polkadot-cli 0.9.0 → 0.10.0

package/README.md

@@ -42,7 +42,7 @@ dot chain remove westend
 
 Dev accounts (Alice, Bob, Charlie, Dave, Eve, Ferdie) are always available for testnets. Create or import your own accounts for any chain.
 
-> **Security warning:** Account secrets (mnemonics and seeds) are currently stored **unencrypted** in `~/.polkadot/accounts.json`. Do not use this for high-value accounts on mainnet. Encrypted storage is planned for a future release.
+> **Security warning:** Account secrets (mnemonics and seeds) are currently stored **unencrypted** in `~/.polkadot/accounts.json`. Do not use this for high-value accounts on mainnet. Encrypted storage is planned for a future release. Use `--env` to keep secrets off disk entirely.
 
 ```bash
 # List all accounts (dev + stored)
@@ -55,10 +55,26 @@ dot account create my-validator
 # Import from a BIP39 mnemonic
 dot account import treasury --secret "word1 word2 ... word12"
 
+# Add an env-var-backed account (secret stays off disk)
+dot account add ci-signer --env MY_SECRET
+
+# Use it — the env var is read at signing time
+MY_SECRET="word1 word2 ..." dot tx System.remark 0xdead --from ci-signer
+
 # Remove an account
 dot account remove my-validator
 ```
 
+#### Env-var-backed accounts
+
+For CI/CD and security-conscious workflows, store a reference to an environment variable instead of the secret itself:
+
+```bash
+dot account add ci-signer --env MY_SECRET
+```
+
+The secret is never written to disk. At signing time, the CLI reads `$MY_SECRET` and derives the keypair. If the variable is not set, the CLI errors with a clear message. `account list` shows an `(env: MY_SECRET)` badge and resolves the address live when the variable is available.
+
 **Supported secret formats for import:**
 
 | Format | Example | Status |

package/dist/cli.mjs

@@ -5,7 +5,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // src/cli.ts
 import cac from "cac";
 // package.json
-var version = "0.9.0";
+var version = "0.10.0";
 
 // src/config/accounts-store.ts
 import { access as access2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
@@ -120,6 +120,11 @@ function findAccount(file, name) {
   return file.accounts.find((a) => a.name.toLowerCase() === name.toLowerCase());
 }
 
+// src/config/accounts-types.ts
+function isEnvSecret(secret) {
+  return typeof secret === "object" && secret !== null && "env" in secret;
+}
+
 // src/core/accounts.ts
 import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
 import {
@@ -195,6 +200,27 @@ function toSs58(publicKey, prefix = 42) {
   }
   return ss58Address(publicKey, prefix);
 }
+function resolveSecret(secret) {
+  if (isEnvSecret(secret)) {
+    const value = process.env[secret.env];
+    if (!value) {
+      throw new Error(`Environment variable "${secret.env}" is not set. Set it before signing.`);
+    }
+    return value;
+  }
+  return secret;
+}
+function tryDerivePublicKey(envVarName) {
+  const value = process.env[envVarName];
+  if (!value)
+    return null;
+  try {
+    const { publicKey } = importAccount(value);
+    return publicKeyToHex(publicKey);
+  } catch {
+    return null;
+  }
+}
 async function resolveAccountSigner(name) {
   if (isDevAccount(name)) {
     const keypair2 = getDevKeypair(name);
@@ -206,8 +232,9 @@ async function resolveAccountSigner(name) {
     const available = [...DEV_NAMES, ...accountsFile.accounts.map((a) => a.name)];
     throw new Error(`Unknown account "${name}". Available accounts: ${available.join(", ")}`);
   }
-  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(account.secret);
-  const keypair = isHexSeed ? deriveFromHexSeed(account.secret, account.derivationPath) : deriveFromMnemonic(account.secret, account.derivationPath);
+  const secret = resolveSecret(account.secret);
+  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(secret);
+  const keypair = isHexSeed ? deriveFromHexSeed(secret, account.derivationPath) : deriveFromMnemonic(secret, account.derivationPath);
   return getPolkadotSigner(keypair.publicKey, "Sr25519", keypair.sign);
 }
 
@@ -309,20 +336,23 @@ var ACCOUNT_HELP = `
 ${BOLD}Usage:${RESET}
   $ dot account create <name>                Create a new account
   $ dot account import <name> --secret <s>   Import from BIP39 mnemonic
+  $ dot account add <name> --env <VAR>       Add account backed by env variable
   $ dot account list                         List all accounts
   $ dot account remove <name>                Remove a stored account
 
 ${BOLD}Examples:${RESET}
   $ dot account create my-validator
   $ dot account import treasury --secret "word1 word2 ... word12"
+  $ dot account add ci-signer --env MY_SECRET
   $ dot account list
   $ dot account remove my-validator
 
 ${YELLOW}Note: Secrets are stored unencrypted in ~/.polkadot/accounts.json.
+      Use --env to keep secrets off disk entirely.
       Hex seed import (0x...) is not supported via CLI.${RESET}
 `.trimStart();
 function registerAccountCommands(cli) {
-  cli.command("account [action] [name]", "Manage local accounts (create, import, list, remove)").alias("accounts").option("--secret <value>", "Secret key (mnemonic or hex seed) for import").action(async (action, name, opts) => {
+  cli.command("account [action] [name]", "Manage local accounts (create, import, add, list, remove)").alias("accounts").option("--secret <value>", "Secret key (mnemonic or hex seed) for import").option("--env <varName>", "Environment variable name holding the secret").action(async (action, name, opts) => {
     if (!action) {
       return accountList();
     }
@@ -331,6 +361,8 @@ function registerAccountCommands(cli) {
         return accountCreate(name);
       case "import":
         return accountImport(name, opts);
+      case "add":
+        return accountAdd(name, opts);
       case "list":
         return accountList();
       case "remove":
@@ -410,6 +442,44 @@ async function accountImport(name, opts) {
   console.log(`  ${BOLD}Address:${RESET} ${address}`);
   console.log();
 }
+async function accountAdd(name, opts) {
+  if (!name) {
+    console.error(`Account name is required.
+`);
+    console.error("Usage: dot account add <name> --env <VAR>");
+    process.exit(1);
+  }
+  if (!opts.env) {
+    console.error(`--env is required.
+`);
+    console.error("Usage: dot account add <name> --env <VAR>");
+    process.exit(1);
+  }
+  if (isDevAccount(name)) {
+    throw new Error(`"${name}" is a built-in dev account and cannot be used as a custom account name.`);
+  }
+  const accountsFile = await loadAccounts();
+  if (findAccount(accountsFile, name)) {
+    throw new Error(`Account "${name}" already exists.`);
+  }
+  const publicKey = tryDerivePublicKey(opts.env) ?? "";
+  accountsFile.accounts.push({
+    name,
+    secret: { env: opts.env },
+    publicKey,
+    derivationPath: ""
+  });
+  await saveAccounts(accountsFile);
+  printHeading("Account Added");
+  console.log(`  ${BOLD}Name:${RESET}  ${name}`);
+  console.log(`  ${BOLD}Env:${RESET}   ${opts.env}`);
+  if (publicKey) {
+    console.log(`  ${BOLD}Address:${RESET} ${toSs58(publicKey)}`);
+  } else {
+    console.log(`  ${YELLOW}Address will resolve when $${opts.env} is set.${RESET}`);
+  }
+  console.log();
+}
 async function accountList() {
   printHeading("Dev Accounts");
   for (const name of DEV_NAMES) {
@@ -421,8 +491,19 @@ async function accountList() {
   if (accountsFile.accounts.length > 0) {
     printHeading("Stored Accounts");
     for (const account of accountsFile.accounts) {
-      const address = toSs58(account.publicKey);
-      printItem(account.name, address);
+      let displayName = account.name;
+      let address;
+      if (isEnvSecret(account.secret)) {
+        displayName += ` (env: ${account.secret.env})`;
+        let pubKey = account.publicKey;
+        if (!pubKey) {
+          pubKey = tryDerivePublicKey(account.secret.env) ?? "";
+        }
+        address = pubKey ? toSs58(pubKey) : "n/a";
+      } else {
+        address = toSs58(account.publicKey);
+      }
+      printItem(displayName, address);
     }
   } else {
     printHeading("Stored Accounts");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polkadot-cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "CLI tool for querying Polkadot-ecosystem on-chain state",
   "type": "module",
   "bin": {