polkadot-cli 1.19.0 → 1.20.0

package/README.md

@@ -280,6 +280,10 @@ dot account create my-staking --path //staking
 # Add a keyed account from a BIP39 mnemonic
 dot account add treasury --secret "word1 word2 ... word12"
 
+# Add from a 32-byte hex seed or a 64-byte raw sr25519 private key
+dot account add seeded --secret 0x1111111111111111111111111111111111111111111111111111111111111111
+dot account add raw-key --secret 0x<128-hex-char expanded secret>   # no --path
+
 # Add with a derivation path
 dot account add hot-wallet --secret "word1 word2 ... word12" --path //hot
 
@@ -313,6 +317,7 @@ dot account inspect 5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY
 dot account inspect 0xd43593c715fdd31c61141abd04a99fd6822c8558854ccde39a5684e7a56da27d
 dot account inspect alice --prefix 0         # Polkadot mainnet prefix
 dot account inspect alice --json             # JSON output
+dot account inspect dave --show-secret       # reveal mnemonic + sr25519 private key
 ```
 
 #### Watch-only accounts
@@ -484,16 +489,21 @@ dot account inspect --pallet-id py/trsry --json
 
 Constraints (will error): cannot combine a positional input with derivation flags; `--pallet-id` and `--parachain` are mutually exclusive; `--parachain` requires `--parachain-type child|sibling`; `--show-secret` doesn't apply (derived sovereigns have no key).
 
-#### Reveal the sr25519 private key
+#### Reveal the mnemonic and sr25519 private key
 
-For provisioning another signer (e.g. a server that expects a raw hex private key in an env var), add `--show-secret` to print the **64-byte sr25519 expanded secret** as `0x`-prefixed hex:
+For provisioning another signer (e.g. a server that expects a raw hex private key in an env var), add `--show-secret` to print the **64-byte sr25519 expanded secret** as `0x`-prefixed hex. It also reveals the **stored mnemonic** (or hex seed) so you can back it up:
 
 ```bash
-dot account inspect dave --show-secret
-# Private Key: 0x<128 hex chars>   (sr25519 expanded, 64 bytes — never share)
+dot account inspect my-validator --show-secret
+# Mnemonic:    word1 word2 ... word12   (only for accounts stored as a phrase)
+# Private Key: 0x<128 hex chars>        (sr25519 expanded, 64 bytes — never share)
 ```
 
-Works for dev accounts (derived on-the-fly from the standard dev mnemonic) and for stored accounts that have a secret (mnemonic or hex seed). Refuses on watch-only accounts, bare SS58 addresses, or hex public keys. The hex is the final secret after any derivation path is applied, so it can be fed directly to signers that don't accept a mnemonic+path (e.g. `@scure/sr25519`'s `sign`, or services like identity-backend that read a `PROXY_PRIVATE_KEY`). Combine with `--json` to include it under the `privateKey` field.
+Works for dev accounts (derived on-the-fly from the standard dev mnemonic) and for stored accounts that have a secret. Refuses on watch-only accounts, bare SS58 addresses, or hex public keys. The revealed line depends on how the account was stored: a phrase shows under `Mnemonic`, a 32-byte hex seed under `Seed`, and a raw private key shows only the `Private Key` (the stored secret already _is_ the expanded key). **Env-backed secrets are never resolved to disk output** — only the `$VAR` reference is shown. The expanded `Private Key` is the final secret after any derivation path is applied, so it can be fed directly to signers that don't accept a mnemonic+path (e.g. `@scure/sr25519`'s `sign`, or services like identity-backend that read a `PROXY_PRIVATE_KEY`). Combine with `--json` to include the values under the `mnemonic`/`seed` and `privateKey` fields.
+
+The revealed `Private Key` round-trips: you can re-import it as a usable account (see [Import a raw private key](#import-a-raw-private-key) below).
+
+> **Note:** if the account was stored with a derivation path, the revealed `Mnemonic`/`Seed` reproduces the original address **only when re-imported with the same `--path`** (shown on the `Derivation` line). The `Private Key` already bakes in the path, so it round-trips on its own.
 
 #### Env-var-backed accounts
 
@@ -540,12 +550,29 @@ Signers
 
 **Supported secret formats for import:**
 
-| Format | Example | Status |
-|--------|---------|--------|
-| BIP39 mnemonic (12/24 words) | `"abandon abandon ... about"` | Supported |
-| Hex seed (`0x` + 64 hex chars) | `0xabcdef0123...` | Not supported via CLI (see below) |
+| Format | Example | `--path`? |
+|--------|---------|-----------|
+| BIP39 mnemonic (12/24 words) | `"abandon abandon ... about"` | Yes |
+| Hex seed (`0x` + 64 hex chars = 32 bytes) | `0x1111...1111` | Yes |
+| Raw private key (`0x` + 128 hex chars = 64-byte sr25519 expanded secret) | `0x20e0...5568` | No (cannot be HD-derived) |
+
+All three formats work directly from the command line via `--secret` or via `--env`.
+
+#### Import a raw private key
+
+The 64-byte expanded secret that `--show-secret` prints can be re-imported as a fully usable, signing-capable account. This is the round-trip companion to `--show-secret` — handy when a key only exists in expanded form (e.g. exported from another tool or read from a `PROXY_PRIVATE_KEY` env var):
+
+```bash
+# Round-trip: reveal dave's expanded secret, then import it under a new name
+SECRET=$(dot account inspect dave --show-secret --json | jq -r .privateKey)
+dot account add raw-dave --secret "$SECRET"
+# raw-dave now has the same address as dave and can sign
+
+# Or from an environment variable (secret stays off disk)
+dot account add server-signer --env PROXY_PRIVATE_KEY
+```
 
-**Known limitation:** Hex seed import (`--secret 0x...`) does not work from the command line. The CLI argument parser (`cac`) interprets `0x`-prefixed values as JavaScript numbers, which loses precision for 32-byte seeds. Use a BIP39 mnemonic instead. If you need to import a raw seed programmatically, write it directly to `~/.polkadot/accounts.json`.
+A raw private key cannot be HD-derived, so `--path` is rejected for this format. Imported expanded-secret accounts sign exactly like mnemonic-backed ones.
 
 #### Export/import accounts
 
@@ -1871,7 +1898,7 @@ dot verifiable alice
 # Bandersnatch Member Key
 #
 #   Account:    alice
-#   Member Key: 0x66813b70ba616b374c90ac92edff6e3be95e12adbc93ea7a6c37cbf334ab87e2
+#   Member Key: 0xbb6ee099b568f1844d62fc00e6305c2e83aa8da30ce59e664ef39e089204d43c
 
 # Derive keyed member key (full person — "candidate" context)
 dot verifiable alice --context candidate
@@ -1880,7 +1907,7 @@ dot verifiable alice --context candidate
 #
 #   Account:    alice
 #   Context:    candidate
-#   Member Key: 0x2fd5b74033d904cf5575b932507939c5d43811e488223229eaf5596565f15ae6
+#   Member Key: 0x5f915576987547d3e55bb4129ac8cae1d338f8933073dc74272b4c825f738592
 
 # Arbitrary context string
 dot verifiable alice --context pps

package/dist/cli.mjs

@@ -461,6 +461,7 @@ function suggestMessage(kind, input, candidates) {
 }
 
 // src/core/accounts.ts
+import { hexToBytes as nobleHexToBytes } from "@noble/hashes/utils.js";
 import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
 import {
   DEV_PHRASE,
@@ -471,7 +472,7 @@ import {
   ss58Decode,
   validateMnemonic
 } from "@polkadot-labs/hdkd-helpers";
-import { HDKD, secretFromSeed } from "@scure/sr25519";
+import { getPublicKey, HDKD, secretFromSeed, sign } from "@scure/sr25519";
 import { getPolkadotSigner } from "polkadot-api/signer";
 function isDevAccount(name) {
   return DEV_NAMES.includes(name.toLowerCase());
@@ -486,18 +487,54 @@ function deriveFromMnemonic(mnemonic, path) {
   return derive(path);
 }
 function deriveFromHexSeed(hexSeed, path) {
-  const clean = hexSeed.startsWith("0x") ? hexSeed.slice(2) : hexSeed;
-  const seed = new Uint8Array(clean.length / 2);
-  for (let i = 0;i < clean.length; i += 2) {
-    seed[i / 2] = parseInt(clean.substring(i, i + 2), 16);
-  }
-  const derive = sr25519CreateDerive(seed);
+  const derive = sr25519CreateDerive(hexToBytes(hexSeed));
   return derive(path);
 }
 function getDevKeypair(name) {
   const path = devDerivationPath(name);
   return deriveFromMnemonic(DEV_PHRASE, path);
 }
+function hexToBytes(hex) {
+  return nobleHexToBytes(hex.startsWith("0x") ? hex.slice(2) : hex);
+}
+function isExpandedSecret(secret) {
+  return EXPANDED_SECRET_RE.test(secret);
+}
+function isHexSeed(secret) {
+  return HEX_SEED_RE.test(secret);
+}
+function secretKind(secret) {
+  if (isExpandedSecret(secret))
+    return "expanded";
+  if (isHexSeed(secret))
+    return "seed";
+  return "mnemonic";
+}
+function assertNoPathForExpandedSecret(derivationPath) {
+  if (derivationPath) {
+    throw new Error("Stored account has a 64-byte expanded secret with a derivation path, which cannot be applied. An expanded secret cannot be HD-derived; remove the derivationPath from accounts.json.");
+  }
+}
+function keypairFromExpandedSecret(secret) {
+  return {
+    publicKey: getPublicKey(secret),
+    sign: (msg) => sign(secret, msg)
+  };
+}
+function keypairFromSecret(secret, derivationPath = "") {
+  if (isExpandedSecret(secret)) {
+    assertNoPathForExpandedSecret(derivationPath);
+    return keypairFromExpandedSecret(hexToBytes(secret));
+  }
+  return isHexSeed(secret) ? deriveFromHexSeed(secret, derivationPath) : deriveFromMnemonic(secret, derivationPath);
+}
+function expandedSecretFromStored(secret, derivationPath = "") {
+  if (isExpandedSecret(secret)) {
+    assertNoPathForExpandedSecret(derivationPath);
+    return hexToBytes(secret);
+  }
+  return deriveExpandedSecret(miniSecretFromSecret(secret), derivationPath);
+}
 function parseDerivations(path) {
   const out = [];
   for (const [, type, code] of path.matchAll(DERIVATION_RE)) {
@@ -528,17 +565,11 @@ function deriveExpandedSecret(miniSecret, path) {
   return parseDerivations(path).reduce((sk, [type, code]) => type === "hard" ? HDKD.secretHard(sk, createChainCode(code)) : HDKD.secretSoft(sk, createChainCode(code)), secretFromSeed(miniSecret));
 }
 function miniSecretFromSecret(secret) {
-  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(secret);
-  if (isHexSeed) {
-    const clean = secret.slice(2);
-    const bytes = new Uint8Array(32);
-    for (let i = 0;i < clean.length; i += 2) {
-      bytes[i / 2] = parseInt(clean.substring(i, i + 2), 16);
-    }
-    return bytes;
+  if (isHexSeed(secret)) {
+    return hexToBytes(secret);
   }
   if (!validateMnemonic(secret)) {
-    throw new Error("Invalid secret. Expected a 0x-prefixed 32-byte hex seed or a valid BIP39 mnemonic.");
+    throw new Error("Invalid secret. Expected a BIP39 mnemonic or a 0x-prefixed 32-byte hex seed.");
   }
   return entropyToMiniSecret(mnemonicToEntropy(secret));
 }
@@ -555,13 +586,19 @@ function createNewAccount(path = "") {
   return { mnemonic, publicKey: keypair.publicKey };
 }
 function importAccount(secret, path = "") {
-  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(secret);
-  if (isHexSeed) {
+  if (isExpandedSecret(secret)) {
+    if (path) {
+      throw new Error("Derivation paths are not supported for raw private key (64-byte expanded secret) import. An expanded secret cannot be HD-derived; omit --path.");
+    }
+    const keypair2 = keypairFromExpandedSecret(hexToBytes(secret));
+    return { publicKey: keypair2.publicKey };
+  }
+  if (isHexSeed(secret)) {
     const keypair2 = deriveFromHexSeed(secret, path);
     return { publicKey: keypair2.publicKey };
   }
   if (!validateMnemonic(secret)) {
-    throw new Error("Invalid secret. Expected a 0x-prefixed 32-byte hex seed or a valid BIP39 mnemonic.");
+    throw new Error("Invalid secret. Expected a BIP39 mnemonic, a 0x-prefixed 32-byte hex seed, or a 0x-prefixed 64-byte sr25519 expanded secret.");
   }
   const keypair = deriveFromMnemonic(secret, path);
   return { publicKey: keypair.publicKey };
@@ -627,9 +664,7 @@ async function resolveAccountKeypair(name) {
   if (account.secret === undefined) {
     throw new Error(`Account "${name}" is watch-only (no secret). Cannot sign. Import with --secret or --env.`);
   }
-  const secret = resolveSecret(account.secret);
-  const isHexSeed = /^0x[0-9a-fA-F]{64}$/.test(secret);
-  return isHexSeed ? deriveFromHexSeed(secret, account.derivationPath) : deriveFromMnemonic(secret, account.derivationPath);
+  return keypairFromSecret(resolveSecret(account.secret), account.derivationPath);
 }
 async function resolveAccountSigner(name) {
   const keypair = await resolveAccountKeypair(name);
@@ -637,8 +672,8 @@ async function resolveAccountSigner(name) {
 }
 async function resolveAccountExpandedSecret(name) {
   if (isDevAccount(name)) {
-    const miniSecret2 = entropyToMiniSecret(mnemonicToEntropy(DEV_PHRASE));
-    return deriveExpandedSecret(miniSecret2, devDerivationPath(name));
+    const miniSecret = entropyToMiniSecret(mnemonicToEntropy(DEV_PHRASE));
+    return deriveExpandedSecret(miniSecret, devDerivationPath(name));
   }
   const accountsFile = await loadAccounts();
   const account = findAccount(accountsFile, name);
@@ -655,16 +690,17 @@ async function resolveAccountExpandedSecret(name) {
   if (account.secret === undefined) {
     throw new Error(`Account "${name}" is watch-only (no secret). Cannot derive private key. Import with --secret or --env.`);
   }
-  const miniSecret = miniSecretFromSecret(resolveSecret(account.secret));
-  return deriveExpandedSecret(miniSecret, account.derivationPath);
+  return expandedSecretFromStored(resolveSecret(account.secret), account.derivationPath);
 }
 function bytesToHex(bytes) {
   return "0x" + Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
-var DEV_NAMES, DERIVATION_RE;
+var DEV_NAMES, EXPANDED_SECRET_RE, HEX_SEED_RE, DERIVATION_RE;
 var init_accounts = __esm(() => {
   init_accounts_store();
   DEV_NAMES = ["alice", "bob", "charlie", "dave", "eve", "ferdie"];
+  EXPANDED_SECRET_RE = /^0x[0-9a-fA-F]{128}$/;
+  HEX_SEED_RE = /^0x[0-9a-fA-F]{64}$/;
   DERIVATION_RE = /(\/{1,2})([^/]+)/g;
 });
 
@@ -1264,7 +1300,7 @@ async function fetchMetadataFromChain(clientHandle, chainName) {
   let bytes;
   try {
     const hex = await withTimeout(client._request("state_call", ["Metadata_metadata_at_version", v15Arg]), chainName);
-    const raw = hexToBytes2(hex);
+    const raw = hexToBytes3(hex);
     const decoded = optionalOpaqueBytes.dec(raw);
     if (decoded !== undefined) {
       bytes = new Uint8Array(decoded);
@@ -1273,7 +1309,7 @@ async function fetchMetadataFromChain(clientHandle, chainName) {
   if (!bytes) {
     try {
       const hex = await withTimeout(client._request("state_getMetadata", []), chainName);
-      bytes = hexToBytes2(hex);
+      bytes = hexToBytes3(hex);
     } catch (err) {
       if (err instanceof ConnectionError)
         throw err;
@@ -1469,7 +1505,7 @@ function describeCallArgs(meta, palletName, callName) {
 function describeEventFields(meta, palletName, eventName) {
   return compactArgsString(getEventFields(meta, palletName, eventName));
 }
-function hexToBytes2(hex) {
+function hexToBytes3(hex) {
   const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
   const bytes = new Uint8Array(clean.length / 2);
   for (let i = 0;i < clean.length; i += 2) {
@@ -3198,7 +3234,7 @@ var init_xxh64 = __esm(() => {
 import { blake2b as blake2b2 } from "@noble/hashes/blake2.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { keccak_256 as keccak_2562 } from "@noble/hashes/sha3.js";
-import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes3 } from "@noble/hashes/utils.js";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes4 } from "@noble/hashes/utils.js";
 function computeHash(algorithm, data) {
   const algo = ALGORITHMS[algorithm];
   if (!algo) {
@@ -3212,7 +3248,7 @@ function parseInputData(input) {
     if (hex.length % 2 !== 0) {
       throw new Error(`Invalid hex input: odd number of characters`);
     }
-    return hexToBytes3(hex);
+    return hexToBytes4(hex);
   }
   return new TextEncoder().encode(input);
 }
@@ -3660,17 +3696,17 @@ var init_complete = __esm(() => {
 // src/cli.ts
 import cac from "cac";
 // package.json
-var version = "1.19.0";
+var version = "1.20.0";
 
 // src/commands/account.ts
 init_accounts_store();
 init_accounts();
 import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { hexToBytes as nobleHexToBytes } from "@noble/hashes/utils.js";
+import { hexToBytes as nobleHexToBytes2 } from "@noble/hashes/utils.js";
 
 // src/core/h160.ts
 import { keccak_256 } from "@noble/hashes/sha3.js";
-import { bytesToHex as bytesToHex2, hexToBytes } from "@noble/hashes/utils.js";
+import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2 } from "@noble/hashes/utils.js";
 var ETH_DERIVED_SUFFIX_BYTE = 238;
 var H160_LEN = 20;
 var ACCOUNT_ID_LEN = 32;
@@ -3722,7 +3758,7 @@ function h160FromHex(input) {
   if (!isH160Hex(input)) {
     throw new Error(`Not a valid 0x-prefixed 20-byte hex string: ${input}`);
   }
-  return hexToBytes(input.slice(2));
+  return hexToBytes2(input.slice(2));
 }
 
 // src/commands/account.ts
@@ -3797,7 +3833,8 @@ function isValidParaId(value) {
 var ACCOUNT_HELP = `
 ${BOLD}Usage:${RESET}
   $ dot account add <name> <ss58|hex>                                Add a watch-only address (no secret)
-  $ dot account add <name> --secret <s> [--path <derivation>]        Import from BIP39 mnemonic
+  $ dot account add <name> --secret <s> [--path <derivation>]        Import from BIP39 mnemonic or 32-byte hex seed
+  $ dot account add <name> --secret 0x<128 hex>                      Import a raw 64-byte sr25519 private key (no --path)
   $ dot account add <name> --env <VAR> [--path <derivation>]         Import account backed by env variable
   $ dot account add <name> --parachain <id> --parachain-type <t>     Derive a parachain sovereign (t = child|sibling)
   $ dot account add <name> --pallet-id <8 chars or 0x hex>           Derive a pallet sovereign (e.g. py/trsry)
@@ -3814,6 +3851,7 @@ ${BOLD}Usage:${RESET}
 ${BOLD}Examples:${RESET}
   $ dot account add treasury 5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY
   $ dot account add treasury --secret "word1 word2 ... word12"
+  $ dot account add raw-key --secret 0x<128-hex-char sr25519 expanded secret>
   $ dot account add ci-signer --env MY_SECRET --path //ci
   $ dot account add Treasury --pallet-id py/trsry
   $ dot account add Bounties --pallet-id 0x70792f626f756e74
@@ -3841,16 +3879,21 @@ ${BOLD}Examples:${RESET}
 
 ${YELLOW}Note: Secrets are stored unencrypted in ~/.polkadot/accounts.json.
       Use --env to keep secrets off disk entirely.
-      Hex seed import (0x...) is not supported via CLI.${RESET}
+      --secret accepts a BIP39 mnemonic, a 0x 32-byte hex seed, or a
+      0x 64-byte raw sr25519 private key (the value --show-secret prints).
+      Raw private keys cannot be HD-derived, so --path is rejected for them.${RESET}
 `.trimStart();
 function registerAccountCommands(cli) {
-  cli.command("account [action] [...names]", "Manage local accounts (create, import, list, remove, export)").alias("accounts").option("--secret <value>", "Secret key (mnemonic or hex seed) for import").option("--env <varName>", "Environment variable name holding the secret").option("--path <derivation>", "Derivation path (e.g. //staking, //polkadot//0/wallet)").option("--parachain <id>", "Derive a parachain sovereign account (requires --parachain-type)").option("--parachain-type <type>", "Parachain sovereign type: child or sibling").option("--pallet-id <id>", "Derive a pallet sovereign account from an 8-byte PalletId").option("--prefix <number>", "SS58 prefix for address encoding (default: 42)").option("--file <path>", "Input/output file for batch import/export").option("--overwrite", "Overwrite existing accounts on batch import").option("--dry-run", "Preview batch import without applying changes").option("--include-secrets", "Include secrets in export (redacted by default)").option("--watch-only", "Export only watch-only accounts").option("--show-secret", "Reveal the 64-byte sr25519 expanded private key (inspect only)").action(async (action, names, opts) => {
+  cli.command("account [action] [...names]", "Manage local accounts (create, import, list, remove, export)").alias("accounts").option("--secret <value>", "Secret for import: BIP39 mnemonic, 0x 32-byte hex seed, or 0x 64-byte raw private key").option("--env <varName>", "Environment variable name holding the secret").option("--path <derivation>", "Derivation path (e.g. //staking, //polkadot//0/wallet)").option("--parachain <id>", "Derive a parachain sovereign account (requires --parachain-type)").option("--parachain-type <type>", "Parachain sovereign type: child or sibling").option("--pallet-id <id>", "Derive a pallet sovereign account from an 8-byte PalletId").option("--prefix <number>", "SS58 prefix for address encoding (default: 42)").option("--file <path>", "Input/output file for batch import/export").option("--overwrite", "Overwrite existing accounts on batch import").option("--dry-run", "Preview batch import without applying changes").option("--include-secrets", "Include secrets in export (redacted by default)").option("--watch-only", "Export only watch-only accounts").option("--show-secret", "Reveal the 64-byte sr25519 expanded private key (inspect only)").action(async (action, names, opts) => {
     if (!action) {
       if (process.argv[2] === "accounts")
         return accountList(opts);
       console.log(ACCOUNT_HELP);
       return;
     }
+    const rawSecret = rawArgValue("--secret");
+    if (rawSecret != null)
+      opts.secret = rawSecret;
     switch (action) {
       case "new":
       case "create":
@@ -4492,8 +4535,9 @@ async function accountInspect(input, opts) {
     }
   }
   const ss58 = toSs58(publicKeyHex, prefix);
-  const h160Hex = toEip55(accountIdToH160(nobleHexToBytes(publicKeyHex.slice(2))));
+  const h160Hex = toEip55(accountIdToH160(nobleHexToBytes2(publicKeyHex.slice(2))));
   let privateKeyHex;
+  let revealedSecret;
   if (opts.showSecret) {
     if (!name) {
       console.error("--show-secret requires an account name; raw addresses and hex keys have no secret to reveal.");
@@ -4509,6 +4553,14 @@ async function accountInspect(input, opts) {
       console.error(err.message);
       process.exit(1);
     }
+    if (storedAccount?.secret !== undefined && !isEnvSecret(storedAccount.secret)) {
+      const kind = secretKind(storedAccount.secret);
+      if (kind === "mnemonic") {
+        revealedSecret = { label: "Mnemonic", field: "mnemonic", value: storedAccount.secret };
+      } else if (kind === "seed") {
+        revealedSecret = { label: "Seed", field: "seed", value: storedAccount.secret };
+      }
+    }
   }
   let kindLabel;
   let sourceLine;
@@ -4587,6 +4639,8 @@ async function accountInspect(input, opts) {
       result.env = envLine.replace(/^\$/, "");
     if (bandersnatch && Object.keys(bandersnatch).length > 0)
       result.bandersnatch = bandersnatch;
+    if (revealedSecret)
+      result[revealedSecret.field] = revealedSecret.value;
     if (privateKeyHex)
       result.privateKey = privateKeyHex;
     console.log(formatJson(result));
@@ -4618,6 +4672,12 @@ async function accountInspect(input, opts) {
       }
     }
     console.log(`  ${BOLD}Prefix:${RESET}      ${prefix}`);
+    if (revealedSecret) {
+      console.log(`  ${BOLD}${`${revealedSecret.label}:`.padEnd(13)}${RESET}${revealedSecret.value}`);
+      if (derivationLine) {
+        console.log(`               ${YELLOW}(derived with ${derivationLine} — re-import needs --path ${derivationLine})${RESET}`);
+      }
+    }
     if (privateKeyHex) {
       console.log(`  ${BOLD}Private Key:${RESET} ${privateKeyHex}`);
       console.log(`               ${YELLOW}(sr25519 expanded, 64 bytes — never share)${RESET}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polkadot-cli",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "CLI tool for querying Polkadot-ecosystem on-chain state",
   "type": "module",
   "bin": {
@@ -38,22 +38,22 @@
   },
   "dependencies": {
     "@noble/hashes": "^2.0.1",
-    "@polkadot-api/metadata-builders": "^0.14.1",
-    "@polkadot-api/substrate-bindings": "^0.20.1",
+    "@polkadot-api/metadata-builders": "^0.14.3",
+    "@polkadot-api/substrate-bindings": "^0.20.3",
     "@polkadot-api/substrate-client": "^0.7.0",
-    "@polkadot-api/view-builder": "^0.5.1",
+    "@polkadot-api/view-builder": "^0.5.3",
     "@polkadot-labs/hdkd": "^0.0.28",
     "@polkadot-labs/hdkd-helpers": "^0.0.29",
     "@scure/sr25519": "^1.0.0",
     "cac": "^6.7.14",
-    "polkadot-api": "^2.0.1",
-    "verifiablejs": "1.3.0-beta.2",
+    "polkadot-api": "^2.1.4",
+    "verifiablejs": "1.3.0",
     "yaml": "^2.8.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.5",
     "@changesets/cli": "^2.29.4",
-    "@polkadot-api/metadata-compatibility": "^0.6.1",
+    "@polkadot-api/metadata-compatibility": "^0.6.3",
     "@types/bun": "^1.3.9",
     "husky": "^9.1.7"
   }