movehat 0.1.9 → 0.2.0

package/dist/utils/__tests__/runCli.test.js

@@ -0,0 +1,187 @@
+import { describe, it, expect } from 'vitest';
+import { CliExecutionError } from '../../errors.js';
+import { redactSecrets, runCli } from '../runCli.js';
+function makeAdapter(result, capture) {
+    return {
+        async run(input) {
+            if (capture)
+                capture.last = input;
+            return result;
+        },
+        spawn() {
+            throw new Error('spawn not used in runCli tests');
+        },
+    };
+}
+describe('redactSecrets', () => {
+    it('replaces ed25519-priv-0x… literals', () => {
+        const key = '0x' + 'a'.repeat(64);
+        const input = `Loaded key ed25519-priv-${key} ok`;
+        expect(redactSecrets(input)).toBe('Loaded key ***REDACTED*** ok');
+    });
+    it('redacts private_key labelled values', () => {
+        const input = 'private_key: 0x' + 'b'.repeat(64);
+        expect(redactSecrets(input)).toBe('***REDACTED***');
+    });
+    it('redacts priv-key labelled values with hyphen variants', () => {
+        const input = 'priv-key = 0x' + 'c'.repeat(64);
+        expect(redactSecrets(input)).toBe('***REDACTED***');
+    });
+    it('leaves regular hex addresses alone', () => {
+        const input = 'Account 0x1234 deployed module counter';
+        expect(redactSecrets(input)).toBe(input);
+    });
+    it('is a no-op on empty input', () => {
+        expect(redactSecrets('')).toBe('');
+    });
+});
+describe('runCli', () => {
+    it('returns redacted stdout and stderr on success', async () => {
+        const key = 'ed25519-priv-0x' + 'a'.repeat(64);
+        const adapter = makeAdapter({
+            exitCode: 0,
+            stdout: `ok ${key}`,
+            stderr: '',
+        });
+        const result = await runCli({ command: 'fake', args: [] }, { adapter });
+        expect(result.exitCode).toBe(0);
+        expect(result.stdout).toBe('ok ***REDACTED***');
+        expect(result.stderr).toBe('');
+    });
+    it('throws CliExecutionError with redacted stderr on non-zero exit', async () => {
+        const adapter = makeAdapter({
+            exitCode: 1,
+            stdout: '',
+            stderr: 'boom private_key: 0x' + 'd'.repeat(64),
+        });
+        await expect(runCli({ command: 'movement', args: ['publish'] }, { adapter })).rejects.toMatchObject({
+            name: 'CliExecutionError',
+            command: 'movement',
+            exitCode: 1,
+        });
+        try {
+            await runCli({ command: 'movement', args: ['publish'] }, { adapter });
+        }
+        catch (e) {
+            expect(e).toBeInstanceOf(CliExecutionError);
+            const err = e;
+            expect(err.stderr).toBe('boom ***REDACTED***');
+            expect(err.stderr).not.toContain('private_key');
+            expect(err.args).toEqual(['publish']);
+        }
+    });
+    it('does not throw on non-zero exit when throwOnNonZeroExit is false', async () => {
+        const adapter = makeAdapter({
+            exitCode: 2,
+            stdout: 'partial',
+            stderr: 'warn',
+        });
+        const result = await runCli({ command: 'fake', args: [] }, { adapter, throwOnNonZeroExit: false });
+        expect(result.exitCode).toBe(2);
+        expect(result.stdout).toBe('partial');
+        expect(result.stderr).toBe('warn');
+    });
+    it('passes the input through to the adapter unchanged', async () => {
+        const capture = {};
+        const adapter = makeAdapter({ exitCode: 0, stdout: '', stderr: '' }, capture);
+        const env = { FOO: 'bar' };
+        const signal = new AbortController().signal;
+        await runCli({
+            command: 'movement',
+            args: ['move', 'build'],
+            cwd: '/tmp/pkg',
+            env,
+            stdin: 'hello',
+            timeoutMs: 1234,
+            signal,
+        }, { adapter });
+        expect(capture.last).toEqual({
+            command: 'movement',
+            args: ['move', 'build'],
+            cwd: '/tmp/pkg',
+            env,
+            stdin: 'hello',
+            timeoutMs: 1234,
+            signal,
+        });
+    });
+    it('truncates stdoutPreview on CliExecutionError', async () => {
+        const longStdout = 'x'.repeat(5000);
+        const adapter = makeAdapter({
+            exitCode: 1,
+            stdout: longStdout,
+            stderr: '',
+        });
+        try {
+            await runCli({ command: 'fake', args: [] }, { adapter });
+            expect.fail('should have thrown');
+        }
+        catch (e) {
+            const err = e;
+            expect(err.stdoutPreview.length).toBe(2000);
+        }
+    });
+    it('redacts secret-shaped args inside CliExecutionError.args', async () => {
+        const key = 'ed25519-priv-0x' + 'a'.repeat(64);
+        const adapter = makeAdapter({ exitCode: 1, stdout: '', stderr: '' });
+        try {
+            await runCli({ command: 'movement', args: ['publish', '--private-key', key] }, { adapter });
+            expect.fail('should have thrown');
+        }
+        catch (e) {
+            const err = e;
+            expect(err.args[0]).toBe('publish');
+            expect(err.args[1]).toBe('--private-key');
+            expect(err.args[2]).toBe('***REDACTED***');
+        }
+    });
+    it('preserves non-secret args unchanged', async () => {
+        const adapter = makeAdapter({ exitCode: 1, stdout: '', stderr: '' });
+        const args = ['move', 'publish', '--package-dir', '/tmp/pkg'];
+        try {
+            await runCli({ command: 'movement', args }, { adapter });
+            expect.fail('should have thrown');
+        }
+        catch (e) {
+            const err = e;
+            expect(Array.from(err.args)).toEqual(args);
+        }
+    });
+    it('forwards inheritStdio flag to the adapter unchanged', async () => {
+        const capture = {};
+        const adapter = makeAdapter({ exitCode: 0, stdout: '', stderr: '' }, capture);
+        await runCli({ command: 'mocha', args: ['--watch'], inheritStdio: true }, { adapter });
+        expect(capture.last?.inheritStdio).toBe(true);
+    });
+    it('propagates AbortSignal to a slow adapter and returns the killed result', async () => {
+        const slowAdapter = {
+            run(input) {
+                return new Promise((resolve) => {
+                    const t = setTimeout(() => resolve({ exitCode: 0, stdout: '', stderr: '' }), 5000);
+                    input.signal?.addEventListener('abort', () => {
+                        clearTimeout(t);
+                        resolve({
+                            exitCode: -1,
+                            stdout: '',
+                            stderr: '',
+                            signal: 'SIGTERM',
+                        });
+                    });
+                });
+            },
+            spawn() {
+                throw new Error('spawn not used in this test');
+            },
+        };
+        const controller = new AbortController();
+        const start = Date.now();
+        const promise = runCli({ command: 'movement', args: ['move', 'test'], signal: controller.signal }, { adapter: slowAdapter, throwOnNonZeroExit: false });
+        setTimeout(() => controller.abort(), 20);
+        const result = await promise;
+        const elapsed = Date.now() - start;
+        expect(result.exitCode).toBe(-1);
+        expect(result.signal).toBe('SIGTERM');
+        expect(elapsed).toBeLessThan(500);
+    });
+});
+//# sourceMappingURL=runCli.test.js.map

package/dist/utils/__tests__/runCli.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runCli.test.js","sourceRoot":"","sources":["../../../src/utils/__tests__/runCli.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAMpD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAErD,SAAS,WAAW,CAAC,MAAiB,EAAE,OAA6B;IACnE,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,KAAK;YACb,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK;YACH,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,2BAA2B,GAAG,KAAK,CAAC;QAClD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,KAAK,GAAG,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,eAAe,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,KAAK,GAAG,wCAAwC,CAAC;QACvD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,MAAM,GAAG,EAAE;YACnB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,sBAAsB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAChE,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,CAAsB,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAC7B,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CACvC,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;QAE5C,MAAM,MAAM,CACV;YACE,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YACvB,GAAG,EAAE,UAAU;YACf,GAAG;YACH,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,IAAI;YACf,MAAM;SACP,EACD,EAAE,OAAO,EAAE,CACZ,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YACvB,GAAG,EAAE,UAAU;YACf,GAAG;YACH,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,IAAI;YACf,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAsB,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,MAAM,CACV,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,EAChE,EAAE,OAAO,EAAE,CACZ,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAsB,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAsB,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CACzB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EACvC,OAAO,CACR,CAAC;QAEF,MAAM,MAAM,CACV,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,EAC3D,EAAE,OAAO,EAAE,CACZ,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,WAAW,GAAwB;YACvC,GAAG,CAAC,KAAK;gBACP,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBAC7B,MAAM,CAAC,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EACtD,IAAI,CACL,CAAC;oBACF,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;wBAC3C,YAAY,CAAC,CAAC,CAAC,CAAC;wBAChB,OAAO,CAAC;4BACN,QAAQ,EAAE,CAAC,CAAC;4BACZ,MAAM,EAAE,EAAE;4BACV,MAAM,EAAE,EAAE;4BACV,MAAM,EAAE,SAAS;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YACD,KAAK;gBACH,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;SACF,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CACpB,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAC1E,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,KAAK,EAAE,CACpD,CAAC;QACF,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEnC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/utils/address.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Address normalization helpers shared across the fork code.
+ *
+ * Two normalization variants live in production today and are preserved here
+ * with identical semantics so the in-place migration in M1.2 is behavior-
+ * preserving:
+ *
+ *   - `normalizeAddress`      → lowercase + `0x` + left-pad to 64 hex chars.
+ *                                Used by `fork/manager.ts` for storage keys.
+ *   - `normalizeAddressShort` → lowercase + `0x`, no padding.
+ *                                Used by `fork/api.ts` for HTTP paths.
+ */
+/**
+ * Lowercase the input, ensure a `0x` prefix, and left-pad the hex tail to
+ * 64 characters (66 total). Already-padded inputs are returned unchanged
+ * (apart from case folding).
+ *
+ * No validation: callers that need to reject non-hex input should consult
+ * `isHexAddress` first.
+ */
+export declare function normalizeAddress(input: string): string;
+/**
+ * Lowercase the input and ensure a `0x` prefix. Length is preserved — no
+ * padding is applied. Suitable for callers that pass addresses straight to
+ * an HTTP endpoint that accepts short forms.
+ */
+export declare function normalizeAddressShort(input: string): string;
+/**
+ * Returns true when the input is a syntactically valid hex address: optional
+ * `0x` prefix followed by 1 to 64 hex characters (case insensitive).
+ */
+export declare function isHexAddress(input: string): boolean;
+//# sourceMappingURL=address.d.ts.map

package/dist/utils/address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.d.ts","sourceRoot":"","sources":["../../src/utils/address.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYtD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMnD"}

package/dist/utils/address.js

@@ -0,0 +1,52 @@
+/**
+ * Address normalization helpers shared across the fork code.
+ *
+ * Two normalization variants live in production today and are preserved here
+ * with identical semantics so the in-place migration in M1.2 is behavior-
+ * preserving:
+ *
+ *   - `normalizeAddress`      → lowercase + `0x` + left-pad to 64 hex chars.
+ *                                Used by `fork/manager.ts` for storage keys.
+ *   - `normalizeAddressShort` → lowercase + `0x`, no padding.
+ *                                Used by `fork/api.ts` for HTTP paths.
+ */
+/**
+ * Lowercase the input, ensure a `0x` prefix, and left-pad the hex tail to
+ * 64 characters (66 total). Already-padded inputs are returned unchanged
+ * (apart from case folding).
+ *
+ * No validation: callers that need to reject non-hex input should consult
+ * `isHexAddress` first.
+ */
+export function normalizeAddress(input) {
+    let normalized = input.toLowerCase();
+    if (!normalized.startsWith('0x')) {
+        normalized = `0x${normalized}`;
+    }
+    if (normalized.length < 66) {
+        normalized = '0x' + normalized.slice(2).padStart(64, '0');
+    }
+    return normalized;
+}
+/**
+ * Lowercase the input and ensure a `0x` prefix. Length is preserved — no
+ * padding is applied. Suitable for callers that pass addresses straight to
+ * an HTTP endpoint that accepts short forms.
+ */
+export function normalizeAddressShort(input) {
+    const lower = input.toLowerCase();
+    return lower.startsWith('0x') ? lower : `0x${lower}`;
+}
+/**
+ * Returns true when the input is a syntactically valid hex address: optional
+ * `0x` prefix followed by 1 to 64 hex characters (case insensitive).
+ */
+export function isHexAddress(input) {
+    const stripped = input.startsWith('0x') || input.startsWith('0X')
+        ? input.slice(2)
+        : input;
+    if (stripped.length === 0 || stripped.length > 64)
+        return false;
+    return /^[0-9a-fA-F]+$/.test(stripped);
+}
+//# sourceMappingURL=address.js.map

package/dist/utils/address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../../src/utils/address.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAErC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,UAAU,GAAG,KAAK,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3B,UAAU,GAAG,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/D,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC"}

package/dist/utils/childProcessAdapter.d.ts

@@ -0,0 +1,93 @@
+import type { Readable, Writable } from 'node:stream';
+/**
+ * Injectable abstraction over `child_process.spawn`.
+ *
+ * Tests inject a fake adapter; production code uses `defaultChildProcessAdapter`.
+ * Higher-level helpers (see `runCli`) wrap this with redaction and error handling.
+ *
+ * Two affordances:
+ *   - `run` for one-shot commands whose stdout/stderr fit in memory.
+ *   - `spawn` for long-running children where the caller wants to stream
+ *     output incrementally and decide when to kill the process.
+ */
+export interface ChildProcessAdapter {
+    run(input: RunInput): Promise<RunResult>;
+    spawn(input: SpawnInput): SpawnedProcess;
+}
+export interface RunInput {
+    command: string;
+    args: readonly string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    stdin?: string;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    /**
+     * When `true`, the child inherits the parent's stdio (stdout, stderr,
+     * stdin go straight to the terminal). The resulting `RunResult.stdout`
+     * and `RunResult.stderr` will be empty strings because nothing is
+     * captured. Useful for interactive commands like `mocha`, `tsx`, or
+     * `pnpm install` where the user expects to see live output.
+     *
+     * If `inheritStdio` is `true`, `stdin` on this input is ignored — the
+     * child reads directly from the parent's stdin.
+     *
+     * Default: `false`.
+     */
+    inheritStdio?: boolean;
+}
+export interface RunResult {
+    /**
+     * Numeric exit code from the child. `-1` when the child was terminated by
+     * a signal (no numeric exit code available) — in that case `signal` is
+     * populated.
+     */
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    /**
+     * Populated when the child died from a signal (e.g. external abort, kill
+     * during shutdown). `undefined` for normal exits.
+     */
+    signal?: NodeJS.Signals;
+}
+/**
+ * Input for `spawn()`. Mirrors the subset of `RunInput` that applies to
+ * long-running children: no `stdin`, no `timeoutMs`, no `signal`. Callers
+ * control the lifecycle via the returned `SpawnedProcess`.
+ */
+export interface SpawnInput {
+    command: string;
+    args: readonly string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    /**
+     * `'pipe'` (default) makes stdout/stderr/stdin streams available on the
+     * returned `SpawnedProcess`. `'ignore'` silences the child entirely
+     * (streams are `null`). For `'inherit'`, use `run` with `inheritStdio: true`
+     * instead — the spawn handle isn't useful when the parent owns stdio.
+     */
+    stdio?: 'pipe' | 'ignore';
+}
+/**
+ * Handle returned by `spawn()`. Callers can listen on streams, kill the
+ * process, or await `exited` for the final exit code and signal.
+ */
+export interface SpawnedProcess {
+    pid: number | undefined;
+    stdout: Readable | null;
+    stderr: Readable | null;
+    stdin: Writable | null;
+    kill(signal?: NodeJS.Signals): boolean;
+    /**
+     * Resolves once when the child exits, regardless of how the caller
+     * triggered it (natural exit, `kill`, or process death). Safe to await
+     * multiple times.
+     */
+    exited: Promise<{
+        code: number | null;
+        signal: NodeJS.Signals | null;
+    }>;
+}
+export declare const defaultChildProcessAdapter: ChildProcessAdapter;
+//# sourceMappingURL=childProcessAdapter.d.ts.map

package/dist/utils/childProcessAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"childProcessAdapter.d.ts","sourceRoot":"","sources":["../../src/utils/childProcessAdapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAAC;CAC1C;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACzE;AAyHD,eAAO,MAAM,0BAA0B,EAAE,mBAAsD,CAAC"}

package/dist/utils/childProcessAdapter.js

@@ -0,0 +1,109 @@
+import { spawn } from 'node:child_process';
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+class DefaultChildProcessAdapter {
+    run(input) {
+        // Skip the default 5-minute timeout when the caller wires stdio
+        // through to the terminal — interactive sessions (mocha, tsx scripts,
+        // `movement move test`, `pnpm install`) routinely exceed 5 minutes and
+        // SIGTERM'ing them silently is a regression vs the direct-spawn code
+        // these callers used before M1.3a. An explicitly-passed `timeoutMs`
+        // is always honored, regardless of `inheritStdio`.
+        const timeoutMs = input.timeoutMs ?? (input.inheritStdio ? undefined : DEFAULT_TIMEOUT_MS);
+        return new Promise((resolve, reject) => {
+            const child = spawn(input.command, [...input.args], {
+                cwd: input.cwd,
+                env: input.env ?? process.env,
+                stdio: input.inheritStdio ? 'inherit' : ['pipe', 'pipe', 'pipe'],
+            });
+            const stdoutChunks = [];
+            const stderrChunks = [];
+            // Streams are null when stdio is 'inherit'; the `?.` covers that.
+            child.stdout?.on('data', (chunk) => stdoutChunks.push(chunk));
+            child.stderr?.on('data', (chunk) => stderrChunks.push(chunk));
+            let timeoutHandle;
+            const clearTimer = () => {
+                if (timeoutHandle)
+                    clearTimeout(timeoutHandle);
+            };
+            if (timeoutMs !== undefined) {
+                timeoutHandle = setTimeout(() => {
+                    child.kill('SIGTERM');
+                    reject(new Error(`Command timed out after ${timeoutMs}ms: ${input.command}`));
+                }, timeoutMs);
+            }
+            const onAbort = () => {
+                child.kill('SIGTERM');
+            };
+            if (input.signal) {
+                if (input.signal.aborted) {
+                    clearTimer();
+                    child.kill('SIGTERM');
+                    reject(new Error('Command aborted before start'));
+                    return;
+                }
+                input.signal.addEventListener('abort', onAbort, { once: true });
+            }
+            child.on('error', (err) => {
+                clearTimer();
+                input.signal?.removeEventListener('abort', onAbort);
+                reject(err);
+            });
+            child.on('close', (code, signal) => {
+                clearTimer();
+                input.signal?.removeEventListener('abort', onAbort);
+                const result = {
+                    exitCode: code !== null ? code : -1,
+                    stdout: Buffer.concat(stdoutChunks).toString('utf8'),
+                    stderr: Buffer.concat(stderrChunks).toString('utf8'),
+                };
+                if (signal) {
+                    result.signal = signal;
+                }
+                resolve(result);
+            });
+            // Under inheritStdio, child.stdin is null and the parent's stdin
+            // is wired through; we just skip the close call. Otherwise, end()
+            // either with the provided string or empty to close stdin cleanly.
+            if (!input.inheritStdio) {
+                if (input.stdin !== undefined) {
+                    child.stdin?.end(input.stdin);
+                }
+                else {
+                    child.stdin?.end();
+                }
+            }
+        });
+    }
+    spawn(input) {
+        const stdio = input.stdio ?? 'pipe';
+        const child = spawn(input.command, [...input.args], {
+            cwd: input.cwd,
+            env: input.env ?? process.env,
+            stdio,
+        });
+        // `exited` must settle whether the child dies via natural exit, kill,
+        // or a spawn-time `error` (e.g. ENOENT). Both events resolve once;
+        // a settled guard prevents double-resolve if both happen to fire.
+        const exited = new Promise((resolve) => {
+            let settled = false;
+            const finish = (code, signal) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve({ code, signal });
+            };
+            child.on('exit', (code, signal) => finish(code, signal));
+            child.on('error', () => finish(null, null));
+        });
+        return {
+            pid: child.pid,
+            stdout: child.stdout,
+            stderr: child.stderr,
+            stdin: child.stdin,
+            kill: (signal) => child.kill(signal),
+            exited,
+        };
+    }
+}
+export const defaultChildProcessAdapter = new DefaultChildProcessAdapter();
+//# sourceMappingURL=childProcessAdapter.js.map

package/dist/utils/childProcessAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"childProcessAdapter.js","sourceRoot":"","sources":["../../src/utils/childProcessAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+F3C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,0BAA0B;IAC9B,GAAG,CAAC,KAAe;QACjB,gEAAgE;QAChE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,mDAAmD;QACnD,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE3E,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;gBAClD,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;gBAC7B,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aACjE,CAAC,CAAC;YAEH,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,kEAAkE;YAClE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAEtE,IAAI,aAAyC,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,EAAE;gBACtB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YACjD,CAAC,CAAC;YAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAChF,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACzB,UAAU,EAAE,CAAC;oBACb,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACjC,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAc;oBACxB,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBACrD,CAAC;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,iEAAiE;YACjE,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;YAClD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC7B,KAAK;SACN,CAAC,CAAC;QAEH,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,GAAG,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,EAAE;YAC7F,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;gBACpE,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,CAAC,MAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACrD,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,0BAA0B,EAAE,CAAC"}

package/dist/utils/parseCliOutput.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Helpers for extracting fields out of Movement CLI stdout / stderr.
+ *
+ * @internal — not exported from `src/index.ts`.
+ */
+/**
+ * Extract the transaction hash from a `movement` CLI subcommand's stdout.
+ *
+ * Tries the context-bearing pattern first (`transaction hash: 0x…`,
+ * `txn hash: 0x…`, `hash: 0x…`) and falls back to any 64-char hex
+ * literal in the buffer. Returns `undefined` if no candidate matches.
+ *
+ * Shared by `core/Publisher.ts` (publish), `harness/codeObject.ts`
+ * (deploy-object / upgrade-object), and `harness/script.ts`
+ * (run-script). All three CLI subcommands emit the txHash in the same
+ * shape — keep this helper as the single source of truth so a future
+ * CLI-format change is a one-line fix.
+ */
+export declare function parseTxHash(stdout: string): string | undefined;
+//# sourceMappingURL=parseCliOutput.d.ts.map

package/dist/utils/parseCliOutput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseCliOutput.d.ts","sourceRoot":"","sources":["../../src/utils/parseCliOutput.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO9D"}

package/dist/utils/parseCliOutput.js

@@ -0,0 +1,26 @@
+/**
+ * Helpers for extracting fields out of Movement CLI stdout / stderr.
+ *
+ * @internal — not exported from `src/index.ts`.
+ */
+/**
+ * Extract the transaction hash from a `movement` CLI subcommand's stdout.
+ *
+ * Tries the context-bearing pattern first (`transaction hash: 0x…`,
+ * `txn hash: 0x…`, `hash: 0x…`) and falls back to any 64-char hex
+ * literal in the buffer. Returns `undefined` if no candidate matches.
+ *
+ * Shared by `core/Publisher.ts` (publish), `harness/codeObject.ts`
+ * (deploy-object / upgrade-object), and `harness/script.ts`
+ * (run-script). All three CLI subcommands emit the txHash in the same
+ * shape — keep this helper as the single source of truth so a future
+ * CLI-format change is a one-line fix.
+ */
+export function parseTxHash(stdout) {
+    const withContext = stdout.match(/(?:transaction\s*(?:hash)?|txn\s*(?:hash)?|hash):\s*(0x[a-fA-F0-9]{64})\b/i);
+    if (withContext?.[1])
+        return withContext[1];
+    const fallback = stdout.match(/\b(0x[a-fA-F0-9]{64})\b/);
+    return fallback?.[1];
+}
+//# sourceMappingURL=parseCliOutput.js.map

package/dist/utils/parseCliOutput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseCliOutput.js","sourceRoot":"","sources":["../../src/utils/parseCliOutput.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAC9B,4EAA4E,CAC7E,CAAC;IACF,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzD,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC"}

package/dist/utils/redact.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Patterns that match well-known secret shapes Movement tools emit on
+ * stderr / stdout / CLI arguments. Each match is replaced with
+ * `***REDACTED***` by `redactSecrets`.
+ *
+ * The labelled pattern (second entry) intentionally accepts bare `priv` and
+ * `key` prefixes. Over-redaction is fine; missing a real key is not.
+ */
+export declare const SECRET_PATTERNS: readonly RegExp[];
+/**
+ * Replaces every match of every known secret pattern with `***REDACTED***`.
+ * Idempotent: running it on already-redacted text is a no-op.
+ */
+export declare function redactSecrets(text: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/utils/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAG5C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD"}

package/dist/utils/redact.js

@@ -0,0 +1,24 @@
+/**
+ * Patterns that match well-known secret shapes Movement tools emit on
+ * stderr / stdout / CLI arguments. Each match is replaced with
+ * `***REDACTED***` by `redactSecrets`.
+ *
+ * The labelled pattern (second entry) intentionally accepts bare `priv` and
+ * `key` prefixes. Over-redaction is fine; missing a real key is not.
+ */
+export const SECRET_PATTERNS = [
+    /ed25519-priv-0x[0-9a-fA-F]{64}/g,
+    /(private[_-]?key|priv[_-]?key|priv|key)\s*[:=]\s*0x[0-9a-fA-F]{32,}/gi,
+];
+/**
+ * Replaces every match of every known secret pattern with `***REDACTED***`.
+ * Idempotent: running it on already-redacted text is a no-op.
+ */
+export function redactSecrets(text) {
+    let out = text;
+    for (const pattern of SECRET_PATTERNS) {
+        out = out.replace(pattern, '***REDACTED***');
+    }
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/utils/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,iCAAiC;IACjC,uEAAuE;CACxE,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/runCli.d.ts

@@ -0,0 +1,24 @@
+import { type ChildProcessAdapter, type RunInput, type RunResult } from './childProcessAdapter.js';
+export { redactSecrets } from './redact.js';
+export interface RunCliOptions {
+    /** Override the child-process adapter (defaults to spawn-based). */
+    adapter?: ChildProcessAdapter | undefined;
+    /** When true (default), throw `CliExecutionError` on non-zero exit. */
+    throwOnNonZeroExit?: boolean | undefined;
+}
+/**
+ * Spawns a CLI command through the injectable adapter, redacts well-known
+ * secret shapes from stdout and stderr before returning, and throws
+ * `CliExecutionError` (with already-redacted payloads) on non-zero exits.
+ *
+ * Callers that need to inspect raw output should set `throwOnNonZeroExit:false`
+ * and consume the returned `RunResult` directly — fields are still redacted.
+ *
+ * Pass `input.inheritStdio: true` for interactive commands (mocha, tsx,
+ * package managers) where the user expects to see live output. Under that
+ * flag, `stdout` and `stderr` in the returned `RunResult` are empty strings
+ * (and so is `stdoutPreview` on any `CliExecutionError`), since the child
+ * writes directly to the terminal rather than to a captured buffer.
+ */
+export declare function runCli(input: RunInput, options?: RunCliOptions): Promise<RunResult>;
+//# sourceMappingURL=runCli.d.ts.map

package/dist/utils/runCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runCli.d.ts","sourceRoot":"","sources":["../../src/utils/runCli.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,OAAO,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1C,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,QAAQ,EACf,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,SAAS,CAAC,CA0BpB"}