movehat 0.2.5 → 0.2.7

package/dist/core/config.js

@@ -13,6 +13,45 @@ import { logger } from "../ui/index.js";
 // same value here. No corruption, no in-flight-promise memoization
 // needed.
 const configCache = new Map();
+// In-flight load deduplication (#47). When two callers hit a cold cache
+// for the same config file concurrently, both would invoke
+// `register()` from `tsx/esm/api` and race on the unregister cleanup.
+// The dedup map ensures only ONE load runs per (path, mtime) burst —
+// concurrent callers await the same Promise. Cleared after the load
+// settles so a later edit (new mtime) can re-trigger a cold load.
+const inFlightLoads = new Map();
+// Hostnames recognized as safe targets for the deterministic test key
+// auto-injection. Any URL whose hostname is not in this set causes the
+// test-key path to be skipped even if the network NAME is 'testnet' or
+// 'local' (#40 — name-only gating was spoofable when users named a
+// production-pointing network 'testnet').
+const TEST_ENDPOINT_HOSTS = new Set([
+    "testnet.movementnetwork.xyz",
+    "localhost",
+    "127.0.0.1",
+    "::1",
+]);
+function isKnownTestEndpoint(url) {
+    try {
+        return TEST_ENDPOINT_HOSTS.has(new URL(url).hostname.toLowerCase());
+    }
+    catch {
+        return false;
+    }
+}
+// Render a URL for log output without exposing userinfo (`user:pass@`)
+// or query strings (`?apiKey=…`). Returns the protocol + host + pathname
+// only, which is enough for the operator to identify the endpoint
+// without leaking embedded credentials to CI logs.
+function sanitizeUrlForLog(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+    }
+    catch {
+        return "<invalid-url>";
+    }
+}
 /**
  * Loads the user's movehat.config.{ts,js} from the current working directory.
  *
@@ -47,32 +86,58 @@ export async function loadUserConfig() {
         if (cached && cached.mtimeMs === mtimeMs) {
             return cached.config;
         }
-        let configModule;
-        if (configPath.endsWith('.ts')) {
-            const { register } = await import('tsx/esm/api');
-            const unregister = register();
-            try {
-                const configUrl = pathToFileURL(configPath).href;
-                configModule = await import(configUrl + '?mtime=' + mtimeMs);
-            }
-            finally {
-                unregister();
-            }
+        // Dedup concurrent cold-cache loads of the same file (#47).
+        // Without this, two callers race on tsx's register/unregister and
+        // the second may run its `await import()` after the first calls
+        // unregister(), removing the loader mid-flight. All callers go
+        // through the same `return await loadPromise` below so the outer
+        // try/catch wraps a consistent error regardless of who started the
+        // load.
+        let loadPromise = inFlightLoads.get(configPath);
+        if (!loadPromise) {
+            loadPromise = doLoadConfig(configPath, mtimeMs);
+            inFlightLoads.set(configPath, loadPromise);
+            // Clean up after settles. `.catch(() => undefined)` after the
+            // finally chain swallows the cleanup-promise rejection so it
+            // does not become an unhandled rejection — the actual awaiters
+            // still see the original rejection via `return await loadPromise`.
+            void loadPromise
+                .finally(() => {
+                if (inFlightLoads.get(configPath) === loadPromise) {
+                    inFlightLoads.delete(configPath);
+                }
+            })
+                .catch(() => undefined);
         }
-        else {
+        return await loadPromise;
+    }
+    catch (error) {
+        throw new Error(`Failed to load configuration file '${configPath}': ${error}`);
+    }
+}
+async function doLoadConfig(configPath, mtimeMs) {
+    let configModule;
+    if (configPath.endsWith('.ts')) {
+        const { register } = await import('tsx/esm/api');
+        const unregister = register();
+        try {
             const configUrl = pathToFileURL(configPath).href;
             configModule = await import(configUrl + '?mtime=' + mtimeMs);
         }
-        const userConfig = configModule.default;
-        if (!userConfig.networks || Object.keys(userConfig.networks).length === 0) {
-            throw new Error("No networks defined in configuration. Add at least one network in the 'networks' field.");
+        finally {
+            unregister();
         }
-        configCache.set(configPath, { mtimeMs, config: userConfig });
-        return userConfig;
     }
-    catch (error) {
-        throw new Error(`Failed to load configuration file '${configPath}': ${error}`);
+    else {
+        const configUrl = pathToFileURL(configPath).href;
+        configModule = await import(configUrl + '?mtime=' + mtimeMs);
     }
+    const userConfig = configModule.default;
+    if (!userConfig.networks || Object.keys(userConfig.networks).length === 0) {
+        throw new Error("No networks defined in configuration. Add at least one network in the 'networks' field.");
+    }
+    configCache.set(configPath, { mtimeMs, config: userConfig });
+    return userConfig;
 }
 /**
  * Clear the in-memory config cache. Test-only escape hatch.
@@ -82,6 +147,7 @@ export async function loadUserConfig() {
  */
 export function _resetConfigCache() {
     configCache.clear();
+    inFlightLoads.clear();
 }
 /**
  * Resolve configuration for a specific network
@@ -136,15 +202,30 @@ export async function resolveNetworkConfig(userConfig, networkName) {
     if (accounts.length === 0 && process.env.PRIVATE_KEY) {
         accounts = [process.env.PRIVATE_KEY];
     }
-    // 4. Validate we have at least one account (unless using testnet/local)
+    // 4. Validate we have at least one account (unless using testnet/local
+    //    AND the URL is a recognized test endpoint — name alone is not enough
+    //    per #40, since a user can name a network 'testnet' but point it at
+    //    a production RPC and would otherwise inherit the deterministic test
+    //    key with a production endpoint).
     if (accounts.length === 0 || !accounts[0]) {
-        // Special case: Auto-generate test accounts for testing networks
-        // testnet = public Movement test network (recommended)
-        // local = local fork server
-        if (selectedNetwork === "testnet" || selectedNetwork === "local") {
+        const isTestNetworkName = selectedNetwork === "testnet" || selectedNetwork === "local";
+        const isTestEndpoint = isTestNetworkName && isKnownTestEndpoint(networkConfig.url);
+        if (isTestNetworkName && !isTestEndpoint) {
+            // Name matches the reserved convention but URL is not a recognized
+            // test endpoint — block the deterministic test-key injection. Falls
+            // through to the standard "no accounts" throw below so the user gets
+            // actionable guidance.
+            logger.warning(`Network '${selectedNetwork}' uses a name reserved for testnet/local ` +
+                `but '${sanitizeUrlForLog(networkConfig.url)}' is not a recognized test endpoint. ` +
+                `Skipping auto-injection of the deterministic test key to protect ` +
+                `against accidental production use. Set PRIVATE_KEY explicitly, ` +
+                `configure 'accounts' in movehat.config.ts, or rename this network.`);
+        }
+        if (isTestEndpoint) {
             // Security: Using a deterministic test account (like Hardhat's default accounts)
             // This is SAFE because:
-            // 1. Only used for testnet/local (never mainnet - that throws error below)
+            // 1. Only used for testnet/local against a known test endpoint
+            //    (network NAME + URL allowlist enforced above; bypassed otherwise)
             // 2. Perfect for transaction simulation (no real funds)
             // 3. Deterministic = consistent test results
             const testPrivateKey = "0x0000000000000000000000000000000000000000000000000000000000000001";
@@ -155,8 +236,9 @@ export async function resolveNetworkConfig(userConfig, networkName) {
             logger.newline();
         }
         else {
-            // For any other network (especially mainnet), REQUIRE explicit configuration
-            // This prevents accidentally using the test key on production networks
+            // For any other network (mainnet, or testnet/local with a non-test
+            // URL), REQUIRE explicit configuration. This prevents accidentally
+            // using the test key on production networks.
             throw new Error(`Network '${selectedNetwork}' has no accounts configured.\n` +
                 `\n` +
                 `SECURITY: This network requires explicit account configuration.\n` +

package/dist/harness/Harness.d.ts

@@ -1,3 +1,4 @@
+import type { Account } from "@aptos-labs/ts-sdk";
 import type { MovehatRuntime } from "../types/runtime.js";
 import type { LocalNodeManager } from "../node/LocalNodeManager.js";
 import type { ForkServer } from "../fork/server.js";
@@ -13,14 +14,41 @@ export type HarnessMode = "local" | "fork" | "live";
  * a Proxy that synchronously throws {@link HarnessDisposedError} on any
  * post-`cleanup()` call to one of the deployment / script / view methods.
  *
- * AccountManager note: the underlying account pool is a process-wide
- * static (see `core/AccountManager.ts`). Two Harness instances in the
- * same process share account labels; this is the same constraint that
- * already governs `setupTestFixture`.
+ * Account isolation: each Harness owns a per-instance `AccountManager`
+ * (see `core/AccountManager.ts`) reachable at `harness.runtime.accountManager`.
+ * Two Harness instances in the same process have independent account
+ * pools and label maps — `Harness.createLocal({ accountLabels: ["alice"] })`
+ * twice produces two DIFFERENT alice accounts.
+ *
+ * Labeled accounts created during construction (via `accountLabels` in
+ * `createLocal`) are snapshotted onto `harness.accounts` at construction
+ * time. Late additions via `harness.runtime.accountManager.createAccount(...)`
+ * are NOT reflected in the `accounts` Record — that's a snapshot, not a
+ * live view. For live mode (`Harness.createLive`), `accounts` is `{}`
+ * because the live factory does not create labeled accounts; reach into
+ * `harness.runtime.accountManager.*` for advanced operations.
+ *
+ * The `AccountManager` class-static methods remain available in 0.2.x
+ * for backward compatibility (deprecation warning lands in 0.2.7,
+ * removal in 0.3.0 — see #270). New code should prefer
+ * `harness.accounts.<label>` for the common read path.
  */
 export declare class Harness {
     readonly mode: HarnessMode;
     readonly runtime: MovehatRuntime;
+    /**
+     * Labeled accounts snapshotted from `runtime.accountManager` at
+     * construction time. For `createLocal`, this is populated from the
+     * `accountLabels` option. For `createFork`, populated the same way.
+     * For `createLive`, empty (live mode does not create labeled accounts;
+     * use `harness.runtime.accountManager.loadAccountFromPrivateKey(...)`
+     * for direct key loading).
+     *
+     * Typed `Readonly` so the snapshot can't be mutated via
+     * `harness.accounts.alice = X`. Reach into
+     * `harness.runtime.accountManager.*` when you need mutable access.
+     */
+    readonly accounts: Readonly<Record<string, Account>>;
     /** @internal */
     readonly localNode?: LocalNodeManager;
     /** @internal */

package/dist/harness/Harness.js

@@ -12,14 +12,41 @@ import { runMoveScript } from "./script.js";
  * a Proxy that synchronously throws {@link HarnessDisposedError} on any
  * post-`cleanup()` call to one of the deployment / script / view methods.
  *
- * AccountManager note: the underlying account pool is a process-wide
- * static (see `core/AccountManager.ts`). Two Harness instances in the
- * same process share account labels; this is the same constraint that
- * already governs `setupTestFixture`.
+ * Account isolation: each Harness owns a per-instance `AccountManager`
+ * (see `core/AccountManager.ts`) reachable at `harness.runtime.accountManager`.
+ * Two Harness instances in the same process have independent account
+ * pools and label maps — `Harness.createLocal({ accountLabels: ["alice"] })`
+ * twice produces two DIFFERENT alice accounts.
+ *
+ * Labeled accounts created during construction (via `accountLabels` in
+ * `createLocal`) are snapshotted onto `harness.accounts` at construction
+ * time. Late additions via `harness.runtime.accountManager.createAccount(...)`
+ * are NOT reflected in the `accounts` Record — that's a snapshot, not a
+ * live view. For live mode (`Harness.createLive`), `accounts` is `{}`
+ * because the live factory does not create labeled accounts; reach into
+ * `harness.runtime.accountManager.*` for advanced operations.
+ *
+ * The `AccountManager` class-static methods remain available in 0.2.x
+ * for backward compatibility (deprecation warning lands in 0.2.7,
+ * removal in 0.3.0 — see #270). New code should prefer
+ * `harness.accounts.<label>` for the common read path.
  */
 export class Harness {
     mode;
     runtime;
+    /**
+     * Labeled accounts snapshotted from `runtime.accountManager` at
+     * construction time. For `createLocal`, this is populated from the
+     * `accountLabels` option. For `createFork`, populated the same way.
+     * For `createLive`, empty (live mode does not create labeled accounts;
+     * use `harness.runtime.accountManager.loadAccountFromPrivateKey(...)`
+     * for direct key loading).
+     *
+     * Typed `Readonly` so the snapshot can't be mutated via
+     * `harness.accounts.alice = X`. Reach into
+     * `harness.runtime.accountManager.*` when you need mutable access.
+     */
+    accounts;
     /** @internal */
     localNode;
     /** @internal */
@@ -30,6 +57,7 @@ export class Harness {
     constructor(init) {
         this.mode = init.mode;
         this.runtime = init.runtime;
+        this.accounts = init.runtime.accountManager.getLabeledAccounts();
         if (init.localNode)
             this.localNode = init.localNode;
         if (init.forkServer)

package/dist/helpers/setup.js

@@ -14,8 +14,10 @@ export async function setupTestEnvironment(networkName) {
         fullnode: config.rpc,
     });
     const aptos = new Aptos(aptosConfig);
-    // Load account using AccountManager
-    const account = AccountManager.loadAccountFromPrivateKey(config.privateKey);
+    // Load account using a throwaway AccountManager instance. This helper
+    // returns Aptos+Account directly (no runtime exposure), so a local
+    // instance suffices — no shared pool needed.
+    const account = new AccountManager().loadAccountFromPrivateKey(config.privateKey);
     logger.success("Test environment ready");
     logger.plain(`   Account: ${account.accountAddress.toString()}`);
     logger.plain(`   Network: ${config.network}`);
@@ -28,5 +30,6 @@ export async function setupTestEnvironment(networkName) {
     };
 }
 export function createTestAccount() {
-    return AccountManager.createAccount();
+    // Throwaway instance — see setupTestEnvironment for rationale.
+    return new AccountManager().createAccount();
 }

package/dist/helpers/setupLocalTesting.js

@@ -118,8 +118,12 @@ async function setupWithLocalNode(options, accountLabels, autoFund, defaultBalan
     // leaks and port 8080 stays bound until the OS reaps it (manifests as
     // "Movement command failed" on the next test:example run).
     try {
+        // Per-context AccountManager. Threaded into initRuntime below so
+        // the runtime exposes the SAME instance — the labels created by
+        // createBatch here are visible on `runtime.accountManager`.
+        const accountManager = new AccountManager();
         logger.step(`Generating ${accountLabels.length} test accounts...`);
-        const accounts = AccountManager.createBatch(accountLabels);
+        const accounts = accountManager.createBatch(accountLabels);
         for (const [label, account] of Object.entries(accounts)) {
             logger.plain(`   ${label}: ${account.accountAddress.toString()}`);
         }
@@ -129,12 +133,13 @@ async function setupWithLocalNode(options, accountLabels, autoFund, defaultBalan
             await localNode.fundAccounts(accountsList, defaultBalance);
         }
         logger.step("Initializing runtime for local network...");
-        const deployerPrivateKey = AccountManager.exportPrivateKeys(["deployer"]).deployer;
+        const deployerPrivateKey = accountManager.exportPrivateKeys(["deployer"]).deployer;
         if (!deployerPrivateKey) {
             throw new Error("Failed to get deployer private key");
         }
         const runtime = await initRuntime({
             network: "local",
+            accountManager,
             configOverride: {
                 networks: {
                     local: {
@@ -256,8 +261,10 @@ async function setupWithFork(options, accountLabels, autoFund, defaultBalance) {
     // we leak the listener.
     try {
         await new Promise((resolve) => setTimeout(resolve, 500));
+        // Per-context AccountManager (mirror of setupWithLocalNode pattern).
+        const accountManager = new AccountManager();
         logger.step(`Generating ${accountLabels.length} test accounts...`);
-        const accounts = AccountManager.createBatch(accountLabels);
+        const accounts = accountManager.createBatch(accountLabels);
         for (const [label, account] of Object.entries(accounts)) {
             logger.plain(`   ${label}: ${account.accountAddress.toString()}`);
         }
@@ -267,12 +274,13 @@ async function setupWithFork(options, accountLabels, autoFund, defaultBalance) {
             await forkManager.fundMultipleAccounts(addresses, defaultBalance);
         }
         logger.step("Initializing runtime for local network...");
-        const deployerPrivateKey = AccountManager.exportPrivateKeys(["deployer"]).deployer;
+        const deployerPrivateKey = accountManager.exportPrivateKeys(["deployer"]).deployer;
         if (!deployerPrivateKey) {
             throw new Error("Failed to get deployer private key");
         }
         const runtime = await initRuntime({
             network: "local",
+            accountManager,
             configOverride: {
                 networks: {
                     local: {

package/dist/helpers/testFixtures.d.ts

@@ -22,10 +22,11 @@ export interface TestFixture<TModules extends string = string> {
     /**
      * Stop the local node / fork server this fixture started.
      *
-     * Does **not** clear the shared `AccountManager` pool — clearing it
-     * would break parallel `setupTestFixture` invocations that share the
-     * pool. The pool grows for the lifetime of the process; the process
-     * exit reclaims it.
+     * Each fixture owns its own `AccountManager` instance (via
+     * `setupLocalTesting` → `initRuntime`), so there is no shared pool
+     * to clear — accounts are garbage-collected when the fixture goes
+     * out of scope. Parallel `setupTestFixture` invocations have fully
+     * isolated label maps and pools (M9.2, #270).
      */
     teardown: () => Promise<void>;
 }

package/dist/helpers/testFixtures.js

@@ -1,4 +1,3 @@
-import { AccountManager } from "../core/AccountManager.js";
 import { setupLocalTesting } from "./setupLocalTesting.js";
 import { logger } from "../ui/index.js";
 /**
@@ -59,7 +58,7 @@ export async function setupTestFixture(modules, accountLabels = ["alice", "bob"]
     // the original assembly error unchanged.
     try {
         const mh = ctx.runtime;
-        const labeledAccounts = AccountManager.getLabeledAccounts();
+        const labeledAccounts = mh.accountManager.getLabeledAccounts();
         // any: TestFixture.accounts has a structural shape with required
         // `deployer/alice/bob` plus a `[key: string]: Account` index. The
         // builder fills the index dynamically; typing this as the exact
@@ -72,7 +71,7 @@ export async function setupTestFixture(modules, accountLabels = ["alice", "bob"]
             deployer: labeledAccounts.deployer,
         };
         for (const label of accountLabels) {
-            accounts[label] = labeledAccounts[label] || AccountManager.getOrCreateLabeled(label);
+            accounts[label] = labeledAccounts[label] || mh.accountManager.getOrCreateLabeled(label);
         }
         const contracts = {};
         for (const moduleName of modules) {
@@ -119,14 +118,14 @@ export async function setupMinimalFixture(accountLabels = ["alice", "bob"], opti
     // Same teardown-on-assembly-failure pattern as setupTestFixture.
     try {
         const mh = ctx.runtime;
-        const labeledAccounts = AccountManager.getLabeledAccounts();
+        const labeledAccounts = mh.accountManager.getLabeledAccounts();
         // any: see setupTestFixture above — same dynamic-key builder pattern.
         const accounts = {
             // non-null: deployer is unconditionally added to allLabels at L156 above.
             deployer: labeledAccounts.deployer,
         };
         for (const label of accountLabels) {
-            accounts[label] = labeledAccounts[label] || AccountManager.getOrCreateLabeled(label);
+            accounts[label] = labeledAccounts[label] || mh.accountManager.getOrCreateLabeled(label);
         }
         logger.newline();
         logger.success("Minimal fixture ready!");

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export * from "./helpers/index.js";
-export type { MovehatConfig } from "./types/config.js";
+export type { MovehatConfig, NetworkConfig, LocalTestingMode, } from "./types/config.js";
 export { initRuntime } from "./runtime.js";
+export type { InitRuntimeOptions } from "./runtime.js";
 export type { MovehatRuntime, NetworkInfo } from "./types/runtime.js";
+export type { ChildProcessAdapter } from "./utils/childProcessAdapter.js";
 export { ForkManager } from "./fork/manager.js";
 export { MovementApiClient } from "./fork/api.js";
 export { ForkStorage } from "./fork/storage.js";

package/dist/runtime.d.ts

@@ -1,9 +1,22 @@
 import { MovehatRuntime } from "./types/runtime.js";
 import { MovehatUserConfig } from "./types/config.js";
+import { AccountManager } from "./core/AccountManager.js";
 export interface InitRuntimeOptions {
     network?: string;
     accountIndex?: number;
     configOverride?: Partial<MovehatUserConfig>;
+    /**
+     * Optional pre-constructed `AccountManager` instance. When supplied,
+     * the returned runtime's `accountManager` field is THIS instance —
+     * so labeled accounts created BEFORE `initRuntime` are visible on
+     * the runtime. When omitted, `initRuntime` constructs a fresh
+     * `new AccountManager()` per call.
+     *
+     * `setupLocalTesting` uses this option to thread one manager through
+     * `createBatch` → `exportPrivateKeys` → `initRuntime` so the deployer
+     * key it extracts ends up on the same manager the runtime exposes.
+     */
+    accountManager?: AccountManager;
 }
 /**
  * Initialize the Movehat Runtime Environment.

package/dist/runtime.js

@@ -35,9 +35,12 @@ export async function initRuntime(options = {}) {
         fullnode: config.rpc,
     });
     const aptos = new Aptos(aptosConfig);
-    // Setup accounts using AccountManager
+    // Setup accounts using AccountManager. Use the caller-supplied
+    // instance when threaded in (preserves labels created before
+    // initRuntime); otherwise construct a fresh one.
+    const accountManager = options.accountManager ?? new AccountManager();
     const accountIndex = options.accountIndex || 0;
-    const accounts = AccountManager.loadAccountsFromConfig(config);
+    const accounts = accountManager.loadAccountsFromConfig(config);
     // Primary account (accounts[0] or selected index)
     const account = accounts[accountIndex];
     if (!account) {
@@ -73,10 +76,10 @@ export async function initRuntime(options = {}) {
         return getDeployedAddress(config.network, moduleName);
     };
     const createAccount = () => {
-        return AccountManager.createAccount();
+        return accountManager.createAccount();
     };
     const getAccountHelper = (privateKeyHex) => {
-        return AccountManager.loadAccountFromPrivateKey(privateKeyHex);
+        return accountManager.loadAccountFromPrivateKey(privateKeyHex);
     };
     const getAccountByIndex = (index) => {
         const acc = accounts[index];
@@ -95,6 +98,7 @@ export async function initRuntime(options = {}) {
         aptos,
         account,
         accounts,
+        accountManager,
         getContract: getContractHelper,
         deployContract,
         getDeployment,

package/dist/templates/tests/Counter.test.ts

@@ -1,7 +1,7 @@
 // @ts-nocheck - This is a template file, dependencies are installed in user projects
 import { describe, it, before, after } from "mocha";
 import { expect } from "chai";
-import { Harness, AccountManager } from "movehat";
+import { Harness } from "movehat";
 
 describe("Counter Contract", () => {
   let harness;
@@ -23,10 +23,11 @@ describe("Counter Contract", () => {
       autoDeploy: ["counter"],
     });
 
-    const labeled = AccountManager.getLabeledAccounts();
-    deployer = labeled.deployer;
-    alice = labeled.alice;
-    bob = labeled.bob;
+    // harness.accounts is a snapshot of the labeled accounts created
+    // during Harness construction. Two `Harness.createLocal({ accountLabels:
+    // ["alice"] })` calls in the same process now produce DIFFERENT
+    // alice accounts (per-Harness isolation introduced in 0.2.7).
+    ({ deployer, alice, bob } = harness.accounts);
 
     const counterAddr = harness.runtime.getDeploymentAddress("counter");
     counter = harness.runtime.getContract(counterAddr, "counter");

package/dist/types/runtime.d.ts

@@ -2,6 +2,7 @@ import { Aptos, Account } from "@aptos-labs/ts-sdk";
 import { MovehatConfig } from "./config.js";
 import { MoveContract } from "../core/contract.js";
 import { DeploymentInfo } from "../core/deployments.js";
+import type { AccountManager } from "../core/AccountManager.js";
 import type { ChildProcessAdapter } from "../utils/childProcessAdapter.js";
 export interface NetworkInfo {
     name: string;
@@ -14,6 +15,7 @@ export interface MovehatRuntime {
     aptos: Aptos;
     account: Account;
     accounts: Account[];
+    accountManager: AccountManager;
     getContract: (address: string, moduleName: string) => MoveContract;
     deployContract: (moduleName: string, options?: {
         packageDir?: string;

package/dist/utils/parseCliOutput.d.ts

@@ -6,9 +6,12 @@
 /**
  * Extract the transaction hash from a `movement` CLI subcommand's stdout.
  *
- * Tries the context-bearing pattern first (`transaction hash: 0x…`,
- * `txn hash: 0x…`, `hash: 0x…`) and falls back to any 64-char hex
- * literal in the buffer. Returns `undefined` if no candidate matches.
+ * Only the context-bearing pattern is accepted (`transaction hash: 0x…`,
+ * `txn hash: 0x…`, `hash: 0x…`). When the context is absent we log a
+ * warning and return `undefined` so callers decide whether to throw —
+ * the previous behavior of falling back to "any 64-hex literal" was
+ * fragile: a padded module address or state root printed before the
+ * actual txhash would silently corrupt the cached deployment record.
  *
  * Shared by `core/Publisher.ts` (publish), `harness/codeObject.ts`
  * (deploy-object / upgrade-object), and `harness/script.ts`

package/dist/utils/parseCliOutput.js

@@ -3,12 +3,16 @@
  *
  * @internal — not exported from `src/index.ts`.
  */
+import { logger } from '../ui/index.js';
 /**
  * Extract the transaction hash from a `movement` CLI subcommand's stdout.
  *
- * Tries the context-bearing pattern first (`transaction hash: 0x…`,
- * `txn hash: 0x…`, `hash: 0x…`) and falls back to any 64-char hex
- * literal in the buffer. Returns `undefined` if no candidate matches.
+ * Only the context-bearing pattern is accepted (`transaction hash: 0x…`,
+ * `txn hash: 0x…`, `hash: 0x…`). When the context is absent we log a
+ * warning and return `undefined` so callers decide whether to throw —
+ * the previous behavior of falling back to "any 64-hex literal" was
+ * fragile: a padded module address or state root printed before the
+ * actual txhash would silently corrupt the cached deployment record.
  *
  * Shared by `core/Publisher.ts` (publish), `harness/codeObject.ts`
  * (deploy-object / upgrade-object), and `harness/script.ts`
@@ -20,6 +24,7 @@ export function parseTxHash(stdout) {
     const withContext = stdout.match(/(?:transaction\s*(?:hash)?|txn\s*(?:hash)?|hash):\s*(0x[a-fA-F0-9]{64})\b/i);
     if (withContext?.[1])
         return withContext[1];
-    const fallback = stdout.match(/\b(0x[a-fA-F0-9]{64})\b/);
-    return fallback?.[1];
+    logger.warning(`parseTxHash: no contextual 'transaction|txn|hash: 0x…' match in ${stdout.length}-byte CLI output. ` +
+        `Returning undefined; the caller decides whether to error.`);
+    return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "movehat",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "type": "module",
   "description": "Hardhat-like development framework for Movement L1 smart contracts",
   "bin": {