@zodiac-os/sdk 1.6.0 → 1.7.0

package/README.md

@@ -39,7 +39,7 @@ export default defineConfig({
 zodiac-os pull
 ```
 
-This generates typed data in `node_modules/.zodiac-os/` with your org's users and vaults.
+This generates typed data in `.zodiac/` at your project root with your org's users and accounts (workspace vaults plus accounts that have been applied via a constellation). Add `.zodiac/` to your `.gitignore`.
 
 ## Constellation API
 
@@ -61,27 +61,29 @@ const eth = constellation({
 })
 ```
 
-### Referencing existing vaults
+### Referencing existing accounts
 
-Bracket access gives you existing Safes and Roles mods from the selected workspace. Names auto-complete from the codegen output.
+Bracket access gives you existing Safes and Roles mods from the selected workspace — both **vault accounts** (manually-promoted entries surfaced in the workspace UI) and any **constellation accounts** previously created by a `push()`. The codegen records them under the same `accounts` map, marked with a `vault` flag for the subset that are also workspace vaults. Names auto-complete from the codegen output.
 
 ```ts
 // Reference an existing Safe — no invocation needed
 const ggDao = eth.safe['GG DAO']
 
-// Reference the canonical Roles mod for that Safe
-const ggDaoRoles = eth.roles['GG DAO']
+// Reference an existing Roles mod
+const ggDaoRoles = eth.roles['GG DAO Roles']
 
 // Optionally invoke with overrides
 const ggDaoOverridden = eth.safe['GG DAO']({ threshold: 5 })
 ```
 
+> `bun push` runs `pull-org` first via the `prepush` hook, so re-pushing always sees the freshest existing-account values from your org.
+
 ### Creating new accounts
 
-Use bracket access with a new label to create new nodes. Required fields are enforced by the type system:
+Use bracket access with a new label to create new nodes. Every mandatory field (`nonce`, `threshold`, `owners` for Safes; `nonce` for Roles mods) must be supplied explicitly — the SDK does not inject any runtime defaults. The type system surfaces a missing field as a compile-time error so you can't ship an incomplete spec.
 
 ```ts
-// New Safe — threshold, owners are required
+// New Safe — nonce, threshold, owners are required
 const newSafe = eth.safe['New Safe']({
   nonce: 0n,
   threshold: 2,
@@ -99,18 +101,7 @@ const newRoles = eth.roles['New Roles']({
 })
 ```
 
-### Canonical Roles mods
-
-Every Safe has a canonical Roles mod hosting policies applied through the app. When you use the Safe label on the `roles` accessor, it resolves to that Safe's canonical Roles mod automatically.
-
-```ts
-// Enable roles on an existing Safe in your org
-const daoRoles = eth.roles['GG DAO']({
-  roles: [
-    /* ... */
-  ],
-})
-```
+When a bracket label matches an existing account from your codegen, all overrides become optional — you pass only the fields you want to change against the live configuration.
 
 ### Circular references between new nodes
 
@@ -131,7 +122,7 @@ const roles = eth.roles['New Roles']({
 })
 ```
 
-References are resolved by label at `apply()` time, so both sides of the cycle must be included in the call.
+References are resolved by label at `push()` time, so both sides of the cycle must be included in the call.
 
 ### Referencing users
 
@@ -141,22 +132,22 @@ References are resolved by label at `apply()` time, so both sides of the cycle m
 const aliceAddress = eth.user['Alice Sample']
 ```
 
-### Applying the constellation
+### Pushing the constellation
 
-The `apply()` function takes all nodes and sends them to the Zodiac OS API. Pass either a named object (keys become refs) or an array:
+The `push()` function takes all nodes and sends them to the Zodiac OS API. Pass either a named object (keys become refs) or an array:
 
 ```ts
-import { apply } from '@zodiac-os/sdk'
+import { push } from '@zodiac-os/sdk'
 
-await apply({ ggDao, ggDaoRoles, newSafe, newRoles })
+await push({ ggDao, ggDaoRoles, newSafe, newRoles })
 ```
 
-All referenced nodes must be included in the `apply()` call.
+All referenced nodes must be included in the `push()` call.
 
-By default, `apply()` creates an API client from the `ZODIAC_OS_API_KEY` environment variable. You can pass a custom client:
+By default, `push()` creates an API client from the `ZODIAC_API_KEY` environment variable. You can pass a custom client:
 
 ```ts
-await apply({ ggDao, newRoles }, { api: new ApiClient({ apiKey: '...' }) })
+await push({ ggDao, newRoles }, { api: new ApiClient({ apiKey: '...' }) })
 ```
 
 ## CLI reference

package/dist/allow-Dzh6t_l8.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"allow-Dzh6t_l8.mjs","names":[],"sources":["../src/allow/types.ts","../src/allow/runtime.ts"],"sourcesContent":["import type { BigNumberish, BytesLike, ParamType } from 'ethers'\nimport type {\n  Condition,\n  FunctionPermission,\n  TargetPermission,\n} from 'zodiac-roles-sdk'\n\nexport type Options = {\n  send?: boolean\n  delegatecall?: boolean\n  etherWithinAllowance?: `0x${string}`\n  callWithinAllowance?: `0x${string}`\n}\n\nexport type PrimitiveValue = BigNumberish | BytesLike | string | boolean\n\n// Signature matches `zodiac-roles-sdk` so values from `c.*` are assignable.\nexport type ConditionFunction<T = unknown> = (\n  abiType: ParamType,\n  _?: T\n) => Condition\n\ntype RequireAtLeastOne<T> = {\n  [K in keyof T]-?: Required<Pick<T, K>> & Partial<Pick<T, Exclude<keyof T, K>>>\n}[keyof T]\n\ntype ArrayElement<T extends readonly unknown[]> = T extends readonly (infer U)[]\n  ? U\n  : never\n\nexport type PrimitiveScoping<T extends PrimitiveValue> =\n  | T\n  | ConditionFunction<T>\n\nexport type ArrayScoping<T extends readonly any[]> =\n  | readonly Scoping<ArrayElement<T>>[]\n  | ConditionFunction<T>\n\nexport type StructScoping<T extends { [key: string]: any }> =\n  | RequireAtLeastOne<{ [K in keyof T]?: Scoping<T[K]> }>\n  | ConditionFunction<T>\n\nexport type Scoping<T> = T extends PrimitiveValue\n  ? PrimitiveScoping<T>\n  : T extends readonly any[]\n    ? ArrayScoping<T>\n    : T extends { [key: string]: any }\n      ? StructScoping<T>\n      : unknown\n\nexport type { FunctionPermission, TargetPermission }\n\nexport const EVERYTHING = Symbol.for('@zodiac-os/allow-kit/EVERYTHING')\nexport type EVERYTHING = typeof EVERYTHING\n","import { Interface, FunctionFragment, isError, type InterfaceAbi } from 'ethers'\nimport { c, coercePermission } from 'zodiac-roles-sdk'\nimport type {\n  Condition,\n  FunctionPermission,\n  TargetPermission,\n} from 'zodiac-roles-sdk'\nimport { ParameterType, Operator } from 'zodiac-roles-deployments'\nimport { readAbi, walkContracts, type ContractNode } from './abi'\nimport { EVERYTHING, type Options } from './types'\n\nexport function buildAllowKit(\n  abisDir: string,\n  contractsConfig: Record<string, any>\n): Record<string, any> {\n  const kit: Record<string, any> = {}\n  for (const node of walkContracts(contractsConfig)) {\n    const abi = readAbi(abisDir, node)\n    if (!abi) {\n      // Defer the error until the user touches this contract — otherwise an\n      // ABI missing for one chain crashes all unrelated role definitions.\n      attachAt(kit, [node.chain, ...node.segments], missingAbiProxy(node))\n      continue\n    }\n    attachAt(\n      kit,\n      [node.chain, ...node.segments],\n      makeAllowContract(node.address, abi as InterfaceAbi)\n    )\n  }\n  return kit\n}\n\nfunction attachAt(root: Record<string, any>, segments: string[], value: any) {\n  let cursor = root\n  for (let i = 0; i < segments.length - 1; i++) {\n    const seg = segments[i]!\n    if (!(seg in cursor)) cursor[seg] = {}\n    cursor = cursor[seg]\n  }\n  cursor[segments[segments.length - 1]!] = value\n}\n\nfunction missingAbiProxy(node: ContractNode) {\n  const explain = () => {\n    throw new Error(\n      `ABI missing for ${node.chain}.${node.segments.join('.')} ` +\n        `(${node.address}). Run \\`zodiac-os pull-contracts\\` to fetch it, or ` +\n        `paste the ABI JSON manually at <abisDir>/${node.chain}/${node.segments.join('/')}.json`\n    )\n  }\n  return new Proxy(\n    {},\n    {\n      get: explain,\n      has: explain,\n    }\n  )\n}\n\nfunction makeAllowContract(\n  address: `0x${string}`,\n  abi: InterfaceAbi\n): Record<string | symbol, any> {\n  const iface = Interface.from(abi)\n  const lowerAddr = address.toLowerCase() as `0x${string}`\n\n  const allowEverything = (options?: Options): TargetPermission => ({\n    targetAddress: lowerAddr,\n    send: options?.send,\n    delegatecall: options?.delegatecall,\n  })\n\n  const has = (name: string) => {\n    try {\n      const fn = iface.getFunction(name)\n      if (!fn) return false\n      return fn.stateMutability !== 'view' && fn.stateMutability !== 'pure'\n    } catch (error) {\n      if (!isError(error as any, 'INVALID_ARGUMENT')) throw error\n      return false\n    }\n  }\n\n  return new Proxy(\n    {},\n    {\n      get: (_target, prop) => {\n        if (prop === EVERYTHING) return allowEverything\n        if (typeof prop !== 'string') return undefined\n        if (!has(prop)) return undefined\n        const fn = iface.getFunction(prop)!\n        return makeAllowFunction(fn, lowerAddr)\n      },\n      has: (_target, prop) => {\n        if (prop === EVERYTHING) return true\n        return typeof prop === 'string' && has(prop)\n      },\n    }\n  )\n}\n\nfunction makeAllowFunction(\n  fn: FunctionFragment,\n  targetAddress: `0x${string}`\n): (...args: any[]) => FunctionPermission {\n  const inputs = fn.inputs\n  return (...args: any[]) => {\n    const scopings = args.slice(0, inputs.length)\n    const hasScopings = scopings.some((s) => s !== undefined && s !== null)\n    const options: Options = args[inputs.length] ?? {}\n    const condition = hasScopings\n      ? c.calldataMatches(scopings, inputs)()\n      : undefined\n    const preset = {\n      targetAddress,\n      signature: fn.format('sighash'),\n      condition,\n    }\n    return applyOptions(coercePermission(preset as any) as any, options)\n  }\n}\n\nconst emptyCalldataMatches: Condition = {\n  paramType: ParameterType.Calldata,\n  operator: Operator.Matches,\n  children: [],\n}\n\nconst applyGlobalAllowance = (\n  condition: Condition | undefined,\n  allowanceCondition: Condition\n): Condition => {\n  const base = condition ?? emptyCalldataMatches\n  if (\n    base.paramType !== ParameterType.Calldata ||\n    base.operator !== Operator.Matches\n  ) {\n    throw new Error(\n      'Global allowance can only be applied to calldata matches nodes'\n    )\n  }\n  return {\n    ...base,\n    children: [...(base.children ?? []), allowanceCondition],\n  }\n}\n\nconst applyOptions = (\n  permission: FunctionPermission & { condition?: Condition },\n  options: Options\n): FunctionPermission => {\n  let condition = permission.condition\n  if (options.etherWithinAllowance) {\n    if (!options.send) {\n      throw new Error(\n        '`etherWithinAllowance` can only be used if `send` is allowed'\n      )\n    }\n    condition = applyGlobalAllowance(condition, {\n      paramType: ParameterType.None,\n      operator: Operator.EtherWithinAllowance,\n      compValue: options.etherWithinAllowance,\n    })\n  }\n  if (options.callWithinAllowance) {\n    condition = applyGlobalAllowance(condition, {\n      paramType: ParameterType.None,\n      operator: Operator.CallWithinAllowance,\n      compValue: options.callWithinAllowance,\n    })\n  }\n  return {\n    ...permission,\n    send: options.send,\n    delegatecall: options.delegatecall,\n    condition,\n  }\n}\n"],"mappings":";;;;;AAoDA,MAAa,aAAa,OAAO,IAAI,kCAAkC;;;ACzCvE,SAAgB,cACd,SACA,iBACqB;CACrB,MAAM,MAA2B,EAAE;AACnC,MAAK,MAAM,QAAQ,cAAc,gBAAgB,EAAE;EACjD,MAAM,MAAM,QAAQ,SAAS,KAAK;AAClC,MAAI,CAAC,KAAK;AAGR,YAAS,KAAK,CAAC,KAAK,OAAO,GAAG,KAAK,SAAS,EAAE,gBAAgB,KAAK,CAAC;AACpE;;AAEF,WACE,KACA,CAAC,KAAK,OAAO,GAAG,KAAK,SAAS,EAC9B,kBAAkB,KAAK,SAAS,IAAoB,CACrD;;AAEH,QAAO;;AAGT,SAAS,SAAS,MAA2B,UAAoB,OAAY;CAC3E,IAAI,SAAS;AACb,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,GAAG,KAAK;EAC5C,MAAM,MAAM,SAAS;AACrB,MAAI,EAAE,OAAO,QAAS,QAAO,OAAO,EAAE;AACtC,WAAS,OAAO;;AAElB,QAAO,SAAS,SAAS,SAAS,MAAO;;AAG3C,SAAS,gBAAgB,MAAoB;CAC3C,MAAM,gBAAgB;AACpB,QAAM,IAAI,MACR,mBAAmB,KAAK,MAAM,GAAG,KAAK,SAAS,KAAK,IAAI,CAAC,IACnD,KAAK,QAAQ,+FAC2B,KAAK,MAAM,GAAG,KAAK,SAAS,KAAK,IAAI,CAAC,OACrF;;AAEH,QAAO,IAAI,MACT,EAAE,EACF;EACE,KAAK;EACL,KAAK;EACN,CACF;;AAGH,SAAS,kBACP,SACA,KAC8B;CAC9B,MAAM,QAAQ,UAAU,KAAK,IAAI;CACjC,MAAM,YAAY,QAAQ,aAAa;CAEvC,MAAM,mBAAmB,aAAyC;EAChE,eAAe;EACf,MAAM,SAAS;EACf,cAAc,SAAS;EACxB;CAED,MAAM,OAAO,SAAiB;AAC5B,MAAI;GACF,MAAM,KAAK,MAAM,YAAY,KAAK;AAClC,OAAI,CAAC,GAAI,QAAO;AAChB,UAAO,GAAG,oBAAoB,UAAU,GAAG,oBAAoB;WACxD,OAAO;AACd,OAAI,CAAC,QAAQ,OAAc,mBAAmB,CAAE,OAAM;AACtD,UAAO;;;AAIX,QAAO,IAAI,MACT,EAAE,EACF;EACE,MAAM,SAAS,SAAS;AACtB,OAAI,SAAS,WAAY,QAAO;AAChC,OAAI,OAAO,SAAS,SAAU,QAAO,KAAA;AACrC,OAAI,CAAC,IAAI,KAAK,CAAE,QAAO,KAAA;AAEvB,UAAO,kBADI,MAAM,YAAY,KAAK,EACL,UAAU;;EAEzC,MAAM,SAAS,SAAS;AACtB,OAAI,SAAS,WAAY,QAAO;AAChC,UAAO,OAAO,SAAS,YAAY,IAAI,KAAK;;EAE/C,CACF;;AAGH,SAAS,kBACP,IACA,eACwC;CACxC,MAAM,SAAS,GAAG;AAClB,SAAQ,GAAG,SAAgB;EACzB,MAAM,WAAW,KAAK,MAAM,GAAG,OAAO,OAAO;EAC7C,MAAM,cAAc,SAAS,MAAM,MAAM,MAAM,KAAA,KAAa,MAAM,KAAK;EACvE,MAAM,UAAmB,KAAK,OAAO,WAAW,EAAE;EAClD,MAAM,YAAY,cACd,EAAE,gBAAgB,UAAU,OAAO,EAAE,GACrC,KAAA;AAMJ,SAAO,aAAa,iBALL;GACb;GACA,WAAW,GAAG,OAAO,UAAU;GAC/B;GACD,CACkD,EAAS,QAAQ;;;AAIxE,MAAM,uBAAkC;CACtC,WAAW,cAAc;CACzB,UAAU,SAAS;CACnB,UAAU,EAAE;CACb;AAED,MAAM,wBACJ,WACA,uBACc;CACd,MAAM,OAAO,aAAa;AAC1B,KACE,KAAK,cAAc,cAAc,YACjC,KAAK,aAAa,SAAS,QAE3B,OAAM,IAAI,MACR,iEACD;AAEH,QAAO;EACL,GAAG;EACH,UAAU,CAAC,GAAI,KAAK,YAAY,EAAE,EAAG,mBAAmB;EACzD;;AAGH,MAAM,gBACJ,YACA,YACuB;CACvB,IAAI,YAAY,WAAW;AAC3B,KAAI,QAAQ,sBAAsB;AAChC,MAAI,CAAC,QAAQ,KACX,OAAM,IAAI,MACR,+DACD;AAEH,cAAY,qBAAqB,WAAW;GAC1C,WAAW,cAAc;GACzB,UAAU,SAAS;GACnB,WAAW,QAAQ;GACpB,CAAC;;AAEJ,KAAI,QAAQ,oBACV,aAAY,qBAAqB,WAAW;EAC1C,WAAW,cAAc;EACzB,UAAU,SAAS;EACnB,WAAW,QAAQ;EACpB,CAAC;AAEJ,QAAO;EACL,GAAG;EACH,MAAM,QAAQ;EACd,cAAc,QAAQ;EACtB;EACD"}
+{"version":3,"file":"allow-Dzh6t_l8.mjs","names":[],"sources":["../src/allow/types.ts","../src/allow/runtime.ts"],"sourcesContent":["import type { BigNumberish, BytesLike, ParamType } from 'ethers'\nimport type {\n  Condition,\n  FunctionPermission,\n  TargetPermission,\n} from 'zodiac-roles-sdk'\n\nexport type Options = {\n  send?: boolean\n  delegatecall?: boolean\n  etherWithinAllowance?: `0x${string}`\n  callWithinAllowance?: `0x${string}`\n}\n\nexport type PrimitiveValue = BigNumberish | BytesLike | string | boolean\n\n// Signature matches `zodiac-roles-sdk` so values from `c.*` are assignable.\nexport type ConditionFunction<T = unknown> = (\n  abiType: ParamType,\n  _?: T\n) => Condition\n\ntype RequireAtLeastOne<T> = {\n  [K in keyof T]-?: Required<Pick<T, K>> & Partial<Pick<T, Exclude<keyof T, K>>>\n}[keyof T]\n\ntype ArrayElement<T extends readonly unknown[]> = T extends readonly (infer U)[]\n  ? U\n  : never\n\nexport type PrimitiveScoping<T extends PrimitiveValue> =\n  | T\n  | ConditionFunction<T>\n\nexport type ArrayScoping<T extends readonly any[]> =\n  | readonly Scoping<ArrayElement<T>>[]\n  | ConditionFunction<T>\n\nexport type StructScoping<T extends { [key: string]: any }> =\n  | RequireAtLeastOne<{ [K in keyof T]?: Scoping<T[K]> }>\n  | ConditionFunction<T>\n\nexport type Scoping<T> = T extends PrimitiveValue\n  ? PrimitiveScoping<T>\n  : T extends readonly any[]\n    ? ArrayScoping<T>\n    : T extends { [key: string]: any }\n      ? StructScoping<T>\n      : unknown\n\nexport type { FunctionPermission, TargetPermission }\n\nexport const EVERYTHING = Symbol.for('@zodiac-os/allow-kit/EVERYTHING')\nexport type EVERYTHING = typeof EVERYTHING\n","import { Interface, FunctionFragment, isError, type InterfaceAbi } from 'ethers'\nimport { c, coercePermission } from 'zodiac-roles-sdk'\nimport type {\n  Condition,\n  FunctionPermission,\n  TargetPermission,\n} from 'zodiac-roles-sdk'\nimport { ParameterType, Operator } from 'zodiac-roles-deployments'\nimport { readAbi, walkContracts, type ContractNode } from './abi'\nimport { EVERYTHING, type Options } from './types'\n\nexport function buildAllowKit(\n  abisDir: string,\n  contractsConfig: Record<string, any>\n): Record<string, any> {\n  const kit: Record<string, any> = {}\n  for (const node of walkContracts(contractsConfig)) {\n    const abi = readAbi(abisDir, node)\n    if (!abi) {\n      // Defer the error until the user touches this contract — otherwise an\n      // ABI missing for one chain crashes all unrelated role definitions.\n      attachAt(kit, [node.chain, ...node.segments], missingAbiProxy(node))\n      continue\n    }\n    attachAt(\n      kit,\n      [node.chain, ...node.segments],\n      makeAllowContract(node.address, abi as InterfaceAbi)\n    )\n  }\n  return kit\n}\n\nfunction attachAt(root: Record<string, any>, segments: string[], value: any) {\n  let cursor = root\n  for (let i = 0; i < segments.length - 1; i++) {\n    const seg = segments[i]!\n    if (!(seg in cursor)) cursor[seg] = {}\n    cursor = cursor[seg]\n  }\n  cursor[segments[segments.length - 1]!] = value\n}\n\nfunction missingAbiProxy(node: ContractNode) {\n  const explain = () => {\n    throw new Error(\n      `ABI missing for ${node.chain}.${node.segments.join('.')} ` +\n        `(${node.address}). Run \\`zodiac-os pull-contracts\\` to fetch it, or ` +\n        `paste the ABI JSON manually at <abisDir>/${node.chain}/${node.segments.join('/')}.json`\n    )\n  }\n  return new Proxy(\n    {},\n    {\n      get: explain,\n      has: explain,\n    }\n  )\n}\n\nfunction makeAllowContract(\n  address: `0x${string}`,\n  abi: InterfaceAbi\n): Record<string | symbol, any> {\n  const iface = Interface.from(abi)\n  const lowerAddr = address.toLowerCase() as `0x${string}`\n\n  const allowEverything = (options?: Options): TargetPermission => ({\n    targetAddress: lowerAddr,\n    send: options?.send,\n    delegatecall: options?.delegatecall,\n  })\n\n  const has = (name: string) => {\n    try {\n      const fn = iface.getFunction(name)\n      if (!fn) return false\n      return fn.stateMutability !== 'view' && fn.stateMutability !== 'pure'\n    } catch (error) {\n      if (!isError(error as any, 'INVALID_ARGUMENT')) throw error\n      return false\n    }\n  }\n\n  return new Proxy(\n    {},\n    {\n      get: (_target, prop) => {\n        if (prop === EVERYTHING) return allowEverything\n        if (typeof prop !== 'string') return undefined\n        if (!has(prop)) return undefined\n        const fn = iface.getFunction(prop)!\n        return makeAllowFunction(fn, lowerAddr)\n      },\n      has: (_target, prop) => {\n        if (prop === EVERYTHING) return true\n        return typeof prop === 'string' && has(prop)\n      },\n    }\n  )\n}\n\nfunction makeAllowFunction(\n  fn: FunctionFragment,\n  targetAddress: `0x${string}`\n): (...args: any[]) => FunctionPermission {\n  const inputs = fn.inputs\n  return (...args: any[]) => {\n    const scopings = args.slice(0, inputs.length)\n    const hasScopings = scopings.some((s) => s !== undefined && s !== null)\n    const options: Options = args[inputs.length] ?? {}\n    const condition = hasScopings\n      ? c.calldataMatches(scopings, inputs)()\n      : undefined\n    const preset = {\n      targetAddress,\n      signature: fn.format('sighash'),\n      condition,\n    }\n    return applyOptions(coercePermission(preset as any) as any, options)\n  }\n}\n\nconst emptyCalldataMatches: Condition = {\n  paramType: ParameterType.Calldata,\n  operator: Operator.Matches,\n  children: [],\n}\n\nconst applyGlobalAllowance = (\n  condition: Condition | undefined,\n  allowanceCondition: Condition\n): Condition => {\n  const base = condition ?? emptyCalldataMatches\n  if (\n    base.paramType !== ParameterType.Calldata ||\n    base.operator !== Operator.Matches\n  ) {\n    throw new Error(\n      'Global allowance can only be applied to calldata matches nodes'\n    )\n  }\n  return {\n    ...base,\n    children: [...(base.children ?? []), allowanceCondition],\n  }\n}\n\nconst applyOptions = (\n  permission: FunctionPermission & { condition?: Condition },\n  options: Options\n): FunctionPermission => {\n  let condition = permission.condition\n  if (options.etherWithinAllowance) {\n    if (!options.send) {\n      throw new Error(\n        '`etherWithinAllowance` can only be used if `send` is allowed'\n      )\n    }\n    condition = applyGlobalAllowance(condition, {\n      paramType: ParameterType.None,\n      operator: Operator.EtherWithinAllowance,\n      compValue: options.etherWithinAllowance,\n    })\n  }\n  if (options.callWithinAllowance) {\n    condition = applyGlobalAllowance(condition, {\n      paramType: ParameterType.None,\n      operator: Operator.CallWithinAllowance,\n      compValue: options.callWithinAllowance,\n    })\n  }\n  return {\n    ...permission,\n    send: options.send,\n    delegatecall: options.delegatecall,\n    condition,\n  }\n}\n"],"mappings":";;;;;AAoDA,MAAa,aAAa,OAAO,IAAI,kCAAkC;;;ACzCvE,SAAgB,cACd,SACA,iBACqB;CACrB,MAAM,MAA2B,EAAE;AACnC,MAAK,MAAM,QAAQ,cAAc,gBAAgB,EAAE;EACjD,MAAM,MAAM,QAAQ,SAAS,KAAK;AAClC,MAAI,CAAC,KAAK;AAGR,YAAS,KAAK,CAAC,KAAK,OAAO,GAAG,KAAK,SAAS,EAAE,gBAAgB,KAAK,CAAC;AACpE;;AAEF,WACE,KACA,CAAC,KAAK,OAAO,GAAG,KAAK,SAAS,EAC9B,kBAAkB,KAAK,SAAS,IAAoB,CACrD;;AAEH,QAAO;;AAGT,SAAS,SAAS,MAA2B,UAAoB,OAAY;CAC3E,IAAI,SAAS;AACb,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,GAAG,KAAK;EAC5C,MAAM,MAAM,SAAS;AACrB,MAAI,EAAE,OAAO,QAAS,QAAO,OAAO,EAAE;AACtC,WAAS,OAAO;;AAElB,QAAO,SAAS,SAAS,SAAS,MAAO;;AAG3C,SAAS,gBAAgB,MAAoB;CAC3C,MAAM,gBAAgB;AACpB,QAAM,IAAI,MACR,mBAAmB,KAAK,MAAM,GAAG,KAAK,SAAS,KAAK,IAAI,CAAC,IACnD,KAAK,QAAQ,+FAC2B,KAAK,MAAM,GAAG,KAAK,SAAS,KAAK,IAAI,CAAC,OACrF;;AAEH,QAAO,IAAI,MACT,EAAE,EACF;EACE,KAAK;EACL,KAAK;EACN,CACF;;AAGH,SAAS,kBACP,SACA,KAC8B;CAC9B,MAAM,QAAQ,UAAU,KAAK,IAAI;CACjC,MAAM,YAAY,QAAQ,aAAa;CAEvC,MAAM,mBAAmB,aAAyC;EAChE,eAAe;EACf,MAAM,SAAS;EACf,cAAc,SAAS;EACxB;CAED,MAAM,OAAO,SAAiB;AAC5B,MAAI;GACF,MAAM,KAAK,MAAM,YAAY,KAAK;AAClC,OAAI,CAAC,GAAI,QAAO;AAChB,UAAO,GAAG,oBAAoB,UAAU,GAAG,oBAAoB;WACxD,OAAO;AACd,OAAI,CAAC,QAAQ,OAAc,mBAAmB,CAAE,OAAM;AACtD,UAAO;;;AAIX,QAAO,IAAI,MACT,EAAE,EACF;EACE,MAAM,SAAS,SAAS;AACtB,OAAI,SAAS,WAAY,QAAO;AAChC,OAAI,OAAO,SAAS,SAAU,QAAO,KAAA;AACrC,OAAI,CAAC,IAAI,KAAK,CAAE,QAAO,KAAA;AAEvB,UAAO,kBADI,MAAM,YAAY,KACF,EAAE,UAAU;;EAEzC,MAAM,SAAS,SAAS;AACtB,OAAI,SAAS,WAAY,QAAO;AAChC,UAAO,OAAO,SAAS,YAAY,IAAI,KAAK;;EAE/C,CACF;;AAGH,SAAS,kBACP,IACA,eACwC;CACxC,MAAM,SAAS,GAAG;AAClB,SAAQ,GAAG,SAAgB;EACzB,MAAM,WAAW,KAAK,MAAM,GAAG,OAAO,OAAO;EAC7C,MAAM,cAAc,SAAS,MAAM,MAAM,MAAM,KAAA,KAAa,MAAM,KAAK;EACvE,MAAM,UAAmB,KAAK,OAAO,WAAW,EAAE;EAClD,MAAM,YAAY,cACd,EAAE,gBAAgB,UAAU,OAAO,EAAE,GACrC,KAAA;AAMJ,SAAO,aAAa,iBAAiB;GAJnC;GACA,WAAW,GAAG,OAAO,UAAU;GAC/B;GAEyC,CAAQ,EAAS,QAAQ;;;AAIxE,MAAM,uBAAkC;CACtC,WAAW,cAAc;CACzB,UAAU,SAAS;CACnB,UAAU,EAAE;CACb;AAED,MAAM,wBACJ,WACA,uBACc;CACd,MAAM,OAAO,aAAa;AAC1B,KACE,KAAK,cAAc,cAAc,YACjC,KAAK,aAAa,SAAS,QAE3B,OAAM,IAAI,MACR,iEACD;AAEH,QAAO;EACL,GAAG;EACH,UAAU,CAAC,GAAI,KAAK,YAAY,EAAE,EAAG,mBAAmB;EACzD;;AAGH,MAAM,gBACJ,YACA,YACuB;CACvB,IAAI,YAAY,WAAW;AAC3B,KAAI,QAAQ,sBAAsB;AAChC,MAAI,CAAC,QAAQ,KACX,OAAM,IAAI,MACR,+DACD;AAEH,cAAY,qBAAqB,WAAW;GAC1C,WAAW,cAAc;GACzB,UAAU,SAAS;GACnB,WAAW,QAAQ;GACpB,CAAC;;AAEJ,KAAI,QAAQ,oBACV,aAAY,qBAAqB,WAAW;EAC1C,WAAW,cAAc;EACzB,UAAU,SAAS;EACnB,WAAW,QAAQ;EACpB,CAAC;AAEJ,QAAO;EACL,GAAG;EACH,MAAM,QAAQ;EACd,cAAc,QAAQ;EACtB;EACD"}

package/dist/{api-D6ee2Q2b.mjs → api-CygEDU4N.mjs}

@@ -1,16 +1,47 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
 import assert from "assert";
+//#region src/paths.ts
+/**
+* Resolve the project's `.zodiac/` directory — the shared home for SDK
+* codegen (`pull-org` emits the importable module here, `pull-contracts`
+* writes `allow.d.ts` alongside it).
+*
+* Pass `rootDir` to anchor explicitly (CLI commands do this using the
+* directory of the loaded `zodiac.config.ts`). Without a `rootDir`, walks
+* up from `cwd` to the nearest `zodiac.config.{ts,js,mjs,cjs}` so runtime
+* callers like `constellation()` work even when invoked from a subdirectory.
+*/
+function resolveZodiacDir(rootDir) {
+	return join(rootDir ?? findProjectRoot(), ".zodiac");
+}
+const CONFIG_FILENAMES = [
+	"zodiac.config.ts",
+	"zodiac.config.js",
+	"zodiac.config.mjs",
+	"zodiac.config.cjs"
+];
+function findProjectRoot() {
+	let dir = process.cwd();
+	while (dir !== dirname(dir)) {
+		if (CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)))) return dir;
+		dir = dirname(dir);
+	}
+	return process.cwd();
+}
+//#endregion
 //#region src/api.ts
-const { ZODIAC_OS_API_KEY, ZODIAC_OS_API_URL = "https://app.zodiac.eco/api/v1" } = process.env;
+const { ZODIAC_API_KEY, ZODIAC_API_URL = "https://app.zodiac.eco/api/v1" } = process.env;
 var ApiClient = class {
 	apiKey;
 	baseUrl;
 	_fetch;
 	headers;
-	constructor({ baseUrl = ZODIAC_OS_API_URL, fetch: customFetch = fetch, headers = {}, apiKey = ZODIAC_OS_API_KEY } = {}) {
+	constructor({ baseUrl = ZODIAC_API_URL, fetch: customFetch = fetch, headers = {}, apiKey = ZODIAC_API_KEY } = {}) {
 		this.baseUrl = baseUrl.replace(/\/$/, "");
 		this._fetch = customFetch;
 		this.headers = headers;
-		assert(apiKey, "No API key provided to the API client. Either pass it as the \"apiKey\" option or set the ZODIAC_OS_API_KEY environment variable.");
+		assert(apiKey, "No API key provided to the API client. Either pass it as the \"apiKey\" option or set the ZODIAC_API_KEY environment variable.");
 		this.apiKey = apiKey;
 	}
 	async postJson(endpoint, payload) {
@@ -34,8 +65,8 @@ var ApiClient = class {
 		if (!res.ok) await handleApiError(res);
 		return res.json();
 	}
-	listVaults() {
-		return this.get("vaults");
+	listAccounts() {
+		return this.get("accounts");
 	}
 	listUsers() {
 		return this.get("users");
@@ -97,7 +128,7 @@ async function handleApiError(response) {
 			});
 		}
 		throw error;
-	} else throw new ApiRequestError(await response.text() || "Unexpected error", {
+	} else throw new ApiRequestError(`${response.status} ${response.statusText}: ${response.url}`, {
 		status: response.status,
 		statusText: response.statusText
 	});
@@ -108,6 +139,6 @@ const jsonStringify = (value, indent) => JSON.stringify(value, (_, value) => {
 	return value;
 }, indent);
 //#endregion
-export { ApiClient as t };
+export { resolveZodiacDir as n, ApiClient as t };
 
-//# sourceMappingURL=api-D6ee2Q2b.mjs.map
+//# sourceMappingURL=api-CygEDU4N.mjs.map

package/dist/api-CygEDU4N.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-CygEDU4N.mjs","names":[],"sources":["../src/paths.ts","../src/api.ts"],"sourcesContent":["import { existsSync } from 'node:fs'\nimport { dirname, join } from 'node:path'\n\n/**\n * Resolve the project's `.zodiac/` directory — the shared home for SDK\n * codegen (`pull-org` emits the importable module here, `pull-contracts`\n * writes `allow.d.ts` alongside it).\n *\n * Pass `rootDir` to anchor explicitly (CLI commands do this using the\n * directory of the loaded `zodiac.config.ts`). Without a `rootDir`, walks\n * up from `cwd` to the nearest `zodiac.config.{ts,js,mjs,cjs}` so runtime\n * callers like `constellation()` work even when invoked from a subdirectory.\n */\nexport function resolveZodiacDir(rootDir?: string): string {\n  return join(rootDir ?? findProjectRoot(), '.zodiac')\n}\n\nconst CONFIG_FILENAMES = [\n  'zodiac.config.ts',\n  'zodiac.config.js',\n  'zodiac.config.mjs',\n  'zodiac.config.cjs',\n]\n\nfunction findProjectRoot(): string {\n  let dir = process.cwd()\n  while (dir !== dirname(dir)) {\n    if (CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)))) return dir\n    dir = dirname(dir)\n  }\n  return process.cwd()\n}\n","import type {\n  ApplyConstellationPayload,\n  ApplyConstellationResult,\n  ResolveConstellationPayload,\n  ResolveConstellationResult,\n  ApiError as ApiErrorResponse,\n  ListAccountsResult,\n  ListUsersResult,\n} from '@zodiac-os/api-types'\nimport assert from 'assert'\nimport { UUID } from 'crypto'\n\nexport type Options = {\n  workspace?: string\n  apiKey?: string\n  baseUrl?: string\n  fetch?: typeof globalThis.fetch\n  headers?: Record<string, string>\n}\n\nconst { ZODIAC_API_KEY, ZODIAC_API_URL = 'https://app.zodiac.eco/api/v1' } =\n  process.env\n\nexport class ApiClient {\n  private apiKey: string\n  private baseUrl: string\n  private _fetch: typeof fetch\n  private headers: Record<string, string>\n\n  constructor({\n    baseUrl = ZODIAC_API_URL,\n    fetch: customFetch = fetch,\n    headers = {},\n    apiKey = ZODIAC_API_KEY,\n  }: Options = {}) {\n    this.baseUrl = baseUrl.replace(/\\/$/, '')\n    this._fetch = customFetch\n    this.headers = headers\n\n    assert(\n      apiKey,\n      'No API key provided to the API client. Either pass it as the \"apiKey\" option or set the ZODIAC_API_KEY environment variable.'\n    )\n\n    this.apiKey = apiKey\n  }\n\n  protected async postJson(endpoint: string, payload: unknown) {\n    const res = await this._fetch(`${this.baseUrl}/${endpoint}`, {\n      method: 'POST',\n      headers: {\n        ...this.headers,\n        'content-type': 'application/json',\n        authorization: `Bearer ${this.apiKey}`,\n      },\n      body: jsonStringify(payload),\n    })\n    if (!res.ok) {\n      await handleApiError(res)\n    }\n\n    return res.json()\n  }\n\n  protected async get(endpoint: string) {\n    const res = await this._fetch(`${this.baseUrl}/${endpoint}`, {\n      headers: { ...this.headers, authorization: `Bearer ${this.apiKey}` },\n    })\n\n    if (!res.ok) {\n      await handleApiError(res)\n    }\n\n    return res.json()\n  }\n\n  listAccounts(): Promise<ListAccountsResult> {\n    return this.get('accounts')\n  }\n\n  listUsers(): Promise<ListUsersResult> {\n    return this.get('users')\n  }\n\n  /**\n   * Applies an accounts specification to Zodiac OS.\n   */\n  applyConstellation(\n    workspaceId: UUID,\n    payload: ApplyConstellationPayload\n  ): Promise<ApplyConstellationResult> {\n    return this.postJson(\n      `workspace/${workspaceId}/constellation/apply`,\n      payload\n    )\n  }\n\n  /**\n   * Resolves an accounts specification to Zodiac OS.\n   */\n  resolveConstellation(\n    workspaceId: UUID,\n    payload: ResolveConstellationPayload\n  ): Promise<ResolveConstellationResult> {\n    return this.postJson(\n      `workspace/${workspaceId}/constellation/resolve`,\n      payload\n    )\n  }\n}\n\nexport class ApiRequestError extends Error {\n  public readonly status: number\n  public readonly statusText: string\n  public readonly details?: unknown\n\n  constructor(\n    message: string,\n    opts: {\n      status: number\n      statusText: string\n      details?: unknown\n      cause?: unknown\n    }\n  ) {\n    super(ApiRequestError.composeMessage(message, opts.details))\n    this.name = 'ApiRequestError'\n    this.status = opts.status\n    this.statusText = opts.statusText\n    this.details = opts.details\n    if (opts.cause !== undefined) {\n      ;(this as any).cause = opts.cause\n    }\n  }\n\n  private static composeMessage(message: string, details?: unknown) {\n    if (details == null) return message\n    let detailsString: string\n    try {\n      detailsString =\n        typeof details === 'string' ? details : jsonStringify(details, 2)\n    } catch (_err) {\n      detailsString = String(details)\n    }\n    return `${message}\\nDetails: ${detailsString}`\n  }\n\n  toString() {\n    return `${this.name}: ${this.message}`\n  }\n}\n\nasync function handleApiError(response: Response): Promise<never> {\n  const contentType = response.headers.get('content-type')\n  if (contentType?.includes('application/json')) {\n    const errorData = (await response.json()) as ApiErrorResponse\n    let error: ApiRequestError\n    try {\n      error = new ApiRequestError(errorData.error.message, {\n        status: response.status,\n        statusText: response.statusText,\n        details: errorData.error.details,\n      })\n    } catch (jsonShapeError) {\n      error = new ApiRequestError(\n        `Failed parsing error response: ${jsonShapeError}`,\n        {\n          status: response.status,\n          statusText: response.statusText,\n          details: errorData,\n        }\n      )\n    }\n    throw error\n  } else {\n    throw new ApiRequestError(\n      `${response.status} ${response.statusText}: ${response.url}`,\n      {\n        status: response.status,\n        statusText: response.statusText,\n      }\n    )\n  }\n}\n\n/** JSON.stringify with bigint support */\nconst jsonStringify = (value: unknown, indent?: number) =>\n  JSON.stringify(\n    value,\n    (_, value) => {\n      if (typeof value === 'bigint') {\n        return value.toString()\n      }\n\n      return value\n    },\n    indent\n  )\n"],"mappings":";;;;;;;;;;;;;;AAaA,SAAgB,iBAAiB,SAA0B;AACzD,QAAO,KAAK,WAAW,iBAAiB,EAAE,UAAU;;AAGtD,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACD;AAED,SAAS,kBAA0B;CACjC,IAAI,MAAM,QAAQ,KAAK;AACvB,QAAO,QAAQ,QAAQ,IAAI,EAAE;AAC3B,MAAI,iBAAiB,MAAM,SAAS,WAAW,KAAK,KAAK,KAAK,CAAC,CAAC,CAAE,QAAO;AACzE,QAAM,QAAQ,IAAI;;AAEpB,QAAO,QAAQ,KAAK;;;;ACVtB,MAAM,EAAE,gBAAgB,iBAAiB,oCACvC,QAAQ;AAEV,IAAa,YAAb,MAAuB;CACrB;CACA;CACA;CACA;CAEA,YAAY,EACV,UAAU,gBACV,OAAO,cAAc,OACrB,UAAU,EAAE,EACZ,SAAS,mBACE,EAAE,EAAE;AACf,OAAK,UAAU,QAAQ,QAAQ,OAAO,GAAG;AACzC,OAAK,SAAS;AACd,OAAK,UAAU;AAEf,SACE,QACA,iIACD;AAED,OAAK,SAAS;;CAGhB,MAAgB,SAAS,UAAkB,SAAkB;EAC3D,MAAM,MAAM,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,YAAY;GAC3D,QAAQ;GACR,SAAS;IACP,GAAG,KAAK;IACR,gBAAgB;IAChB,eAAe,UAAU,KAAK;IAC/B;GACD,MAAM,cAAc,QAAQ;GAC7B,CAAC;AACF,MAAI,CAAC,IAAI,GACP,OAAM,eAAe,IAAI;AAG3B,SAAO,IAAI,MAAM;;CAGnB,MAAgB,IAAI,UAAkB;EACpC,MAAM,MAAM,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,YAAY,EAC3D,SAAS;GAAE,GAAG,KAAK;GAAS,eAAe,UAAU,KAAK;GAAU,EACrE,CAAC;AAEF,MAAI,CAAC,IAAI,GACP,OAAM,eAAe,IAAI;AAG3B,SAAO,IAAI,MAAM;;CAGnB,eAA4C;AAC1C,SAAO,KAAK,IAAI,WAAW;;CAG7B,YAAsC;AACpC,SAAO,KAAK,IAAI,QAAQ;;;;;CAM1B,mBACE,aACA,SACmC;AACnC,SAAO,KAAK,SACV,aAAa,YAAY,uBACzB,QACD;;;;;CAMH,qBACE,aACA,SACqC;AACrC,SAAO,KAAK,SACV,aAAa,YAAY,yBACzB,QACD;;;AAIL,IAAa,kBAAb,MAAa,wBAAwB,MAAM;CACzC;CACA;CACA;CAEA,YACE,SACA,MAMA;AACA,QAAM,gBAAgB,eAAe,SAAS,KAAK,QAAQ,CAAC;AAC5D,OAAK,OAAO;AACZ,OAAK,SAAS,KAAK;AACnB,OAAK,aAAa,KAAK;AACvB,OAAK,UAAU,KAAK;AACpB,MAAI,KAAK,UAAU,KAAA,EACf,MAAa,QAAQ,KAAK;;CAIhC,OAAe,eAAe,SAAiB,SAAmB;AAChE,MAAI,WAAW,KAAM,QAAO;EAC5B,IAAI;AACJ,MAAI;AACF,mBACE,OAAO,YAAY,WAAW,UAAU,cAAc,SAAS,EAAE;WAC5D,MAAM;AACb,mBAAgB,OAAO,QAAQ;;AAEjC,SAAO,GAAG,QAAQ,aAAa;;CAGjC,WAAW;AACT,SAAO,GAAG,KAAK,KAAK,IAAI,KAAK;;;AAIjC,eAAe,eAAe,UAAoC;AAEhE,KADoB,SAAS,QAAQ,IAAI,eAC1B,EAAE,SAAS,mBAAmB,EAAE;EAC7C,MAAM,YAAa,MAAM,SAAS,MAAM;EACxC,IAAI;AACJ,MAAI;AACF,WAAQ,IAAI,gBAAgB,UAAU,MAAM,SAAS;IACnD,QAAQ,SAAS;IACjB,YAAY,SAAS;IACrB,SAAS,UAAU,MAAM;IAC1B,CAAC;WACK,gBAAgB;AACvB,WAAQ,IAAI,gBACV,kCAAkC,kBAClC;IACE,QAAQ,SAAS;IACjB,YAAY,SAAS;IACrB,SAAS;IACV,CACF;;AAEH,QAAM;OAEN,OAAM,IAAI,gBACR,GAAG,SAAS,OAAO,GAAG,SAAS,WAAW,IAAI,SAAS,OACvD;EACE,QAAQ,SAAS;EACjB,YAAY,SAAS;EACtB,CACF;;;AAKL,MAAM,iBAAiB,OAAgB,WACrC,KAAK,UACH,QACC,GAAG,UAAU;AACZ,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,UAAU;AAGzB,QAAO;GAET,OACD"}

package/dist/cli/config.d.mts

@@ -14,10 +14,15 @@ interface ZodiacConfig {
   contracts?: Contracts;
   /**
    * Directory where fetched ABIs are stored and read from.
-   * Resolved relative to the project root (cwd). Defaults to `./abis`.
+   * Resolved relative to the project root (config file's directory).
+   * Defaults to `./abis`.
    */
   abisDir?: string;
 }
+/** User-provided config plus the directory it was loaded from. */
+interface ResolvedConfig extends ZodiacConfig {
+  rootDir: string;
+}
 /**
  * Loose base used as the *inference* constraint for `defineConfig`.
  * `contracts` is `Record<string, unknown>` here so `const T` can preserve the
@@ -38,9 +43,9 @@ type ValidateContracts<C> = { [K in keyof C]: C[K] extends `0x${string}` ? C[K]
 declare const defineConfig: <const T extends DefineConfigInput>(config: T & {
   contracts?: ValidateContracts<NonNullable<T["contracts"]>>;
 }) => T;
-declare function loadConfig(configPath?: string): Promise<ZodiacConfig>;
+declare function loadConfig(configPath?: string): Promise<ResolvedConfig>;
 declare const DEFAULT_ABIS_DIR = "abis";
-declare function resolveAbisDir(config: ZodiacConfig): string;
+declare function resolveAbisDir(config: ResolvedConfig): string;
 //#endregion
-export { Contracts, ContractsNode, DEFAULT_ABIS_DIR, ZodiacConfig, defineConfig, loadConfig, resolveAbisDir };
+export { Contracts, ContractsNode, DEFAULT_ABIS_DIR, ResolvedConfig, ZodiacConfig, defineConfig, loadConfig, resolveAbisDir };
 //# sourceMappingURL=config.d.mts.map

package/dist/cli/config.mjs

@@ -1,5 +1,5 @@
 import { pathToFileURL } from "url";
-import { resolve } from "path";
+import { dirname, resolve } from "path";
 //#region src/cli/config.ts
 const defineConfig = (config) => config;
 const DEFAULT_CONFIG_PATH = "zodiac.config.ts";
@@ -15,11 +15,14 @@ async function loadConfig(configPath = DEFAULT_CONFIG_PATH) {
 	const config = mod.default ?? mod.config;
 	if (!config) throw new Error(`Config file must export a default value or a named "config" export: ${absolutePath}`);
 	if (!config.apiKey) throw new Error(`Config is missing required field "apiKey"`);
-	return config;
+	return {
+		...config,
+		rootDir: dirname(absolutePath)
+	};
 }
 const DEFAULT_ABIS_DIR = "abis";
 function resolveAbisDir(config) {
-	return resolve(process.cwd(), config.abisDir ?? "abis");
+	return resolve(config.rootDir, config.abisDir ?? "abis");
 }
 //#endregion
 export { DEFAULT_ABIS_DIR, defineConfig, loadConfig, resolveAbisDir };

package/dist/cli/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../../src/cli/config.ts"],"sourcesContent":["import { pathToFileURL } from 'url'\nimport { resolve } from 'path'\n\nexport type Contracts = {\n  [chain: string]: ContractsNode\n}\nexport type ContractsNode = `0x${string}` | { [name: string]: ContractsNode }\n\nexport interface ZodiacConfig {\n  apiKey: `zodiac_${string}`\n  /**\n   * Contracts the `allow` kit should know about, keyed by chain prefix.\n   * Nested objects are allowed for grouping related addresses.\n   */\n  contracts?: Contracts\n  /**\n   * Directory where fetched ABIs are stored and read from.\n   * Resolved relative to the project root (cwd). Defaults to `./abis`.\n   */\n  abisDir?: string\n}\n\n/**\n * Loose base used as the *inference* constraint for `defineConfig`.\n * `contracts` is `Record<string, unknown>` here so `const T` can preserve the\n * caller's exact address literals rather than collapsing them into the\n * recursive `ContractsNode` union.\n */\ntype DefineConfigInput = {\n  apiKey: `zodiac_${string}`\n  contracts?: Record<string, unknown>\n  abisDir?: string\n}\n\n/**\n * Recursive leaf-level check: every leaf in `contracts` must be\n * `` `0x${string}` ``; any other value collapses the branch to `never`,\n * which surfaces as a type error at the call site.\n */\ntype ValidateContracts<C> = {\n  [K in keyof C]: C[K] extends `0x${string}`\n    ? C[K]\n    : C[K] extends object\n      ? ValidateContracts<C[K]>\n      : never\n}\n\nexport const defineConfig = <const T extends DefineConfigInput>(\n  config: T & {\n    contracts?: ValidateContracts<NonNullable<T['contracts']>>\n  }\n): T => config\n\nconst DEFAULT_CONFIG_PATH = 'zodiac.config.ts'\n\nexport async function loadConfig(\n  configPath: string = DEFAULT_CONFIG_PATH\n): Promise<ZodiacConfig> {\n  const absolutePath = resolve(process.cwd(), configPath)\n\n  let mod: Record<string, unknown>\n  try {\n    mod = await import(pathToFileURL(absolutePath).href)\n  } catch (error: any) {\n    if (error?.code === 'ERR_MODULE_NOT_FOUND' || error?.code === 'ENOENT') {\n      throw new Error(`Config file not found: ${absolutePath}`)\n    }\n    throw error\n  }\n\n  const config = (mod.default ?? mod.config) as ZodiacConfig | undefined\n  if (!config) {\n    throw new Error(\n      `Config file must export a default value or a named \"config\" export: ${absolutePath}`\n    )\n  }\n\n  if (!config.apiKey) {\n    throw new Error(`Config is missing required field \"apiKey\"`)\n  }\n\n  return config\n}\n\nexport const DEFAULT_ABIS_DIR = 'abis'\n\nexport function resolveAbisDir(config: ZodiacConfig): string {\n  return resolve(process.cwd(), config.abisDir ?? DEFAULT_ABIS_DIR)\n}\n"],"mappings":";;;AA+CA,MAAa,gBACX,WAGM;AAER,MAAM,sBAAsB;AAE5B,eAAsB,WACpB,aAAqB,qBACE;CACvB,MAAM,eAAe,QAAQ,QAAQ,KAAK,EAAE,WAAW;CAEvD,IAAI;AACJ,KAAI;AACF,QAAM,MAAM,OAAO,cAAc,aAAa,CAAC;UACxC,OAAY;AACnB,MAAI,OAAO,SAAS,0BAA0B,OAAO,SAAS,SAC5D,OAAM,IAAI,MAAM,0BAA0B,eAAe;AAE3D,QAAM;;CAGR,MAAM,SAAU,IAAI,WAAW,IAAI;AACnC,KAAI,CAAC,OACH,OAAM,IAAI,MACR,uEAAuE,eACxE;AAGH,KAAI,CAAC,OAAO,OACV,OAAM,IAAI,MAAM,4CAA4C;AAG9D,QAAO;;AAGT,MAAa,mBAAmB;AAEhC,SAAgB,eAAe,QAA8B;AAC3D,QAAO,QAAQ,QAAQ,KAAK,EAAE,OAAO,WAAA,OAA4B"}
+{"version":3,"file":"config.mjs","names":[],"sources":["../../src/cli/config.ts"],"sourcesContent":["import { pathToFileURL } from 'url'\nimport { dirname, resolve } from 'path'\n\nexport type Contracts = {\n  [chain: string]: ContractsNode\n}\nexport type ContractsNode = `0x${string}` | { [name: string]: ContractsNode }\n\nexport interface ZodiacConfig {\n  apiKey: `zodiac_${string}`\n  /**\n   * Contracts the `allow` kit should know about, keyed by chain prefix.\n   * Nested objects are allowed for grouping related addresses.\n   */\n  contracts?: Contracts\n  /**\n   * Directory where fetched ABIs are stored and read from.\n   * Resolved relative to the project root (config file's directory).\n   * Defaults to `./abis`.\n   */\n  abisDir?: string\n}\n\n/** User-provided config plus the directory it was loaded from. */\nexport interface ResolvedConfig extends ZodiacConfig {\n  rootDir: string\n}\n\n/**\n * Loose base used as the *inference* constraint for `defineConfig`.\n * `contracts` is `Record<string, unknown>` here so `const T` can preserve the\n * caller's exact address literals rather than collapsing them into the\n * recursive `ContractsNode` union.\n */\ntype DefineConfigInput = {\n  apiKey: `zodiac_${string}`\n  contracts?: Record<string, unknown>\n  abisDir?: string\n}\n\n/**\n * Recursive leaf-level check: every leaf in `contracts` must be\n * `` `0x${string}` ``; any other value collapses the branch to `never`,\n * which surfaces as a type error at the call site.\n */\ntype ValidateContracts<C> = {\n  [K in keyof C]: C[K] extends `0x${string}`\n    ? C[K]\n    : C[K] extends object\n      ? ValidateContracts<C[K]>\n      : never\n}\n\nexport const defineConfig = <const T extends DefineConfigInput>(\n  config: T & {\n    contracts?: ValidateContracts<NonNullable<T['contracts']>>\n  }\n): T => config\n\nconst DEFAULT_CONFIG_PATH = 'zodiac.config.ts'\n\nexport async function loadConfig(\n  configPath: string = DEFAULT_CONFIG_PATH\n): Promise<ResolvedConfig> {\n  const absolutePath = resolve(process.cwd(), configPath)\n\n  let mod: Record<string, unknown>\n  try {\n    mod = await import(pathToFileURL(absolutePath).href)\n  } catch (error: any) {\n    if (error?.code === 'ERR_MODULE_NOT_FOUND' || error?.code === 'ENOENT') {\n      throw new Error(`Config file not found: ${absolutePath}`)\n    }\n    throw error\n  }\n\n  const config = (mod.default ?? mod.config) as ZodiacConfig | undefined\n  if (!config) {\n    throw new Error(\n      `Config file must export a default value or a named \"config\" export: ${absolutePath}`\n    )\n  }\n\n  if (!config.apiKey) {\n    throw new Error(`Config is missing required field \"apiKey\"`)\n  }\n\n  return { ...config, rootDir: dirname(absolutePath) }\n}\n\nexport const DEFAULT_ABIS_DIR = 'abis'\n\nexport function resolveAbisDir(config: ResolvedConfig): string {\n  return resolve(config.rootDir, config.abisDir ?? DEFAULT_ABIS_DIR)\n}\n"],"mappings":";;;AAqDA,MAAa,gBACX,WAGM;AAER,MAAM,sBAAsB;AAE5B,eAAsB,WACpB,aAAqB,qBACI;CACzB,MAAM,eAAe,QAAQ,QAAQ,KAAK,EAAE,WAAW;CAEvD,IAAI;AACJ,KAAI;AACF,QAAM,MAAM,OAAO,cAAc,aAAa,CAAC;UACxC,OAAY;AACnB,MAAI,OAAO,SAAS,0BAA0B,OAAO,SAAS,SAC5D,OAAM,IAAI,MAAM,0BAA0B,eAAe;AAE3D,QAAM;;CAGR,MAAM,SAAU,IAAI,WAAW,IAAI;AACnC,KAAI,CAAC,OACH,OAAM,IAAI,MACR,uEAAuE,eACxE;AAGH,KAAI,CAAC,OAAO,OACV,OAAM,IAAI,MAAM,4CAA4C;AAG9D,QAAO;EAAE,GAAG;EAAQ,SAAS,QAAQ,aAAa;EAAE;;AAGtD,MAAa,mBAAmB;AAEhC,SAAgB,eAAe,QAAgC;AAC7D,QAAO,QAAQ,OAAO,SAAS,OAAO,WAAA,OAA4B"}

package/dist/cli.mjs

@@ -1,30 +1,15 @@
 #!/usr/bin/env node
-import { t as ApiClient } from "./api-D6ee2Q2b.mjs";
+import { n as resolveZodiacDir, t as ApiClient } from "./api-CygEDU4N.mjs";
 import { a as walkContracts, i as readAbi, n as chainIdFor, o as writeAbi, r as abiFilePath } from "./networks-BTW1qAAa.mjs";
 import { loadConfig, resolveAbisDir } from "./cli/config.mjs";
-import { invariant } from "@epic-web/invariant";
 import fs from "node:fs";
-import path, { join } from "node:path";
+import path from "node:path";
+import { invariant } from "@epic-web/invariant";
+import { getAddress } from "ethers";
 import { Command } from "commander";
 import { join as join$1 } from "path";
 import { ModuleKind, Project, ScriptTarget, VariableDeclarationKind } from "ts-morph";
 import { mkdirSync, writeFileSync } from "fs";
-import { fileURLToPath } from "node:url";
-//#region src/cli/paths.ts
-/**
-* Resolve the consumer's `node_modules/.zodiac-os/` directory — the shared
-* home for SDK codegen (`pull-org` emits the importable module here,
-* `pull-contracts` writes `allow.d.ts` alongside it).
-*
-* Prefers walking up from this module's own path when the SDK is installed
-* under a real `node_modules`; falls back to `<cwd>/node_modules` when the
-* SDK is being run from source (dev / linked builds).
-*/
-function resolveZodiacOsDir() {
-	const match = fileURLToPath(import.meta.url).match(/^(.+[/\\]node_modules)[/\\]/);
-	return join(match ? match[1] : join(process.cwd(), "node_modules"), ".zodiac-os");
-}
-//#endregion
 //#region src/cli/commands/pullOrg.ts
 const toLiteral = (value, indent = 0) => {
 	const pad = "  ".repeat(indent);
@@ -46,34 +31,65 @@ const toLiteral = (value, indent = 0) => {
 };
 const pullOrg = async (config) => {
 	const client = new ApiClient({ apiKey: config.apiKey });
-	const [users, workspaceVaults] = await Promise.all([client.listUsers(), client.listVaults()]);
-	const allRawVaults = workspaceVaults.flatMap((ws) => ws.vaults);
-	const { result: accounts } = await client.resolveConstellation(workspaceVaults[0].workspaceId, { specification: allRawVaults.map((vault) => ({
-		type: "SAFE",
-		chain: vault.chain,
-		address: vault.address
-	})) });
-	let accountIndex = 0;
-	const vaultsRecord = {};
-	for (const ws of workspaceVaults) {
-		const wsVaults = {};
-		for (const vault of ws.vaults) {
-			const account = accounts[accountIndex++];
-			invariant(account.type === "SAFE", `Expected SAFE account for vault ${vault.id}`);
-			wsVaults[vault.label] = {
-				id: vault.id,
-				label: vault.label,
+	const [users, workspaceAccounts] = await Promise.all([client.listUsers(), client.listAccounts()]);
+	const resolvableAccounts = workspaceAccounts.flatMap((ws) => ws.accounts).filter((a) => a.spec != null || a.vault);
+	const resolved = /* @__PURE__ */ new Map();
+	if (resolvableAccounts.length > 0) {
+		const response = await client.resolveConstellation(workspaceAccounts[0].workspaceId, { specification: resolvableAccounts.map((account, i) => account.spec != null ? account.spec : {
+			ref: `vault_${i}`,
+			type: "SAFE",
+			chain: account.chain,
+			address: account.address
+		}) });
+		invariant(response?.result?.length === resolvableAccounts.length, `resolveConstellation returned ${response?.result?.length ?? 0} accounts for ${resolvableAccounts.length} accounts`);
+		resolvableAccounts.forEach((account, i) => {
+			resolved.set(account.id, response.result[i]);
+		});
+	}
+	const accountsRecord = {};
+	for (const ws of workspaceAccounts) {
+		const safes = {};
+		const rolesMods = {};
+		const delays = {};
+		const bucketsByType = {
+			SAFE: safes,
+			ROLES: rolesMods,
+			DELAY: delays
+		};
+		const isNodeType = (type) => type === "SAFE" || type === "ROLES" || type === "DELAY";
+		const labelCountByType = {
+			SAFE: /* @__PURE__ */ new Map(),
+			ROLES: /* @__PURE__ */ new Map(),
+			DELAY: /* @__PURE__ */ new Map()
+		};
+		for (const account of ws.accounts) {
+			if (!isNodeType(account.type)) continue;
+			const counts = labelCountByType[account.type];
+			counts.set(account.label, (counts.get(account.label) ?? 0) + 1);
+		}
+		for (const account of ws.accounts) {
+			if (!isNodeType(account.type)) continue;
+			const onChain = resolved.get(account.id);
+			const key = (labelCountByType[account.type].get(account.label) ?? 0) > 1 ? `${account.label} (${getAddress(account.address)})` : account.label;
+			bucketsByType[account.type][key] = {
+				id: account.id,
+				label: account.label,
 				address: account.address,
-				chain: vault.chain,
-				threshold: account.threshold,
-				owners: [...account.owners],
-				modules: [...account.modules]
+				chain: account.chain,
+				vault: account.vault,
+				...onChain?.type === "SAFE" && {
+					threshold: onChain.threshold,
+					owners: [...onChain.owners],
+					modules: [...onChain.modules]
+				}
 			};
 		}
-		vaultsRecord[ws.workspaceName] = {
+		accountsRecord[ws.workspaceName] = {
 			workspaceId: ws.workspaceId,
 			workspaceName: ws.workspaceName,
-			vaults: wsVaults
+			safes,
+			rolesMods,
+			delays
 		};
 	}
 	const nameCount = /* @__PURE__ */ new Map();
@@ -87,18 +103,17 @@ const pullOrg = async (config) => {
 			personalSafes: user.personalSafes
 		};
 	}
-	const outDir = resolveZodiacOsDir();
+	const outDir = resolveZodiacDir(config.rootDir);
 	mkdirSync(outDir, { recursive: true });
 	writeFileSync(join$1(outDir, "package.json"), JSON.stringify({
-		name: ".zodiac-os",
-		type: "module",
+		type: "commonjs",
 		main: "index.js",
 		types: "index.d.ts"
 	}, null, 2));
 	const sourceFile = new Project({
 		compilerOptions: {
 			declaration: true,
-			module: ModuleKind.ESNext,
+			module: ModuleKind.CommonJS,
 			target: ScriptTarget.ESNext,
 			outDir
 		},
@@ -116,12 +131,24 @@ const pullOrg = async (config) => {
 		isExported: true,
 		declarationKind: VariableDeclarationKind.Const,
 		declarations: [{
-			name: "vaults",
-			initializer: `${toLiteral(vaultsRecord)} as const`
+			name: "accounts",
+			initializer: `${toLiteral(accountsRecord)} as const`
 		}]
 	});
 	const emitResult = sourceFile.getEmitOutput();
-	for (const outputFile of emitResult.getOutputFiles()) writeFileSync(join$1(outDir, outputFile.getFilePath().includes(".d.ts") ? "index.d.ts" : "index.js"), outputFile.getText());
+	for (const outputFile of emitResult.getOutputFiles()) {
+		const fileName = outputFile.getFilePath().includes(".d.ts") ? "index.d.ts" : "index.js";
+		let contents = outputFile.getText();
+		if (fileName === "index.d.ts") contents += `
+declare global {
+    interface ZodiacGeneratedCodegen {
+        users: typeof users;
+        accounts: typeof accounts;
+    }
+}
+`;
+		writeFileSync(join$1(outDir, fileName), contents);
+	}
 };
 //#endregion
 //#region src/allow/fetch.ts
@@ -297,7 +324,7 @@ const pullContracts = async (config) => {
 		return;
 	}
 	const abisDir = resolveAbisDir(config);
-	const generatedFile = path.join(resolveZodiacOsDir(), "allow.d.ts");
+	const generatedFile = path.join(resolveZodiacDir(config.rootDir), "allow.d.ts");
 	let missing = 0;
 	let fetched = 0;
 	let existing = 0;