@zodiaceco/sdk 1.12.1

package/dist/cli/config.d.mts

@@ -0,0 +1,90 @@
+//#region src/cli/config.d.ts
+type Contracts = {
+  [chain: string]: ContractsNode;
+};
+type ContractsNode = `0x${string}` | {
+  [name: string]: ContractsNode;
+};
+interface ZodiacConfig {
+  /**
+   * API key authorizing this directory against a Zodiac org.
+   *
+   * Optional — defaults to `process.env.ZODIAC_API_KEY` (populated by
+   * `zodiac init`). Set this explicitly only when you need to override
+   * the env var from inside the config file.
+   */
+  apiKey?: `zodiac_${string}`;
+  /**
+   * Contracts the `allow` kit should know about, keyed by chain prefix.
+   * Nested objects are allowed for grouping related addresses.
+   */
+  contracts?: Contracts;
+  /**
+   * Directory where fetched ABIs are stored and read from.
+   * Resolved relative to the project root (config file's directory).
+   * Defaults to `./abis`.
+   */
+  abisDir?: string;
+}
+/** User-provided config plus the resolved API key + project root. */
+interface ResolvedConfig extends Omit<ZodiacConfig, 'apiKey'> {
+  apiKey: `zodiac_${string}`;
+  rootDir: string;
+}
+/**
+ * Loose base used as the *inference* constraint for `defineConfig`.
+ * `contracts` is `Record<string, unknown>` here so `const T` can preserve the
+ * caller's exact address literals rather than collapsing them into the
+ * recursive `ContractsNode` union.
+ */
+type DefineConfigInput = {
+  apiKey?: `zodiac_${string}`;
+  contracts?: Record<string, unknown>;
+  abisDir?: string;
+};
+/**
+ * Recursive leaf-level check: every leaf in `contracts` must be
+ * `` `0x${string}` ``; any other value collapses the branch to `never`,
+ * which surfaces as a type error at the call site.
+ */
+type ValidateContracts<C> = { [K in keyof C]: C[K] extends `0x${string}` ? C[K] : C[K] extends object ? ValidateContracts<C[K]> : never };
+declare const defineConfig: <const T extends DefineConfigInput>(config: T & {
+  contracts?: ValidateContracts<NonNullable<T["contracts"]>>;
+}) => T;
+type LoadConfigOptions = {
+  /**
+   * Called when neither `config.apiKey` nor `process.env.ZODIAC_API_KEY` is
+   * set. Receives the resolved project root and must return a freshly minted
+   * API key. Typically wired to the interactive `init()` flow.
+   *
+   * If omitted, `loadConfig` throws when no key is found.
+   */
+  onMissingKey?: (rootDir: string) => Promise<string>;
+  /**
+   * When the config file doesn't exist, write a minimal stub before
+   * loading. Used by the CLI's `pull` commands so first-time setup
+   * works without the user having to scaffold the file themselves.
+   */
+  createIfMissing?: boolean;
+};
+/**
+ * Write a starter `zodiac.config.ts` if no file exists at `absolutePath`.
+ * Returns `true` if a file was written.
+ */
+declare const ensureConfigStub: (absolutePath: string) => boolean;
+declare function loadConfig(configPath?: string, options?: LoadConfigOptions): Promise<ResolvedConfig>;
+declare const DEFAULT_ABIS_DIR = "abis";
+/**
+ * Resolves the absolute path to the ABIs directory. Only `rootDir` (and
+ * optionally `abisDir`) are read, so the parameter is intentionally narrower
+ * than `ResolvedConfig`: userland code can pass `{ ...config, rootDir }`
+ * without first satisfying `apiKey` (normally supplied via the
+ * `ZODIAC_API_KEY` env var at runtime).
+ */
+declare function resolveAbisDir(config: {
+  rootDir: string;
+  abisDir?: string;
+}): string;
+//#endregion
+export { Contracts, ContractsNode, DEFAULT_ABIS_DIR, ResolvedConfig, ZodiacConfig, defineConfig, ensureConfigStub, loadConfig, resolveAbisDir };
+//# sourceMappingURL=config.d.mts.map

package/dist/cli/config.mjs

@@ -0,0 +1,2 @@
+import { a as resolveAbisDir, i as loadConfig, n as defineConfig, r as ensureConfigStub, t as DEFAULT_ABIS_DIR } from "../config-D5ArAp07.mjs";
+export { DEFAULT_ABIS_DIR, defineConfig, ensureConfigStub, loadConfig, resolveAbisDir };

package/dist/cli.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/cli.mjs

@@ -0,0 +1,574 @@
+#!/usr/bin/env node
+import { n as resolveZodiacDir, t as ApiClient } from "./api-C49DoaPC.mjs";
+import { a as walkContracts, i as readAbi, n as chainIdFor, o as writeAbi, r as abiFilePath } from "./networks-BTW1qAAa.mjs";
+import { a as resolveAbisDir, i as loadConfig, o as findProjectRoot, r as ensureConfigStub } from "./config-D5ArAp07.mjs";
+import fs, { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path, { basename, join, resolve } from "node:path";
+import { invariant } from "@epic-web/invariant";
+import { getAddress } from "ethers";
+import { Command } from "commander";
+import { config } from "dotenv";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import open from "open";
+import { join as join$1 } from "path";
+import { ModuleKind, Project, ScriptTarget, VariableDeclarationKind } from "ts-morph";
+import { mkdirSync, writeFileSync as writeFileSync$1 } from "fs";
+//#region src/cli/commands/init.ts
+const DEFAULT_APP_URL = "https://app.zodiac.eco";
+const CALLBACK_TIMEOUT_MS = 300 * 1e3;
+const init = async (options = {}) => {
+	const rootDir = options.rootDir ?? findProjectRoot();
+	const appUrl = (options.appUrl ?? process.env.ZODIAC_APP_URL ?? DEFAULT_APP_URL).replace(/\/$/, "");
+	const label = basename(resolve(rootDir)) || "zodiac-cli";
+	const codeVerifier = randomBytes(32).toString("base64url");
+	const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+	const state = randomBytes(32).toString("base64url");
+	const { port, waitForCode, close } = await startCallbackServer({
+		expectedState: state,
+		appUrl
+	});
+	const callbackUrl = `http://127.0.0.1:${port}/callback`;
+	const authUrl = new URL("/cli-auth", appUrl);
+	authUrl.searchParams.set("callback", callbackUrl);
+	authUrl.searchParams.set("state", state);
+	authUrl.searchParams.set("code_challenge", codeChallenge);
+	authUrl.searchParams.set("label", label);
+	console.log(`Opening ${authUrl} in your browser. Approve the request to receive an API key.`);
+	await open(authUrl.toString());
+	let code;
+	try {
+		code = await waitForCode(CALLBACK_TIMEOUT_MS);
+	} finally {
+		await close();
+	}
+	const apiKey = await exchangeCodeForKey(appUrl, code, codeVerifier);
+	const envPath = join(rootDir, ".env");
+	const apiUrl = `${appUrl}/api/v1`;
+	writeEnv(envPath, {
+		ZODIAC_API_KEY: apiKey,
+		ZODIAC_API_URL: apiUrl
+	});
+	process.env.ZODIAC_API_KEY = apiKey;
+	process.env.ZODIAC_API_URL = apiUrl;
+	console.log(`✅ API key written to ${envPath}`);
+	const configPath = join(rootDir, "zodiac.config.ts");
+	if (ensureConfigStub(configPath)) console.log(`✅ Created ${configPath}`);
+	return apiKey;
+};
+const exchangeCodeForKey = async (appUrl, code, codeVerifier) => {
+	const response = await fetch(`${appUrl}/cli-auth/exchange`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			code,
+			code_verifier: codeVerifier
+		})
+	});
+	if (!response.ok) {
+		let detail = "";
+		try {
+			const body = await response.json();
+			detail = body.error ? `: ${body.error}` : "";
+		} catch {}
+		throw new Error(`Failed to exchange auth code (${response.status})${detail}`);
+	}
+	const { key } = await response.json();
+	if (typeof key !== "string" || !key.startsWith("zodiac_")) throw new Error("Exchange endpoint returned an unexpected response (missing or malformed key)");
+	return key;
+};
+const startCallbackServer = async ({ expectedState, appUrl }) => {
+	let resolveCode = () => {};
+	let rejectCode = () => {};
+	const codePromise = new Promise((res, rej) => {
+		resolveCode = res;
+		rejectCode = rej;
+	});
+	const handler = (req, res) => {
+		if (req.method !== "GET" || !req.url?.startsWith("/callback")) {
+			res.statusCode = 404;
+			res.end();
+			return;
+		}
+		const url = new URL(req.url, `http://127.0.0.1`);
+		const code = url.searchParams.get("code");
+		if (url.searchParams.get("state") !== expectedState) {
+			respondHtml(res, 403, renderHtml("Mismatched state", `<p>This callback didn't match the running <code>zodiac init</code> session. You can close this tab.</p>`));
+			return;
+		}
+		if (typeof code !== "string" || code.length === 0) {
+			respondHtml(res, 400, renderHtml("Missing code", `<p>The callback URL didn't include an auth <code>code</code>. Please re-run <code>zodiac init</code>.</p>`));
+			return;
+		}
+		respondHtml(res, 200, renderHtml("Authorized", `<p>Your CLI now has its API key. You can close this tab and return to your terminal.</p>
+         <p><a href="${escapeHtml(appUrl)}">Back to Zodiac</a></p>`));
+		resolveCode(code);
+	};
+	const server = createServer(handler);
+	await new Promise((res) => server.listen(0, "127.0.0.1", res));
+	const address = server.address();
+	if (address == null || typeof address === "string") throw new Error("Failed to bind loopback callback server");
+	const port = address.port;
+	const close = () => new Promise((resolve) => {
+		server.close(() => resolve());
+	});
+	const waitForCode = (timeoutMs) => Promise.race([codePromise, new Promise((_, rej) => setTimeout(() => {
+		rejectCode(/* @__PURE__ */ new Error(`Timed out waiting for CLI auth callback`));
+		rej(/* @__PURE__ */ new Error(`Timed out waiting for CLI auth callback`));
+	}, timeoutMs))]);
+	return {
+		port,
+		waitForCode,
+		close
+	};
+};
+const respondHtml = (res, status, body) => {
+	res.setHeader("Connection", "close");
+	res.setHeader("content-type", "text/html; charset=utf-8");
+	res.statusCode = status;
+	res.end(body);
+};
+const renderHtml = (title, bodyHtml) => `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(title)} — Zodiac CLI</title>
+    <style>
+      body { font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 32rem; margin: 4rem auto; padding: 0 1rem; color: #1f2937; }
+      h1 { font-weight: 300; font-size: 1.75rem; margin-bottom: 1rem; }
+      code { background: #f3f4f6; padding: 0.125rem 0.375rem; border-radius: 0.25rem; }
+      a { color: #1d4ed8; }
+    </style>
+  </head>
+  <body>
+    <h1>${escapeHtml(title)}</h1>
+    ${bodyHtml}
+  </body>
+</html>
+`;
+const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+const writeEnv = (envPath, vars) => {
+	let contents = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+	for (const [key, value] of Object.entries(vars)) contents = upsertEnvLine(contents, key, value);
+	writeFileSync(envPath, contents, "utf8");
+};
+const upsertEnvLine = (contents, key, value) => {
+	const line = `${key}=${value}`;
+	const lines = contents.split(/\r?\n/);
+	const idx = lines.findIndex((l) => new RegExp(`^\\s*${key}\\s*=`).test(l));
+	if (idx >= 0) {
+		lines[idx] = line;
+		return lines.join("\n");
+	}
+	return contents.length === 0 || contents.endsWith("\n") ? `${contents}${line}\n` : `${contents}\n${line}\n`;
+};
+//#endregion
+//#region src/cli/commands/pullOrg.ts
+const toLiteral = (value, indent = 0) => {
+	const pad = "  ".repeat(indent);
+	const childPad = "  ".repeat(indent + 1);
+	if (value === null) return "null";
+	if (typeof value === "bigint") return `${value}n`;
+	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (Array.isArray(value)) {
+		if (value.length === 0) return "[]";
+		return `[\n${value.map((v) => `${childPad}${toLiteral(v, indent + 1)}`).join(",\n")},\n${pad}]`;
+	}
+	if (typeof value === "object") {
+		const entries = Object.entries(value);
+		if (entries.length === 0) return "{}";
+		return `{\n${entries.map(([k, v]) => `${childPad}${/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(k) ? k : JSON.stringify(k)}: ${toLiteral(v, indent + 1)}`).join(",\n")},\n${pad}}`;
+	}
+	return String(value);
+};
+const pullOrg = async (config) => {
+	const client = new ApiClient({ apiKey: config.apiKey });
+	const [users, workspaceAccounts] = await Promise.all([client.listUsers(), client.listAccounts()]);
+	const resolvableAccounts = workspaceAccounts.flatMap((ws) => ws.accounts).filter((a) => a.spec != null || a.vault);
+	const resolved = /* @__PURE__ */ new Map();
+	if (resolvableAccounts.length > 0) {
+		const response = await client.resolveConstellation(workspaceAccounts[0].workspaceId, { specification: resolvableAccounts.map((account, i) => account.spec != null ? account.spec : {
+			ref: `vault_${i}`,
+			type: "SAFE",
+			chain: account.chain,
+			address: account.address
+		}) });
+		invariant(response?.result?.length === resolvableAccounts.length, `resolveConstellation returned ${response?.result?.length ?? 0} accounts for ${resolvableAccounts.length} accounts`);
+		resolvableAccounts.forEach((account, i) => {
+			resolved.set(account.id, response.result[i]);
+		});
+	}
+	const accountsRecord = {};
+	for (const ws of workspaceAccounts) {
+		const safes = {};
+		const rolesMods = {};
+		const delays = {};
+		const bucketsByType = {
+			SAFE: safes,
+			ROLES: rolesMods,
+			DELAY: delays
+		};
+		const isNodeType = (type) => type === "SAFE" || type === "ROLES" || type === "DELAY";
+		const labelCountByType = {
+			SAFE: /* @__PURE__ */ new Map(),
+			ROLES: /* @__PURE__ */ new Map(),
+			DELAY: /* @__PURE__ */ new Map()
+		};
+		for (const account of ws.accounts) {
+			const { label } = account;
+			if (label == null || !isNodeType(account.type)) continue;
+			const counts = labelCountByType[account.type];
+			counts.set(label, (counts.get(label) ?? 0) + 1);
+		}
+		for (const account of ws.accounts) {
+			const { label } = account;
+			if (label == null || !isNodeType(account.type)) continue;
+			const onChain = resolved.get(account.id);
+			const key = (labelCountByType[account.type].get(label) ?? 0) > 1 ? `${label} (${getAddress(account.address)})` : label;
+			bucketsByType[account.type][key] = {
+				id: account.id,
+				label,
+				address: account.address,
+				chain: account.chain,
+				vault: account.vault,
+				...onChain?.type === "SAFE" && {
+					threshold: onChain.threshold,
+					owners: [...onChain.owners],
+					modules: [...onChain.modules]
+				}
+			};
+		}
+		accountsRecord[ws.workspaceName] = {
+			workspaceId: ws.workspaceId,
+			workspaceName: ws.workspaceName,
+			safes,
+			rolesMods,
+			delays
+		};
+	}
+	const nameCount = /* @__PURE__ */ new Map();
+	for (const user of users) nameCount.set(user.fullName, (nameCount.get(user.fullName) ?? 0) + 1);
+	const usersRecord = {};
+	for (const user of users) {
+		const handle = nameCount.get(user.fullName) > 1 ? `${user.fullName} (${user.id})` : user.fullName;
+		usersRecord[handle] = {
+			id: user.id,
+			fullName: user.fullName,
+			personalSafes: user.personalSafes
+		};
+	}
+	const outDir = resolveZodiacDir(config.rootDir);
+	mkdirSync(outDir, { recursive: true });
+	writeFileSync$1(join$1(outDir, "package.json"), JSON.stringify({
+		type: "commonjs",
+		main: "index.js",
+		types: "index.d.ts"
+	}, null, 2));
+	const sourceFile = new Project({
+		compilerOptions: {
+			declaration: true,
+			module: ModuleKind.CommonJS,
+			target: ScriptTarget.ESNext,
+			outDir
+		},
+		useInMemoryFileSystem: true
+	}).createSourceFile("index.ts", "");
+	sourceFile.addVariableStatement({
+		isExported: true,
+		declarationKind: VariableDeclarationKind.Const,
+		declarations: [{
+			name: "users",
+			initializer: `${toLiteral(usersRecord)} as const`
+		}]
+	});
+	sourceFile.addVariableStatement({
+		isExported: true,
+		declarationKind: VariableDeclarationKind.Const,
+		declarations: [{
+			name: "accounts",
+			initializer: `${toLiteral(accountsRecord)} as const`
+		}]
+	});
+	const emitResult = sourceFile.getEmitOutput();
+	for (const outputFile of emitResult.getOutputFiles()) {
+		const fileName = outputFile.getFilePath().includes(".d.ts") ? "index.d.ts" : "index.js";
+		let contents = outputFile.getText();
+		if (fileName === "index.d.ts") contents += `
+declare global {
+    interface ZodiacGeneratedCodegen {
+        users: typeof users;
+        accounts: typeof accounts;
+    }
+}
+`;
+		writeFileSync$1(join$1(outDir, fileName), contents);
+	}
+};
+//#endregion
+//#region src/allow/fetch.ts
+async function fetchAbi(chainId, address) {
+	const url = `https://api.abi.pub/v1/chains/${chainId}/etherscan?module=contract&action=getabi&address=${address}`;
+	let body;
+	try {
+		const resp = await fetch(url);
+		if (!resp.ok) return null;
+		body = await resp.json();
+	} catch {
+		return null;
+	}
+	if (body.status !== "1" || typeof body.result !== "string") return null;
+	try {
+		const parsed = JSON.parse(body.result);
+		if (!Array.isArray(parsed) || parsed.length === 0) return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/allow/codegen.ts
+function generateAllowTypes(abisDir, contractsConfig) {
+	const root = /* @__PURE__ */ new Map();
+	for (const node of walkContracts(contractsConfig)) {
+		const abi = readAbi(abisDir, node);
+		if (!abi) continue;
+		insertIntoTree(root, [node.chain, ...node.segments], {
+			node,
+			abi
+		});
+	}
+	const out = [];
+	out.push("// AUTO-GENERATED by `zodiac pull-contracts`. Do not edit.");
+	out.push("/* eslint-disable */");
+	out.push("");
+	out.push(`import type { FunctionPermission, TargetPermission } from "zodiac-roles-sdk";`);
+	out.push(`import type { Scoping, Options, EVERYTHING } from "@zodiaceco/sdk/allow";`);
+	out.push("");
+	out.push("declare global {");
+	out.push("  interface AllowKit " + renderTree(root, "  "));
+	out.push("}");
+	out.push("");
+	out.push("export {};");
+	out.push("");
+	return out.join("\n");
+}
+function insertIntoTree(tree, segments, leaf) {
+	const [first, ...rest] = segments;
+	if (!first) throw new Error("empty segments");
+	if (rest.length === 0) {
+		tree.set(first, leaf);
+		return;
+	}
+	let child = tree.get(first);
+	if (!child || child.node) {
+		child = /* @__PURE__ */ new Map();
+		tree.set(first, child);
+	}
+	insertIntoTree(child, rest, leaf);
+}
+function renderTree(tree, indent) {
+	const lines = ["{"];
+	for (const [key, value] of tree) {
+		const safeKey = renderPropKey(key);
+		if (value instanceof Map) lines.push(`${indent}  ${safeKey}: ${renderTree(value, indent + "  ")};`);
+		else {
+			const { node, abi } = value;
+			lines.push(`${indent}  ${safeKey}: ${renderContractType(node, abi, indent + "  ")};`);
+		}
+	}
+	lines.push(`${indent}}`);
+	return lines.join("\n");
+}
+function renderPropKey(name) {
+	return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
+}
+function renderContractType(node, abi, indent) {
+	const members = [];
+	const seen = /* @__PURE__ */ new Set();
+	members.push(`${indent}  [EVERYTHING]: (options?: Options) => TargetPermission;`);
+	for (const fragment of abi) {
+		if (fragment.type !== "function") continue;
+		if (fragment.stateMutability === "view" || fragment.stateMutability === "pure") continue;
+		const name = fragment.name;
+		if (!name || seen.has(name)) continue;
+		seen.add(name);
+		members.push(renderFunctionSignature(fragment, indent + "  "));
+	}
+	return [
+		"{",
+		...members,
+		`${indent}}`
+	].join("\n");
+}
+function renderFunctionSignature(fragment, indent) {
+	const name = renderPropKey(fragment.name);
+	const params = [];
+	for (const input of fragment.inputs ?? []) {
+		const paramName = sanitizeParamName(input.name || `arg${params.length}`, params.length);
+		params.push(`${paramName}?: Scoping<${tsTypeFor(input)}>`);
+	}
+	params.push(`options?: Options`);
+	return `${indent}${name}: (${params.join(", ")}) => FunctionPermission;`;
+}
+function sanitizeParamName(name, index) {
+	const cleaned = name.replace(/[^A-Za-z0-9_$]/g, "_");
+	if (!cleaned || /^[0-9]/.test(cleaned)) return `arg${index}`;
+	return new Set([
+		"function",
+		"class",
+		"new",
+		"number",
+		"string",
+		"object",
+		"boolean",
+		"symbol",
+		"default",
+		"return",
+		"this",
+		"void",
+		"delete",
+		"in",
+		"of",
+		"for",
+		"while",
+		"switch",
+		"case",
+		"if",
+		"else",
+		"null",
+		"true",
+		"false",
+		"undefined",
+		"any",
+		"never",
+		"unknown"
+	]).has(cleaned) ? `_${cleaned}` : cleaned;
+}
+function tsTypeFor(fragment) {
+	const type = fragment.type;
+	const arrayMatch = /^(.*)\[(\d*)\]$/.exec(type);
+	if (arrayMatch) return `readonly (${tsTypeFor({
+		...fragment,
+		type: arrayMatch[1]
+	})})[]`;
+	if (type === "tuple") {
+		const components = fragment.components ?? [];
+		if (components.length === 0) return "Record<string, unknown>";
+		return `{ ${components.map((c, i) => {
+			return `${renderPropKey(sanitizeParamName(c.name || `f${i}`, i))}: ${tsTypeFor(c)}`;
+		}).join("; ")} }`;
+	}
+	if (type === "address") return "`0x${string}`";
+	if (type === "bool") return "boolean";
+	if (type === "string") return "string";
+	if (type === "bytes") return "import(\"ethers\").BytesLike";
+	if (/^bytes\d+$/.test(type)) return "`0x${string}`";
+	if (/^u?int\d*$/.test(type)) return "import(\"ethers\").BigNumberish";
+	return "unknown";
+}
+function writeGenerated(outFile, source) {
+	fs.mkdirSync(path.dirname(outFile), { recursive: true });
+	fs.writeFileSync(outFile, source, "utf8");
+}
+//#endregion
+//#region src/cli/commands/pullContracts.ts
+const pullContracts = async (config) => {
+	if (!config.contracts || Object.keys(config.contracts).length === 0) {
+		console.log("No contracts defined in config, skipping.");
+		return;
+	}
+	const abisDir = resolveAbisDir(config);
+	const generatedFile = path.join(resolveZodiacDir(config.rootDir), "allow.d.ts");
+	let missing = 0;
+	let fetched = 0;
+	let existing = 0;
+	for (const node of walkContracts(config.contracts)) {
+		const file = abiFilePath(abisDir, node);
+		if (fs.existsSync(file)) {
+			existing++;
+			report(node.chain, node.segments, node.address, "ok", file);
+			continue;
+		}
+		let chainId;
+		try {
+			chainId = chainIdFor(node.chain);
+		} catch (error) {
+			missing++;
+			report(node.chain, node.segments, node.address, "missing", file, error.message);
+			continue;
+		}
+		const abi = await fetchAbi(chainId, node.address);
+		if (!abi) {
+			missing++;
+			report(node.chain, node.segments, node.address, "missing", file, `api.abi.pub returned no ABI for chain ${chainId}`);
+			continue;
+		}
+		writeAbi(abisDir, node, abi);
+		fetched++;
+		report(node.chain, node.segments, node.address, "fetched", file);
+	}
+	console.log("");
+	console.log(`Contracts summary: ${existing} existing, ${fetched} fetched, ${missing} missing.`);
+	if (missing > 0) {
+		console.log("");
+		console.log("Missing ABIs must be provided manually. Paste the contract");
+		console.log("ABI JSON at the paths listed above and re-run `zodiac pull-contracts`.");
+	}
+	writeGenerated(generatedFile, generateAllowTypes(abisDir, config.contracts));
+	console.log("");
+	console.log(`Wrote typings to ${path.relative(process.cwd(), generatedFile)}`);
+	if (missing > 0) process.exit(1);
+};
+function report(chain, segments, address, status, file, reason) {
+	const label = `${chain}.${segments.join(".")}`.padEnd(40, " ");
+	const tag = {
+		ok: "  cached  ",
+		fetched: "  fetched ",
+		missing: "  MISSING "
+	}[status];
+	const suffix = reason ? ` — ${reason}` : "";
+	console.log(`${tag} ${label} ${address}${suffix}`);
+	if (status === "missing") console.log(`            → paste ABI at ${file}`);
+}
+//#endregion
+//#region src/cli/run.ts
+config({ quiet: true });
+const loadConfigOrInit = (configPath) => loadConfig(configPath, {
+	createIfMissing: true,
+	onMissingKey: async (rootDir) => {
+		console.log("No ZODIAC_API_KEY found. Starting authorization to mint one for this directory…");
+		return init({ rootDir });
+	}
+});
+const run = async (argv = process.argv) => {
+	const program = new Command();
+	program.name("zodiac").description("Zodiac SDK CLI – pull org data and contract ABIs").version("1.0.0").option("-c, --config <path>", "path to the config file", "zodiac.config.ts");
+	program.command("pull").description("Fetch Zodiac org data and contract ABIs, generating typed SDK functions. Authorizes this directory automatically on first run.").action(async (_opts, cmd) => {
+		const config = await loadConfigOrInit(cmd.optsWithGlobals().config);
+		await Promise.all([pullOrg(config), pullContracts(config)]);
+	});
+	program.command("pull-org").description("Fetch Zodiac users and accounts, generate TypeScript types").action(async (_opts, cmd) => {
+		await pullOrg(await loadConfigOrInit(cmd.optsWithGlobals().config));
+	});
+	program.command("pull-contracts").description("Fetch contract ABIs, generate typed permissions kit").action(async (_opts, cmd) => {
+		await pullContracts(await loadConfigOrInit(cmd.optsWithGlobals().config));
+	});
+	program.command("init").description("Re-authorize this directory / mint a new API key (run automatically by `pull` on first use).").option("--app-url <url>", "Override the Zodiac app URL (defaults to ZODIAC_APP_URL or app.zodiac.eco)").action(async (opts) => {
+		await init({ appUrl: opts.appUrl });
+	});
+	await program.parseAsync(argv);
+};
+//#endregion
+//#region src/cli/index.ts
+run().then(() => {
+	process.exit(0);
+}, (error) => {
+	if (error) console.error(error);
+	process.exit(1);
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=cli.mjs.map