movehat 0.2.4 → 0.2.6

package/dist/core/config.js

@@ -13,6 +13,45 @@ import { logger } from "../ui/index.js";
 // same value here. No corruption, no in-flight-promise memoization
 // needed.
 const configCache = new Map();
+// In-flight load deduplication (#47). When two callers hit a cold cache
+// for the same config file concurrently, both would invoke
+// `register()` from `tsx/esm/api` and race on the unregister cleanup.
+// The dedup map ensures only ONE load runs per (path, mtime) burst —
+// concurrent callers await the same Promise. Cleared after the load
+// settles so a later edit (new mtime) can re-trigger a cold load.
+const inFlightLoads = new Map();
+// Hostnames recognized as safe targets for the deterministic test key
+// auto-injection. Any URL whose hostname is not in this set causes the
+// test-key path to be skipped even if the network NAME is 'testnet' or
+// 'local' (#40 — name-only gating was spoofable when users named a
+// production-pointing network 'testnet').
+const TEST_ENDPOINT_HOSTS = new Set([
+    "testnet.movementnetwork.xyz",
+    "localhost",
+    "127.0.0.1",
+    "::1",
+]);
+function isKnownTestEndpoint(url) {
+    try {
+        return TEST_ENDPOINT_HOSTS.has(new URL(url).hostname.toLowerCase());
+    }
+    catch {
+        return false;
+    }
+}
+// Render a URL for log output without exposing userinfo (`user:pass@`)
+// or query strings (`?apiKey=…`). Returns the protocol + host + pathname
+// only, which is enough for the operator to identify the endpoint
+// without leaking embedded credentials to CI logs.
+function sanitizeUrlForLog(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+    }
+    catch {
+        return "<invalid-url>";
+    }
+}
 /**
  * Loads the user's movehat.config.{ts,js} from the current working directory.
  *
@@ -47,32 +86,58 @@ export async function loadUserConfig() {
         if (cached && cached.mtimeMs === mtimeMs) {
             return cached.config;
         }
-        let configModule;
-        if (configPath.endsWith('.ts')) {
-            const { register } = await import('tsx/esm/api');
-            const unregister = register();
-            try {
-                const configUrl = pathToFileURL(configPath).href;
-                configModule = await import(configUrl + '?mtime=' + mtimeMs);
-            }
-            finally {
-                unregister();
-            }
+        // Dedup concurrent cold-cache loads of the same file (#47).
+        // Without this, two callers race on tsx's register/unregister and
+        // the second may run its `await import()` after the first calls
+        // unregister(), removing the loader mid-flight. All callers go
+        // through the same `return await loadPromise` below so the outer
+        // try/catch wraps a consistent error regardless of who started the
+        // load.
+        let loadPromise = inFlightLoads.get(configPath);
+        if (!loadPromise) {
+            loadPromise = doLoadConfig(configPath, mtimeMs);
+            inFlightLoads.set(configPath, loadPromise);
+            // Clean up after settles. `.catch(() => undefined)` after the
+            // finally chain swallows the cleanup-promise rejection so it
+            // does not become an unhandled rejection — the actual awaiters
+            // still see the original rejection via `return await loadPromise`.
+            void loadPromise
+                .finally(() => {
+                if (inFlightLoads.get(configPath) === loadPromise) {
+                    inFlightLoads.delete(configPath);
+                }
+            })
+                .catch(() => undefined);
         }
-        else {
+        return await loadPromise;
+    }
+    catch (error) {
+        throw new Error(`Failed to load configuration file '${configPath}': ${error}`);
+    }
+}
+async function doLoadConfig(configPath, mtimeMs) {
+    let configModule;
+    if (configPath.endsWith('.ts')) {
+        const { register } = await import('tsx/esm/api');
+        const unregister = register();
+        try {
             const configUrl = pathToFileURL(configPath).href;
             configModule = await import(configUrl + '?mtime=' + mtimeMs);
         }
-        const userConfig = configModule.default;
-        if (!userConfig.networks || Object.keys(userConfig.networks).length === 0) {
-            throw new Error("No networks defined in configuration. Add at least one network in the 'networks' field.");
+        finally {
+            unregister();
         }
-        configCache.set(configPath, { mtimeMs, config: userConfig });
-        return userConfig;
     }
-    catch (error) {
-        throw new Error(`Failed to load configuration file '${configPath}': ${error}`);
+    else {
+        const configUrl = pathToFileURL(configPath).href;
+        configModule = await import(configUrl + '?mtime=' + mtimeMs);
     }
+    const userConfig = configModule.default;
+    if (!userConfig.networks || Object.keys(userConfig.networks).length === 0) {
+        throw new Error("No networks defined in configuration. Add at least one network in the 'networks' field.");
+    }
+    configCache.set(configPath, { mtimeMs, config: userConfig });
+    return userConfig;
 }
 /**
  * Clear the in-memory config cache. Test-only escape hatch.
@@ -82,6 +147,7 @@ export async function loadUserConfig() {
  */
 export function _resetConfigCache() {
     configCache.clear();
+    inFlightLoads.clear();
 }
 /**
  * Resolve configuration for a specific network
@@ -136,15 +202,30 @@ export async function resolveNetworkConfig(userConfig, networkName) {
     if (accounts.length === 0 && process.env.PRIVATE_KEY) {
         accounts = [process.env.PRIVATE_KEY];
     }
-    // 4. Validate we have at least one account (unless using testnet/local)
+    // 4. Validate we have at least one account (unless using testnet/local
+    //    AND the URL is a recognized test endpoint — name alone is not enough
+    //    per #40, since a user can name a network 'testnet' but point it at
+    //    a production RPC and would otherwise inherit the deterministic test
+    //    key with a production endpoint).
     if (accounts.length === 0 || !accounts[0]) {
-        // Special case: Auto-generate test accounts for testing networks
-        // testnet = public Movement test network (recommended)
-        // local = local fork server
-        if (selectedNetwork === "testnet" || selectedNetwork === "local") {
+        const isTestNetworkName = selectedNetwork === "testnet" || selectedNetwork === "local";
+        const isTestEndpoint = isTestNetworkName && isKnownTestEndpoint(networkConfig.url);
+        if (isTestNetworkName && !isTestEndpoint) {
+            // Name matches the reserved convention but URL is not a recognized
+            // test endpoint — block the deterministic test-key injection. Falls
+            // through to the standard "no accounts" throw below so the user gets
+            // actionable guidance.
+            logger.warning(`Network '${selectedNetwork}' uses a name reserved for testnet/local ` +
+                `but '${sanitizeUrlForLog(networkConfig.url)}' is not a recognized test endpoint. ` +
+                `Skipping auto-injection of the deterministic test key to protect ` +
+                `against accidental production use. Set PRIVATE_KEY explicitly, ` +
+                `configure 'accounts' in movehat.config.ts, or rename this network.`);
+        }
+        if (isTestEndpoint) {
             // Security: Using a deterministic test account (like Hardhat's default accounts)
             // This is SAFE because:
-            // 1. Only used for testnet/local (never mainnet - that throws error below)
+            // 1. Only used for testnet/local against a known test endpoint
+            //    (network NAME + URL allowlist enforced above; bypassed otherwise)
             // 2. Perfect for transaction simulation (no real funds)
             // 3. Deterministic = consistent test results
             const testPrivateKey = "0x0000000000000000000000000000000000000000000000000000000000000001";
@@ -155,8 +236,9 @@ export async function resolveNetworkConfig(userConfig, networkName) {
             logger.newline();
         }
         else {
-            // For any other network (especially mainnet), REQUIRE explicit configuration
-            // This prevents accidentally using the test key on production networks
+            // For any other network (mainnet, or testnet/local with a non-test
+            // URL), REQUIRE explicit configuration. This prevents accidentally
+            // using the test key on production networks.
             throw new Error(`Network '${selectedNetwork}' has no accounts configured.\n` +
                 `\n` +
                 `SECURITY: This network requires explicit account configuration.\n` +
@@ -233,4 +315,3 @@ function deriveAccountAddress(privateKeyHex) {
         return "";
     }
 }
-//# sourceMappingURL=config.js.map

package/dist/core/contract.d.ts

@@ -14,4 +14,3 @@ export declare class MoveContract {
     getModuleId(): string;
 }
 export declare function getContract(aptos: Aptos, moduleAddress: string, moduleName: string): MoveContract;
-//# sourceMappingURL=contract.d.ts.map

package/dist/core/contract.js

@@ -64,4 +64,3 @@ export class MoveContract {
 export function getContract(aptos, moduleAddress, moduleName) {
     return new MoveContract(aptos, moduleAddress, moduleName);
 }
-//# sourceMappingURL=contract.js.map

package/dist/core/deployments.d.ts

@@ -23,4 +23,3 @@ export declare function getAllDeployments(network: string): Record<string, Deplo
  * Get deployed address for a module
  */
 export declare function getDeployedAddress(network: string, moduleName: string): string | null;
-//# sourceMappingURL=deployments.d.ts.map

package/dist/core/deployments.js

@@ -111,4 +111,3 @@ export function getDeployedAddress(network, moduleName) {
     const deployment = loadDeployment(network, moduleName);
     return deployment ? deployment.address : null;
 }
-//# sourceMappingURL=deployments.js.map

package/dist/core/movementProfile.d.ts

@@ -64,4 +64,3 @@ export declare function removeKeyFile(path: string): Error | null;
  */
 export declare const cleanupCallbacks: Set<() => void>;
 export declare function ensureSignalHandler(): void;
-//# sourceMappingURL=movementProfile.d.ts.map

package/dist/core/movementProfile.js

@@ -125,4 +125,3 @@ export function ensureSignalHandler() {
     process.on("SIGINT", handler);
     process.on("SIGTERM", handler);
 }
-//# sourceMappingURL=movementProfile.js.map

package/dist/core/shell.d.ts

@@ -38,4 +38,3 @@ export declare function validateProfileSafety(profile: string): string;
  * commands (e.g. `exec`).
  */
 export declare function validateAndEscapeProfile(profile: string): string;
-//# sourceMappingURL=shell.d.ts.map

package/dist/core/shell.js

@@ -71,4 +71,3 @@ export function validateProfileSafety(profile) {
 export function validateAndEscapeProfile(profile) {
     return escapeShellArg(validateProfileSafety(profile));
 }
-//# sourceMappingURL=shell.js.map

package/dist/errors.d.ts

@@ -44,4 +44,3 @@ export declare class CliExecutionError extends Error {
     readonly args: readonly string[];
     constructor(message: string, command: string, args: readonly string[], exitCode: number, stderr: string, stdoutPreview: string);
 }
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js

@@ -75,4 +75,3 @@ export class CliExecutionError extends Error {
         }
     }
 }
-//# sourceMappingURL=errors.js.map

package/dist/fork/api.d.ts

@@ -28,6 +28,18 @@ export declare class MovementApiClient {
      * public endpoints.
      */
     private get;
+    /**
+     * Make a POST request to the API with a JSON body.
+     *
+     * Mirrors `get<T>` for TLS/timeout/maxBytes/error-wrapping; differs
+     * only in `method: 'POST'`, the `Content-Type: application/json`
+     * header, and writing `body` to the request stream before `end()`.
+     *
+     * `extraHeaders` are merged in last and override defaults — used by
+     * the fork-server view proxy to forward client headers like
+     * `Accept` or `X-Aptos-Client` through to the upstream node.
+     */
+    private post;
     /**
      * Build API path with proper prefix
      */
@@ -48,5 +60,16 @@ export declare class MovementApiClient {
      * Get all resources for an account
      */
     getAccountResources(address: string): Promise<AccountResource[]>;
+    /**
+     * Execute a Move view function via the upstream node's POST /v1/view.
+     *
+     * Stateless passthrough — view results are not cached. Returns the raw
+     * array the upstream API returns (single-value views still come back as
+     * a one-element tuple).
+     *
+     * `extraHeaders` are forwarded to upstream — used by the fork server's
+     * view proxy to relay client headers (`Accept`, `X-Aptos-Client`, …)
+     * so downstream behavior such as BCS-encoded responses is preserved.
+     */
+    view(payload: unknown, extraHeaders?: Record<string, string>): Promise<unknown[]>;
 }
-//# sourceMappingURL=api.d.ts.map

package/dist/fork/api.js

@@ -98,6 +98,87 @@ export class MovementApiClient {
             req.end();
         });
     }
+    /**
+     * Make a POST request to the API with a JSON body.
+     *
+     * Mirrors `get<T>` for TLS/timeout/maxBytes/error-wrapping; differs
+     * only in `method: 'POST'`, the `Content-Type: application/json`
+     * header, and writing `body` to the request stream before `end()`.
+     *
+     * `extraHeaders` are merged in last and override defaults — used by
+     * the fork-server view proxy to forward client headers like
+     * `Accept` or `X-Aptos-Client` through to the upstream node.
+     */
+    async post(path, body, extraHeaders = {}) {
+        const fullUrl = `${this.nodeUrl}${path}`;
+        const parsedUrl = new URL(fullUrl);
+        const isHttps = parsedUrl.protocol === 'https:';
+        const client = isHttps ? https : http;
+        const payload = JSON.stringify(body);
+        const headers = {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(payload).toString(),
+        };
+        if (this.apiKey !== undefined) {
+            headers.Authorization = `Bearer ${this.apiKey}`;
+        }
+        for (const [k, v] of Object.entries(extraHeaders)) {
+            // Don't let callers override Content-Length — we just computed it.
+            if (k.toLowerCase() === 'content-length')
+                continue;
+            headers[k] = v;
+        }
+        const timeoutMs = this.timeoutMs;
+        const maxBytes = this.maxBytes;
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                fn();
+            };
+            const req = client.request(fullUrl, { method: 'POST', headers }, (res) => {
+                const chunks = [];
+                let totalBytes = 0;
+                res.on('data', (chunk) => {
+                    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                    totalBytes += buf.length;
+                    if (totalBytes > maxBytes) {
+                        req.destroy();
+                        settle(() => reject(new Error(`Response exceeded maxBytes (${maxBytes}); ${totalBytes} bytes received before abort`)));
+                        return;
+                    }
+                    chunks.push(buf);
+                });
+                res.on('end', () => {
+                    if (settled)
+                        return;
+                    const data = Buffer.concat(chunks).toString('utf8');
+                    if (res.statusCode !== 200) {
+                        settle(() => reject(new Error(`API request failed with status ${res.statusCode}: ${data}`)));
+                        return;
+                    }
+                    try {
+                        const parsed = JSON.parse(data);
+                        settle(() => resolve(parsed));
+                    }
+                    catch (err) {
+                        settle(() => reject(new Error(`Failed to parse JSON response: ${err}`)));
+                    }
+                });
+            });
+            req.setTimeout(timeoutMs, () => {
+                req.destroy();
+                settle(() => reject(new Error(`API request timed out after ${timeoutMs}ms`)));
+            });
+            req.on('error', (err) => {
+                settle(() => reject(new Error(`API request failed: ${err.message}`)));
+            });
+            req.write(payload);
+            req.end();
+        });
+    }
     /**
      * Build API path with proper prefix
      */
@@ -135,5 +216,18 @@ export class MovementApiClient {
         const normalizedAddress = normalizeAddressShort(address);
         return this.get(this.apiPath(`/accounts/${normalizedAddress}/resources`));
     }
+    /**
+     * Execute a Move view function via the upstream node's POST /v1/view.
+     *
+     * Stateless passthrough — view results are not cached. Returns the raw
+     * array the upstream API returns (single-value views still come back as
+     * a one-element tuple).
+     *
+     * `extraHeaders` are forwarded to upstream — used by the fork server's
+     * view proxy to relay client headers (`Accept`, `X-Aptos-Client`, …)
+     * so downstream behavior such as BCS-encoded responses is preserved.
+     */
+    async view(payload, extraHeaders = {}) {
+        return this.post(this.apiPath('/view'), payload, extraHeaders);
+    }
 }
-//# sourceMappingURL=api.js.map

package/dist/fork/manager.d.ts

@@ -38,6 +38,20 @@ export declare class ForkManager {
     getAccount(address: string): Promise<AccountState>;
     getResource(address: string, resourceType: string): Promise<any>;
     getAllResources(address: string): Promise<Record<string, any>>;
+    /**
+     * Stateless passthrough of `POST /v1/view` to the upstream RPC.
+     *
+     * View results are not cached — they depend on ledger version and
+     * arguments, so any caching layer would need version-aware
+     * invalidation that the fork system does not implement today. The
+     * payload is forwarded verbatim and the upstream response array is
+     * returned unchanged.
+     *
+     * `extraHeaders` are forwarded to upstream so that client headers
+     * such as `Accept: application/x-bcs` (for BCS-encoded view results)
+     * or `X-Aptos-Client` round-trip through the proxy.
+     */
+    forwardView(payload: unknown, extraHeaders?: Record<string, string>): Promise<unknown[]>;
     setResource(address: string, resourceType: string, data: unknown): Promise<void>;
     /** Adds to the existing balance rather than replacing it. */
     fundAccount(address: string, amount: number, coinType?: string): Promise<void>;
@@ -76,4 +90,3 @@ export declare class ForkManager {
      */
     getOrCreateAccount(address: string): Promise<AccountState>;
 }
-//# sourceMappingURL=manager.d.ts.map

package/dist/fork/manager.js

@@ -154,6 +154,25 @@ export class ForkManager {
         }
         return resources;
     }
+    /**
+     * Stateless passthrough of `POST /v1/view` to the upstream RPC.
+     *
+     * View results are not cached — they depend on ledger version and
+     * arguments, so any caching layer would need version-aware
+     * invalidation that the fork system does not implement today. The
+     * payload is forwarded verbatim and the upstream response array is
+     * returned unchanged.
+     *
+     * `extraHeaders` are forwarded to upstream so that client headers
+     * such as `Accept: application/x-bcs` (for BCS-encoded view results)
+     * or `X-Aptos-Client` round-trip through the proxy.
+     */
+    async forwardView(payload, extraHeaders = {}) {
+        if (!this.apiClient) {
+            throw new Error('Fork not initialized. Call initialize() or load() first.');
+        }
+        return this.apiClient.view(payload, extraHeaders);
+    }
     async setResource(address, resourceType, data) {
         const normalizedAddress = normalizeAddress(address);
         this.storage.saveResource(normalizedAddress, resourceType, data);
@@ -282,4 +301,3 @@ export class ForkManager {
         }
     }
 }
-//# sourceMappingURL=manager.js.map

package/dist/fork/server.d.ts

@@ -32,6 +32,11 @@ export declare class ForkServer {
      * the allowlist. No-op otherwise.
      */
     private applyCors;
+    private isOriginAllowed;
+    private allowedMethodsForPath;
+    private sendMethodNotAllowed;
+    private sendForbiddenOrigin;
+    private handleOptions;
     /**
      * Start the fork server
      */
@@ -44,6 +49,7 @@ export declare class ForkServer {
      * Sanitize pathname for error messages to prevent log injection
      */
     private sanitizePathname;
+    private sanitizeErrorMessage;
     /**
      * Handle incoming HTTP requests
      */
@@ -64,6 +70,19 @@ export declare class ForkServer {
      * Handle GET /v1/accounts/:address/resources
      */
     private handleGetResources;
+    /**
+     * Handle POST /v1/view — proxy to upstream RPC.
+     *
+     * Stateless: view results are not cached. Buffers the request body
+     * with a 1 MiB ceiling, parses JSON, delegates to
+     * `forkManager.forwardView`, and returns the upstream array verbatim.
+     *
+     * Errors map to:
+     *   413 — body exceeds MAX_VIEW_BODY_BYTES
+     *   400 — body is not valid JSON
+     *   502 — upstream RPC failed (timeout, network error, non-200 response)
+     */
+    private handleViewProxy;
     /**
      * Send JSON response.
      * unknown: arbitrary JSON-serializable payload; structural shape varies by
@@ -79,4 +98,3 @@ export declare class ForkServer {
      */
     private sendError;
 }
-//# sourceMappingURL=server.d.ts.map