@hardkas/cli 0.2.2-alpha → 0.3.0-alpha

package/dist/accounts-keystore-runners-QYSNZMZV.js

@@ -0,0 +1,155 @@
+import {
+  acquirePassword,
+  acquirePrivateKey
+} from "./chunk-ZM2NBOAE.js";
+import {
+  UI
+} from "./chunk-K7XPWWIO.js";
+
+// src/runners/accounts-keystore-runners.ts
+import fs from "fs";
+import path from "path";
+import { KeystoreManager, loadOrCreateRealAccountStore, saveRealAccountStore, importRealDevAccount } from "@hardkas/accounts";
+async function runAccountsKeystoreImport(options) {
+  const name = options.name || "default";
+  const address = options.address;
+  if (options.unsafePlaintext) {
+    UI.warning("LEGACY MODE: Storing private keys in plaintext is unsafe and discouraged.");
+    if (!options.yes) {
+      const confirmed = await UI.confirm("Are you sure you want to store this key in plaintext?");
+      if (!confirmed) throw new Error("Import cancelled by user.");
+    }
+  } else {
+    UI.info("HardKAS: Encrypted keystore is for local developer workflows, not institutional custody.");
+    UI.info("Do not import mainnet keys unless you fully understand the risks.");
+  }
+  if (!address) {
+    throw new Error("Address is required for import.");
+  }
+  let privateKeyUsedAsArg = false;
+  let finalKey;
+  if (options.privateKeyStdin || options.privateKeyEnv) {
+    finalKey = await acquirePrivateKey({
+      stdin: !!options.privateKeyStdin,
+      env: options.privateKeyEnv,
+      message: `Enter private key for account '${name}':`
+    });
+  } else if (options.privateKey) {
+    finalKey = options.privateKey;
+    privateKeyUsedAsArg = true;
+  } else {
+    finalKey = await acquirePrivateKey({
+      message: `Enter private key for account '${name}':`
+    });
+  }
+  if (privateKeyUsedAsArg) {
+    const warningMsg = "--private-key may be recorded in shell history, process lists, CI logs, or terminal scrollback.";
+    const suggestion = "Use --private-key-stdin or --private-key-env instead.";
+    if (!options.json) {
+      UI.securityWarning("PRIVATE_KEY_ARG_DEPRECATED", warningMsg, suggestion);
+    }
+  }
+  if (!finalKey) {
+    throw new Error("Private key is required for import.");
+  }
+  let keystoreRef;
+  if (!options.unsafePlaintext) {
+    const password = await acquirePassword({
+      stdin: !!options.passwordStdin,
+      env: options.passwordEnv,
+      message: `Enter new keystore password for account '${name}':`
+    });
+    if (!password) {
+      throw new Error("Password cannot be empty for encrypted storage.");
+    }
+    const keystore = await KeystoreManager.createEncryptedKeystore(
+      {
+        address,
+        privateKey: finalKey,
+        network: address.startsWith("kaspa:") ? "mainnet" : "devnet"
+      },
+      password,
+      {
+        label: name,
+        network: address.startsWith("kaspa:") ? "mainnet" : "devnet"
+      }
+    );
+    const keystoreDir = path.join(process.cwd(), ".hardkas", "keystore");
+    const filePath = path.join(keystoreDir, `${name}.json`);
+    await KeystoreManager.saveEncryptedKeystore(filePath, keystore);
+    keystoreRef = `.hardkas/keystore/${name}.json`;
+  }
+  let store = await loadOrCreateRealAccountStore();
+  store = importRealDevAccount(store, {
+    name,
+    address,
+    ...options.unsafePlaintext ? { privateKey: finalKey } : {},
+    ...keystoreRef ? { keystoreRef } : {}
+  });
+  await saveRealAccountStore(store);
+  const warnings = [];
+  if (privateKeyUsedAsArg) {
+    warnings.push({
+      code: "PRIVATE_KEY_ARG_DEPRECATED",
+      severity: "warning",
+      message: "--private-key is deprecated and unsafe. Use --private-key-stdin or --private-key-env."
+    });
+  }
+  return {
+    success: true,
+    name,
+    encrypted: !options.unsafePlaintext,
+    warnings,
+    formatted: options.unsafePlaintext ? `\u2713 Successfully imported account '${name}' (UNSAFE PLAINTEXT)` : `\u2713 Successfully imported and encrypted account '${name}'`
+  };
+}
+async function runAccountsSessionOpen(options) {
+  const { name } = options;
+  const filePath = path.join(process.cwd(), ".hardkas", "keystore", `${name}.json`);
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`Keystore for account '${name}' not found at ${filePath}`);
+  }
+  const keystore = await KeystoreManager.loadEncryptedKeystore(filePath);
+  const password = await acquirePassword({
+    stdin: !!options.passwordStdin,
+    env: options.passwordEnv,
+    message: `Enter password for account '${name}':`
+  });
+  const result = await KeystoreManager.decryptEncryptedKeystore(keystore, password);
+  if (result.success) {
+    UI.success(`Access to account '${name}' verified.`);
+    UI.info("Note: This does not create a production wallet session or daemon.");
+    UI.info("Decrypted key material is process-local and will not be persisted.");
+  } else {
+    throw new Error(result.error || "Failed to unlock keystore.");
+  }
+}
+async function runAccountsKeystoreChangePassword(options) {
+  const { name } = options;
+  const filePath = path.join(process.cwd(), ".hardkas", "keystore", `${name}.json`);
+  const keystore = await KeystoreManager.loadEncryptedKeystore(filePath);
+  const oldPassword = await acquirePassword({
+    message: "Enter current password:"
+  });
+  const newPassword = await acquirePassword({
+    message: "Enter new password:"
+  });
+  const confirm = await acquirePassword({
+    message: "Confirm new password:"
+  });
+  if (newPassword !== confirm) {
+    throw new Error("New passwords do not match.");
+  }
+  const updatedKeystore = await KeystoreManager.changeKeystorePassword(
+    keystore,
+    oldPassword,
+    newPassword
+  );
+  await KeystoreManager.saveEncryptedKeystore(filePath, updatedKeystore);
+  UI.success(`Successfully changed password for account '${name}'.`);
+}
+export {
+  runAccountsKeystoreChangePassword,
+  runAccountsKeystoreImport,
+  runAccountsSessionOpen
+};

package/dist/{artifact-lineage-runner-EPT6ABS2.js → artifact-lineage-runner-TY4YTE6H.js}

@@ -1,6 +1,6 @@
 import {
   UI
-} from "./chunk-M54KNJEH.js";
+} from "./chunk-K7XPWWIO.js";
 
 // src/runners/artifact-lineage-runner.ts
 import {
@@ -49,7 +49,11 @@ async function runArtifactLineage(options) {
   const result = verifyLineage(artifact);
   if (!result.ok) {
     console.log("\nLineage Violations:");
-    result.issues.forEach((i) => console.log(`  \u2717 [${i.code}] ${i.message}`));
+    result.issues.forEach((i) => {
+      const prefix = i.severity === "error" ? "\u2717" : "\u26A0";
+      console.log(`  ${prefix} [${i.code}] ${i.message}`);
+    });
+    process.exitCode = 1;
   } else {
     console.log("\n\u2713 Internal lineage structure is consistent.");
   }

package/dist/chunk-K7XPWWIO.js

@@ -0,0 +1,165 @@
+// src/ui.ts
+import pc from "picocolors";
+import { formatSompi, maskSecrets } from "@hardkas/core";
+var UI = {
+  header(text) {
+    const masked = maskSecrets(text);
+    console.log(pc.bold(pc.magenta(`
+  \u2550\u2550\u2550 ${masked} \u2550\u2550\u2550`)));
+  },
+  divider() {
+    console.log(pc.dim("  " + "\u2500".repeat(50)));
+  },
+  info(text) {
+    console.log(`  ${pc.blue("\u2139")} ${text}`);
+  },
+  success(text) {
+    console.log(`  ${pc.green("\u2714")} ${text}`);
+  },
+  box(title, subtitle) {
+    const width = 40;
+    console.log(pc.magenta(`  \u2554${"\u2550".repeat(width - 2)}\u2557`));
+    console.log(pc.magenta(`  \u2551${pc.bold(pc.white(title.padStart((width - 2 + title.length) / 2).padEnd(width - 2)))}\u2551`));
+    if (subtitle) {
+      console.log(pc.magenta(`  \u2551${pc.italic(pc.dim(subtitle.padStart((width - 2 + subtitle.length) / 2).padEnd(width - 2)))}\u2551`));
+    }
+    console.log(pc.magenta(`  \u255A${"\u2550".repeat(width - 2)}\u255D`));
+    console.log("");
+  },
+  warning(text) {
+    const masked = maskSecrets(text);
+    console.log(pc.yellow(`
+  \u26A0\uFE0F  WARNING:`));
+    console.log(pc.yellow(`     ${masked}`));
+  },
+  securityWarning(code, message, suggestion) {
+    console.log(pc.yellow(`
+  \u26A0\uFE0F  SECURITY WARNING [${code}]:`));
+    console.log(pc.yellow(`     ${message}`));
+    if (suggestion) {
+      console.log(pc.cyan(`
+  \u{1F4A1} Suggestion:`));
+      console.log(pc.cyan(`     ${suggestion}`));
+    }
+    console.log("");
+  },
+  error(msg, suggestion) {
+    const maskedMsg = maskSecrets(msg);
+    const maskedSuggestion = suggestion ? maskSecrets(suggestion) : void 0;
+    console.error(pc.red(`
+  \u2717 Error:`));
+    console.error(pc.red(`    ${maskedMsg}`));
+    if (maskedSuggestion) {
+      console.error(pc.cyan(`
+  \u{1F4A1} Suggestion:`));
+      console.error(pc.cyan(`    ${maskedSuggestion}`));
+    }
+  },
+  field(label, value) {
+    const val = value === void 0 || value === null ? pc.dim("none") : maskSecrets(String(value));
+    console.log(`  ${pc.dim(label.padEnd(16))} ${pc.white(val)}`);
+  },
+  kas(label, sompi) {
+    this.field(label, pc.cyan(formatSompi(BigInt(sompi))));
+  },
+  maturity(label) {
+    const colors = {
+      stable: pc.green,
+      preview: pc.blue,
+      experimental: pc.yellow,
+      research: pc.magenta,
+      internal: pc.dim
+    };
+    const color = colors[label.toLowerCase()] || pc.white;
+    return color(label.toLowerCase());
+  },
+  async confirm(message) {
+    const readline = await import("readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question(pc.yellow(`  \u26A0\uFE0F  ${message} (y/N): `));
+    rl.close();
+    return answer.toLowerCase() === "y";
+  },
+  footer(hint) {
+    if (hint) {
+      console.log(pc.dim(`
+  Hint: ${hint}`));
+    }
+    console.log("");
+  }
+};
+function handleError(e, context) {
+  const rawMsg = e instanceof Error ? e.message : String(e);
+  const msg = maskSecrets ? maskSecrets(rawMsg) : rawMsg;
+  const errorObj = e;
+  let reason = maskSecrets ? maskSecrets(errorObj.reason) : errorObj.reason;
+  let suggestion = maskSecrets ? maskSecrets(errorObj.suggestion) : errorObj.suggestion;
+  if (msg === "Real transaction signing is not available") {
+    console.error(`
+${msg}`);
+    if (reason) console.error(`
+Reason:
+  ${reason}`);
+    if (suggestion) console.error(`
+Suggestion:
+  ${suggestion}
+  No artifact was written.`);
+    return;
+  }
+  if (!suggestion) {
+    if (msg.includes("Localnet state not found")) {
+      suggestion = "Run 'hardkas localnet reset' to initialize the simulated environment.";
+    } else if (msg.includes("Insufficient funds")) {
+      suggestion = "Use 'hardkas faucet <address> <amount>' to add funds to your account.";
+    } else if (msg.includes("Account not found")) {
+      suggestion = "Check your 'hardkas.config.ts' or use a full Kaspa address.";
+    } else if (msg.includes("Docker") || msg.includes("container")) {
+      suggestion = "Ensure Docker is running and you have permissions to manage containers.";
+    } else if (msg.includes("L2 RPC") || msg.includes("L2 profile")) {
+      suggestion = "Check your L2 network configuration or pass a valid --url.";
+    } else if (msg.includes("RPC") || msg.includes("Connection refused")) {
+      suggestion = "The Kaspa node might still be starting. Try 'hardkas rpc health --wait'.";
+    } else if (msg.includes("submitTransaction is not exposed")) {
+      suggestion = "Ensure your node/RPC provider supports transaction submission and you are NOT on mainnet without --allow-mainnet-signing.";
+    }
+  }
+  UI.error(context ? `${context}: ${msg}` : msg, suggestion);
+}
+function handleLockError(e) {
+  const code = e.code || "UNKNOWN_ERROR";
+  const meta = e.cause;
+  if (code === "LOCK_HELD" || code === "LOCK_TIMEOUT" || code === "STALE_LOCK") {
+    const title = code === "STALE_LOCK" ? "Stale Workspace Lock Detected" : "Workspace is locked by another HardKAS process";
+    console.error(pc.red(`
+  \u2717 ${pc.bold(title)}`));
+    console.error(pc.red(`  ${"\u2500".repeat(title.length + 4)}`));
+    if (meta) {
+      console.error(`  ${pc.dim("Lock:")}    ${pc.white(meta.name)}`);
+      console.error(`  ${pc.dim("PID:")}     ${pc.white(meta.pid)}`);
+      console.error(`  ${pc.dim("Command:")} ${pc.white(meta.command)}`);
+      console.error(`  ${pc.dim("Created:")} ${pc.white(meta.createdAt)}`);
+      if (meta.path) console.error(`  ${pc.dim("Path:")}    ${pc.white(meta.path)}`);
+    }
+    console.error(pc.cyan(`
+  \u{1F4A1} Suggestion:`));
+    if (code === "STALE_LOCK") {
+      console.error(`    The process (PID ${meta?.pid}) appears to be dead.`);
+      console.error(`    Run 'hardkas lock clear ${meta?.name} --if-dead' to release it safely.`);
+    } else {
+      console.error(`    Wait for the process to finish, or run:`);
+      console.error(`    hardkas lock doctor`);
+      console.error(`
+    If you believe the process is dead:`);
+      console.error(`    hardkas lock clear ${meta?.name} --if-dead`);
+    }
+    console.error("");
+    return;
+  }
+  handleError(e);
+}
+
+export {
+  UI,
+  handleError,
+  handleLockError
+};

package/dist/chunk-KA5CAWI2.js

@@ -0,0 +1,163 @@
+import {
+  UI
+} from "./chunk-K7XPWWIO.js";
+
+// src/runners/deployment-runners.ts
+import { withLock } from "@hardkas/core";
+import {
+  saveDeployment,
+  loadDeployment,
+  listDeployments,
+  createDeploymentRecord,
+  updateDeploymentStatus
+} from "@hardkas/artifacts";
+import { loadHardkasConfig, resolveNetworkTarget } from "@hardkas/config";
+import { JsonWrpcKaspaClient } from "@hardkas/kaspa-rpc";
+async function trackDeployment(opts) {
+  const rootDir = process.cwd();
+  await withLock({ rootDir, name: "artifacts", command: "hardkas deploy track" }, async () => {
+    const existing = await loadDeployment(rootDir, opts.network, opts.label);
+    if (existing) {
+      throw new Error(`Deployment '${opts.label}' already exists on network '${opts.network}'.`);
+    }
+    const record = createDeploymentRecord({
+      label: opts.label,
+      networkId: opts.network,
+      ...opts.txId ? { txId: opts.txId } : {},
+      ...opts.plan ? { planArtifactId: opts.plan } : {},
+      ...opts.receipt ? { receiptArtifactId: opts.receipt } : {},
+      status: opts.status || "sent",
+      ...opts.notes ? { notes: opts.notes } : {}
+    });
+    await saveDeployment(rootDir, record);
+    UI.success(`Tracked deployment: ${opts.label} (${opts.network})`);
+  });
+}
+async function listAllDeployments(opts) {
+  const rootDir = process.cwd();
+  const deployments = await listDeployments(rootDir, opts.network);
+  const filtered = opts.status ? deployments.filter((d) => d.status === opts.status) : deployments;
+  if (opts.json) {
+    console.log(JSON.stringify(filtered, null, 2));
+    return;
+  }
+  if (filtered.length === 0) {
+    UI.info("No deployments found.");
+    return;
+  }
+  UI.header("Deployments");
+  const byNetwork = {};
+  for (const d of filtered) {
+    const net = d.networkId || "unknown";
+    if (!byNetwork[net]) byNetwork[net] = [];
+    byNetwork[net].push(d);
+  }
+  let total = 0;
+  for (const [net, items] of Object.entries(byNetwork)) {
+    console.log(`
+  ${net}`);
+    for (const d of items) {
+      const statusIcon = d.status === "confirmed" ? "\u2705" : d.status === "failed" ? "\u274C" : "\u23F3";
+      const txIdShort = d.txId ? d.txId.slice(0, 12) + "..." : "(none)";
+      const ago = formatAgo(d.deployedAt);
+      console.log(`    ${statusIcon} ${d.label.padEnd(20)} ${d.status.padEnd(10)} ${txIdShort.padEnd(16)} ${ago}`);
+      total++;
+    }
+  }
+  console.log(`
+  Total: ${total} deployments across ${Object.keys(byNetwork).length} networks`);
+}
+async function inspectDeployment(opts) {
+  const rootDir = process.cwd();
+  const record = await loadDeployment(rootDir, opts.network, opts.label);
+  if (!record) {
+    throw new Error(`Deployment '${opts.label}' not found on network '${opts.network}'.`);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(record, null, 2));
+    return;
+  }
+  UI.header(`Deployment: ${record.label}`);
+  console.log(`  Network:        ${record.networkId}`);
+  console.log(`  Status:         ${record.status}`);
+  console.log(`  TxId:           ${record.txId || "(none)"}`);
+  console.log(`  Plan artifact:  ${record.planArtifactId || "(none)"}`);
+  console.log(`  Receipt:        ${record.receiptArtifactId || "(none)"}`);
+  console.log(`  Deployed at:    ${record.deployedAt}`);
+  console.log(`  Content hash:   ${record.contentHash}`);
+  if (record.notes) console.log(`  Notes:          ${record.notes}`);
+}
+async function verifyDeploymentStatus(opts) {
+  const rootDir = process.cwd();
+  const record = await loadDeployment(rootDir, opts.network, opts.label);
+  if (!record) {
+    throw new Error(`Deployment '${opts.label}' not found on network '${opts.network}'.`);
+  }
+  if (!opts.verify) {
+    if (opts.json) console.log(JSON.stringify({ label: record.label, status: record.status }, null, 2));
+    else console.log(`Current status: ${record.status}`);
+    return;
+  }
+  if (!record.txId) {
+    throw new Error(`Cannot verify deployment '${opts.label}' without a transaction ID.`);
+  }
+  UI.info(`Checking ${record.label} on ${record.networkId}...`);
+  const { config } = await loadHardkasConfig();
+  const netTarget = resolveNetworkTarget({ config, network: record.networkId });
+  const rpcUrl = netTarget.target.rpcUrl;
+  console.log(`  RPC: ${rpcUrl || "simulated"}`);
+  console.log(`  TxId: ${record.txId}`);
+  if (record.networkId === "simnet") {
+    UI.info("  Simnet deployment \u2014 status preserved.");
+  } else if (!rpcUrl) {
+    UI.error("  No RPC URL configured for this network.");
+  } else {
+    try {
+      const client = new JsonWrpcKaspaClient({ rpcUrl });
+      const tx = await client.getTransaction(record.txId);
+      let newStatus = record.status;
+      if (tx) {
+        const isAccepted = tx.isAccepted || tx.transaction && tx.transaction.block_hash;
+        if (isAccepted) newStatus = "confirmed";
+      } else {
+      }
+      if (newStatus !== record.status) {
+        await withLock({ rootDir, name: "artifacts", command: "hardkas deploy status" }, async () => {
+          const updated = updateDeploymentStatus(record, newStatus);
+          await saveDeployment(rootDir, updated);
+          UI.success(`  Status updated: ${newStatus}`);
+        });
+      } else {
+        UI.info(`  Status remains: ${record.status}`);
+      }
+      await client.close();
+    } catch (e) {
+      UI.error(`  RPC check failed: ${e.message}`);
+    }
+  }
+}
+async function showDeploymentHistory(opts) {
+  const options = {
+    ...opts.json !== void 0 ? { json: opts.json } : {}
+  };
+  await listAllDeployments(options);
+}
+function formatAgo(dateStr) {
+  const date = new Date(dateStr);
+  const now = /* @__PURE__ */ new Date();
+  const diffMs = now.getTime() - date.getTime();
+  const diffMin = Math.floor(diffMs / 6e4);
+  if (diffMin < 1) return "just now";
+  if (diffMin < 60) return `${diffMin} min ago`;
+  const diffHour = Math.floor(diffMin / 60);
+  if (diffHour < 24) return `${diffHour} hours ago`;
+  return `${Math.floor(diffHour / 24)} days ago`;
+}
+
+export {
+  trackDeployment,
+  listAllDeployments,
+  inspectDeployment,
+  verifyDeploymentStatus,
+  showDeploymentHistory
+};

package/dist/chunk-ZM2NBOAE.js

@@ -0,0 +1,37 @@
+// src/runners/secrets.ts
+import enquirer from "enquirer";
+var { Password } = enquirer;
+async function acquirePassword(options = {}) {
+  if (options.env && process.env[options.env]) {
+    return process.env[options.env];
+  }
+  if (options.stdin) {
+    return new Promise((resolve, reject) => {
+      let data = "";
+      process.stdin.setEncoding("utf8");
+      process.stdin.on("data", (chunk) => {
+        data += chunk;
+      });
+      process.stdin.on("end", () => {
+        resolve(data.trim());
+      });
+      process.stdin.on("error", reject);
+    });
+  }
+  const prompt = new Password({
+    name: "password",
+    message: options.message || "Enter password:"
+  });
+  return await prompt.run();
+}
+async function acquirePrivateKey(options = {}) {
+  return acquirePassword({
+    ...options,
+    message: options.message || "Enter private key (hex):"
+  });
+}
+
+export {
+  acquirePassword,
+  acquirePrivateKey
+};

package/dist/{dag-runners-BQAKJ6DM.js → dag-runners-NLBYR7I7.js}

@@ -1,6 +1,6 @@
 import {
   UI
-} from "./chunk-M54KNJEH.js";
+} from "./chunk-K7XPWWIO.js";
 
 // src/runners/dag-runners.ts
 import {
@@ -49,7 +49,7 @@ async function runDagSimulateReorg(options) {
   if (!forkPointId) throw new Error("Could not find fork point in current path.");
   const forkPoint = state.dag.blocks[forkPointId];
   if (!forkPoint) throw new Error(`Fork point block ${forkPointId} not found in state.`);
-  const sideBlockId = `reorg_side_${Date.now().toString(36)}`;
+  const sideBlockId = `reorg_side_${forkPointId}_0`;
   state.dag.blocks[sideBlockId] = {
     id: sideBlockId,
     parents: [forkPointId],

package/dist/deployment-runners-GEICABEH.js

@@ -0,0 +1,15 @@
+import {
+  inspectDeployment,
+  listAllDeployments,
+  showDeploymentHistory,
+  trackDeployment,
+  verifyDeploymentStatus
+} from "./chunk-KA5CAWI2.js";
+import "./chunk-K7XPWWIO.js";
+export {
+  inspectDeployment,
+  listAllDeployments,
+  showDeploymentHistory,
+  trackDeployment,
+  verifyDeploymentStatus
+};