@offckb/cli 0.4.9-canary-2b6b3af.0 → 0.4.9

package/build/index.js

@@ -353,6 +353,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.runCli = runCli;
 const commander_1 = __nccwpck_require__(53497);
 const node_1 = __nccwpck_require__(998);
 const accounts_1 = __nccwpck_require__(87398);
@@ -366,6 +367,8 @@ const udt_1 = __nccwpck_require__(50703);
 const create_1 = __nccwpck_require__(51534);
 const config_1 = __nccwpck_require__(93004);
 const devnet_config_1 = __nccwpck_require__(10015);
+const devnet_fork_1 = __nccwpck_require__(36709);
+const devnet_info_1 = __nccwpck_require__(60905);
 const debug_1 = __nccwpck_require__(39591);
 const system_scripts_1 = __nccwpck_require__(86198);
 const transfer_all_1 = __nccwpck_require__(92039);
@@ -373,16 +376,26 @@ const gen_1 = __nccwpck_require__(750);
 const ckb_debugger_1 = __nccwpck_require__(14815);
 const logger_1 = __nccwpck_require__(65370);
 const status_1 = __nccwpck_require__(71420);
-const validator_1 = __nccwpck_require__(39534);
 const version = (__nccwpck_require__(8330)/* .version */ .rE);
 const description = (__nccwpck_require__(8330)/* .description */ .h_);
 // fix windows terminal encoding of simplified chinese text
 (0, encoding_1.setUTF8EncodingForWindows)();
 const program = new commander_1.Command();
 program.name('offckb').description(description).version(version).enablePositionalOptions();
+let activeCommand = 'offckb';
+function commandPath(command) {
+    const names = [];
+    let current = command;
+    while (current === null || current === void 0 ? void 0 : current.parent) {
+        names.unshift(current.name());
+        current = current.parent;
+    }
+    return names.join('.') || 'offckb';
+}
 program.option('--json', 'Output logs in JSON format for agent/programmatic consumption');
-program.hook('preAction', (thisCommand) => {
-    const opts = thisCommand.opts();
+program.hook('preAction', (_thisCommand, actionCommand) => {
+    activeCommand = commandPath(actionCommand);
+    const opts = actionCommand.optsWithGlobals();
     if (opts.json) {
         logger_1.logger.setJsonMode(true);
     }
@@ -419,7 +432,8 @@ program
     .option('--target <target>', 'Specify the script binaries file/folder path to deploy', './')
     .option('-o, --output <output>', 'Specify the output folder path for the deployment record files', './deployment')
     .option('-t, --type-id', 'Specify if use upgradable type id to deploy the script')
-    .option('--privkey <privkey>', 'Specify the private key to deploy scripts')
+    .option('--privkey <privkey>', 'Specify the private key to deploy scripts (visible in shell history)')
+    .option('--privkey-file <path>', 'Read the private key from a local file')
     .option('-y, --yes', 'Skip confirmation prompt and deploy immediately')
     .action((options) => (0, deploy_1.deploy)(options));
 program
@@ -432,8 +446,7 @@ program
     .action((option) => __awaiter(void 0, void 0, void 0, function* () {
     // For debugging, tx-hash is required
     if (!option.txHash) {
-        logger_1.logger.error('Error: --tx-hash is required for debugging operations');
-        process.exit(1);
+        throw new Error('--tx-hash is required for debugging operations');
     }
     const txHash = option.txHash;
     if (option.singleScript) {
@@ -463,34 +476,43 @@ program
     .description('Clean the devnet data, need to stop running the chain first')
     .option('-d, --data', 'Only remove chain data, keep devnet config files')
     .action((options) => (0, clean_1.clean)(options));
-program.command('accounts').description('Print account list info').action(accounts_1.accounts);
+program
+    .command('accounts')
+    .description('Print account list info')
+    .option('--show-private-keys', 'Include built-in dev private keys (hidden by default)')
+    .action((options) => __awaiter(void 0, void 0, void 0, function* () {
+    yield (0, accounts_1.accounts)(options);
+}));
 program
     .command('deposit [toAddress] [amountInCKB]')
     .description('Deposit CKB tokens to address, only devnet and testnet')
     .option('--network <network>', 'Specify the network to deposit to', 'devnet')
     .option('-r, --proxy-rpc', 'Use Proxy RPC to connect to blockchain')
     .action((toAddress, amountInCKB, options) => __awaiter(void 0, void 0, void 0, function* () {
-    return (0, deposit_1.deposit)(toAddress, amountInCKB, options);
+    yield (0, deposit_1.deposit)(toAddress, amountInCKB, options);
 }));
 program
     .command('transfer [toAddress] [amount]')
     .description('Transfer CKB or UDT tokens to address, only devnet and testnet')
     .option('--network <network>', 'Specify the network to transfer to', 'devnet')
-    .option('--privkey <privkey>', 'Specify the private key to transfer')
-    .addOption(new commander_1.Option('--udt-kind <kind>', 'Specify the UDT kind').choices(['sudt', 'xudt']).default('sudt'))
+    .option('--privkey <privkey>', 'Specify the private key to transfer (visible in shell history)')
+    .option('--privkey-file <path>', 'Read the private key from a local file')
+    .addOption(new commander_1.Option('--udt-kind <kind>', 'Specify the UDT kind').choices(['sudt', 'xudt']))
     .option('--udt-type-args <typeArgs>', 'Specify the UDT type script args to transfer UDT')
+    .option('--allow-mainnet-replay-risk', 'Allow a non-built-in key on a Mainnet fork (copied inputs remain blocked)')
     .option('-r, --proxy-rpc', 'Use Proxy RPC to connect to blockchain')
     .action((toAddress, amount, options) => __awaiter(void 0, void 0, void 0, function* () {
-    return (0, transfer_1.transfer)(toAddress, amount, options);
+    yield (0, transfer_1.transfer)(toAddress, amount, options);
 }));
 program
     .command('transfer-all [toAddress]')
     .description('Transfer All CKB tokens to address, only devnet and testnet')
     .option('--network <network>', 'Specify the network to transfer to', 'devnet')
-    .option('--privkey <privkey>', 'Specify the private key to deploy scripts')
+    .option('--privkey <privkey>', 'Specify the private key (visible in shell history)')
+    .option('--privkey-file <path>', 'Read the private key from a local file')
     .option('-r, --proxy-rpc', 'Use Proxy RPC to connect to blockchain')
     .action((toAddress, options) => __awaiter(void 0, void 0, void 0, function* () {
-    return (0, transfer_all_1.transferAll)(toAddress, options);
+    yield (0, transfer_all_1.transferAll)(toAddress, options);
 }));
 program
     .command('balance [toAddress]')
@@ -500,7 +522,7 @@ program
     .option('--udt-type-args <typeArgs>', 'Filter by UDT type script args')
     .option('--no-udt', 'Skip UDT balance scan')
     .action((toAddress, options) => __awaiter(void 0, void 0, void 0, function* () {
-    return (0, balance_1.balanceOf)(toAddress, options);
+    yield (0, balance_1.balanceOf)(toAddress, options);
 }));
 const udtCommand = program.command('udt').description('UDT token commands');
 udtCommand
@@ -510,9 +532,10 @@ udtCommand
     .addOption(new commander_1.Option('--udt-kind <kind>', 'Specify the UDT kind').choices(['sudt', 'xudt']).default('sudt'))
     .option('--type-args <typeArgs>', 'Specify the UDT type script args (xudt only; defaults to signer lock hash)')
     .option('--to <toAddress>', 'Specify the receiver address (defaults to signer)')
-    .option('--privkey <privkey>', 'Specify the private key to issue UDT')
+    .option('--privkey <privkey>', 'Specify the private key to issue UDT (visible in shell history)')
+    .option('--privkey-file <path>', 'Read the private key from a local file')
     .action((amount, options) => __awaiter(void 0, void 0, void 0, function* () {
-    return (0, udt_1.udtIssue)(amount, options);
+    yield (0, udt_1.udtIssue)(amount, options);
 }));
 udtCommand
     .command('destroy <amount>')
@@ -520,9 +543,10 @@ udtCommand
     .option('--network <network>', 'Specify the network', 'devnet')
     .addOption(new commander_1.Option('--udt-kind <kind>', 'Specify the UDT kind').choices(['sudt', 'xudt']).default('sudt'))
     .requiredOption('--type-args <typeArgs>', 'Specify the UDT type script args')
-    .option('--privkey <privkey>', 'Specify the private key to destroy UDT')
+    .option('--privkey <privkey>', 'Specify the private key to destroy UDT (visible in shell history)')
+    .option('--privkey-file <path>', 'Read the private key from a local file')
     .action((amount, options) => __awaiter(void 0, void 0, void 0, function* () {
-    return (0, udt_1.udtDestroy)(amount, options);
+    yield (0, udt_1.udtDestroy)(amount, options);
 }));
 program
     .command('debugger')
@@ -536,10 +560,11 @@ program
 program
     .command('status')
     .description('Show ckb-tui status interface')
-    .option('--network <network>', 'Specify the network whose node status to monitor', 'devnet')
+    .addOption(new commander_1.Option('--network <network>', 'Specify the network whose node status to monitor')
+    .choices(['devnet', 'testnet', 'mainnet'])
+    .default('devnet'))
     .action((option) => __awaiter(void 0, void 0, void 0, function* () {
-    (0, validator_1.validateNetworkOpt)(option.network);
-    return yield (0, status_1.status)({ network: option.network });
+    yield (0, status_1.status)({ network: option.network });
 }));
 program
     .command('config <action> [item] [value]')
@@ -551,10 +576,77 @@ devnetCommand
     .description('Open a full-screen editor to tweak devnet config files')
     .option('-s, --set <key=value>', 'Set a devnet config field non-interactively (repeatable), e.g. --set ckb.logger.filter=info', (value, previous = []) => [...previous, value], [])
     .action(devnet_config_1.devnetConfig);
-program.parse(process.argv);
-// If no command is specified, display help
-if (!process.argv.slice(2).length) {
-    program.outputHelp();
+devnetCommand
+    .command('info')
+    .description('Show fork metadata and node/indexer readiness')
+    .action(() => __awaiter(void 0, void 0, void 0, function* () {
+    yield (0, devnet_info_1.devnetInfo)();
+}));
+devnetCommand
+    .command('fork')
+    .description('Fork an existing mainnet/testnet chain data directory into the local devnet')
+    .option('--from <dir>', 'Path to the source CKB node directory used with `ckb -C`')
+    .option('--source <source>', 'Source chain: mainnet or testnet (auto-detected from the source ckb.toml when omitted)')
+    .option('--spec-file <path>', 'Use a local chain spec file instead of downloading it')
+    .option('--force', 'Replace the existing devnet (or a previous fork)')
+    .option('--migrate', 'Migrate only the copied database when the selected CKB version requires it')
+    .option('--dry-run', 'Run source/spec/database preflight without replacing the current devnet')
+    .action(devnet_fork_1.devnetFork);
+function normalizeGlobalJsonFlag(argv) {
+    const jsonRequested = argv.slice(2).includes('--json');
+    if (!jsonRequested)
+        return argv;
+    return [argv[0], argv[1], '--json', ...argv.slice(2).filter((arg) => arg !== '--json')];
+}
+function installBrokenPipeHandlers() {
+    for (const stream of [process.stdout, process.stderr]) {
+        stream.on('error', (error) => {
+            if (error.code === 'EPIPE') {
+                process.exit(0);
+            }
+            throw error;
+        });
+    }
+}
+function configureCommanderErrors(command) {
+    command.exitOverride();
+    command.configureOutput({
+        writeErr: (text) => {
+            if (!logger_1.logger.isJsonMode())
+                process.stderr.write(text);
+        },
+    });
+    command.commands.forEach(configureCommanderErrors);
+}
+function runCli() {
+    return __awaiter(this, arguments, void 0, function* (argv = process.argv) {
+        installBrokenPipeHandlers();
+        const normalizedArgv = normalizeGlobalJsonFlag(argv);
+        if (normalizedArgv.includes('--json'))
+            logger_1.logger.setJsonMode(true);
+        if (!normalizedArgv.slice(2).length) {
+            program.outputHelp();
+            return;
+        }
+        configureCommanderErrors(program);
+        try {
+            yield program.parseAsync(normalizedArgv);
+            if (logger_1.logger.isJsonMode() && !logger_1.logger.hasResult() && (process.exitCode == null || process.exitCode === 0)) {
+                logger_1.logger.result({ command: activeCommand, completed: true });
+            }
+        }
+        catch (error) {
+            if (error instanceof commander_1.CommanderError && error.exitCode === 0)
+                return;
+            const message = error instanceof Error ? error.message : String(error);
+            const code = error instanceof commander_1.CommanderError ? error.code : 'COMMAND_FAILED';
+            logger_1.logger.failure(code, message);
+            process.exitCode = error instanceof commander_1.CommanderError ? error.exitCode : 1;
+        }
+    });
+}
+if (require.main === require.cache[eval('__filename')]) {
+    void runCli();
 }
 
 
@@ -565,40 +657,90 @@ if (!process.argv.slice(2).length) {
 
 "use strict";
 
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.accounts = accounts;
 const account_json_1 = __importDefault(__nccwpck_require__(13849));
+const core_1 = __nccwpck_require__(39842);
+const setting_1 = __nccwpck_require__(25546);
+const fork_1 = __nccwpck_require__(77912);
+const readiness_1 = __nccwpck_require__(19326);
+const base_1 = __nccwpck_require__(69951);
 const logger_1 = __nccwpck_require__(65370);
 function accounts() {
-    logger_1.logger.warn([
-        '#### All Accounts are for test and develop only  ####'.toUpperCase(),
-        "#### DON'T use these accounts on Mainnet         ####".toUpperCase(),
-        '#### Otherwise You will loose your money         ####'.toUpperCase(),
-        '',
-    ]);
-    logger_1.logger.info([
-        'Print account list, each account is funded with 42_000_000_00000000 capacity in the devnet genesis block.',
-        '',
-    ]);
-    const accountDetails = account_json_1.default.map((account, index) => {
-        return [
-            `- "#": ${index}`,
-            `address: ${account.address}`,
-            `privkey: ${account.privkey}`,
-            `pubkey: ${account.pubkey}`,
-            `lock_arg: ${account.lockScript.args}`,
-            'lockScript:',
-            `    codeHash: ${account.lockScript.codeHash}`,
-            `    hashType: ${account.lockScript.hashType}`,
-            `    args: ${account.lockScript.args}`,
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        const settings = (0, setting_1.readSettings)();
+        const fork = (0, fork_1.readForkState)(settings.devnet.configPath);
+        const isMainnetFork = (fork === null || fork === void 0 ? void 0 : fork.source) === 'mainnet';
+        const client = isMainnetFork
+            ? new core_1.ccc.ClientPublicMainnet({ url: settings.devnet.rpcUrl, fallbacks: [] })
+            : new core_1.ccc.ClientPublicTestnet({ url: settings.devnet.rpcUrl, fallbacks: [] });
+        const context = fork ? `DEVNET (fork of ${fork.source.toUpperCase()})` : 'DEVNET';
+        const readiness = fork ? yield (0, readiness_1.warnIfForkIndexerIsBehind)(base_1.Network.devnet) : undefined;
+        const canReadSpendableBalance = (readiness === null || readiness === void 0 ? void 0 : readiness.ready) === true && readiness.indexerTip != null && readiness.indexerLag === BigInt(0);
+        logger_1.logger.warn([
+            '#### All Accounts are for test and develop only  ####'.toUpperCase(),
+            "#### DON'T use these accounts on Mainnet         ####".toUpperCase(),
+            '#### Otherwise You will lose your money          ####'.toUpperCase(),
             '',
-        ];
-    });
-    accountDetails.forEach((details, _index) => {
-        logger_1.logger.info(details);
+        ]);
+        if (fork) {
+            logger_1.logger.info([
+                `Print account list for ${context}. Addresses use the source-chain prefix.`,
+                'Forked devnets do not include the standard offckb genesis allocation; funds come from fork-mined cellbase cells.',
+                'Run `offckb devnet info` before trusting balances while the indexer catches up.',
+                '',
+            ]);
+        }
+        else {
+            logger_1.logger.info([
+                'Print account list, each account is funded with 42_000_000_00000000 capacity in the devnet genesis block.',
+                '',
+            ]);
+        }
+        const resolvedAccounts = yield Promise.all(account_json_1.default.map((account, index) => __awaiter(this, void 0, void 0, function* () {
+            const script = core_1.ccc.Script.from(account.lockScript);
+            const address = core_1.ccc.Address.fromScript(script, client).toString();
+            const spendableCkb = canReadSpendableBalance
+                ? core_1.ccc.fixedPointToString(yield client.getBalanceSingle(script))
+                : undefined;
+            return Object.assign(Object.assign(Object.assign({ index,
+                address }, (spendableCkb == null ? {} : { spendableCkb })), (options.showPrivateKeys ? { privkey: account.privkey } : {})), { pubkey: account.pubkey, lockArg: account.lockScript.args, lockScript: account.lockScript });
+        })));
+        const accountDetails = resolvedAccounts.map((account) => {
+            return [
+                `- "#": ${account.index}`,
+                `address: ${account.address}`,
+                ...('spendableCkb' in account ? [`spendable_ckb: ${account.spendableCkb}`] : []),
+                ...(options.showPrivateKeys ? [`privkey: ${account.privkey}`] : []),
+                `pubkey: ${account.pubkey}`,
+                `lock_arg: ${account.lockArg}`,
+                'lockScript:',
+                `    codeHash: ${account.lockScript.codeHash}`,
+                `    hashType: ${account.lockScript.hashType}`,
+                `    args: ${account.lockScript.args}`,
+                '',
+            ];
+        });
+        accountDetails.forEach((details, _index) => {
+            logger_1.logger.info(details);
+        });
+        if (!options.showPrivateKeys) {
+            logger_1.logger.info('Private keys are hidden by default. Use --show-private-keys only in a trusted local terminal.');
+        }
+        logger_1.logger.result({ command: 'accounts', context, forked: Boolean(fork), accounts: resolvedAccounts });
+        return resolvedAccounts;
     });
 }
 
@@ -625,10 +767,12 @@ const ckb_1 = __nccwpck_require__(83748);
 const validator_1 = __nccwpck_require__(39534);
 const base_1 = __nccwpck_require__(69951);
 const logger_1 = __nccwpck_require__(65370);
+const readiness_1 = __nccwpck_require__(19326);
 function balanceOf(address_1) {
     return __awaiter(this, arguments, void 0, function* (address, opt = { network: base_1.Network.devnet }) {
         const network = opt.network;
         (0, validator_1.validateNetworkOpt)(network);
+        yield (0, readiness_1.warnIfForkIndexerIsBehind)(network);
         const ckb = new ckb_1.CKB({ network });
         const [balanceInCKB, udtBalances] = yield Promise.all([
             ckb.balance(address),
@@ -642,7 +786,9 @@ function balanceOf(address_1) {
                 logger_1.logger.info(`  ${udt.kind} (args=${udt.args}): ${udt.balance}`);
             }
         }
-        process.exit(0);
+        const result = { command: 'balance', network, address, ckb: balanceInCKB, udt: filtered };
+        logger_1.logger.result(result);
+        return result;
     });
 }
 function filterUdtBalances(balances, opt) {
@@ -686,8 +832,7 @@ function clean(options) {
                 logger_1.logger.info(`Chain data cleaned. Devnet config files preserved.`);
             }
             catch (error) {
-                logger_1.logger.info(`Did you stop running the chain first?`);
-                logger_1.logger.error(error.message);
+                throw new Error(`Failed to clean chain data. Did you stop the chain first? ${error.message}`);
             }
         }
         else {
@@ -703,8 +848,7 @@ function clean(options) {
                 logger_1.logger.info(`Chain data cleaned.`);
             }
             catch (error) {
-                logger_1.logger.info(`Did you stop running the chain first?`);
-                logger_1.logger.error(error.message);
+                throw new Error(`Failed to clean devnet data. Did you stop the chain first? ${error.message}`);
             }
         }
         else {
@@ -761,8 +905,7 @@ function Config(action, item, value) {
                     const settings = (0, setting_1.readSettings)();
                     const proxy = settings.proxy;
                     if (proxy == null) {
-                        logger_1.logger.info(`No Proxy.`);
-                        process.exit(0);
+                        return logger_1.logger.info(`No Proxy.`);
                     }
                     return logger_1.logger.info(`${request_1.Request.proxyConfigToUrl(proxy)}`);
                 }
@@ -787,7 +930,7 @@ function Config(action, item, value) {
                         return (0, setting_1.writeSettings)(settings);
                     }
                     catch (error) {
-                        return logger_1.logger.error(`invalid proxyURL, `, error.message);
+                        throw new Error(`invalid proxyURL: ${error.message}`);
                     }
                 }
                 case ConfigItem.ckbVersion: {
@@ -799,11 +942,11 @@ function Config(action, item, value) {
                             return (0, setting_1.writeSettings)(settings);
                         }
                         else {
-                            return logger_1.logger.error(`invalid version value, ${value}. Check available versions on https://github.com/nervosnetwork/ckb/tags`);
+                            throw new Error(`invalid version value, ${value}. Check available versions on https://github.com/nervosnetwork/ckb/tags`);
                         }
                     }
                     catch (error) {
-                        return logger_1.logger.error(`invalid version value, `, error.message);
+                        throw new Error(`invalid version value: ${error.message}`);
                     }
                 }
                 default:
@@ -923,8 +1066,7 @@ function createScriptProject(name_1) {
             const fullProjectPath = path.resolve(projectPath);
             // Check if directory already exists
             if (fs.existsSync(fullProjectPath)) {
-                logger_1.logger.error(`❌ Directory '${projectPath}' already exists!`);
-                process.exit(1);
+                throw new Error(`Directory '${projectPath}' already exists!`);
             }
             logger_1.logger.info([
                 '📝 Project details:',
@@ -945,8 +1087,7 @@ function createScriptProject(name_1) {
             // Get template directory (adjust path based on whether we're running from source or built)
             const templateDir = possiblePaths.find((p) => fs.existsSync(p)) || possiblePaths[0];
             if (!fs.existsSync(templateDir)) {
-                logger_1.logger.error(`❌ Template directory not found: ${templateDir}`);
-                process.exit(1);
+                throw new Error(`Template directory not found: ${templateDir}`);
             }
             // Initialize template processor
             const processor = new processor_1.TemplateProcessor(templateDir);
@@ -1022,8 +1163,7 @@ function createScriptProject(name_1) {
             }
         }
         catch (error) {
-            logger_1.logger.error(`\n❌ Failed to create project: ${error.message}`);
-            process.exit(1);
+            throw new Error(`Failed to create project: ${error.message}`);
         }
     });
 }
@@ -1089,6 +1229,7 @@ const path_1 = __importDefault(__nccwpck_require__(16928));
 const advanced_1 = __nccwpck_require__(98486);
 const base_1 = __nccwpck_require__(69951);
 const encoding_1 = __nccwpck_require__(6851);
+const json_rpc_1 = __nccwpck_require__(51726);
 const logger_1 = __nccwpck_require__(65370);
 function debugTransaction(txHash, network) {
     return __awaiter(this, void 0, void 0, function* () {
@@ -1159,8 +1300,8 @@ function buildTxFileOptionBy(txHash, network) {
         if (!fs_1.default.existsSync(outputFilePath)) {
             const rpc = settings[network].rpcUrl;
             const txJsonFilePath = buildTransactionJsonFilePath(network, txHash);
-            if (!fs_1.default.existsSync(outputFilePath)) {
-                fs_1.default.mkdirSync(path_1.default.dirname(outputFilePath), { recursive: true });
+            if (!fs_1.default.existsSync(txJsonFilePath)) {
+                yield fetchTransactionIntoCache(rpc, txHash, txJsonFilePath);
             }
             yield (0, ckb_tx_dumper_1.dumpTransaction)({ rpc, txJsonFilePath, outputFilePath });
         }
@@ -1168,6 +1309,23 @@ function buildTxFileOptionBy(txHash, network) {
         return opt;
     });
 }
+// Fallback for transactions that never went through the local RPC proxy
+// (e.g. historical transactions on a forked devnet): pull the transaction
+// from the node and cache it in the same JSON-RPC format the proxy stores.
+function fetchTransactionIntoCache(rpc, txHash, txJsonFilePath) {
+    return __awaiter(this, void 0, void 0, function* () {
+        logger_1.logger.info(`Transaction ${txHash} not found in local cache, fetching from ${rpc} ..`);
+        const result = yield (0, json_rpc_1.callJsonRpc)(rpc, 'get_transaction', [txHash]).catch((error) => {
+            throw new Error(`Failed to fetch transaction ${txHash} from ${rpc}: ${error.message}`);
+        });
+        if (!(result === null || result === void 0 ? void 0 : result.transaction)) {
+            throw new Error(`Transaction ${txHash} not found on ${rpc}. ` +
+                `Check the hash and the --network option, or send the transaction through the offckb RPC proxy first.`);
+        }
+        fs_1.default.mkdirSync(path_1.default.dirname(txJsonFilePath), { recursive: true });
+        fs_1.default.writeFileSync(txJsonFilePath, JSON.stringify(result.transaction, null, 2));
+    });
+}
 function buildTransactionJsonFilePath(network, txHash) {
     const settings = (0, setting_1.readSettings)();
     if (network === base_1.Network.devnet) {
@@ -1230,8 +1388,7 @@ function buildContract(jsFile, outputFile, jsVmPath) {
             logger_1.logger.success(`✅ Contract built successfully: ${outputFile}`);
         }
         catch (error) {
-            logger_1.logger.error(`❌ Build failed: ${error}`);
-            process.exit(1);
+            throw new Error(`Build failed: ${error instanceof Error ? error.message : String(error)}`);
         }
     });
 }
@@ -1267,14 +1424,19 @@ const deploy_1 = __nccwpck_require__(45615);
 const ckb_1 = __nccwpck_require__(83748);
 const prompts_1 = __nccwpck_require__(18167);
 const logger_1 = __nccwpck_require__(65370);
+const private_key_1 = __nccwpck_require__(26241);
+const readiness_1 = __nccwpck_require__(19326);
+const fork_safety_1 = __nccwpck_require__(47625);
 function deploy() {
     return __awaiter(this, arguments, void 0, function* (opt = { network: base_1.Network.devnet, typeId: false, target: './', output: './deployment' }) {
         var _a;
         const network = opt.network;
         (0, validator_1.validateNetworkOpt)(network);
-        const ckb = new ckb_1.CKB({ network });
         // we use deployerAccount to deploy contract by default
-        const privateKey = opt.privkey || account_1.deployerAccount.privkey;
+        const privateKey = (0, private_key_1.resolvePrivateKey)(opt, account_1.deployerAccount.privkey);
+        (0, fork_safety_1.warnIfMainnetForkSigning)(network, privateKey);
+        yield (0, readiness_1.warnIfForkIndexerIsBehind)(network);
+        const ckb = new ckb_1.CKB({ network });
         const enableTypeId = (_a = opt.typeId) !== null && _a !== void 0 ? _a : false;
         const targetFolder = opt.target;
         const output = opt.output;
@@ -1298,7 +1460,7 @@ function deploy() {
             '',
             `   📁 Deployment artifacts will be saved to: ${outputFolder}`,
             `   🌐 Network: ${network}`,
-            `   🔑 Using ${opt.privkey ? 'custom' : 'default'} private key`,
+            `   🔑 Using ${opt.privkey || opt.privkeyFile || process.env.OFFCKB_PRIVATE_KEY ? 'custom' : 'default'} private key`,
             `   🔄 Type ID: ${enableTypeId ? 'enabled (upgradable)' : 'disabled (immutable)'}`,
         ]);
         // Skip confirmation if -y flag is provided
@@ -1344,22 +1506,40 @@ const link_1 = __nccwpck_require__(27814);
 const validator_1 = __nccwpck_require__(39534);
 const request_1 = __nccwpck_require__(65897);
 const logger_1 = __nccwpck_require__(65370);
+const readiness_1 = __nccwpck_require__(19326);
+const fork_safety_1 = __nccwpck_require__(47625);
+const TESTNET_FAUCET_CLAIM_AMOUNT = '10000';
 function deposit(toAddress_1, amountInCKB_1) {
     return __awaiter(this, arguments, void 0, function* (toAddress, amountInCKB, opt = { network: base_1.Network.devnet }) {
         const network = opt.network;
         (0, validator_1.validateNetworkOpt)(network);
         const ckb = new ckb_1.CKB({ network });
         if (network === 'testnet') {
-            return yield depositFromTestnetFaucet(toAddress, ckb);
+            const txHash = yield depositFromTestnetFaucet(toAddress, ckb);
+            logger_1.logger.result({
+                command: 'deposit',
+                network,
+                source: 'fixed-testnet-faucet-claim',
+                requestedAmount: amountInCKB,
+                faucetClaimAmount: TESTNET_FAUCET_CLAIM_AMOUNT,
+                toAddress,
+                txHash,
+            });
+            return txHash;
         }
         // deposit from devnet miner
         const privateKey = account_1.ckbDevnetMinerAccount.privkey;
+        const rejectInputsAtOrBeforeBlock = (0, fork_safety_1.validateMainnetForkSigning)(network, privateKey);
+        yield (0, readiness_1.warnIfForkIndexerIsBehind)(network);
         const txHash = yield ckb.transfer({
             toAddress,
             privateKey,
             amountInCKB,
+            rejectInputsAtOrBeforeBlock,
         });
         logger_1.logger.info('tx hash: ', txHash);
+        logger_1.logger.result({ command: 'deposit', network, amount: amountInCKB, toAddress, txHash });
+        return txHash;
     });
 }
 function depositFromTestnetFaucet(ckbAddress, ckb) {
@@ -1385,6 +1565,7 @@ function depositFromTestnetFaucet(ckbAddress, ckb) {
         }
         const txHash = yield ckb.transferAll({ privateKey: randomAccountPrivateKey, toAddress: ckbAddress });
         logger_1.logger.info(`Done, check ${(0, link_1.buildTestnetTxLink)(txHash)} for details.`);
+        return txHash;
     });
 }
 function sendClaimRequest(toAddress) {
@@ -1400,7 +1581,7 @@ function sendClaimRequest(toAddress) {
         const body = JSON.stringify({
             claim_event: {
                 address_hash: toAddress,
-                amount: '10000', // unit: CKB
+                amount: TESTNET_FAUCET_CLAIM_AMOUNT, // unit: CKB
             },
         });
         const config = {
@@ -1482,12 +1663,8 @@ function devnetConfig() {
                 return;
             }
             if (!process.stdin.isTTY || !process.stdout.isTTY) {
-                logger_1.logger.error('Interactive devnet config editor requires a TTY terminal.');
-                logger_1.logger.info('Use non-interactive mode instead, e.g.:');
-                logger_1.logger.info('  offckb devnet config --set ckb.logger.filter=info');
-                logger_1.logger.info('  offckb devnet config --set miner.client.poll_interval=1500');
-                process.exitCode = 1;
-                return;
+                throw new Error('Interactive devnet config editor requires a TTY terminal. Use non-interactive mode, e.g. ' +
+                    '`offckb devnet config --set ckb.logger.filter=info`.');
             }
             const isSaved = yield (0, devnet_config_tui_1.runDevnetConfigTui)(editor, configPath);
             if (isSaved) {
@@ -1498,13 +1675,121 @@ function devnetConfig() {
             logger_1.logger.info('No changes saved.');
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            logger_1.logger.error(message);
+            let message = error instanceof Error ? error.message : String(error);
             if (error instanceof config_editor_1.InitializationError) {
-                logger_1.logger.info('Tip: run `offckb node` once to initialize devnet config files first.');
+                message += ' Tip: run `offckb node` once to initialize devnet config files first.';
             }
-            process.exitCode = 1;
+            throw new Error(message);
+        }
+    });
+}
+
+
+/***/ }),
+
+/***/ 36709:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.devnetFork = devnetFork;
+const fork_1 = __nccwpck_require__(77912);
+function devnetFork(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (options.source && options.source !== 'mainnet' && options.source !== 'testnet') {
+            throw new Error(`Invalid --source value: ${options.source}. Expected mainnet or testnet.`);
         }
+        yield (0, fork_1.forkDevnet)(options);
+    });
+}
+
+
+/***/ }),
+
+/***/ 60905:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.devnetInfo = devnetInfo;
+const setting_1 = __nccwpck_require__(25546);
+const fork_1 = __nccwpck_require__(77912);
+const readiness_1 = __nccwpck_require__(19326);
+const logger_1 = __nccwpck_require__(65370);
+function devnetInfo() {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const settings = (0, setting_1.readSettings)();
+        const fork = (0, fork_1.readForkState)(settings.devnet.configPath);
+        const readiness = yield (0, readiness_1.checkNodeReadiness)(settings.devnet.rpcUrl);
+        const indexerReady = readiness.indexerTip != null && readiness.indexerLag === BigInt(0);
+        const networkIsolated = fork && readiness.peers != null ? readiness.peers === 0 : undefined;
+        const result = {
+            command: 'devnet.info',
+            kind: fork ? `fork-of-${fork.source}` : 'pure-devnet',
+            configPath: settings.devnet.configPath,
+            rpcUrl: settings.devnet.rpcUrl,
+            proxyUrl: `http://127.0.0.1:${settings.devnet.rpcProxyPort}`,
+            ready: readiness.ready,
+            nodeTip: (_a = readiness.nodeTip) === null || _a === void 0 ? void 0 : _a.toString(),
+            indexerTip: (_b = readiness.indexerTip) === null || _b === void 0 ? void 0 : _b.toString(),
+            indexerLag: (_c = readiness.indexerLag) === null || _c === void 0 ? void 0 : _c.toString(),
+            indexerReady,
+            peers: readiness.peers,
+            networkIsolated,
+            error: readiness.error,
+            fork,
+        };
+        logger_1.logger.info(`Devnet: ${result.kind}`);
+        logger_1.logger.info(`RPC: ${result.rpcUrl}`);
+        logger_1.logger.info(`Proxy RPC: ${result.proxyUrl}`);
+        logger_1.logger.info(`Node ready: ${result.ready ? 'yes' : 'no'}`);
+        if (readiness.nodeTip != null)
+            logger_1.logger.info(`Node tip: ${readiness.nodeTip}`);
+        if (readiness.indexerTip != null)
+            logger_1.logger.info(`Indexer tip: ${readiness.indexerTip}`);
+        if (readiness.indexerLag != null) {
+            const message = `Indexer lag: ${readiness.indexerLag}`;
+            if (readiness.indexerLag > BigInt(0))
+                logger_1.logger.warn(`${message}; indexed queries may be stale.`);
+            else
+                logger_1.logger.info(message);
+        }
+        logger_1.logger.info(`Indexer ready: ${indexerReady ? 'yes' : 'no'}`);
+        if (readiness.peers != null)
+            logger_1.logger.info(`Peers: ${readiness.peers}`);
+        if (fork)
+            logger_1.logger.info(`Public network isolated: ${networkIsolated == null ? 'unknown' : networkIsolated ? 'yes' : 'NO'}`);
+        if (fork && readiness.peers != null && readiness.peers > 0) {
+            logger_1.logger.warn('A forked devnet has connected peers. Stop it and inspect ckb.toml before signing or mining.');
+        }
+        if ((fork === null || fork === void 0 ? void 0 : fork.source) === 'mainnet') {
+            logger_1.logger.warn('MAINNET FORK REPLAY RISK: only sign with built-in dev keys and fork-mined cells.');
+        }
+        if (readiness.error)
+            logger_1.logger.warn(readiness.error);
+        logger_1.logger.result(result);
+        return result;
     });
 }
 
@@ -1570,14 +1855,23 @@ const path = __importStar(__nccwpck_require__(16928));
 const init_chain_1 = __nccwpck_require__(1360);
 const install_1 = __nccwpck_require__(65611);
 const setting_1 = __nccwpck_require__(25546);
-const encoding_1 = __nccwpck_require__(6851);
 const rpc_proxy_1 = __nccwpck_require__(46589);
+const fork_1 = __nccwpck_require__(77912);
+const json_rpc_1 = __nccwpck_require__(51726);
 const base_1 = __nccwpck_require__(69951);
 const logger_1 = __nccwpck_require__(65370);
+const readiness_1 = __nccwpck_require__(19326);
 const DAEMON_LOG_DIR = 'logs';
 const DAEMON_LOG_FILE = 'daemon.log';
 const DAEMON_PID_FILE = 'daemon.pid';
 const DAEMON_CHILD_ENV = 'OFFCKB_DAEMON_CHILD';
+const NODE_READY_TIMEOUT_MS = 90000;
+const FORK_NODE_READY_TIMEOUT_MS = 10 * 60000;
+function cleanChildOutput(data) {
+    // CKB colors its output even when it is redirected. Strip ANSI control
+    // sequences so JSON logs stay machine-readable.
+    return String(data).replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, '');
+}
 function startNode({ version, network = base_1.Network.devnet, binaryPath, daemon }) {
     if (binaryPath && network !== base_1.Network.devnet) {
         logger_1.logger.warn('Custom binaryPath is only supported for devnet. The provided binaryPath will be ignored.');
@@ -1598,7 +1892,7 @@ function startNode({ version, network = base_1.Network.devnet, binaryPath, daemo
 }
 function nodeDevnet(_a) {
     return __awaiter(this, arguments, void 0, function* ({ version, binaryPath, daemon }) {
-        var _b, _c;
+        var _b, _c, _d, _e, _f;
         if (daemon) {
             return startDaemon();
         }
@@ -1606,54 +1900,114 @@ function nodeDevnet(_a) {
         const ckbVersion = version || settings.bins.defaultCKBVersion;
         let ckbBinPath = '';
         if (binaryPath) {
-            ckbBinPath = (0, encoding_1.encodeBinPathForTerminal)(binaryPath);
+            ckbBinPath = binaryPath;
             logger_1.logger.info(`Using custom CKB binary path: ${ckbBinPath}`);
         }
         else {
             yield (0, install_1.installCKBBinary)(ckbVersion);
-            ckbBinPath = (0, encoding_1.encodeBinPathForTerminal)((0, setting_1.getCKBBinaryPath)(ckbVersion));
+            ckbBinPath = (0, setting_1.getCKBBinaryPath)(ckbVersion);
         }
         yield (0, init_chain_1.initChainIfNeeded)();
-        const devnetConfigPath = (0, encoding_1.encodeBinPathForTerminal)(settings.devnet.configPath);
-        const ckbCmd = `${ckbBinPath} run -C ${devnetConfigPath}`;
-        const minerCmd = `${ckbBinPath} miner -C ${devnetConfigPath}`;
+        const devnetConfigPath = settings.devnet.configPath;
+        // A forked devnet must boot once with --skip-spec-check --overwrite-spec so
+        // the imported (and patched) spec replaces the source chain's stored spec.
+        const forkState = (0, fork_1.readForkState)(settings.devnet.configPath);
+        const firstRunFlags = (forkState === null || forkState === void 0 ? void 0 : forkState.firstRunPending) ? ' --skip-spec-check --overwrite-spec' : '';
+        if (forkState === null || forkState === void 0 ? void 0 : forkState.firstRunPending) {
+            logger_1.logger.info(`Forked devnet (${forkState.source}) detected, first run uses --skip-spec-check --overwrite-spec.`);
+        }
         logger_1.logger.info(`Launching CKB devnet Node...`);
+        const runArgs = ['run', '-C', devnetConfigPath];
+        if (firstRunFlags)
+            runArgs.push('--skip-spec-check', '--overwrite-spec');
+        const ckbProcess = (0, child_process_1.spawn)(ckbBinPath, runArgs, { stdio: ['ignore', 'pipe', 'pipe'] });
+        (_b = ckbProcess.stdout) === null || _b === void 0 ? void 0 : _b.on('data', (data) => logger_1.logger.info(['CKB:', cleanChildOutput(data)]));
+        (_c = ckbProcess.stderr) === null || _c === void 0 ? void 0 : _c.on('data', (data) => logger_1.logger.error(['CKB error:', cleanChildOutput(data)]));
+        let ckbExited = false;
+        ckbProcess.once('exit', () => {
+            ckbExited = true;
+        });
+        ckbProcess.once('error', () => {
+            ckbExited = true;
+        });
+        const timeoutMs = forkState ? FORK_NODE_READY_TIMEOUT_MS : NODE_READY_TIMEOUT_MS;
+        const readiness = yield (0, readiness_1.waitForNodeReady)(settings.devnet.rpcUrl, timeoutMs, () => !ckbExited);
+        if (!readiness.ready) {
+            if (!ckbExited)
+                ckbProcess.kill('SIGTERM');
+            throw new Error(`CKB devnet failed to become ready: ${(_d = readiness.error) !== null && _d !== void 0 ? _d : 'CKB process exited'}`);
+        }
+        if (ckbExited) {
+            throw new Error('CKB devnet exited immediately after its readiness check.');
+        }
+        if (forkState === null || forkState === void 0 ? void 0 : forkState.firstRunPending) {
+            yield clearForkFirstRunWhenNodeUp(ckbProcess, settings.devnet.rpcUrl, settings.devnet.configPath, forkState.genesisHash);
+        }
+        let minerProcess;
         try {
-            // Run first command
-            const ckbProcess = (0, child_process_1.exec)(ckbCmd);
-            // Log first command's output
-            (_b = ckbProcess.stdout) === null || _b === void 0 ? void 0 : _b.on('data', (data) => {
-                logger_1.logger.info(['CKB:', data.toString()]);
-            });
-            (_c = ckbProcess.stderr) === null || _c === void 0 ? void 0 : _c.on('data', (data) => {
-                logger_1.logger.error(['CKB error:', data.toString()]);
-            });
-            // Start the second command after 3 seconds
-            setTimeout(() => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b;
-                try {
-                    // Run second command
-                    const minerProcess = (0, child_process_1.exec)(minerCmd);
-                    (_a = minerProcess.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (data) => {
-                        logger_1.logger.info(['CKB-Miner:', data.toString()]);
-                    });
-                    (_b = minerProcess.stderr) === null || _b === void 0 ? void 0 : _b.on('data', (data) => {
-                        logger_1.logger.error(['CKB-Miner error:', data.toString()]);
-                    });
-                    // by default we start the proxy server
-                    const ckbRpc = settings.devnet.rpcUrl;
-                    const port = settings.devnet.rpcProxyPort;
-                    const proxy = (0, rpc_proxy_1.createRPCProxy)(base_1.Network.devnet, ckbRpc, port);
-                    proxy.start();
-                }
-                catch (error) {
-                    logger_1.logger.error('Error running CKB-Miner:', error);
-                }
-            }), 3000);
+            minerProcess = (0, child_process_1.spawn)(ckbBinPath, ['miner', '-C', devnetConfigPath], { stdio: ['ignore', 'pipe', 'pipe'] });
         }
         catch (error) {
-            logger_1.logger.error('Error:', error);
+            ckbProcess.kill('SIGTERM');
+            throw new Error(`CKB miner failed to start: ${error.message}`);
         }
+        (_e = minerProcess.stdout) === null || _e === void 0 ? void 0 : _e.on('data', (data) => logger_1.logger.info(['CKB-Miner:', cleanChildOutput(data)]));
+        (_f = minerProcess.stderr) === null || _f === void 0 ? void 0 : _f.on('data', (data) => logger_1.logger.error(['CKB-Miner error:', cleanChildOutput(data)]));
+        try {
+            yield waitForChildSpawn(minerProcess, 'CKB miner');
+        }
+        catch (error) {
+            ckbProcess.kill('SIGTERM');
+            throw error;
+        }
+        if (ckbExited) {
+            if (!minerProcess.killed)
+                minerProcess.kill('SIGTERM');
+            throw new Error('CKB devnet exited while the miner was starting.');
+        }
+        const proxy = (0, rpc_proxy_1.createRPCProxy)(base_1.Network.devnet, settings.devnet.rpcUrl, settings.devnet.rpcProxyPort);
+        proxy.start();
+        logger_1.logger.success(`CKB devnet is ready at ${settings.devnet.rpcUrl}.`);
+        logger_1.logger.result({
+            command: 'node',
+            network: base_1.Network.devnet,
+            daemon: false,
+            rpcUrl: settings.devnet.rpcUrl,
+            proxyUrl: `http://127.0.0.1:${settings.devnet.rpcProxyPort}`,
+        });
+        // Treat CKB, miner and proxy as one service. A dead CKB must not leave a
+        // healthy-looking proxy and a miner that retries forever.
+        let serviceStopping = false;
+        const stopService = (component, code, signal) => {
+            if (serviceStopping)
+                return;
+            serviceStopping = true;
+            if (component !== 'CKB node' && !ckbProcess.killed)
+                ckbProcess.kill('SIGTERM');
+            if (component !== 'CKB miner' && !minerProcess.killed)
+                minerProcess.kill('SIGTERM');
+            proxy.stop();
+            if (process.env[DAEMON_CHILD_ENV] === '1')
+                cleanupPidFile(resolveDaemonPaths().pidFile);
+            logger_1.logger.error(`${component} exited unexpectedly (code=${code !== null && code !== void 0 ? code : 'null'}, signal=${signal !== null && signal !== void 0 ? signal : 'none'}).`);
+            process.exitCode = typeof code === 'number' && code > 0 ? code : 1;
+        };
+        ckbProcess.once('exit', (code, signal) => stopService('CKB node', code, signal));
+        minerProcess.once('exit', (code, signal) => stopService('CKB miner', code, signal));
+    });
+}
+function waitForChildSpawn(child, label) {
+    return new Promise((resolve, reject) => {
+        const onSpawn = () => {
+            child.removeListener('error', onError);
+            resolve();
+        };
+        const onError = (error) => {
+            child.removeListener('spawn', onSpawn);
+            reject(new Error(`${label} failed to start: ${error.message}`));
+        };
+        child.once('spawn', onSpawn);
+        child.once('error', onError);
     });
 }
 function resolveDaemonPaths() {
@@ -1663,6 +2017,49 @@ function resolveDaemonPaths() {
     const pidFile = path.join(logDir, DAEMON_PID_FILE);
     return { logDir, logFile, pidFile };
 }
+// Poll the devnet RPC until the spawned node answers with the fork's genesis
+// hash, then mark the first run as done so subsequent `offckb node` runs boot
+// normally. Two guards against clearing the flag on the wrong signal:
+//   - the poll aborts when the spawned ckb process exits (e.g. failed boot),
+//   - an answering node is only trusted when its genesis matches the fork
+//     state — an unrelated node occupying the port must not clear the flag.
+function clearForkFirstRunWhenNodeUp(ckbProcess, rpcUrl, configPath, expectedGenesisHash) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let processExited = false;
+        const markExited = () => {
+            processExited = true;
+        };
+        ckbProcess.once('exit', markExited);
+        ckbProcess.once('error', markExited);
+        const timeoutMs = 10 * 60 * 1000; // large forks take a while to boot
+        const start = Date.now();
+        while (!processExited && Date.now() - start < timeoutMs) {
+            try {
+                const genesisHash = String(yield (0, json_rpc_1.callJsonRpc)(rpcUrl, 'get_block_hash', ['0x0'], 5000)).toLowerCase();
+                if (genesisHash !== expectedGenesisHash.toLowerCase()) {
+                    logger_1.logger.warn(`A node is answering at ${rpcUrl} but reports a different genesis (${genesisHash}); ` +
+                        'leaving the first-run flags in place.');
+                    return;
+                }
+                // The miner has not started yet, so this tip is the exact boundary
+                // between copied public-chain state and cells mined on the local fork.
+                const forkBlockNumber = BigInt(String(yield (0, json_rpc_1.callJsonRpc)(rpcUrl, 'get_tip_block_number', [], 5000))).toString();
+                (0, fork_1.markForkFirstRunComplete)(configPath, forkBlockNumber);
+                logger_1.logger.success('Forked devnet is up; first-run spec flags cleared.');
+                return;
+            }
+            catch (_a) {
+                yield new Promise((resolve) => setTimeout(resolve, 1000));
+            }
+        }
+        if (processExited) {
+            logger_1.logger.warn('The CKB process exited before the forked devnet came up; first-run flags will be retried next time.');
+        }
+        else {
+            logger_1.logger.warn('Timed out waiting for the forked devnet to start; first-run flags will be retried next time.');
+        }
+    });
+}
 function readPidFile(pidFile) {
     var _a, _b;
     let raw;
@@ -1689,6 +2086,7 @@ function readPidFile(pidFile) {
                 pid,
                 scriptPath: parsed.scriptPath,
                 startedAt: (_b = parsed.startedAt) !== null && _b !== void 0 ? _b : new Date(0).toISOString(),
+                status: parsed.status,
             };
         }
     }
@@ -1702,6 +2100,39 @@ function readPidFile(pidFile) {
 function writePidFile(pidFile, metadata) {
     fs.writeFileSync(pidFile, JSON.stringify(metadata, null, 2));
 }
+function reservePidFile(pidFile, scriptPath) {
+    let fd;
+    try {
+        fd = fs.openSync(pidFile, 'wx');
+    }
+    catch (error) {
+        const err = error;
+        if (err.code === 'EEXIST') {
+            throw new Error('A CKB devnet daemon startup is already in progress. Try again after it completes.');
+        }
+        throw new Error(`Failed to reserve daemon PID file ${pidFile}: ${err.message}`);
+    }
+    let writeError;
+    try {
+        const reservation = {
+            pid: process.pid,
+            scriptPath,
+            startedAt: new Date().toISOString(),
+            status: 'starting',
+        };
+        fs.writeFileSync(fd, JSON.stringify(reservation, null, 2));
+    }
+    catch (error) {
+        writeError = error;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    if (writeError) {
+        cleanupPidFile(pidFile);
+        throw new Error(`Failed to initialize daemon PID reservation ${pidFile}: ${writeError.message}`);
+    }
+}
 function resolveCliEntry() {
     var _a;
     // In priority order. process.argv[1] is the most reliable for a Node CLI.
@@ -1723,12 +2154,19 @@ function resolveCliEntry() {
     return null;
 }
 function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
     try {
         process.kill(pid, 0);
         return true;
     }
-    catch (_a) {
-        return false;
+    catch (error) {
+        const err = error;
+        if (err.code === 'ESRCH')
+            return false;
+        if (err.code === 'EPERM')
+            throw new Error(`Permission denied when checking daemon process ${pid}.`);
+        throw error;
     }
 }
 function cleanupPidFile(pidFile) {
@@ -1741,10 +2179,16 @@ function cleanupPidFile(pidFile) {
 }
 function waitForProcessExit(pid, timeoutMs) {
     const start = Date.now();
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
         const check = () => {
-            if (!isProcessAlive(pid)) {
-                resolve(true);
+            try {
+                if (!isProcessAlive(pid)) {
+                    resolve(true);
+                    return;
+                }
+            }
+            catch (error) {
+                reject(error);
                 return;
             }
             if (Date.now() - start >= timeoutMs) {
@@ -1824,73 +2268,159 @@ function terminateProcess(pid, signal) {
         }
     });
 }
+function failDaemonStartup(error, pid, pidFile) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let exited = false;
+        try {
+            exited = !isProcessAlive(pid);
+            if (!exited) {
+                yield terminateProcess(pid, 'SIGTERM');
+                exited = yield waitForProcessExit(pid, 5000);
+                if (!exited) {
+                    yield terminateProcess(pid, 'SIGKILL');
+                    exited = yield waitForProcessExit(pid, 5000);
+                }
+            }
+        }
+        catch (_a) {
+            // The child may have exited while cleanup signals were sent. If liveness
+            // cannot be checked, preserve the PID file for a later explicit stop.
+            try {
+                exited = !isProcessAlive(pid);
+            }
+            catch (_b) {
+                exited = false;
+            }
+        }
+        if (exited) {
+            cleanupPidFile(pidFile);
+        }
+        else {
+            error.message += ` Process ${pid} is still running; PID file was preserved.`;
+        }
+        throw error;
+    });
+}
 function startDaemon() {
-    const { logDir, logFile, pidFile } = resolveDaemonPaths();
-    // Prevent duplicate daemon starts. If a daemon is already running, refuse
-    // to overwrite its PID file.
-    const existing = readPidFile(pidFile);
-    if (existing && isProcessAlive(existing.pid)) {
-        logger_1.logger.error(`A CKB devnet daemon is already running (PID ${existing.pid}). Stop it first with: offckb node stop`);
-        return;
-    }
-    if (existing && !isProcessAlive(existing.pid)) {
-        // Stale PID file from a crashed daemon; clean it up before starting anew.
-        cleanupPidFile(pidFile);
-    }
-    let out;
-    let err;
-    try {
-        fs.mkdirSync(logDir, { recursive: true });
-        out = fs.openSync(logFile, 'a');
-        err = fs.openSync(logFile, 'a');
-    }
-    catch (error) {
-        logger_1.logger.error(`Failed to prepare daemon log directory or log file at ${logFile}:`, error);
-        return;
-    }
-    const scriptPath = resolveCliEntry();
-    if (!scriptPath) {
-        logger_1.logger.error('Unable to determine the CLI entry point for daemon mode. Set OFFCKB_CLI_PATH to the offckb script.');
-        closeFileDescriptors(out, err);
-        return;
-    }
-    const childArgs = process.argv.slice(2).filter((arg) => arg !== '--daemon');
-    const childEnv = Object.assign(Object.assign({}, process.env), { [DAEMON_CHILD_ENV]: '1' });
-    let child;
-    try {
-        child = (0, child_process_1.spawn)(process.execPath, [scriptPath, ...childArgs], {
-            detached: true,
-            stdio: ['ignore', out, err],
-            env: childEnv,
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const { logDir, logFile, pidFile } = resolveDaemonPaths();
+        try {
+            fs.mkdirSync(logDir, { recursive: true });
+        }
+        catch (error) {
+            throw new Error(`Failed to prepare daemon log directory at ${logDir}: ${error.message}`);
+        }
+        const settings = (0, setting_1.readSettings)();
+        const activeNode = yield (0, readiness_1.checkNodeReadiness)(settings.devnet.rpcUrl, 1000);
+        if (activeNode.ready) {
+            throw new Error(`A CKB node is already answering at ${settings.devnet.rpcUrl}. Stop it before starting daemon mode.`);
+        }
+        // Prevent duplicate daemon starts. If a daemon is already running, refuse
+        // to overwrite its PID file.
+        const existing = readPidFile(pidFile);
+        if (existing) {
+            if (isProcessAlive(existing.pid)) {
+                const identityOk = yield verifyDaemonIdentity(existing.pid, existing);
+                if (identityOk) {
+                    if (existing.status === 'starting') {
+                        throw new Error(`Another CKB devnet daemon startup is already in progress (PID ${existing.pid}).`);
+                    }
+                    throw new Error(`A CKB devnet daemon is already running (PID ${existing.pid}). Stop it first with: offckb node stop`);
+                }
+                logger_1.logger.warn(`PID ${existing.pid} from ${pidFile} belongs to another process; removing stale daemon metadata without signaling it.`);
+            }
+            // Stale PID file from a crashed daemon; clean it up before atomically
+            // reserving the same control file for this startup attempt.
+            cleanupPidFile(pidFile);
+        }
+        const scriptPath = resolveCliEntry();
+        if (!scriptPath) {
+            throw new Error('Unable to determine the CLI entry point for daemon mode. Set OFFCKB_CLI_PATH to the offckb script.');
+        }
+        reservePidFile(pidFile, scriptPath);
+        let out;
+        let err;
+        try {
+            out = fs.openSync(logFile, 'a');
+            err = fs.openSync(logFile, 'a');
+        }
+        catch (error) {
+            closeFileDescriptors(out, err);
+            cleanupPidFile(pidFile);
+            throw new Error(`Failed to prepare daemon log directory or log file at ${logFile}: ${error.message}`);
+        }
+        const childArgs = process.argv.slice(2).filter((arg) => arg !== '--daemon');
+        const childEnv = Object.assign(Object.assign({}, process.env), { [DAEMON_CHILD_ENV]: '1' });
+        let child;
+        try {
+            child = (0, child_process_1.spawn)(process.execPath, [scriptPath, ...childArgs], {
+                detached: true,
+                stdio: ['ignore', out, err],
+                env: childEnv,
+            });
+        }
+        catch (error) {
+            closeFileDescriptors(out, err);
+            cleanupPidFile(pidFile);
+            throw new Error(`Failed to spawn daemon process: ${error.message}`);
+        }
+        if (!child.pid) {
+            closeFileDescriptors(out, err);
+            cleanupPidFile(pidFile);
+            throw new Error('Failed to spawn daemon process: no PID returned.');
+        }
+        child.unref();
+        child.on('error', (error) => {
+            logger_1.logger.error('Daemon child process failed to start:', error);
+            cleanupPidFile(pidFile);
         });
-    }
-    catch (error) {
-        logger_1.logger.error('Failed to spawn daemon process:', error);
-        closeFileDescriptors(out, err);
-        return;
-    }
-    if (!child.pid) {
-        logger_1.logger.error('Failed to spawn daemon process: no PID returned.');
+        const metadata = {
+            pid: child.pid,
+            scriptPath,
+            startedAt: new Date().toISOString(),
+            status: 'starting',
+        };
+        try {
+            writePidFile(pidFile, metadata);
+        }
+        catch (error) {
+            closeFileDescriptors(out, err);
+            return failDaemonStartup(error, child.pid, pidFile);
+        }
+        // File descriptors are now owned by the spawned child; close our copies.
         closeFileDescriptors(out, err);
-        return;
-    }
-    child.unref();
-    child.on('error', (error) => {
-        logger_1.logger.error('Daemon child process failed to start:', error);
-        cleanupPidFile(pidFile);
+        const proxyUrl = `http://127.0.0.1:${settings.devnet.rpcProxyPort}`;
+        try {
+            const forkState = (0, fork_1.readForkState)(settings.devnet.configPath);
+            const timeoutMs = forkState ? FORK_NODE_READY_TIMEOUT_MS : NODE_READY_TIMEOUT_MS;
+            // The proxy only starts after the child has a healthy CKB RPC and has
+            // successfully spawned the miner, so this is the daemon's service-level
+            // readiness check rather than a port/process check.
+            const readiness = yield (0, readiness_1.waitForNodeReady)(proxyUrl, timeoutMs, () => isProcessAlive(child.pid));
+            if (!readiness.ready) {
+                throw new Error(`CKB devnet daemon failed to become ready. See ${logFile}. ${(_a = readiness.error) !== null && _a !== void 0 ? _a : 'Daemon process exited.'}`);
+            }
+            writePidFile(pidFile, Object.assign(Object.assign({}, metadata), { status: 'running' }));
+        }
+        catch (error) {
+            return failDaemonStartup(error, child.pid, pidFile);
+        }
+        logger_1.logger.success(`CKB devnet daemon started with PID ${child.pid} and passed its RPC/proxy health check.`);
+        logger_1.logger.info(`Logs: ${logFile}`);
+        logger_1.logger.info(`PID file: ${pidFile}`);
+        logger_1.logger.info('Stop the daemon with: offckb node stop');
+        logger_1.logger.result({
+            command: 'node',
+            network: base_1.Network.devnet,
+            daemon: true,
+            pid: child.pid,
+            rpcUrl: settings.devnet.rpcUrl,
+            proxyUrl,
+            logFile,
+            pidFile,
+        });
     });
-    const metadata = {
-        pid: child.pid,
-        scriptPath,
-        startedAt: new Date().toISOString(),
-    };
-    writePidFile(pidFile, metadata);
-    // File descriptors are now owned by the spawned child; close our copies.
-    closeFileDescriptors(out, err);
-    logger_1.logger.success(`CKB devnet daemon started with PID ${child.pid}.`);
-    logger_1.logger.info(`Logs: ${logFile}`);
-    logger_1.logger.info(`PID file: ${pidFile}`);
-    logger_1.logger.info('Stop the daemon with: offckb node stop');
 }
 function closeFileDescriptors(...fds) {
     for (const fd of fds) {
@@ -1910,24 +2440,28 @@ function stopNode() {
         const metadata = readPidFile(pidFile);
         if (!metadata) {
             logger_1.logger.warn(`No daemon PID file found at ${pidFile}. Is the devnet daemon running?`);
+            logger_1.logger.result({ command: 'node.stop', stopped: false, reason: 'not-running' });
             return;
         }
         const pid = metadata.pid;
         if (!Number.isInteger(pid) || pid <= 0) {
-            logger_1.logger.error(`Invalid PID in ${pidFile}: ${pid}`);
             cleanupPidFile(pidFile);
-            return;
+            throw new Error(`Invalid PID in ${pidFile}: ${pid}`);
         }
-        if (!isProcessAlive(pid)) {
+        const processAlive = isProcessAlive(pid);
+        if (!processAlive) {
             logger_1.logger.warn(`Daemon process ${pid} is not running.`);
             cleanupPidFile(pidFile);
+            logger_1.logger.result({ command: 'node.stop', stopped: false, reason: 'stale-pid', pid });
             return;
         }
+        if (metadata.status === 'starting') {
+            throw new Error(`CKB devnet daemon startup is still in progress (PID ${pid}). Try stopping it again shortly.`);
+        }
         const identityOk = yield verifyDaemonIdentity(pid, metadata);
         if (!identityOk) {
-            logger_1.logger.error(`Process ${pid} does not appear to be the offckb daemon. Refusing to send signals to avoid killing an unrelated process. ` +
+            throw new Error(`Process ${pid} does not appear to be the offckb daemon. Refusing to send signals to avoid killing an unrelated process. ` +
                 `If you are sure this is the daemon, stop it manually and remove ${pidFile}.`);
-            return;
         }
         logger_1.logger.info(`Stopping CKB devnet daemon (PID ${pid})...`);
         try {
@@ -1938,17 +2472,13 @@ function stopNode() {
             if (err.code === 'ESRCH') {
                 logger_1.logger.warn(`Daemon process ${pid} is not running.`);
                 cleanupPidFile(pidFile);
+                logger_1.logger.result({ command: 'node.stop', stopped: false, reason: 'already-exited', pid });
                 return;
             }
             if (err.code === 'EPERM') {
-                logger_1.logger.error(`Permission denied when sending SIGTERM to daemon process ${pid}.`);
+                throw new Error(`Permission denied when sending SIGTERM to daemon process ${pid}.`);
             }
-            else {
-                logger_1.logger.error(`Failed to send SIGTERM to daemon process ${pid}:`, error);
-            }
-            // Still try to clean up the PID file so the user can recover.
-            cleanupPidFile(pidFile);
-            return;
+            throw new Error(`Failed to send SIGTERM to daemon process ${pid}: ${err.message}`);
         }
         const exited = yield waitForProcessExit(pid, 5000);
         if (!exited) {
@@ -1957,11 +2487,12 @@ function stopNode() {
                 yield terminateProcess(pid, 'SIGKILL');
             }
             catch (error) {
-                logger_1.logger.error(`Failed to send SIGKILL to daemon process ${pid}:`, error);
+                throw new Error(`Failed to send SIGKILL to daemon process ${pid}: ${error.message}`);
             }
         }
         cleanupPidFile(pidFile);
         logger_1.logger.success('CKB devnet daemon stopped.');
+        logger_1.logger.result({ command: 'node.stop', stopped: true, pid });
     });
 }
 function nodeTestnet() {
@@ -1995,39 +2526,6 @@ function nodeMainnet() {
 
 "use strict";
 
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -2042,8 +2540,7 @@ exports.status = status;
 const setting_1 = __nccwpck_require__(25546);
 const ckb_tui_1 = __nccwpck_require__(7020);
 const base_1 = __nccwpck_require__(69951);
-const logger_1 = __nccwpck_require__(65370);
-const net = __importStar(__nccwpck_require__(69278));
+const readiness_1 = __nccwpck_require__(19326);
 const NETWORK_SETTINGS_KEY = {
     [base_1.Network.devnet]: 'devnet',
     [base_1.Network.testnet]: 'testnet',
@@ -2051,65 +2548,27 @@ const NETWORK_SETTINGS_KEY = {
 };
 function status(_a) {
     return __awaiter(this, arguments, void 0, function* ({ network }) {
-        var _b;
+        var _b, _c;
         // ckb-tui is an interactive terminal UI. Running it without a TTY
         // (pipe, redirect, CI) would hang or produce garbage output.
         if (!process.stdout.isTTY || !process.stdin.isTTY) {
-            logger_1.logger.error('The status command requires an interactive terminal (TTY). ' +
-                'It cannot be used in pipes, redirects, or non-interactive environments like CI.');
-            process.exit(1);
+            throw new Error('The status command requires an interactive terminal (TTY). It cannot be used in pipes, redirects, or CI.');
         }
         const settings = (0, setting_1.readSettings)();
         const networkKey = NETWORK_SETTINGS_KEY[network];
         const port = settings[networkKey].rpcProxyPort;
         const url = `http://127.0.0.1:${port}`;
-        const isListening = yield isRPCPortListening(port);
-        if (!isListening) {
-            logger_1.logger.error(`RPC port ${port} is not listening. Please make sure the ${network} node is running and Proxy RPC is enabled.`);
-            return;
+        const readiness = yield (0, readiness_1.checkNodeReadiness)(url);
+        if (!readiness.ready) {
+            throw new Error(`RPC proxy ${url} is not connected to a healthy ${network} node: ${(_b = readiness.error) !== null && _b !== void 0 ? _b : 'health check failed'}`);
         }
         const result = ckb_tui_1.CKBTui.run(['-r', url]);
         // Propagate ckb-tui exit code so scripts can detect TUI failure
         if (result.status !== 0) {
-            process.exitCode = (_b = result.status) !== null && _b !== void 0 ? _b : 1;
+            throw new Error(`ckb-tui exited with code ${(_c = result.status) !== null && _c !== void 0 ? _c : 'unknown'}`);
         }
     });
 }
-function isRPCPortListening(port) {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (!Number.isInteger(port) || port < 1 || port > 65535) {
-            return false;
-        }
-        const client = new net.Socket();
-        return new Promise((resolve) => {
-            let settled = false;
-            const TIMEOUT_MS = 2000;
-            const timeout = setTimeout(() => {
-                if (!settled) {
-                    settled = true;
-                    client.destroy();
-                    resolve(false);
-                }
-            }, TIMEOUT_MS);
-            client.once('error', () => {
-                if (!settled) {
-                    settled = true;
-                    clearTimeout(timeout);
-                    resolve(false);
-                }
-            });
-            client.once('connect', () => {
-                if (!settled) {
-                    settled = true;
-                    clearTimeout(timeout);
-                    client.end();
-                    resolve(true);
-                }
-            });
-            client.connect(port, '127.0.0.1');
-        });
-    });
-}
 
 
 /***/ }),
@@ -2134,7 +2593,6 @@ exports.printSystemScripts = printSystemScripts;
 exports.printInSystemStyle = printInSystemStyle;
 exports.printInLumosConfigStyle = printInLumosConfigStyle;
 exports.printInCCCStyle = printInCCCStyle;
-exports.systemCellToScriptInfo = systemCellToScriptInfo;
 exports.toLumosConfig = toLumosConfig;
 const base_1 = __nccwpck_require__(69951);
 const public_1 = __nccwpck_require__(84535);
@@ -2148,26 +2606,41 @@ var PrintStyle;
 })(PrintStyle || (exports.PrintStyle = PrintStyle = {}));
 function printSystemScripts(_a) {
     return __awaiter(this, arguments, void 0, function* ({ style = PrintStyle.system, network = base_1.Network.devnet }) {
-        const systemScripts = network === base_1.Network.mainnet
-            ? public_1.MAINNET_SYSTEM_SCRIPTS
-            : network === base_1.Network.testnet
-                ? public_1.TESTNET_SYSTEM_SCRIPTS
-                : (0, private_1.getDevnetSystemScriptsFromListHashes)();
+        var _b;
+        let systemScripts;
+        // Display label and address prefix follow the chain the devnet actually
+        // runs: a fork carries the source chain's genesis, scripts and prefix.
+        let label = network.toUpperCase();
+        let addressPrefix = network === base_1.Network.mainnet ? 'ckb' : 'ckt';
+        if (network === base_1.Network.mainnet) {
+            systemScripts = public_1.MAINNET_SYSTEM_SCRIPTS;
+        }
+        else if (network === base_1.Network.testnet) {
+            systemScripts = public_1.TESTNET_SYSTEM_SCRIPTS;
+        }
+        else {
+            const resolved = (0, private_1.resolveDevnetSystemScripts)();
+            systemScripts = (_b = resolved === null || resolved === void 0 ? void 0 : resolved.scripts) !== null && _b !== void 0 ? _b : null;
+            if (resolved === null || resolved === void 0 ? void 0 : resolved.forkedFrom) {
+                label = `DEVNET (fork of ${resolved.forkedFrom.toUpperCase()})`;
+                addressPrefix = resolved.forkedFrom === 'mainnet' ? 'ckb' : 'ckt';
+            }
+        }
         if (!systemScripts)
             return logger_1.logger.info(`SystemScripts is null, ${network}`);
         if (style === PrintStyle.system) {
-            return printInSystemStyle(systemScripts, network);
+            return printInSystemStyle(systemScripts, label);
         }
         if (style === PrintStyle.lumos) {
-            return printInLumosConfigStyle(systemScripts, network);
+            return printInLumosConfigStyle(systemScripts, label, addressPrefix);
         }
         if (style === PrintStyle.ccc) {
-            return printInCCCStyle(systemScripts, network);
+            return printInCCCStyle(systemScripts, label);
         }
     });
 }
-function printInSystemStyle(systemScripts, network) {
-    logger_1.logger.info(`*** CKB ${network.toUpperCase()} System Scripts ***\n`);
+function printInSystemStyle(systemScripts, label) {
+    logger_1.logger.info(`*** CKB ${label} System Scripts ***\n`);
     for (const [name, script] of Object.entries(systemScripts)) {
         logger_1.logger.info(`- name: ${name}`);
         if (script == null) {
@@ -2180,67 +2653,16 @@ function printInSystemStyle(systemScripts, network) {
         logger_1.logger.info(`  cellDeps: ${JSON.stringify(script.script.cellDeps, null, 2)}\n`);
     }
 }
-function printInLumosConfigStyle(scripts, network) {
-    const config = toLumosConfig(scripts, network === base_1.Network.mainnet ? 'ckb' : 'ckt');
-    logger_1.logger.info(`*** CKB ${network.toUpperCase()} System Scripts As LumosConfig ***\n`);
+function printInLumosConfigStyle(scripts, label, addressPrefix) {
+    const config = toLumosConfig(scripts, addressPrefix);
+    logger_1.logger.info(`*** CKB ${label} System Scripts As LumosConfig ***\n`);
     logger_1.logger.info(JSON.stringify(config, null, 2));
 }
-function printInCCCStyle(scripts, network) {
+function printInCCCStyle(scripts, label) {
     const knownsScripts = (0, private_1.toCCCKnownScripts)(scripts);
-    logger_1.logger.info(`*** CKB ${network.toUpperCase()} System Scripts As CCC KnownScripts ***\n`);
+    logger_1.logger.info(`*** CKB ${label} System Scripts As CCC KnownScripts ***\n`);
     logger_1.logger.info(JSON.stringify(knownsScripts, null, 2));
 }
-function systemCellToScriptInfo({ cell, depType, depGroup, extraCellDeps, }) {
-    // todo: we left the type in cellDepsInfo since it requires async fetching and
-    // chain running to get the full type script of the type-id deps.
-    // Also, in devnet there is no real need to auto upgrade the system scripts with type-id
-    if (depType === 'code') {
-        let cellDeps = [
-            {
-                cellDep: {
-                    outPoint: {
-                        txHash: cell.tx_hash,
-                        index: cell.index,
-                    },
-                    depType,
-                },
-            },
-        ];
-        if (extraCellDeps && extraCellDeps.length > 0) {
-            cellDeps = [...extraCellDeps, ...cellDeps];
-        }
-        return {
-            codeHash: (cell.type_hash || cell.data_hash),
-            hashType: cell.type_hash ? 'type' : 'data2',
-            cellDeps,
-        };
-    }
-    if (depType === 'depGroup') {
-        if (!depGroup) {
-            throw new Error('require depGroup info since the dep type is depGroup');
-        }
-        let cellDeps = [
-            {
-                cellDep: {
-                    outPoint: {
-                        txHash: depGroup.txHash,
-                        index: depGroup.index,
-                    },
-                    depType,
-                },
-            },
-        ];
-        if (extraCellDeps && extraCellDeps.length > 0) {
-            cellDeps = [...extraCellDeps, ...cellDeps];
-        }
-        return {
-            codeHash: (cell.type_hash || cell.data_hash),
-            hashType: cell.type_hash ? 'type' : 'data2',
-            cellDeps,
-        };
-    }
-    throw new Error(`unknown DepType ${depType}`);
-}
 function toLumosConfig(scripts, addressPrefix = 'ckt') {
     const config = {
         PREFIX: addressPrefix,
@@ -2379,14 +2801,16 @@ const base_1 = __nccwpck_require__(69951);
 const link_1 = __nccwpck_require__(27814);
 const validator_1 = __nccwpck_require__(39534);
 const logger_1 = __nccwpck_require__(65370);
+const private_key_1 = __nccwpck_require__(26241);
+const readiness_1 = __nccwpck_require__(19326);
+const fork_safety_1 = __nccwpck_require__(47625);
 function transferAll(toAddress_1) {
     return __awaiter(this, arguments, void 0, function* (toAddress, opt = { network: base_1.Network.devnet }) {
         const network = opt.network;
         (0, validator_1.validateNetworkOpt)(network);
-        if (opt.privkey == null) {
-            throw new Error('--privkey is required!');
-        }
-        const privateKey = opt.privkey;
+        const privateKey = (0, private_key_1.resolvePrivateKey)(opt);
+        (0, fork_safety_1.warnIfMainnetForkSigning)(network, privateKey);
+        yield (0, readiness_1.warnIfForkIndexerIsBehind)(network);
         const ckb = new ckb_1.CKB({ network });
         const txHash = yield ckb.transferAll({
             toAddress,
@@ -2394,9 +2818,12 @@ function transferAll(toAddress_1) {
         });
         if (network === 'testnet') {
             logger_1.logger.info(`Successfully transfer, check ${(0, link_1.buildTestnetTxLink)(txHash)} for details.`);
-            return;
+            logger_1.logger.result({ command: 'transfer-all', network, toAddress, txHash });
+            return txHash;
         }
         logger_1.logger.info('Successfully transfer, txHash:', txHash);
+        logger_1.logger.result({ command: 'transfer-all', network, toAddress, txHash });
+        return txHash;
     });
 }
 
@@ -2423,37 +2850,61 @@ const ckb_1 = __nccwpck_require__(83748);
 const base_1 = __nccwpck_require__(69951);
 const link_1 = __nccwpck_require__(27814);
 const validator_1 = __nccwpck_require__(39534);
+const private_key_1 = __nccwpck_require__(26241);
+const logger_1 = __nccwpck_require__(65370);
+const readiness_1 = __nccwpck_require__(19326);
+const fork_safety_1 = __nccwpck_require__(47625);
 function transfer(toAddress_1, amount_1) {
     return __awaiter(this, arguments, void 0, function* (toAddress, amount, opt = { network: base_1.Network.devnet }) {
         var _a;
         const network = opt.network;
         (0, validator_1.validateNetworkOpt)(network);
-        if (opt.privkey == null) {
-            throw new Error('--privkey is required!');
-        }
-        const privateKey = opt.privkey;
+        let udtKind;
+        let udtTypeArgs;
+        if (opt.udtKind != null || opt.udtTypeArgs != null) {
+            if (!opt.udtTypeArgs) {
+                throw new Error('UDT type args are required for a UDT transfer');
+            }
+            (0, validator_1.validateUdtAmount)(amount);
+            udtKind = (_a = opt.udtKind) !== null && _a !== void 0 ? _a : 'sudt';
+            (0, validator_1.validateUdtKind)(udtKind);
+            udtTypeArgs = (0, validator_1.validateUdtTypeArgs)(udtKind, opt.udtTypeArgs);
+        }
+        const privateKey = (0, private_key_1.resolvePrivateKey)(opt);
+        const rejectInputsAtOrBeforeBlock = (0, fork_safety_1.validateMainnetForkSigning)(network, privateKey, opt.allowMainnetReplayRisk);
+        yield (0, readiness_1.warnIfForkIndexerIsBehind)(network);
         const ckb = new ckb_1.CKB({ network });
-        if (opt.udtTypeArgs) {
-            const kind = (_a = opt.udtKind) !== null && _a !== void 0 ? _a : 'sudt';
-            (0, validator_1.validateUdtKind)(kind);
-            const udtTypeArgs = (0, validator_1.validateUdtTypeArgs)(kind, opt.udtTypeArgs);
-            const udtType = yield ckb.buildUdtTypeScript(kind, udtTypeArgs);
+        if (udtKind && udtTypeArgs) {
+            const udtType = yield ckb.buildUdtTypeScript(udtKind, udtTypeArgs);
             const txHash = yield ckb.udtTransfer({
                 toAddress,
                 amount,
                 privateKey,
                 udtType,
-                kind,
+                kind: udtKind,
+                rejectInputsAtOrBeforeBlock,
             });
             (0, link_1.logTxSuccess)(network, txHash, 'transfer UDT');
-            return;
+            logger_1.logger.result({
+                command: 'udt.transfer',
+                network,
+                kind: udtKind,
+                amount,
+                typeArgs: udtTypeArgs,
+                toAddress,
+                txHash,
+            });
+            return txHash;
         }
         const txHash = yield ckb.transfer({
             toAddress,
             amountInCKB: amount,
             privateKey,
+            rejectInputsAtOrBeforeBlock,
         });
         (0, link_1.logTxSuccess)(network, txHash, 'transfer');
+        logger_1.logger.result({ command: 'transfer', network, amount, toAddress, txHash });
+        return txHash;
     });
 }
 
@@ -2481,41 +2932,65 @@ const ckb_1 = __nccwpck_require__(83748);
 const base_1 = __nccwpck_require__(69951);
 const link_1 = __nccwpck_require__(27814);
 const validator_1 = __nccwpck_require__(39534);
+const private_key_1 = __nccwpck_require__(26241);
+const logger_1 = __nccwpck_require__(65370);
+const readiness_1 = __nccwpck_require__(19326);
+const fork_safety_1 = __nccwpck_require__(47625);
 function udtIssue(amount_1) {
-    return __awaiter(this, arguments, void 0, function* (amount, opt = { network: base_1.Network.devnet, udtKind: 'sudt', privkey: '' }) {
+    return __awaiter(this, arguments, void 0, function* (amount, opt = { network: base_1.Network.devnet, udtKind: 'sudt' }) {
         const network = opt.network;
         (0, validator_1.validateNetworkOpt)(network);
         (0, validator_1.validateUdtKind)(opt.udtKind);
-        if (!opt.privkey) {
-            throw new Error('--privkey is required!');
-        }
+        (0, validator_1.validateUdtAmount)(amount);
+        const typeArgs = opt.typeArgs ? (0, validator_1.validateUdtTypeArgs)(opt.udtKind, opt.typeArgs) : undefined;
+        const privateKey = (0, private_key_1.resolvePrivateKey)(opt);
+        (0, fork_safety_1.warnIfMainnetForkSigning)(network, privateKey);
+        yield (0, readiness_1.warnIfForkIndexerIsBehind)(network);
         const ckb = new ckb_1.CKB({ network });
-        const txHash = yield ckb.udtIssue({
-            privateKey: opt.privkey,
+        const result = yield ckb.udtIssue({
+            privateKey,
             kind: opt.udtKind,
             amount,
-            typeArgs: opt.typeArgs ? (0, validator_1.validateUdtTypeArgs)(opt.udtKind, opt.typeArgs) : undefined,
+            typeArgs,
             toAddress: opt.to,
         });
-        (0, link_1.logTxSuccess)(network, txHash, 'issued UDT');
+        (0, link_1.logTxSuccess)(network, result.txHash, 'issued UDT');
+        logger_1.logger.info(`UDT kind: ${opt.udtKind}`);
+        logger_1.logger.info(`UDT type args: ${result.typeArgs}`);
+        logger_1.logger.info(`Receiver: ${result.receiver}`);
+        logger_1.logger.info(`Next: offckb balance ${result.receiver} --udt-kind ${opt.udtKind} --udt-type-args ${result.typeArgs}`);
+        logger_1.logger.result({
+            command: 'udt.issue',
+            network,
+            kind: opt.udtKind,
+            amount,
+            receiver: result.receiver,
+            typeArgs: result.typeArgs,
+            txHash: result.txHash,
+        });
+        return result;
     });
 }
 function udtDestroy(amount_1) {
-    return __awaiter(this, arguments, void 0, function* (amount, opt = { network: base_1.Network.devnet, udtKind: 'sudt', typeArgs: '', privkey: '' }) {
+    return __awaiter(this, arguments, void 0, function* (amount, opt = { network: base_1.Network.devnet, udtKind: 'sudt', typeArgs: '' }) {
         const network = opt.network;
         (0, validator_1.validateNetworkOpt)(network);
         (0, validator_1.validateUdtKind)(opt.udtKind);
-        if (!opt.privkey) {
-            throw new Error('--privkey is required!');
-        }
+        (0, validator_1.validateUdtAmount)(amount);
+        const typeArgs = (0, validator_1.validateUdtTypeArgs)(opt.udtKind, opt.typeArgs);
+        const privateKey = (0, private_key_1.resolvePrivateKey)(opt);
+        (0, fork_safety_1.warnIfMainnetForkSigning)(network, privateKey);
+        yield (0, readiness_1.warnIfForkIndexerIsBehind)(network);
         const ckb = new ckb_1.CKB({ network });
         const txHash = yield ckb.udtDestroy({
-            privateKey: opt.privkey,
+            privateKey,
             kind: opt.udtKind,
             amount,
-            typeArgs: (0, validator_1.validateUdtTypeArgs)(opt.udtKind, opt.typeArgs),
+            typeArgs,
         });
         (0, link_1.logTxSuccess)(network, txHash, 'destroyed UDT');
+        logger_1.logger.result({ command: 'udt.destroy', network, kind: opt.udtKind, amount, typeArgs, txHash });
+        return txHash;
     });
 }
 
@@ -3487,6 +3962,640 @@ class InitializationError extends Error {
 exports.InitializationError = InitializationError;
 
 
+/***/ }),
+
+/***/ 77912:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.FORK_STATE_FILE = void 0;
+exports.getForkStatePath = getForkStatePath;
+exports.readForkState = readForkState;
+exports.writeForkState = writeForkState;
+exports.markForkFirstRunComplete = markForkFirstRunComplete;
+exports.detectSourceFromCkbToml = detectSourceFromCkbToml;
+exports.parseGenesisHashFromInitOutput = parseGenesisHashFromInitOutput;
+exports.parseGenesisHashFromListHashes = parseGenesisHashFromListHashes;
+exports.expectedGenesisHash = expectedGenesisHash;
+exports.patchDevSpecForFork = patchDevSpecForFork;
+exports.copySourceData = copySourceData;
+exports.isolateForkCkbConfig = isolateForkCkbConfig;
+exports.migrationNeededFromExitCode = migrationNeededFromExitCode;
+exports.forkDevnet = forkDevnet;
+const child_process_1 = __nccwpck_require__(35317);
+const fs_1 = __importDefault(__nccwpck_require__(79896));
+const os_1 = __importDefault(__nccwpck_require__(70857));
+const path_1 = __importDefault(__nccwpck_require__(16928));
+const toml_1 = __importDefault(__nccwpck_require__(2811));
+const setting_1 = __nccwpck_require__(25546);
+const install_1 = __nccwpck_require__(65611);
+const fs_2 = __nccwpck_require__(37293);
+const request_1 = __nccwpck_require__(65897);
+const logger_1 = __nccwpck_require__(65370);
+const const_1 = __nccwpck_require__(75587);
+exports.FORK_STATE_FILE = 'fork.json';
+// The official guide requires genesis_epoch_length to stay at 1743 for a
+// mainnet fork, and to fall back to the default 1000 for a testnet fork
+// (i.e. the key must be absent). Getting this wrong produces a different
+// genesis hash and the node refuses to start. See nervosnetwork/ckb#5205.
+const MAINNET_GENESIS_EPOCH_LENGTH = 1743;
+function getForkStatePath(configPath) {
+    return path_1.default.join(configPath, exports.FORK_STATE_FILE);
+}
+function readForkState(configPath) {
+    const statePath = getForkStatePath(configPath);
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync(statePath, 'utf8');
+    }
+    catch (_a) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.source !== 'string' || typeof parsed.firstRunPending !== 'boolean') {
+            return null;
+        }
+        return parsed;
+    }
+    catch (_b) {
+        return null;
+    }
+}
+function writeForkState(configPath, state) {
+    const statePath = getForkStatePath(configPath);
+    const tempPath = `${statePath}.tmp`;
+    fs_1.default.writeFileSync(tempPath, JSON.stringify(state, null, 2));
+    fs_1.default.renameSync(tempPath, statePath);
+}
+function markForkFirstRunComplete(configPath, forkBlockNumber) {
+    const state = readForkState(configPath);
+    if (!state || !state.firstRunPending)
+        return;
+    writeForkState(configPath, Object.assign(Object.assign(Object.assign({}, state), { firstRunPending: false }), (forkBlockNumber == null ? {} : { forkBlockNumber })));
+}
+function detectSourceFromCkbToml(ckbTomlContent) {
+    let parsed;
+    try {
+        parsed = toml_1.default.parse(ckbTomlContent);
+    }
+    catch (_a) {
+        return null;
+    }
+    const chain = parsed.chain;
+    if (chain == null || typeof chain !== 'object')
+        return null;
+    const spec = chain.spec;
+    if (spec == null || typeof spec !== 'object')
+        return null;
+    const bundled = spec.bundled;
+    if (typeof bundled !== 'string')
+        return null;
+    if (bundled.includes('mainnet'))
+        return 'mainnet';
+    if (bundled.includes('testnet'))
+        return 'testnet';
+    return null;
+}
+function parseGenesisHashFromInitOutput(output) {
+    const match = output.match(/Genesis Hash:\s*(0x[0-9a-fA-F]{64})/);
+    return match ? match[1].toLowerCase() : null;
+}
+// `ckb list-hashes` prints TOML with a single table whose `genesis` field is
+// the chain's genesis hash.
+function parseGenesisHashFromListHashes(output) {
+    const match = output.match(/^\s*genesis\s*=\s*"(0x[0-9a-fA-F]{64})"\s*$/m);
+    return match ? match[1].toLowerCase() : null;
+}
+function expectedGenesisHash(source) {
+    return source === 'mainnet' ? const_1.MAINNET_GENESIS_HASH : const_1.TESTNET_GENESIS_HASH;
+}
+// Patch the imported chain spec into a minable dev chain, following
+// https://docs.nervos.org/docs/node/devnet-from-existing-data
+function patchDevSpecForFork(spec, source) {
+    var _a, _b;
+    const pow = Object.assign(Object.assign({}, ((_a = spec.pow) !== null && _a !== void 0 ? _a : {})), { func: 'Dummy' });
+    const params = Object.assign({}, ((_b = spec.params) !== null && _b !== void 0 ? _b : {}));
+    params.cellbase_maturity = 0;
+    params.permanent_difficulty_in_dummy = true;
+    if (source === 'mainnet') {
+        params.genesis_epoch_length = MAINNET_GENESIS_EPOCH_LENGTH;
+    }
+    else if (source === 'testnet') {
+        // testnet derives genesis_epoch_length from the default (1000); a leftover
+        // mainnet value here is exactly the nervosnetwork/ckb#5205 trap.
+        delete params.genesis_epoch_length;
+    }
+    // custom specs keep whatever genesis_epoch_length they declared
+    return Object.assign(Object.assign({}, spec), { pow, params });
+}
+function validateSourceDir(sourceDir) {
+    if (!(0, fs_2.isFolderExists)(sourceDir)) {
+        throw new Error(`Source directory does not exist: ${sourceDir}`);
+    }
+    if (!(0, fs_2.isFolderExists)(path_1.default.join(sourceDir, 'data', 'db'))) {
+        throw new Error(`${sourceDir} does not look like a CKB node directory (missing data/db). ` +
+            `Point --from at the directory the source node runs with (-C).`);
+    }
+}
+// Best-effort detection of a running ckb process using the given directory.
+// Returns null when the check cannot be performed (Windows, no ps).
+function isCkbNodeRunningOn(dir) {
+    if (process.platform === 'win32')
+        return null;
+    let processes = '';
+    try {
+        processes = (0, child_process_1.execSync)('ps -eo args', { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+    }
+    catch (_a) {
+        return null;
+    }
+    return processes.split('\n').some((line) => {
+        var _a;
+        const tokens = line.trim().split(/\s+/);
+        // The program itself must be a ckb binary — a looser match would flag
+        // unrelated processes that merely mention the directory.
+        const program = path_1.default.basename((_a = tokens[0]) !== null && _a !== void 0 ? _a : '');
+        if (program !== 'ckb' && program !== 'ckb.exe')
+            return false;
+        return tokens.includes('run') && line.includes(dir);
+    });
+}
+function assertSourceNodeStopped(sourceDir) {
+    const running = isCkbNodeRunningOn(sourceDir);
+    if (running === null) {
+        logger_1.logger.warn('Make sure the source CKB node is stopped; copying a live database produces corrupted data.');
+        return;
+    }
+    if (running) {
+        throw new Error(`A CKB node appears to be running on ${sourceDir}. Stop it first; ` +
+            `copying a live database produces corrupted data.`);
+    }
+}
+function assertOffckbDevnetStopped() {
+    const settings = (0, setting_1.readSettings)();
+    // Foreground `offckb node` (no daemon pid file): look for the ckb process.
+    if (isCkbNodeRunningOn(settings.devnet.configPath) === true) {
+        throw new Error('An offckb devnet node appears to be running. Stop it before forking.');
+    }
+    // Daemon mode: check the pid file.
+    const pidFile = path_1.default.join(settings.devnet.dataPath, 'logs', 'daemon.pid');
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync(pidFile, 'utf8').trim();
+    }
+    catch (_a) {
+        return;
+    }
+    let pid = Number(raw);
+    if (!Number.isInteger(pid) || pid <= 0) {
+        try {
+            pid = Number(JSON.parse(raw).pid);
+        }
+        catch (_b) {
+            return;
+        }
+    }
+    if (!Number.isInteger(pid) || pid <= 0)
+        return;
+    let alive = true;
+    try {
+        process.kill(pid, 0);
+    }
+    catch (_c) {
+        alive = false; // ESRCH: stale pid file, no daemon running
+    }
+    if (alive) {
+        throw new Error(`The offckb devnet daemon is running (PID ${pid}). Stop it first with: offckb node stop`);
+    }
+}
+function resolveSpecFile(options, source, ckbVersion) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (options.specFile) {
+            const specFile = path_1.default.resolve(options.specFile);
+            if (!fs_1.default.existsSync(specFile)) {
+                throw new Error(`Spec file not found: ${specFile}`);
+            }
+            return specFile;
+        }
+        const cacheDir = path_1.default.join(setting_1.cachePath, 'specs', ckbVersion);
+        const cachedSpec = path_1.default.join(cacheDir, `${source}.toml`);
+        if (fs_1.default.existsSync(cachedSpec)) {
+            logger_1.logger.debug(`Using cached ${source} spec: ${cachedSpec}`);
+            return cachedSpec;
+        }
+        const url = `https://raw.githubusercontent.com/nervosnetwork/ckb/v${ckbVersion}/resource/specs/${source}.toml`;
+        logger_1.logger.info(`Downloading ${source} chain spec from ${url} ..`);
+        try {
+            const response = yield request_1.Request.send(url);
+            const content = yield response.text();
+            fs_1.default.mkdirSync(cacheDir, { recursive: true });
+            fs_1.default.writeFileSync(cachedSpec, content);
+            return cachedSpec;
+        }
+        catch (error) {
+            throw new Error(`Failed to download the ${source} chain spec for CKB v${ckbVersion}: ${error.message}. ` +
+                `Pass a local copy with --spec-file.`);
+        }
+    });
+}
+function copySourceData(sourceDir, configPath) {
+    const sourceData = path_1.default.join(sourceDir, 'data');
+    const targetData = path_1.default.join(configPath, 'data');
+    logger_1.logger.info(`Copying chain data from ${sourceData} to ${targetData} ..`);
+    logger_1.logger.info('This can take a while for large chains.');
+    fs_1.default.mkdirSync(configPath, { recursive: true });
+    // Full copy on purpose: never hardlink — RocksDB appends to WAL/MANIFEST in
+    // place, and linked files would corrupt the source chain.
+    const excludedTopLevelEntries = new Set(['network', 'logs', 'tmp']);
+    fs_1.default.mkdirSync(targetData, { recursive: true });
+    // Enumerate top-level entries instead of relying on fs.cp's filter paths,
+    // which may use Windows extended-length prefixes and bypass relative-path
+    // comparisons.
+    for (const entry of fs_1.default.readdirSync(sourceData)) {
+        if (excludedTopLevelEntries.has(entry))
+            continue;
+        fs_1.default.cpSync(path_1.default.join(sourceData, entry), path_1.default.join(targetData, entry), { recursive: true });
+    }
+    logger_1.logger.info('Excluded source network peers and transient logs/tmp data from the fork.');
+}
+function isolateForkCkbConfig(config) {
+    var _a, _b;
+    const network = Object.assign({}, ((_a = config.network) !== null && _a !== void 0 ? _a : {}));
+    network.bootnodes = [];
+    network.max_outbound_peers = 0;
+    network.whitelist_only = true;
+    network.discovery_local_address = false;
+    const loggerConfig = Object.assign({}, ((_b = config.logger) !== null && _b !== void 0 ? _b : {}));
+    loggerConfig.filter = 'warn';
+    return Object.assign(Object.assign({}, config), { network, logger: loggerConfig });
+}
+function runCkbInit(ckbBinPath, configPath, specFile) {
+    // argv form, never a shell: --spec-file is user input and quote-wrapping
+    // alone does not stop shell expansion (command substitution still runs
+    // inside double quotes).
+    const args = ['init', '-C', configPath, '--chain', 'dev', '--import-spec', specFile, '--force'];
+    logger_1.logger.debug(`Running: ${ckbBinPath} ${args.join(' ')}`);
+    return (0, child_process_1.execFileSync)(ckbBinPath, args, {
+        encoding: 'utf8',
+        maxBuffer: 16 * 1024 * 1024,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+}
+function migrationNeededFromExitCode(status) {
+    if (status === 0)
+        return true;
+    if (status === 64)
+        return false;
+    throw new Error(`ckb migrate --check failed with exit code ${status !== null && status !== void 0 ? status : 'unknown'}`);
+}
+function isDatabaseMigrationNeeded(ckbBinPath, configPath) {
+    const result = (0, child_process_1.spawnSync)(ckbBinPath, ['migrate', '--check', '-C', configPath], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.error) {
+        throw new Error(`Could not check the CKB database version: ${result.error.message}`);
+    }
+    try {
+        return migrationNeededFromExitCode(result.status);
+    }
+    catch (error) {
+        const details = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+        throw new Error(`${error.message}${details ? `: ${details}` : ''}`);
+    }
+}
+function migrateDatabaseCopy(ckbBinPath, configPath) {
+    var _a, _b;
+    logger_1.logger.info('Migrating the copied database (the source directory remains untouched) ..');
+    const result = (0, child_process_1.spawnSync)(ckbBinPath, ['migrate', '--force', '-C', configPath], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.error || result.status !== 0) {
+        const details = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+        throw new Error(`Failed to migrate the copied database: ${(_b = (_a = result.error) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : `exit code ${result.status}`}` +
+            `${details ? `\n${details}` : ''}`);
+    }
+    logger_1.logger.success('Copied database migration completed.');
+}
+// Best-effort read of the source directory's own chain identity. `ckb
+// list-hashes` resolves the chain spec of the given config dir (no database
+// access needed), which tells us which chain the source node was configured
+// for. Returns null when the source is not a standard config dir.
+function readSourceGenesisHash(ckbBinPath, sourceDir) {
+    try {
+        const output = (0, child_process_1.execFileSync)(ckbBinPath, ['list-hashes', '-C', sourceDir], {
+            encoding: 'utf8',
+            maxBuffer: 16 * 1024 * 1024,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return parseGenesisHashFromListHashes(output);
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function validateForkSpec(ckbBinPath, sourceDir, specFile, declaredSource) {
+    var _a;
+    const tempConfigPath = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'offckb-fork-preflight-'));
+    try {
+        const initOutput = runCkbInit(ckbBinPath, tempConfigPath, specFile);
+        const genesisHash = parseGenesisHashFromInitOutput(initOutput);
+        if (!genesisHash) {
+            throw new Error(`Could not parse the genesis hash from ckb init output:\n${initOutput}`);
+        }
+        const source = (_a = declaredSource !== null && declaredSource !== void 0 ? declaredSource : (0, const_1.identifyPublicChainByGenesisHash)(genesisHash)) !== null && _a !== void 0 ? _a : 'custom';
+        if (source !== 'custom') {
+            const expected = expectedGenesisHash(source);
+            if (genesisHash !== expected) {
+                throw new Error(`Genesis hash mismatch: expected ${expected} for ${source}, got ${genesisHash}. ` +
+                    'This usually means the chain spec does not match the source data.');
+            }
+        }
+        const sourceGenesisHash = readSourceGenesisHash(ckbBinPath, sourceDir);
+        if (sourceGenesisHash && sourceGenesisHash !== genesisHash) {
+            throw new Error(`The source directory is configured for a different chain (genesis ${sourceGenesisHash}) ` +
+                `than the imported spec (genesis ${genesisHash}). Pass a matching --source or --spec-file.`);
+        }
+        return { source, genesisHash };
+    }
+    finally {
+        fs_1.default.rmSync(tempConfigPath, { recursive: true, force: true });
+    }
+}
+// Overwrite the ckb-init-generated configs with offckb's own devnet configs so
+// the fork behaves like a normal offckb devnet (miner account as block
+// assembler, RPC on 8114 with the Indexer module, proxy on 28114). The
+// imported specs/dev.toml is kept.
+function alignConfigsWithOffckb(configPath) {
+    const settings = (0, setting_1.readSettings)();
+    const devnetSourcePath = path_1.default.resolve(setting_1.packageRootPath, './ckb/devnet');
+    const ckbConfigPath = path_1.default.join(configPath, 'ckb.toml');
+    const parsedCkbConfig = toml_1.default.parse(fs_1.default.readFileSync(path_1.default.join(devnetSourcePath, 'ckb.toml'), 'utf8'));
+    const ckbConfig = isolateForkCkbConfig(parsedCkbConfig);
+    fs_1.default.writeFileSync(ckbConfigPath, toml_1.default.stringify(ckbConfig));
+    fs_1.default.copyFileSync(path_1.default.join(devnetSourcePath, 'default.db-options'), path_1.default.join(configPath, 'default.db-options'));
+    const minerToml = fs_1.default.readFileSync(path_1.default.join(devnetSourcePath, 'ckb-miner.toml'), 'utf8');
+    fs_1.default.writeFileSync(path_1.default.join(configPath, 'ckb-miner.toml'), minerToml.replace('http://ckb:8114/', settings.devnet.rpcUrl));
+}
+function forkDevnet(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (!options.from) {
+            throw new Error('Database fork requires a source CKB directory: --from <dir>.');
+        }
+        const settings = (0, setting_1.readSettings)();
+        const configPath = settings.devnet.configPath;
+        const ckbVersion = settings.bins.defaultCKBVersion;
+        const sourceDir = path_1.default.resolve(options.from);
+        validateSourceDir(sourceDir);
+        assertSourceNodeStopped(sourceDir);
+        // Identify the source chain: explicit flag > ckb.toml bundled spec.
+        let source = (_a = options.source) !== null && _a !== void 0 ? _a : null;
+        if (source == null) {
+            const sourceCkbToml = path_1.default.join(sourceDir, 'ckb.toml');
+            if (fs_1.default.existsSync(sourceCkbToml)) {
+                source = detectSourceFromCkbToml(fs_1.default.readFileSync(sourceCkbToml, 'utf8'));
+            }
+        }
+        if (source == null && !options.specFile) {
+            throw new Error('Could not identify the source chain from the source directory. ' +
+                'Pass --source mainnet|testnet, or provide the chain spec with --spec-file.');
+        }
+        yield (0, install_1.installCKBBinary)(ckbVersion);
+        const ckbBinPath = (0, setting_1.getCKBBinaryPath)(ckbVersion);
+        const databaseMigrationNeeded = isDatabaseMigrationNeeded(ckbBinPath, sourceDir);
+        const sourcePeerStoreDetected = fs_1.default.existsSync(path_1.default.join(sourceDir, 'data', 'network', 'peer_store'));
+        const specFile = yield resolveSpecFile(options, source !== null && source !== void 0 ? source : 'mainnet', ckbVersion);
+        const specPreflight = validateForkSpec(ckbBinPath, sourceDir, specFile, source);
+        source = specPreflight.source;
+        logger_1.logger.info(`Fork preflight: source=${source}, genesis=${specPreflight.genesisHash}, CKB=${ckbVersion}, migration=${databaseMigrationNeeded ? 'required' : 'not required'}.`);
+        if (sourcePeerStoreDetected) {
+            logger_1.logger.info('A persisted source peer store was detected and will be excluded from the fork.');
+        }
+        if (options.dryRun) {
+            logger_1.logger.success('Fork preflight passed. No devnet files were changed.');
+            logger_1.logger.result({
+                command: 'devnet.fork.preflight',
+                sourceDir,
+                source,
+                genesisHash: specPreflight.genesisHash,
+                ckbVersion,
+                databaseMigrationNeeded,
+                sourcePeerStoreDetected,
+                sourcePeerStoreWillBeExcluded: true,
+                targetDir: configPath,
+            });
+            return;
+        }
+        assertOffckbDevnetStopped();
+        if (databaseMigrationNeeded && !options.migrate) {
+            throw new Error(`The source database requires migration for CKB v${ckbVersion}. ` +
+                'Re-run with --migrate to migrate only the copied devnet, leaving the source untouched.');
+        }
+        if ((0, fs_2.isFolderExists)(configPath)) {
+            if (!options.force) {
+                throw new Error(`A devnet already exists at ${configPath}. Re-run with --force to replace it, ` +
+                    `or reset it first with: offckb clean`);
+            }
+            logger_1.logger.info(`Removing existing devnet at ${configPath} ..`);
+            fs_1.default.rmSync(configPath, { recursive: true, force: true });
+        }
+        try {
+            // Inside the try so a failed copy (disk full, permissions, I/O) gets the
+            // same rollback: a partial configPath would otherwise block the next
+            // attempt as an "existing devnet".
+            copySourceData(sourceDir, configPath);
+            const initOutput = runCkbInit(ckbBinPath, configPath, specFile);
+            const genesisHash = parseGenesisHashFromInitOutput(initOutput);
+            if (!genesisHash) {
+                throw new Error(`Could not parse the genesis hash from ckb init output:\n${initOutput}`);
+            }
+            if (genesisHash !== specPreflight.genesisHash) {
+                throw new Error(`Chain spec changed after preflight: expected genesis ${specPreflight.genesisHash}, got ${genesisHash}.`);
+            }
+            const devSpecPath = path_1.default.join(configPath, 'specs', 'dev.toml');
+            const spec = toml_1.default.parse(fs_1.default.readFileSync(devSpecPath, 'utf8'));
+            const patched = patchDevSpecForFork(spec, source);
+            const tempSpecPath = `${devSpecPath}.tmp`;
+            fs_1.default.writeFileSync(tempSpecPath, toml_1.default.stringify(patched));
+            fs_1.default.renameSync(tempSpecPath, devSpecPath);
+            alignConfigsWithOffckb(configPath);
+            if (databaseMigrationNeeded) {
+                migrateDatabaseCopy(ckbBinPath, configPath);
+            }
+            const state = {
+                source,
+                sourceDir,
+                ckbVersion,
+                genesisHash,
+                forkedAt: new Date().toISOString(),
+                firstRunPending: true,
+                databaseMigrated: databaseMigrationNeeded,
+                networkIsolated: true,
+            };
+            writeForkState(configPath, state);
+            logger_1.logger.success(`Devnet forked from ${sourceDir} (${source}, genesis ${genesisHash}).`);
+            logger_1.logger.info('Start it with: offckb node --daemon');
+            logger_1.logger.info('The first run applies --skip-spec-check --overwrite-spec automatically.');
+            logger_1.logger.info('Then inspect node, Indexer, and network isolation with: offckb devnet info');
+            logger_1.logger.info('List source-prefix dev addresses with: offckb accounts');
+            if (source === 'mainnet') {
+                logger_1.logger.warn('MAINNET FORK REPLAY RISK: only sign with built-in dev keys and fork-mined cells.');
+            }
+            logger_1.logger.result({
+                command: 'devnet.fork',
+                sourceDir,
+                source,
+                genesisHash,
+                ckbVersion,
+                databaseMigrated: databaseMigrationNeeded,
+                networkIsolated: true,
+                next: ['offckb node --daemon', 'offckb devnet info', 'offckb accounts'],
+            });
+        }
+        catch (error) {
+            // Leave no half-forked devnet behind.
+            fs_1.default.rmSync(configPath, { recursive: true, force: true });
+            throw error;
+        }
+    });
+}
+
+
+/***/ }),
+
+/***/ 19326:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.checkNodeReadiness = checkNodeReadiness;
+exports.waitForNodeReady = waitForNodeReady;
+exports.checkConfiguredDevnetReadiness = checkConfiguredDevnetReadiness;
+exports.warnIfForkIndexerIsBehind = warnIfForkIndexerIsBehind;
+const setting_1 = __nccwpck_require__(25546);
+const base_1 = __nccwpck_require__(69951);
+const logger_1 = __nccwpck_require__(65370);
+const json_rpc_1 = __nccwpck_require__(51726);
+const fork_1 = __nccwpck_require__(77912);
+function parseHexNumber(value) {
+    if (typeof value !== 'string' || !/^0x[0-9a-f]+$/i.test(value))
+        return undefined;
+    return BigInt(value);
+}
+function checkNodeReadiness(rpcUrl_1) {
+    return __awaiter(this, arguments, void 0, function* (rpcUrl, timeoutMs = 3000) {
+        try {
+            const [nodeInfo, tipValue] = yield Promise.all([
+                (0, json_rpc_1.callJsonRpc)(rpcUrl, 'local_node_info', [], timeoutMs),
+                (0, json_rpc_1.callJsonRpc)(rpcUrl, 'get_tip_block_number', [], timeoutMs),
+            ]);
+            const nodeTip = parseHexNumber(tipValue);
+            if (nodeTip == null) {
+                throw new Error(`Invalid node tip returned by ${rpcUrl}`);
+            }
+            let indexerTip;
+            try {
+                const value = yield (0, json_rpc_1.callJsonRpc)(rpcUrl, 'get_indexer_tip', [], timeoutMs);
+                indexerTip = parseHexNumber(value === null || value === void 0 ? void 0 : value.block_number);
+            }
+            catch (_a) {
+                // Indexer readiness is reported separately and does not make the node RPC unhealthy.
+            }
+            let peers;
+            try {
+                const value = yield (0, json_rpc_1.callJsonRpc)(rpcUrl, 'get_peers', [], timeoutMs);
+                peers = Array.isArray(value) ? value.length : undefined;
+            }
+            catch (_b) {
+                // The Net RPC module can be disabled on custom nodes.
+            }
+            const indexerLag = indexerTip == null ? undefined : indexerTip >= nodeTip ? BigInt(0) : nodeTip - indexerTip;
+            return {
+                ready: true,
+                rpcUrl,
+                version: typeof (nodeInfo === null || nodeInfo === void 0 ? void 0 : nodeInfo.version) === 'string' ? nodeInfo.version : undefined,
+                nodeTip,
+                indexerTip,
+                indexerLag,
+                peers,
+            };
+        }
+        catch (error) {
+            return {
+                ready: false,
+                rpcUrl,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    });
+}
+function waitForNodeReady(rpcUrl_1, timeoutMs_1) {
+    return __awaiter(this, arguments, void 0, function* (rpcUrl, timeoutMs, isProcessAlive = () => true) {
+        const start = Date.now();
+        let last = yield checkNodeReadiness(rpcUrl);
+        while (!last.ready && isProcessAlive() && Date.now() - start < timeoutMs) {
+            yield new Promise((resolve) => setTimeout(resolve, 500));
+            last = yield checkNodeReadiness(rpcUrl);
+        }
+        return last;
+    });
+}
+function checkConfiguredDevnetReadiness() {
+    return __awaiter(this, void 0, void 0, function* () {
+        return checkNodeReadiness((0, setting_1.readSettings)().devnet.rpcUrl);
+    });
+}
+function warnIfForkIndexerIsBehind(network) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (network !== base_1.Network.devnet)
+            return undefined;
+        const settings = (0, setting_1.readSettings)();
+        if (!(0, fork_1.readForkState)(settings.devnet.configPath))
+            return undefined;
+        const readiness = yield checkNodeReadiness(settings.devnet.rpcUrl);
+        if (!readiness.ready) {
+            logger_1.logger.warn(`The forked devnet is not RPC-ready: ${(_a = readiness.error) !== null && _a !== void 0 ? _a : 'health check failed'}`);
+        }
+        else if (readiness.indexerTip == null) {
+            logger_1.logger.warn('The CKB indexer is not ready yet; cell and balance lookups may be incomplete. Check `offckb devnet info`.');
+        }
+        else if (readiness.indexerLag && readiness.indexerLag > BigInt(0)) {
+            logger_1.logger.warn(`The CKB indexer is ${readiness.indexerLag} blocks behind the node; cell and balance lookups may be incomplete. ` +
+                'Check `offckb devnet info`.');
+        }
+        return readiness;
+    });
+}
+
+
 /***/ }),
 
 /***/ 1360:
@@ -3518,19 +4627,27 @@ function initChainIfNeeded() {
         const settings = (0, setting_1.readSettings)();
         const devnetSourcePath = path_1.default.resolve(setting_1.packageRootPath, './ckb/devnet');
         const devnetConfigPath = settings.devnet.configPath;
-        if (!(0, fs_2.isFolderExists)(devnetConfigPath)) {
-            const devnetConfigPath = settings.devnet.configPath;
-            yield (0, fs_2.copyFilesWithExclusion)(devnetSourcePath, devnetConfigPath, ['data']);
+        const requiredConfigFiles = ['ckb.toml', 'ckb-miner.toml', path_1.default.join('specs', 'dev.toml')];
+        const isInitialized = (0, fs_2.isFolderExists)(devnetConfigPath) &&
+            requiredConfigFiles.every((relativePath) => fs_1.default.existsSync(path_1.default.join(devnetConfigPath, relativePath)));
+        const minerConfigPath = path_1.default.join(devnetConfigPath, 'ckb-miner.toml');
+        const minerConfigWasMissing = !fs_1.default.existsSync(minerConfigPath);
+        // Daemon mode creates data/logs before the child starts. A directory-only
+        // check therefore mistakes a fresh install for an initialized chain. Check
+        // the files CKB actually needs instead, and repair an incomplete directory.
+        if (!isInitialized) {
+            yield (0, fs_2.copyFilesWithExclusion)(devnetSourcePath, devnetConfigPath, ['data'], false);
             logger_1.logger.debug(`init devnet config folder: ${devnetConfigPath}`);
             // copy and edit ckb-miner.toml
             const minerToml = path_1.default.join(devnetSourcePath, 'ckb-miner.toml');
-            const newMinerToml = path_1.default.join(devnetConfigPath, 'ckb-miner.toml');
-            // Read the content of the ckb-miner.toml file
-            const data = fs_1.default.readFileSync(minerToml, 'utf8');
-            // Replace the URL
-            const modifiedData = data.replace('http://ckb:8114/', settings.devnet.rpcUrl);
-            // Write the modified content back to the file
-            fs_1.default.writeFileSync(newMinerToml, modifiedData, 'utf8');
+            if (minerConfigWasMissing) {
+                // Read the content of the ckb-miner.toml file
+                const data = fs_1.default.readFileSync(minerToml, 'utf8');
+                // Replace the URL
+                const modifiedData = data.replace('http://ckb:8114/', settings.devnet.rpcUrl);
+                // Write the modified content back to the file
+                fs_1.default.writeFileSync(minerConfigPath, modifiedData, 'utf8');
+            }
         }
     });
 }
@@ -3601,7 +4718,7 @@ const fs = __importStar(__nccwpck_require__(79896));
 const path = __importStar(__nccwpck_require__(16928));
 const semver_1 = __importDefault(__nccwpck_require__(89939));
 const os_1 = __importDefault(__nccwpck_require__(70857));
-const adm_zip_1 = __importDefault(__nccwpck_require__(83746));
+const adm_zip_1 = __importDefault(__nccwpck_require__(3858));
 const tar = __importStar(__nccwpck_require__(80228));
 const request_1 = __nccwpck_require__(65897);
 const setting_1 = __nccwpck_require__(25546);
@@ -3660,6 +4777,7 @@ function downloadCKBBinaryAndUnzip(version) {
         }
         catch (error) {
             logger_1.logger.error('Error installing dependency binary:', error.message);
+            throw error;
         }
     });
 }
@@ -3821,7 +4939,8 @@ function buildDownloadUrl(version, opt = {}) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.TYPE_ID_SCRIPT = void 0;
+exports.TESTNET_GENESIS_HASH = exports.MAINNET_GENESIS_HASH = exports.TYPE_ID_SCRIPT = void 0;
+exports.identifyPublicChainByGenesisHash = identifyPublicChainByGenesisHash;
 exports.TYPE_ID_SCRIPT = {
     name: 'type_id',
     script: {
@@ -3830,6 +4949,18 @@ exports.TYPE_ID_SCRIPT = {
         cellDeps: [],
     },
 };
+// Well-known genesis block hashes, used to identify which chain a devnet
+// actually runs (a forked devnet carries the source chain's genesis).
+// https://github.com/nervosnetwork/ckb/tree/master/resource/specs
+exports.MAINNET_GENESIS_HASH = '0x92b197aa1fba0f63633922c61c92375c9c074a93e85963554f5499fe1450d0e5';
+exports.TESTNET_GENESIS_HASH = '0x10639e0895502b5688a6be8cf69460d76541bfa4821629d86d62ba0aae3f9606';
+function identifyPublicChainByGenesisHash(genesisHash) {
+    if (genesisHash === exports.MAINNET_GENESIS_HASH)
+        return 'mainnet';
+    if (genesisHash === exports.TESTNET_GENESIS_HASH)
+        return 'testnet';
+    return null;
+}
 
 
 /***/ }),
@@ -3917,30 +5048,21 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.resolveDevnetSystemScripts = resolveDevnetSystemScripts;
 exports.getDevnetSystemScriptsFromListHashes = getDevnetSystemScriptsFromListHashes;
 exports.toCCCKnownScripts = toCCCKnownScripts;
 exports.buildCCCDevnetKnownScripts = buildCCCDevnetKnownScripts;
+exports.buildDevnetCCCClient = buildDevnetCCCClient;
 const core_1 = __nccwpck_require__(39842);
 const setting_1 = __nccwpck_require__(25546);
-const system_scripts_1 = __nccwpck_require__(86198);
 const list_hashes_1 = __nccwpck_require__(31603);
 const logger_1 = __nccwpck_require__(65370);
 const const_1 = __nccwpck_require__(75587);
+const public_1 = __nccwpck_require__(84535);
 const toml_1 = __importDefault(__nccwpck_require__(2811));
 const util_1 = __nccwpck_require__(58642);
-function getDevnetSystemScriptsFromListHashes() {
+function buildSystemScriptsFromSpecHashes(chainSpecHashes) {
     var _a;
-    const settings = (0, setting_1.readSettings)();
-    const listHashesString = (0, list_hashes_1.getDevnetListHashes)(settings.bins.defaultCKBVersion);
-    if (!listHashesString) {
-        logger_1.logger.info(`list-hashes not found!`);
-        return null;
-    }
-    const listHashes = toml_1.default.parse(listHashesString);
-    const chainSpecHashes = Object.values(listHashes)[0];
-    if (chainSpecHashes == null) {
-        throw new Error(`invalid chain spec hashes file ${listHashesString}`);
-    }
     const systemScriptArray = chainSpecHashes.system_cells
         .map((cell) => {
         // Extract the file name from the path using the helper function
@@ -3953,7 +5075,7 @@ function getDevnetSystemScriptsFromListHashes() {
                 txHash: chainSpecHashes.dep_groups[depGroupIndex].tx_hash,
                 index: chainSpecHashes.dep_groups[depGroupIndex].index,
             };
-        const scriptInfo = (0, system_scripts_1.systemCellToScriptInfo)({ cell, depType, depGroup });
+        const scriptInfo = (0, util_1.systemCellToScriptInfo)({ cell, depType, depGroup });
         return {
             name,
             file: cell.path,
@@ -3973,6 +5095,46 @@ function getDevnetSystemScriptsFromListHashes() {
     systemScripts.type_id = const_1.TYPE_ID_SCRIPT;
     return systemScripts;
 }
+// `ckb list-hashes` only reports what the chain spec declares in genesis.
+// Post-genesis deployments (sudt/xudt/omnilock/spore on mainnet and testnet)
+// can never appear there, so for a forked devnet we fill the gaps from the
+// well-known static records of the chain the genesis belongs to. Genesis
+// scripts always come from list-hashes — the chain's own spec wins.
+function supplementFromStaticRecord(scripts, staticRecord) {
+    for (const [name, script] of Object.entries(staticRecord)) {
+        const key = name;
+        if (scripts[key] == null && script != null) {
+            // deep clone so callers can never mutate the shared static record
+            scripts[key] = JSON.parse(JSON.stringify(script));
+        }
+    }
+}
+function resolveDevnetSystemScripts() {
+    const settings = (0, setting_1.readSettings)();
+    const listHashesString = (0, list_hashes_1.getDevnetListHashes)(settings.bins.defaultCKBVersion);
+    if (!listHashesString) {
+        logger_1.logger.info(`list-hashes not found!`);
+        return null;
+    }
+    const listHashes = toml_1.default.parse(listHashesString);
+    const chainSpecHashes = Object.values(listHashes)[0];
+    if (chainSpecHashes == null) {
+        throw new Error(`invalid chain spec hashes file ${listHashesString}`);
+    }
+    const scripts = buildSystemScriptsFromSpecHashes(chainSpecHashes);
+    const forkedFrom = (0, const_1.identifyPublicChainByGenesisHash)(chainSpecHashes.genesis);
+    if (forkedFrom === 'mainnet') {
+        supplementFromStaticRecord(scripts, public_1.MAINNET_SYSTEM_SCRIPTS);
+    }
+    else if (forkedFrom === 'testnet') {
+        supplementFromStaticRecord(scripts, public_1.TESTNET_SYSTEM_SCRIPTS);
+    }
+    return { scripts, forkedFrom, genesisHash: chainSpecHashes.genesis };
+}
+function getDevnetSystemScriptsFromListHashes() {
+    var _a, _b;
+    return (_b = (_a = resolveDevnetSystemScripts()) === null || _a === void 0 ? void 0 : _a.scripts) !== null && _b !== void 0 ? _b : null;
+}
 function toCCCKnownScripts(scripts) {
     const DEVNET_SCRIPTS = {
         [core_1.KnownScript.Secp256k1Blake160]: scripts.secp256k1_blake160_sighash_all.script,
@@ -4000,6 +5162,19 @@ function buildCCCDevnetKnownScripts() {
     const devnetKnownScripts = toCCCKnownScripts(devnetSystemScripts);
     return devnetKnownScripts;
 }
+// Build the ccc client for the devnet. A forked devnet carries the source
+// chain's genesis, so a mainnet fork must use the `ckb` address prefix
+// (ClientPublicMainnet); everything else uses the `ckt` prefix. Known scripts
+// always come from the fork-aware resolver above.
+function buildDevnetCCCClient(url, fallbacks = []) {
+    const resolved = resolveDevnetSystemScripts();
+    if (resolved == null) {
+        throw new Error('can not getSystemScriptsFromListHashes in devnet');
+    }
+    const scripts = toCCCKnownScripts(resolved.scripts);
+    const ClientCtor = resolved.forkedFrom === 'mainnet' ? core_1.ccc.ClientPublicMainnet : core_1.ccc.ClientPublicTestnet;
+    return new ClientCtor({ url, scripts, fallbacks });
+}
 
 
 /***/ }),
@@ -4384,6 +5559,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.readDeployedScriptInfoFrom = readDeployedScriptInfoFrom;
 exports.getScriptInfoFrom = getScriptInfoFrom;
 exports.extractScriptNameFromPath = extractScriptNameFromPath;
+exports.systemCellToScriptInfo = systemCellToScriptInfo;
 const fs = __importStar(__nccwpck_require__(79896));
 const migration_1 = __nccwpck_require__(76679);
 const path_1 = __importDefault(__nccwpck_require__(16928));
@@ -4474,6 +5650,57 @@ function extractScriptNameFromPath(pathString) {
     // On Windows, it handles backslashes; on Unix, it handles forward slashes
     return path_1.default.basename(pathString);
 }
+function systemCellToScriptInfo({ cell, depType, depGroup, extraCellDeps, }) {
+    // todo: we left the type in cellDepsInfo since it requires async fetching and
+    // chain running to get the full type script of the type-id deps.
+    // Also, in devnet there is no real need to auto upgrade the system scripts with type-id
+    if (depType === 'code') {
+        let cellDeps = [
+            {
+                cellDep: {
+                    outPoint: {
+                        txHash: cell.tx_hash,
+                        index: cell.index,
+                    },
+                    depType,
+                },
+            },
+        ];
+        if (extraCellDeps && extraCellDeps.length > 0) {
+            cellDeps = [...extraCellDeps, ...cellDeps];
+        }
+        return {
+            codeHash: (cell.type_hash || cell.data_hash),
+            hashType: cell.type_hash ? 'type' : 'data2',
+            cellDeps,
+        };
+    }
+    if (depType === 'depGroup') {
+        if (!depGroup) {
+            throw new Error('require depGroup info since the dep type is depGroup');
+        }
+        let cellDeps = [
+            {
+                cellDep: {
+                    outPoint: {
+                        txHash: depGroup.txHash,
+                        index: depGroup.index,
+                    },
+                    depType,
+                },
+            },
+        ];
+        if (extraCellDeps && extraCellDeps.length > 0) {
+            cellDeps = [...extraCellDeps, ...cellDeps];
+        }
+        return {
+            codeHash: (cell.type_hash || cell.data_hash),
+            hashType: cell.type_hash ? 'type' : 'data2',
+            cellDeps,
+        };
+    }
+    throw new Error(`unknown DepType ${depType}`);
+}
 
 
 /***/ }),
@@ -4541,11 +5768,7 @@ class CKB {
                             url: network_1.networks.testnet.proxy_rpc_url,
                             fallbacks: [network_1.networks.testnet.rpc_url],
                         }) // we keep the fallbacks in case the proxy rpc is not started
-                        : new core_1.ccc.ClientPublicTestnet({
-                            url: network_1.networks.devnet.proxy_rpc_url,
-                            scripts: (0, private_1.buildCCCDevnetKnownScripts)(),
-                            fallbacks: [network_1.networks.devnet.rpc_url],
-                        });
+                        : (0, private_1.buildDevnetCCCClient)(network_1.networks.devnet.proxy_rpc_url, [network_1.networks.devnet.rpc_url]);
         }
         else {
             this.client =
@@ -4559,11 +5782,7 @@ class CKB {
                             url: network_1.networks.testnet.rpc_url,
                             fallbacks: [],
                         }) // pass it to avoid using websocket and fallback RPCs
-                        : new core_1.ccc.ClientPublicTestnet({
-                            url: network_1.networks.devnet.rpc_url,
-                            scripts: (0, private_1.buildCCCDevnetKnownScripts)(),
-                            fallbacks: [], // pass it to avoid using websocket and fallback RPCs
-                        });
+                        : (0, private_1.buildDevnetCCCClient)(network_1.networks.devnet.rpc_url);
         }
     }
     buildSigner(privateKey) {
@@ -4620,7 +5839,7 @@ class CKB {
         });
     }
     transfer(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ privateKey, toAddress, amountInCKB }) {
+        return __awaiter(this, arguments, void 0, function* ({ privateKey, toAddress, amountInCKB, rejectInputsAtOrBeforeBlock, }) {
             const signer = this.buildSigner(privateKey);
             const to = yield core_1.ccc.Address.fromString(toAddress, this.client);
             const tx = core_1.ccc.Transaction.from({
@@ -4633,6 +5852,7 @@ class CKB {
             });
             yield tx.completeInputsByCapacity(signer);
             yield tx.completeFeeBy(signer, this.feeRate);
+            yield this.assertInputsCreatedAfter(tx, rejectInputsAtOrBeforeBlock);
             const txHash = yield signer.sendTransaction(tx);
             return txHash;
         });
@@ -4802,7 +6022,7 @@ class CKB {
         });
     }
     udtTransfer(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ privateKey, toAddress, amount, udtType, kind }) {
+        return __awaiter(this, arguments, void 0, function* ({ privateKey, toAddress, amount, udtType, kind, rejectInputsAtOrBeforeBlock, }) {
             const signer = this.buildSigner(privateKey);
             const to = yield core_1.ccc.Address.fromString(toAddress, this.client);
             const amountBigInt = (0, validator_1.validateUdtAmount)(amount);
@@ -4833,10 +6053,28 @@ class CKB {
                 tx.outputsData.push(core_1.ccc.hexFrom(core_1.ccc.numToBytes(changeAmount, 16)));
             }
             yield tx.completeFeeBy(signer, this.feeRate);
+            yield this.assertInputsCreatedAfter(tx, rejectInputsAtOrBeforeBlock);
             const txHash = yield signer.sendTransaction(tx);
             return txHash;
         });
     }
+    assertInputsCreatedAfter(tx, blockNumber) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (blockNumber == null)
+                return;
+            for (const input of tx.inputs) {
+                const outPoint = input.previousOutput;
+                const origin = yield this.client.getTransactionNoCache(outPoint.txHash);
+                if ((origin === null || origin === void 0 ? void 0 : origin.blockNumber) == null) {
+                    throw new Error(`Refusing to sign: could not verify the origin block of input ${outPoint.txHash}:${outPoint.index}.`);
+                }
+                if (origin.blockNumber <= blockNumber) {
+                    throw new Error(`Refusing to sign: input ${outPoint.txHash}:${outPoint.index} was created at block ${origin.blockNumber}, ` +
+                        `at or before the Mainnet fork boundary ${blockNumber}.`);
+                }
+            }
+        });
+    }
     udtIssue(_a) {
         return __awaiter(this, arguments, void 0, function* ({ privateKey, kind, amount, typeArgs, toAddress }) {
             const signer = this.buildSigner(privateKey);
@@ -4849,7 +6087,7 @@ class CKB {
                     logger_1.logger.warn('SUDT type args are derived from the issuer lock hash; --type-args is ignored');
                 }
                 const issuerLockHash = signerAddress.script.hash();
-                resolvedTypeArgs = ('0x' + issuerLockHash.slice(2, 42));
+                resolvedTypeArgs = issuerLockHash;
             }
             else {
                 if (typeArgs) {
@@ -4877,7 +6115,7 @@ class CKB {
             yield tx.completeInputsByCapacity(signer);
             yield tx.completeFeeBy(signer, this.feeRate);
             const txHash = yield signer.sendTransaction(tx);
-            return txHash;
+            return { txHash, typeArgs: resolvedTypeArgs, receiver: to.toString() };
         });
     }
     udtDestroy(_a) {
@@ -6336,7 +7574,7 @@ const path = __importStar(__nccwpck_require__(16928));
 const fs = __importStar(__nccwpck_require__(79896));
 const os = __importStar(__nccwpck_require__(70857));
 const crypto = __importStar(__nccwpck_require__(76982));
-const adm_zip_1 = __importDefault(__nccwpck_require__(83746));
+const adm_zip_1 = __importDefault(__nccwpck_require__(3858));
 const setting_1 = __nccwpck_require__(25546);
 const logger_1 = __nccwpck_require__(65370);
 const fs_1 = __nccwpck_require__(37293);
@@ -6344,6 +7582,16 @@ const DOWNLOAD_TIMEOUT_MS = 120000;
 const EXTRACT_TIMEOUT_MS = 60000;
 // Strict semver regex: v<major>.<minor>.<patch> (no leading zeros on digits)
 const STRICT_VERSION_REGEX = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+// Independently pinned digests for the default release. Keeping these in
+// offckb makes the default installation verifiable even though ckb-tui v0.1.3
+// did not upload a checksums-sha256.txt asset.
+const KNOWN_SHA256 = {
+    'v0.1.3': {
+        'ckb-tui-with-node-linux-amd64.tar.gz': '33455cefe2c016149fa8fa3abde7960b348d4606afef9279d787ac8a8b59956f',
+        'ckb-tui-with-node-macos-aarch64.tar.gz': 'de18107ec179ced03608da956013e38ae82e6c1fae588f12c17d138ee6ee072c',
+        'ckb-tui-with-node-windows-amd64.zip': '749d8e09fd5d23fc8af12892b7d197add5aae004f7438678023e4a973f3fd58b',
+    },
+};
 class CKBTui {
     /**
      * Pure lookup — returns the expected binary path without triggering any
@@ -6460,7 +7708,7 @@ class CKBTui {
             if (curlResult.status !== 0) {
                 throw new Error(`curl exited with code ${curlResult.status}`);
             }
-            // 2. Verify checksum (best-effort: warns if checksum file is unavailable)
+            // 2. Verify checksum. Installation fails closed if no trusted digest exists.
             this.verifyChecksum(version, assetName, archivePath);
             // 3. Extract to temp directory
             logger_1.logger.info('Extracting...');
@@ -6498,64 +7746,24 @@ class CKBTui {
             }
         }
     }
-    /**
-     * Best-effort SHA-256 checksum verification.
-     * Downloads the checksum file published alongside the release asset and
-     * verifies the downloaded archive. Logs a warning (but does not fail) if
-     * the checksum file is unavailable — this maintains compatibility while
-     * the upstream project adopts checksum publishing.
-     */
+    /** Verify against an independently pinned digest. */
     static verifyChecksum(version, assetName, archivePath) {
-        const checksumUrl = `https://github.com/Officeyutong/ckb-tui/releases/download/${version}/checksums-sha256.txt`;
-        const checksumPath = path.join(path.dirname(archivePath), 'checksums-sha256.txt');
-        const fetchResult = (0, child_process_1.spawnSync)('curl', ['-fsSL', '--max-time', '30', '-o', checksumPath, checksumUrl], {
-            stdio: 'pipe',
-            timeout: 30000,
-        });
-        if (fetchResult.status !== 0) {
-            logger_1.logger.warn(`SHA-256 checksum file not available for version ${version}. ` +
-                'Skipping integrity verification. Consider asking the upstream maintainer to publish checksum files.');
-            return;
-        }
-        try {
-            const checksumContent = fs.readFileSync(checksumPath, 'utf8');
-            const expectedHash = this.parseChecksumFile(checksumContent, assetName);
-            if (!expectedHash) {
-                logger_1.logger.warn(`Checksum entry for "${assetName}" not found in checksums file. Skipping verification.`);
-                return;
-            }
-            const actualHash = crypto.createHash('sha256').update(fs.readFileSync(archivePath)).digest('hex');
-            if (actualHash !== expectedHash) {
-                throw new Error(`SHA-256 checksum mismatch for ${assetName}.\n` +
-                    `Expected: ${expectedHash}\nActual:   ${actualHash}\n` +
-                    'The downloaded file may be corrupted or tampered with.');
-            }
-            logger_1.logger.info('SHA-256 checksum verified successfully.');
-        }
-        finally {
-            try {
-                fs.unlinkSync(checksumPath);
-            }
-            catch (_a) {
-                // Best effort
-            }
+        var _a;
+        const pinnedHash = (_a = KNOWN_SHA256[version]) === null || _a === void 0 ? void 0 : _a[assetName];
+        if (!pinnedHash) {
+            throw new Error(`No trusted SHA-256 checksum is pinned for ckb-tui ${version} (${assetName}). ` +
+                'Refusing to install an unverified binary.');
         }
+        this.assertChecksum(archivePath, assetName, pinnedHash);
     }
-    /**
-     * Parse a standard SHA-256 checksum file (format: "<hash>  <filename>" per line)
-     * and return the hex hash for the given asset name, or null if not found.
-     */
-    static parseChecksumFile(content, assetName) {
-        for (const line of content.split('\n')) {
-            const trimmed = line.trim();
-            if (!trimmed || trimmed.startsWith('#'))
-                continue;
-            const match = trimmed.match(/^([0-9a-fA-F]{64})\s+[*]?(.+)$/);
-            if (match && match[2] === assetName) {
-                return match[1].toLowerCase();
-            }
+    static assertChecksum(archivePath, assetName, expectedHash) {
+        const actualHash = crypto.createHash('sha256').update(fs.readFileSync(archivePath)).digest('hex');
+        if (actualHash !== expectedHash) {
+            throw new Error(`SHA-256 checksum mismatch for ${assetName}.\n` +
+                `Expected: ${expectedHash}\nActual:   ${actualHash}\n` +
+                'The downloaded file may be corrupted or tampered with.');
         }
-        return null;
+        logger_1.logger.info('SHA-256 checksum verified successfully.');
     }
     /**
      * Extract a downloaded archive to the given directory.
@@ -6619,6 +7827,7 @@ const fs_1 = __importDefault(__nccwpck_require__(79896));
 const path_1 = __importDefault(__nccwpck_require__(16928));
 const core_1 = __nccwpck_require__(39842);
 const advanced_1 = __nccwpck_require__(98486);
+const json_rpc_1 = __nccwpck_require__(51726);
 const logger_1 = __nccwpck_require__(65370);
 const OutPointCodec = core_1.ccc.mol.struct({
     txHash: core_1.ccc.mol.Byte32,
@@ -6743,6 +7952,19 @@ function resolveInputs(client, inputs) {
         return resolved;
     });
 }
+function resolveHeaderDeps(rpc, headerDeps) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const headers = [];
+        for (const hash of headerDeps) {
+            const header = yield (0, json_rpc_1.callJsonRpc)(rpc, 'get_header', [hash]);
+            if (!header) {
+                throw new Error(`Header not found: ${hash}`);
+            }
+            headers.push(header);
+        }
+        return headers;
+    });
+}
 function dumpTransaction(_a) {
     return __awaiter(this, arguments, void 0, function* ({ rpc, txJsonFilePath, outputFilePath }) {
         try {
@@ -6758,15 +7980,16 @@ function dumpTransaction(_a) {
                 });
             const txJson = JSON.parse(fs_1.default.readFileSync(txJsonFilePath, 'utf-8'));
             const tx = advanced_1.cccA.JsonRpcTransformers.transactionTo(txJson);
-            const [cell_deps, inputs] = yield Promise.all([
+            const [cell_deps, inputs, header_deps] = yield Promise.all([
                 resolveCellDeps(client, tx.cellDeps),
                 resolveInputs(client, tx.inputs),
+                resolveHeaderDeps(rpc, tx.headerDeps),
             ]);
             const mockTx = {
                 mock_info: {
                     inputs,
                     cell_deps,
-                    header_deps: tx.headerDeps.map((h) => h.toString()),
+                    header_deps,
                 },
                 tx: {
                     version: '0x' + tx.version.toString(16),
@@ -8792,6 +10015,77 @@ function encodeBinPathForTerminal(path) {
 }
 
 
+/***/ }),
+
+/***/ 47625:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.warnIfMainnetForkSigning = warnIfMainnetForkSigning;
+exports.validateMainnetForkSigning = validateMainnetForkSigning;
+const account_json_1 = __importDefault(__nccwpck_require__(13849));
+const account_1 = __nccwpck_require__(59489);
+const setting_1 = __nccwpck_require__(25546);
+const fork_1 = __nccwpck_require__(77912);
+const base_1 = __nccwpck_require__(69951);
+const logger_1 = __nccwpck_require__(65370);
+const BUILT_IN_DEV_KEYS = new Set([...account_json_1.default.map((account) => account.privkey), account_1.ckbDevnetMinerAccount.privkey].map((key) => key.toLowerCase()));
+function warnIfMainnetForkSigning(network, privateKey) {
+    if (!readMainnetForkState(network))
+        return;
+    logMainnetForkSigningWarning(privateKey);
+}
+/**
+ * Fail closed before a Mainnet-fork transfer is constructed or signed.
+ * Returns the copied-chain tip so the transaction layer can reject inputs
+ * created at or before the fork boundary after input selection.
+ */
+function validateMainnetForkSigning(network, privateKey, allowMainnetReplayRisk = false) {
+    const fork = readMainnetForkState(network);
+    if (!fork)
+        return undefined;
+    logMainnetForkSigningWarning(privateKey);
+    if (!BUILT_IN_DEV_KEYS.has(privateKey.trim().toLowerCase()) && !allowMainnetReplayRisk) {
+        throw new Error('Refusing to sign with a non-built-in private key on a Mainnet fork. ' +
+            'Use --allow-mainnet-replay-risk only after verifying that no copied Mainnet input will be selected.');
+    }
+    if (fork.forkBlockNumber == null) {
+        throw new Error('Mainnet fork boundary metadata is missing. Restart or recreate the fork before signing so input origins can be verified.');
+    }
+    try {
+        const blockNumber = BigInt(fork.forkBlockNumber);
+        if (blockNumber < BigInt(0))
+            throw new Error('negative block number');
+        return blockNumber;
+    }
+    catch (_a) {
+        throw new Error(`Invalid Mainnet fork boundary metadata: ${fork.forkBlockNumber}`);
+    }
+}
+function readMainnetForkState(network) {
+    if (network !== base_1.Network.devnet)
+        return null;
+    const settings = (0, setting_1.readSettings)();
+    const fork = (0, fork_1.readForkState)(settings.devnet.configPath);
+    return (fork === null || fork === void 0 ? void 0 : fork.source) === 'mainnet' ? fork : null;
+}
+function logMainnetForkSigningWarning(privateKey) {
+    logger_1.logger.warn([
+        'MAINNET FORK REPLAY RISK: CKB transactions have no chain id.',
+        'A transaction spending cells copied from Mainnet can also be valid on Mainnet.',
+        'Use only built-in dev keys and fork-mined cells unless you explicitly accept that risk.',
+    ]);
+    if (!BUILT_IN_DEV_KEYS.has(privateKey.trim().toLowerCase())) {
+        logger_1.logger.warn('A non-built-in private key is being used on a Mainnet fork. Verify every input before signing.');
+    }
+}
+
+
 /***/ }),
 
 /***/ 37293:
@@ -8897,22 +10191,23 @@ function copyFileSync(source, target) {
     }
     fs.writeFileSync(targetFile, fs.readFileSync(source));
 }
-function copyFilesWithExclusion(sourceDir, destinationDir, excludedFolders) {
-    return __awaiter(this, void 0, void 0, function* () {
+function copyFilesWithExclusion(sourceDir_1, destinationDir_1, excludedFolders_1) {
+    return __awaiter(this, arguments, void 0, function* (sourceDir, destinationDir, excludedFolders, overwrite = true) {
         try {
             // Ensure the destination directory exists
             yield fs.promises.mkdir(destinationDir, { recursive: true });
             // Start copying recursively from the source directory
-            yield copyRecursive(sourceDir, destinationDir, excludedFolders);
+            yield copyRecursive(sourceDir, destinationDir, excludedFolders, overwrite);
         }
         catch (error) {
             logger_1.logger.error('An error occurred during copying files:', error);
+            throw error;
         }
     });
 }
 // Function to recursively copy files and directories
-function copyRecursive(source, destination, excludedFolders) {
-    return __awaiter(this, void 0, void 0, function* () {
+function copyRecursive(source_1, destination_1, excludedFolders_1) {
+    return __awaiter(this, arguments, void 0, function* (source, destination, excludedFolders, overwrite = true) {
         // Get a list of all files and directories in the source directory
         const files = yield fs.promises.readdir(source);
         // Iterate through each file or directory
@@ -8929,12 +10224,14 @@ function copyRecursive(source, destination, excludedFolders) {
                 else {
                     // Ensure destination directory exists before copying
                     yield fs.promises.mkdir(destPath, { recursive: true });
-                    yield copyRecursive(sourcePath, destPath, excludedFolders);
+                    yield copyRecursive(sourcePath, destPath, excludedFolders, overwrite);
                 }
             }
             else {
                 // Otherwise, copy the file
-                yield fs.promises.copyFile(sourcePath, destPath);
+                if (overwrite || !fs.existsSync(destPath)) {
+                    yield fs.promises.copyFile(sourcePath, destPath);
+                }
             }
         }
     });
@@ -9019,6 +10316,85 @@ function getSubfolders(folderPath) {
 }
 
 
+/***/ }),
+
+/***/ 51726:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.callJsonRpc = callJsonRpc;
+const http_1 = __importDefault(__nccwpck_require__(58611));
+const https_1 = __importDefault(__nccwpck_require__(65692));
+// Minimal raw JSON-RPC caller. Unlike Request.send it never goes through the
+// configured proxy, which makes it safe for talking to the local devnet node.
+function callJsonRpc(rpcUrl_1, method_1, params_1) {
+    return __awaiter(this, arguments, void 0, function* (rpcUrl, method, params, timeoutMs = 30000) {
+        const body = JSON.stringify({ id: 1, jsonrpc: '2.0', method, params });
+        const url = new URL(rpcUrl);
+        const transport = url.protocol === 'https:' ? https_1.default : http_1.default;
+        return new Promise((resolve, reject) => {
+            const req = transport.request({
+                hostname: url.hostname,
+                port: url.port || (url.protocol === 'https:' ? 443 : 80),
+                path: url.pathname + url.search,
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    'content-length': Buffer.byteLength(body),
+                },
+                timeout: timeoutMs,
+            }, (res) => {
+                const chunks = [];
+                res.on('data', (chunk) => chunks.push(chunk));
+                // The response stream can error or close before `end` (connection
+                // reset, truncated body). Without these listeners the promise would
+                // hang until the request timeout — or the process would crash on an
+                // unhandled stream error.
+                res.once('error', reject);
+                res.on('close', () => {
+                    if (!res.complete) {
+                        reject(new Error(`JSON-RPC ${method} to ${rpcUrl} returned a truncated response`));
+                    }
+                });
+                res.on('end', () => {
+                    try {
+                        const parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                        if (parsed.error) {
+                            reject(new Error(`JSON-RPC ${method} failed: ${JSON.stringify(parsed.error)}`));
+                            return;
+                        }
+                        resolve(parsed.result);
+                    }
+                    catch (error) {
+                        reject(new Error(`Invalid JSON-RPC response from ${rpcUrl}: ${error.message}`));
+                    }
+                });
+            });
+            req.on('timeout', () => {
+                req.destroy(new Error(`JSON-RPC ${method} to ${rpcUrl} timed out`));
+            });
+            req.on('error', reject);
+            req.write(body);
+            req.end();
+        });
+    });
+}
+
+
 /***/ }),
 
 /***/ 27814:
@@ -9100,6 +10476,7 @@ const levelColors = {
 };
 class UnifiedLogger {
     constructor(options = {}) {
+        this.resultEmitted = false;
         this.enableColors = options.enableColors !== false;
         this.showLevel = options.showLevel !== false;
         this.jsonMode = options.jsonMode === true;
@@ -9109,8 +10486,8 @@ class UnifiedLogger {
             levels: {
                 error: 0,
                 warn: 1,
-                info: 2,
-                success: 3,
+                success: 2,
+                info: 3,
                 debug: 4,
             },
             format: winston_1.default.format.combine(winston_1.default.format.timestamp(), winston_1.default.format.errors({ stack: true }), winston_1.default.format.printf(({ level, message, timestamp }) => {
@@ -9122,6 +10499,7 @@ class UnifiedLogger {
                 }),
             ],
         });
+        this.setJsonMode(this.jsonMode);
     }
     /**
      * Toggle JSON output mode. When enabled, every log line is emitted as a
@@ -9129,6 +10507,36 @@ class UnifiedLogger {
      */
     setJsonMode(enabled) {
         this.jsonMode = enabled;
+        // In machine mode stdout is reserved for command result records. Progress
+        // and diagnostics remain NDJSON, but go to stderr so callers can parse one
+        // stable stdout object without filtering human-oriented logs.
+        for (const transport of this.logger.transports) {
+            if (transport instanceof winston_1.default.transports.Console) {
+                const consoleTransport = transport;
+                consoleTransport.stderrLevels = Object.fromEntries((enabled ? Object.keys(levelColors) : ['error', 'warn']).map((level) => [level, true]));
+            }
+        }
+    }
+    isJsonMode() {
+        return this.jsonMode;
+    }
+    /** Emit one stable, command-level result record for programmatic callers. */
+    result(result) {
+        if (this.jsonMode && !this.resultEmitted) {
+            this.resultEmitted = true;
+            node_process_1.default.stdout.write(`${JSON.stringify(Object.assign({ ok: true }, result))}\n`);
+        }
+    }
+    hasResult() {
+        return this.resultEmitted;
+    }
+    /** Emit a stable error record without exposing internal stack traces. */
+    failure(code, message, details) {
+        if (this.jsonMode) {
+            node_process_1.default.stderr.write(`${JSON.stringify(Object.assign({ ok: false, code, message }, (details == null ? {} : { details })))}\n`);
+            return;
+        }
+        this.error(message);
     }
     /**
      * Format the message with appropriate colors and structure
@@ -9311,6 +10719,43 @@ const logger = UnifiedLogger.create({ showLevel: false });
 exports.logger = logger;
 
 
+/***/ }),
+
+/***/ 26241:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.resolvePrivateKey = resolvePrivateKey;
+const fs_1 = __importDefault(__nccwpck_require__(79896));
+const path_1 = __importDefault(__nccwpck_require__(16928));
+function resolvePrivateKey(input, defaultKey) {
+    if (input.privkey && input.privkeyFile) {
+        throw new Error('Use only one of --privkey or --privkey-file.');
+    }
+    if (input.privkey)
+        return input.privkey;
+    if (input.privkeyFile) {
+        const filePath = path_1.default.resolve(input.privkeyFile);
+        try {
+            return fs_1.default.readFileSync(filePath, 'utf8').trim();
+        }
+        catch (error) {
+            throw new Error(`Could not read private key file ${filePath}: ${error.message}`);
+        }
+    }
+    if (process.env.OFFCKB_PRIVATE_KEY)
+        return process.env.OFFCKB_PRIVATE_KEY;
+    if (defaultKey)
+        return defaultKey;
+    throw new Error('--privkey, --privkey-file, or OFFCKB_PRIVATE_KEY is required!');
+}
+
+
 /***/ }),
 
 /***/ 65897:
@@ -9405,7 +10850,6 @@ exports.validateUdtTypeArgs = validateUdtTypeArgs;
 const path_1 = __importDefault(__nccwpck_require__(16928));
 const fs_1 = __importDefault(__nccwpck_require__(79896));
 const base_1 = __nccwpck_require__(69951);
-const logger_1 = __nccwpck_require__(65370);
 function validateTypescriptWorkspace() {
     const cwd = process.cwd();
     // Check if package.json exists
@@ -9447,8 +10891,7 @@ function validateNetworkOpt(network) {
         throw new Error('invalid network option, ' + network);
     }
     if (network === base_1.Network.mainnet) {
-        logger_1.logger.info('Mainnet not support yet. Please use CKB-CLI to operate on mainnet for better security. Check https://github.com/nervosnetwork/ckb-cli');
-        process.exit(1);
+        throw new Error('Mainnet not support yet. Please use CKB-CLI to operate on mainnet for better security. Check https://github.com/nervosnetwork/ckb-cli');
     }
 }
 function isValidVersion(version) {
@@ -9504,9 +10947,12 @@ function validateUdtKind(kind) {
 const U128_MAX = (BigInt(1) << BigInt(128)) - BigInt(1);
 function validateUdtAmount(amount) {
     if (!/^\d+$/.test(amount)) {
-        throw new Error(`invalid UDT amount "${amount}", must be a non-negative decimal integer`);
+        throw new Error(`invalid UDT amount "${amount}", must be a positive decimal integer`);
     }
     const value = BigInt(amount);
+    if (value === BigInt(0)) {
+        throw new Error('invalid UDT amount "0", must be greater than zero');
+    }
     if (value > U128_MAX) {
         throw new Error(`UDT amount exceeds 128-bit max: ${amount}`);
     }
@@ -9522,8 +10968,8 @@ function validateHexString(value, name) {
 function validateUdtTypeArgs(kind, typeArgs) {
     const hex = validateHexString(typeArgs, 'type args');
     const byteLength = (hex.length - 2) / 2;
-    if (kind === 'sudt' && byteLength !== 20) {
-        throw new Error(`invalid SUDT type args length: expected 20 bytes, got ${byteLength}`);
+    if (kind === 'sudt' && byteLength !== 32) {
+        throw new Error(`invalid SUDT type args length: expected 32 bytes, got ${byteLength}`);
     }
     if (kind === 'xudt' && byteLength !== 32) {
         throw new Error(`invalid xUDT type args length: expected 32 bytes, got ${byteLength}`);
@@ -17273,13 +18719,13 @@ exports.randomBytes = randomBytes;
 
 /***/ }),
 
-/***/ 83746:
+/***/ 3858:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-const Utils = __nccwpck_require__(28605);
+const Utils = __nccwpck_require__(91373);
 const pth = __nccwpck_require__(16928);
-const ZipEntry = __nccwpck_require__(59155);
-const ZipFile = __nccwpck_require__(43985);
+const ZipEntry = __nccwpck_require__(58851);
+const ZipFile = __nccwpck_require__(46593);
 
 const get_Bool = (...val) => Utils.findLast(val, (c) => typeof c === "boolean");
 const get_Str = (...val) => Utils.findLast(val, (c) => typeof c === "string");
@@ -17325,6 +18771,18 @@ module.exports = function (/**String*/ input, /** object */ options) {
     // instanciate utils filesystem
     const filetools = new Utils(opts);
 
+    // Restore the archived permissions on extracted directories. This has to run
+    // after a directory's contents are written: applying a restrictive mode
+    // (e.g. 0o500) up front would stop us writing the files it contains. Applying
+    // the deepest paths first keeps parent directories traversable while their
+    // children are updated (issue #530).
+    const applyDirAttributes = (dirEntries) => {
+        dirEntries
+            .filter((d) => d.attr)
+            .sort((a, b) => b.path.length - a.path.length)
+            .forEach((d) => filetools.fs.chmodSync(d.path, d.attr));
+    };
+
     if (typeof opts.decoder !== "object" || typeof opts.decoder.encode !== "function" || typeof opts.decoder.decode !== "function") {
         opts.decoder = Utils.decoder;
     }
@@ -17364,7 +18822,7 @@ module.exports = function (/**String*/ input, /** object */ options) {
     function fixPath(zipPath) {
         const { join, normalize, sep } = pth.posix;
         // convert windows file separators and normalize
-        return join(".", normalize(sep + zipPath.split("\\").join(sep) + sep));
+        return join(pth.isAbsolute(zipPath) ? "/": '.',  normalize(sep + zipPath.split("\\").join(sep) + sep));
     }
 
     function filenameFilter(filterfn) {
@@ -17479,6 +18937,7 @@ module.exports = function (/**String*/ input, /** object */ options) {
          * Remove the entry from the file or the entry and all it's nested directories and files if the given entry is a directory
          *
          * @param {ZipEntry|string} entry
+         * @param {boolean} withsubfolders
          * @returns {void}
          */
         deleteFile: function (entry, withsubfolders = true) {
@@ -17763,7 +19222,7 @@ module.exports = function (/**String*/ input, /** object */ options) {
         addLocalFolderAsync2: function (options, callback) {
             const self = this;
             options = typeof options === "object" ? options : { localPath: options };
-            localPath = pth.resolve(fixPath(options.localPath));
+            const localPath = pth.resolve(fixPath(options.localPath));
             let { zipPath, filter, namefix } = options;
 
             if (filter instanceof RegExp) {
@@ -17782,7 +19241,7 @@ module.exports = function (/**String*/ input, /** object */ options) {
             zipPath = zipPath ? fixPath(zipPath) : "";
 
             // Check Namefix function
-            if (namefix == "latin1") {
+            if (namefix === "latin1") {
                 namefix = (str) =>
                     str
                         .normalize("NFD")
@@ -17958,7 +19417,7 @@ module.exports = function (/**String*/ input, /** object */ options) {
 
             var entryName = canonical(item.entryName);
 
-            var target = sanitize(targetPath, outFileName && !item.isDirectory ? outFileName : maintainEntryPath ? entryName : pth.basename(entryName));
+            var target = sanitize(targetPath, outFileName && !item.isDirectory ? canonical(outFileName) : maintainEntryPath ? entryName : pth.basename(entryName));
 
             if (item.isDirectory) {
                 var children = _zip.getEntryChildren(item);
@@ -17968,8 +19427,12 @@ module.exports = function (/**String*/ input, /** object */ options) {
                     if (!content) {
                         throw Utils.Errors.CANT_EXTRACT_FILE();
                     }
-                    var name = canonical(child.entryName);
-                    var childName = sanitize(targetPath, maintainEntryPath ? name : pth.basename(name));
+                    // When not maintaining the full entry path, keep each child's path
+                    // relative to the extracted directory (drop the directory's own
+                    // prefix) instead of flattening every file to its basename, which
+                    // collapsed subdirectories together (issue #306).
+                    var name = canonical(maintainEntryPath ? child.entryName : child.entryName.substring(item.entryName.length));
+                    var childName = sanitize(targetPath, name);
                     // The reverse operation for attr depend on method addFile()
                     const fileAttr = keepOriginalPermission ? child.header.fileAttr : undefined;
                     filetools.writeFileTo(childName, content, overwrite, fileAttr);
@@ -17999,12 +19462,14 @@ module.exports = function (/**String*/ input, /** object */ options) {
                 return false;
             }
 
-            for (var entry in _zip.entries) {
+            for (var entry of _zip.entries) {
                 try {
                     if (entry.isDirectory) {
                         continue;
                     }
-                    var content = _zip.entries[entry].getData(pass);
+                    // was `_zip.entries[entry]` (indexing the array with an entry
+                    // object -> undefined -> threw -> test() always returned false)
+                    var content = entry.getData(pass);
                     if (!content) {
                         return false;
                     }
@@ -18031,10 +19496,13 @@ module.exports = function (/**String*/ input, /** object */ options) {
             overwrite = get_Bool(false, overwrite);
             if (!_zip) throw Utils.Errors.NO_ZIP();
 
+            const dirEntries = [];
             _zip.entries.forEach(function (entry) {
                 var entryName = sanitize(targetPath, canonical(entry.entryName));
                 if (entry.isDirectory) {
                     filetools.makeDir(entryName);
+                    // defer restoring the directory permission until its files are written
+                    if (keepOriginalPermission) dirEntries.push({ path: entryName, attr: entry.header.fileAttr });
                     return;
                 }
                 var content = entry.getData(pass);
@@ -18045,11 +19513,15 @@ module.exports = function (/**String*/ input, /** object */ options) {
                 const fileAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;
                 filetools.writeFileTo(entryName, content, overwrite, fileAttr);
                 try {
+                    // best-effort: an invalid date in the archive or a filesystem that
+                    // rejects utimes must not fail extraction of already-written content (issue #379)
                     filetools.fs.utimesSync(entryName, entry.header.time, entry.header.time);
                 } catch (err) {
-                    throw Utils.Errors.CANT_EXTRACT_FILE();
+                    /* ignore timestamp failures */
                 }
             });
+
+            applyDirAttributes(dirEntries);
         },
 
         /**
@@ -18100,20 +19572,41 @@ module.exports = function (/**String*/ input, /** object */ options) {
 
             // Create directory entries first synchronously
             // this prevents race condition and assures folders are there before writing files
+            const deferredDirAttr = [];
             for (const entry of dirEntries) {
                 const dirPath = getPath(entry);
                 // The reverse operation for attr depend on method addFile()
                 const dirAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;
                 try {
                     filetools.makeDir(dirPath);
-                    if (dirAttr) filetools.fs.chmodSync(dirPath, dirAttr);
-                    // in unix timestamp will change if files are later added to folder, but still
-                    filetools.fs.utimesSync(dirPath, entry.header.time, entry.header.time);
                 } catch (er) {
                     callback(getError("Unable to create folder", dirPath));
+                    continue;
+                }
+                // defer restoring the directory permission until its files are written:
+                // a restrictive mode applied now would block writing them
+                if (dirAttr) deferredDirAttr.push({ path: dirPath, attr: dirAttr });
+                try {
+                    // in unix timestamp will change if files are later added to folder, but still.
+                    // best-effort: a utimes failure must not abort extraction (issue #379)
+                    filetools.fs.utimesSync(dirPath, entry.header.time, entry.header.time);
+                } catch (er) {
+                    /* ignore timestamp failures */
                 }
             }
 
+            // restore directory permissions once every file has been extracted
+            const done = (err) => {
+                if (!err) {
+                    try {
+                        applyDirAttributes(deferredDirAttr);
+                    } catch (er) {
+                        return callback(getError("Unable to set folder permissions", er.path || ""));
+                    }
+                }
+                callback(err);
+            };
+
             fileEntries.reverse().reduce(function (next, entry) {
                 return function (err) {
                     if (err) {
@@ -18131,21 +19624,19 @@ module.exports = function (/**String*/ input, /** object */ options) {
                                 const fileAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;
                                 filetools.writeFileToAsync(filePath, content, overwrite, fileAttr, function (succ) {
                                     if (!succ) {
-                                        next(getError("Unable to write file", filePath));
+                                        return next(getError("Unable to write file", filePath));
                                     }
-                                    filetools.fs.utimes(filePath, entry.header.time, entry.header.time, function (err_2) {
-                                        if (err_2) {
-                                            next(getError("Unable to set times", filePath));
-                                        } else {
-                                            next();
-                                        }
+                                    filetools.fs.utimes(filePath, entry.header.time, entry.header.time, function () {
+                                        // best-effort: a utimes failure must not abort extraction
+                                        // of already-written content (issue #379)
+                                        next();
                                     });
                                 });
                             }
                         });
                     }
                 };
-            }, callback)();
+            }, done)();
         },
 
         /**
@@ -18229,10 +19720,10 @@ module.exports = function (/**String*/ input, /** object */ options) {
 
 /***/ }),
 
-/***/ 2916:
+/***/ 88436:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-var Utils = __nccwpck_require__(28605),
+var Utils = __nccwpck_require__(91373),
     Constants = Utils.Constants;
 
 /* The central directory file header */
@@ -18321,6 +19812,7 @@ module.exports = function () {
             switch (val) {
                 case Constants.STORED:
                     this.version = 10;
+                    break;
                 case Constants.DEFLATED:
                 default:
                     this.version = 20;
@@ -18332,6 +19824,7 @@ module.exports = function () {
             return Utils.fromDOS2Date(this.timeval);
         },
         set time(val) {
+            val = new Date(val);
             this.timeval = Utils.fromDate2DOS(val);
         },
 
@@ -18454,6 +19947,8 @@ module.exports = function () {
             _localHeader.version = data.readUInt16LE(Constants.LOCVER);
             // general purpose bit flag
             _localHeader.flags = data.readUInt16LE(Constants.LOCFLG);
+            // desc flag
+            _localHeader.flags_desc = (_localHeader.flags & Constants.FLG_DESC) > 0;
             // compression method
             _localHeader.method = data.readUInt16LE(Constants.LOCHOW);
             // modification time (2 bytes time, 2 bytes date)
@@ -18520,7 +20015,11 @@ module.exports = function () {
             // version needed to extract
             data.writeUInt16LE(_version, Constants.LOCVER);
             // general purpose bit flag
-            data.writeUInt16LE(_flags, Constants.LOCFLG);
+            // clear bit 3 (data descriptor): we always write the real crc-32
+            // and sizes into this local header, so no trailing descriptor is
+            // emitted. Leaving the flag set would make the output unreadable
+            // (see issue #555).
+            data.writeUInt16LE(_flags & ~Constants.FLG_DESC, Constants.LOCFLG);
             // compression method
             data.writeUInt16LE(_method, Constants.LOCHOW);
             // modification time (2 bytes time, 2 bytes date)
@@ -18548,7 +20047,9 @@ module.exports = function () {
             // version needed to extract
             data.writeUInt16LE(_version, Constants.CENVER);
             // encrypt, decrypt flags
-            data.writeUInt16LE(_flags, Constants.CENFLG);
+            // clear bit 3 (data descriptor) to match the local header we emit
+            // (real crc/sizes are written, no descriptor follows the data) — issue #555
+            data.writeUInt16LE(_flags & ~Constants.FLG_DESC, Constants.CENFLG);
             // compression method
             data.writeUInt16LE(_method, Constants.CENHOW);
             // modification time (2 bytes time, 2 bytes date)
@@ -18610,19 +20111,19 @@ module.exports = function () {
 
 /***/ }),
 
-/***/ 57405:
+/***/ 77837:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
-exports.EntryHeader = __nccwpck_require__(2916);
-exports.MainHeader = __nccwpck_require__(81289);
+exports.EntryHeader = __nccwpck_require__(88436);
+exports.MainHeader = __nccwpck_require__(88889);
 
 
 /***/ }),
 
-/***/ 81289:
+/***/ 88889:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-var Utils = __nccwpck_require__(28605),
+var Utils = __nccwpck_require__(91373),
     Constants = Utils.Constants;
 
 /* The entries in the end of central directory */
@@ -18633,6 +20134,8 @@ module.exports = function () {
         _offset = 0,
         _commentLength = 0;
 
+    const needsZip64 = () => _volumeEntries > Constants.EF_ZIP64_OR_16 || _totalEntries > Constants.EF_ZIP64_OR_16 || _size > Constants.EF_ZIP64_OR_32 || _offset > Constants.EF_ZIP64_OR_32;
+
     return {
         get diskEntries() {
             return _volumeEntries;
@@ -18670,7 +20173,7 @@ module.exports = function () {
         },
 
         get mainHeaderSize() {
-            return Constants.ENDHDR + _commentLength;
+            return (needsZip64() ? Constants.ZIP64HDR + Constants.END64HDR : 0) + Constants.ENDHDR + _commentLength;
         },
 
         loadFromBinary: function (/*Buffer*/ data) {
@@ -18700,7 +20203,7 @@ module.exports = function () {
                 // total number of entries
                 _totalEntries = Utils.readBigUInt64LE(data, Constants.ZIP64TOT);
                 // central directory size in bytes
-                _size = Utils.readBigUInt64LE(data, Constants.ZIP64SIZE);
+                _size = Utils.readBigUInt64LE(data, Constants.ZIP64SIZB);
                 // offset of first CEN header
                 _offset = Utils.readBigUInt64LE(data, Constants.ZIP64OFF);
 
@@ -18709,22 +20212,67 @@ module.exports = function () {
         },
 
         toBinary: function () {
-            var b = Buffer.alloc(Constants.ENDHDR + _commentLength);
+            if (!needsZip64()) {
+                var b = Buffer.alloc(Constants.ENDHDR + _commentLength);
+                // "PK 05 06" signature
+                b.writeUInt32LE(Constants.ENDSIG, 0);
+                b.writeUInt32LE(0, 4);
+                // number of entries on this volume
+                b.writeUInt16LE(_volumeEntries, Constants.ENDSUB);
+                // total number of entries
+                b.writeUInt16LE(_totalEntries, Constants.ENDTOT);
+                // central directory size in bytes
+                b.writeUInt32LE(_size, Constants.ENDSIZ);
+                // offset of first CEN header
+                b.writeUInt32LE(_offset, Constants.ENDOFF);
+                // zip file comment length
+                b.writeUInt16LE(_commentLength, Constants.ENDCOM);
+                // fill comment memory with spaces so no garbage is left there
+                b.fill(" ", Constants.ENDHDR);
+
+                return b;
+            }
+
+            var b = Buffer.alloc(this.mainHeaderSize);
+            let offset = 0;
+
+            // Zip64 end of central directory record.
+            b.writeUInt32LE(Constants.ZIP64SIG, offset);
+            Utils.writeBigUInt64LE(b, Constants.ZIP64HDR - Constants.ZIP64LEAD, offset + Constants.ZIP64SIZE);
+            b.writeUInt16LE(45, offset + Constants.ZIP64VEM);
+            b.writeUInt16LE(45, offset + Constants.ZIP64VER);
+            b.writeUInt32LE(0, offset + Constants.ZIP64DSK);
+            b.writeUInt32LE(0, offset + Constants.ZIP64DSKDIR);
+            Utils.writeBigUInt64LE(b, _volumeEntries, offset + Constants.ZIP64SUB);
+            Utils.writeBigUInt64LE(b, _totalEntries, offset + Constants.ZIP64TOT);
+            Utils.writeBigUInt64LE(b, _size, offset + Constants.ZIP64SIZB);
+            Utils.writeBigUInt64LE(b, _offset, offset + Constants.ZIP64OFF);
+
+            const zip64EndOffset = _offset + _size;
+            offset += Constants.ZIP64HDR;
+
+            // Zip64 end of central directory locator.
+            b.writeUInt32LE(Constants.END64SIG, offset);
+            b.writeUInt32LE(0, offset + Constants.END64START);
+            Utils.writeBigUInt64LE(b, zip64EndOffset, offset + Constants.END64OFF);
+            b.writeUInt32LE(1, offset + Constants.END64NUMDISKS);
+            offset += Constants.END64HDR;
+
             // "PK 05 06" signature
-            b.writeUInt32LE(Constants.ENDSIG, 0);
-            b.writeUInt32LE(0, 4);
+            b.writeUInt32LE(Constants.ENDSIG, offset);
+            b.writeUInt32LE(0, offset + 4);
             // number of entries on this volume
-            b.writeUInt16LE(_volumeEntries, Constants.ENDSUB);
+            b.writeUInt16LE(Math.min(_volumeEntries, Constants.EF_ZIP64_OR_16), offset + Constants.ENDSUB);
             // total number of entries
-            b.writeUInt16LE(_totalEntries, Constants.ENDTOT);
+            b.writeUInt16LE(Math.min(_totalEntries, Constants.EF_ZIP64_OR_16), offset + Constants.ENDTOT);
             // central directory size in bytes
-            b.writeUInt32LE(_size, Constants.ENDSIZ);
+            b.writeUInt32LE(Math.min(_size, Constants.EF_ZIP64_OR_32), offset + Constants.ENDSIZ);
             // offset of first CEN header
-            b.writeUInt32LE(_offset, Constants.ENDOFF);
+            b.writeUInt32LE(Math.min(_offset, Constants.EF_ZIP64_OR_32), offset + Constants.ENDOFF);
             // zip file comment length
-            b.writeUInt16LE(_commentLength, Constants.ENDCOM);
+            b.writeUInt16LE(_commentLength, offset + Constants.ENDCOM);
             // fill comment memory with spaces so no garbage is left there
-            b.fill(" ", Constants.ENDHDR);
+            b.fill(" ", offset + Constants.ENDHDR);
 
             return b;
         },
@@ -18756,7 +20304,7 @@ module.exports = function () {
 
 /***/ }),
 
-/***/ 90858:
+/***/ 49466:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 module.exports = function (/*Buffer*/ inbuf) {
@@ -18796,20 +20344,20 @@ module.exports = function (/*Buffer*/ inbuf) {
 
 /***/ }),
 
-/***/ 93133:
+/***/ 70493:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
-exports.Deflater = __nccwpck_require__(90858);
-exports.Inflater = __nccwpck_require__(33938);
-exports.ZipCrypto = __nccwpck_require__(12759);
+exports.Deflater = __nccwpck_require__(49466);
+exports.Inflater = __nccwpck_require__(27298);
+exports.ZipCrypto = __nccwpck_require__(19687);
 
 
 /***/ }),
 
-/***/ 33938:
+/***/ 27298:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-const version = +(process.versions ? process.versions.node : "").split(".")[0] || 0;
+const version = +(process?.versions?.node ?? "").split(".")[0] || 0;
 
 module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
     var zlib = __nccwpck_require__(43106);
@@ -18847,7 +20395,7 @@ module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
 
 /***/ }),
 
-/***/ 12759:
+/***/ 19687:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 "use strict";
@@ -18856,7 +20404,7 @@ module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
 // node crypt, we use it for generate salt
 // eslint-disable-next-line node/no-unsupported-features/node-builtins
 const { randomFillSync } = __nccwpck_require__(76982);
-const Errors = __nccwpck_require__(68978);
+const Errors = __nccwpck_require__(9314);
 
 // generate CRC32 lookup table
 const crctable = new Uint32Array(256).map((t, crc) => {
@@ -19030,7 +20578,7 @@ module.exports = { decrypt, encrypt, _salter };
 
 /***/ }),
 
-/***/ 44436:
+/***/ 85604:
 /***/ ((module) => {
 
 module.exports = {
@@ -19179,7 +20727,7 @@ module.exports = {
 
 /***/ }),
 
-/***/ 40801:
+/***/ 95825:
 /***/ ((module) => {
 
 module.exports = {
@@ -19191,7 +20739,7 @@ module.exports = {
 
 /***/ }),
 
-/***/ 68978:
+/***/ 9314:
 /***/ ((__unused_webpack_module, exports) => {
 
 const errors = {
@@ -19261,7 +20809,7 @@ for (const msg of Object.keys(errors)) {
 
 /***/ }),
 
-/***/ 62328:
+/***/ 71560:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 const pth = __nccwpck_require__(16928);
@@ -19344,25 +20892,25 @@ module.exports = function (/*String*/ path, /*Utils object*/ { fs }) {
 
 /***/ }),
 
-/***/ 28605:
+/***/ 91373:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-module.exports = __nccwpck_require__(32904);
-module.exports.Constants = __nccwpck_require__(44436);
-module.exports.Errors = __nccwpck_require__(68978);
-module.exports.FileAttr = __nccwpck_require__(62328);
-module.exports.decoder = __nccwpck_require__(40801);
+module.exports = __nccwpck_require__(12056);
+module.exports.Constants = __nccwpck_require__(85604);
+module.exports.Errors = __nccwpck_require__(9314);
+module.exports.FileAttr = __nccwpck_require__(71560);
+module.exports.decoder = __nccwpck_require__(95825);
 
 
 /***/ }),
 
-/***/ 32904:
+/***/ 12056:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 const fsystem = __nccwpck_require__(79896);
 const pth = __nccwpck_require__(16928);
-const Constants = __nccwpck_require__(44436);
-const Errors = __nccwpck_require__(68978);
+const Constants = __nccwpck_require__(85604);
+const Errors = __nccwpck_require__(9314);
 const isWin = typeof process === "object" && "win32" === process.platform;
 
 const is_Obj = (obj) => typeof obj === "object" && obj !== null;
@@ -19410,7 +20958,11 @@ Utils.prototype.makeDir = function (/*String*/ folder) {
             try {
                 stat = self.fs.statSync(resolvedPath);
             } catch (e) {
-                self.fs.mkdirSync(resolvedPath);
+                if (e.message && e.message.startsWith('ENOENT')) {
+                    self.fs.mkdirSync(resolvedPath);
+                } else {
+                    throw e;
+                }
             }
             if (stat && stat.isFile()) throw Errors.FILE_IN_THE_WAY(`"${resolvedPath}"`);
         });
@@ -19464,39 +21016,51 @@ Utils.prototype.writeFileToAsync = function (/*String*/ path, /*Buffer*/ content
         if (exist && !overwrite) return callback(false);
 
         self.fs.stat(path, function (err, stat) {
-            if (exist && stat.isDirectory()) {
+            if (exist && stat && stat.isDirectory()) {
                 return callback(false);
             }
 
             var folder = pth.dirname(path);
             self.fs.exists(folder, function (exists) {
-                if (!exists) self.makeDir(folder);
+                if (!exists) {
+                    // makeDir is synchronous and can throw (e.g. EACCES); report failure
+                    // rather than letting it escape this callback as an uncaught exception
+                    try {
+                        self.makeDir(folder);
+                    } catch (e) {
+                        return callback(false);
+                    }
+                }
+
+                // write the content to an open descriptor, then apply the attributes
+                const writeToFd = function (fd) {
+                    self.fs.write(fd, content, 0, content.length, 0, function (writeErr) {
+                        self.fs.close(fd, function () {
+                            // surface write failures instead of silently reporting success (issue #402)
+                            if (writeErr) return callback(false);
+                            self.fs.chmod(path, attr || 0o666, function () {
+                                callback(true);
+                            });
+                        });
+                    });
+                };
 
                 self.fs.open(path, "w", 0o666, function (err, fd) {
                     if (err) {
+                        // the target may exist but be read-only: make it writable and retry once
                         self.fs.chmod(path, 0o666, function () {
-                            self.fs.open(path, "w", 0o666, function (err, fd) {
-                                self.fs.write(fd, content, 0, content.length, 0, function () {
-                                    self.fs.close(fd, function () {
-                                        self.fs.chmod(path, attr || 0o666, function () {
-                                            callback(true);
-                                        });
-                                    });
-                                });
+                            self.fs.open(path, "w", 0o666, function (retryErr, fd) {
+                                // Previously the retry error was ignored and an undefined fd was
+                                // passed to fs.write, throwing an uncaught ERR_INVALID_ARG_TYPE that
+                                // crashed the process (issues #470, #459, #402). Report failure instead.
+                                if (retryErr || !fd) return callback(false);
+                                writeToFd(fd);
                             });
                         });
                     } else if (fd) {
-                        self.fs.write(fd, content, 0, content.length, 0, function () {
-                            self.fs.close(fd, function () {
-                                self.fs.chmod(path, attr || 0o666, function () {
-                                    callback(true);
-                                });
-                            });
-                        });
+                        writeToFd(fd);
                     } else {
-                        self.fs.chmod(path, attr || 0o666, function () {
-                            callback(true);
-                        });
+                        callback(false);
                     }
                 });
             });
@@ -19507,7 +21071,7 @@ Utils.prototype.writeFileToAsync = function (/*String*/ path, /*Buffer*/ content
 Utils.prototype.findFiles = function (/*String*/ path) {
     const self = this;
 
-    function findSync(/*String*/ dir, /*RegExp*/ pattern, /*Boolean*/ recursive) {
+    function findSync(/*String*/ dir, /*RegExp*/ pattern, /*Boolean*/ recursive, /*Set*/ visited) {
         if (typeof pattern === "boolean") {
             recursive = pattern;
             pattern = undefined;
@@ -19521,12 +21085,22 @@ Utils.prototype.findFiles = function (/*String*/ path) {
                 files.push(pth.normalize(path) + (stat.isDirectory() ? self.sep : ""));
             }
 
-            if (stat.isDirectory() && recursive) files = files.concat(findSync(path, pattern, recursive));
+            if (stat.isDirectory() && recursive) {
+                // Descend by resolved real path and skip directories we have already
+                // visited. This stops a symlink that points back to an ancestor from
+                // recursing forever until the path fails with ELOOP / ENAMETOOLONG
+                // (issue #541).
+                const realDir = self.fs.realpathSync(path);
+                if (!visited.has(realDir)) {
+                    visited.add(realDir);
+                    files = files.concat(findSync(path, pattern, recursive, visited));
+                }
+            }
         });
         return files;
     }
 
-    return findSync(path, undefined, true);
+    return findSync(path, undefined, true, new Set([self.fs.realpathSync(path)]));
 };
 
 /**
@@ -19544,29 +21118,54 @@ Utils.prototype.findFiles = function (/*String*/ path) {
  */
 Utils.prototype.findFilesAsync = function (dir, cb) {
     const self = this;
-    let results = [];
-    self.fs.readdir(dir, function (err, list) {
-        if (err) return cb(err);
-        let list_length = list.length;
-        if (!list_length) return cb(null, results);
-        list.forEach(function (file) {
-            file = pth.join(dir, file);
-            self.fs.stat(file, function (err, stat) {
-                if (err) return cb(err);
-                if (stat) {
+    const results = [];
+    let finished = false;
+    const finish = function (err) {
+        if (finished) return;
+        finished = true;
+        cb(err, err ? undefined : results);
+    };
+
+    // Descend by resolved real path and skip directories already visited, so a
+    // symlink pointing back to an ancestor cannot recurse forever (issue #541).
+    const walk = function (dir, visited, done) {
+        self.fs.readdir(dir, function (err, list) {
+            if (err) return done(err);
+            let pending = list.length;
+            if (!pending) return done();
+            list.forEach(function (name) {
+                const file = pth.join(dir, name);
+                self.fs.stat(file, function (err, stat) {
+                    if (err) return done(err);
+                    if (!stat) {
+                        if (!--pending) done();
+                        return;
+                    }
                     results.push(pth.normalize(file) + (stat.isDirectory() ? self.sep : ""));
-                    if (stat.isDirectory()) {
-                        self.findFilesAsync(file, function (err, res) {
-                            if (err) return cb(err);
-                            results = results.concat(res);
-                            if (!--list_length) cb(null, results);
-                        });
-                    } else {
-                        if (!--list_length) cb(null, results);
+                    if (!stat.isDirectory()) {
+                        if (!--pending) done();
+                        return;
                     }
-                }
+                    self.fs.realpath(file, function (err, realDir) {
+                        if (err) return done(err);
+                        if (visited.has(realDir)) {
+                            if (!--pending) done();
+                            return;
+                        }
+                        visited.add(realDir);
+                        walk(file, visited, function (err) {
+                            if (err) return done(err);
+                            if (!--pending) done();
+                        });
+                    });
+                });
             });
         });
+    };
+
+    self.fs.realpath(dir, function (err, realDir) {
+        if (err) return finish(err);
+        walk(dir, new Set([realDir]), finish);
     });
 };
 
@@ -19647,13 +21246,13 @@ Utils.findLast = function (arr, callback) {
     return void 0;
 };
 
-// make abolute paths taking prefix as root folder
+// make absolute paths taking prefix as root folder
 Utils.sanitize = function (/*string*/ prefix, /*string*/ name) {
     prefix = pth.resolve(pth.normalize(prefix));
     var parts = name.split("/");
     for (var i = 0, l = parts.length; i < l; i++) {
         var path = pth.normalize(pth.join(prefix, parts.slice(i, l).join(pth.sep)));
-        if (path.indexOf(prefix) === 0) {
+        if (path === prefix || path.startsWith(prefix + pth.sep)) {
             return path;
         }
     }
@@ -19673,10 +21272,16 @@ Utils.toBuffer = function toBuffer(/*buffer, Uint8Array, string*/ input, /* func
 };
 
 Utils.readBigUInt64LE = function (/*Buffer*/ buffer, /*int*/ index) {
-    var slice = Buffer.from(buffer.slice(index, index + 8));
-    slice.swap64();
+    const lo = buffer.readUInt32LE(index);
+    const hi = buffer.readUInt32LE(index + 4);
+    return hi * 0x100000000 + lo;
+};
 
-    return parseInt(`0x${slice.toString("hex")}`);
+Utils.writeBigUInt64LE = function (/*Buffer*/ buffer, /*Number*/ value, /*int*/ index) {
+    const lo = value >>> 0;
+    const hi = Math.floor(value / 0x100000000) >>> 0;
+    buffer.writeUInt32LE(lo, index);
+    buffer.writeUInt32LE(hi, index + 4);
 };
 
 Utils.fromDOS2Date = function (val) {
@@ -19699,13 +21304,13 @@ Utils.crcTable = crcTable;
 
 /***/ }),
 
-/***/ 59155:
+/***/ 58851:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-var Utils = __nccwpck_require__(28605),
-    Headers = __nccwpck_require__(57405),
+var Utils = __nccwpck_require__(91373),
+    Headers = __nccwpck_require__(77837),
     Constants = Utils.Constants,
-    Methods = __nccwpck_require__(93133);
+    Methods = __nccwpck_require__(70493);
 
 module.exports = function (/** object */ options, /*Buffer*/ input) {
     var _centralHeader = new Headers.EntryHeader(),
@@ -19733,48 +21338,23 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
     }
 
     function crc32OK(data) {
-        // if bit 3 (0x08) of the general-purpose flags field is set, then the CRC-32 and file sizes are not known when the local header is written
-        if (!_centralHeader.flags_desc) {
-            if (Utils.crc32(data) !== _centralHeader.localHeader.crc) {
-                return false;
-            }
-        } else {
-            const descriptor = {};
-            const dataEndOffset = _centralHeader.realDataOffset + _centralHeader.compressedSize;
-            // no descriptor after compressed data, instead new local header
-            if (input.readUInt32LE(dataEndOffset) == Constants.LOCSIG || input.readUInt32LE(dataEndOffset) == Constants.CENSIG) {
-                throw Utils.Errors.DESCRIPTOR_NOT_EXIST();
-            }
-
-            // get decriptor data
-            if (input.readUInt32LE(dataEndOffset) == Constants.EXTSIG) {
-                // descriptor with signature
-                descriptor.crc = input.readUInt32LE(dataEndOffset + Constants.EXTCRC);
-                descriptor.compressedSize = input.readUInt32LE(dataEndOffset + Constants.EXTSIZ);
-                descriptor.size = input.readUInt32LE(dataEndOffset + Constants.EXTLEN);
-            } else if (input.readUInt16LE(dataEndOffset + 12) === 0x4b50) {
-                // descriptor without signature (we check is new header starting where we expect)
-                descriptor.crc = input.readUInt32LE(dataEndOffset + Constants.EXTCRC - 4);
-                descriptor.compressedSize = input.readUInt32LE(dataEndOffset + Constants.EXTSIZ - 4);
-                descriptor.size = input.readUInt32LE(dataEndOffset + Constants.EXTLEN - 4);
-            } else {
-                throw Utils.Errors.DESCRIPTOR_UNKNOWN();
-            }
-
-            // check data integrity
-            if (descriptor.compressedSize !== _centralHeader.compressedSize || descriptor.size !== _centralHeader.size || descriptor.crc !== _centralHeader.crc) {
-                throw Utils.Errors.DESCRIPTOR_FAULTY();
-            }
-            if (Utils.crc32(data) !== descriptor.crc) {
-                return false;
-            }
+        // When bit 3 (0x08) of the general-purpose flags is set, the crc-32 and
+        // sizes were unknown when the local file header was written, so that
+        // header carries placeholder zeros and the real values are repeated in a
+        // data descriptor after the compressed data. adm-zip always parses the
+        // central directory, whose header holds the authoritative crc-32 and
+        // sizes, so we validate the payload against that value.
+        //
+        // Earlier versions instead located and parsed the trailing descriptor and
+        // threw when it was absent or in an unexpected shape. Many valid archives
+        // set the descriptor flag but write the real crc/sizes into the local and
+        // central headers without emitting a descriptor (or write one we did not
+        // recognise), so that strict handling rejected readable zips
+        // (issues #533, #548, #554). Trusting the central-directory crc keeps the
+        // integrity check while accepting those archives.
+        const expectedCrc = _centralHeader.flags_desc || _centralHeader.localHeader.flags_desc ? _centralHeader.crc : _centralHeader.localHeader.crc;
 
-            // @TODO: zip64 bit descriptor fields
-            // if bit 3 is set and any value in local header "zip64 Extended information" extra field are set 0 (place holder)
-            // then 64-bit descriptor format is used instead of 32-bit
-            // central header - "zip64 Extended information" extra field should store real values and not place holders
-        }
-        return true;
+        return Utils.crc32(data) === expectedCrc;
     }
 
     function decompress(/*Boolean*/ async, /*Function*/ callback, /*String, Buffer*/ pass) {
@@ -19804,10 +21384,16 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
             compressedData = Methods.ZipCrypto.decrypt(compressedData, _centralHeader, pass);
         }
 
-        var data = Buffer.alloc(_centralHeader.size);
+        var data;
 
         switch (_centralHeader.method) {
             case Utils.Constants.STORED:
+                // STORED entries are not compressed, so the uncompressed output is
+                // exactly the bytes present in the archive. Allocate from the real
+                // data length rather than the attacker-declared central-directory
+                // size, otherwise a tiny archive can declare a huge size and force a
+                // multi-gigabyte allocation before any validation (CVE-2026-39244).
+                data = Buffer.alloc(compressedData.length);
                 compressedData.copy(data);
                 if (!crc32OK(data)) {
                     if (async && callback) callback(data, Utils.Errors.BAD_CRC()); //si added error
@@ -19818,17 +21404,19 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
                     return data;
                 }
             case Utils.Constants.DEFLATED:
+                // Do not pre-allocate the declared uncompressed size. The inflater
+                // grows its output buffer as zlib emits data and caps the total at
+                // the declared size (maxOutputLength), so a bogus size can no longer
+                // trigger an eager allocation before the data is read (CVE-2026-39244).
                 var inflater = new Methods.Inflater(compressedData, _centralHeader.size);
                 if (!async) {
-                    const result = inflater.inflate(data);
-                    result.copy(data, 0);
+                    data = inflater.inflate();
                     if (!crc32OK(data)) {
                         throw Utils.Errors.BAD_CRC(`"${decoder.decode(_entryName)}"`);
                     }
                     return data;
                 } else {
                     inflater.inflateAsync(function (result) {
-                        result.copy(result, 0);
                         if (callback) {
                             if (!crc32OK(result)) {
                                 callback(result, Utils.Errors.BAD_CRC()); //si added error
@@ -19890,7 +21478,7 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
     }
 
     function readUInt64LE(buffer, offset) {
-        return (buffer.readUInt32LE(offset + 4) << 4) + buffer.readUInt32LE(offset);
+        return Utils.readBigUInt64LE(buffer, offset);
     }
 
     function parseExtra(data) {
@@ -19984,10 +21572,12 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
         },
 
         get name() {
-            var n = decoder.decode(_entryName);
+            const n = decoder.decode(_entryName);
+            // For directories the name is the last path segment; drop the trailing
+            // separator first so "a/b/c/" yields "c" and not "" (issue #466).
             return _isDirectory
                 ? n
-                      .substr(n.length - 1)
+                      .replace(/[/\\]$/, "")
                       .split("/")
                       .pop()
                 : n.split("/").pop();
@@ -20111,16 +21701,19 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
 
 /***/ }),
 
-/***/ 43985:
+/***/ 46593:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-const ZipEntry = __nccwpck_require__(59155);
-const Headers = __nccwpck_require__(57405);
-const Utils = __nccwpck_require__(28605);
+const ZipEntry = __nccwpck_require__(58851);
+const Headers = __nccwpck_require__(77837);
+const Utils = __nccwpck_require__(91373);
 
 module.exports = function (/*Buffer|null*/ inBuffer, /** object */ options) {
     var entryList = [],
-        entryTable = {},
+        // prototype-less: entry names come from untrusted input, so keys like
+        // "__proto__" or "constructor" must be plain data, not touch the prototype
+        // chain (which otherwise crashes addFile and hides such entries)
+        entryTable = Object.create(null),
         _comment = Buffer.alloc(0),
         mainHeader = new Headers.MainHeader(),
         loadedEntries = false;
@@ -20170,7 +21763,7 @@ module.exports = function (/*Buffer|null*/ inBuffer, /** object */ options) {
 
     function readEntries() {
         loadedEntries = true;
-        entryTable = {};
+        entryTable = Object.create(null);
         if (mainHeader.diskEntries > (inBuffer.length - mainHeader.offset) / Utils.Constants.CENHDR) {
             throw Utils.Errors.DISK_ENTRY_TOO_LARGE();
         }
@@ -20247,7 +21840,14 @@ module.exports = function (/*Buffer|null*/ inBuffer, /** object */ options) {
 
     function sortEntries() {
         if (entryList.length > 1 && !noSort) {
-            entryList.sort((a, b) => a.entryName.toLowerCase().localeCompare(b.entryName.toLowerCase()));
+            // Decode + lowercase each name once rather than on every comparison:
+            // the entryName getter re-decodes the underlying buffer on each access,
+            // so the previous inline comparator did O(n log n) redundant decoding.
+            // Ordering is unchanged (same localeCompare on the same keys).
+            entryList = entryList
+                .map((entry) => ({ entry, key: entry.entryName.toLowerCase() }))
+                .sort((a, b) => a.key.localeCompare(b.key))
+                .map((pair) => pair.entry);
         }
     }
 
@@ -20459,7 +22059,7 @@ module.exports = function (/*Buffer|null*/ inBuffer, /** object */ options) {
             // write main header
             const mh = mainHeader.toBinary();
             if (_comment) {
-                _comment.copy(mh, Utils.Constants.ENDHDR); // add zip file comment
+                _comment.copy(mh, mh.length - _comment.length); // add zip file comment
             }
             mh.copy(outBuffer, dindex);
 
@@ -20537,7 +22137,7 @@ module.exports = function (/*Buffer|null*/ inBuffer, /** object */ options) {
 
                         const mh = mainHeader.toBinary();
                         if (_comment) {
-                            _comment.copy(mh, Utils.Constants.ENDHDR); // add zip file comment
+                            _comment.copy(mh, mh.length - _comment.length); // add zip file comment
                         }
 
                         mh.copy(outBuffer, dindex); // write main header
@@ -129501,7 +131101,7 @@ module.exports = {"version":"3.17.0"};
 /***/ ((module) => {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"rE":"0.4.9-canary-2b6b3af.0","h_":"ckb development network for your first try"}');
+module.exports = /*#__PURE__*/JSON.parse('{"rE":"0.4.9","h_":"ckb development network for your first try"}');
 
 /***/ })