movehat 0.2.3 → 0.2.5

package/src/core/deployments.ts

@@ -1,155 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
-import { join } from "path";
-import { logger } from "../ui/index.js";
-
-export interface DeploymentInfo {
-  address: string;
-  moduleName: string;
-  network: string;
-  deployer: string;
-  timestamp: number;
-  txHash?: string | undefined;
-  blockNumber?: string | undefined;
-}
-
-/**
- * Validates that a name is safe for use in file paths
- * Only allows alphanumeric characters, hyphens, and underscores
- * Prevents path traversal attacks
- */
-export function validateSafeName(name: string, type: "network" | "module"): void {
-  if (!name || typeof name !== "string") {
-    throw new Error(`Invalid ${type} name: must be a non-empty string`);
-  }
-
-  // Check for path traversal sequences
-  if (name.includes("..") || name.includes("/") || name.includes("\\")) {
-    throw new Error(
-      `Invalid ${type} name: "${name}"\n` +
-      `Path traversal sequences are not allowed.\n` +
-      `Use only alphanumeric characters, hyphens, and underscores.`
-    );
-  }
-
-  // Reject hidden-file names first so the error message is specific
-  // (otherwise the alphanumeric check below would fire generically).
-  if (name.startsWith(".")) {
-    throw new Error(
-      `Invalid ${type} name: "${name}"\n` +
-      `Names cannot start with a dot (.) to prevent hidden file creation.`
-    );
-  }
-
-  // Only allow alphanumeric, hyphens, underscores
-  const safePattern = /^[a-zA-Z0-9_-]+$/;
-  if (!safePattern.test(name)) {
-    throw new Error(
-      `Invalid ${type} name: "${name}"\n` +
-      `Only alphanumeric characters, hyphens (-), and underscores (_) are allowed.`
-    );
-  }
-}
-
-function getDeploymentsDir(): string {
-  return join(process.cwd(), "deployments");
-}
-
-function getNetworkDeploymentsDir(network: string): string {
-  // Validate network name to prevent path traversal
-  validateSafeName(network, "network");
-
-  const deploymentsDir = getDeploymentsDir();
-  const networkDir = join(deploymentsDir, network);
-
-  // Create directories if they don't exist
-  if (!existsSync(deploymentsDir)) {
-    mkdirSync(deploymentsDir, { recursive: true });
-  }
-  if (!existsSync(networkDir)) {
-    mkdirSync(networkDir, { recursive: true });
-  }
-
-  return networkDir;
-}
-
-export function saveDeployment(deployment: DeploymentInfo): void {
-  // Validate both network and module name
-  validateSafeName(deployment.network, "network");
-  validateSafeName(deployment.moduleName, "module");
-
-  const networkDir = getNetworkDeploymentsDir(deployment.network);
-  const filePath = join(networkDir, `${deployment.moduleName}.json`);
-
-  try {
-    writeFileSync(filePath, JSON.stringify(deployment, null, 2), "utf-8");
-    logger.success(
-      `Deployment saved: deployments/${deployment.network}/${deployment.moduleName}.json`
-    );
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    logger.error(
-      `Failed to save deployment for ${deployment.moduleName} on ${deployment.network} at ${filePath}: ${msg}`
-    );
-    throw error;
-  }
-}
-
-export function loadDeployment(network: string, moduleName: string): DeploymentInfo | null {
-  // Validate both network and module name
-  validateSafeName(network, "network");
-  validateSafeName(moduleName, "module");
-
-  const networkDir = getNetworkDeploymentsDir(network);
-  const filePath = join(networkDir, `${moduleName}.json`);
-
-  if (!existsSync(filePath)) {
-    return null;
-  }
-
-  try {
-    const content = readFileSync(filePath, "utf-8");
-    return JSON.parse(content) as DeploymentInfo;
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    logger.error(`Failed to load deployment for ${moduleName} on ${network}: ${msg}`);
-    return null;
-  }
-}
-
-/**
- * Get all deployments for a network
- */
-export function getAllDeployments(network: string): Record<string, DeploymentInfo> {
-  // Validate network name
-  validateSafeName(network, "network");
-
-  const networkDir = getNetworkDeploymentsDir(network);
-
-  if (!existsSync(networkDir)) {
-    return {};
-  }
-
-  const files = readdirSync(networkDir).filter((f: string) => f.endsWith(".json"));
-
-  const deployments: Record<string, DeploymentInfo> = {};
-
-  for (const file of files) {
-    const moduleName = file.replace(".json", "");
-    // loadDeployment will validate moduleName internally
-    const deployment = loadDeployment(network, moduleName);
-    if (deployment) {
-      deployments[moduleName] = deployment;
-    }
-  }
-
-  return deployments;
-}
-
-/**
- * Get deployed address for a module
- */
-export function getDeployedAddress(network: string, moduleName: string): string | null {
-  // Validation happens in loadDeployment
-  const deployment = loadDeployment(network, moduleName);
-  return deployment ? deployment.address : null;
-}

package/src/core/movementProfile.ts

@@ -1,127 +0,0 @@
-import { chmodSync, existsSync, unlinkSync, writeFileSync } from "fs";
-import { tmpdir } from "os";
-import { join } from "path";
-import { randomUUID } from "crypto";
-
-/**
- * Per-deploy private-key file management and SIGINT/SIGTERM cleanup
- * infrastructure shared across the Movement CLI invocations (`move
- * publish`, `move deploy-object`, `move upgrade-object`, `move
- * run-script`).
- *
- * **Why a temp key file rather than the CLI's profile yaml?** The
- * Movement CLI's `--profile <name>` flag requires a config.yaml to
- * exist in the working directory (older Movement CLI variants look
- * for `<cwd>/.aptos/config.yaml`; newer variants look for
- * `<cwd>/.movement/config.yaml`). On fresh user installs neither
- * directory exists, and the CLI errors out before it would otherwise
- * fall back to `~/.aptos/config.yaml`. Writing to a temp file and
- * passing `--private-key-file <path> --sender-account <addr>`
- * directly avoids the entire profile-yaml lookup chain — no CWD
- * dependency, no CLI-variant dependency.
- *
- * The same SIGINT-safe cleanup pattern applies as the old profile
- * flow: the temp key file persists private key material on disk and
- * MUST be removed before process exit even on abnormal termination.
- *
- * @internal — not exported from `src/index.ts`.
- */
-
-/**
- * Write the private key to a `mode 0o600` file in the system temp
- * directory and return the path. The filename is UUID-suffixed so
- * concurrent deploys don't collide.
- *
- * The key string is written verbatim — callers should format to
- * AIP-80 before calling (see `PrivateKey.formatPrivateKey` from
- * `@aptos-labs/ts-sdk`).
- */
-export function writeTempKeyFile(privateKey: string): string {
-  const path = join(tmpdir(), `movehat-key-${randomUUID()}`);
-  // mode in the open() call may be filtered by the process umask
-  // (typically 0o022 → resulting perms 0o644). chmod after write
-  // is defense in depth so the file can never be observable as
-  // group-/world-readable while it carries the private key.
-  writeFileSync(path, privateKey, { mode: 0o600 });
-  chmodSync(path, 0o600);
-  return path;
-}
-
-/**
- * Sync unlink for SIGINT/SIGTERM handlers — never throws, never logs.
- * The event loop is dead by the time this runs; observability isn't
- * possible. Worst case: a stale 0o600 temp file in `os.tmpdir()`
- * that the OS reaps eventually.
- *
- * **Do not use this from a normal `finally` cleanup path** — failures
- * become invisible there, hiding the case where a private-key temp
- * file persists on disk after a deploy. Use {@link removeKeyFile}
- * instead for those paths.
- */
-export function removeKeyFileSyncBestEffort(path: string): void {
-  try {
-    unlinkSync(path);
-  } catch {
-    // event loop dead — best-effort
-  }
-}
-
-/**
- * Sync unlink for the normal cleanup path (a `finally` block after the
- * Movement CLI invocation returns). Returns `null` on success — either
- * the file was removed, or it was already gone (ENOENT is treated as
- * benign success). Returns an `Error` only when the file **still
- * exists on disk** after the unlink attempt failed (EPERM, EACCES,
- * EBUSY, EISDIR if the path collided with a directory, etc.).
- *
- * Callers SHOULD `logger.warning` when a non-null Error is returned —
- * a private-key temp file would otherwise persist silently.
- */
-export function removeKeyFile(path: string): Error | null {
-  try {
-    unlinkSync(path);
-    return null;
-  } catch (err) {
-    const code = (err as NodeJS.ErrnoException).code;
-    if (code === "ENOENT") return null;
-    // The unlink call failed but verify the file actually still exists
-    // before declaring this preocupante — some races (parallel cleanup,
-    // tmpdir reaper) can race with us and the file may already be gone
-    // despite the syscall reporting an unexpected error.
-    if (!existsSync(path)) return null;
-    return err instanceof Error ? err : new Error(String(err));
-  }
-}
-
-/**
- * Process-level signal handling. A single registered handler iterates
- * the per-deploy cleanup callbacks. Installed once per process because
- * multiple concurrent deploys share the same parent — installing per
- * deploy would re-add the listener and exceed Node's max-listeners
- * warning threshold under heavy parallelism.
- */
-export const cleanupCallbacks = new Set<() => void>();
-let signalHandlerInstalled = false;
-
-export function ensureSignalHandler(): void {
-  if (signalHandlerInstalled) return;
-  signalHandlerInstalled = true;
-  const handler = (sig: NodeJS.Signals) => {
-    // Synchronous cleanup of every active deploy's resources.
-    for (const cb of [...cleanupCallbacks]) {
-      try {
-        cb();
-      } catch {
-        /* sync best-effort */
-      }
-    }
-    // Defer the actual exit one tick so other listeners (vitest's own
-    // SIGINT handler, app-level shutdown hooks) still get to run.
-    // Without this we'd stomp on vitest's afterEach if a dev Ctrl+C'd
-    // a test run mid-suite.
-    const code = sig === "SIGTERM" ? 143 : 130;
-    setImmediate(() => process.exit(code));
-  };
-  process.on("SIGINT", handler);
-  process.on("SIGTERM", handler);
-}

package/src/core/shell.ts

@@ -1,86 +0,0 @@
-/**
- * Escapes a shell argument to prevent command injection
- * Wraps the argument in single quotes and escapes any single quotes within
- *
- * @param arg - The argument to escape
- * @returns The escaped argument safe for shell execution
- */
-export function escapeShellArg(arg: string): string {
-  if (typeof arg !== "string") {
-    throw new Error("Shell argument must be a string");
-  }
-
-  // Wrap in single quotes and escape any single quotes by replacing them with '\''
-  // This technique works on both Unix and Windows (Git Bash, WSL)
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-
-/**
- * Validates that a path is safe (no command injection characters) and
- * returns it unchanged. Use this for callers that pass paths to spawn-with-
- * args (no shell), where shell quoting would be incorrect.
- *
- * @param path - The path to validate
- * @param name - Name for error messages (e.g., "package directory")
- * @returns The original path, after validation
- */
-export function validatePathSafety(path: string, name: string = "path"): string {
-  if (!path || typeof path !== "string") {
-    throw new Error(`Invalid ${name}: must be a non-empty string`);
-  }
-
-  // Check for obvious command injection attempts.
-  const dangerousChars = /[;&|`$(){}[\]<>]/;
-  if (dangerousChars.test(path)) {
-    throw new Error(
-      `Invalid ${name}: "${path}"\n` +
-      `Path contains potentially dangerous characters.\n` +
-      `Allowed characters: letters, numbers, ., -, _, /, \\, spaces`
-    );
-  }
-
-  return path;
-}
-
-/**
- * Validates a path and returns the shell-escaped form. Wraps
- * `validatePathSafety` for callers that pass paths into shell-style
- * commands (e.g. `exec`).
- *
- * @param path - The path to validate and escape
- * @param name - Name for error messages
- * @returns The escaped path safe for shell execution
- */
-export function validateAndEscapePath(path: string, name: string = "path"): string {
-  return escapeShellArg(validatePathSafety(path, name));
-}
-
-/**
- * Validates that a profile name is safe and returns it unchanged. Mirrors
- * `validatePathSafety` — use this for callers that pass the profile to
- * spawn-with-args (no shell), where shell quoting would be incorrect.
- */
-export function validateProfileSafety(profile: string): string {
-  if (!profile || typeof profile !== "string") {
-    throw new Error("Invalid profile name: must be a non-empty string");
-  }
-
-  const safePattern = /^[a-zA-Z0-9_-]+$/;
-  if (!safePattern.test(profile)) {
-    throw new Error(
-      `Invalid profile name: "${profile}"\n` +
-      `Only alphanumeric characters, hyphens (-), and underscores (_) are allowed.`
-    );
-  }
-
-  return profile;
-}
-
-/**
- * Validates a profile and returns the shell-escaped form. Wraps
- * `validateProfileSafety` for callers that pass the profile into shell-style
- * commands (e.g. `exec`).
- */
-export function validateAndEscapeProfile(profile: string): string {
-  return escapeShellArg(validateProfileSafety(profile));
-}

package/src/errors.ts

@@ -1,81 +0,0 @@
-/**
- * Custom error thrown when attempting to deploy a module that is already deployed
- */
-export class ModuleAlreadyDeployedError extends Error {
-  constructor(
-    message: string,
-    public readonly moduleName: string,
-    public readonly network: string,
-    public readonly address: string,
-    public readonly timestamp: number,
-    public readonly txHash?: string
-  ) {
-    super(message);
-    this.name = 'ModuleAlreadyDeployedError';
-
-    // Maintains proper stack trace for where our error was thrown (only available on V8)
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, ModuleAlreadyDeployedError);
-    }
-  }
-}
-
-import { redactSecrets } from './utils/redact.js';
-import type { DeploymentInfo } from './core/deployments.js';
-
-/**
- * Thrown when the on-chain publish succeeded but a subsequent local
- * step (saveDeployment, profile cleanup, etc.) failed.
- *
- * Distinct from `CliExecutionError`: by the time this error fires, the
- * module IS deployed on-chain. Callers that want to recover can read
- * `deployment` and re-attempt the local-side persistence manually
- * (e.g. write the JSON to `deployments/{network}/{moduleName}.json`).
- *
- * Without this distinction, the same outer catch would surface a
- * post-publish filesystem failure as "Failed to publish module",
- * inviting an accidental redeploy that wastes gas.
- */
-export class PostPublishError extends Error {
-  constructor(
-    message: string,
-    public readonly deployment: DeploymentInfo,
-    public readonly cause: Error
-  ) {
-    super(message);
-    this.name = 'PostPublishError';
-
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, PostPublishError);
-    }
-  }
-}
-
-/**
- * Thrown by runCli when a spawned process exits with a non-zero status.
- *
- * `stderr`, `stdoutPreview`, and each entry in `args` are redacted of
- * well-known secret shapes (private keys, etc.) in the constructor, so the
- * error is safe to log regardless of how it was raised. Redaction is
- * idempotent.
- */
-export class CliExecutionError extends Error {
-  public readonly args: readonly string[];
-
-  constructor(
-    message: string,
-    public readonly command: string,
-    args: readonly string[],
-    public readonly exitCode: number,
-    public readonly stderr: string,
-    public readonly stdoutPreview: string
-  ) {
-    super(message);
-    this.name = 'CliExecutionError';
-    this.args = args.map(redactSecrets);
-
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, CliExecutionError);
-    }
-  }
-}