system.py

import json
import os
import shutil
import subprocess
import tempfile
from datetime import datetime, timedelta
from decimal import Decimal
from getpass import getpass
from importlib.resources import files
from pathlib import Path
from typing import Optional
from rich.console import Console
import typer
import time
from eth_account import Account
from rich.prompt import Confirm

from dincli.cli.contract_utils import erc20_abi, router_abi
from dincli.cli.utils import (CACHE_DIR, CONFIG_DIR,
                              CONFIG_FILE, WORKER_CACHE_DIR,
                              print_tx_info,
                              SUPPORTED_IPFS_PROVIDERS, _get_password,
                              _confirm_or_exit, _clean_optional_string,
                              get_config, get_demo_private_key,
                              get_env_key, is_ethereum_address,
                              load_cid_services, load_config,
                              load_din_info, normalize_ipfs_provider,
                              resolve_ipfs_config, resolve_task_coordinator_address,
                              save_config, save_din_info,
                              validate_account_name, wallet_path_for_name,
                              atomic_write_wallet, resolve_wallet_path,
                              list_accounts, get_active_account_name, load_account,
                              _extract_keystore)

from dincli.services import bridge as bridge_service

dataset_app = typer.Typer(help="Manage federated datasets.")

app = typer.Typer(help="System utilities for DIN CLI.")

# Register the dataset group under system_app
app.add_typer(dataset_app, name="dataset")


def _is_inside_container() -> bool:
    """Return True when running inside a Docker container (/.dockerenv is the canonical marker)."""
    return Path("/.dockerenv").exists()


def initialize_directories():
    """
    Create user-level config and cache dirs if they do not exist.
    Call this explicitly (e.g. from CLI or first-run code), not on import.
    """
    os.makedirs(CONFIG_DIR, exist_ok=True)
    os.makedirs(CACHE_DIR, exist_ok=True)
    os.makedirs(WORKER_CACHE_DIR, exist_ok=True)
    print(f"Initialized directories:\n- Config: {CONFIG_DIR}\n- Cache: {CACHE_DIR} \n- Worker Cache: {WORKER_CACHE_DIR}")

@app.callback(invoke_without_command=True)
def system(
    ctx: typer.Context,
    eth_balance: bool = typer.Option(
        False,
        "--eth-balance",
        help="Show ETH balance for your wallet or a given address."
    ),
    address: str = typer.Option(
        None,
        "--address",
        help="Ethereum address to query. If not provided, uses your connected wallet."
    ),
):
    # If the subcommand is one that doesn't need an account, we skip the default setup logic
    if ctx.invoked_subcommand in ["register-wallet", "connect-wallet", "connect-demo-wallet", "init", "welcome", "where", "configure-network", "configure-demo", "configure-ipfs", "read-wallet", "show-index", "din-info", "import-deployments", "configure-logging", "dump-abi", "reset-all", "todo", "dataset", "send-eth", "run-worker-counting", "run-node-counting", "list-accounts", "set-wallet", "bridge-eth", "verify-deployment"]:
        return

    effective_network, w3, account, console = ctx.obj.get_en_w3_account_console()

    
    # Early exit if neither balance flag is set
    if not (eth_balance):
        return  # let subcommands run, or do nothing
    
    if address:
        target_address = w3.to_checksum_address(address)
    else:
        target_address = account.address
    console.print(f"\n[green]Target Account Address:[/green] {target_address}")
    
     # Fetch ETH balance if requested
    if eth_balance:
        balance_wei = w3.eth.get_balance(target_address)
        balance_eth = w3.from_wei(balance_wei, "ether")
        
        console.print(f"[green]ETH Balance:[/green] {balance_eth} ETH")    
        

@app.command()
def where(ctx: typer.Context):
    """Print where dincli is installed."""
    typer.secho("dincli is installed at: ", fg="green", nl=False)
    typer.secho(f"{files('dincli')}", fg="magenta")

@app.command("run-node-counting")
def run_node_counting():
    """Run the counting task."""
    typer.echo("Running the counting task...")
    n = 0
    while True:
        n += 1
        time.sleep(1)
        typer.echo(f"DIN Node Count: {n}")


@app.command("run-worker-counting")
def run_worker_counting(
    count: int = typer.Option(10, "--count", "-n", help="Number of counts (0 for infinite)"),
    delay: float = typer.Option(1.0, "--delay", "-d", help="Seconds between counts"),
):
    """Run a counting task inside the DIN worker container."""
    from dincli.cli.worker import ensure_worker_image, write_worker_job, WORKER_IMAGE

    console = Console()

    try:
        ensure_worker_image(console)
    except RuntimeError as e:
        console.print(f"[bold red]{e}[/bold red]")
        raise typer.Exit(1)

    
    model_dir = Path(CACHE_DIR / "model_tmp")
    model_dir.mkdir(parents=True, exist_ok=True)
    (model_dir / "manifest.json").write_text("{}\n", encoding="utf-8")

    svc_dir = model_dir / "services"
    svc_dir.mkdir()
    svc_src = Path(str(files("dincli"))) / "services" / "counting_service.py"
    shutil.copy(svc_src, svc_dir / "counting_service.py")

    job_path, output_dir = write_worker_job(
        model_dir / "jobs",
        "counting",
        {
            "network": "local",
            "model_base_dir": "/din/model",
            "manifest_path": "/din/model/manifest.json",
            "role": "system",
            "service_path": "services/counting_service.py",
            "function_name": "run_counting",
            "kwargs": {"count": count, "delay": delay},
        },
    )

    cmd = [
        "docker", "run", "--rm",
        "--name", "din-worker-counting",
        "--user", f"{os.getuid()}:{os.getgid()}",
        "-e", "HOME=/tmp",
        "--network", "none",
        "-v", f"{model_dir.resolve()}:/din/model:ro",
        "-v", f"{job_path.resolve()}:/din/job/job.json:ro",
        "-v", f"{output_dir.resolve()}:/din/output:rw",
        WORKER_IMAGE,
    ]

    console.print("[bold cyan]Starting worker counting container (Ctrl+C to stop)...[/bold cyan]")
    try:
        subprocess.run(cmd, check=False)
    except KeyboardInterrupt:
        console.print("\n[yellow]Worker counting stopped.[/yellow]")


@app.command()
def welcome():
    """Print welcome message."""
    typer.echo("Welcome to DIN CLI!")

@app.command("get-cache-dir")
def get_cache_dir():
    """Print cache directory paths used by dincli."""
    if _is_inside_container():
        typer.echo("Environment: DIN node container")
        typer.echo("(DIN_STATE_DIR is bind-mounted at the identical host path, so paths below are valid on the host daemon too)")
    else:
        typer.echo("Environment: host")
    typer.echo(f"Cache Directory:        {CACHE_DIR}")
    typer.echo(f"Worker Node Cache Directory: {WORKER_CACHE_DIR}")

@app.command("get-config-dir")
def get_config_dir():
    """Print config directory path used by dincli."""
    if _is_inside_container():
        typer.echo("Environment: DIN node container")
        typer.echo("(DIN_STATE_DIR is bind-mounted at the identical host path, so path below is valid on the host daemon too)")
    else:
        typer.echo("Environment: host")
    typer.echo(f"Config Directory: {CONFIG_DIR}")



@app.command("init")
def initialize():
    """Initialize DIN CLI by creating config/cache directories and a config file with demo mode off."""
    initialize_directories()
    if not CONFIG_FILE.exists():
        CONFIG_FILE.write_text(json.dumps({"demo_mode": False}, indent=4) + "\n", encoding="utf-8")
        Console().print(f"[green]✅ Created config file (demo mode off) at: {CONFIG_FILE}[/green]")
 
@app.command("configure-network")
def configure_network(ctx: typer.Context):
    """
    Configure the default blockchain network for DIN CLI.
    """
    
    effective_network, console = ctx.obj.network, ctx.obj.console

    config = load_config()
    config["network"] = effective_network
    save_config(config)

    console.print(f"[green]Network configured successfully: {effective_network}[/green]")

# ---------------------------------------------------------------------------
# Wallet model — registration vs. connection
# ---------------------------------------------------------------------------
# Wallets are *registered* once (key material stored under a name) and then
# *connected* (made the active wallet) as often as needed:
#
#   dincli system register-wallet ...    write key material to
#                                        <CONFIG_DIR>/wallets/wallet_<name>.json
#   dincli system connect-wallet NAME    flip the persistent active-wallet
#                                        pointer (config "wallet_name");
#                                        never touches key material, never
#                                        prompts for a secret
#
# Every command resolves the active wallet via utils.get_active_account_name()
# with this precedence (first hit wins):
#
#   1. dincli --wallet <name>    global flag — this invocation only
#   2. DIN_WALLET_NAME           environment variable
#   3. config "wallet_name"      persisted by connect-wallet (or set-wallet)
#   4. "default"                 wallets/wallet_default.json, falling back to
#                                the legacy single-wallet <CONFIG_DIR>/wallet.json
#
# The private key is only decrypted (DIN_WALLET_PASSWORD or password prompt)
# when a command actually needs to sign — see utils.load_account().


def _refuse_real_wallet_in_demo_lane(console, resolved: str) -> None:
    """Refuse connect-demo-wallet on a real (encrypted) wallet, pointing at connect-wallet."""
    console.print(
        f"[red]❌ '{resolved}' is not a demo wallet — connect-demo-wallet only "
        f"connects wallets created via `connect-demo-wallet`.[/red]"
    )
    console.print(f"[yellow]Did you mean:[/yellow] dincli system connect-wallet {resolved}")
    raise typer.Exit(1)


def _is_existing_real_wallet(name: str) -> bool:
    """True if `name` resolves to an existing, readable wallet file that is not demo-format.

    Invalid names, missing files and unreadable files return False so the caller's
    normal error path reports them.
    """
    try:
        wallet_path, exists = resolve_wallet_path(validate_account_name(name))
        if not exists:
            return False
        with open(wallet_path) as f:
            return json.load(f).get("demo_mode") is not True
    except (ValueError, OSError, json.JSONDecodeError, AttributeError):
        return False


def _connect_registered_wallet(console, name: str, require_demo: Optional[bool] = None) -> str:
    """Persist `name` as the active wallet (config "wallet_name").

    Pure pointer flip: requires the wallet file to already exist, never writes
    key material, never prompts for a secret. Returns the validated name.

    require_demo, when not None, restricts which lane `name` must belong to:
    True requires the plaintext demo format (connect-demo-wallet), False
    requires the encrypted real-wallet format (connect-wallet) — refusing on a
    mismatch keeps demo and real accounts from ever being activated through
    the wrong command. None (the default) applies no restriction.
    """
    try:
        resolved = validate_account_name(name)
    except ValueError as e:
        console.print(f"[red]❌ {e}[/red]")
        raise typer.Exit(1)

    wallet_path, exists = resolve_wallet_path(resolved)
    if not exists:
        if require_demo is True:
            console.print(
                f"[red]❌ Demo wallet '{resolved}' not found. "
                f"Run `dincli system connect-demo-wallet {resolved} --account N` first.[/red]"
            )
        else:
            console.print(
                f"[red]❌ Wallet '{resolved}' not found. "
                f"Run `dincli system register-wallet --name {resolved}` first.[/red]"
            )
        registered = [e["name"] for e in list_accounts(resolved)]
        if registered:
            console.print(f"[yellow]Registered wallets:[/yellow] {', '.join(registered)}")
        raise typer.Exit(1)

    # Read once — used for both the demo-lane check below and the address
    # display at the end (present in demo, wrapper, and legacy-keystore
    # formats; fall back gracefully if unreadable).
    try:
        with open(wallet_path) as f:
            wallet_data = json.load(f)
    except (json.JSONDecodeError, OSError):
        wallet_data = {}
    address = wallet_data.get("address", "unknown")
    is_demo = wallet_data.get("demo_mode") is True

    if require_demo is True and not is_demo:
        _refuse_real_wallet_in_demo_lane(console, resolved)
    if require_demo is False and is_demo:
        console.print(
            f"[red]❌ '{resolved}' is a demo wallet — connect-wallet refuses to activate it, "
            f"to keep demo accounts out of the real-account path.[/red]"
        )
        console.print(f"[yellow]Did you mean:[/yellow] dincli system connect-demo-wallet {resolved}")
        raise typer.Exit(1)

    config = load_config()
    config["wallet_name"] = resolved
    save_config(config)

    console.print(f"[green]✅ Active wallet set to '{resolved}'[/green] ({address})")
    console.print("[dim]`dincli --wallet <name>` or DIN_WALLET_NAME still override this per invocation.[/dim]")
    return resolved


@app.command("connect-wallet")
def connect_wallet(ctx: typer.Context,
    name: str = typer.Argument("default", help="Registered wallet name to make active (default: 'default')"),
):
    """
    Connect (activate) a registered named wallet.

    Persists the choice in config ("wallet_name") so every subsequent dincli
    invocation on this machine uses that wallet. This is purely a pointer
    flip: no key material is read, written, or decrypted, and nothing is
    prompted — so switching between named wallets is always safe and silent.

    Active-wallet resolution priority (first hit wins):

    \b
      1. dincli --wallet <name>   global flag, this invocation only
      2. DIN_WALLET_NAME          environment variable
      3. config "wallet_name"     <- what this command sets
      4. 'default'

    The wallet must already be registered:

    \b
      dincli system register-wallet --name validator --keystore ks.json
      dincli system connect-wallet validator     # switch to it
      dincli system connect-wallet               # switch back to 'default'

    Real accounts only — refuses to activate a demo wallet (one created via
    `connect-demo-wallet`). Use `connect-demo-wallet` for those instead.
    """
    # Direct callers (e.g. tests) may omit the argument; Typer then passes an
    # ArgumentInfo object — normalize to the CLI default.
    if not isinstance(name, str):
        name = "default"

    # Guard against a common trap: `--wallet X` is the global per-invocation
    # override (GlobalOptionsGroup hoists it to the root callback), so it never
    # reaches this command — `connect-wallet --wallet X` just falls back to the
    # positional default. If the override names a different wallet than the
    # argument, the user almost certainly meant the positional form.
    override = ctx.obj.wallet_name
    if override and override != name:
        ctx.obj.console.print(
            f"[red]❌ `--wallet {override}` overrides the active wallet for this "
            f"invocation only — it does not choose the wallet to connect.[/red]"
        )
        ctx.obj.console.print(
            f"[yellow]Did you mean:[/yellow] dincli system connect-wallet {override}"
        )
        raise typer.Exit(1)

    resolved = _connect_registered_wallet(ctx.obj.console, name, require_demo=False)
    # Keep the in-process context consistent for the rest of this invocation.
    ctx.obj.select_wallet(resolved)


@app.command("connect-demo-wallet")
def connect_demo_wallet(ctx: typer.Context,
    name: str = typer.Argument("demo-default", help="Demo wallet name to connect (default: 'demo-default')"),
    account: Optional[int] = typer.Option(None, "--account", "-a", help="Hardhat dev account index — (re)creates `name` from this index before connecting"),
    yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt when overwriting an existing named demo wallet"),
):
    """
    Connect a well-known Hardhat dev account for local testing only.

    With --account, this is a one-shot: no separate step needed. There is no
    `register-demo-wallet` — this command both creates and connects.

    \b
      dincli system connect-demo-wallet --account 0        # create+connect 'demo-default' from index 0
      dincli system connect-demo-wallet bob --account 1     # create+connect as 'bob'
      dincli system connect-demo-wallet bob                 # reconnect an already-connected demo wallet by name

    Requires demo mode on (`dincli system configure-demo --mode yes`). Stores the
    key in PLAINTEXT — these keys are publicly derivable, never fund this address
    on a real network. For your own wallet, use `register-wallet` + `connect-wallet`
    instead.
    """
    console = ctx.obj.console
    yes = yes if isinstance(yes, bool) else False

    if not isinstance(name, str):
        name = "demo-default"
    if not isinstance(account, int):
        account = None

    # Reconnecting by name to a real (encrypted) wallet: refuse with the specific
    # "not a demo wallet" message before the demo-mode check. Turning demo mode
    # on would not make this command accept it, so "Demo mode is off" misleads.
    if account is None and _is_existing_real_wallet(name):
        _refuse_real_wallet_in_demo_lane(console, validate_account_name(name))

    if not get_config("demo_mode"):
        console.print(
            "[red]❌ Demo mode is off — connect-demo-wallet only works with demo "
            "mode on.[/red]"
        )
        console.print(
            "[yellow]Run `dincli system configure-demo --mode yes` first, or use "
            "`dincli system register-wallet` / `connect-wallet` to connect your own key.[/yellow]"
        )
        raise typer.Exit(1)

    # Guard against the same `--wallet X` trap connect-wallet guards against.
    override = ctx.obj.wallet_name
    if override and override != name:
        console.print(
            f"[red]❌ `--wallet {override}` overrides the active wallet for this "
            f"invocation only — it does not choose the wallet to connect.[/red]"
        )
        console.print(
            f"[yellow]Did you mean:[/yellow] dincli system connect-demo-wallet {override}"
        )
        raise typer.Exit(1)

    if account is not None:
        # One-shot: (re)create `name` from the given dev-account index, then connect it.
        try:
            resolved_name = validate_account_name(name)
        except ValueError as e:
            console.print(f"[red]❌ {e}[/red]")
            raise typer.Exit(1)

        target_path = wallet_path_for_name(resolved_name)
        if target_path.exists() and not yes:
            console.print(f"[yellow]A wallet named '{resolved_name}' already exists at {target_path}.[/yellow]")
            if not typer.confirm("Overwrite it?"):
                console.print("[yellow]Aborted. Existing wallet left unchanged.[/yellow]")
                raise typer.Exit(0)

        console.print(f"[green] ⚙️  Connecting demo wallet...[/green]")
        console.print(f"[cyan]Saving as:[/cyan] {resolved_name}")

        try:
            privatekey = get_demo_private_key(account)
        except (FileNotFoundError, IndexError) as e:
            console.print(f"[red]❌ {e}[/red]")
            raise typer.Exit(1)

        acct = Account.from_key(privatekey)
        wallet_data = {
            "address": acct.address,
            "private_key": privatekey,  # ⚠️ PLAINTEXT — ONLY FOR MOCK!
            "demo_mode": True
        }
        atomic_write_wallet(target_path, wallet_data)
        console.print(f"[green]✅ Wallet saved in DEMO MODE (plaintext)![/green]")
        console.print(f"[yellow]Address:[/yellow] {acct.address}")
        console.print(f"[cyan]Wallet File:[/cyan] {target_path}")

        resolved = _connect_registered_wallet(console, resolved_name, require_demo=True)
    else:
        # Pure pointer-flip to an already-connected demo wallet.
        resolved = _connect_registered_wallet(console, name, require_demo=True)

    # Keep the in-process context consistent for the rest of this invocation.
    ctx.obj.select_wallet(resolved)


@app.command("set-wallet", deprecated=True)
def set_wallet(ctx: typer.Context, name: str = typer.Argument(..., help="Wallet name to set as the persistent default")):
    """(Deprecated) Alias of `connect-wallet`."""
    console = ctx.obj.console
    console.print("[yellow]`set-wallet` is deprecated — use `dincli system connect-wallet <name>`.[/yellow]")
    _connect_registered_wallet(console, name, require_demo=False)

@app.command("configure-demo")
def configure_demo(ctx: typer.Context,
    mode: str = typer.Option("yes", "--mode", help="Set demo mode: yes or no")
):
    """
    Enable/disable demo mode (plaintext wallet storage, no password).
    Useful for Hardhat/local testing.
    """
    console = ctx.obj.console
    if mode.lower() not in ("yes", "no"):
        console.print("[red]Mode must be 'yes' or 'no'[/red]")
        raise typer.Exit(1)
    
    enable = mode.lower() == "yes"
    config = load_config()
    config["demo_mode"] = enable
    save_config(config)
    status = "enabled" if enable else "disabled"
    console.print(f"[green]Demo mode {status}.[/green]")
    if enable:
        console.print("[red]⚠️  Wallets will be stored in plaintext. Do NOT use with real keys![/red]")

@app.command("configure-logging")
def configure_logging(ctx: typer.Context,  
    level: str = typer.Option("info", "--level", help="Set log level: debug | info | warning | error | critical")
):
    """
    Configure the log level for DIN CLI.
    """
    console = ctx.obj.console
    if level.lower() not in ("debug", "info", "warning", "error", "critical"):
        console.print("[red]Level must be 'debug', 'info', 'warning', 'error', or 'critical'[/red]")
        raise typer.Exit(1)
    
    config = load_config()
    config["log_level"] = level.lower()
    save_config(config)
    console.print(f"[green]Log level set to {level}.[/green]")
    
    
@app.command("register-wallet")
def register_wallet(ctx: typer.Context,
    privatekey: Optional[str] = typer.Argument(None, help="Your Ethereum private key (0x...)"),
    key_file: Optional[Path] = typer.Option(None, "--key-file", "-f", help="Path to file containing private key"),
    account: Optional[int] = typer.Option(None, "--account", "-a", help="Hardhat dev account index (0-69)"),
    keystore: Optional[Path] = typer.Option(None, "--keystore", help="Import a standard Ethereum JSON keystore file"),
    name: Optional[str] = typer.Option("default", "--name", "-n", help="Label for the saved keystore (default 'default')"),
    yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt when overwriting an existing named wallet"),
    connect: bool = typer.Option(False, "--connect", "-c", help="Also make this wallet the active one (same as running `connect-wallet <name>` afterwards)"),
):
    """
    Register a wallet: store key material under a name (create or import).

    The key comes from exactly ONE of the following sources — passing more
    than one is an error, passing none falls through to the hidden prompt:

    \b
      --keystore FILE   import a standard Ethereum JSON keystore
      --account N       dev-account index: reads ETH_PRIVATE_KEY_<N> from the
                        environment/.env
      --key-file FILE   read the raw private key (0x...) from a file
      PRIVATEKEY        positional argument (insecure: shell history/logs)
      (none)            interactive hidden prompt  <- recommended

    Real accounts only — refuses to run while demo mode is on. For local
    Hardhat testing, use `dincli system connect-demo-wallet` instead.

    \b
    Storage (at <CONFIG_DIR>/wallets/wallet_<name>.json): always an encrypted
    keystore; the encryption password comes from DIN_WALLET_PASSWORD if set,
    else a create/confirm prompt.

    Registering does NOT switch the active wallet — pass --connect, or run
    `dincli system connect-wallet <name>` afterwards. (--name defaults to
    'default', which is also the final fallback of the active-wallet
    resolution, so a plain `register-wallet` sets up the wallet used when
    nothing else is selected.)

    An existing wallet with the same name is only overwritten after
    confirmation (skip with --yes).

    \b
    Examples:
      dincli system register-wallet                          # prompt, save as 'default'
      dincli system register-wallet --keystore ks.json --name validator
      dincli system register-wallet --key-file ~/.dincli/wallet.key
      dincli system register-wallet --account 3 --name acct3 --connect
    """

    console = ctx.obj.console

    if get_config("demo_mode"):
        console.print(
            "[red]❌ Demo mode is on — register-wallet refuses to run, to avoid ever "
            "touching a real key while demo mode is active.[/red]"
        )
        console.print(
            "[yellow]Run `dincli system configure-demo --mode no` first, or use "
            "`dincli system connect-demo-wallet` for local Hardhat testing.[/yellow]"
        )
        raise typer.Exit(1)

    # Direct callers (e.g. tests) may omit --yes/--connect; Typer then passes an
    # OptionInfo object (truthy), which would silently bypass the overwrite guard
    # below (or trigger an unwanted connect). Normalize to real bools so the
    # behavior is the same on direct calls.
    yes = yes if isinstance(yes, bool) else False
    connect = connect if isinstance(connect, bool) else False

    # Validate account name
    try:
        resolved_name = validate_account_name(name or "default")
    except ValueError as e:
        console.print(f"[red]❌ {e}[/red]")
        raise typer.Exit(1)

    # Validate mutual exclusivity
    auth_methods = [
        (privatekey, "private key argument"),
        (key_file, "key file"),
        (account, "account index"),
        (keystore, "keystore file"),
    ]
    provided_methods = [n for val, n in auth_methods if val is not None]

    if len(provided_methods) > 1:
        console.print(f"[red]❌ Please specify only one of: {', '.join(provided_methods)}.[/red]")
        raise typer.Exit(1)

    source = "created"

    # --- keystore import: non-secret validation only ---
    # Runs before the overwrite guard so a missing/malformed keystore fails fast
    # without prompting, and so no secret (passphrase) is requested before the
    # overwrite decision. The passphrase/decrypt happen after the guard, below.
    inner_keystore = None
    if keystore is not None:
        keystore = keystore.expanduser()
        if not keystore.exists():
            console.print(f"[red]❌ Keystore file not found: {keystore}[/red]")
            raise typer.Exit(1)
        try:
            with open(keystore, 'r') as f:
                imported_ks = json.load(f)
        except (json.JSONDecodeError, OSError) as e:
            console.print(f"[red]❌ Failed to read keystore file: {e}[/red]")
            raise typer.Exit(1)
        try:
            inner_keystore = _extract_keystore(imported_ks)
        except ValueError:
            console.print("[red]❌ File does not contain a recognisable keystore.[/red]")
            raise typer.Exit(1)
        source = "imported"

    # --- overwrite guard ---
    # Confirm before overwriting an existing named keystore, and before any secret
    # prompt. Keys on the exact file to be written (a legacy wallet.json for the
    # 'default' name is a non-destructive migration and intentionally not guarded).
    target_path = wallet_path_for_name(resolved_name)
    if target_path.exists() and not yes:
        console.print(f"[yellow]A wallet named '{resolved_name}' already exists at {target_path}.[/yellow]")
        if not typer.confirm("Overwrite it?"):
            console.print("[yellow]Aborted. Existing wallet left unchanged.[/yellow]")
            raise typer.Exit(0)

    console.print(f"[green] ⚙️  Registering wallet...[/green]")
    console.print(f"[cyan]Saving as:[/cyan] {resolved_name}")

    # --- resolve secret material ---
    if keystore is not None:
        # Uses the keystore already extracted above — no re-read/re-parse.
        passphrase = getpass("Keystore passphrase: ")
        try:
            decrypted_key = Account.decrypt(inner_keystore, passphrase)
        except ValueError:
            console.print("[red]❌ Wrong passphrase or corrupted keystore.[/red]")
            raise typer.Exit(1)
        acct = Account.from_key(decrypted_key)
        address = acct.address

    elif account is not None:
        privatekey = get_env_key("ETH_PRIVATE_KEY_"+str(account))
        if privatekey is None:
            raise typer.Exit(1)

    elif key_file is not None:
        # Load from file
        key_file = key_file.expanduser()
        if not key_file.exists():
            console.print(f"[red]❌ Key file not found: {key_file}[/red]")
            raise typer.Exit(1)
        try:
            with open(key_file, 'r') as f:
                privatekey = f.read().strip()
        except Exception as e:
            console.print(f"[red]❌ Failed to read key file: {e}[/red]")
            raise typer.Exit(1)

    elif privatekey is not None:
        # Explicit argument
        console.print("[yellow]⚠️  Warning: Providing private key as argument is insecure (saved in shell history). Use interactive mode or --key-file instead.[/yellow]")

    else:
        # Interactive prompt
        console.print("[cyan]Enter your Ethereum private key (input will be hidden):[/cyan]")
        privatekey = getpass("Private Key: ").strip()

    # For non-keystore paths: validate key format and derive address
    if keystore is None:
        if not privatekey.startswith("0x") or len(privatekey) != 66:
            console.print("[red]❌ Invalid private key format! Must be 0x + 64 hex chars.[/red]")
            raise typer.Exit(1)
    
    # Ensure config dir exists
    CONFIG_DIR.mkdir(parents=True, exist_ok=True)

    if keystore is None:
        acct = Account.from_key(privatekey)
        address = acct.address


    if keystore is not None:
        ks_payload = inner_keystore
    else:
        # is_new_wallet=True: never reuse a stale in-memory-cached password when
        # creating/overwriting a wallet; force the create/confirm flow (env var
        # DIN_WALLET_PASSWORD is still honored for automation).
        password = _get_password(resolved_name, False, is_new_wallet=True)
        if password == "":
            password = getpass("Create wallet password: ")
            confirm = getpass("Confirm password: ")
            if password != confirm:
                console.print("[red]Passwords do not match![/red]")
                raise typer.Exit()
        ks_payload = Account.encrypt(privatekey, password)

    wrapper = {
        "version": 1,
        "address": address,
        "keystore": ks_payload,
        "source": source,
        "name": resolved_name,
    }

    wallet_path = wallet_path_for_name(resolved_name)
    atomic_write_wallet(wallet_path, wrapper)

    console.print(f"[green]Wallet {resolved_name} registered successfully![/green]")
    console.print(f"[green]Wallet Account Address:[/green] {address}")
    console.print(f"[green]Encrypted keystore saved at:[/green] {wallet_path}")

    # Registration never switches the active wallet implicitly — only via
    # --connect (see the wallet-model comment above for the resolution order).
    if connect:
        _connect_registered_wallet(console, resolved_name)
    elif resolved_name != "default":
        console.print(
            f"[dim]Run `dincli system connect-wallet {resolved_name}` to make it the active wallet.[/dim]"
        )


@app.command("read-wallet")
def read_wallet(ctx: typer.Context, 
    name: Optional[str] = typer.Option(None, "--name", "-n", help="Wallet name")
):
    """
    Read and display wallet info.
    In demo mode, shows private key. Otherwise, shows only address (after decrypting).
    """
    console = ctx.obj.console
    if not isinstance(name, str):
        name = None

    if name is not None:
        wallet_to_read_name = name
        active = False
    else:
        wallet_to_read_name = ctx.obj.resolved_wallet_name
        active = True
    wallet_path, exists = resolve_wallet_path(wallet_to_read_name)

    if not exists:
        console.print(f"[red]No wallet found for '{wallet_to_read_name}'. Run `dincli system register-wallet` first.[/red]")
        raise typer.Exit(1)

    with open(wallet_path) as f:
        data = json.load(f)

    # Check if it's demo mode (plaintext)
    if isinstance(data, dict) and data.get("demo_mode") is True:
        console.print("[bold green]🔐 Wallet (Demo Mode - Plaintext)[/bold green]")
        console.print(f"[green]Wallet Name:[/green] {wallet_to_read_name} {'[bold green](active)[/bold green]' if active else ''}")
        console.print(f"[yellow]Address:[/yellow] {data['address']}")
        console.print(f"[red]Private Key:[/red] {data['private_key']}")
        console.print("[cyan]⚠️  This key is stored in plaintext — for local testing only![/cyan]")
        return
    try:
        # Decrypt the *requested* wallet, not the active one — ctx.obj.account
        # always resolves the active wallet and would ignore --name.
        acct = load_account(wallet_to_read_name)
        console.print(f"[green]Wallet Name:[/green] {wallet_to_read_name} {'[bold green](active)[/bold green]' if active else ''}")
        console.print(f"[green]Address:[/green] {acct.address}")
        console.print("[green]✅ Wallet decrypted successfully.[/green]")
    except Exception as e:
        console.print(f"[red]❌ {e}[/red]")
        raise typer.Exit(1)


@app.command("list-accounts")
def list_managed_accounts(ctx: typer.Context):
    """
    List all named wallet accounts and their addresses (no decrypt needed).
    Marks the currently active wallet.
    """
    console = ctx.obj.console
    active_name = ctx.obj.resolved_wallet_name
    accounts = list_accounts(active_name)

    if not accounts:
        console.print("[yellow]No wallets found. Run `dincli system register-wallet` to create one.[/yellow]")
        return

    console.print("[bold cyan]Named wallets:[/bold cyan]")
    for e in accounts:
        marker = "[green](active)[/green]" if e["active"] else ""
        source_tag = f" ({e['source']})" if e.get("source") not in ("unknown",) else ""
        console.print(f"  [bold]{e['name']}[/bold] → {e['address']}{source_tag} {marker}")

    console.print(f"\n[dim]Active wallet name:[/dim] {active_name}")

@app.command("send-eth")
def send_eth(
    ctx: typer.Context,
    amount: str = typer.Option(..., "--amount", "-a", help="Amount of ETH to send (in ETH)"),
    to: str = typer.Option(..., "--to", "-t", help="Recipient address"),
    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
):
    """
    Send ETH to an address.
    """
    effective_network, w3, account, console = ctx.obj.get_en_w3_account_console()

    # Validate recipient address
    try:
        to = w3.to_checksum_address(to)
    except Exception:
        console.print(f"[bold red]✗ Invalid recipient address: {to}[/bold red]")
        raise typer.Exit(1)

    # Convert amount to wei
    try:
        amount_wei = w3.to_wei(amount, "ether")
    except Exception as e:
        console.print(f"[bold red]✗ Invalid amount '{amount}': {e}[/bold red]")
        raise typer.Exit(1)

    # Check sender balance
    balance_wei = w3.eth.get_balance(account.address)
    if balance_wei < amount_wei:
        balance_eth = w3.from_wei(balance_wei, "ether")
        console.print(f"[bold red]✗ Insufficient balance. Have {balance_eth} ETH, tried to send {amount} ETH.[/bold red]")
        raise typer.Exit(1)

    # Confirmation prompt
    if not yes:
        console.print(f"\n[bold yellow]  From:[/bold yellow] {account.address}")
        console.print(f"[bold yellow]    To:[/bold yellow] {to}")
        console.print(f"[bold yellow]Amount:[/bold yellow] {amount} ETH")
        console.print(f"[bold yellow]   Net:[/bold yellow] {effective_network}\n")
        confirmed = typer.confirm("Confirm transaction?")
        if not confirmed:
            console.print("[yellow]Aborted.[/yellow]")
            raise typer.Exit(0)

    # Build and send raw ETH transfer
    try:
        tx_params = ctx.obj.get_tx_params()
        tx_params.update({"to": to, "value": amount_wei, "from": account.address})

        tx_params["gas"] = int(w3.eth.estimate_gas(tx_params) * 1.1)

        signed_tx = account.sign_transaction(tx_params)
        console.print(f"[bold green]Sending {amount} ETH to {to}...[/bold green]")

        tx_hash = w3.eth.send_raw_transaction(signed_tx.raw_transaction)
        print_tx_info(tx_hash, effective_network)
        receipt = w3.eth.wait_for_transaction_receipt(tx_hash)
        if receipt.status == 1:
            console.print(f"[bold green] ✓ Successfully sent {amount} ETH to {to}[/bold green]")
        else:
            console.print(f"[bold red]✗ Transaction failed (reverted)[/bold red]")
            raise typer.Exit(1)

    except typer.Exit:
        raise
    except Exception as e:
        console.print(f"[bold red]✗ Transaction failed: {e}[/bold red]")
        raise typer.Exit(1)

@app.command("show-index")
def show_index(ctx: typer.Context,
    address: str = typer.Option(..., "--address", "-a", help="Address of the contract"),
):
    """
    Show the index of the the account address in demo mode.
    """
    from dincli.cli.utils import get_demo_account_index
    console = ctx.obj.console
    try:
        index = get_demo_account_index(address)
        console.print(f"[green]Account Index:[/green] {index}")
    except ValueError as e:
        console.print(f"[red]{e}[/red]")
        raise typer.Exit(1)
    except FileNotFoundError as e:
        console.print(f"[red]{e}[/red]")
        raise typer.Exit(1)

@app.command("din-info")
def din_info(ctx: typer.Context,
    coordinator: bool = typer.Option(False, "--coordinator", help="Show coordinator address"),
    token: bool = typer.Option(False, "--token", help="Show DIN token address"),
    stake: bool = typer.Option(False, "--stake", help="Show staking contract"),
    representative: bool = typer.Option(False, "--representative", help="Show representative logic"),
    registry: bool = typer.Option(False, "--registry", help="Show registry contract"),
    treasury: bool = typer.Option(False, "--treasury", help="Show treasury contract"),
    fee_router: bool = typer.Option(False, "--fee-router", help="Show fee router contract"),
    emission: bool = typer.Option(False, "--emission", help="Show emission contract"),

):

    # Resolve effective network
    effective_network, _, _, console = ctx.obj.get_en_w3_account_console()

    data = load_din_info()[effective_network]

    # Print requested info
    if coordinator:
        console.print(f"[cyan]Coordinator:[/cyan] {data.get('coordinator', 'N/A')}")
    if token:
        console.print(f"[green]DIN Token:[/green] {data.get('token', 'N/A')}")
    if stake:
        console.print(f"[yellow]Staking Contract:[/yellow] {data.get('stake', 'N/A')}")
    if representative:
        console.print(f"[magenta]Representative:[/magenta] {data.get('representative', 'N/A')}")
    if registry:
        console.print(f"[magenta]Registry:[/magenta] {data.get('registry', 'N/A')}")
    if treasury:
        console.print(f"[blue]Treasury:[/blue] {data.get('treasury', 'N/A')}")
    if fee_router:
        console.print(f"[blue]Fee Router:[/blue] {data.get('fee_router', 'N/A')}")
    if emission:
        console.print(f"[blue]Emission:[/blue] {data.get('emission', 'N/A')}")

    if not any([coordinator, token, stake, representative, registry, treasury, fee_router, emission]):
        console.print(f"[cyan]Coordinator:[/cyan] {data.get('coordinator', 'N/A')}")
        console.print(f"[green]DIN Token:[/green] {data.get('token', 'N/A')}")
        console.print(f"[yellow]Staking Contract:[/yellow] {data.get('stake', 'N/A')}")
        console.print(f"[magenta]Representative:[/magenta] {data.get('representative', 'N/A')}")
        console.print(f"[magenta]Registry:[/magenta] {data.get('registry', 'N/A')}")
        if data.get("treasury"):
            console.print(f"[blue]Treasury:[/blue] {data.get('treasury')}")
        if data.get("fee_router"):
            console.print(f"[blue]Fee Router:[/blue] {data.get('fee_router')}")
        if data.get("emission"):
            console.print(f"[blue]Emission:[/blue] {data.get('emission')}")


# ---------------------------------------------------------------------------
# Platform deployments import
# ---------------------------------------------------------------------------
# The platform contracts (DinTreasury, DinToken, DinCoordinator,
# DinValidatorStake, DINModelRegistry, DinFeeRouter, DinEmission) are
# transparent proxies. INTERIM bootstrap flow: proxy deployment + initialize +
# wiring is done by a toolchain script running the OpenZeppelin upgrades
# validation:
#
#     cd foundry && forge script script/DeployPlatform.s.sol --rpc-url <rpc> --broadcast ...   # primary
#     cd hardhat && npx hardhat run scripts/deploy-platform.ts --network <net>              # secondary
#
# Each script records the proxy addresses in <toolchain>/deployments/<net>.json
# (same schema); `dincli system import-deployments` maps that file into
# din_info.json so all dincli commands resolve the deployed platform.
#
# NOTE — this is not the target architecture. The decision record
# Documentation/technical/upgradable-contracts/proxy-deployment-architecture.md
# chose native web3.py proxy deployment inside `dinrep deploy` (its Option C;
# backlog: Developer/issues/dincli-native-proxy-deployment.md). Once that
# lands, this command demotes to a secondary sync utility for script-driven
# deployments/upgrades and for adopting already-deployed networks. Either way
# din_info.json stays the contract with the rest of dincli.

# dincli network name → deploy-toolchain network name (standalone `npx hardhat
# node` / anvil are both "localhost"); networks not listed map to themselves.
# Shared by both the hardhat and foundry deployments/<network>.json lookups.
_DEPLOYMENT_CHAIN_NETWORK_FOR = {"local": "localhost"}

# deployments/<network>.json keys (savePlatformAddresses in deploy/helpers.ts)
# → din_info.json keys. proxy_admin_* keys are informational; the four contract
# keys are required.
_DEPLOYMENTS_TO_DIN_INFO = {
    "dinCoordinator": "coordinator",
    "dinToken": "token",
    "dinValidatorStake": "stake",
    "dinModelRegistry": "registry",
    "dinTreasury": "treasury",
    "dinFeeRouter": "fee_router",
    "dinEmission": "emission",
    "proxyAdminToken": "proxy_admin_token",
    "proxyAdminCoordinator": "proxy_admin_coordinator",
    "proxyAdminStake": "proxy_admin_stake",
    "proxyAdminRegistry": "proxy_admin_registry",
    "proxyAdminTreasury": "proxy_admin_treasury",
    "proxyAdminFeeRouter": "proxy_admin_fee_router",
    "proxyAdminEmission": "proxy_admin_emission",
}
_REQUIRED_DEPLOYMENT_KEYS = ("dinToken", "dinCoordinator", "dinValidatorStake", "dinModelRegistry")


@app.command("import-deployments")
def import_deployments(ctx: typer.Context,
    file: Optional[Path] = typer.Option(
        None, "--file", "-f",
        help="Explicit deployments JSON path. Mutually exclusive with --foundry/--hardhat.",
    ),
    foundry: bool = typer.Option(
        False, "--foundry",
        help="Load from foundry/deployments/<network>.json (dincli 'local' maps to 'localhost'). Mutually exclusive with --hardhat/--file. Default when no flag is given.",
    ),
    hardhat: bool = typer.Option(
        False, "--hardhat",
        help="Load from hardhat/deployments/<network>.json (dincli 'local' maps to 'localhost'). Mutually exclusive with --foundry/--file.",
    ),
):
    """
    Import platform proxy addresses from a deployments JSON into din_info.json.

    Foundry flow (default, --foundry is optional/implicit):

      forge script foundry/script/DeployPlatform.s.sol --rpc-url http://127.0.0.1:8545 --broadcast ...
      dincli system import-deployments

    Hardhat flow:

      cd hardhat && npx hardhat run scripts/deploy-platform.ts --network localhost
      dincli system import-deployments --hardhat

    Foundry writes 14 keys (7 contracts + 7 proxy admins, including
    dinTreasury and dinFeeRouter added in PR #51 and dinEmission added in
    PR #148); hardhat still writes the four-contract shape — both
    toolchains use per-contract proxyAdmin keys, but hardhat predates both
    of those additions and carries no treasury, fee-router, or emission
    entries (consistent with hardhat being the secondary toolchain).
    Pass --file to supply an explicit path. --foundry, --hardhat, and --file
    are all mutually exclusive with each other.

    Only the platform address keys of the active network's din_info entry are
    updated (coordinator, token, stake, registry, treasury, fee_router,
    emission, proxy_admin_*); everything else (representative, explorer,
    default CIDs, ...) is preserved.
    """
    console = ctx.obj.console
    effective_network = ctx.obj.network

    if sum([foundry, hardhat, file is not None]) > 1:
        console.print("[red]❌ --foundry, --hardhat, and --file are mutually exclusive; pass only one.[/red]")
        raise typer.Exit(1)

    if file is None:
        network_key = _DEPLOYMENT_CHAIN_NETWORK_FOR.get(effective_network, effective_network)
        if hardhat:
            file = Path("hardhat") / "deployments" / f"{network_key}.json"
        else:
            # --foundry explicit, or no flag given (foundry is the default).
            file = Path("foundry") / "deployments" / f"{network_key}.json"

    file = file.expanduser()
    if not file.exists():
        console.print(f"[red]❌ Deployments file not found: {file}[/red]")
        if hardhat:
            console.print("[yellow]Run the platform deploy script first:[/yellow] cd hardhat && npx hardhat run scripts/deploy-platform.ts --network <net>")
        else:
            console.print("[yellow]Run the Foundry deploy script first:[/yellow] forge script foundry/script/DeployPlatform.s.sol --rpc-url http://127.0.0.1:8545 --broadcast ...")
        raise typer.Exit(1)

    try:
        with open(file) as f:
            deployments = json.load(f)
    except (json.JSONDecodeError, OSError) as e:
        console.print(f"[red]❌ Failed to read deployments file: {e}[/red]")
        raise typer.Exit(1)

    missing = [k for k in _REQUIRED_DEPLOYMENT_KEYS if k not in deployments]
    if missing:
        console.print(f"[red]❌ Deployments file is missing keys: {', '.join(missing)}[/red]")
        raise typer.Exit(1)
    bad = [k for k in _DEPLOYMENTS_TO_DIN_INFO if k in deployments and not is_ethereum_address(deployments[k])]
    if bad:
        console.print(f"[red]❌ Not a valid Ethereum address for: {', '.join(bad)}[/red]")
        raise typer.Exit(1)

    din_info = load_din_info()
    entry = din_info.setdefault(effective_network, {})
    for src_key, dst_key in _DEPLOYMENTS_TO_DIN_INFO.items():
        if src_key in deployments:
            entry[dst_key] = deployments[src_key]
    save_din_info(din_info)

    console.print(f"[green]✅ Imported platform deployments into din_info.json[/green] (network: {effective_network})")
    console.print(f"[cyan]Source:[/cyan] {file}")
    console.print(f"[cyan]Coordinator:[/cyan] {entry.get('coordinator')}")
    console.print(f"[green]DIN Token:[/green] {entry.get('token')}")
    console.print(f"[yellow]Staking Contract:[/yellow] {entry.get('stake')}")
    console.print(f"[magenta]Registry:[/magenta] {entry.get('registry')}")
    if entry.get("treasury"):
        console.print(f"[blue]Treasury:[/blue] {entry.get('treasury')}")
    if entry.get("fee_router"):
        console.print(f"[blue]Fee Router:[/blue] {entry.get('fee_router')}")
    if entry.get("emission"):
        console.print(f"[blue]Emission:[/blue] {entry.get('emission')}")
    for _label, _key in [
        ("Proxy Admin (token)", "proxy_admin_token"),
        ("Proxy Admin (coordinator)", "proxy_admin_coordinator"),
        ("Proxy Admin (stake)", "proxy_admin_stake"),
        ("Proxy Admin (registry)", "proxy_admin_registry"),
        ("Proxy Admin (treasury)", "proxy_admin_treasury"),
        ("Proxy Admin (fee router)", "proxy_admin_fee_router"),
        ("Proxy Admin (emission)", "proxy_admin_emission"),
    ]:
        if entry.get(_key):
            console.print(f"[magenta]{_label}:[/magenta] {entry[_key]}")


# ── EIP-1967 storage slots ──────────────────────────────────────────────────
# implementation: bytes32(uint256(keccak256("eip1967.proxy.implementation")) - 1)
_EIP1967_IMPL_SLOT  = "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc"
# admin:          bytes32(uint256(keccak256("eip1967.proxy.admin")) - 1)
_EIP1967_ADMIN_SLOT = "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103"

# Minimal ABI fragments used by verify-deployment
_OWNER_ABI    = [{"inputs": [], "name": "owner",             "outputs": [{"type": "address"}], "stateMutability": "view", "type": "function"}]
_WIRING_ABI   = [
    {"inputs": [], "name": "dinToken",                 "outputs": [{"type": "address"}], "stateMutability": "view", "type": "function"},
    {"inputs": [], "name": "dinValidatorStakeContract","outputs": [{"type": "address"}], "stateMutability": "view", "type": "function"},
    {"inputs": [], "name": "feeRouter",                "outputs": [{"type": "address"}], "stateMutability": "view", "type": "function"},
]
_SLASHER_ABI     = [{"inputs": [{"type": "address"}], "name": "slasherContracts", "outputs": [{"type": "bool"}], "stateMutability": "view", "type": "function"}]
_FEE_ROUTER_ABI  = [{"inputs": [], "name": "treasury",          "outputs": [{"type": "address"}], "stateMutability": "view", "type": "function"}]
_REGISTRY_ABI    = [{"inputs": [], "name": "dinValidatorStake", "outputs": [{"type": "address"}], "stateMutability": "view", "type": "function"}]

# Proxy names and the matching JSON keys for proxy / proxyAdmin / impl / codehash
_PROXIES = [
    ("DinTreasury",        "dinTreasury",        "proxyAdminTreasury",    "dinTreasuryImpl",        "dinTreasuryImplCodehash"),
    ("DinToken",           "dinToken",           "proxyAdminToken",       "dinTokenImpl",           "dinTokenImplCodehash"),
    ("DinCoordinator",     "dinCoordinator",     "proxyAdminCoordinator", "dinCoordinatorImpl",     "dinCoordinatorImplCodehash"),
    ("DinFeeRouter",       "dinFeeRouter",       "proxyAdminFeeRouter",   "dinFeeRouterImpl",       "dinFeeRouterImplCodehash"),
    ("DinValidatorStake",  "dinValidatorStake",  "proxyAdminStake",       "dinValidatorStakeImpl",  "dinValidatorStakeImplCodehash"),
    ("DINModelRegistry",   "dinModelRegistry",   "proxyAdminRegistry",    "dinModelRegistryImpl",   "dinModelRegistryImplCodehash"),
    ("DinEmission",        "dinEmission",        "proxyAdminEmission",    "dinEmissionImpl",        "dinEmissionImplCodehash"),
]


def _slot_to_address(w3, raw: bytes) -> str:
    """Convert a 32-byte EIP-1967 slot value to a checksummed address."""
    return w3.to_checksum_address("0x" + raw.hex()[-40:])


def _read_impl_slot(w3, proxy: str) -> str:
    raw = w3.eth.get_storage_at(proxy, _EIP1967_IMPL_SLOT)
    return _slot_to_address(w3, raw)


def _read_admin_slot(w3, proxy: str) -> str:
    raw = w3.eth.get_storage_at(proxy, _EIP1967_ADMIN_SLOT)
    return _slot_to_address(w3, raw)


def _codehash(w3, addr: str) -> str:
    """keccak256 of the runtime bytecode at addr, matching EVM extcodehash."""
    from eth_utils import keccak
    code = w3.eth.get_code(addr)
    if not code:
        return "0x" + "00" * 32
    return "0x" + keccak(code).hex()


@app.command("verify-deployment")
def verify_deployment(
    ctx: typer.Context,
    file: Optional[Path] = typer.Option(
        None, "--file", "-f",
        help="Explicit deployments JSON path. Defaults to foundry/deployments/<network>.json.",
    ),
    no_color: bool = typer.Option(
        False, "--no-color",
        help="Plain-text output without Rich markup (auto-detected when stdout is not a tty).",
    ),
    slashers: Optional[str] = typer.Option(
        None, "--slashers",
        help="Comma-separated list of expected slasher (task-coordinator) addresses. "
             "If omitted the on-chain slasher list is reported as informational only.",
    ),
):
    """
    Verify that foundry/deployments/<network>.json matches the live chain.

    Reads the deployments file (written by DeployPlatform.s.sol / UpgradePlatform.s.sol),
    connects to the configured RPC, and checks:

    \b
      1. EIP-1967 implementation slot of each proxy
      2. EIP-1967 admin slot of each proxy
      3. extcodehash of each implementation vs the recorded codehash
      4. owner() of each ProxyAdmin
      5. DinCoordinator cross-contract wiring (dinToken / dinValidatorStakeContract / feeRouter)
      5b. DinFeeRouter.treasury() points at the recorded dinTreasury proxy
      5c. DINModelRegistry.dinValidatorStake() points at the recorded dinValidatorStake proxy
      6. DinValidatorStake slasher authorizations (informational when no --slashers given)

    Exits 0 when all checks pass, 1 on any DRIFT or ERROR.

    This check is read-only; it never sends transactions.
    It covers only what the deployments file records — a clean run does not
    prove that nothing else was deployed or authorized outside that file.
    """
    import sys
    from eth_utils import keccak

    use_plain = no_color or not sys.stdout.isatty()
    raw_console = ctx.obj.console

    def _emit(status: str, msg: str):
        tag = f"[{status}]".ljust(7)
        if use_plain:
            raw_console.print(f"{tag} {msg}", markup=False, highlight=False)
        else:
            color = {"OK": "green", "DRIFT": "red", "ERROR": "red", "INFO": "cyan", "WARN": "yellow"}.get(status, "white")
            raw_console.print(f"[{color}]{tag}[/{color}] {msg}")

    network = ctx.obj.network
    w3 = ctx.obj.w3

    if file is None:
        network_key = _DEPLOYMENT_CHAIN_NETWORK_FOR.get(network, network)
        file = Path("foundry") / "deployments" / f"{network_key}.json"

    file = file.expanduser()
    if not file.exists():
        _emit("ERROR", f"Deployments file not found: {file}")
        raise typer.Exit(1)

    try:
        with open(file) as fh:
            deps = json.load(fh)
    except (json.JSONDecodeError, OSError) as e:
        _emit("ERROR", f"Failed to read deployments file: {e}")
        raise typer.Exit(1)

    commit = deps.get("deployedAtCommit", "")
    if commit:
        _emit("INFO", f"deployedAtCommit: {commit}")
    recorded_owner = deps.get("owner", "")

    drift = False

    # ── Check 1 + 2: EIP-1967 impl and admin slots ──────────────────────────
    for label, proxy_key, admin_key, impl_key, _codehash_key in _PROXIES:
        proxy_addr = deps.get(proxy_key)
        if not proxy_addr:
            _emit("WARN", f"{label}: proxy address not in deployments file — skipped")
            continue
        try:
            proxy_addr = w3.to_checksum_address(proxy_addr)
        except Exception:
            _emit("ERROR", f"{label}: invalid proxy address in file: {proxy_addr}")
            drift = True
            continue

        # Check 1 — implementation slot
        recorded_impl = deps.get(impl_key, "")
        try:
            on_chain_impl = _read_impl_slot(w3, proxy_addr)
        except Exception as exc:
            _emit("ERROR", f"{label} impl slot read failed: {exc}")
            drift = True
        else:
            if recorded_impl and w3.to_checksum_address(recorded_impl) == on_chain_impl:
                _emit("OK", f"{label} proxy → impl {on_chain_impl}")
            elif not recorded_impl:
                _emit("INFO", f"{label} impl (no recorded value): on-chain {on_chain_impl}")
            else:
                _emit("DRIFT", f"{label} impl: recorded {recorded_impl}  actual {on_chain_impl}")
                drift = True

        # Check 2 — admin slot
        recorded_admin = deps.get(admin_key, "")
        try:
            on_chain_admin = _read_admin_slot(w3, proxy_addr)
        except Exception as exc:
            _emit("ERROR", f"{label} admin slot read failed: {exc}")
            drift = True
        else:
            if recorded_admin and w3.to_checksum_address(recorded_admin) == on_chain_admin:
                _emit("OK", f"{label} proxyAdmin {on_chain_admin}")
            elif not recorded_admin:
                _emit("INFO", f"{label} proxyAdmin (no recorded value): on-chain {on_chain_admin}")
            else:
                _emit("DRIFT", f"{label} proxyAdmin: recorded {recorded_admin}  actual {on_chain_admin}")
                drift = True

    # ── Check 3: extcodehash of each implementation ──────────────────────────
    for label, _proxy_key, _admin_key, impl_key, codehash_key in _PROXIES:
        impl_addr = deps.get(impl_key, "")
        recorded_ch = deps.get(codehash_key, "")
        if not impl_addr or not recorded_ch:
            continue
        try:
            impl_addr = w3.to_checksum_address(impl_addr)
            actual_ch = _codehash(w3, impl_addr)
        except Exception as exc:
            _emit("ERROR", f"{label} codehash check failed: {exc}")
            drift = True
            continue
        if actual_ch.lower() == recorded_ch.lower():
            _emit("OK", f"{label} impl codehash {actual_ch[:18]}…")
        else:
            _emit("DRIFT", f"{label} impl codehash: recorded {recorded_ch[:18]}…  actual {actual_ch[:18]}…")
            drift = True

    # ── Check 4: owner() of each ProxyAdmin ──────────────────────────────────
    for label, _proxy_key, admin_key, _impl_key, _codehash_key in _PROXIES:
        admin_addr = deps.get(admin_key, "")
        if not admin_addr:
            continue
        try:
            admin_addr = w3.to_checksum_address(admin_addr)
            contract = w3.eth.contract(address=admin_addr, abi=_OWNER_ABI)
            actual_owner = contract.functions.owner().call()
        except Exception as exc:
            _emit("ERROR", f"{label} proxyAdmin.owner() failed: {exc}")
            drift = True
            continue
        if recorded_owner and w3.to_checksum_address(recorded_owner) == actual_owner:
            _emit("OK", f"{label} proxyAdmin owner {actual_owner}")
        elif not recorded_owner:
            _emit("INFO", f"{label} proxyAdmin owner (no recorded value): on-chain {actual_owner}")
        else:
            _emit("DRIFT", f"{label} proxyAdmin owner: recorded {recorded_owner}  actual {actual_owner}")
            drift = True

    # ── Check 4b: owner() of each application proxy ──────────────────────────
    for label, proxy_key, _admin_key, _impl_key, _codehash_key in _PROXIES:
        proxy_addr = deps.get(proxy_key, "")
        if not proxy_addr:
            continue
        try:
            proxy_addr = w3.to_checksum_address(proxy_addr)
            contract = w3.eth.contract(address=proxy_addr, abi=_OWNER_ABI)
            actual_owner = contract.functions.owner().call()
        except Exception as exc:
            _emit("ERROR", f"{label} owner() failed: {exc}")
            drift = True
            continue
        if recorded_owner and w3.to_checksum_address(recorded_owner) == actual_owner:
            _emit("OK", f"{label} owner {actual_owner}")
        elif not recorded_owner:
            _emit("INFO", f"{label} owner (no recorded value): on-chain {actual_owner}")
        else:
            _emit("DRIFT", f"{label} owner: recorded {recorded_owner}  actual {actual_owner}")
            drift = True

    # ── Check 5: DinCoordinator cross-contract wiring ────────────────────────
    coordinator_addr = deps.get("dinCoordinator", "")
    if coordinator_addr:
        try:
            coordinator_addr = w3.to_checksum_address(coordinator_addr)
            coord = w3.eth.contract(address=coordinator_addr, abi=_WIRING_ABI)
            wiring_checks = [
                ("dinToken",                 "dinToken",          coord.functions.dinToken().call()),
                ("dinValidatorStakeContract", "dinValidatorStake", coord.functions.dinValidatorStakeContract().call()),
                ("feeRouter",                "dinFeeRouter",      coord.functions.feeRouter().call()),
            ]
            for desc, dep_key, actual in wiring_checks:
                recorded = deps.get(dep_key, "")
                if recorded and w3.to_checksum_address(recorded) == w3.to_checksum_address(actual):
                    _emit("OK", f"wiring: DinCoordinator.{desc} → {actual}")
                elif not recorded:
                    _emit("INFO", f"wiring: DinCoordinator.{desc} on-chain {actual}")
                else:
                    _emit("DRIFT", f"wiring: DinCoordinator.{desc}: recorded {recorded}  actual {actual}")
                    drift = True
        except Exception as exc:
            _emit("ERROR", f"DinCoordinator wiring check failed: {exc}")
            drift = True

    # ── Check 5b: FeeRouter.treasury wiring (independent of coordinator) ─────
    fee_router_addr = deps.get("dinFeeRouter", "")
    treasury_addr   = deps.get("dinTreasury", "")
    if fee_router_addr and treasury_addr:
        try:
            fee_router_cs = w3.to_checksum_address(fee_router_addr)
            treasury_cs   = w3.to_checksum_address(treasury_addr)
            if int(fee_router_cs, 16) == 0:
                _emit("WARN", "DinFeeRouter address is zero — treasury wiring check skipped")
            else:
                fee_router = w3.eth.contract(address=fee_router_cs, abi=_FEE_ROUTER_ABI)
                actual_treasury = w3.to_checksum_address(fee_router.functions.treasury().call())
                if treasury_cs == actual_treasury:
                    _emit("OK", f"wiring: DinFeeRouter.treasury → {actual_treasury}")
                else:
                    _emit("DRIFT", f"wiring: DinFeeRouter.treasury: recorded {treasury_cs}  actual {actual_treasury}")
                    drift = True
        except Exception as exc:
            _emit("ERROR", f"DinFeeRouter.treasury() check failed: {exc}")
            drift = True

    # ── Check 5c: DINModelRegistry.dinValidatorStake wiring ──────────────────
    registry_addr = deps.get("dinModelRegistry", "")
    stake_dep     = deps.get("dinValidatorStake", "")
    if registry_addr and stake_dep:
        try:
            registry_cs = w3.to_checksum_address(registry_addr)
            if int(registry_cs, 16) == 0:
                pass  # no registry recorded — skip
            else:
                stake_cs = w3.to_checksum_address(stake_dep)
                registry = w3.eth.contract(address=registry_cs, abi=_REGISTRY_ABI)
                actual_stake = w3.to_checksum_address(registry.functions.dinValidatorStake().call())
                if stake_cs == actual_stake:
                    _emit("OK", f"wiring: DINModelRegistry.dinValidatorStake → {actual_stake}")
                else:
                    _emit("DRIFT", f"wiring: DINModelRegistry.dinValidatorStake: recorded {stake_cs}  actual {actual_stake}")
                    drift = True
        except Exception as exc:
            _emit("ERROR", f"DINModelRegistry.dinValidatorStake check failed: {exc}")
            drift = True

    # ── Check 6: slasher authorizations ──────────────────────────────────────
    stake_addr = deps.get("dinValidatorStake", "")
    if stake_addr:
        try:
            stake_addr = w3.to_checksum_address(stake_addr)
            stake_contract = w3.eth.contract(address=stake_addr, abi=_SLASHER_ABI)
            if slashers:
                expected_list = [s.strip() for s in slashers.split(",") if s.strip()]
                for addr in expected_list:
                    try:
                        addr = w3.to_checksum_address(addr)
                        authorized = stake_contract.functions.slasherContracts(addr).call()
                    except Exception as exc:
                        _emit("ERROR", f"slasher check for {addr} failed: {exc}")
                        drift = True
                        continue
                    if authorized:
                        _emit("OK", f"slasher {addr} authorized on DinValidatorStake")
                    else:
                        _emit("DRIFT", f"slasher {addr} NOT authorized on DinValidatorStake")
                        drift = True
            else:
                _emit("INFO", "slasher list: pass --slashers to verify; on-chain list not enumerated")
        except Exception as exc:
            _emit("ERROR", f"DinValidatorStake slasher check failed: {exc}")
            drift = True

    if drift:
        raise typer.Exit(1)


@app.command("reset-all")
def reset_all(
    ctx: typer.Context,
    force: bool = typer.Option(False, "--force", "-f", help="Skip confirmation prompt"),
    cache: bool = typer.Option(False, "--cache", "-c", help="Reset cache directory"),
    config: bool = typer.Option(False, "--config", "-co", help="Reset config directory"),
):
    """
    Reset DIN CLI state.

    By default (no flags), deletes both config and cache directories.
    Use --cache or --config to delete only one.
    """

    # Decide which paths to consider
    targets = []
    if config:
        targets.append(("Config", CONFIG_DIR))
    if cache:
        targets.append(("Cache", CACHE_DIR))

    # If neither flag is given, reset both
    if not (cache or config):
        targets = [("Config", CONFIG_DIR), ("Cache", CACHE_DIR)]

    # Filter only existing paths to avoid noise
    to_delete = [(name, path) for name, path in targets if path.exists()]

    if not to_delete:
        typer.secho("[yellow]No DIN CLI data found to delete.[/yellow]", fg=typer.colors.YELLOW)
        return

    # Build confirmation message
    paths_str = "\n".join(str(path.resolve()) for _, path in to_delete)
    if not force:
        typer.secho(
            f"[red]⚠️  This will permanently delete the following:[/red]\n{paths_str}\n",
            fg=typer.colors.RED,
            bold=True,
        )
        if not typer.confirm("Are you sure?"):
            typer.secho("[cyan]Operation cancelled.[/cyan]", fg=typer.colors.CYAN)
            raise typer.Exit()

    # Perform deletion
    for name, path in to_delete:
        try:
            shutil.rmtree(path)
            typer.secho(f"[green]✅ Deleted {name} directory: {path}[/green]")
        except Exception as e:
            typer.secho(f"[red]❌ Failed to delete {path}: {e}[/red]", fg=typer.colors.RED)
            raise typer.Exit(code=1)    


@app.command("todo")
def todo(
    ctx: typer.Context,
    client: bool = typer.Option(False, "--client", "-cl", help="todo as client"),
    aggregator: bool = typer.Option(False, "--aggregator", "-ag", help="todo as aggregator"),
    auditor: bool = typer.Option(False, "--auditor", "-au", help="todo as auditor"),
    model_owner: bool = typer.Option(False, "--model-owner", "-mo", help="todo as model owner"),
    model_id: str = typer.Option(None, "--model-id", "-m", help="Model ID"),
):
    typer.secho("TODO list:", fg=typer.colors.CYAN)

    effective_network, w3, account, console = ctx.obj.get_en_w3_account_console(model_id)

    if not CONFIG_DIR.exists():
        console.print(f"[red]❌ Config directory does not exist: {CONFIG_DIR}[/red], run 'dincli system init' to create it.")
    else:
        console.print(f"[green]✅ Config directory exists: {CONFIG_DIR}[/green]")

    if not CACHE_DIR.exists():
        console.print(f"[red]❌ Cache directory does not exist: {CACHE_DIR}[/red], run 'dincli system init' to create it.")
    else:
        console.print(f"[green]✅ Cache directory exists: {CACHE_DIR}[/green]")
    
    if not CONFIG_FILE.exists():
        console.print(f"[red]❌ Config file does not exist: {CONFIG_FILE}[/red], run 'dincli system init' to create it.")
    else:
        console.print(f"[green]✅ Config file exists: {CONFIG_FILE}[/green]")
        config = load_config()
        if config.get("network") is None: 
            console.print(f"[red]❌ Config file does not contain a network[/red], run 'dincli system configure-network' to set it.")
        else:
            console.print(f"[green]✅ Config file contains a network: {config.get('network')}[/green]")
        if config.get("log_level") is None: 
            console.print(f"[red]❌ Config file does not contain a log level[/red], run 'dincli system configure-logging' to set it.")
        else:
            console.print(f"[green]✅ Config file contains a log level: {config.get('log_level')}[/green]")
        if config.get("demo_mode") is None: 
            console.print(f"[red]❌ Config file does not contain a demo mode[/red], run 'dincli system configure-demo' to set it.")
        else:
            console.print(f"[green]✅ Config file contains a demo mode: {config.get('demo_mode')}[/green]")

    active_name = ctx.obj.resolved_wallet_name
    wallet_path, wallet_exists = resolve_wallet_path(active_name)
    if not wallet_exists:
        console.print(f"[red]❌ No wallet found for '{active_name}' at {wallet_path}.[/red]\n  Run 'dincli system connect-wallet' to create one.")
    else:
        console.print(f"[green]✅ Wallet exists for '{active_name}': {wallet_path}[/green]")

    accounts = list_accounts(active_name)
    if len(accounts) > 1:
        console.print("[cyan]Named wallets:[/cyan]")
        for e in accounts:
            marker = "[green](active)[/green]" if e["active"] else ""
            console.print(f"  [bold]{e['name']}[/bold] → {e['address']}{marker}")

    env_key = "DIN_WALLET_PASSWORD"
    cwd = os.getcwd()
    if get_env_key(env_key, None, False) is None:
        console.print(
            f"[red]❌ Wallet password not found.[/red]\n"
            f"Please define [bold]{env_key}[/bold] in a [.env] file in your current directory:\n"
            f"  → File path: [cyan]{cwd}/.env[/cyan]\n"
            f"  → File content:\n"
            f"      {env_key}=your_wallet_password\n"
            f"[dim]🔒 Important: Never commit [.env] to version control.[/dim]"
        )
    else:
        console.print(f"[green]✅ Wallet password found in environment variable: {env_key} in {cwd}/.env file[/green]")

    env_key = str(effective_network).upper() + "_RPC_URL"
    if get_env_key(env_key, None, False) is None:
        console.print(
            f"[red]❌ RPC URL not found for network '[bold]{effective_network}[/bold]'.[/red]\n"
            f"Please define [bold]{env_key}[/bold] in your [.env] file:\n"
            f"  → File path: [cyan]{cwd}/.env[/cyan]\n"
            f"  → Example value:\n"
            f"      {env_key}=https://rpc.sepolia.org\n"
            f"\n"
            f"[dim]💡 You can get free RPC URLs from services like Infura, Alchemy, or QuickNode.[/dim]\n"
            f"[dim]🔒 Remember: Never commit [.env] to version control.[/dim]"
        )
    else:
        console.print(f"[green]✅ RPC URL found in environment variable: {env_key} in {cwd}/.env file[/green]")

    if CONFIG_FILE.exists():
        config = load_config()
        network = config.get("network")
        if network:
            rpc_env_key = f"{network.upper()}_RPC_URL"
            if get_env_key(rpc_env_key, None, False) is None:
                console.print(
                f"[red]❌ RPC URL not found for network '[bold]{network}[/bold]'.[/red]\n"
                f"Please define [bold]{rpc_env_key}[/bold] in your [.env] file:\n"
                f"  → File path: [cyan]{cwd}/.env[/cyan]\n"
                f"  → Example value:\n"
                f"      {rpc_env_key}=https://rpc.sepolia.org\n"
                f"\n"
                f"[dim]💡 You can get free RPC URLs from services like Infura, Alchemy, or QuickNode.[/dim]\n"
                f"[dim]🔒 Remember: Never commit [.env] to version control.[/dim]"
            )
            else:
                console.print(f"[green]✅ RPC URL found in environment variable: {rpc_env_key} in {cwd}/.env file[/green]")

    ipfs_config = resolve_ipfs_config()
    console.print(f"[green]✅ Active IPFS provider: {ipfs_config.provider}[/green]")

    if ipfs_config.provider == "env":
        if ipfs_config.api_url_add is None:
            console.print(
                f"[red]❌ IPFS API ADD URL not found.[/red]\n"
                f"Please define [bold]IPFS_API_URL_ADD[/bold] in your [.env] file:\n"
                f"  → File path: [cyan]{cwd}/.env[/cyan]\n"
                f"  → Example value:\n"
                f"      IPFS_API_URL_ADD=http://localhost:5001/api/v0\n"
                f"\n"
                f"[dim]🔒 Important: Never commit [.env] to version control.[/dim]"
            )
        else:
            console.print(f"[green]✅ IPFS API ADD URL found in environment variable: IPFS_API_URL_ADD in {cwd}/.env file with value: {ipfs_config.api_url_add}[/green]")

        if ipfs_config.api_url_retrieve is None:
            console.print(
                f"[red]❌ IPFS API RETRIEVE URL not found.[/red]\n"
                f"Please define [bold]IPFS_API_URL_RETRIEVE[/bold] in your [.env] file:\n"
                f"  → File path: [cyan]{cwd}/.env[/cyan]\n"
                f"  → Example value:\n"
                f"      IPFS_API_URL_RETRIEVE=http://localhost:5001/api/v0\n"
                f"\n"
                f"[dim] Important: Never commit [.env] to version control.[/dim]"
            )
        else:
            console.print(f"[green]✅ IPFS API RETRIEVE URL found in environment variable: IPFS_API_URL_RETRIEVE in {cwd}/.env file with value: {ipfs_config.api_url_retrieve}[/green]")
    elif ipfs_config.provider == "filebase":
        if ipfs_config.api_key is None:
            console.print("[red]❌ Filebase API key not found in dincli config. Run `dincli system configure-ipfs --provider filebase --api-key <token>`.[/red]")
        else:
            console.print("[green]✅ Filebase API key found in dincli config.[/green]")
    elif ipfs_config.provider == "custom":
        if ipfs_config.service_path is None:
            console.print("[red]❌ Custom IPFS service path not found in dincli config. Run `dincli system configure-ipfs --provider custom --service-path <path>`.[/red]")
        elif not ipfs_config.service_path.exists():
            console.print(f"[red]❌ Custom IPFS service path does not exist: {ipfs_config.service_path}[/red]")
        else:
            console.print(f"[green]✅ Custom IPFS service found at: {ipfs_config.service_path}[/green]")
    else:
        console.print(f"[red]❌ Unsupported IPFS provider in config: {ipfs_config.provider}[/red]")
    
    if client:
        if not model_id:
            console.print("[red]❌ Model ID not found in config file or cli argument.[/red]")
            raise typer.Exit(1)
        client_path =  Path(CACHE_DIR)/effective_network.lower()/ f"model_{model_id}"/ "dataset"/ "clients"/ account.address/ "data.pt"
        if client_path.exists():
            console.print(f"[green]✅ Client dataset found at: {client_path}[/green]")
        else:
            console.print(f"[red]❌ Client dataset not found at: {client_path}[/red]")

@dataset_app.command("distribute-mnist")
def distribute_mnist(
    ctx: typer.Context,
    num_clients: int = typer.Option(None, "--num-clients", "-nc", help="Number of clients"),
    seed: int = typer.Option(42, "--seed", "-s", help="Random seed"),
    test_train: bool = typer.Option(False, "--test-train", "-tt", help="get test/train dataset"),
    clients: bool = typer.Option(False, "--clients", "-cl", help="get clients dataset"),
    task_coordinator_address: str = typer.Option(None, "--task-coordinator", "-tc", help="TaskCoordinator address"),
    task: bool = typer.Option(False, "--task", "-t", help="get task dataset"),
    model_id: str = typer.Option(None, "--model-id", "-m", help="Model ID"),
    start_client_index: int = typer.Option(2, "--start-client-index", "-sci", help="Start client index of ETH_PRIVATE_KEY_i"),
):
    """
    Download MNIST and distribute it across N clients (IID split).
    """

    effective_network, w3, account, console = ctx.obj.get_en_w3_account_console(model_id)

    if (not task_coordinator_address or not task) and not model_id:
        if not task_coordinator_address:
            task_coordinator_address = resolve_task_coordinator_address(
                effective_network, None, console, exit_on_failure=True
            )

    if model_id:
        base_dir = ctx.obj.get_model_base_dir(model_id)
    elif task_coordinator_address:
        base_dir = ctx.obj.get_task_dir(task_coordinator_address)
    else:
        console.print("[red]❌ Model ID or task coordinator address is required.[/red]")
        raise typer.Exit(1)


    if not test_train and not clients:
        console.print("[red]❌ Both train/test flag and clients flag not found in cli argument.[/red]")
        raise typer.Exit(1)

    if clients and num_clients <= 0:
        console.print("[red]Number of clients must be >= 1[/red]")
        raise typer.Exit(1)
    if clients and num_clients > 10:
        console.print("[red]Number of clients must be < 10[/red]")
        raise typer.Exit(1)

    console.print(f"[cyan]Using base dir:[/cyan] {base_dir}")

    dataset_dir = base_dir / "dataset"
    clients_dir = dataset_dir / "clients"

    accounts_list = []
    if clients:
        demo_mode = get_config("demo_mode")
        if not start_client_index:
            start_client_index = 2

        for i in range(num_clients):
            if demo_mode:
                private_key = get_demo_private_key(i + start_client_index)
            else:
                private_key = get_env_key("ETH_PRIVATE_KEY_" + str(i + start_client_index))

            acct = Account.from_key(private_key)
            accounts_list.append(acct.address)


    service_entry = load_cid_services()["services"]["distribute_mnist"]
    service_path = base_dir / service_entry["path"].lstrip("/")
    requirements_path = base_dir / "requirements" / "distribute_mnist.txt"

    ctx.obj.ensure_file_exists(service_path, service_entry["ipfs"], "distribute_mnist service", base_dir=base_dir)
    ctx.obj.ensure_file_exists(requirements_path, service_entry["requirements"], "distribute_mnist requirements", base_dir=base_dir)

    _confirm_or_exit(
        f"Have you installed the required dependencies via `pip install -r {requirements_path}`?",
        f"Please install the required dependencies first: pip install -r {requirements_path}",
        console,
    )

    # -----------------------------------------------------------------------
    # Scenario A – save raw train/test datasets
    # -----------------------------------------------------------------------
    if test_train:
        console.print("[cyan]Processing Train/Test Datasets...[/cyan]")
        try:
            save_test_train_fn = ctx.obj.load_custom_fn(service_path, "save_test_train_datasets", base_dir=base_dir)
            save_test_train_fn(base_dir=base_dir)
        except Exception as e:
            console.print(f"[bold red]Error saving train/test datasets: {e}[/bold red]")
            raise typer.Exit(1)
        console.print(f"[green]Processed Train/Test Datasets saved successfully to {dataset_dir}![/green]")

    # -----------------------------------------------------------------------
    # Scenario B – distribute data to clients
    # -----------------------------------------------------------------------
    if clients:
        console.print("[cyan]Processing Client Datasets... This may take a while.[/cyan]")
        try:
            distribute_to_clients_fn = ctx.obj.load_custom_fn(service_path, "distribute_to_clients", base_dir=base_dir)
            result = distribute_to_clients_fn(
                base_dir=base_dir,
                accounts_list=accounts_list,
                num_clients=num_clients,
                seed=seed,
            )
        except Exception as e:
            console.print(f"[bold red]Error distributing MNIST to clients: {e}[/bold red]")
            raise typer.Exit(1)
        for item in result["client_datasets"]:
            console.print(
                f"[green]Saved client_{item['client_index']} ({item['num_samples']} samples) → {item['path']}[/green]"
            )
        console.print(f"[bold green]✅ MNIST distributed to {num_clients} clients under {clients_dir}[/bold green]")

@app.command("dump-abi")
def dump_abi(
    ctx: typer.Context,
    artifact_path: str = typer.Option(..., "--artifact", help="Path to contract artifact JSON (e.g., hardhat/artifacts/.../DINCoordinator.json)"),
    name: str = typer.Option(
        None,
        "--name",
        "-n",
        help="Output name (e.g., 'DINCoordinator'). Defaults to filename stem."
    ),
    include_bytecode: bool = typer.Option(
        False,
        "--bytecode",
        "-b",
        help="Also include 'bytecode' (useful for redeploying from CLI)."
    ),
    output_dir: str = typer.Option(
        None,
        "--output",
        "-o",
        help="Directory to save the output ABI file. Defaults to 'dincli/abis/'."
    ),
    official: bool = typer.Option(
        False,
        "--official",
        "-O",  # uppercase O to avoid conflict
        help="specify if official contract artifact.",
    ),

    
):
    """
    Extract ABI (and optionally bytecode) from a contract artifact and save it 
    in Hardhat-compatible format to dincli/abis/.

    Example:
      dincli system dump-abi --official --artifact "foundry/out/DinCoordinator.sol/DinCoordinator.json" --bytecode
    """

    # File-only operation: no network, web3 or wallet needed.
    console = ctx.obj.console
    
    artifact = Path(artifact_path)
    if not artifact.exists():
        console.print(f"[red]❌ Artifact not found: {artifact}[/red]")
        raise typer.Exit(1)

     # Load full artifact
    try:
        with open(artifact) as f:
            data = json.load(f)
    except (json.JSONDecodeError, OSError) as e:
        console.print(f"[red]❌ Failed to read artifact: {e}[/red]")
        raise typer.Exit(1)

    # Validate required fields
    if "abi" not in data:
        console.print(f"[red]❌ No 'abi' field in {artifact}[/red]")
        raise typer.Exit(1)

    # Build output data
    output_data = {"abi": data["abi"]}
    
    if include_bytecode and "bytecode" in data:
        if isinstance(data["bytecode"], dict):
            output_data["bytecode"] = data["bytecode"]["object"]
        else:
            output_data["bytecode"] = data["bytecode"]
    elif include_bytecode:
        console.print(f"[yellow]⚠️  'bytecode' not found in {artifact}, skipping.[/yellow]")

    # Determine name
    output_name = name or artifact.stem

    if official and not output_dir:
        abi_dir = files("dincli").joinpath("abis")
    elif output_dir:
        abi_dir = Path(output_dir)
    else:
        # Default to ./abis in the cwd
        abi_dir = Path.cwd() / "abis"

    abi_dir.mkdir(exist_ok=True)
    output_path = abi_dir / f"{output_name}.json"

    # Save in Hardhat-compatible format
    with open(output_path, "w") as f:
        json.dump(output_data, f, indent=2)

    console.print(f"[green]✅ Artifact saved to:[/green] {output_path}")
    console.print(f"[cyan]→ ABI-only: {not include_bytecode} | Includes bytecode: {include_bytecode}[/cyan]")
    
# dincli system
@app.command("configure-ipfs")
def configure_ipfs(ctx: typer.Context,
    provider: str = typer.Option(None, "--provider", "-p", help="IPFS provider [env, filebase, custom]"),
    api_key: str = typer.Option(None, "--api-key", "-k", help="API key for the selected provider"),
    api_secret: str = typer.Option(None, "--api-secret", "-s", help="Optional API secret for the selected provider"),
    service_path: Path = typer.Option(None, "--service-path", help="Python module implementing upload_to_ipfs and retrieve_from_ipfs for the custom provider"),
   ):

    config = load_config()
    configured_provider = normalize_ipfs_provider(config.get("ipfs_provider"))

    if provider is None and api_key is None and api_secret is None and service_path is None:
        active = resolve_ipfs_config()
        ctx.obj.console.print(f"[green]Active IPFS provider:[/green] {active.provider}")
        if active.provider == "env":
            ctx.obj.console.print("[cyan]Source:[/cyan] `IPFS_API_URL_ADD` and `IPFS_API_URL_RETRIEVE` from the current shell or .env")
        elif active.provider == "filebase":
            ctx.obj.console.print("[cyan]Source:[/cyan] Filebase token stored in dincli config")
        elif active.provider == "custom":
            ctx.obj.console.print(f"[cyan]Source:[/cyan] {active.service_path}")
        raise typer.Exit()

    selected_provider = normalize_ipfs_provider(provider) if provider is not None else configured_provider
    if selected_provider not in SUPPORTED_IPFS_PROVIDERS:
        ctx.obj.console.print(f"[red]❌ Invalid provider. Use {', '.join(SUPPORTED_IPFS_PROVIDERS)}.[/red]")
        raise typer.Exit(1)

    resolved_existing_api_key = _clean_optional_string(config.get(f"ipfs_api_key_{selected_provider}"))
    if not resolved_existing_api_key and selected_provider == "filebase":
        resolved_existing_api_key = _clean_optional_string(config.get("ipfs_api_key"))
    existing_service_path = config.get("ipfs_service_path")

    if selected_provider == "filebase" and not (api_key or resolved_existing_api_key):
        ctx.obj.console.print(f"[red]❌ Please specify an API key for the {selected_provider} provider.[/red]")
        raise typer.Exit(1)
    if selected_provider == "custom" and not (service_path or existing_service_path):
        ctx.obj.console.print("[red]❌ Please specify --service-path for the custom provider.[/red]")
        raise typer.Exit(1)

    config["ipfs_provider"] = selected_provider

    if api_key is not None:
        config[f"ipfs_api_key_{selected_provider}"] = api_key.strip()
        if selected_provider == "filebase":
            config["ipfs_api_key"] = api_key.strip()
    if api_secret is not None:
        config[f"ipfs_api_secret_{selected_provider}"] = api_secret.strip()
        if selected_provider == "filebase":
            config["ipfs_api_secret"] = api_secret.strip()
    if service_path is not None:
        config["ipfs_service_path"] = str(service_path.expanduser().resolve())

    save_config(config)

    ctx.obj.console.print(f"[green] ✅ Current IPFS provider: {selected_provider}[/green]")
    if selected_provider == "env":
        ctx.obj.console.print("[cyan] IPFS Runtime source:[/cyan] `IPFS_API_URL_ADD` and `IPFS_API_URL_RETRIEVE` from the current shell or .env")
    elif selected_provider == "filebase":
        ctx.obj.console.print("[cyan]Runtime source:[/cyan] Filebase RPC API token stored in dincli config")
    elif selected_provider == "custom":
        ctx.obj.console.print(f"[cyan]Runtime source:[/cyan] {config['ipfs_service_path']}")
   
@app.command("get-registry-fee")
def get_registry_fee(
    ctx: typer.Context,
    fee_type: str = typer.Option(None, "--fee-type", "-f", help="Type of fee to retrieve [model-registry, manifest-update]"),
    model_type: str = typer.Option(None, "--model-type", "-m", help="Type of model [proprietary, open-source]"),
):
    effective_network, w3, account, console = ctx.obj.get_en_w3_account_console()
    
    DINModelRegistry_Contract = ctx.obj.get_deployed_din_registry_contract()

    if fee_type == "model-registry" or fee_type is None:
        if model_type == "proprietary" or model_type is None:
            proprietary_fee = DINModelRegistry_Contract.functions.proprietaryFee().call()
            wei_to_eth = w3.from_wei(proprietary_fee, 'ether')
            console.print(f"[bold green]Proprietary fee for model-registry: {wei_to_eth} ETH[/bold green]")
        if model_type == "open-source" or model_type is None:
            open_source_fee = DINModelRegistry_Contract.functions.openSourceFee().call()
            wei_to_eth = w3.from_wei(open_source_fee, 'ether')
            console.print(f"[bold green]Open-source fee for model-registry: {wei_to_eth} ETH[/bold green]")
    if fee_type == "manifest-update" or fee_type is None:
        if model_type == "proprietary" or model_type is None:
            proprietary_update_fee = DINModelRegistry_Contract.functions.proprietaryUpdateFee().call()
            wei_to_eth = w3.from_wei(proprietary_update_fee, 'ether')
            console.print(f"[bold green]Proprietary update fee for manifest-update: {wei_to_eth} ETH[/bold green]")
        if model_type == "open-source" or model_type is None:
            open_source_update_fee = DINModelRegistry_Contract.functions.openSourceUpdateFee().call()
            wei_to_eth = w3.from_wei(open_source_update_fee, 'ether')
            console.print(f"[bold green]Open-source update fee for manifest-update: {wei_to_eth} ETH[/bold green]")


@app.command("bridge-eth")
def bridge_eth(
    ctx: typer.Context,
    amount: str = typer.Option(..., "--amount", help="ETH amount to deposit (e.g. 0.01)"),
    l1_rpc_url: Optional[str] = typer.Option(None, "--l1-rpc-url", help="L1 RPC URL override (else SEPOLIA_L1_RPC_URL)"),
    wait: bool = typer.Option(True, "--wait/--no-wait", help="Wait for the L2 balance increase (default) or return after L1 inclusion"),
    timeout: int = typer.Option(360, "--timeout", help="L2 poll timeout in seconds (with --wait)"),
    dry_run: bool = typer.Option(False, "--dry-run", help="Simulate every check and print the tx without signing"),
    yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt"),
):
    """
    Deposit ETH from Ethereum Sepolia L1 to the same address on OP Sepolia.

    Deposits only: withdrawals are L2→L1, take ~7 days, and need separate
    prove and finalize steps. Reorg protection is out of scope — L1 inclusion
    is reported, never "confirmation".
    """
    console = ctx.obj.console

    try:
        # ---- Stage 1: static preflight -------------------------------- #
        # Input validation (no RPC)
        amount_wei = bridge_service.parse_amount(amount)
        if timeout < 0:
            raise bridge_service.PreflightRejected("timeout must be non-negative")

        # Selected network, before any RPC (§3.1)
        network = ctx.obj.network
        if network != "sepolia_op_devnet":
            raise bridge_service.PreflightRejected(
                f"bridge-eth requires network 'sepolia_op_devnet', got '{network}'"
            )

        # L1 RPC resolution + connection (§3.6)
        l1_url = bridge_service.resolve_l1_rpc(l1_rpc_url, get_env_key)
        l1_w3 = bridge_service.connect_l1_rpc(l1_url)

        # Account, then L2 w3 (§3.1 order)
        account = ctx.obj.account
        l2_w3 = ctx.obj.w3

        # Chain ids, bridge bytecode/paused, sender + recipient code (§4.2)
        bridge_service.static_preflight(
            network=network,
            l1_w3=l1_w3,
            l2_w3=l2_w3,
            sender=account.address,
        )

        # ---- Stage 2: prepare ------------------------------------------ #
        tx, estimated_gas = bridge_service.prepare_transaction(
            l1_w3=l1_w3,
            sender=account.address,
            amount_wei=amount_wei,
        )

        # ---- Stage 3: financial preflight ------------------------------ #
        bridge_service.affordability_check(
            l1_w3=l1_w3,
            sender=account.address,
            value=amount_wei,
            gas_limit=tx["gas"],
            max_fee_per_gas=tx["maxFeePerGas"],
        )

        # ---- Stage 4: summary → dry-run or send ------------------------ #
        max_possible_fee = tx["gas"] * tx["maxFeePerGas"]
        console.print("[bold]Bridge deposit summary[/bold]")
        console.print(f"  From (L1):           {account.address}")
        console.print(f"  To (L2):             {account.address} (same address)")
        console.print(f"  Bridge proxy (L1):   {bridge_service.L1_STANDARD_BRIDGE_SEPOLIA}")
        console.print(f"  Amount:              {l1_w3.from_wei(amount_wei, 'ether')} ETH")
        console.print(f"  Nonce:               {tx['nonce']}")
        console.print(f"  Estimated gas:       {estimated_gas}")
        console.print(f"  Signed gas limit:    {tx['gas']}")
        console.print(f"  Max priority fee:    {l1_w3.from_wei(tx['maxPriorityFeePerGas'], 'gwei')} gwei")
        console.print(f"  Max fee per gas:     {l1_w3.from_wei(tx['maxFeePerGas'], 'gwei')} gwei")
        console.print(f"  Max possible fee:    {l1_w3.from_wei(max_possible_fee, 'ether')} ETH")

        if dry_run:
            # Dry-run: no prompt, no L2 baseline read, no signing (§5.2).
            # Print the exact unsigned tx params (data hexified for display).
            display_tx = {
                **tx,
                "data": "0x",
            }
            console.print("[bold]Unsigned transaction[/bold]")
            console.print(f"  {display_tx}")
            return

        # Live: confirm unless --yes
        if not yes:
            if not typer.confirm("Send this deposit?"):
                console.print("Operation cancelled — nothing signed.")
                raise typer.Exit(0)

        # Read L2 baseline ONLY when waiting (§5.2)
        baseline_wei = None
        if wait:
            baseline_wei = l2_w3.eth.get_balance(account.address)

        # Sign and print the locally computed hash BEFORE broadcast (§3.2)
        signed, tx_hash = bridge_service.sign_deposit(
            sender_account=account,
            tx=tx,
        )
        console.print(f"Transaction hash: {tx_hash}")

        # Broadcast once — never auto-retry (§3.2)
        tx_hash, block_number = bridge_service.broadcast_and_wait(
            l1_w3=l1_w3,
            signed=signed,
            tx_hash=tx_hash,
            l1_timeout=bridge_service.L1_RECEIPT_TIMEOUT,
        )
        console.print(f"included in block {block_number}")
        console.print(f"Sepolia explorer: https://sepolia.etherscan.io/tx/{tx_hash}")

        if wait:
            arrived = bridge_service.poll_l2_balance(
                l2_w3=l2_w3,
                address=account.address,
                baseline_wei=baseline_wei,
                timeout=timeout,
            )
            if arrived:
                console.print(
                    f"balance increase observed on L2 for {account.address} "
                    f"(L1 hash remains the durable reference: {tx_hash})"
                )
            else:
                console.print(
                    f"not visible yet on L2 — check the L1 hash: {tx_hash}"
                )
        else:
            console.print(f"submitted, delivery pending — hash: {tx_hash}")

    except bridge_service.BridgeError as e:
        # One sanitized line; every failure outcome in §3.2b maps to exit 1.
        console.print(f"[red]❌ {e}[/red]")
        raise typer.Exit(1)
    except ConnectionError:
        # #83 handles this globally once merged; local handling closes the
        # gap on plain main and stays harmless afterwards.
        console.print("[red]❌ could not connect to a blockchain RPC endpoint[/red]")
        raise typer.Exit(1)