (options.json) {
     console.log(JSON.stringify(assumptions, null, 2));
     return;
   }
-  console.log(`${capitalize(networkName)} bridge status`);
+  console.log(`${capitalize(profile.name)} bridge status (${profile.source})`);
   console.log("");
   console.log(`Network:        ${assumptions.l2Network}`);
   console.log(`Bridge phase:   ${assumptions.bridgePhase}`);
@@ -2250,16 +2498,20 @@ async function runL2BridgeStatus(options) {
   }
 }
 async function runL2BridgeAssumptions(options) {
-  const networkName = options.network ?? "igra";
-  const assumptions = getL2BridgeAssumptions(networkName);
-  if (!assumptions) {
-    throw new Error(`No bridge assumptions found for network '${networkName}'.`);
-  }
+  const loaded = await loadHardkasConfig9();
+  const profile = resolveL2Profile5({
+    name: options.network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {}
+    }
+  });
+  const assumptions = mapProfileToAssumptions(profile);
   if (options.json) {
     console.log(JSON.stringify(assumptions, null, 2));
     return;
   }
-  console.log(`${capitalize(networkName)} bridge assumptions`);
+  console.log(`${capitalize(profile.name)} bridge assumptions (${profile.source})`);
   console.log("");
   console.log("Bridge security phases:");
   console.log("  pre-ZK: stronger trust assumptions / non-trustless exit");
@@ -2272,21 +2524,39 @@ async function runL2BridgeAssumptions(options) {
   console.log("Trustless exit:");
   console.log(`  ${assumptions.trustlessExit ? "yes" : "no"}`);
 }
+function mapProfileToAssumptions(profile) {
+  return {
+    schema: "hardkas.l2BridgeAssumptions.v1",
+    hardkasVersion: HARDKAS_VERSION4,
+    l2Network: profile.name,
+    bridgePhase: profile.security.bridgePhase,
+    trustlessExit: profile.security.trustlessExit,
+    custodyModel: profile.security.custodyModel,
+    exitModel: profile.security.bridgePhase === "zk" ? "Trustless exit is available via ZK proofs." : "Trustless exit is available only in the ZK phase.",
+    riskProfile: profile.security.riskProfile,
+    notes: profile.security.notes,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
 function capitalize(s) {
   return s.charAt(0).toUpperCase() + s.slice(1);
 }
 
 // src/runners/l2-rpc-health-runner.ts
-import { getL2Profile as getL2Profile5, checkEvmRpcHealth, waitForEvmRpcReady } from "@hardkas/l2";
+import { resolveL2Profile as resolveL2Profile6, checkEvmRpcHealth, waitForEvmRpcReady } from "@hardkas/l2";
+import { loadHardkasConfig as loadHardkasConfig10 } from "@hardkas/config";
 async function runL2RpcHealth(options) {
-  const networkName = options.network ?? "igra";
-  const profile = getL2Profile5(networkName);
-  if (!profile) {
-    throw new Error(`L2 profile '${networkName}' not found.`);
-  }
-  const rpcUrl = options.url ?? profile.rpcUrl;
+  const loaded = await loadHardkasConfig10();
+  const profile = resolveL2Profile6({
+    name: options.network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {}
+    }
+  });
+  const rpcUrl = profile.rpcUrl;
   if (!rpcUrl) {
-    throw new Error(`No L2 RPC URL configured for network '${networkName}'. Pass --url <rpcUrl>.`);
+    throw new Error(`No L2 RPC URL configured for network '${profile.name}'. Pass --url <rpcUrl>.`);
   }
   const healthOptions = {
     url: rpcUrl,
@@ -2295,63 +2565,78 @@ async function runL2RpcHealth(options) {
     maxWaitMs: (options.timeout ?? 60) * 1e3
   };
   const health = options.wait ? await waitForEvmRpcReady(healthOptions) : await checkEvmRpcHealth(healthOptions);
+  let chainIdMismatch = false;
+  if (health.ready && profile.chainId !== void 0 && health.chainId !== void 0 && String(health.chainId) !== String(profile.chainId)) {
+    chainIdMismatch = true;
+  }
   if (options.json) {
-    console.log(JSON.stringify(health, (key, value) => typeof value === "bigint" ? value.toString() : value, 2));
+    console.log(JSON.stringify({ ...health, chainIdMismatch, profileChainId: profile.chainId }, (key, value) => typeof value === "bigint" ? value.toString() : value, 2));
     return;
   }
-  console.log(`${profile.displayName} L2 RPC health`);
+  console.log(`${profile.displayName} L2 RPC health (${profile.source})`);
   console.log("");
-  console.log(`Network:  ${networkName}`);
+  console.log(`Network:  ${profile.name}`);
   console.log(`URL:      ${health.url}`);
   console.log(`Status:   ${health.ready ? "ready" : "not ready"}`);
   if (health.ready) {
-    console.log(`Chain ID: ${health.chainId}`);
+    console.log(`Chain ID: ${health.chainId} ${chainIdMismatch ? `(CONFLICT! Expected ${profile.chainId})` : ""}`);
     console.log(`Block:    ${health.blockNumber}`);
     console.log(`Gas:      ${health.gasPriceWei} wei`);
     if (health.latencyMs !== void 0) {
       console.log(`Latency:  ${health.latencyMs}ms`);
     }
   }
+  if (chainIdMismatch) {
+    console.log("");
+    console.log("CRITICAL CONFLICT:");
+    console.log(`  The remote RPC reports chain ID ${health.chainId}, but your local profile is configured for ${profile.chainId}.`);
+    console.log("  Ensure you are connecting to the correct network.");
+  }
   if (health.error) {
     console.log(`Error:    ${health.error}`);
   }
   console.log("");
   console.log("Warning:");
   console.log("  This is L2 EVM state, not Kaspa L1 UTXO state.");
-  if (!health.ready) {
+  if (!health.ready || chainIdMismatch) {
     process.exitCode = 1;
   }
 }
 
 // src/runners/l2-account-runners.ts
-import { getL2Profile as getL2Profile6, EvmJsonRpcClient as EvmJsonRpcClient3, formatWeiAsEtherLike } from "@hardkas/l2";
+import { resolveL2Profile as resolveL2Profile7, EvmJsonRpcClient as EvmJsonRpcClient4, formatWeiAsEtherLike } from "@hardkas/l2";
+import { loadHardkasConfig as loadHardkasConfig11 } from "@hardkas/config";
 async function getClient(options) {
-  const networkName = options.network ?? "igra";
-  const profile = getL2Profile6(networkName);
-  if (!profile) {
-    throw new Error(`L2 profile '${networkName}' not found.`);
-  }
-  const rpcUrl = options.url ?? profile.rpcUrl;
+  const loaded = await loadHardkasConfig11();
+  const profile = resolveL2Profile7({
+    name: options.network,
+    userProfiles: loaded.config.l2?.networks,
+    cliOverrides: {
+      ...options.url !== void 0 ? { url: options.url } : {},
+      ...options.chainId !== void 0 ? { chainId: options.chainId } : {}
+    }
+  });
+  const rpcUrl = profile.rpcUrl;
   if (!rpcUrl) {
-    throw new Error(`No L2 RPC URL configured for network '${networkName}'. Pass --url <rpcUrl>.`);
+    throw new Error(`No L2 RPC URL configured for network '${profile.name}'. Pass --url <rpcUrl>.`);
   }
   return {
-    client: new EvmJsonRpcClient3({ url: rpcUrl }),
-    profile,
-    networkName
+    client: new EvmJsonRpcClient4({ url: rpcUrl }),
+    profile
   };
 }
 async function runL2Balance(address, options) {
-  const { client, profile, networkName } = await getClient(options);
+  const { client, profile } = await getClient(options);
   const blockTag = options.block ?? "latest";
   const balanceWei = await client.getBalanceWei(address, blockTag);
   const balanceFormatted = formatWeiAsEtherLike(balanceWei, profile.gasToken, profile.nativeTokenDecimals);
   if (options.json) {
     console.log(JSON.stringify({
       networkId: profile.name,
-      l2Network: networkName,
+      l2Network: profile.name,
       chainId: profile.chainId,
       rpcUrl: profile.rpcUrl,
+      source: profile.source,
       address,
       block: blockTag,
       balanceWei: balanceWei.toString(),
@@ -2360,9 +2645,9 @@ async function runL2Balance(address, options) {
     }, null, 2));
     return;
   }
-  console.log(`${profile.displayName} L2 balance`);
+  console.log(`${profile.displayName} L2 balance (${profile.source})`);
   console.log("");
-  console.log(`Network:  ${networkName}`);
+  console.log(`Network:  ${profile.name}`);
   console.log(`Address:  ${address}`);
   console.log(`Block:    ${blockTag}`);
   console.log(`Balance:  ${balanceFormatted}`);
@@ -2372,24 +2657,25 @@ async function runL2Balance(address, options) {
   console.log("  This is L2 EVM account state, not Kaspa L1 UTXO state.");
 }
 async function runL2Nonce(address, options) {
-  const { client, profile, networkName } = await getClient(options);
+  const { client, profile } = await getClient(options);
   const blockTag = options.block ?? "latest";
   const nonce = await client.getTransactionCount(address, blockTag);
   if (options.json) {
     console.log(JSON.stringify({
       networkId: profile.name,
-      l2Network: networkName,
+      l2Network: profile.name,
       chainId: profile.chainId,
       rpcUrl: profile.rpcUrl,
+      source: profile.source,
       address,
       block: blockTag,
       nonce: nonce.toString()
     }, null, 2));
     return;
   }
-  console.log(`${profile.displayName} L2 nonce`);
+  console.log(`${profile.displayName} L2 nonce (${profile.source})`);
   console.log("");
-  console.log(`Network:  ${networkName}`);
+  console.log(`Network:  ${profile.name}`);
   console.log(`Address:  ${address}`);
   console.log(`Block:    ${blockTag}`);
   console.log(`Nonce:    ${nonce}`);
@@ -2405,14 +2691,14 @@ function registerL2Commands(program) {
     await runL2Networks(options);
   });
   const l2Profile = l2.command("profile").description("L2 profile management");
-  l2Profile.command("show <name>").description("Show L2 profile details").option("--json", "Output results in JSON format").action(async (name, options) => {
+  l2Profile.command("show [name]").description("Show L2 profile details").option("--network <name>", "L2 network name").option("--url <url>", "RPC URL override").option("--chain-id <id>", "Chain ID override").option("--json", "Output results in JSON format").action(async (name, options) => {
     await runL2ProfileShow({ name, ...options });
   });
-  l2Profile.command("validate <name>").description("Validate L2 profile").option("--json", "Output results in JSON format").action(async (name, options) => {
+  l2Profile.command("validate [name]").description("Validate L2 profile").option("--network <name>", "L2 network name").option("--url <url>", "Override RPC URL for validation").option("--json", "Output results in JSON format").action(async (name, options) => {
     await runL2ProfileValidate({ name, ...options });
   });
   const l2tx = l2.command("tx").description("Igra transaction management");
-  l2tx.command("build").description("Build L2 transaction plan").option("--network <name>", "L2 network name", "igra").option("--url <url>", "RPC URL").option("--from <address>", "From address").option("--to <address>", "To address").option("--value <wei>", "Value in wei", "0").option("--data <hex>", "Call data", "0x").option("--json", "Output as JSON").action(async (options) => {
+  l2tx.command("build").description("Build L2 transaction plan").option("--network <name>", "L2 network name").option("--url <url>", "RPC URL override").option("--chain-id <id>", "Chain ID override").option("--from <address>", "From address").option("--to <address>", "To address").option("--value <wei>", "Value in wei", "0").option("--data <hex>", "Call data", "0x").option("--json", "Output as JSON").action(async (options) => {
     try {
       await runL2TxBuild(options);
     } catch (e) {
@@ -2448,7 +2734,7 @@ function registerL2Commands(program) {
     }
   });
   const l2contract = l2.command("contract").description("Igra contract management");
-  l2contract.command("deploy-plan").description("Build L2 contract deployment plan").option("--network <name>", "L2 network name", "igra").option("--bytecode <hex>", "Contract bytecode").option("--constructor <sig>", "Constructor signature").option("--args <csv>", "Constructor arguments").option("--json", "Output as JSON").action(async (options) => {
+  l2contract.command("deploy-plan").description("Build L2 contract deployment plan").option("--network <name>", "L2 network name").option("--url <url>", "RPC URL override").option("--chain-id <id>", "Chain ID override").option("--bytecode <hex>", "Contract bytecode").option("--constructor <sig>", "Constructor signature").option("--args <csv>", "Constructor arguments").option("--json", "Output as JSON").action(async (options) => {
     try {
       await runL2ContractDeployPlan(options);
     } catch (e) {
@@ -2456,7 +2742,7 @@ function registerL2Commands(program) {
     }
   });
   const l2bridge = l2.command("bridge").description("Igra bridge awareness");
-  l2bridge.command("status").description("Show bridge security status").option("--json", "Output as JSON").action(async (options) => {
+  l2bridge.command("status").description("Show bridge security status").option("--network <name>", "L2 network name").option("--url <url>", "RPC URL override").option("--json", "Output as JSON").action(async (options) => {
     try {
       await runL2BridgeStatus(options);
     } catch (e) {
@@ -2471,21 +2757,21 @@ function registerL2Commands(program) {
     }
   });
   const l2rpc = l2.command("rpc").description("Igra RPC diagnostics");
-  l2rpc.command("health").description("Check L2 RPC health").option("--json", "Output as JSON").action(async (options) => {
+  l2rpc.command("health").description("Check L2 RPC health").option("--network <name>", "L2 network name").option("--url <url>", "RPC URL override").option("--json", "Output as JSON").action(async (options) => {
     try {
       await runL2RpcHealth(options);
     } catch (e) {
       handleError(e);
     }
   });
-  l2.command("balance <address>").description("Check Igra L2 balance").option("--json", "Output as JSON").action(async (address, options) => {
+  l2.command("balance <address>").description("Check Igra L2 balance").option("--network <name>", "L2 network name").option("--url <url>", "RPC URL override").option("--chain-id <id>", "Chain ID override").option("--json", "Output as JSON").action(async (address, options) => {
     try {
       await runL2Balance(address, options);
     } catch (e) {
       handleError(e);
     }
   });
-  l2.command("nonce <address>").description("Check Igra L2 nonce").option("--json", "Output as JSON").action(async (address, options) => {
+  l2.command("nonce <address>").description("Check Igra L2 nonce").option("--network <name>", "L2 network name").option("--url <url>", "RPC URL override").option("--chain-id <id>", "Chain ID override").option("--json", "Output as JSON").action(async (address, options) => {
     try {
       await runL2Nonce(address, options);
     } catch (e) {
@@ -2500,20 +2786,19 @@ async function runNodeStart(input) {
   const runner = new DockerKaspadRunner(input);
   const status = await runner.start();
   const lines = [
-    "Kaspa node started",
+    "Kaspa node started successfully",
     "",
-    "Backend:   Docker",
+    `Backend:   Docker`,
     `Image:     ${status.image}`,
     `Container: ${status.containerName}`,
-    `Network:   ${status.network}`,
-    `Status:    ${status.running ? "running" : "stopped"}`,
+    `Status:    \u2713 running`,
     "",
-    "RPC:",
-    `  gRPC:     127.0.0.1:${status.ports.rpc}`,
-    `  Borsh:    127.0.0.1:${status.ports.borshRpc}`,
-    `  JSON RPC: 127.0.0.1:${status.ports.jsonRpc}`,
+    "RPC Readiness:",
+    `  gRPC:     ${status.transports.grpc.ready ? "\u2713 ready" : "\u2717 not ready"} (port ${status.ports.rpc})`,
+    `  Borsh:    ${status.transports.borsh.ready ? "\u2713 ready" : "\u2717 not ready"} (port ${status.ports.borshRpc})`,
+    `  JSON RPC: ${status.transports.json.ready ? "\u2713 ready" : "\u2717 not ready"} (port ${status.ports.jsonRpc})`,
     "",
-    "Data:",
+    "Data Directory:",
     `  ${status.dataDir}`
   ];
   return {
@@ -2530,16 +2815,23 @@ async function runNodeStatus(input) {
   const lines = [
     "Kaspa node status",
     "",
-    "Backend:   Docker",
-    `Container: ${status.containerName}`,
-    `Network:   ${status.network}`,
-    `Status:    ${status.running ? "running" : "stopped"}`,
+    `Backend:   Docker`,
+    `Status:    ${status.running ? "\u2713 running" : "\u2717 stopped"}`,
     "",
-    "RPC:",
-    `  gRPC:     127.0.0.1:${status.ports.rpc}`,
-    `  Borsh:    127.0.0.1:${status.ports.borshRpc}`,
-    `  JSON RPC: 127.0.0.1:${status.ports.jsonRpc}`
+    "RPC Readiness:",
+    `  gRPC:     ${status.transports.grpc.ready ? "\u2713 ready" : "\u2717 not ready"} (port ${status.ports.rpc})`,
+    `  Borsh:    ${status.transports.borsh.ready ? "\u2713 ready" : "\u2717 not ready"} (port ${status.ports.borshRpc})`,
+    `  JSON RPC: ${status.transports.json.ready ? "\u2713 ready" : "\u2717 not ready"} (port ${status.ports.jsonRpc})`,
+    "",
+    "Node Information:",
+    `  Container: ${status.containerName}`,
+    `  Image:     ${status.image}`,
+    `  Network:   ${status.network}`,
+    `  Data Dir:  ${status.dataDir}`
   ];
+  if (status.lastError && !status.rpcReady) {
+    lines.push("", "Last Error:", `  ${status.lastError}`);
+  }
   return {
     status,
     formatted: lines.join("\n")
@@ -2588,54 +2880,124 @@ async function runNodeLogs(input) {
 // src/commands/node.ts
 function registerNodeCommands(program) {
   const nodeCmd = program.command("node").description("Kaspa node management (Docker)");
-  nodeCmd.command("start").description(`Start local node ${UI.maturity("stable")}`).option("--image <image>", "Docker image").action(async (options) => {
+  nodeCmd.command("start").description(`Start local node ${UI.maturity("stable")}`).option("--image <image>", "Docker image").option("--allow-floating-image", "Allow using a floating tag like 'latest' without warning", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const result = await runNodeStart(options);
-      console.log(result.formatted);
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "node",
+        command: "hardkas node start",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        UI.info("Starting Kaspa node (Docker)...");
+        const result = await runNodeStart(options);
+        console.log(result.formatted);
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
     }
   });
-  nodeCmd.command("stop").description(`Stop local node ${UI.maturity("stable")}`).action(async () => {
+  nodeCmd.command("stop").description(`Stop local node ${UI.maturity("stable")}`).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const result = await runNodeStop({});
-      UI.success(`Node stopped (Container: ${result.containerName})`);
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "node",
+        command: "hardkas node stop",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const result = await runNodeStop({});
+        UI.success(`Node stopped (Container: ${result.containerName})`);
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
     }
   });
-  nodeCmd.command("restart").description(`Restart local node ${UI.maturity("stable")}`).action(async () => {
+  nodeCmd.command("restart").description(`Restart local node ${UI.maturity("stable")}`).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const result = await runNodeRestart({});
-      console.log(result.formatted);
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "node",
+        command: "hardkas node restart",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        const result = await runNodeRestart({});
+        console.log(result.formatted);
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
     }
   });
-  nodeCmd.command("reset").description(`Stop node and remove all local chain data ${UI.maturity("preview")}`).option("--start", "Restart the node after reset", false).option("--yes", "Skip confirmation prompt", false).action(async (options) => {
+  nodeCmd.command("reset").description(`Stop node and remove all local chain data ${UI.maturity("preview")}`).option("--start", "Restart the node after reset", false).option("--yes", "Skip confirmation prompt", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      if (!options.yes) {
-        const confirmed = await UI.confirm("This will delete all local chain data. Are you sure?");
-        if (!confirmed) {
-          console.log("  Aborted.");
-          return;
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "node",
+        command: "hardkas node reset",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        if (!options.yes) {
+          const confirmed = await UI.confirm("This will delete all local chain data. Are you sure?");
+          if (!confirmed) {
+            console.log("  Aborted.");
+            return;
+          }
         }
-      }
-      const result = await runNodeReset({ removeData: true });
-      UI.success(result.formatted);
-      if (options.start) {
-        UI.info("Starting node...");
-        const startResult = await runNodeStart({});
-        console.log(startResult.formatted);
-      }
+        const result = await runNodeReset({ removeData: true });
+        UI.success(result.formatted);
+        if (options.start) {
+          UI.info("Starting node...");
+          const startResult = await runNodeStart({});
+          console.log(startResult.formatted);
+        }
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
     }
   });
-  nodeCmd.command("status").description("Check node status").action(async () => {
+  nodeCmd.command("status").description("Check node status").option("--json", "Return status in JSON format", false).action(async (options) => {
     try {
       const result = await runNodeStatus({});
-      console.log(result.formatted);
+      if (options.json) {
+        console.log(JSON.stringify({
+          schema: "hardkas.nodeStatus.v1",
+          docker: {
+            available: true,
+            // If we reached here, docker CLI at least worked in runner
+            daemonReady: result.status.statusText !== "not-found"
+          },
+          container: {
+            exists: result.status.statusText !== "not-found",
+            running: result.status.running,
+            name: result.status.containerName,
+            image: result.status.image
+          },
+          rpc: {
+            url: result.status.rpcUrl,
+            ready: result.status.rpcReady,
+            lastError: result.status.lastError,
+            transports: result.status.transports
+          },
+          ports: [
+            { protocol: "grpc", host: "127.0.0.1", port: result.status.ports.rpc, ready: result.status.transports.grpc.ready },
+            { protocol: "borsh", host: "127.0.0.1", port: result.status.ports.borshRpc, ready: result.status.transports.borsh.ready },
+            { protocol: "json", host: "127.0.0.1", port: result.status.ports.jsonRpc, ready: result.status.transports.json.ready }
+          ],
+          dataDir: result.status.dataDir
+        }, null, 2));
+      } else {
+        console.log(result.formatted);
+      }
     } catch (e) {
       handleError(e);
     }
@@ -2656,9 +3018,9 @@ function registerNodeCommands(program) {
 function registerConfigCommands(program) {
   const configCmd = program.command("config").description("Manage HardKAS configuration");
   configCmd.command("show").description("Show the current HardKAS configuration").option("--config <path>", "Path to config file").option("--json", "Output as JSON", false).action(async (options) => {
-    const { loadHardkasConfig: loadHardkasConfig5 } = await import("@hardkas/config");
+    const { loadHardkasConfig: loadHardkasConfig15 } = await import("@hardkas/config");
     try {
-      const loaded = await loadHardkasConfig5(options.config ? { configPath: options.config } : {});
+      const loaded = await loadHardkasConfig15(options.config ? { configPath: options.config } : {});
       if (options.json) {
         console.log(JSON.stringify(loaded, null, 2));
         return;
@@ -2692,19 +3054,19 @@ import { loadOrCreateLocalnetState as loadOrCreateLocalnetState3 } from "@hardka
 
 // src/runners/example-list-runner.ts
 import fs7 from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 async function runExampleList() {
   UI.box("HardKAS", "Example Registry");
   try {
     let currentDir = process.cwd();
-    let registryPath = path8.join(currentDir, "examples", "registry.json");
+    let registryPath = path9.join(currentDir, "examples", "registry.json");
     for (let i = 0; i < 3; i++) {
       try {
         await fs7.access(registryPath);
         break;
       } catch {
-        currentDir = path8.dirname(currentDir);
-        registryPath = path8.join(currentDir, "examples", "registry.json");
+        currentDir = path9.dirname(currentDir);
+        registryPath = path9.join(currentDir, "examples", "registry.json");
       }
     }
     const data = await fs7.readFile(registryPath, "utf-8");
@@ -2724,19 +3086,19 @@ async function runExampleList() {
 
 // src/runners/example-run-runner.ts
 import fs8 from "fs/promises";
-import path9 from "path";
+import path10 from "path";
 import { spawn } from "child_process";
 async function runExampleRun(id) {
   try {
     let currentDir = process.cwd();
-    let registryPath = path9.join(currentDir, "examples", "registry.json");
+    let registryPath = path10.join(currentDir, "examples", "registry.json");
     for (let i = 0; i < 3; i++) {
       try {
         await fs8.access(registryPath);
         break;
       } catch {
-        currentDir = path9.dirname(currentDir);
-        registryPath = path9.join(currentDir, "examples", "registry.json");
+        currentDir = path10.dirname(currentDir);
+        registryPath = path10.join(currentDir, "examples", "registry.json");
       }
     }
     const data = await fs8.readFile(registryPath, "utf-8");
@@ -2757,10 +3119,10 @@ async function runExampleRun(id) {
       shell: true
       // Required for pnpm/npx on Windows
     });
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       child.on("close", (code) => {
         if (code === 0) {
-          resolve();
+          resolve3();
         } else {
           reject(new Error(`Example execution failed with exit code ${code}`));
         }
@@ -2806,70 +3168,244 @@ function registerMiscCommands(program) {
 }
 
 // src/commands/query.ts
+import pc from "picocolors";
 function registerQueryCommands(program) {
   const queryCmd = program.command("query").description("Query and introspect HardKAS artifacts, lineage, and workflows");
   const artifactsCmd = queryCmd.command("artifacts").description(`Query artifact store ${UI.maturity("stable")}`);
-  const storeCmd = queryCmd.command("store").description(`Manage query store index ${UI.maturity("alpha")}`);
-  storeCmd.command("doctor").description("Integrity and freshness check of the query store index").action(async () => {
+  const storeCmd = queryCmd.command("store").description(`Manage query store index ${UI.maturity("stable")}`);
+  storeCmd.command("doctor").description("Integrity and freshness check of the query store index").option("--migrate", "Apply pending migrations if found", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const engine = await getQueryEngine();
-      const report = await engine.backend.doctor();
-      console.log("\n  \u2550\u2550\u2550 Query Store Doctor \u2550\u2550\u2550\n");
-      console.log(`  Backend:      ${engine.backend.kind()}`);
-      console.log(`  Overall:      ${report.ok ? "\u2713 HEALTHY" : "\u2717 STALE / ISSUES"}`);
-      console.log(`  Last Indexed: ${report.lastIndexedAt || "never"}`);
-      console.log(`  Stale Rows:   ${report.staleArtifacts || 0}`);
-      console.log(`  Zombie Rows:  ${report.zombieArtifacts || 0}`);
-      console.log(`  Orphan Edges: ${report.orphanEdges || 0}`);
-      if (report.corruptedFiles?.length > 0) {
-        console.log("\n  Corrupted Files:");
-        for (const f of report.corruptedFiles) console.log(`    \u2717 ${f}`);
-      }
-      if (!report.ok) {
-        console.log("\n  Recommendation: Run 'hardkas query store rebuild' to fix issues.\n");
+      const action = async () => {
+        const engine = await getQueryEngine();
+        if (options.migrate) {
+          console.log("\n  Checking and applying migrations...");
+          await engine.backend.migrate();
+        }
+        const report = await engine.backend.doctor();
+        console.log("\n  \u2550\u2550\u2550 Query Store Doctor \u2550\u2550\u2550\n");
+        console.log(`  Backend:      ${engine.backend.kind()}`);
+        console.log(`  Overall:      ${report.ok ? pc.green("\u2713 HEALTHY") : pc.red("\u2717 STALE / ISSUES")}`);
+        console.log(`  Last Indexed: ${report.lastIndexedAt || "never"}`);
+        if (report.storeIssues && report.storeIssues.length > 0) {
+          console.log("\n  Store Issues:");
+          for (const issue of report.storeIssues) {
+            const icon = issue.severity === "error" ? pc.red("\u2717") : pc.yellow("\u26A0");
+            console.log(`    ${icon} [${issue.code}] ${issue.message}`);
+            if (issue.suggestion) console.log(`      Suggestion: ${issue.suggestion}`);
+          }
+        }
+        if (report.corruptedFiles?.length > 0) {
+          console.log("\n  Corrupted Files:");
+          for (const f of report.corruptedFiles) console.log(`    ${pc.red("\u2717")} ${f}`);
+        }
+        if (!report.ok) {
+          const cmd = report.storeIssues?.some((i) => i.code.includes("MIGRATION")) ? "migrate" : "rebuild";
+          console.log(`
+  ${UI.warning("Recommendation:")} Run 'hardkas query store ${cmd}' to fix issues.
+`);
+          process.exitCode = 1;
+        } else {
+          console.log("\n  \u2713 Everything looks good.\n");
+        }
+      };
+      if (options.migrate) {
+        await withLock2({
+          rootDir: process.cwd(),
+          name: "query-store",
+          command: "hardkas query store doctor --migrate",
+          wait: options.waitLock,
+          timeoutMs: parseInt(options.lockTimeout)
+        }, action);
       } else {
-        console.log("\n  Everything looks good.\n");
+        await action();
       }
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  storeCmd.command("rebuild").description("Force a complete rebuild of the query store index").action(async () => {
+  storeCmd.command("migrate").description("Apply pending schema migrations to the query store").option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      console.log("\n  Rebuilding query store index...");
-      const engine = await getQueryEngine();
-      const start = Date.now();
-      await engine.backend.rebuild();
-      console.log(`  \u2713 Index rebuilt successfully in ${Date.now() - start}ms.
-`);
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "query-store",
+        command: "hardkas query store migrate",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        console.log("\n  Checking for pending migrations...");
+        const engine = await getQueryEngine();
+        const result = await engine.backend.migrate();
+        if (result.applied > 0) {
+          UI.success(`Applied ${result.applied} migration(s). Store is up to date.`);
+        } else {
+          UI.info("No pending migrations found. Store is already up to date.");
+        }
+        console.log("");
+      });
     } catch (e) {
-      handleError(e);
+      handleLockError2(e);
       process.exitCode = 1;
     }
   });
-  artifactsCmd.command("list").description("List artifacts matching filters").option("--schema <schema>", "Filter by artifact schema (e.g. txPlan, signedTx)").option("--network <network>", "Filter by network ID").option("--mode <mode>", "Filter by mode (simulated/real)").option("--from <address>", "Filter by sender address").option("--to <address>", "Filter by recipient address").option("--sort <field:dir>", "Sort field and direction (e.g. createdAt:desc)").option("--limit <n>", "Max results", "100").option("--json", "Output as deterministic JSON", false).option("--explain [level]", "Attach explain chains (brief|full)").action(async (options) => {
+  storeCmd.command("sync").alias("index").description("Synchronize the filesystem artifacts with the query store index").option("--strict", "Fail on any corrupted data", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
     try {
-      const { createQueryRequest } = await import("@hardkas/query");
-      const engine = await getQueryEngine();
-      const filters = [];
-      if (options.schema) filters.push({ field: "schema", op: "eq", value: `hardkas.${options.schema}` });
-      if (options.network) filters.push({ field: "networkId", op: "eq", value: options.network });
-      if (options.mode) filters.push({ field: "mode", op: "eq", value: options.mode });
-      if (options.from) filters.push({ field: "from.address", op: "eq", value: options.from });
-      if (options.to) filters.push({ field: "to.address", op: "eq", value: options.to });
-      let sort;
-      if (options.sort) {
-        const [field, dir] = options.sort.split(":");
-        sort = { field, direction: dir === "asc" ? "asc" : "desc" };
-      }
-      const request = createQueryRequest({
-        domain: "artifacts",
-        op: "list",
-        filters,
-        sort,
-        limit: parseInt(options.limit, 10),
-        explain: options.explain === true ? "brief" : options.explain || false
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "query-store",
+        command: "hardkas query store sync",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        if (!options.json) console.log("\n  Synchronizing query store index...");
+        const engine = await getQueryEngine();
+        const start = Date.now();
+        const result = await engine.backend.sync({ strict: options.strict });
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          const elapsed = Date.now() - start;
+          console.log(`  \u2713 Index synchronized in ${elapsed}ms.`);
+          console.log(`
+  Artifacts: ${result.artifacts.indexed}/${result.artifacts.scanned} indexed (${result.artifacts.corrupted} corrupted)`);
+          console.log(`  Events:    ${result.events.indexed}/${result.events.scanned} indexed (${result.events.corrupted} corrupted)`);
+          if (result.issues && result.issues.length > 0) {
+            console.log("\n  Issues Found:");
+            for (const issue of result.issues.slice(0, 10)) {
+              console.log(`    ${issue.severity === "error" ? pc.red("\u2717") : pc.yellow("\u26A0")} [${issue.code}] ${issue.message}`);
+              if (issue.path) console.log(`      At: ${issue.path}${issue.lineNumber ? ":" + issue.lineNumber : ""}`);
+            }
+            if (result.issues.length > 10) console.log(`    ... and ${result.issues.length - 10} more.`);
+          }
+          if (!result.ok) {
+            console.log(`
+  ${UI.error("Synchronization encountered corruption.")} Use --strict for fail-fast behavior.`);
+            process.exitCode = 1;
+          }
+          console.log("");
+        }
+      });
+    } catch (e) {
+      handleLockError2(e);
+      process.exitCode = 1;
+    }
+  });
+  storeCmd.command("rebuild").description("Force a complete rebuild of the query store index").option("--strict", "Fail on any corrupted data", false).option("--wait-lock", "Wait for workspace lock if held", false).option("--lock-timeout <ms>", "Lock wait timeout in ms", "30000").option("--json", "Output as JSON", false).action(async (options) => {
+    const { withLock: withLock2 } = await import("@hardkas/core");
+    const { handleLockError: handleLockError2 } = await import("./ui-SUYOHGGP.js");
+    try {
+      await withLock2({
+        rootDir: process.cwd(),
+        name: "query-store",
+        command: "hardkas query store rebuild",
+        wait: options.waitLock,
+        timeoutMs: parseInt(options.lockTimeout)
+      }, async () => {
+        if (!options.json) console.log("\n  Rebuilding query store index...");
+        const engine = await getQueryEngine();
+        const start = Date.now();
+        const result = await engine.backend.rebuild({ strict: options.strict });
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          const elapsed = Date.now() - start;
+          console.log(`  \u2713 Index rebuilt successfully in ${elapsed}ms.`);
+          console.log(`
+  Artifacts: ${result.artifacts.indexed}/${result.artifacts.scanned} indexed (${result.artifacts.corrupted} corrupted)`);
+          console.log(`  Events:    ${result.events.indexed}/${result.events.scanned} indexed (${result.events.corrupted} corrupted)`);
+          if (result.issues && result.issues.length > 0) {
+            console.log("\n  Corruption Issues:");
+            for (const issue of result.issues.slice(0, 10)) {
+              console.log(`    ${issue.severity === "error" ? pc.red("\u2717") : pc.yellow("\u26A0")} [${issue.code}] ${issue.message}`);
+              if (issue.path) console.log(`      At: ${issue.path}${issue.lineNumber ? ":" + issue.lineNumber : ""}`);
+            }
+            if (result.issues.length > 10) console.log(`    ... and ${result.issues.length - 10} more.`);
+          }
+          if (!result.ok) {
+            console.log(`
+  ${UI.error("Rebuild failed or encountered corruption.")} Use --strict for fail-fast behavior.`);
+            process.exitCode = 1;
+          }
+          console.log("");
+        }
+      });
+    } catch (e) {
+      handleLockError2(e);
+      process.exitCode = 1;
+    }
+  });
+  storeCmd.command("sql <query>").description("Run a raw SQL query against the query store").option("--json", "Output as JSON", false).action(async (query, options) => {
+    try {
+      const engine = await getQueryEngine();
+      if (typeof engine.backend.executeRawSql !== "function") {
+        throw new Error("Raw SQL execution not supported by current backend");
+      }
+      const result = await engine.backend.executeRawSql(query);
+      if (options.json) {
+        console.log(JSON.stringify(result, null, 2));
+      } else {
+        if (result.length === 0) {
+          console.log("\n  No results.\n");
+        } else {
+          console.table(result);
+        }
+      }
+    } catch (e) {
+      handleError(e);
+      process.exitCode = 1;
+    }
+  });
+  storeCmd.command("export").description("Export logical store state to JSON").option("--output <path>", "Output file path").action(async (options) => {
+    try {
+      const { HardkasStore } = await import("@hardkas/query-store");
+      const store = new HardkasStore();
+      store.connect({ autoMigrate: true });
+      const db = store.getDatabase();
+      const artifacts = db.prepare("SELECT * FROM artifacts ORDER BY artifact_id ASC").all();
+      const events = db.prepare("SELECT * FROM events ORDER BY event_id ASC").all();
+      const dump = { artifacts, events };
+      const json = JSON.stringify(dump, null, 2);
+      if (options.output) {
+        const fs12 = await import("fs");
+        fs12.writeFileSync(options.output, json);
+        UI.success(`Store exported to ${options.output}`);
+      } else {
+        console.log(json);
+      }
+      store.disconnect();
+    } catch (e) {
+      handleError(e);
+      process.exitCode = 1;
+    }
+  });
+  artifactsCmd.command("list").description("List artifacts matching filters").option("--schema <schema>", "Filter by artifact schema (e.g. txPlan, signedTx)").option("--network <network>", "Filter by network ID").option("--mode <mode>", "Filter by mode (simulated/real)").option("--from <address>", "Filter by sender address").option("--to <address>", "Filter by recipient address").option("--sort <field:dir>", "Sort field and direction (e.g. createdAt:desc)").option("--limit <n>", "Max results", "100").option("--json", "Output as deterministic JSON", false).option("--explain [level]", "Attach explain chains (brief|full)").action(async (options) => {
+    try {
+      const { createQueryRequest } = await import("@hardkas/query");
+      const engine = await getQueryEngine();
+      const filters = [];
+      if (options.schema) filters.push({ field: "schema", op: "eq", value: `hardkas.${options.schema}` });
+      if (options.network) filters.push({ field: "networkId", op: "eq", value: options.network });
+      if (options.mode) filters.push({ field: "mode", op: "eq", value: options.mode });
+      if (options.from) filters.push({ field: "from.address", op: "eq", value: options.from });
+      if (options.to) filters.push({ field: "to.address", op: "eq", value: options.to });
+      let sort;
+      if (options.sort) {
+        const [field, dir] = options.sort.split(":");
+        sort = { field, direction: dir === "asc" ? "asc" : "desc" };
+      }
+      const request = createQueryRequest({
+        domain: "artifacts",
+        op: "list",
+        filters,
+        sort,
+        limit: parseInt(options.limit, 10),
+        explain: options.explain === true ? "brief" : options.explain || false
       });
       const result = await engine.execute(request);
       if (options.json) {
@@ -2926,7 +3462,7 @@ function registerQueryCommands(program) {
       process.exitCode = 1;
     }
   });
-  const lineageCmd = queryCmd.command("lineage").description(`Traverse artifact lineage ${UI.maturity("preview")}`);
+  const lineageCmd = queryCmd.command("lineage").description(`Traverse artifact lineage ${UI.maturity("stable")}`);
   lineageCmd.command("chain <anchor>").description("Reconstruct lineage chain from an artifact (contentHash or artifactId)").option("--direction <dir>", "Traversal direction: ancestors or descendants", "ancestors").option("--json", "Output as JSON", false).option("--explain [level]", "Attach explain chains (brief|full)").option("--why", "Shorthand for --explain full").action(async (anchor, options) => {
     try {
       const { createQueryRequest } = await import("@hardkas/query");
@@ -2994,7 +3530,7 @@ function registerQueryCommands(program) {
       process.exitCode = 1;
     }
   });
-  const replayCmd = queryCmd.command("replay").description(`Inspect replay history and divergence ${UI.maturity("preview")}`);
+  const replayCmd = queryCmd.command("replay").description(`Inspect replay history and divergence ${UI.maturity("stable")}`);
   replayCmd.command("list").description("List all stored receipts").option("--status <status>", "Filter by status").option("--json", "Output as JSON", false).option("--limit <n>", "Max results", "100").action(async (options) => {
     try {
       const { createQueryRequest } = await import("@hardkas/query");
@@ -3627,14 +4163,17 @@ async function runTest(options) {
 
 // src/commands/test.ts
 function registerTestCommands(program) {
-  program.command("test [files...]").description(`Run HardKAS tests against localnet ${UI.maturity("stable")}`).option("--network <network>", "Network to test against", "simnet").option("--watch", "Watch for changes", false).option("--json", "Output results as JSON", false).option("--reporter <reporter>", "Reporter to use", "default").action(async (files, options) => {
+  program.command("test [files...]").description(`Run HardKAS tests against localnet ${UI.maturity("stable")}`).option("--network <network>", "Network to test against", "simnet").option("--watch", "Watch for changes", false).option("--json", "Output results as JSON", false).option("--mass-report", "Show mass/fee report after test run", false).option("--mass-snapshot <label>", "Save mass snapshot for regression detection").option("--mass-compare <label>", "Compare against saved mass snapshot").action(async (files, options) => {
     try {
       await runTest({
         files,
         network: options.network,
         watch: options.watch,
         json: options.json,
-        reporter: options.reporter
+        reporter: options.reporter,
+        massReport: options.massReport,
+        ...options.massSnapshot ? { massSnapshot: options.massSnapshot } : {},
+        ...options.massCompare ? { massCompare: options.massCompare } : {}
       });
     } catch (e) {
       handleError(e, "Test execution failed");
@@ -3645,93 +4184,292 @@ function registerTestCommands(program) {
 
 // src/commands/doctor.ts
 import os from "os";
-import path10 from "path";
+import path11 from "path";
 import fs9 from "fs/promises";
-import pc from "picocolors";
-import { loadHardkasConfig as loadHardkasConfig4 } from "@hardkas/config";
-import { JsonWrpcKaspaClient as JsonWrpcKaspaClient4 } from "@hardkas/kaspa-rpc";
-import { HardkasStore } from "@hardkas/query-store";
+import pc2 from "picocolors";
+import { DockerKaspadRunner as DockerKaspadRunner7 } from "@hardkas/node-runner";
+import { execa } from "execa";
 function registerDoctorCommand(program) {
-  program.command("doctor").description("Perform a full system diagnostic and health report").action(async () => {
+  program.command("doctor").description(`Perform a full system diagnostic and health report ${UI.maturity("stable")}`).option("--json", "Output results as stable JSON schema", false).action(async (opts) => {
     try {
-      await runDoctor();
+      await runDoctor(opts);
     } catch (err) {
       handleError(err);
     }
   });
 }
-async function runDoctor() {
-  UI.box("HardKAS System Doctor", "Operational Health Check");
-  UI.header("Environment Status");
-  UI.field("OS", `${os.type()} ${os.release()} (${os.arch()})`);
-  UI.field("Node", process.version);
-  UI.field("CWD", process.cwd());
-  UI.divider();
-  UI.header("Configuration Analysis");
-  try {
-    const loaded = await loadHardkasConfig4({ cwd: process.cwd() });
-    UI.success(`Config found: ${pc.cyan(path10.basename(loaded.path || "unknown"))}`);
-    UI.field("Default Network", loaded.config.defaultNetwork || "simnet");
-  } catch (e) {
-    UI.error("Configuration issues detected", e.message);
+async function runDoctor(opts) {
+  const report = {
+    version: "0.2.2-alpha.1",
+    // In real world, get this from constants
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    checks: [],
+    summary: { total: 0, passed: 0, failed: 0, warnings: 0, skipped: 0 }
+  };
+  if (!opts.json) {
+    UI.box("HardKAS System Doctor", "Operational Health Check");
+  }
+  const addCheck = (check) => {
+    report.checks.push(check);
+    report.summary.total++;
+    if (check.status === "pass") report.summary.passed++;
+    else if (check.status === "fail") report.summary.failed++;
+    else if (check.status === "warn") report.summary.warnings++;
+    else if (check.status === "skip") report.summary.skipped++;
+    if (!opts.json) {
+      let icon = pc2.green("\u2705");
+      if (check.status === "fail") icon = pc2.red("\u274C");
+      if (check.status === "warn") icon = pc2.yellow("\u26A0\uFE0F");
+      if (check.status === "skip") icon = pc2.gray("\u23ED\uFE0F");
+      console.log(`  ${icon} ${pc2.bold(check.name)}: ${check.message}`);
+      if (check.suggestion && check.status !== "pass") {
+        console.log(`     ${pc2.dim("Suggestion: " + check.suggestion)}`);
+      }
+    }
+  };
+  const nodeVer = process.version;
+  const nodeMajor = parseInt(nodeVer.slice(1).split(".")[0]);
+  if (nodeMajor >= 18) {
+    addCheck({
+      name: "Node.js version",
+      category: "runtime",
+      status: "pass",
+      message: `${nodeVer} (>= 18 required)`
+    });
+  } else {
+    addCheck({
+      name: "Node.js version",
+      category: "runtime",
+      status: "fail",
+      message: `${nodeVer} (>= 18 required)`,
+      suggestion: "Upgrade Node.js to v18 or higher."
+    });
   }
-  UI.divider();
-  UI.header("RPC Connectivity & Health");
   try {
-    const loaded = await loadHardkasConfig4({ cwd: process.cwd() });
-    const networkId = loaded.config.defaultNetwork || "simnet";
-    const target = loaded.config.networks?.[networkId];
-    let rpcUrl = "ws://127.0.0.1:18210";
-    if (target?.rpcUrl) rpcUrl = target.rpcUrl;
-    UI.info(`Connecting to ${pc.cyan(rpcUrl)}...`);
-    const rpc = new JsonWrpcKaspaClient4({ rpcUrl });
-    const info = await rpc.getInfo();
-    UI.success(`RPC Alive: ${pc.bold(info.networkId || "active")}`);
-    UI.field("Synced", info.isSynced ? pc.green("YES") : pc.yellow("NO"));
-    if (info.serverVersion) UI.field("Version", info.serverVersion);
-  } catch (e) {
-    UI.error("RPC Connection Failed", "Is the localnet or node running? Check your network config.");
+    const { stdout } = await execa("pnpm", ["-v"]);
+    addCheck({
+      name: "pnpm",
+      category: "runtime",
+      status: "pass",
+      message: `v${stdout.trim()}`
+    });
+  } catch {
+    addCheck({
+      name: "pnpm",
+      category: "runtime",
+      status: "fail",
+      message: "Not found in PATH",
+      suggestion: "Install pnpm (npm install -g pnpm)."
+    });
   }
-  UI.divider();
-  UI.header("Artifact Store Integrity");
-  const hardkasDir = path10.join(process.cwd(), ".hardkas");
+  const hardkasDir = path11.join(process.cwd(), ".hardkas");
+  let dirExists = false;
   try {
     const stats = await fs9.stat(hardkasDir);
-    if (stats.isDirectory()) {
+    dirExists = stats.isDirectory();
+    addCheck({
+      name: ".hardkas/ directory",
+      category: "persistence",
+      status: "pass",
+      message: "Exists and is active"
+    });
+  } catch {
+    addCheck({
+      name: ".hardkas/ directory",
+      category: "persistence",
+      status: "fail",
+      message: "Not found",
+      suggestion: "Run 'hardkas init' to initialize project."
+    });
+  }
+  if (dirExists) {
+    try {
+      const gitignorePath = path11.join(process.cwd(), ".gitignore");
+      const gitignore = await fs9.readFile(gitignorePath, "utf-8");
+      if (gitignore.includes(".hardkas")) {
+        addCheck({
+          name: ".gitignore protection",
+          category: "persistence",
+          status: "pass",
+          message: "Contains .hardkas/"
+        });
+      } else {
+        addCheck({
+          name: ".gitignore protection",
+          category: "persistence",
+          status: "warn",
+          message: "Does not contain .hardkas/",
+          suggestion: "Add '.hardkas/' to your .gitignore to avoid committing artifacts."
+        });
+      }
+    } catch {
+      addCheck({
+        name: ".gitignore protection",
+        category: "persistence",
+        status: "skip",
+        message: ".gitignore not found"
+      });
+    }
+    const dbPath = path11.join(hardkasDir, "store.db");
+    try {
+      await fs9.access(dbPath);
+      addCheck({
+        name: "store.db accessibility",
+        category: "persistence",
+        status: "pass",
+        message: "File exists and is accessible"
+      });
+    } catch {
+      addCheck({
+        name: "store.db accessibility",
+        category: "persistence",
+        status: "warn",
+        message: "store.db not found",
+        suggestion: "Run 'hardkas query store rebuild' to populate the index."
+      });
+    }
+    try {
       const files = await fs9.readdir(hardkasDir);
-      const artifacts = files.filter((f) => f.endsWith(".json") && !f.endsWith(".enc.json"));
-      UI.success(`Artifact directory .hardkas/ is active`);
-      UI.field("Cached Artifacts", artifacts.length);
-      const hasEvents = files.includes("events.jsonl");
-      if (hasEvents) {
-        UI.success("Observability event log (events.jsonl) is present");
+      const locks = files.filter((f) => f.endsWith(".lock"));
+      if (locks.length === 0) {
+        addCheck({
+          name: "Workspace locks",
+          category: "persistence",
+          status: "pass",
+          message: "No active or stale locks found"
+        });
       } else {
-        UI.warning("Event log missing. Operational queries may be limited.");
+        addCheck({
+          name: "Workspace locks",
+          category: "persistence",
+          status: "warn",
+          message: `${locks.length} lock(s) found`,
+          suggestion: "Use 'hardkas lock doctor' to diagnose if they are stale."
+        });
+      }
+    } catch {
+    }
+  }
+  const keystoreDir = path11.join(hardkasDir, "keystore");
+  try {
+    const stats = await fs9.stat(keystoreDir);
+    if (stats.isDirectory()) {
+      const files = await fs9.readdir(keystoreDir);
+      let allOk = true;
+      for (const file of files) {
+        const filePath = path11.join(keystoreDir, file);
+        const fstats = await fs9.stat(filePath);
+        if (os.platform() !== "win32") {
+          const mode = fstats.mode & 511;
+          if (mode !== 384) allOk = false;
+        }
+      }
+      if (allOk) {
+        addCheck({
+          name: "Keystore permissions",
+          category: "security",
+          status: "pass",
+          message: "0600 permissions enforced"
+        });
+      } else {
+        addCheck({
+          name: "Keystore permissions",
+          category: "security",
+          status: "warn",
+          message: "Relaxed permissions detected",
+          suggestion: "Ensure .hardkas/keystore/* files are chmod 600."
+        });
       }
     }
   } catch {
-    UI.error("Artifact Store not initialized", "Run 'hardkas init' to create a project.");
+    addCheck({
+      name: "Keystore permissions",
+      category: "security",
+      status: "pass",
+      message: "No keystore found (nothing to secure)"
+    });
   }
-  UI.divider();
-  UI.header("Query Store (SQLite) Status");
-  const dbPath = path10.join(hardkasDir, "store.db");
+  if (dirExists) {
+    try {
+      const files = await fs9.readdir(hardkasDir);
+      const accountsJson = files.find((f) => f.includes("accounts") && f.endsWith(".json"));
+      if (accountsJson) {
+        const content = await fs9.readFile(path11.join(hardkasDir, accountsJson), "utf-8");
+        if (content.includes("privateKey") && !content.includes("encrypted")) {
+          addCheck({
+            name: "Plaintext keys check",
+            category: "security",
+            status: "fail",
+            message: "Plaintext private keys detected in artifacts!",
+            suggestion: "Use encrypted accounts and avoid --unsafe-plaintext."
+          });
+        } else {
+          addCheck({
+            name: "Plaintext keys check",
+            category: "security",
+            status: "pass",
+            message: "No plaintext keys found in account artifacts"
+          });
+        }
+      }
+    } catch {
+    }
+  }
+  let dockerDaemonOk = false;
   try {
-    const store = new HardkasStore({ dbPath });
-    store.connect();
-    const db = store.getDatabase();
-    const artCount = db.prepare("SELECT COUNT(*) as count FROM artifacts").get().count;
-    const eventCount = db.prepare("SELECT COUNT(*) as count FROM events").get().count;
-    UI.success("Relational index (store.db) is healthy");
-    UI.field("Indexed Artifacts", artCount);
-    UI.field("Indexed Events", eventCount);
-    if (artCount === 0 && eventCount === 0) {
-      UI.warning("Database is empty. Run 'hardkas query store rebuild' to populate.");
-    }
-    store.disconnect();
-  } catch (e) {
-    UI.error("Query Store Issues", "The SQLite database might be corrupt or inaccessible. Run 'hardkas query store rebuild' to repair.");
+    await execa("docker", ["info"]);
+    dockerDaemonOk = true;
+    addCheck({
+      name: "Docker daemon",
+      category: "docker",
+      status: "pass",
+      message: "Reachable"
+    });
+  } catch {
+    addCheck({
+      name: "Docker daemon",
+      category: "docker",
+      status: "fail",
+      message: "Not reachable",
+      suggestion: "Ensure Docker is running."
+    });
+  }
+  if (dockerDaemonOk) {
+    try {
+      const runner = new DockerKaspadRunner7();
+      const status = await runner.status();
+      addCheck({
+        name: "kaspad image",
+        category: "docker",
+        status: "pass",
+        message: status.image || "unknown"
+      });
+      if (status.running) {
+        addCheck({
+          name: "Local node RPC",
+          category: "network",
+          status: status.rpcReady ? "pass" : "fail",
+          message: status.rpcReady ? "Ready" : "Not Ready",
+          suggestion: !status.rpcReady ? "Check node logs: hardkas node logs" : void 0
+        });
+      } else {
+        addCheck({
+          name: "Local node RPC",
+          category: "network",
+          status: "skip",
+          message: "Node is not running"
+        });
+      }
+    } catch {
+    }
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    UI.divider();
+    console.log(`  Summary: ${report.summary.passed} passed, ${report.summary.failed} failed, ${report.summary.warnings} warning, ${report.summary.skipped} skipped`);
+    UI.footer("Use 'hardkas capabilities' to see supported features.");
   }
-  UI.footer("Use 'hardkas query' for deep operational introspection.");
 }
 
 // src/commands/faucet.ts
@@ -3748,18 +4486,708 @@ function registerFaucetCommand(program) {
   });
 }
 
-// src/index.ts
+// src/runners/script-runner.ts
+import { resolve } from "path";
+import { existsSync, unlinkSync } from "fs";
+import { execSync } from "child_process";
+import { loadHardkasConfig as loadHardkasConfig12 } from "@hardkas/config";
+async function runScript(script, opts) {
+  const scriptPath = resolve(script);
+  if (!existsSync(scriptPath)) {
+    console.error(`Script not found: ${scriptPath}`);
+    process.exit(1);
+  }
+  const { config } = await loadHardkasConfig12();
+  const netConfig = config.networks?.[opts.network] || { kind: "simulated" };
+  const isSimulated = netConfig.kind === "simulated";
+  let injectionCode = "";
+  if (opts.harness) {
+    if (isSimulated) {
+      injectionCode = `
+import { createTestHarness } from "@hardkas/testing/harness";
+const hardkas = createTestHarness({
+  accounts: ${parseInt(opts.accounts)},
+  initialBalance: ${opts.balance}n,
+  networkId: "${opts.network}",
+});
+(globalThis as any).hardkas = hardkas;
+`;
+    } else {
+      const rpcUrl = netConfig.rpcUrl;
+      const networkId = netConfig.network || opts.network;
+      injectionCode = `
+import { KaspaRpcClient } from "@hardkas/kaspa-rpc";
+const rpc = new KaspaRpcClient({ url: "${rpcUrl}" });
+(globalThis as any).hardkas = {
+  network: "${opts.network}",
+  networkId: "${networkId}",
+  rpcUrl: "${rpcUrl}",
+  rpc: rpc
+};
+`;
+    }
+  }
+  const wrapperCode = `
+${injectionCode}
+(async () => {
+  try {
+    await import("file://${scriptPath.replace(/\\/g, "/")}");
+  } catch (err) {
+    console.error(err);
+    process.exit(1);
+  }
+})();
+`;
+  const dotHardkas = resolve(process.cwd(), ".hardkas");
+  if (!existsSync(dotHardkas)) {
+    const { mkdirSync } = await import("fs");
+    mkdirSync(dotHardkas, { recursive: true });
+  }
+  const tempWrapper = resolve(dotHardkas, `run-${Date.now()}.mts`);
+  const { writeFileAtomicSync } = await import("@hardkas/core");
+  writeFileAtomicSync(tempWrapper, wrapperCode);
+  try {
+    const tsxBin = resolve("node_modules/.bin/tsx");
+    const actualTsx = existsSync(tsxBin) ? tsxBin : "npx tsx";
+    execSync(`${actualTsx} ${tempWrapper}`, {
+      stdio: "inherit",
+      cwd: process.cwd(),
+      env: {
+        ...process.env,
+        HARDKAS_NETWORK: opts.network,
+        HARDKAS_ACCOUNTS: opts.accounts,
+        HARDKAS_BALANCE: opts.balance
+      }
+    });
+  } finally {
+    if (existsSync(tempWrapper)) {
+      unlinkSync(tempWrapper);
+    }
+  }
+}
+
+// src/commands/run.ts
+function registerRunCommand(program) {
+  program.command("run <script>").description(`Execute a TypeScript or JavaScript file with HardKAS SDK injected ${UI.maturity("stable")}`).option("--network <name>", "Network name", "simnet").option("--accounts <n>", "Number of simulated accounts", "3").option("--balance <sompi>", "Initial balance per account in sompi", "100000000000").option("--no-harness", "Skip automatic harness creation").action(async (script, opts) => {
+    await runScript(script, opts);
+  });
+}
+
+// src/commands/capabilities.ts
+import pc3 from "picocolors";
+import { HARDKAS_VERSION as HARDKAS_VERSION5, CURRENT_HASH_VERSION } from "@hardkas/artifacts";
+function registerCapabilitiesCommand(program) {
+  program.command("capabilities").description("Show HardKAS capabilities and maturity level").option("--json", "Output as stable JSON schema", false).action(async (opts) => {
+    const caps = {
+      version: HARDKAS_VERSION5,
+      maturity: "hardened-alpha",
+      proofVersion: "repro-v0",
+      hashVersion: CURRENT_HASH_VERSION,
+      capabilities: {
+        artifacts: true,
+        lineageVerification: true,
+        deterministicHashing: true,
+        atomicPersistence: true,
+        workspaceLocks: true,
+        corruptionDetection: true,
+        secretRedaction: true,
+        mainnetGuards: true,
+        localnetSimulation: true,
+        ghostdagSimulation: true,
+        dagConflictResolution: true,
+        massProfiler: true,
+        simulationScenarios: true,
+        queryStore: true,
+        replayVerification: true,
+        schemaMigrations: true,
+        dockerNode: true,
+        scriptRunner: true,
+        testingFramework: true,
+        l2Profiles: true,
+        l2BridgeAssumptions: true,
+        consensusValidation: false,
+        productionWallet: false,
+        silverScript: false,
+        covenants: false,
+        trustlessExit: false,
+        differentialDagValidation: false
+      },
+      trustBoundaries: {
+        replay: "local-workflow-only",
+        artifacts: "internal-integrity-only",
+        simulator: "research-experimental",
+        queryStore: "rebuildable-read-model",
+        l2Bridge: "pre-zk-assumptions"
+      }
+    };
+    if (opts.json) {
+      console.log(JSON.stringify(caps, null, 2));
+    } else {
+      renderHumanReadable(caps);
+    }
+  });
+}
+function renderHumanReadable(caps) {
+  console.log(`${pc3.bold("HardKAS")} ${pc3.cyan("v" + caps.version)} \u2014 ${pc3.green("Hardened Alpha")}
+`);
+  const printGroup = (title, items) => {
+    console.log(`  ${pc3.bold(title)}`);
+    for (const [name, desc, enabled] of items) {
+      const icon = enabled ? pc3.green("\u2705") : pc3.red("\u274C");
+      const label = enabled ? pc3.white(name.padEnd(16)) : pc3.dim(name.padEnd(16));
+      console.log(`    ${icon} ${label} ${pc3.dim(desc)}`);
+    }
+    console.log("");
+  };
+  printGroup("Core", [
+    ["Artifacts", "Canonical hashing v3 (NFC + newline normalization)", true],
+    ["Lineage", "Contamination detection, monotonic sequences", true],
+    ["Determinism", "Reproducibility proof v0 (cross-platform CI)", true],
+    ["Atomic writes", "Temp-file-and-rename with fsync", true],
+    ["Workspace locks", "O_EXCL + PID liveness + deadlock ordering", true],
+    ["Corruption", "27 machine-readable issue codes", true],
+    ["Secret redaction", "All error paths masked", true],
+    ["Mainnet guards", "Hard refusal without --allow-mainnet-signing", true]
+  ]);
+  printGroup("Simulation", [
+    ["Localnet", "Simulated UTXO state + transactions", true],
+    ["GHOSTDAG", "Approximate engine (RESEARCH_EXPERIMENTAL)", true],
+    ["DAG conflicts", "GHOSTDAG-aligned blue/red ordering", true],
+    ["Mass profiler", "Regression detection + snapshots", true],
+    ["Scenarios", "Linear, wide, fork, diamond", true]
+  ]);
+  printGroup("Query & Replay", [
+    ["Query store", "SQLite with forward-only migrations", true],
+    ["Replay", "Local workflow verification", true],
+    ["Migrations", "Checksummed, transactional", true]
+  ]);
+  printGroup("Infrastructure", [
+    ["Docker node", "Pinned kaspad image on simnet", true],
+    ["Script runner", "hardkas run script.ts via tsx", true],
+    ["Testing", "Harness + 11 semantic matchers", true]
+  ]);
+  printGroup("L2", [
+    ["Igra profiles", "Built-in + user config registry", true],
+    ["Bridge model", "Pre-ZK phase awareness", true]
+  ]);
+  printGroup("Not Yet Implemented", [
+    ["Consensus validation", "", false],
+    ["Production wallet", "", false],
+    ["SilverScript / covenants", "", false],
+    ["Trustless exit", "(requires ZK bridge)", false],
+    ["Differential DAG validation", "", false]
+  ]);
+  console.log(`  ${pc3.bold("Trust Boundaries")}`);
+  console.log(`    Replay:      ${pc3.dim(caps.trustBoundaries.replay.replace(/-/g, " "))}`);
+  console.log(`    Artifacts:   ${pc3.dim(caps.trustBoundaries.artifacts.replace(/-/g, " "))}`);
+  console.log(`    Simulator:   ${pc3.dim(caps.trustBoundaries.simulator.replace(/-/g, " "))}`);
+  console.log(`    Query store: ${pc3.dim(caps.trustBoundaries.queryStore.replace(/-/g, " "))}`);
+  console.log(`    L2 bridge:   ${pc3.dim(caps.trustBoundaries.l2Bridge.replace(/-/g, " "))}`);
+}
+
+// src/commands/new.ts
+import path12 from "path";
+import fs10 from "fs/promises";
+import pc4 from "picocolors";
+import { execa as execa2 } from "execa";
+
+// src/templates/basic.ts
+function generateBasicTemplate(config) {
+  return {
+    "package.json": JSON.stringify({
+      name: config.name,
+      version: "0.1.0",
+      private: true,
+      type: "module",
+      scripts: {
+        "test": "vitest run",
+        "transfer": "hardkas run scripts/transfer.ts",
+        "balance": "hardkas run scripts/check-balance.ts"
+      },
+      devDependencies: {
+        "@hardkas/cli": "alpha",
+        "@hardkas/testing": "alpha",
+        "@hardkas/artifacts": "alpha",
+        "@hardkas/core": "alpha",
+        "vitest": "^2.0.0"
+      }
+    }, null, 2),
+    "hardkas.config.ts": `import { defineConfig } from "@hardkas/cli";
+
+export default defineConfig({
+  network: "${config.network}",
+  accounts: ${config.accounts},
+  initialBalance: "1000",  // KAS
+});
+`,
+    ".gitignore": `node_modules
+dist
+.hardkas/
+.turbo
+*.log
+`,
+    "scripts/transfer.ts": `// Run with: hardkas run scripts/transfer.ts
+// or:       pnpm transfer
+
+const h = (globalThis as any).hardkas;
+
+const [alice, bob] = h.accountNames();
+
+console.log(\`\\nAccounts:\`);
+console.log(\`  Alice: \${h.balanceOf(alice)} sompi\`);
+console.log(\`  Bob:   \${h.balanceOf(bob)} sompi\`);
+
+console.log(\`\\nSending 10 KAS from \${alice} to \${bob}...\`);
+const result = h.send({
+  from: alice,
+  to: bob,
+  amountSompi: 10_000_000_000n
+});
+
+console.log(\`  Status: \${result.receipt.status}\`);
+console.log(\`  TxId:   \${result.receipt.txId}\`);
+
+console.log(\`\\nBalances after:\`);
+console.log(\`  Alice: \${h.balanceOf(alice)} sompi\`);
+console.log(\`  Bob:   \${h.balanceOf(bob)} sompi\`);
+`,
+    "scripts/check-balance.ts": `const h = (globalThis as any).hardkas;
+
+console.log("\\nAccount Balances:");
+for (const name of h.accountNames()) {
+  console.log(\`  \${name}: \${h.balanceOf(name)} sompi\`);
+}
+`,
+    "test/transfer.test.ts": `import { describe, it, expect } from "vitest";
+import { createTestHarness } from "@hardkas/testing";
+import "@hardkas/testing/setup";
+
+describe("Transfer workflow", () => {
+  it("sends KAS from alice to bob", () => {
+    const h = createTestHarness({ accounts: 3, initialBalance: 100_000_000_000n });
+    const [alice, bob] = h.accountNames();
+
+    const result = h.send({
+      from: alice,
+      to: bob,
+      amountSompi: 10_000_000_000n
+    });
+
+    expect(result.receipt).toBeAccepted();
+    expect(result.receipt).toHaveValidTxId();
+  });
+
+  it("rejects insufficient funds", () => {
+    const h = createTestHarness({ accounts: 2, initialBalance: 10_000_000_000n });
+    const [alice, bob] = h.accountNames();
+
+    const result = h.send({
+      from: alice,
+      to: bob,
+      amountSompi: 999_000_000_000n
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.receipt).toBeFailed();
+  });
+
+  it("produces deterministic txId", () => {
+    const h1 = createTestHarness({ accounts: 2, initialBalance: 100_000_000_000n });
+    const h2 = createTestHarness({ accounts: 2, initialBalance: 100_000_000_000n });
+
+    const r1 = h1.send({ from: h1.accountNames()[0], to: h1.accountNames()[1], amountSompi: 5_000_000_000n });
+    const r2 = h2.send({ from: h2.accountNames()[0], to: h2.accountNames()[1], amountSompi: 5_000_000_000n });
+
+    expect(r1.receipt.txId).toBe(r2.receipt.txId);
+  });
+});
+`,
+    "vitest.config.ts": `import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    globals: false,
+    environment: "node",
+  },
+});
+`,
+    "README.md": `# ${config.name}
+
+Built with [HardKAS](https://github.com/KasLabDevs/HardKas) \u2014 Kaspa developer toolkit.
+
+## Quick start
+
+\`\`\`bash
+pnpm install
+pnpm transfer          # Run a simulated transfer
+pnpm balance           # Check account balances
+pnpm test              # Run tests
+\`\`\`
+`
+  };
+}
+
+// src/commands/new.ts
+function registerNewCommand(program) {
+  program.command("new <name>").description(`Create a new HardKAS project ${UI.maturity("stable")}`).option("--template <type>", "Project template", "basic").option("--network <name>", "Default network", "simnet").option("--accounts <n>", "Number of simulated accounts", "3").option("--skip-install", "Skip pnpm install", false).action(async (name, opts) => {
+    try {
+      await createProject(name, opts);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+}
+async function createProject(name, opts) {
+  const projectDir = path12.resolve(process.cwd(), name);
+  try {
+    const stats = await fs10.stat(projectDir);
+    if (stats) {
+      console.error(pc4.red(`Error: Directory '${name}' already exists.`));
+      process.exit(1);
+    }
+  } catch {
+  }
+  UI.box("HardKAS Project Scaffolding", `Creating '${name}'...`);
+  const files = generateBasicTemplate({
+    name,
+    network: opts.network,
+    accounts: parseInt(opts.accounts)
+  });
+  await fs10.mkdir(projectDir, { recursive: true });
+  for (const [relativePath, content] of Object.entries(files)) {
+    const filePath = path12.join(projectDir, relativePath);
+    await fs10.mkdir(path12.dirname(filePath), { recursive: true });
+    await fs10.writeFile(filePath, content);
+    console.log(`  ${pc4.green("create")} ${relativePath}`);
+  }
+  if (!opts.skipInstall) {
+    console.log(pc4.cyan("\nInstalling dependencies with pnpm..."));
+    try {
+      await execa2("pnpm", ["install"], { cwd: projectDir, stdio: "inherit" });
+    } catch (err) {
+      console.warn(pc4.yellow("\nWarning: 'pnpm install' failed. You may need to run it manually."));
+    }
+  }
+  console.log(pc4.green(`
+\u2705 Created project: ${name}`));
+  console.log(`
+Next steps:`);
+  console.log(pc4.cyan(`  cd ${name}`));
+  if (opts.skipInstall) {
+    console.log(pc4.cyan(`  pnpm install`));
+  }
+  console.log(pc4.cyan(`  pnpm transfer          # Run your first transfer`));
+  console.log(pc4.cyan(`  pnpm test              # Run tests`));
+  console.log(pc4.cyan(`  hardkas capabilities   # See what's available`));
+  console.log(`
+Happy building! \u{1F680}
+`);
+}
+
+// src/runners/console-runner.ts
+import repl from "repl";
+import fs11 from "fs";
+import path13 from "path";
+import { createTestHarness } from "@hardkas/testing/harness";
+import { calculateContentHash as calculateContentHash3, canonicalStringify } from "@hardkas/artifacts";
+import { maskSecrets, formatSompi as formatSompi5, parseKasToSompi as parseKasToSompi2 } from "@hardkas/core";
+async function startConsole(opts) {
+  const harness = createTestHarness({
+    accounts: opts.accounts,
+    initialBalance: opts.balance,
+    networkId: opts.network
+  });
+  console.log(`
+HardKAS Console \u2014 ${opts.network}`);
+  console.log(`  ${opts.accounts} accounts, ${formatSompi5(opts.balance)} each
+`);
+  console.log("  Available globals:");
+  console.log("    h              \u2014 test harness (send, balanceOf, accountNames, reset, snapshot)");
+  console.log("    hash(obj)      \u2014 calculateContentHash");
+  console.log("    canonical(obj) \u2014 canonicalStringify");
+  console.log("    kas(str)       \u2014 parseKasToSompi ('1.5' \u2192 150000000n)");
+  console.log("    sompi(n)       \u2014 formatSompi (150000000n \u2192 '1.5 KAS')");
+  console.log("");
+  console.log("  Quick start:");
+  console.log("    h.accountNames()");
+  console.log("    h.balanceOf('alice')");
+  console.log("    h.send({ from: 'alice', to: 'bob', amountSompi: 10_000_000_000n })");
+  console.log("");
+  const historyDir = path13.join(process.cwd(), ".hardkas");
+  const historyPath = path13.join(historyDir, "console-history");
+  if (!fs11.existsSync(historyDir)) fs11.mkdirSync(historyDir, { recursive: true });
+  const r = repl.start({
+    prompt: "hardkas> ",
+    useGlobal: false
+  });
+  r.context.h = harness;
+  r.context.hash = calculateContentHash3;
+  r.context.canonical = canonicalStringify;
+  r.context.kas = parseKasToSompi2;
+  r.context.sompi = formatSompi5;
+  r.context.maskSecrets = maskSecrets;
+  try {
+    if (fs11.existsSync(historyPath)) {
+      const history = fs11.readFileSync(historyPath, "utf-8").split("\n").filter(Boolean).reverse();
+      if (r.history) {
+        for (const line of history) {
+          r.history.push(line);
+        }
+      }
+    }
+  } catch {
+  }
+  r.on("exit", () => {
+    try {
+      const lines = (r.history || []).slice(0, 500).reverse().join("\n");
+      fs11.writeFileSync(historyPath, lines);
+    } catch {
+    }
+    console.log("\nBye!");
+    process.exit(0);
+  });
+}
+
+// src/commands/console.ts
+function registerConsoleCommand(program) {
+  program.command("console").description(`Open an interactive REPL with HardKAS SDK pre-loaded ${UI.maturity("stable")}`).option("--network <name>", "Network name", "simnet").option("--accounts <n>", "Number of simulated accounts", "3").option("--balance <sompi>", "Initial balance per account in sompi", "100000000000").action(async (opts) => {
+    await startConsole({
+      network: opts.network,
+      accounts: parseInt(opts.accounts, 10),
+      balance: BigInt(opts.balance)
+    });
+  });
+}
+
+// src/commands/networks.ts
+import { loadHardkasConfig as loadHardkasConfig13 } from "@hardkas/config";
+function registerNetworksCommand(program) {
+  program.command("networks").description(`List configured networks ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (opts) => {
+    const { config } = await loadHardkasConfig13();
+    const networks = config.networks || {};
+    if (opts.json) {
+      console.log(JSON.stringify(networks, null, 2));
+      return;
+    }
+    UI.header("HardKAS Networks");
+    const header = "  Network        RPC                              Kind";
+    console.log(header);
+    console.log("  " + "\u2500".repeat(header.length - 2));
+    for (const [name, net] of Object.entries(networks)) {
+      const rpc = net.rpcUrl || "simulated";
+      const kind = net.kind || "unknown";
+      console.log(`  ${name.padEnd(14)} ${rpc.padEnd(32)} ${kind}`);
+    }
+    console.log("");
+  });
+}
+
+// src/runners/localnet-runners.ts
+import { loadHardkasConfig as loadHardkasConfig14, resolveNetworkTarget as resolveNetworkTarget3 } from "@hardkas/config";
+import { JsonWrpcKaspaClient as JsonWrpcKaspaClient4 } from "@hardkas/kaspa-rpc";
+import { forkFromNetwork, saveLocalnetState as saveLocalnetState3 } from "@hardkas/localnet";
+import { resolve as resolve2 } from "path";
+import { withLock } from "@hardkas/core";
+async function runLocalnetFork(opts) {
+  UI.header(`HardKAS Localnet Fork`);
+  const { config } = await loadHardkasConfig14();
+  const { target } = resolveNetworkTarget3({ config, network: opts.network });
+  if (target.kind === "simulated") {
+    throw new Error("Cannot fork from a simulated network.");
+  }
+  const rpcUrl = target.rpcUrl;
+  if (!rpcUrl) throw new Error(`No RPC URL configured for network '${opts.network}'.`);
+  UI.info(`Forking from: ${opts.network} (${rpcUrl})`);
+  if (opts.addresses.length > 0) {
+    UI.info(`Addresses: ${opts.addresses.join(", ")}`);
+  } else {
+    UI.warning("No addresses specified. Forked state will be empty.");
+  }
+  const client = new JsonWrpcKaspaClient4({ rpcUrl });
+  try {
+    await withLock({
+      rootDir: process.cwd(),
+      name: "workspace",
+      command: "hardkas localnet fork"
+    }, async () => {
+      const state = await forkFromNetwork(client, {
+        network: opts.network,
+        rpcUrl,
+        addresses: opts.addresses,
+        ...opts.atDaaScore ? { atDaaScore: opts.atDaaScore } : {}
+      });
+      const outputPath = opts.outputPath ? resolve2(opts.outputPath) : resolve2(process.cwd(), ".hardkas", "localnet-state.json");
+      await saveLocalnetState3(state);
+      UI.success(`Forked state saved to: ${outputPath}`);
+      UI.info(`DAA Score: ${state.daaScore}`);
+      UI.info(`UTXOs: ${state.utxos.length}`);
+    });
+  } catch (e) {
+    handleError(e, "Forking failed");
+    process.exit(1);
+  } finally {
+    await client.close();
+  }
+}
+
+// src/commands/localnet.ts
+function registerLocalnetCommands(program) {
+  const localnet = program.command("localnet").description("Manage localnet state and snapshots");
+  localnet.command("fork").description(`Fork state from a real Kaspa network for local simulation ${UI.maturity("preview")}`).requiredOption("--network <name>", "Network to fork from").option("--addresses <addrs...>", "Only fetch UTXOs for these addresses").option("--at-daa-score <score>", "Fork at specific DAA score (default: latest)").option("--output <path>", "Save fork snapshot to file").option("--json", "Output as JSON", false).action(async (opts) => {
+    await runLocalnetFork({
+      network: opts.network,
+      addresses: opts.addresses || [],
+      atDaaScore: opts.atDaaScore,
+      outputPath: opts.output
+    });
+  });
+}
+
+// src/commands/deploy.ts
+function registerDeployCommands(program) {
+  const deployCmd = program.command("deploy").description("Track and manage deployments");
+  deployCmd.command("track <label>").description(`Create a deployment record for a transaction ${UI.maturity("stable")}`).requiredOption("--network <name>", "Network where deployed").option("--tx-id <txId>", "Transaction ID").option("--plan <artifactId>", "Reference to plan artifact").option("--receipt <artifactId>", "Reference to receipt artifact").option("--status <status>", "Deployment status", "sent").option("--notes <text>", "Notes about this deployment").option("--json", "Output as JSON", false).action(async (label, opts) => {
+    const { UI: UI2 } = await import("./ui-SUYOHGGP.js");
+    await trackDeployment({ label, ...opts });
+  });
+  deployCmd.command("list").description(`List all tracked deployments ${UI.maturity("stable")}`).option("--network <name>", "Filter by network").option("--status <status>", "Filter by status").option("--json", "Output as JSON", false).action(async (opts) => {
+    await listAllDeployments(opts);
+  });
+  deployCmd.command("inspect <label>").description(`Show full details of a deployment ${UI.maturity("stable")}`).requiredOption("--network <name>", "Network").option("--json", "Output as JSON", false).action(async (label, opts) => {
+    await inspectDeployment({ label, ...opts });
+  });
+  deployCmd.command("status <label>").description(`Check deployment status (query RPC if available) ${UI.maturity("stable")}`).requiredOption("--network <name>", "Network").option("--verify", "Verify against RPC node", false).option("--json", "Output as JSON", false).action(async (label, opts) => {
+    await verifyDeploymentStatus({ label, ...opts });
+  });
+  deployCmd.command("history").description(`Show deployment history across all networks ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (opts) => {
+    await showDeploymentHistory(opts);
+  });
+}
+
+// src/program.ts
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import path11 from "path";
-var packageJsonPath = path11.resolve(
-  path11.dirname(fileURLToPath(import.meta.url)),
+import path14 from "path";
+
+// src/commands/lock.ts
+import pc5 from "picocolors";
+import { listLocks, clearLock } from "@hardkas/core";
+function registerLockCommands(program) {
+  const lockCmd = program.command("lock").description("Manage HardKAS workspace locks");
+  lockCmd.command("list").description(`List all active workspace locks ${UI.maturity("stable")}`).option("--json", "Output as JSON", false).action(async (options) => {
+    try {
+      const locks = listLocks(process.cwd());
+      if (options.json) {
+        console.log(JSON.stringify(locks, null, 2));
+        return;
+      }
+      UI.header("Active Workspace Locks");
+      if (locks.length === 0) {
+        console.log("  No active locks found.\n");
+        return;
+      }
+      for (const lock of locks) {
+        const status = lock.isAlive ? pc5.green("live") : pc5.red("STALE");
+        console.log(`  ${pc5.bold(lock.name.padEnd(12))} ${pc5.dim("PID:")} ${lock.metadata.pid.toString().padEnd(6)} ${pc5.dim("State:")} ${status}`);
+        console.log(`    ${pc5.dim("Command:")} ${lock.metadata.command}`);
+        console.log(`    ${pc5.dim("Created:")} ${lock.metadata.createdAt}`);
+        console.log("");
+      }
+    } catch (e) {
+      handleLockError(e);
+      process.exitCode = 1;
+    }
+  });
+  lockCmd.command("status [name]").description(`Show status of one or all locks ${UI.maturity("stable")}`).action(async (name) => {
+    try {
+      const locks = listLocks(process.cwd());
+      if (name) {
+        const lock = locks.find((l) => l.name === name);
+        if (!lock) {
+          console.log(`
+  Lock '${name}' is ${pc5.green("FREE")}.
+`);
+          return;
+        }
+        UI.header(`Lock Status: ${name}`);
+        console.log(`  State:   ${lock.isAlive ? pc5.green("HELD (live)") : pc5.red("HELD (STALE)")}`);
+        console.log(`  PID:     ${lock.metadata.pid}`);
+        console.log(`  Host:    ${lock.metadata.hostname}`);
+        console.log(`  Command: ${lock.metadata.command}`);
+        console.log(`  Created: ${lock.metadata.createdAt}`);
+        console.log(`  Path:    ${lock.path}`);
+        console.log("");
+      } else {
+        UI.header("Lock Summary");
+        for (const lock of locks) {
+          console.log(`  ${pc5.bold(lock.name.padEnd(12))}: ${lock.isAlive ? pc5.green("HELD") : pc5.red("STALE")}`);
+        }
+        if (locks.length === 0) console.log("  All locks are FREE.");
+        console.log("");
+      }
+    } catch (e) {
+      handleLockError(e);
+      process.exitCode = 1;
+    }
+  });
+  lockCmd.command("doctor").description(`Analyze locks and identify stale or corrupted ones ${UI.maturity("stable")}`).action(async () => {
+    try {
+      const locks = listLocks(process.cwd());
+      UI.header("Lock Doctor Analysis");
+      let staleCount = 0;
+      for (const lock of locks) {
+        if (!lock.isAlive) {
+          staleCount++;
+          console.log(`  ${pc5.red("\u2717")} Stale lock found: ${pc5.bold(lock.name)} (PID: ${lock.metadata.pid})`);
+          console.log(`    Suggestion: Run 'hardkas lock clear ${lock.name} --if-dead'`);
+        }
+      }
+      if (staleCount === 0) {
+        if (locks.length === 0) {
+          console.log("  \u2713 No locks found. Workspace is clean.");
+        } else {
+          console.log(`  \u2713 All ${locks.length} active lock(s) are held by live processes.`);
+        }
+      }
+      console.log("");
+    } catch (e) {
+      handleLockError(e);
+      process.exitCode = 1;
+    }
+  });
+  lockCmd.command("clear <name>").description(`Safely or forcibly clear a lock ${UI.maturity("stable")}`).option("--if-dead", "Only clear if the process is no longer running", false).option("--force", "Forcibly clear the lock even if the process is alive", false).option("--yes", "Confirm clearing without prompt", false).action(async (name, options) => {
+    try {
+      if (!options.yes && !options.ifDead) {
+        const confirmed = await UI.confirm(`Clearing an active lock may lead to data corruption if another process is writing to the workspace.
+  Are you sure you want to clear '${name}'?`);
+        if (!confirmed) return;
+      }
+      const result = clearLock(process.cwd(), name, {
+        force: options.force,
+        ifDead: options.ifDead
+      });
+      if (result.cleared) {
+        UI.success(`Lock '${name}' cleared.`);
+      } else {
+        UI.error(`Could not clear lock '${name}': ${result.reason}`);
+        process.exitCode = 1;
+      }
+    } catch (e) {
+      handleLockError(e);
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/program.ts
+var packageJsonPath = path14.resolve(
+  path14.dirname(fileURLToPath(import.meta.url)),
   "../package.json"
 );
-var { version: HARDKAS_VERSION4 } = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-async function main() {
+var { version: HARDKAS_VERSION6 } = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+function buildHardkasProgram(options) {
   const program = new Command();
-  program.name("hardkas").description("HardKAS: Kaspa-native developer operating environment").version(HARDKAS_VERSION4);
+  program.name("hardkas").description("HardKAS: Kaspa-native developer operating environment").version(HARDKAS_VERSION6);
   registerInitCommands(program);
   registerTxCommands(program);
   registerArtifactCommands(program);
@@ -3776,20 +5204,36 @@ async function main() {
   registerTestCommands(program);
   registerDoctorCommand(program);
   registerFaucetCommand(program);
+  registerRunCommand(program);
+  registerLockCommands(program);
+  registerCapabilitiesCommand(program);
+  registerNewCommand(program);
+  registerConsoleCommand(program);
+  registerNetworksCommand(program);
+  registerLocalnetCommands(program);
+  registerDeployCommands(program);
+  if (options?.forDocs) {
+  }
+  return program;
+}
+
+// src/index.ts
+async function main() {
+  const program = buildHardkasProgram();
   try {
     await program.parseAsync(process.argv);
   } catch (err) {
-    const { maskSecrets } = await import("@hardkas/core");
+    const { maskSecrets: maskSecrets2 } = await import("@hardkas/core");
     console.error(`
-Error: ${maskSecrets(err.message || String(err))}`);
+Error: ${maskSecrets2(err.message || String(err))}`);
     process.exit(1);
   }
 }
 main().catch(async (err) => {
-  const { maskSecrets } = await import("@hardkas/core");
-  console.error("Fatal error:", maskSecrets(err.message || String(err)));
+  const { maskSecrets: maskSecrets2 } = await import("@hardkas/core");
+  console.error("Fatal error:", maskSecrets2(err.message || String(err)));
   if (err.stack) {
-    console.error(maskSecrets(err.stack));
+    console.error(maskSecrets2(err.stack));
   }
   process.exit(1);
 });