polkadot-cli 1.18.0 → 1.20.0

package/README.md

@@ -280,6 +280,10 @@ dot account create my-staking --path //staking
 # Add a keyed account from a BIP39 mnemonic
 dot account add treasury --secret "word1 word2 ... word12"
 
+# Add from a 32-byte hex seed or a 64-byte raw sr25519 private key
+dot account add seeded --secret 0x1111111111111111111111111111111111111111111111111111111111111111
+dot account add raw-key --secret 0x<128-hex-char expanded secret>   # no --path
+
 # Add with a derivation path
 dot account add hot-wallet --secret "word1 word2 ... word12" --path //hot
 
@@ -313,6 +317,7 @@ dot account inspect 5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY
 dot account inspect 0xd43593c715fdd31c61141abd04a99fd6822c8558854ccde39a5684e7a56da27d
 dot account inspect alice --prefix 0         # Polkadot mainnet prefix
 dot account inspect alice --json             # JSON output
+dot account inspect dave --show-secret       # reveal mnemonic + sr25519 private key
 ```
 
 #### Watch-only accounts
@@ -373,6 +378,11 @@ dot account alice                    # shorthand — unknown subcommands fall th
 
 dot account inspect 5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY
 dot account inspect 0xd43593c715fdd31c61141abd04a99fd6822c8558854ccde39a5684e7a56da27d
+
+# pallet-revive H160 — the 20-byte address shape from EVM tooling. Same
+# input slot as SS58 / hex pubkey; resolved to the deterministic fallback
+# AccountId32 (`H160 || 0xEE * 12`).
+dot account inspect 0x9621DDe636dE098B43Efb0fA9b61fAcFE328F99D
 ```
 
 Use `--prefix` to encode the SS58 address with a specific network prefix (default: 42):
@@ -390,6 +400,7 @@ dot account inspect alice --json
 # {
 #   "publicKey": "0xd43593c715fdd31c61141abd04a99fd6822c8558854ccde39a5684e7a56da27d",
 #   "ss58": "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY",
+#   "h160": "0x9621DDe636dE098B43Efb0fA9b61fAcFE328F99D",
 #   "prefix": 42,
 #   "name": "Alice",
 #   "kind": "dev"
@@ -407,10 +418,38 @@ dot account inspect alice
 #   Kind:        dev
 #   Public Key:  0xd43593c715fdd31c61141abd04a99fd6822c8558854ccde39a5684e7a56da27d
 #   SS58:        5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY
+#   H160:        0x9621DDe636dE098B43Efb0fA9b61fAcFE328F99D
+#   Prefix:      42
+```
+
+The `Kind:` line categorises the account: `dev` (built-in), `signer` (has a secret/env), `watch-only` (raw external address), `pallet sovereign` (derived from a `PalletId`), `parachain sovereign (child|sibling)` (derived from a parachain ID), or `revive H160 fallback` (a 20-byte input resolved to its deterministic Substrate AccountId32). For derived sovereigns, an extra `Source:` line shows what the address was derived from. For env-backed signers, an `Env:` line shows the variable; for derived child keys, `Derivation:` shows the path.
+
+##### pallet-revive H160 address
+
+Every Substrate account has a corresponding 20-byte H160 address under [pallet-revive](https://github.com/paritytech/polkadot-sdk/tree/master/substrate/frame/revive) (the new EVM-compatible smart-contracts pallet on Polkadot Hub / Asset Hub). `dot account inspect` always shows it, EIP-55 checksummed, on the `H160:` line. The mapping is offline and prefix-independent:
+
+- **AccountId32 → H160:** if the last 12 bytes are `0xEE`, strip them (the account originated from an Eth address); otherwise `keccak256(accountId32)` and take the last 20 bytes.
+- **H160 → AccountId32:** deterministic fallback is `H160 || 0xEE * 12`. (The full mapping after a successful `pallet_revive.map_account` extrinsic lives in on-chain `AddressSuffix` storage and isn't recoverable offline — that's a chain-state lookup.)
+
+Pass a 20-byte hex value as the inspect input to resolve it back to its fallback Substrate account:
+
+```bash
+dot account inspect 0x9621DDe636dE098B43Efb0fA9b61fAcFE328F99D
+# Output:
+# Account Info
+#
+#   Kind:        revive H160 fallback
+#   Public Key:  0x9621dde636de098b43efb0fa9b61facfe328f99deeeeeeeeeeeeeeeeeeeeeeee
+#   SS58:        5FTZ6n1wY3GBqEZ2DWEdspbTarvRnp8DM8x2YXbWubu7JN98
+#   H160:        0x9621DDe636dE098B43Efb0fA9b61fAcFE328F99D
 #   Prefix:      42
+
+# Script-friendly: just the H160 for a given account
+dot account inspect alice --json | jq -r .h160
+# 0x9621DDe636dE098B43Efb0fA9b61fAcFE328F99D
 ```
 
-The `Kind:` line categorises the account: `dev` (built-in), `signer` (has a secret/env), `watch-only` (raw external address), `pallet sovereign` (derived from a `PalletId`), or `parachain sovereign (child|sibling)` (derived from a parachain ID). For derived sovereigns, an extra `Source:` line shows what the address was derived from. For env-backed signers, an `Env:` line shows the variable; for derived child keys, `Derivation:` shows the path.
+Note: `dot` implements the current `pallet-revive` master variant (keccak fallback). Older `stable2412` runtimes used plain `accountId32[..20]` truncation; if you target one, compute it manually until a `--revive-truncate` flag lands.
 
 ##### Stateless sovereign derivation (script-friendly)
 
@@ -450,16 +489,21 @@ dot account inspect --pallet-id py/trsry --json
 
 Constraints (will error): cannot combine a positional input with derivation flags; `--pallet-id` and `--parachain` are mutually exclusive; `--parachain` requires `--parachain-type child|sibling`; `--show-secret` doesn't apply (derived sovereigns have no key).
 
-#### Reveal the sr25519 private key
+#### Reveal the mnemonic and sr25519 private key
 
-For provisioning another signer (e.g. a server that expects a raw hex private key in an env var), add `--show-secret` to print the **64-byte sr25519 expanded secret** as `0x`-prefixed hex:
+For provisioning another signer (e.g. a server that expects a raw hex private key in an env var), add `--show-secret` to print the **64-byte sr25519 expanded secret** as `0x`-prefixed hex. It also reveals the **stored mnemonic** (or hex seed) so you can back it up:
 
 ```bash
-dot account inspect dave --show-secret
-# Private Key: 0x<128 hex chars>   (sr25519 expanded, 64 bytes — never share)
+dot account inspect my-validator --show-secret
+# Mnemonic:    word1 word2 ... word12   (only for accounts stored as a phrase)
+# Private Key: 0x<128 hex chars>        (sr25519 expanded, 64 bytes — never share)
 ```
 
-Works for dev accounts (derived on-the-fly from the standard dev mnemonic) and for stored accounts that have a secret (mnemonic or hex seed). Refuses on watch-only accounts, bare SS58 addresses, or hex public keys. The hex is the final secret after any derivation path is applied, so it can be fed directly to signers that don't accept a mnemonic+path (e.g. `@scure/sr25519`'s `sign`, or services like identity-backend that read a `PROXY_PRIVATE_KEY`). Combine with `--json` to include it under the `privateKey` field.
+Works for dev accounts (derived on-the-fly from the standard dev mnemonic) and for stored accounts that have a secret. Refuses on watch-only accounts, bare SS58 addresses, or hex public keys. The revealed line depends on how the account was stored: a phrase shows under `Mnemonic`, a 32-byte hex seed under `Seed`, and a raw private key shows only the `Private Key` (the stored secret already _is_ the expanded key). **Env-backed secrets are never resolved to disk output** — only the `$VAR` reference is shown. The expanded `Private Key` is the final secret after any derivation path is applied, so it can be fed directly to signers that don't accept a mnemonic+path (e.g. `@scure/sr25519`'s `sign`, or services like identity-backend that read a `PROXY_PRIVATE_KEY`). Combine with `--json` to include the values under the `mnemonic`/`seed` and `privateKey` fields.
+
+The revealed `Private Key` round-trips: you can re-import it as a usable account (see [Import a raw private key](#import-a-raw-private-key) below).
+
+> **Note:** if the account was stored with a derivation path, the revealed `Mnemonic`/`Seed` reproduces the original address **only when re-imported with the same `--path`** (shown on the `Derivation` line). The `Private Key` already bakes in the path, so it round-trips on its own.
 
 #### Env-var-backed accounts
 
@@ -506,12 +550,29 @@ Signers
 
 **Supported secret formats for import:**
 
-| Format | Example | Status |
-|--------|---------|--------|
-| BIP39 mnemonic (12/24 words) | `"abandon abandon ... about"` | Supported |
-| Hex seed (`0x` + 64 hex chars) | `0xabcdef0123...` | Not supported via CLI (see below) |
+| Format | Example | `--path`? |
+|--------|---------|-----------|
+| BIP39 mnemonic (12/24 words) | `"abandon abandon ... about"` | Yes |
+| Hex seed (`0x` + 64 hex chars = 32 bytes) | `0x1111...1111` | Yes |
+| Raw private key (`0x` + 128 hex chars = 64-byte sr25519 expanded secret) | `0x20e0...5568` | No (cannot be HD-derived) |
+
+All three formats work directly from the command line via `--secret` or via `--env`.
 
-**Known limitation:** Hex seed import (`--secret 0x...`) does not work from the command line. The CLI argument parser (`cac`) interprets `0x`-prefixed values as JavaScript numbers, which loses precision for 32-byte seeds. Use a BIP39 mnemonic instead. If you need to import a raw seed programmatically, write it directly to `~/.polkadot/accounts.json`.
+#### Import a raw private key
+
+The 64-byte expanded secret that `--show-secret` prints can be re-imported as a fully usable, signing-capable account. This is the round-trip companion to `--show-secret` — handy when a key only exists in expanded form (e.g. exported from another tool or read from a `PROXY_PRIVATE_KEY` env var):
+
+```bash
+# Round-trip: reveal dave's expanded secret, then import it under a new name
+SECRET=$(dot account inspect dave --show-secret --json | jq -r .privateKey)
+dot account add raw-dave --secret "$SECRET"
+# raw-dave now has the same address as dave and can sign
+
+# Or from an environment variable (secret stays off disk)
+dot account add server-signer --env PROXY_PRIVATE_KEY
+```
+
+A raw private key cannot be HD-derived, so `--path` is rejected for this format. Imported expanded-secret accounts sign exactly like mnemonic-backed ones.
 
 #### Export/import accounts
 
@@ -659,6 +720,40 @@ dot polkadot-asset-hub.query.Assets.Metadata 1984
 # }
 ```
 
+#### Historical reads — `--at <block>`
+
+Storage queries default to the latest finalized head. Pass `--at` to read
+state at a specific block hash, the chain head (`best`), or `finalized`
+(explicit). Accepted on both `query.*` and `apis.*` runtime calls.
+
+```bash
+# Read at the current best (non-finalized) head — useful for low-latency reads
+dot polkadot.query.System.Number --at best
+
+# Read at the last finalized block — same as the default, but explicit
+dot polkadot.query.System.Number --at finalized
+
+# Pin a finalized hash and read multiple items at that exact block
+HASH=$(dot polkadot.rpc.chain_getFinalizedHead | tr -d '"')
+dot polkadot.query.System.Number --at "$HASH"
+dot polkadot.apis.Core.version --at "$HASH" --json | jq .spec_version
+```
+
+`--at` accepts a 32-byte `0x…` block hash, `"best"`, or `"finalized"`.
+Anything else errors before any network call. Tx submission rejects `"best"`.
+
+> **Archive-only blocks**: papi v2 talks to the `chainHead_v1_*` JSON-RPC API,
+> which only serves *pinned* (recent) blocks. Querying a hash older than a
+> few minutes against a non-archive node fails with a clean error that
+> includes a copy-pasteable `--rpc wss://<archive-endpoint>` hint:
+>
+> ```
+> ⚠ 0x… is not available on the current RPC endpoint.
+>    Public nodes serve only recent (pinned) blocks via chainHead_v1_*.
+>    For deep historical reads, point --rpc at an archive endpoint, e.g.:
+>      dot ... --at 0x… --rpc wss://<archive-endpoint>
+> ```
+
 ### Look up constants
 
 ```bash
@@ -1340,7 +1435,7 @@ Override low-level transaction parameters. Useful for rapid-fire submission (cus
 | `--nonce <n>` | non-negative integer | Override the auto-detected nonce |
 | `--tip <amount>` | non-negative integer (planck) | Priority tip for the transaction pool |
 | `--mortality <spec>` | `immortal` or period (min 4) | Transaction mortality window |
-| `--at <block>` | 0x-prefixed block hash | Block hash to validate against (defaults to finalized) |
+| `--at <block>` | 0x-prefixed block hash, `"best"`, or `"finalized"` | Block to read/validate against (defaults to finalized). Also honored on `query.*` and `apis.*` for historical reads; tx submission rejects `"best"`. |
 
 ```bash
 # Fire-and-forget: submit two txs in rapid succession with manual nonces
@@ -1626,7 +1721,7 @@ All existing flags work with file input — `--chain` overrides the file's `chai
 
 ### Compute hashes
 
-Compute cryptographic hashes commonly used in Substrate. Supports BLAKE2b-256, BLAKE2b-128, Keccak-256, and SHA-256.
+Compute cryptographic hashes commonly used in Substrate. Supports BLAKE2b-256, BLAKE2b-128, Keccak-256, SHA-256, and the XXH64-based `twox64` / `twox128` / `twox256` family used to build Substrate storage keys.
 
 ```bash
 # Hash hex-encoded data
@@ -1655,6 +1750,16 @@ dot hash blake2b256 0xdeadbeef --json
 #   "input": "0xdeadbeef",
 #   "hash": "0xf3e925002fed7cc0ded46842569eb5c90c910c091d8d04a1bdf96e0db719fd91"
 # }
+
+# Substrate twox128 — pallet/storage prefix used everywhere in Substrate state
+dot hash twox128 System
+# Output:
+# 0x26aa394eea5630e07c48ae0c9558cef7
+
+# Build a full storage key for `System.Number` and read it raw via JSON-RPC
+PALLET=$(dot hash twox128 System)
+ITEM=$(dot hash twox128 Number)
+dot polkadot.rpc.state_getStorage "${PALLET}${ITEM:2}"
 ```
 
 Run `dot hash` with no arguments to see all available algorithms.
@@ -1793,7 +1898,7 @@ dot verifiable alice
 # Bandersnatch Member Key
 #
 #   Account:    alice
-#   Member Key: 0x66813b70ba616b374c90ac92edff6e3be95e12adbc93ea7a6c37cbf334ab87e2
+#   Member Key: 0xbb6ee099b568f1844d62fc00e6305c2e83aa8da30ce59e664ef39e089204d43c
 
 # Derive keyed member key (full person — "candidate" context)
 dot verifiable alice --context candidate
@@ -1802,7 +1907,7 @@ dot verifiable alice --context candidate
 #
 #   Account:    alice
 #   Context:    candidate
-#   Member Key: 0x2fd5b74033d904cf5575b932507939c5d43811e488223229eaf5596565f15ae6
+#   Member Key: 0x5f915576987547d3e55bb4129ac8cae1d338f8933073dc74272b4c825f738592
 
 # Arbitrary context string
 dot verifiable alice --context pps

package/dist/cli.mjs

@@ -22,6 +22,12 @@ function isLikelyStaleMetadataError(err) {
     return false;
   return STALE_METADATA_PATTERNS.some((re) => re.test(msg));
 }
+function isBlockUnavailableError(err) {
+  const msg = err instanceof Error ? err.message : typeof err === "string" ? err : "";
+  if (!msg)
+    return false;
+  return BLOCK_UNAVAILABLE_PATTERNS.some((re) => re.test(msg));
+}
 function formatRuntimeError(err) {
   const msg = err instanceof Error ? err.message : String(err);
   if (/wasm trap|wasm `?unreachable`? instruction|Execution aborted due to trap/i.test(msg)) {
@@ -40,7 +46,7 @@ function formatRuntimeError(err) {
   }
   return msg;
 }
-var CliError, ConnectionError, MetadataError, STALE_METADATA_PATTERNS;
+var CliError, ConnectionError, MetadataError, STALE_METADATA_PATTERNS, BLOCK_UNAVAILABLE_PATTERNS;
 var init_errors = __esm(() => {
   CliError = class CliError extends Error {
     constructor(message) {
@@ -69,6 +75,11 @@ var init_errors = __esm(() => {
     /Lookup failed/i,
     /metadata.*mismatch/i
   ];
+  BLOCK_UNAVAILABLE_PATTERNS = [
+    /is not pinned/i,
+    /Invalid BlockHash/i,
+    /UnknownBlock.*Header was not found/i
+  ];
 });
 
 // src/utils/runtime-fingerprint.ts
@@ -450,6 +461,7 @@ function suggestMessage(kind, input, candidates) {
 }
 
 // src/core/accounts.ts
+import { hexToBytes as nobleHexToBytes } from "@noble/hashes/utils.js";
 import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
 import {
   DEV_PHRASE,
@@ -460,7 +472,7 @@ import {
   ss58Decode,
   validateMnemonic
 } from "@polkadot-labs/hdkd-helpers";
-import { HDKD, secretFromSeed } from "@scure/sr25519";
+import { getPublicKey, HDKD, secretFromSeed, sign } from "@scure/sr25519";
 import { getPolkadotSigner } from "polkadot-api/signer";
 function isDevAccount(name) {
   return DEV_NAMES.includes(name.toLowerCase());
@@ -475,18 +487,54 @@ function deriveFromMnemonic(mnemonic, path) {
   return derive(path);
 }
 function deriveFromHexSeed(hexSeed, path) {
-  const clean = hexSeed.startsWith("0x") ? hexSeed.slice(2) : hexSeed;
-  const seed = new Uint8Array(clean.length / 2);
-  for (let i = 0;i < clean.length; i += 2) {
-    seed[i / 2] = parseInt(clean.substring(i, i + 2), 16);
-  }
-  const derive = sr25519CreateDerive(seed);
+  const derive = sr25519CreateDerive(hexToBytes(hexSeed));
   return derive(path);
 }
 function getDevKeypair(name) {
   const path = devDerivationPath(name);
   return deriveFromMnemonic(DEV_PHRASE, path);
 }
+function hexToBytes(hex) {
+  return nobleHexToBytes(hex.startsWith("0x") ? hex.slice(2) : hex);
+}
+function isExpandedSecret(secret) {
+  return EXPANDED_SECRET_RE.test(secret);
+}
+function isHexSeed(secret) {
+  return HEX_SEED_RE.test(secret);
+}
+function secretKind(secret) {
+  if (isExpandedSecret(secret))
+    return "expanded";
+  if (isHexSeed(secret))
+    return "seed";
+  return "mnemonic";
+}
+function assertNoPathForExpandedSecret(derivationPath) {
+  if (derivationPath) {
+    throw new Error("Stored account has a 64-byte expanded secret with a derivation path, which cannot be applied. An expanded secret cannot be HD-derived; remove the derivationPath from accounts.json.");
+  }
+}
+function keypairFromExpandedSecret(secret) {
+  return {
+    publicKey: getPublicKey(secret),
+    sign: (msg) => sign(secret, msg)
+  };
+}
+function keypairFromSecret(secret, derivationPath = "") {
+  if (isExpandedSecret(secret)) {
+    assertNoPathForExpandedSecret(derivationPath);
+    return keypairFromExpandedSecret(hexToBytes(secret));
+  }
+  return isHexSeed(secret) ? deriveFromHexSeed(secret, derivationPath) : deriveFromMnemonic(secret, derivationPath);
+}
+function expandedSecretFromStored(secret, derivationPath = "") {
+  if (isExpandedSecret(secret)) {
+    assertNoPathForExpandedSecret(derivationPath);
+    return hexToBytes(secret);
+  }
+  return deriveExpandedSecret(miniSecretFromSecret(secret), derivationPath);
+}
 function parseDerivations(path) {
   const out = [];
   for (const [, type, code] of path.matchAll(DERIVATION_RE)) {
@@ -517,17 +565,11 @@ function deriveExpandedSecret(miniSecret, path) {
   return parseDerivations(path).reduce((sk, [type, code]) => type === "hard" ? HDKD.secretHard(sk, createChainCode(code)) : HDKD.secretSoft(sk, createChainCode(code)), secretFromSeed(miniSecret));
 }
 function miniSecretFromSecret(secret) {
-  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(secret);
-  if (isHexSeed) {
-    const clean = secret.slice(2);
-    const bytes = new Uint8Array(32);
-    for (let i = 0;i < clean.length; i += 2) {
-      bytes[i / 2] = parseInt(clean.substring(i, i + 2), 16);
-    }
-    return bytes;
+  if (isHexSeed(secret)) {
+    return hexToBytes(secret);
   }
   if (!validateMnemonic(secret)) {
-    throw new Error("Invalid secret. Expected a 0x-prefixed 32-byte hex seed or a valid BIP39 mnemonic.");
+    throw new Error("Invalid secret. Expected a BIP39 mnemonic or a 0x-prefixed 32-byte hex seed.");
   }
   return entropyToMiniSecret(mnemonicToEntropy(secret));
 }
@@ -544,13 +586,19 @@ function createNewAccount(path = "") {
   return { mnemonic, publicKey: keypair.publicKey };
 }
 function importAccount(secret, path = "") {
-  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(secret);
-  if (isHexSeed) {
+  if (isExpandedSecret(secret)) {
+    if (path) {
+      throw new Error("Derivation paths are not supported for raw private key (64-byte expanded secret) import. An expanded secret cannot be HD-derived; omit --path.");
+    }
+    const keypair2 = keypairFromExpandedSecret(hexToBytes(secret));
+    return { publicKey: keypair2.publicKey };
+  }
+  if (isHexSeed(secret)) {
     const keypair2 = deriveFromHexSeed(secret, path);
     return { publicKey: keypair2.publicKey };
   }
   if (!validateMnemonic(secret)) {
-    throw new Error("Invalid secret. Expected a 0x-prefixed 32-byte hex seed or a valid BIP39 mnemonic.");
+    throw new Error("Invalid secret. Expected a BIP39 mnemonic, a 0x-prefixed 32-byte hex seed, or a 0x-prefixed 64-byte sr25519 expanded secret.");
   }
   const keypair = deriveFromMnemonic(secret, path);
   return { publicKey: keypair.publicKey };
@@ -616,9 +664,7 @@ async function resolveAccountKeypair(name) {
   if (account.secret === undefined) {
     throw new Error(`Account "${name}" is watch-only (no secret). Cannot sign. Import with --secret or --env.`);
   }
-  const secret = resolveSecret(account.secret);
-  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(secret);
-  return isHexSeed ? deriveFromHexSeed(secret, account.derivationPath) : deriveFromMnemonic(secret, account.derivationPath);
+  return keypairFromSecret(resolveSecret(account.secret), account.derivationPath);
 }
 async function resolveAccountSigner(name) {
   const keypair = await resolveAccountKeypair(name);
@@ -626,8 +672,8 @@ async function resolveAccountSigner(name) {
 }
 async function resolveAccountExpandedSecret(name) {
   if (isDevAccount(name)) {
-    const miniSecret2 = entropyToMiniSecret(mnemonicToEntropy(DEV_PHRASE));
-    return deriveExpandedSecret(miniSecret2, devDerivationPath(name));
+    const miniSecret = entropyToMiniSecret(mnemonicToEntropy(DEV_PHRASE));
+    return deriveExpandedSecret(miniSecret, devDerivationPath(name));
   }
   const accountsFile = await loadAccounts();
   const account = findAccount(accountsFile, name);
@@ -644,16 +690,17 @@ async function resolveAccountExpandedSecret(name) {
   if (account.secret === undefined) {
     throw new Error(`Account "${name}" is watch-only (no secret). Cannot derive private key. Import with --secret or --env.`);
   }
-  const miniSecret = miniSecretFromSecret(resolveSecret(account.secret));
-  return deriveExpandedSecret(miniSecret, account.derivationPath);
+  return expandedSecretFromStored(resolveSecret(account.secret), account.derivationPath);
 }
 function bytesToHex(bytes) {
   return "0x" + Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
-var DEV_NAMES, DERIVATION_RE;
+var DEV_NAMES, EXPANDED_SECRET_RE, HEX_SEED_RE, DERIVATION_RE;
 var init_accounts = __esm(() => {
   init_accounts_store();
   DEV_NAMES = ["alice", "bob", "charlie", "dave", "eve", "ferdie"];
+  EXPANDED_SECRET_RE = /^0x[0-9a-fA-F]{128}$/;
+  HEX_SEED_RE = /^0x[0-9a-fA-F]{64}$/;
   DERIVATION_RE = /(\/{1,2})([^/]+)/g;
 });
 
@@ -1253,7 +1300,7 @@ async function fetchMetadataFromChain(clientHandle, chainName) {
   let bytes;
   try {
     const hex = await withTimeout(client._request("state_call", ["Metadata_metadata_at_version", v15Arg]), chainName);
-    const raw = hexToBytes(hex);
+    const raw = hexToBytes3(hex);
     const decoded = optionalOpaqueBytes.dec(raw);
     if (decoded !== undefined) {
       bytes = new Uint8Array(decoded);
@@ -1262,7 +1309,7 @@ async function fetchMetadataFromChain(clientHandle, chainName) {
   if (!bytes) {
     try {
       const hex = await withTimeout(client._request("state_getMetadata", []), chainName);
-      bytes = hexToBytes(hex);
+      bytes = hexToBytes3(hex);
     } catch (err) {
       if (err instanceof ConnectionError)
         throw err;
@@ -1311,6 +1358,24 @@ async function withStalenessSuggestion(chainName, clientHandle, task) {
 ` + `   Run: dot chain update ${chainName}`);
   }
 }
+async function withBlockAvailabilityHint(atRaw, task) {
+  try {
+    return await task();
+  } catch (err) {
+    if (!isBlockUnavailableError(err))
+      throw err;
+    const original = err instanceof Error ? err.message : String(err);
+    const isExplicitHash = atRaw && atRaw !== "best" && atRaw !== "finalized";
+    const target = isExplicitHash ? atRaw : "the requested block";
+    const exampleAt = isExplicitHash ? atRaw : "<hash>";
+    throw new CliError(`${original}
+
+` + `⚠ ${target} is not available on the current RPC endpoint.
+` + `   Public nodes serve only recent (pinned) blocks via chainHead_v1_*.
+` + `   For deep historical reads, point --rpc at an archive endpoint, e.g.:
+` + `     dot ... --at ${exampleAt} --rpc wss://<archive-endpoint>`);
+  }
+}
 async function getOrFetchMetadata(chainName, clientHandle) {
   let raw = await loadMetadata(chainName);
   if (!raw) {
@@ -1440,7 +1505,7 @@ function describeCallArgs(meta, palletName, callName) {
 function describeEventFields(meta, palletName, eventName) {
   return compactArgsString(getEventFields(meta, palletName, eventName));
 }
-function hexToBytes(hex) {
+function hexToBytes3(hex) {
   const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
   const bytes = new Uint8Array(clean.length / 2);
   for (let i = 0;i < clean.length; i += 2) {
@@ -1535,6 +1600,15 @@ import { compact as scaleCompact } from "@polkadot-api/substrate-bindings";
 import { getViewBuilder } from "@polkadot-api/view-builder";
 import { Binary as Binary2 } from "polkadot-api";
 import { stringify as stringifyYaml } from "yaml";
+function parseAtForRead(raw) {
+  if (raw === undefined)
+    return;
+  if (raw === "best" || raw === "finalized")
+    return raw;
+  if (/^0x[0-9a-fA-F]{64}$/.test(raw))
+    return raw;
+  throw new CliError(`Invalid --at value "${raw}". Use "best", "finalized", or a 0x-prefixed 32-byte block hash.`);
+}
 async function parseStructArgs(meta, fields, args, callLabel) {
   const fieldNames = Object.keys(fields);
   if (args.length !== fieldNames.length) {
@@ -1943,8 +2017,10 @@ async function handleApis(target, args, opts) {
       typeof opts.parsedArgs === "object" ? JSON.stringify(opts.parsedArgs) : String(opts.parsedArgs)
     ];
     const parsedArgs = await parseRuntimeApiArgs(meta, method, effectiveArgs);
+    const atArg = parseAtForRead(opts.at);
+    const pullOpts = atArg !== undefined ? [{ at: atArg }] : [];
     const unsafeApi = clientHandle.client.getUnsafeApi();
-    const result = await unsafeApi.apis[api.name][method.name](...parsedArgs);
+    const result = await withBlockAvailabilityHint(opts.at, () => unsafeApi.apis[api.name][method.name](...parsedArgs, ...pullOpts));
     const format = isJsonOutput(opts) ? "json" : opts.output ?? "pretty";
     printResult(result, format);
   } finally {
@@ -3067,11 +3143,98 @@ var init_rpc_registry = __esm(() => {
   };
 });
 
+// src/core/xxh64.ts
+function rotl(v, r) {
+  return (v << r | v >> 64n - r) & MASK;
+}
+function round(acc, val) {
+  acc = acc + val * P2 & MASK;
+  acc = rotl(acc, 31n);
+  return acc * P1 & MASK;
+}
+function mergeRound(h, val) {
+  const k = round(0n, val);
+  return (h ^ k) * P1 + P4 & MASK;
+}
+function readU64LE(data, p) {
+  return BigInt(data[p]) | BigInt(data[p + 1]) << 8n | BigInt(data[p + 2]) << 16n | BigInt(data[p + 3]) << 24n | BigInt(data[p + 4]) << 32n | BigInt(data[p + 5]) << 40n | BigInt(data[p + 6]) << 48n | BigInt(data[p + 7]) << 56n;
+}
+function readU32LE(data, p) {
+  return BigInt(data[p]) | BigInt(data[p + 1]) << 8n | BigInt(data[p + 2]) << 16n | BigInt(data[p + 3]) << 24n;
+}
+function xxh64(input, seed = 0n) {
+  const len = input.length;
+  let p = 0;
+  let h;
+  if (len >= 32) {
+    let v1 = seed + P1 + P2 & MASK;
+    let v2 = seed + P2 & MASK;
+    let v3 = seed & MASK;
+    let v4 = seed - P1 & MASK;
+    while (p <= len - 32) {
+      v1 = round(v1, readU64LE(input, p));
+      p += 8;
+      v2 = round(v2, readU64LE(input, p));
+      p += 8;
+      v3 = round(v3, readU64LE(input, p));
+      p += 8;
+      v4 = round(v4, readU64LE(input, p));
+      p += 8;
+    }
+    h = rotl(v1, 1n) + rotl(v2, 7n) + rotl(v3, 12n) + rotl(v4, 18n) & MASK;
+    h = mergeRound(h, v1);
+    h = mergeRound(h, v2);
+    h = mergeRound(h, v3);
+    h = mergeRound(h, v4);
+  } else {
+    h = seed + P5 & MASK;
+  }
+  h = h + BigInt(len) & MASK;
+  while (p + 8 <= len) {
+    const k = round(0n, readU64LE(input, p));
+    h = rotl(h ^ k, 27n) * P1 + P4 & MASK;
+    p += 8;
+  }
+  if (p + 4 <= len) {
+    const k = readU32LE(input, p) * P1 & MASK;
+    h = rotl(h ^ k, 23n) * P2 + P3 & MASK;
+    p += 4;
+  }
+  while (p < len) {
+    const k = BigInt(input[p]) * P5 & MASK;
+    h = rotl(h ^ k, 11n) * P1 & MASK;
+    p++;
+  }
+  h ^= h >> 33n;
+  h = h * P2 & MASK;
+  h ^= h >> 29n;
+  h = h * P3 & MASK;
+  h ^= h >> 32n;
+  return h;
+}
+function u64ToLEBytes(v, out, offset) {
+  for (let i = 0;i < 8; i++) {
+    out[offset + i] = Number(v >> BigInt(i * 8) & 0xffn);
+  }
+}
+function twox(input, bits) {
+  const lanes = bits / 64;
+  const out = new Uint8Array(bits / 8);
+  for (let i = 0;i < lanes; i++) {
+    u64ToLEBytes(xxh64(input, BigInt(i)), out, i * 8);
+  }
+  return out;
+}
+var MASK, P1 = 11400714785074694791n, P2 = 14029467366897019727n, P3 = 1609587929392839161n, P4 = 9650029242287828579n, P5 = 2870177450012600261n;
+var init_xxh64 = __esm(() => {
+  MASK = (1n << 64n) - 1n;
+});
+
 // src/core/hash.ts
 import { blake2b as blake2b2 } from "@noble/hashes/blake2.js";
 import { sha256 } from "@noble/hashes/sha2.js";
-import { keccak_256 } from "@noble/hashes/sha3.js";
-import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2 } from "@noble/hashes/utils.js";
+import { keccak_256 as keccak_2562 } from "@noble/hashes/sha3.js";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes4 } from "@noble/hashes/utils.js";
 function computeHash(algorithm, data) {
   const algo = ALGORITHMS[algorithm];
   if (!algo) {
@@ -3085,12 +3248,12 @@ function parseInputData(input) {
     if (hex.length % 2 !== 0) {
       throw new Error(`Invalid hex input: odd number of characters`);
     }
-    return hexToBytes2(hex);
+    return hexToBytes4(hex);
   }
   return new TextEncoder().encode(input);
 }
 function toHex2(bytes) {
-  return `0x${bytesToHex2(bytes)}`;
+  return `0x${bytesToHex3(bytes)}`;
 }
 function isValidAlgorithm(name) {
   return name in ALGORITHMS;
@@ -3100,6 +3263,7 @@ function getAlgorithmNames() {
 }
 var ALGORITHMS;
 var init_hash = __esm(() => {
+  init_xxh64();
   ALGORITHMS = {
     blake2b256: {
       compute: (data) => blake2b2(data, { dkLen: 32 }),
@@ -3112,7 +3276,7 @@ var init_hash = __esm(() => {
       description: "BLAKE2b with 128-bit output"
     },
     keccak256: {
-      compute: (data) => keccak_256(data),
+      compute: (data) => keccak_2562(data),
       outputLen: 32,
       description: "Keccak-256 (Ethereum-compatible)"
     },
@@ -3120,6 +3284,21 @@ var init_hash = __esm(() => {
       compute: (data) => sha256(data),
       outputLen: 32,
       description: "SHA-256"
+    },
+    twox64: {
+      compute: (data) => twox(data, 64),
+      outputLen: 8,
+      description: "XXH64 with seed 0 (Substrate twox64)"
+    },
+    twox128: {
+      compute: (data) => twox(data, 128),
+      outputLen: 16,
+      description: "XXH64 with seeds 0,1 (Substrate twox128, pallet/storage prefix)"
+    },
+    twox256: {
+      compute: (data) => twox(data, 256),
+      outputLen: 32,
+      description: "XXH64 with seeds 0,1,2,3 (Substrate twox256)"
     }
   };
 });
@@ -3517,13 +3696,73 @@ var init_complete = __esm(() => {
 // src/cli.ts
 import cac from "cac";
 // package.json
-var version = "1.18.0";
+var version = "1.20.0";
 
 // src/commands/account.ts
 init_accounts_store();
 init_accounts();
-init_output();
 import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { hexToBytes as nobleHexToBytes2 } from "@noble/hashes/utils.js";
+
+// src/core/h160.ts
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2 } from "@noble/hashes/utils.js";
+var ETH_DERIVED_SUFFIX_BYTE = 238;
+var H160_LEN = 20;
+var ACCOUNT_ID_LEN = 32;
+function hasEthDerivedSuffix(accountId) {
+  if (accountId.length !== ACCOUNT_ID_LEN)
+    return false;
+  for (let i = H160_LEN;i < ACCOUNT_ID_LEN; i++) {
+    if (accountId[i] !== ETH_DERIVED_SUFFIX_BYTE)
+      return false;
+  }
+  return true;
+}
+function accountIdToH160(accountId) {
+  if (accountId.length !== ACCOUNT_ID_LEN) {
+    throw new Error(`accountIdToH160 expects 32 bytes, got ${accountId.length}`);
+  }
+  if (hasEthDerivedSuffix(accountId)) {
+    return accountId.slice(0, H160_LEN);
+  }
+  return keccak_256(accountId).slice(ACCOUNT_ID_LEN - H160_LEN);
+}
+function h160ToFallbackAccountId(h160) {
+  if (h160.length !== H160_LEN) {
+    throw new Error(`h160ToFallbackAccountId expects 20 bytes, got ${h160.length}`);
+  }
+  const out = new Uint8Array(ACCOUNT_ID_LEN);
+  out.set(h160, 0);
+  out.fill(ETH_DERIVED_SUFFIX_BYTE, H160_LEN);
+  return out;
+}
+function toEip55(h160) {
+  if (h160.length !== H160_LEN) {
+    throw new Error(`toEip55 expects 20 bytes, got ${h160.length}`);
+  }
+  const lowerHex = bytesToHex2(h160);
+  const hashBytes = keccak_256(new TextEncoder().encode(lowerHex));
+  let out = "0x";
+  for (let i = 0;i < lowerHex.length; i++) {
+    const c = lowerHex[i];
+    const nibble = i % 2 === 0 ? hashBytes[i >> 1] >> 4 : hashBytes[i >> 1] & 15;
+    out += nibble >= 8 ? c.toUpperCase() : c;
+  }
+  return out;
+}
+function isH160Hex(input) {
+  return /^0x[0-9a-fA-F]{40}$/.test(input);
+}
+function h160FromHex(input) {
+  if (!isH160Hex(input)) {
+    throw new Error(`Not a valid 0x-prefixed 20-byte hex string: ${input}`);
+  }
+  return hexToBytes2(input.slice(2));
+}
+
+// src/commands/account.ts
+init_output();
 
 // src/core/pallet.ts
 init_errors();
@@ -3594,7 +3833,8 @@ function isValidParaId(value) {
 var ACCOUNT_HELP = `
 ${BOLD}Usage:${RESET}
   $ dot account add <name> <ss58|hex>                                Add a watch-only address (no secret)
-  $ dot account add <name> --secret <s> [--path <derivation>]        Import from BIP39 mnemonic
+  $ dot account add <name> --secret <s> [--path <derivation>]        Import from BIP39 mnemonic or 32-byte hex seed
+  $ dot account add <name> --secret 0x<128 hex>                      Import a raw 64-byte sr25519 private key (no --path)
   $ dot account add <name> --env <VAR> [--path <derivation>]         Import account backed by env variable
   $ dot account add <name> --parachain <id> --parachain-type <t>     Derive a parachain sovereign (t = child|sibling)
   $ dot account add <name> --pallet-id <8 chars or 0x hex>           Derive a pallet sovereign (e.g. py/trsry)
@@ -3611,6 +3851,7 @@ ${BOLD}Usage:${RESET}
 ${BOLD}Examples:${RESET}
   $ dot account add treasury 5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY
   $ dot account add treasury --secret "word1 word2 ... word12"
+  $ dot account add raw-key --secret 0x<128-hex-char sr25519 expanded secret>
   $ dot account add ci-signer --env MY_SECRET --path //ci
   $ dot account add Treasury --pallet-id py/trsry
   $ dot account add Bounties --pallet-id 0x70792f626f756e74
@@ -3638,16 +3879,21 @@ ${BOLD}Examples:${RESET}
 
 ${YELLOW}Note: Secrets are stored unencrypted in ~/.polkadot/accounts.json.
       Use --env to keep secrets off disk entirely.
-      Hex seed import (0x...) is not supported via CLI.${RESET}
+      --secret accepts a BIP39 mnemonic, a 0x 32-byte hex seed, or a
+      0x 64-byte raw sr25519 private key (the value --show-secret prints).
+      Raw private keys cannot be HD-derived, so --path is rejected for them.${RESET}
 `.trimStart();
 function registerAccountCommands(cli) {
-  cli.command("account [action] [...names]", "Manage local accounts (create, import, list, remove, export)").alias("accounts").option("--secret <value>", "Secret key (mnemonic or hex seed) for import").option("--env <varName>", "Environment variable name holding the secret").option("--path <derivation>", "Derivation path (e.g. //staking, //polkadot//0/wallet)").option("--parachain <id>", "Derive a parachain sovereign account (requires --parachain-type)").option("--parachain-type <type>", "Parachain sovereign type: child or sibling").option("--pallet-id <id>", "Derive a pallet sovereign account from an 8-byte PalletId").option("--prefix <number>", "SS58 prefix for address encoding (default: 42)").option("--file <path>", "Input/output file for batch import/export").option("--overwrite", "Overwrite existing accounts on batch import").option("--dry-run", "Preview batch import without applying changes").option("--include-secrets", "Include secrets in export (redacted by default)").option("--watch-only", "Export only watch-only accounts").option("--show-secret", "Reveal the 64-byte sr25519 expanded private key (inspect only)").action(async (action, names, opts) => {
+  cli.command("account [action] [...names]", "Manage local accounts (create, import, list, remove, export)").alias("accounts").option("--secret <value>", "Secret for import: BIP39 mnemonic, 0x 32-byte hex seed, or 0x 64-byte raw private key").option("--env <varName>", "Environment variable name holding the secret").option("--path <derivation>", "Derivation path (e.g. //staking, //polkadot//0/wallet)").option("--parachain <id>", "Derive a parachain sovereign account (requires --parachain-type)").option("--parachain-type <type>", "Parachain sovereign type: child or sibling").option("--pallet-id <id>", "Derive a pallet sovereign account from an 8-byte PalletId").option("--prefix <number>", "SS58 prefix for address encoding (default: 42)").option("--file <path>", "Input/output file for batch import/export").option("--overwrite", "Overwrite existing accounts on batch import").option("--dry-run", "Preview batch import without applying changes").option("--include-secrets", "Include secrets in export (redacted by default)").option("--watch-only", "Export only watch-only accounts").option("--show-secret", "Reveal the 64-byte sr25519 expanded private key (inspect only)").action(async (action, names, opts) => {
     if (!action) {
       if (process.argv[2] === "accounts")
         return accountList(opts);
       console.log(ACCOUNT_HELP);
       return;
     }
+    const rawSecret = rawArgValue("--secret");
+    if (rawSecret != null)
+      opts.secret = rawSecret;
     switch (action) {
       case "new":
       case "create":
@@ -4226,6 +4472,7 @@ async function accountInspect(input, opts) {
   let hasSecret = false;
   let storedAccount;
   let isDev = false;
+  let isH160Fallback = false;
   let virtualSource;
   if (sovereignSource) {
     if (sovereignSource.kind === "pallet") {
@@ -4273,18 +4520,24 @@ async function accountInspect(input, opts) {
       }
     } else if (isHexPublicKey(input)) {
       publicKeyHex = input;
+    } else if (isH160Hex(input)) {
+      const fallback = h160ToFallbackAccountId(h160FromHex(input));
+      publicKeyHex = publicKeyToHex(fallback);
+      isH160Fallback = true;
     } else {
       try {
         const decoded = fromSs58(input);
         publicKeyHex = publicKeyToHex(decoded);
       } catch {
-        console.error(`Cannot identify "${input}" as an account name, SS58 address, or hex public key.`);
+        console.error(`Cannot identify "${input}" as an account name, SS58 address, hex public key, or H160.`);
         process.exit(1);
       }
     }
   }
   const ss58 = toSs58(publicKeyHex, prefix);
+  const h160Hex = toEip55(accountIdToH160(nobleHexToBytes2(publicKeyHex.slice(2))));
   let privateKeyHex;
+  let revealedSecret;
   if (opts.showSecret) {
     if (!name) {
       console.error("--show-secret requires an account name; raw addresses and hex keys have no secret to reveal.");
@@ -4300,6 +4553,14 @@ async function accountInspect(input, opts) {
       console.error(err.message);
       process.exit(1);
     }
+    if (storedAccount?.secret !== undefined && !isEnvSecret(storedAccount.secret)) {
+      const kind = secretKind(storedAccount.secret);
+      if (kind === "mnemonic") {
+        revealedSecret = { label: "Mnemonic", field: "mnemonic", value: storedAccount.secret };
+      } else if (kind === "seed") {
+        revealedSecret = { label: "Seed", field: "seed", value: storedAccount.secret };
+      }
+    }
   }
   let kindLabel;
   let sourceLine;
@@ -4314,6 +4575,8 @@ async function accountInspect(input, opts) {
     sourceLine = `parachain ${virtualSource.paraId}`;
   } else if (isDev) {
     kindLabel = "dev";
+  } else if (isH160Fallback) {
+    kindLabel = "revive H160 fallback";
   } else if (storedAccount) {
     const k = classifyAccount(storedAccount);
     if (k === "pallet" && storedAccount.source?.kind === "pallet") {
@@ -4335,7 +4598,12 @@ async function accountInspect(input, opts) {
     }
   }
   if (isJsonOutput(opts)) {
-    const result = { publicKey: publicKeyHex, ss58, prefix };
+    const result = {
+      publicKey: publicKeyHex,
+      ss58,
+      h160: h160Hex,
+      prefix
+    };
     if (name)
       result.name = name;
     if (kindLabel)
@@ -4371,6 +4639,8 @@ async function accountInspect(input, opts) {
       result.env = envLine.replace(/^\$/, "");
     if (bandersnatch && Object.keys(bandersnatch).length > 0)
       result.bandersnatch = bandersnatch;
+    if (revealedSecret)
+      result[revealedSecret.field] = revealedSecret.value;
     if (privateKeyHex)
       result.privateKey = privateKeyHex;
     console.log(formatJson(result));
@@ -4382,6 +4652,7 @@ async function accountInspect(input, opts) {
       console.log(`  ${BOLD}Kind:${RESET}        ${kindLabel}`);
     console.log(`  ${BOLD}Public Key:${RESET}  ${publicKeyHex}`);
     console.log(`  ${BOLD}SS58:${RESET}        ${ss58}`);
+    console.log(`  ${BOLD}H160:${RESET}        ${h160Hex}`);
     if (sourceLine)
       console.log(`  ${BOLD}Source:${RESET}      ${sourceLine}`);
     if (derivationLine)
@@ -4401,6 +4672,12 @@ async function accountInspect(input, opts) {
       }
     }
     console.log(`  ${BOLD}Prefix:${RESET}      ${prefix}`);
+    if (revealedSecret) {
+      console.log(`  ${BOLD}${`${revealedSecret.label}:`.padEnd(13)}${RESET}${revealedSecret.value}`);
+      if (derivationLine) {
+        console.log(`               ${YELLOW}(derived with ${derivationLine} — re-import needs --path ${derivationLine})${RESET}`);
+      }
+    }
     if (privateKeyHex) {
       console.log(`  ${BOLD}Private Key:${RESET} ${privateKeyHex}`);
       console.log(`               ${YELLOW}(sr25519 expanded, 64 bytes — never share)${RESET}`);
@@ -4655,8 +4932,10 @@ async function handleApis2(target, args, opts) {
       typeof opts.parsedArgs === "object" ? JSON.stringify(opts.parsedArgs) : String(opts.parsedArgs)
     ];
     const parsedArgs = await parseRuntimeApiArgs2(meta, method, effectiveArgs);
+    const atArg = parseAtForRead(opts.at);
+    const pullOpts = atArg !== undefined ? [{ at: atArg }] : [];
     const unsafeApi = clientHandle.client.getUnsafeApi();
-    const result = await unsafeApi.apis[api.name][method.name](...parsedArgs);
+    const result = await withBlockAvailabilityHint(opts.at, () => unsafeApi.apis[api.name][method.name](...parsedArgs, ...pullOpts));
     const format = isJsonOutput(opts) ? "json" : opts.output ?? "pretty";
     printResult(result, format);
   } finally {
@@ -6826,6 +7105,8 @@ async function handleQuery(target, keys, opts) {
       typeof opts.parsedArgs === "object" ? JSON.stringify(opts.parsedArgs) : String(opts.parsedArgs)
     ];
     const parsedKeys = await parseStorageKeys(meta, palletInfo.name, storageItem, effectiveKeys);
+    const atArg = parseAtForRead(opts.at);
+    const pullOpts = atArg !== undefined ? [{ at: atArg }] : [];
     const format = isJsonOutput(opts) ? "json" : opts.output ?? "pretty";
     const expectedLen = storageItem.type === "map" && storageItem.keyTypeId != null ? meta.builder.buildStorage(palletInfo.name, storageItem.name).len : 0;
     if (storageItem.type === "map" && parsedKeys.length < expectedLen) {
@@ -6835,7 +7116,7 @@ async function handleQuery(target, keys, opts) {
         console.log(`${DIM}Hint: use --dump to fetch all entries${RESET}`);
         return;
       }
-      const entries = await withStalenessSuggestion(chainName, clientHandle, () => storageApi.getEntries(...parsedKeys));
+      const entries = await withStalenessSuggestion(chainName, clientHandle, () => withBlockAvailabilityHint(opts.at, () => storageApi.getEntries(...parsedKeys, ...pullOpts)));
       const rows = entries.map((e) => ({
         keys: e.keyArgs,
         value: e.value
@@ -6844,7 +7125,7 @@ async function handleQuery(target, keys, opts) {
       await writeStdout(`${text}
 `);
     } else {
-      const result = await withStalenessSuggestion(chainName, clientHandle, () => storageApi.getValue(...parsedKeys));
+      const result = await withStalenessSuggestion(chainName, clientHandle, () => withBlockAvailabilityHint(opts.at, () => storageApi.getValue(...parsedKeys, ...pullOpts)));
       const text = format === "json" ? formatJson(result) : formatPretty(result);
       await writeStdout(`${text}
 `);
@@ -7468,7 +7749,7 @@ async function handleTx(target, args, opts) {
       let estimatedFees;
       let estimationError;
       try {
-        estimatedFees = String(await withStalenessSuggestion(chainName, clientHandle, () => tx.getEstimatedFees(signer?.publicKey, txOptions)));
+        estimatedFees = String(await withStalenessSuggestion(chainName, clientHandle, () => withBlockAvailabilityHint(opts.at, () => tx.getEstimatedFees(signer?.publicKey, txOptions))));
       } catch (err) {
         estimationError = err instanceof Error ? err.message : String(err);
       }
@@ -7538,7 +7819,7 @@ async function handleTx(target, args, opts) {
       }
       const observable = clientHandle.client.submitAndWatch(generalTx, at);
       if (isJsonOutput(opts)) {
-        const result3 = await withStalenessSuggestion(chainName, clientHandle, () => watchTransactionJson(observable, waitLevel, { unsigned: true }));
+        const result3 = await withStalenessSuggestion(chainName, clientHandle, () => withBlockAvailabilityHint(opts.at, () => watchTransactionJson(observable, waitLevel, { unsigned: true })));
         const rpcUrl3 = primaryRpc(opts.rpc ?? chainConfig.rpc);
         if (result3.type === "broadcasted") {
           printJsonLine({ event: "broadcasted", txHash: result3.txHash });
@@ -7570,7 +7851,7 @@ async function handleTx(target, args, opts) {
         }
         return;
       }
-      const result2 = await withStalenessSuggestion(chainName, clientHandle, () => watchTransaction(observable, waitLevel, { unsigned: true }));
+      const result2 = await withStalenessSuggestion(chainName, clientHandle, () => withBlockAvailabilityHint(opts.at, () => watchTransaction(observable, waitLevel, { unsigned: true })));
       console.log();
       console.log(`  ${BOLD}Chain:${RESET}  ${chainName}`);
       console.log(`  ${BOLD}Type:${RESET}   unsigned (bare)`);
@@ -7619,7 +7900,7 @@ async function handleTx(target, args, opts) {
       return;
     }
     if (isJsonOutput(opts)) {
-      const result2 = await withStalenessSuggestion(chainName, clientHandle, () => watchTransactionJson(tx.signSubmitAndWatch(signer, txOptions), waitLevel));
+      const result2 = await withStalenessSuggestion(chainName, clientHandle, () => withBlockAvailabilityHint(opts.at, () => watchTransactionJson(tx.signSubmitAndWatch(signer, txOptions), waitLevel)));
       const rpcUrl2 = primaryRpc(opts.rpc ?? chainConfig.rpc);
       if (result2.type === "broadcasted") {
         printJsonLine({ event: "broadcasted", txHash: result2.txHash });
@@ -7650,7 +7931,7 @@ async function handleTx(target, args, opts) {
       }
       return;
     }
-    const result = await withStalenessSuggestion(chainName, clientHandle, () => watchTransaction(tx.signSubmitAndWatch(signer, txOptions), waitLevel));
+    const result = await withStalenessSuggestion(chainName, clientHandle, () => withBlockAvailabilityHint(opts.at, () => watchTransaction(tx.signSubmitAndWatch(signer, txOptions), waitLevel)));
     console.log();
     console.log(`  ${BOLD}Chain:${RESET}  ${chainName}`);
     console.log(`  ${BOLD}Call:${RESET}   ${callHex}`);
@@ -9125,7 +9406,15 @@ if (process.argv[2] === "__complete") {
     process.exit(0);
   })();
 } else {
-  let collectVarFlags = function(argv) {
+  let readAtFromArgv = function(argv) {
+    for (let i = 0;i < argv.length; i++) {
+      if (argv[i] === "--at" && i + 1 < argv.length)
+        return argv[i + 1];
+      if (argv[i].startsWith("--at="))
+        return argv[i].slice(5);
+    }
+    return;
+  }, collectVarFlags = function(argv) {
     const vars = [];
     for (let i = 0;i < argv.length; i++) {
       if (argv[i] === "--var" && i + 1 < argv.length) {
@@ -9211,11 +9500,12 @@ if (process.argv[2] === "__complete") {
   registerVerifiableCommands(cli);
   cli.command("[dotpath] [...args]").option("--from <name>", "Account to sign with (for tx)").option("--dry-run", "Estimate fees without submitting (for tx)").option("--encode", "Encode call to hex without signing (for tx)").option("--to-yaml", "Decode call to YAML file format (for tx)").option("--to-json", "Decode call to JSON file format (for tx)").option("--ext <json>", "Custom signed extension values as JSON (for tx)").option("--asset <json>", "Pay fees in an alternative asset (XCM location JSON, for tx)").option("-w, --wait <level>", "Resolve at: broadcast, best-block (or best), finalized (for tx)", {
     default: "finalized"
-  }).option("--dump", "Dump all entries of a storage map (without specifying a key)").option("--var <kv>", "Template variable for file input (KEY=VALUE, repeatable)").option("--nonce <n>", "Custom nonce for manual tx sequencing (for tx)").option("--tip <amount>", "Tip to prioritize transaction (for tx)").option("--mortality <spec>", '"immortal" or period number (for tx)').option("--at <block>", 'Block hash, "best", or "finalized" to validate against (for tx)').option("--unsigned", "Submit as unsigned/bare transaction (no signer required, for tx)").option("--refresh", "Refresh the cached RPC method list from the node (for rpc)").action(async (dotpath, args, opts) => {
+  }).option("--dump", "Dump all entries of a storage map (without specifying a key)").option("--var <kv>", "Template variable for file input (KEY=VALUE, repeatable)").option("--nonce <n>", "Custom nonce for manual tx sequencing (for tx)").option("--tip <amount>", "Tip to prioritize transaction (for tx)").option("--mortality <spec>", '"immortal" or period number (for tx)').option("--at <block>", 'Block hash, "best", or "finalized" to read/validate against (tx, query, apis)').option("--unsigned", "Submit as unsigned/bare transaction (no signer required, for tx)").option("--refresh", "Refresh the cached RPC method list from the node (for rpc)").action(async (dotpath, args, opts) => {
     if (!dotpath) {
       printHelp();
       return;
     }
+    const atRaw = readAtFromArgv(process.argv);
     if (isFilePath(dotpath)) {
       const cliVars = collectVarFlags(process.argv);
       const cmd = await loadCommandFile(dotpath, cliVars);
@@ -9243,7 +9533,7 @@ if (process.argv[2] === "__complete") {
             nonce: opts.nonce,
             tip: opts.tip,
             mortality: opts.mortality,
-            at: opts.at,
+            at: atRaw,
             parsedArgs: cmd.args
           });
           break;
@@ -9251,6 +9541,7 @@ if (process.argv[2] === "__complete") {
           await handleQuery(target2, args, {
             ...handlerOpts2,
             dump: opts.dump,
+            at: atRaw,
             parsedArgs: cmd.args
           });
           break;
@@ -9260,6 +9551,7 @@ if (process.argv[2] === "__complete") {
         case "apis":
           await handleApis2(target2, args, {
             ...handlerOpts2,
+            at: atRaw,
             parsedArgs: cmd.args
           });
           break;
@@ -9298,7 +9590,7 @@ if (process.argv[2] === "__complete") {
     }
     switch (parsed.category) {
       case "query":
-        await handleQuery(target, args, { ...handlerOpts, dump: opts.dump });
+        await handleQuery(target, args, { ...handlerOpts, dump: opts.dump, at: atRaw });
         break;
       case "tx": {
         const txOpts = {
@@ -9315,7 +9607,7 @@ if (process.argv[2] === "__complete") {
           nonce: opts.nonce,
           tip: opts.tip,
           mortality: opts.mortality,
-          at: opts.at
+          at: atRaw
         };
         if (parsed.pallet && /^0x[0-9a-fA-F]+$/.test(parsed.pallet)) {
           await handleTx(parsed.pallet, args, txOpts);
@@ -9334,7 +9626,7 @@ if (process.argv[2] === "__complete") {
         await handleErrors2(target, handlerOpts);
         break;
       case "apis":
-        await handleApis2(target, args, handlerOpts);
+        await handleApis2(target, args, { ...handlerOpts, at: atRaw });
         break;
       case "extensions": {
         if (parsed.item) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polkadot-cli",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "CLI tool for querying Polkadot-ecosystem on-chain state",
   "type": "module",
   "bin": {
@@ -38,22 +38,22 @@
   },
   "dependencies": {
     "@noble/hashes": "^2.0.1",
-    "@polkadot-api/metadata-builders": "^0.14.1",
-    "@polkadot-api/substrate-bindings": "^0.20.1",
+    "@polkadot-api/metadata-builders": "^0.14.3",
+    "@polkadot-api/substrate-bindings": "^0.20.3",
     "@polkadot-api/substrate-client": "^0.7.0",
-    "@polkadot-api/view-builder": "^0.5.1",
+    "@polkadot-api/view-builder": "^0.5.3",
     "@polkadot-labs/hdkd": "^0.0.28",
     "@polkadot-labs/hdkd-helpers": "^0.0.29",
     "@scure/sr25519": "^1.0.0",
     "cac": "^6.7.14",
-    "polkadot-api": "^2.0.1",
-    "verifiablejs": "^1.2.0",
+    "polkadot-api": "^2.1.4",
+    "verifiablejs": "1.3.0",
     "yaml": "^2.8.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.5",
     "@changesets/cli": "^2.29.4",
-    "@polkadot-api/metadata-compatibility": "^0.6.1",
+    "@polkadot-api/metadata-compatibility": "^0.6.3",
     "@types/bun": "^1.3.9",
     "husky": "^9.1.7"
   }