movehat 0.2.4 → 0.2.5

package/dist/fork/manager.js

@@ -154,6 +154,25 @@ export class ForkManager {
         }
         return resources;
     }
+    /**
+     * Stateless passthrough of `POST /v1/view` to the upstream RPC.
+     *
+     * View results are not cached — they depend on ledger version and
+     * arguments, so any caching layer would need version-aware
+     * invalidation that the fork system does not implement today. The
+     * payload is forwarded verbatim and the upstream response array is
+     * returned unchanged.
+     *
+     * `extraHeaders` are forwarded to upstream so that client headers
+     * such as `Accept: application/x-bcs` (for BCS-encoded view results)
+     * or `X-Aptos-Client` round-trip through the proxy.
+     */
+    async forwardView(payload, extraHeaders = {}) {
+        if (!this.apiClient) {
+            throw new Error('Fork not initialized. Call initialize() or load() first.');
+        }
+        return this.apiClient.view(payload, extraHeaders);
+    }
     async setResource(address, resourceType, data) {
         const normalizedAddress = normalizeAddress(address);
         this.storage.saveResource(normalizedAddress, resourceType, data);
@@ -282,4 +301,3 @@ export class ForkManager {
         }
     }
 }
-//# sourceMappingURL=manager.js.map

package/dist/fork/server.d.ts

@@ -32,6 +32,11 @@ export declare class ForkServer {
      * the allowlist. No-op otherwise.
      */
     private applyCors;
+    private isOriginAllowed;
+    private allowedMethodsForPath;
+    private sendMethodNotAllowed;
+    private sendForbiddenOrigin;
+    private handleOptions;
     /**
      * Start the fork server
      */
@@ -44,6 +49,7 @@ export declare class ForkServer {
      * Sanitize pathname for error messages to prevent log injection
      */
     private sanitizePathname;
+    private sanitizeErrorMessage;
     /**
      * Handle incoming HTTP requests
      */
@@ -64,6 +70,19 @@ export declare class ForkServer {
      * Handle GET /v1/accounts/:address/resources
      */
     private handleGetResources;
+    /**
+     * Handle POST /v1/view — proxy to upstream RPC.
+     *
+     * Stateless: view results are not cached. Buffers the request body
+     * with a 1 MiB ceiling, parses JSON, delegates to
+     * `forkManager.forwardView`, and returns the upstream array verbatim.
+     *
+     * Errors map to:
+     *   413 — body exceeds MAX_VIEW_BODY_BYTES
+     *   400 — body is not valid JSON
+     *   502 — upstream RPC failed (timeout, network error, non-200 response)
+     */
+    private handleViewProxy;
     /**
      * Send JSON response.
      * unknown: arbitrary JSON-serializable payload; structural shape varies by
@@ -79,4 +98,3 @@ export declare class ForkServer {
      */
     private sendError;
 }
-//# sourceMappingURL=server.d.ts.map

package/dist/fork/server.js

@@ -2,6 +2,7 @@ import http from 'http';
 import { URL } from 'url';
 import { ForkManager } from './manager.js';
 import { logger } from '../ui/index.js';
+import { redactSecrets } from '../utils/redact.js';
 /**
  * Fork Server - Serves fork data via Movement L1 RPC API
  * Emulates a Movement L1 node using local fork storage
@@ -37,6 +38,64 @@ export class ForkServer {
             res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
         }
     }
+    isOriginAllowed(req) {
+        const origin = req.headers.origin;
+        return typeof origin !== 'string' || this.corsAllowOrigins.has(origin);
+    }
+    allowedMethodsForPath(pathname) {
+        if (pathname === '/v1' || pathname === '/v1/') {
+            return ['GET'];
+        }
+        if (pathname === '/v1/view') {
+            return ['POST'];
+        }
+        if (pathname.match(/^\/v1\/accounts\/0x[a-fA-F0-9]{1,64}$/)) {
+            return ['GET'];
+        }
+        if (pathname.match(/^\/v1\/accounts\/0x[a-fA-F0-9]{1,64}\/resource\/.+$/)) {
+            return ['GET'];
+        }
+        if (pathname.match(/^\/v1\/accounts\/0x[a-fA-F0-9]{1,64}\/resources$/)) {
+            return ['GET'];
+        }
+        return null;
+    }
+    sendMethodNotAllowed(res, allowedMethods) {
+        this.sendJSON(res, 405, {
+            message: `Method not allowed. Allowed methods: ${allowedMethods.join(', ')}`,
+            error_code: 'method_not_allowed',
+            vm_error_code: null
+        }, { Allow: allowedMethods.join(', ') });
+    }
+    sendForbiddenOrigin(res) {
+        this.sendJSON(res, 403, {
+            message: 'Origin is not allowed to access this fork server',
+            error_code: 'cors_origin_forbidden',
+            vm_error_code: null
+        });
+    }
+    handleOptions(req, res, pathname) {
+        if (req.method !== 'OPTIONS') {
+            return false;
+        }
+        const origin = req.headers.origin;
+        const allowedMethods = this.allowedMethodsForPath(pathname);
+        if (typeof origin !== 'string' || !allowedMethods) {
+            this.sendMethodNotAllowed(res, allowedMethods ?? ['GET', 'POST']);
+            return true;
+        }
+        this.applyCors(req, res);
+        const requestedMethod = req.headers['access-control-request-method'];
+        if (typeof requestedMethod === 'string' &&
+            !allowedMethods.includes(requestedMethod.toUpperCase())) {
+            this.sendMethodNotAllowed(res, allowedMethods);
+            return true;
+        }
+        res.setHeader('Allow', allowedMethods.join(', '));
+        res.writeHead(204);
+        res.end();
+        return true;
+    }
     /**
      * Start the fork server
      */
@@ -53,7 +112,7 @@ export class ForkServer {
         this.server = http.createServer((req, res) => {
             this.handleRequest(req, res).catch((error) => {
                 // Log full error server-side for diagnostics
-                logger.error(`Error handling request: ${error instanceof Error ? error.message : String(error)}`);
+                logger.error(`Error handling request: ${this.sanitizeErrorMessage(error instanceof Error ? error.message : String(error))}`);
                 // Only send response if headers haven't been sent yet
                 if (!res.headersSent) {
                     this.applyCors(req, res);
@@ -135,6 +194,9 @@ export class ForkServer {
         // Truncate to reasonable length
         return sanitized.length > 100 ? sanitized.substring(0, 100) + '...' : sanitized;
     }
+    sanitizeErrorMessage(message) {
+        return this.sanitizePathname(redactSecrets(message));
+    }
     /**
      * Handle incoming HTTP requests
      */
@@ -145,10 +207,16 @@ export class ForkServer {
         // grep-friendly line shape (timestamp + method + path, no symbol).
         logger.plain(`[${new Date().toISOString()}] ${req.method} ${pathname}`);
         this.applyCors(req, res);
-        // Handle OPTIONS for CORS preflight
-        if (req.method === 'OPTIONS') {
-            res.writeHead(200);
-            res.end();
+        if (!this.isOriginAllowed(req)) {
+            this.sendForbiddenOrigin(res);
+            return;
+        }
+        if (this.handleOptions(req, res, pathname)) {
+            return;
+        }
+        const allowedMethods = this.allowedMethodsForPath(pathname);
+        if (allowedMethods && !allowedMethods.includes(req.method ?? '')) {
+            this.sendMethodNotAllowed(res, allowedMethods);
             return;
         }
         try {
@@ -165,13 +233,27 @@ export class ForkServer {
                 const accountIndex = parts.indexOf('accounts') + 1;
                 const resourceIndex = parts.indexOf('resource') + 1;
                 const address = parts[accountIndex];
-                const resourceType = decodeURIComponent(parts.slice(resourceIndex).join('/'));
+                let resourceType;
+                try {
+                    resourceType = decodeURIComponent(parts.slice(resourceIndex).join('/'));
+                }
+                catch {
+                    this.sendJSON(res, 400, {
+                        message: 'Malformed resource path',
+                        error_code: 'malformed_path',
+                        vm_error_code: null
+                    });
+                    return;
+                }
                 if (!address) {
                     this.send404(res, 'Malformed resource path', 'malformed_path');
                     return;
                 }
                 await this.handleGetResource(address, resourceType, res);
             }
+            else if (pathname === '/v1/view' && req.method === 'POST') {
+                await this.handleViewProxy(req, res);
+            }
             else {
                 // Use regex capture for resources endpoint
                 const resourcesMatch = pathname.match(/^\/v1\/accounts\/(0x[a-fA-F0-9]{1,64})\/resources$/);
@@ -188,7 +270,7 @@ export class ForkServer {
         }
         catch (error) {
             // Log full error server-side for diagnostics
-            logger.error(`Error handling request: ${error instanceof Error ? error.message : String(error)}`);
+            logger.error(`Error handling request: ${this.sanitizeErrorMessage(error instanceof Error ? error.message : String(error))}`);
             // Send generic error to client (don't expose internal details)
             this.sendError(res, 500, 'Internal server error');
         }
@@ -284,6 +366,105 @@ export class ForkServer {
             }
         }
     }
+    /**
+     * Handle POST /v1/view — proxy to upstream RPC.
+     *
+     * Stateless: view results are not cached. Buffers the request body
+     * with a 1 MiB ceiling, parses JSON, delegates to
+     * `forkManager.forwardView`, and returns the upstream array verbatim.
+     *
+     * Errors map to:
+     *   413 — body exceeds MAX_VIEW_BODY_BYTES
+     *   400 — body is not valid JSON
+     *   502 — upstream RPC failed (timeout, network error, non-200 response)
+     */
+    async handleViewProxy(req, res) {
+        const MAX_VIEW_BODY_BYTES = 1 * 1024 * 1024; // 1 MiB
+        let body;
+        try {
+            body = await new Promise((resolve, reject) => {
+                const chunks = [];
+                let totalBytes = 0;
+                let overflow = false;
+                req.on('data', (chunk) => {
+                    if (overflow)
+                        return;
+                    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                    totalBytes += buf.length;
+                    if (totalBytes > MAX_VIEW_BODY_BYTES) {
+                        overflow = true;
+                        reject(new Error('body_too_large'));
+                        return;
+                    }
+                    chunks.push(buf);
+                });
+                req.on('end', () => {
+                    if (overflow)
+                        return;
+                    resolve(Buffer.concat(chunks).toString('utf8'));
+                });
+                req.on('error', (err) => {
+                    if (overflow)
+                        return;
+                    reject(err);
+                });
+            });
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            if (msg === 'body_too_large') {
+                this.sendJSON(res, 413, {
+                    message: `Request body exceeds ${MAX_VIEW_BODY_BYTES} bytes`,
+                    error_code: 'body_too_large',
+                    vm_error_code: null
+                });
+                return;
+            }
+            throw error;
+        }
+        let payload;
+        try {
+            payload = JSON.parse(body);
+        }
+        catch {
+            this.sendJSON(res, 400, {
+                message: 'Request body is not valid JSON',
+                error_code: 'invalid_body',
+                vm_error_code: null
+            });
+            return;
+        }
+        // Forward a narrow set of client headers to upstream so that
+        // BCS-encoded responses (`Accept: application/x-bcs`) and client
+        // identification (`X-Aptos-Client`) round-trip through the proxy.
+        // Hop-by-hop and connection-level headers (host, connection,
+        // content-length, etc.) are deliberately not forwarded.
+        const forwardableHeaders = {};
+        for (const name of ['accept', 'x-aptos-client']) {
+            const value = req.headers[name];
+            if (typeof value === 'string') {
+                // Use the canonical capitalization upstream expects.
+                const canonical = name === 'accept' ? 'Accept' : 'X-Aptos-Client';
+                forwardableHeaders[canonical] = value;
+            }
+        }
+        try {
+            const result = await this.forkManager.forwardView(payload, forwardableHeaders);
+            this.sendJSON(res, 200, result);
+        }
+        catch (error) {
+            const rawMsg = error instanceof Error ? error.message : String(error);
+            // Sanitize: reuse the existing log-injection guard from
+            // sanitizePathname (control chars, length cap).
+            const safeMsg = this.sanitizeErrorMessage(rawMsg);
+            logger.error(`Upstream view-fn call failed: ${safeMsg}`);
+            this.sendJSON(res, 502, {
+                message: `Upstream view-fn call failed: ${safeMsg}`,
+                error_code: 'upstream_error',
+                vm_error_code: null
+            });
+        }
+    }
     /**
      * Send JSON response.
      * unknown: arbitrary JSON-serializable payload; structural shape varies by
@@ -319,4 +500,3 @@ export class ForkServer {
         });
     }
 }
-//# sourceMappingURL=server.js.map

package/dist/fork/storage.d.ts

@@ -70,4 +70,3 @@ export declare class ForkStorage {
      */
     clearResources(): void;
 }
-//# sourceMappingURL=storage.d.ts.map

package/dist/fork/storage.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { isHexAddress } from '../utils/address.js';
 /**
@@ -18,6 +18,33 @@ function sanitizeAddressForFilename(address) {
     }
     return safe;
 }
+const PRIVATE_DIR_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+function ensurePrivateDirectory(path) {
+    if (!existsSync(path)) {
+        mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });
+    }
+    chmodSync(path, PRIVATE_DIR_MODE);
+}
+function writePrivateFile(path, data) {
+    writeFileSync(path, data, { mode: PRIVATE_FILE_MODE });
+    chmodSync(path, PRIVATE_FILE_MODE);
+}
+function readJsonFile(path, label) {
+    try {
+        const value = JSON.parse(readFileSync(path, 'utf-8'));
+        if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+            throw new Error(`Invalid JSON in ${label} at ${path}. Expected an object.`);
+        }
+        return value;
+    }
+    catch (error) {
+        if (error instanceof SyntaxError) {
+            throw new Error(`Invalid JSON in ${label} at ${path}. Delete or repair the file and retry.`);
+        }
+        throw error;
+    }
+}
 /**
  * Storage system for fork state
  * Manages the file structure and I/O for fork data
@@ -40,27 +67,24 @@ export class ForkStorage {
      */
     initialize() {
         // Create main fork directory
-        if (!existsSync(this.forkPath)) {
-            mkdirSync(this.forkPath, { recursive: true });
-        }
+        ensurePrivateDirectory(this.forkPath);
         // Create subdirectories
         const resourcesDir = join(this.forkPath, 'resources');
-        if (!existsSync(resourcesDir)) {
-            mkdirSync(resourcesDir, { recursive: true });
-        }
+        ensurePrivateDirectory(resourcesDir);
         const cacheDir = join(this.forkPath, 'cache');
-        if (!existsSync(cacheDir)) {
-            mkdirSync(cacheDir, { recursive: true });
-        }
+        ensurePrivateDirectory(cacheDir);
         // Create .gitignore for cache
         const gitignorePath = join(cacheDir, '.gitignore');
         if (!existsSync(gitignorePath)) {
-            writeFileSync(gitignorePath, '*\n!.gitignore\n');
+            writePrivateFile(gitignorePath, '*\n!.gitignore\n');
         }
         // Initialize accounts.json if it doesn't exist
         const accountsPath = join(this.forkPath, 'accounts.json');
         if (!existsSync(accountsPath)) {
-            writeFileSync(accountsPath, JSON.stringify({}, null, 2));
+            writePrivateFile(accountsPath, JSON.stringify({}, null, 2));
+        }
+        else {
+            chmodSync(accountsPath, PRIVATE_FILE_MODE);
         }
     }
     /**
@@ -74,7 +98,7 @@ export class ForkStorage {
      */
     saveMetadata(metadata) {
         const metadataPath = join(this.forkPath, 'metadata.json');
-        writeFileSync(metadataPath, JSON.stringify(metadata, null, 2));
+        writePrivateFile(metadataPath, JSON.stringify(metadata, null, 2));
     }
     /**
      * Load fork metadata
@@ -84,8 +108,7 @@ export class ForkStorage {
         if (!existsSync(metadataPath)) {
             throw new Error(`Fork metadata not found at ${metadataPath}`);
         }
-        const data = readFileSync(metadataPath, 'utf-8');
-        return JSON.parse(data);
+        return readJsonFile(metadataPath, 'fork metadata');
     }
     /**
      * Get account state
@@ -95,7 +118,7 @@ export class ForkStorage {
         if (!existsSync(accountsPath)) {
             return null;
         }
-        const accounts = JSON.parse(readFileSync(accountsPath, 'utf-8'));
+        const accounts = readJsonFile(accountsPath, 'fork accounts');
         return accounts[address] || null;
     }
     /**
@@ -105,10 +128,10 @@ export class ForkStorage {
         const accountsPath = join(this.forkPath, 'accounts.json');
         let accounts = {};
         if (existsSync(accountsPath)) {
-            accounts = JSON.parse(readFileSync(accountsPath, 'utf-8'));
+            accounts = readJsonFile(accountsPath, 'fork accounts');
         }
         accounts[address] = state;
-        writeFileSync(accountsPath, JSON.stringify(accounts, null, 2));
+        writePrivateFile(accountsPath, JSON.stringify(accounts, null, 2));
     }
     /**
      * Get resource for an account
@@ -118,7 +141,7 @@ export class ForkStorage {
         if (!existsSync(resourceFilePath)) {
             return null;
         }
-        const resources = JSON.parse(readFileSync(resourceFilePath, 'utf-8'));
+        const resources = readJsonFile(resourceFilePath, 'fork resources');
         return resources[resourceType] || null;
     }
     /**
@@ -129,7 +152,7 @@ export class ForkStorage {
         if (!existsSync(resourceFilePath)) {
             return {};
         }
-        return JSON.parse(readFileSync(resourceFilePath, 'utf-8'));
+        return readJsonFile(resourceFilePath, 'fork resources');
     }
     /**
      * Save resource for an account
@@ -138,15 +161,13 @@ export class ForkStorage {
         const resourceFilePath = this.getResourceFilePath(address);
         // Ensure resources directory exists
         const resourcesDir = join(this.forkPath, 'resources');
-        if (!existsSync(resourcesDir)) {
-            mkdirSync(resourcesDir, { recursive: true });
-        }
+        ensurePrivateDirectory(resourcesDir);
         let resources = {};
         if (existsSync(resourceFilePath)) {
-            resources = JSON.parse(readFileSync(resourceFilePath, 'utf-8'));
+            resources = readJsonFile(resourceFilePath, 'fork resources');
         }
         resources[resourceType] = data;
-        writeFileSync(resourceFilePath, JSON.stringify(resources, null, 2));
+        writePrivateFile(resourceFilePath, JSON.stringify(resources, null, 2));
     }
     /**
      * Save all resources for an account
@@ -155,10 +176,8 @@ export class ForkStorage {
         const resourceFilePath = this.getResourceFilePath(address);
         // Ensure resources directory exists
         const resourcesDir = join(this.forkPath, 'resources');
-        if (!existsSync(resourcesDir)) {
-            mkdirSync(resourcesDir, { recursive: true });
-        }
-        writeFileSync(resourceFilePath, JSON.stringify(resources, null, 2));
+        ensurePrivateDirectory(resourcesDir);
+        writePrivateFile(resourceFilePath, JSON.stringify(resources, null, 2));
     }
     /**
      * Check if resource is cached
@@ -174,7 +193,7 @@ export class ForkStorage {
         if (!existsSync(accountsPath)) {
             return [];
         }
-        const accounts = JSON.parse(readFileSync(accountsPath, 'utf-8'));
+        const accounts = readJsonFile(accountsPath, 'fork accounts');
         return Object.keys(accounts);
     }
     /**
@@ -183,7 +202,7 @@ export class ForkStorage {
      */
     clearAccounts() {
         const accountsPath = join(this.forkPath, 'accounts.json');
-        writeFileSync(accountsPath, JSON.stringify({}, null, 2));
+        writePrivateFile(accountsPath, JSON.stringify({}, null, 2));
     }
     /**
      * Clear all cached resources
@@ -205,4 +224,3 @@ export class ForkStorage {
         }
     }
 }
-//# sourceMappingURL=storage.js.map

package/dist/fork/test.d.ts

@@ -80,4 +80,3 @@ export declare function compareForkState(forkPath: string, account: string, reso
  * @returns Array of snapshot paths
  */
 export declare function listSnapshots(): Promise<string[]>;
-//# sourceMappingURL=test.d.ts.map

package/dist/fork/test.js

@@ -164,4 +164,3 @@ export async function listSnapshots() {
         .filter(entry => entry.isDirectory())
         .map(entry => join(snapshotsDir, entry.name));
 }
-//# sourceMappingURL=test.js.map

package/dist/harness/Harness.d.ts

@@ -119,4 +119,3 @@ export declare class Harness {
      */
     runMoveScript(options: RunMoveScriptOptions): Promise<MoveScriptResult>;
 }
-//# sourceMappingURL=Harness.d.ts.map

package/dist/harness/Harness.js

@@ -1,6 +1,6 @@
 import { setupLocalTesting } from "../helpers/setupLocalTesting.js";
 import { initRuntime } from "../runtime.js";
-import { createHarnessProxy } from "./proxy.js";
+import { createHarnessProxy, createForkContractProxy } from "./proxy.js";
 import { deployCodeObject, upgradeCodeObject } from "./codeObject.js";
 import { runViewFunction } from "./view.js";
 import { runMoveScript } from "./script.js";
@@ -87,6 +87,11 @@ export class Harness {
         if (rpcUrl !== undefined)
             setupOpts.forkRpcUrl = rpcUrl;
         const ctx = await setupLocalTesting(setupOpts);
+        // Wrap getContract so contracts obtained in fork mode reject .call()
+        // synchronously instead of 404'ing against the fork server's
+        // unhandled /v1/transactions endpoint. View methods pass through.
+        const originalGetContract = ctx.runtime.getContract;
+        ctx.runtime.getContract = (address, moduleName) => createForkContractProxy(originalGetContract(address, moduleName));
         const init = {
             mode: "fork",
             runtime: ctx.runtime,
@@ -190,4 +195,3 @@ export class Harness {
         return runMoveScript(this.runtime, options);
     }
 }
-//# sourceMappingURL=Harness.js.map

package/dist/harness/codeObject.d.ts

@@ -28,4 +28,3 @@ export declare function deployCodeObject(runtime: MovehatRuntime, options: Deplo
  * @internal — called from `Harness.upgradeCodeObject`.
  */
 export declare function upgradeCodeObject(runtime: MovehatRuntime, options: UpgradeCodeObjectOptions): Promise<CodeObjectInfo>;
-//# sourceMappingURL=codeObject.d.ts.map

package/dist/harness/codeObject.js

@@ -264,4 +264,3 @@ function parseObjectAddress(stdout) {
         return jsonMatch[1];
     return undefined;
 }
-//# sourceMappingURL=codeObject.js.map

package/dist/harness/errors.d.ts

@@ -11,4 +11,3 @@ export declare class HarnessDisposedError extends Error {
     readonly methodName: string;
     constructor(methodName: string);
 }
-//# sourceMappingURL=errors.d.ts.map

package/dist/harness/errors.js

@@ -19,4 +19,3 @@ export class HarnessDisposedError extends Error {
         }
     }
 }
-//# sourceMappingURL=errors.js.map

package/dist/harness/index.d.ts

@@ -1,4 +1,3 @@
 export { Harness } from "./Harness.js";
 export type { HarnessMode } from "./Harness.js";
 export { HarnessDisposedError } from "./errors.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/harness/index.js

@@ -1,3 +1,2 @@
 export { Harness } from "./Harness.js";
 export { HarnessDisposedError } from "./errors.js";
-//# sourceMappingURL=index.js.map

package/dist/harness/proxy.d.ts

@@ -4,4 +4,15 @@
  * `isPoisoned()` returns true.
  */
 export declare function createHarnessProxy<T extends object>(target: T, isPoisoned: () => boolean): T;
-//# sourceMappingURL=proxy.d.ts.map
+/**
+ * Wrap a `MoveContract` so that `.call(...)` throws synchronously in
+ * fork mode instead of hitting the fork server's unhandled
+ * `/v1/transactions` endpoint and surfacing as a confusing HTTP 404.
+ *
+ * Read methods (`view`, `getModuleId`) pass through. Tracks the same
+ * design as the harness-level guards in {@link createHarnessProxy} for
+ * `deployCodeObject` / `upgradeCodeObject` / `runMoveScript`. Writable-
+ * fork support that would make `.call` execute against a local Move VM
+ * is tracked separately.
+ */
+export declare function createForkContractProxy<T extends object>(target: T): T;

package/dist/harness/proxy.js

@@ -33,4 +33,26 @@ export function createHarnessProxy(target, isPoisoned) {
         },
     });
 }
-//# sourceMappingURL=proxy.js.map
+/**
+ * Wrap a `MoveContract` so that `.call(...)` throws synchronously in
+ * fork mode instead of hitting the fork server's unhandled
+ * `/v1/transactions` endpoint and surfacing as a confusing HTTP 404.
+ *
+ * Read methods (`view`, `getModuleId`) pass through. Tracks the same
+ * design as the harness-level guards in {@link createHarnessProxy} for
+ * `deployCodeObject` / `upgradeCodeObject` / `runMoveScript`. Writable-
+ * fork support that would make `.call` execute against a local Move VM
+ * is tracked separately.
+ */
+export function createForkContractProxy(target) {
+    return new Proxy(target, {
+        get(obj, prop, receiver) {
+            if (prop === "call") {
+                return () => {
+                    throw new Error("Harness.createFork is read-only; MoveContract.call requires Harness.createLocal or createLive. Writable-fork support is tracked in #192.");
+                };
+            }
+            return Reflect.get(obj, prop, receiver);
+        },
+    });
+}

package/dist/harness/script.d.ts

@@ -18,4 +18,3 @@ import type { RunMoveScriptOptions, MoveScriptResult } from "../types/harness.js
  * @internal — called from `Harness.runMoveScript`.
  */
 export declare function runMoveScript(runtime: MovehatRuntime, options: RunMoveScriptOptions): Promise<MoveScriptResult>;
-//# sourceMappingURL=script.d.ts.map

package/dist/harness/script.js

@@ -159,4 +159,3 @@ function parseVmStatus(stdout) {
     const m = stdout.match(/"vm_status"\s*:\s*"([^"]*)"/);
     return m?.[1];
 }
-//# sourceMappingURL=script.js.map

package/dist/harness/view.d.ts

@@ -19,4 +19,3 @@ import type { RunViewFunctionOptions } from "../types/harness.js";
  * @internal — called from `Harness.runViewFunction`.
  */
 export declare function runViewFunction(runtime: MovehatRuntime, options: RunViewFunctionOptions): Promise<unknown[]>;
-//# sourceMappingURL=view.d.ts.map