@artblocks/abx-cli 0.1.0-alpha.13 → 0.1.0-alpha.15

package/dist/main.js

@@ -57,11 +57,11 @@ import { formatEther, toHex, zeroAddress } from 'viem';
 import { encodeFunctionData } from 'viem';
 import { DEP_RESOLUTION, deploySeedSource, deploySeriesCodeFactory, prepareCodeSetup, prepareDeploySeriesCode, resolveGenerator, resolveSeedSource, resolveSeriesCodeFactory, seriesCodeAbi, readParamSchema, seriesCodeFactoryAbi, } from '@artblocks/abx-sdk';
 import { checkRegistryDeps, dependencySetupCalls, parseDepFlag, resolveDepRegistryPointer } from './deps.js';
-import { composeParamsKeys, expectedChainComplete, hasOnChainUriLane, onchainUriSetupCalls, onChainUriReport, readParamsKeys } from './onchain-uri.js';
+import { expectedChainComplete, hasOnChainUriLane, onchainUriSetupCalls, onChainUriReport, readLegacyParamsKeys, readParamSchemaKeys, readSetParamKeys, } from './onchain-uri.js';
 import { parseFlags, unknownFlags } from './flags.js';
 import { AGENT_SKILL_PARENTS, checkForCliUpdate, compareVersions, installedSkillVersions, readCliVersion, readSkillVersion, SKILL_DIR_NAME, } from './update-check.js';
 import { analyzeScript, recommendLane } from './inspect.js';
-import { previewConfigFromFlags, previewDepTags, shootPreview, startPreviewServer, DEFAULT_PREVIEW_PORT, PREVIEW_FLAGS } from './preview.js';
+import { previewConfigFromFlags, previewDepTags, parsePreviewParams, shootPreview, startPreviewServer, DEFAULT_PREVIEW_PORT, PREVIEW_FLAGS } from './preview.js';
 import { parseSchemaSpecs, describeSchema } from './schema.js';
 import { declinesSkillInstall } from './prompt.js';
 import { pinGas, waitForCodeAt } from './gas.js';
@@ -74,11 +74,11 @@ const SCHEMA_CATALOG = 'Types: Bool·Select·Uint256Range·Int256Range·DecimalR
     'Select needs options — key:Select[A|B|C]:Auth; a Range takes bounds — key:Uint256Range[0..100]:Auth. ' +
     'A palette collectors set = palette:HexColor:TokenOwner';
 import { uploadAndLocate } from './upload.js';
-import { assertChainId, discoverDeployBlock, deployFactory, deploySeriesFactory, deploySeries, deployOneOfOne, deployRenderer, predictRenderer, predictSeedSource, encodeTag, encodeFieldRenderer, isCodeProject, loadDotEnv, makePublicClient, makeWalletClient, oneOfOneImageAbi, oneOfOneImageFactoryAbi, seriesImageAbi, seriesImageFactoryAbi, abxMetadataRendererAbi, predictClone, probeRpcEndpoints, prepareDeployOneOfOne, prepareDeploySeries, reconstructProject, saltFor, saltGuard, resolveChain, resolveRpcUrl, redactRpcUrl, explorerUrl, DEFAULT_CHAIN_KEY, KNOWN_CHAIN_KEYS, normalizeAttributes, parseTraitPairs, METADATA_FIELD as F, METADATA_REPRESENTATION as R, indexProgress, isAccepted, AbxIndexTimeoutError, AbxServiceError, } from '@artblocks/abx-sdk';
+import { assertChainId, discoverDeployBlock, deployFactory, deploySeriesFactory, deploySeries, deployOneOfOne, deployRenderer, predictRenderer, predictSeedSource, encodeTag, encodeFieldRenderer, isCodeProject, loadDotEnv, makePublicClient, makeWalletClient, oneOfOneImageAbi, oneOfOneImageFactoryAbi, seriesImageAbi, seriesImageFactoryAbi, abxMetadataRendererAbi, predictClone, probeRpcEndpoints, prepareDeployOneOfOne, prepareDeploySeries, reconstructProject, saltFor, saltGuard, resolveChain, resolveRpcUrl, redactRpcUrl, explorerUrl, DEFAULT_CHAIN_KEY, KNOWN_CHAIN_KEYS, normalizeAttributes, parseTraitPairs, resolveRecommendedTransferValidator, CREATOR_TOKEN_INTERFACE_ID, METADATA_FIELD as F, METADATA_REPRESENTATION as R, indexProgress, isAccepted, AbxIndexTimeoutError, AbxServiceError, } from '@artblocks/abx-sdk';
 import { SelfHostIndexer, SqliteStore } from '@artblocks/abx-indexer';
 import { artContentHash, currentRenderArtifact, generateArt, resolveBaseUrl, startChainWatcher, startTokenApiServer, verifyProject, watchIntervalMs, DEFAULT_PORT, } from '@artblocks/abx-token-api';
 import { ARWEAVE_FREE_UPLOAD_LIMIT, arweaveAddress, arweaveFunding, contentTypeFromPath, hashContent, resolveBackend, turboBalanceForAddress, turboUploadCostUsd, turboUploadWinc } from '@artblocks/abx-storage';
-import { cmdTransfer, cmdMint, cmdSetMinter, cmdSetMaxInvocations, cmdConfigureParam, cmdSetSchema, cmdRetireParam, cmdSetParamHooks, cmdSetDependency, cmdRemoveLastDependency, cmdSetDependencyRegistry, cmdLockDependencies, cmdSetPrimaryPayee, cmdPause, cmdUnpause, cmdRefresh, cmdSetTokenUri, cmdSetContractUri, cmdSetRoyalty, cmdSetField, cmdAttach, cmdLockField, cmdSetRenderer, cmdLockUri, cmdSetAdmin, cmdMinterConfigure, cmdMinterShow, cmdMinterBuy, computeContentPlan, envStagingSender, laneFromFlags, ONCHAIN_PROJECT_SOFT_LIMIT, parseCompress, previewImageStaging, sessionStagingSender, stageImageField, stageImageFieldsBatch, authorshipContractFields, AUTHORSHIP_DEPLOY_FIELDS, } from './ownerops.js';
+import { cmdTransfer, cmdMint, cmdSetMinter, cmdSetMaxInvocations, cmdConfigureParam, cmdSetSchema, cmdRetireParam, cmdSetParamHooks, cmdSetDependency, cmdRemoveLastDependency, cmdSetDependencyRegistry, cmdLockDependencies, cmdSetPrimaryPayee, cmdPause, cmdUnpause, cmdRefresh, cmdSetTokenUri, cmdSetContractUri, cmdSetRoyalty, cmdSetTransferValidator, cmdSetField, cmdAttach, parseTransferValidatorValue, cmdLockField, cmdSetRenderer, cmdLockUri, cmdSetAdmin, cmdMinterConfigure, cmdMinterShow, cmdMinterBuy, computeContentPlan, envStagingSender, laneFromFlags, ONCHAIN_PROJECT_SOFT_LIMIT, parseCompress, previewImageStaging, sessionStagingSender, stageImageField, stageImageFieldsBatch, authorshipContractFields, AUTHORSHIP_DEPLOY_FIELDS, } from './ownerops.js';
 import { openWalletSession, signTx } from './signer.js';
 import { describeRemoteError, listConfiguredRemotes, misnamedRemoteVars, requireRemoteToken, resolveRemote, serviceClient, tokenSourceLabel } from './remote.js';
 import { buildMigrationPlan, repinNodeCustody, verifyParity } from './migrate.js';
@@ -174,6 +174,22 @@ async function main() {
     loadDotEnv();
     const [cmd, ...rest] = process.argv.slice(2);
     const flags = parseFlags(rest);
+    // `--chain` is the flag people reach for, and it does not exist: chain selection is the ABX_CHAIN
+    // env var. It used to be swallowed by the generic stray-flag WARNING and the command then acted on
+    // the DEFAULT chain — `abx deploy-code … --chain sepolia` deployed to base-sepolia. On a dry run
+    // that costs a confused minute; on a funded send it is a wrong-chain deploy with real artifacts at
+    // the wrong address. Prose that was ignored once will be ignored again, so this refuses instead,
+    // on EVERY command (a read-only command that quietly ignored it would still teach the wrong model).
+    if (flags.chain !== undefined) {
+        const asked = typeof flags.chain === 'string' && flags.chain !== 'true' ? flags.chain : '';
+        process.stderr.write(`\n${c.red}✗${c.reset} there is no ${bold('--chain')} flag — the chain is chosen by the ${bold('ABX_CHAIN')} environment variable.\n` +
+            `  active now: ${bold(CHAIN)}${asked && asked !== CHAIN ? `  ${dim(`(you asked for '${asked}')`)}` : ''}\n` +
+            `  known chains: ${KNOWN_CHAIN_KEYS.join(', ')}\n\n` +
+            `  run it on ${asked && KNOWN_CHAIN_KEYS.includes(asked) ? asked : '<chain>'} like this:\n` +
+            `      ${bold(`ABX_CHAIN=${asked && KNOWN_CHAIN_KEYS.includes(asked) ? asked : '<chain>'} abx ${cmd ?? '<command>'} …`)}\n` +
+            `  ${dim('(the CLI is deliberately stateless — every run resolves its chain from the environment, so nothing a previous command set can leak into this one.)')}\n\n`);
+        process.exit(1);
+    }
     // `version` / --version / -v is a crisp query — print and exit, no update nag around it.
     if (cmd === 'version' || cmd === '--version' || cmd === '-v') {
         console.log(readCliVersion());
@@ -229,6 +245,7 @@ async function main() {
         case 'deploy-effects': return cmdDeployEffects(flags);
         case 'mint-page': return cmdMintPage(rest[0], flags);
         case 'set-royalty': return cmdSetRoyalty(rest[0], flags);
+        case 'set-transfer-validator': return cmdSetTransferValidator(rest[0], rest.slice(1), flags);
         case 'set-field': return cmdSetField(rest[0], flags);
         case 'attach': return cmdAttach(rest, flags);
         case 'lock-field': return cmdLockField(rest[0], flags);
@@ -429,6 +446,7 @@ function deployCommandLine(flags, salt) {
     str('compress', flags.compress);
     str('royalty-bps', flags['royalty-bps']);
     bool('no-mint');
+    str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     str('backend', flags.backend);
     str('gateway', flags.gateway);
     str('bucket', flags.bucket);
@@ -472,6 +490,7 @@ function deploySeriesCommandLine(flags, salt) {
     str('minter', flags.minter);
     str('primary-payee', flags['primary-payee']);
     str('royalty-bps', flags['royalty-bps']);
+    str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     if (flags.sign !== undefined)
         parts.push('--sign');
     if (flags.unsigned !== undefined)
@@ -512,6 +531,7 @@ function deployCodeCommandLine(flags, salt) {
     str('minter', flags.minter);
     str('primary-payee', flags['primary-payee']);
     str('royalty-bps', flags['royalty-bps']);
+    str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     str('backend', flags.backend);
     str('gateway', flags.gateway);
     str('public-base-url', flags['public-base-url']);
@@ -688,10 +708,12 @@ async function cmdSetRendererCli(address, flags) {
         flags.renderer = await ensureRenderer();
     return cmdSetRenderer(address, flags);
 }
-/** Is the configured renderer the spec version this build expects (v3 — the `artifacts` manifest
- *  plus the authorship/rights collection fields)? A behind-spec renderer is treated as stale so
- *  {ensureRenderer} deploys a fresh one (greenfield redeploy-freely: this number is what tells the
- *  CLI a deployed renderer predates a projection the current build emits). Bump in lockstep with
+/** Is the configured renderer the spec version this build expects (v4 — the computed `abx_params`
+ *  object, enumerated from chain, plus `animation_url` wrapped as `data:text/html;base64` for the
+ *  inline/reader representations)? A behind-spec renderer is treated as stale so {ensureRenderer}
+ *  deploys a fresh one (greenfield redeploy-freely: this number is what tells the CLI a deployed
+ *  renderer predates a projection the current build emits). A v4 renderer is safe on ANY token —
+ *  pointed at a legacy implementation it simply emits no params block. Bump in lockstep with
  *  `AbxMetadataRenderer.SPEC_VERSION`. */
 async function isCurrentRenderer(publicClient, renderer) {
     try {
@@ -700,7 +722,7 @@ async function isCurrentRenderer(publicClient, renderer) {
             abi: abxMetadataRendererAbi,
             functionName: 'specVersion',
         }));
-        return v === 3n;
+        return v === 4n;
     }
     catch {
         return false;
@@ -1130,7 +1152,7 @@ async function remoteLocators(address, stored, flags) {
 }
 // ── deploy (+ optionally serve) ──────────────────────────────────────────────
 async function cmdDeploy(flags, serveAfter) {
-    warnStrayFlags(flags, DEPLOY_FLAGS, 'deploy');
+    refuseStrayFlags(flags, DEPLOY_FLAGS, 'deploy');
     warnSignWithoutFor(flags);
     const dimension = resolveDimension(flags.type ?? '1of1');
     // A multi-token collection is its OWN command; `abx deploy` is the single-token (1/1) path.
@@ -1192,6 +1214,8 @@ async function cmdDeploy(flags, serveAfter) {
     // a wrong-network RPC must still be caught with the clear mismatch message rather than failing
     // opaquely inside predict; `allowUnreachable` keeps a genuinely offline dry-run previewable.
     await assertChainId(CHAIN, { allowUnreachable: dryRun });
+    // --721c (opt-in ERC-721C): absent → zeroAddress, a plain ERC-721 exactly as before.
+    const transferValidator = await resolveTransferValidatorFlag(flags, publicClient, dryRun);
     // `demo` is exempt: its whole job is a zero-argument first token.
     if (!serveAfter)
         assertRealIdentity(flags, { name, symbol, dryRun });
@@ -1440,6 +1464,7 @@ async function cmdDeploy(flags, serveAfter) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            transferValidator,
             tokenFields,
             // authorship + rights (artist / license / …) are collection-scope on-chain fields.
             contractFields: authorshipContractFields(flags),
@@ -1494,7 +1519,8 @@ async function cmdDeploy(flags, serveAfter) {
         return;
     }
     // opt-in --confirm: a final y/N before the real send (no-op without --confirm; never blocks scripts)
-    await confirmSend(`About to deploy 1/1 "${name}" (${symbol})${flags.image ? ' with your image' : ' (generative demo art)'}; mint: ${noMint ? 'deferred' : 'token #0 at deploy'}; owner+royalty: your wallet @ ${royaltyBps / 100}%.`, flags);
+    await confirmSend(`About to deploy 1/1 "${name}" (${symbol})${flags.image ? ' with your image' : ' (generative demo art)'}; mint: ${noMint ? 'deferred' : 'token #0 at deploy'}; owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
+        (transferValidator !== zeroAddress ? ` ERC-721C: enrolled at deploy, permanently (validator ${transferValidator}).` : ''), flags);
     if (lane === 'send') {
         // hot lane: the env key is the deployer, known up front.
         const { wallet, account } = makeWalletClient({ chainKey: CHAIN });
@@ -1738,7 +1764,7 @@ const tokenFieldOf = (tokenId, f) => ({
     value: f.value,
 });
 async function cmdDeploySeries(flags) {
-    warnStrayFlags(flags, DEPLOY_SERIES_FLAGS, 'deploy-series');
+    refuseStrayFlags(flags, DEPLOY_SERIES_FLAGS, 'deploy-series');
     warnSignWithoutFor(flags);
     const name = flags.name ?? 'ABX Series';
     const symbol = flags.symbol ?? 'ABXS';
@@ -1749,7 +1775,7 @@ async function cmdDeploySeries(flags) {
     if (!flags.dir) {
         throw new Error('abx deploy-series --dir <media-dir> [--count N] [--mint-all | --mint-count N | --no-mint] ' +
             '[--onchain-image [--compress fastlz] | --onchain-uri --backend ipfs|arweave|cloud (image off-chain, JSON on-chain; cloud needs --public-base) | --onchain-uri (inline SVG) | --public-base-url https://… (hosted resolver)] ' +
-            '[--minter 0x..] [--primary-payee 0x..] [--unpaused] --name "Title" --symbol SYM');
+            '[--minter 0x..] [--primary-payee 0x..] [--unpaused] [--721c recommended|0x..] --name "Title" --symbol SYM');
     }
     const dirPath = resolvePath(flags.dir);
     const files = readdirSync(dirPath)
@@ -1772,6 +1798,8 @@ async function cmdDeploySeries(flags) {
     // Catch a wrong-network RPC with the clear mismatch message even on dry-run (which still reads
     // the chain to predict the address); tolerate an unreachable RPC so an offline preview still works.
     await assertChainId(CHAIN, { allowUnreachable: dryRun });
+    // --721c (opt-in ERC-721C): absent → zeroAddress, a plain ERC-721 exactly as before.
+    const transferValidator = await resolveTransferValidatorFlag(flags, publicClient, dryRun);
     // (identity guard already ran above, via the shared assertRealIdentity — before any RPC)
     // Mint timing: mint-all → the whole series; mint-count N → the first N; else deferred.
     const mintCount = flags['mint-all'] !== undefined ? count : flags['mint-count'] ? Number(flags['mint-count']) : 0;
@@ -1986,7 +2014,8 @@ async function cmdDeploySeries(flags) {
                 : onChainUri
                     ? 'inline SVG on-chain'
                     : `off-chain custody → ${baseUrl}`;
-        await confirmSend(`About to deploy Series "${name}" (${symbol}) — ${count} token(s); ${custody}; mint: ${mintCount > 0 ? `${mintCount} at deploy` : 'deferred'}; owner+royalty: your wallet @ ${royaltyBps / 100}%.`, flags);
+        await confirmSend(`About to deploy Series "${name}" (${symbol}) — ${count} token(s); ${custody}; mint: ${mintCount > 0 ? `${mintCount} at deploy` : 'deferred'}; owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
+            (transferValidator !== zeroAddress ? ` ERC-721C: enrolled at deploy, permanently (validator ${transferValidator}).` : ''), flags);
     }
     if (!onchainImage && !remoteEthUpload)
         await buildFields();
@@ -2005,6 +2034,7 @@ async function cmdDeploySeries(flags) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            transferValidator,
             maxInvocations: count,
             primaryPayee,
             minter,
@@ -2931,9 +2961,14 @@ async function cmdPreview(flags) {
     if (shootDir) {
         step(`Render ${count} seeds headlessly`);
         try {
+            const shotParams = parsePreviewParams(flags.param);
+            if (Object.keys(shotParams).length) {
+                info(`param overrides applied to every frame: ${Object.entries(shotParams).map(([k, v]) => `${k}=${v || dim('(unset)')}`).join(' · ')}`);
+            }
             const shots = await shootPreview(server.url, shootDir, count, {
                 width: Number(flags.width ?? 1000) || 1000,
                 timeoutMs: Number(flags['timeout-ms'] ?? 10_000) || 10_000,
+                params: shotParams,
             });
             ok(`${shots.length} frames → ${shootDir}/  ${dim('(traits in traits.json)')}`);
             for (const s of shots) {
@@ -3069,7 +3104,7 @@ const DEPLOY_CODE_FLAGS = new Set([
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag), // artist · display-notes · artist-links · license
     'image-base', 'attributes-renderer', 'image-renderer',
     // supply + mint + economics
-    'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps',
+    'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
     // params + dependencies
     'schema', 'no-seed', 'no-delegation', 'dep', 'dep-registry',
     // serving lane
@@ -3085,6 +3120,7 @@ const DEPLOY_CODE_FLAGS = new Set([
 const SHARED_DEPLOY_FLAGS = [
     'backend', 'endpoint', 'bucket', 'region', 'prefix', 'public-base', 'gateway', 'mode', 'api-url', 'upload-url', 'provider', 'storage-signer',
     'sign', 'unsigned', 'for', 'sign-url-file', 'dry-run', 'confirm', 'yes', 'salt', 'factory', 'bootstrap-factory', 'port', 'renderer', 'public-base-url',
+    '721c', // opt-in ERC-721C enrollment (recommended | 0x…) — every deploy path takes it
 ];
 // A 1/1 `abx deploy` accepts these (see `abx help deploy`). Anything else warns (typo'd/unsupported).
 const DEPLOY_FLAGS = new Set([
@@ -3113,6 +3149,33 @@ const FLAG_HINTS = {
     supply: () => 'did you mean --max <N> (the supply cap)?',
     amount: () => 'a sale price/amount is set post-deploy via `abx minter configure`.',
 };
+/**
+ * Unknown flags on a command that can SEND: refuse, don't warn.
+ *
+ * This used to warn and carry on, and `--chain sepolia` proved why that isn't enough — the warning was
+ * accurate, it scrolled past, and the deploy ran on the DEFAULT chain. On a dry run that costs a
+ * confused minute; on a funded send it is a wrong-chain deploy. "Prose that was ignored once will be
+ * ignored again" is the standing rule here, so the tx-sending commands stop instead.
+ *
+ * Safe to refuse rather than warn because a flag absent from the allowlist is, by construction, one
+ * the command never reads — verified per command by comparing every `flags.x` read in its body against
+ * its allowlist. So refusal cannot break a working flag; it only makes an already-ignored one loud.
+ *
+ * `--dry-run` refuses identically. A preview that accepts what the real send rejects is its own trap:
+ * you'd validate a command in preview and have it fail at the moment it matters.
+ */
+function refuseStrayFlags(flags, allowed, cmd) {
+    const stray = unknownFlags(flags, allowed);
+    if (!stray.length)
+        return;
+    const hints = stray.map((f) => FLAG_HINTS[f]?.(cmd)).filter(Boolean);
+    throw new Error(`unrecognized flag(s): ${stray.map((f) => '--' + f).join(', ')} — this command would have ignored them silently, so it is refusing instead.\n` +
+        hints.map((h, i) => `    ↳ --${stray[i]}: ${h}`).join('\n') +
+        (hints.length ? '\n' : '') +
+        `    see \`abx help ${cmd}\` for the flags it accepts.`);
+}
+/** Unknown flags on a READ-ONLY command: warn, don't refuse. Nothing can be mis-sent, and a stray
+ *  flag on `preview`/`inspect` shouldn't stop a creator mid-iteration. */
 function warnStrayFlags(flags, allowed, cmd) {
     const stray = unknownFlags(flags, allowed);
     if (stray.length) {
@@ -3138,7 +3201,7 @@ async function cmdDeployCode(flags) {
         '[--description "<s>"] [--external-url <url>] [--image-base <url> | --image-renderer 0x..] [--attributes-renderer 0x..] ' +
         '[--max N] [--mint-count N | --mint-all] [--schema key:Type:Auth,…] [--no-seed] ' +
         '[--dep <name@version|0x..>[,…]] [--dep-registry 0x..] ' +
-        '[--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--backend ipfs|arweave] [--dry-run] [--confirm] [--bootstrap-factory]';
+        '[--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--721c recommended|0x..] [--backend ipfs|arweave] [--dry-run] [--confirm] [--bootstrap-factory]';
     const scriptPath = flags.script;
     const codeDir = flags['code-dir'];
     const hasProgram = !!(scriptPath || codeDir); // a JS program (script or built dir)
@@ -3154,7 +3217,7 @@ async function cmdDeployCode(flags) {
     // Surface unsupported/typo'd flags BEFORE any work — a silent no-op on a write-adjacent value
     // (e.g. --description landing nowhere) is the worst failure mode. Non-fatal (see unknownFlags).
     // Shared path so the "did you mean --max / price is post-deploy" hints fire here too.
-    warnStrayFlags(flags, DEPLOY_CODE_FLAGS, 'deploy-code');
+    refuseStrayFlags(flags, DEPLOY_CODE_FLAGS, 'deploy-code');
     warnSignWithoutFor(flags);
     const dryRun = !!flags['dry-run'];
     const name = flags.name ?? 'ABX Code';
@@ -3211,6 +3274,8 @@ async function cmdDeployCode(flags) {
     // chain to resolve the factory/renderer and predict the address); tolerate an offline preview.
     await assertChainId(CHAIN, { allowUnreachable: dryRun });
     const chainId = dryRun ? resolveChain(CHAIN).id : (await publicClient.getChainId());
+    // --721c (opt-in ERC-721C): absent → zeroAddress, a plain ERC-721 exactly as before.
+    const transferValidator = await resolveTransferValidatorFlag(flags, publicClient, dryRun);
     step('Trust anchor');
     let factory;
     if (dryRun) {
@@ -3589,27 +3654,21 @@ async function cmdDeployCode(flags) {
     // gas cap and appear to REVERT. Expected, not a bug — a real session mis-diagnosed it as indexing lag.
     const tokenUriGasRisk = onChainUri && !codeDir && (scriptAnalysis?.doc.estBytes ?? 0) > 30_000;
     // --onchain-uri legs (ride the setup multicall, before the mints): the animation_url field
-    // pointing at the generator, the params.keys contract param, and the two URI renderers.
-    // params.keys composition rule: EVERY param key this deploy writes ∪ the --schema keys ∪
-    // `params.keys` itself — deduped, sorted, comma-joined. deploy-code writes no display.*/
-    // render.* params today; a future flag that does MUST add its key to `writtenParamKeys` so
-    // the generator's on-chain tokenData stays byte-aligned with the resolver's (which carries
-    // every evented param — inputsHash parity is load-bearing).
+    // pointing at the generator, and the two URI renderers. The param surface needs NO leg — the
+    // generator enumerates it from the token on-chain (`contractParamKeys`/`tokenParamKeys`, kept in
+    // step by the write paths themselves), so there is nothing for a deploy to declare and nothing to
+    // drift. (The retired `params.keys` CSV convention is gone; a legacy project keeps its old generator.)
     // THE FOLD: on the renderer-only in-chain lane (no program), the on-chain-URI wiring (tokenURI/
     // contractURI renderers) + the reserve mint move INTO the deploy tx's init params — the token is
     // fully configured at deploy (the renderers already exist on-chain), so the setup multicall is
     // needed ONLY for a PostParam schema (and is skipped entirely when there's none → a 1-tx drop).
     // The script/dir lane is UNCHANGED: its chunks always need the multicall, and its mint must ride
     // AFTER the chunks (a mint-before-chunks token would be transiently unresolvable), so its
-    // URI-renderers + animation + params.keys + mint stay in the multicall exactly as before.
+    // URI-renderers + animation + mint stay in the multicall exactly as before.
     const foldIntoInit = onChainUri && !hasProgram;
-    const writtenParamKeys = [];
-    const paramsKeysCsv = onChainUri ? composeParamsKeys(writtenParamKeys, schemas.map((s) => s.key)) : '';
-    // params.keys + the URI-renderer/animation legs only ride the multicall for a PROGRAM (the
-    // generator consumes params.keys; renderer-only has no generator and folds the renderers to init).
-    const onchainUriLegs = onChainUri && hasProgram
-        ? onchainUriSetupCalls({ generator, metadataRenderer, paramsKeys: paramsKeysCsv })
-        : null;
+    // The URI-renderer/animation legs only ride the multicall for a PROGRAM (renderer-only has no
+    // generator and folds the renderers into init).
+    const onchainUriLegs = onChainUri && hasProgram ? onchainUriSetupCalls({ generator, metadataRenderer }) : null;
     const setupMintCount = foldIntoInit ? 0 : mintCount; // folded mints ride init, not the multicall
     // opt-in --confirm: one y/N before ANY upload or send (no-op without --confirm; never blocks scripts).
     if (!dryRun) {
@@ -3617,12 +3676,13 @@ async function cmdDeployCode(flags) {
         await confirmSend(`About to deploy code project "${name}" (${symbol}) — ${contentSummary}; ` +
             (identityFields.length ? `${identityFields.join(' + ')} on-chain; ` : '') +
             (onChainUri
-                ? `tokenURI ON-CHAIN via renderer ${metadataRenderer}${hasProgram ? ` (generator ${generator}; params.keys "${paramsKeysCsv}")` : ' (renderer-only — image + traits from your Solidity renderers, no animation)'}; `
+                ? `tokenURI ON-CHAIN via renderer ${metadataRenderer}${hasProgram ? ` (generator ${generator})` : ' (renderer-only — image + traits from your Solidity renderers, no animation)'}; `
                 : `resolver base ${baseUrl}; `) +
             `dependencies: ${deps.length ? deps.map((d) => d.display).join(', ') + (depRegistry ? ` (registry ${depRegistry})` : '') : 'none'}; ` +
             `mint: ${mintCount > 0 ? `${mintCount} at deploy${foldIntoInit ? ' (in the deploy tx)' : ''}` : 'deferred'}; ` +
             `tx count: ${foldIntoInit ? (schemas.length ? '2 (deploy + enable your params)' : '1 (everything in the deploy tx)') : '2 (deploy + setup)'}; ` +
-            `owner+royalty: ${flags.for ? `pinned to ${String(flags.for)}` : flags.sign !== undefined ? '⚠ the wallet you connect (NOT pinned — pass --for to enforce)' : 'your wallet'} @ ${royaltyBps / 100}%.\n` +
+            `owner+royalty: ${flags.for ? `pinned to ${String(flags.for)}` : flags.sign !== undefined ? '⚠ the wallet you connect (NOT pinned — pass --for to enforce)' : 'your wallet'} @ ${royaltyBps / 100}%.` +
+            (transferValidator !== zeroAddress ? ` ERC-721C: enrolled at deploy, permanently (validator ${transferValidator}).` : '') + `\n` +
             `  Surfaces — thumbnail: ${imageDisposition}. traits: ${traitsDisposition}. postparams: ${paramsDisposition}.` +
             ((imageOrphaned || traitsBroken || undeclaredParams.length)
                 ? `\n  ⚠ One or more surfaces resolve to NOTHING marketplaces can see — these are DEPLOY-TIME decisions, not backfillable. Re-run --dry-run after fixing, or pass --yes to ship as-is.`
@@ -3652,7 +3712,7 @@ async function cmdDeployCode(flags) {
             ? (await publicClient.readContract({ address: factory, abi: seriesCodeFactoryAbi, functionName: 'predictDeterministicAddress', args: [salt] }))
             : null;
         const depLegs = deps.length + (depRegistry ? 1 : 0);
-        const setupLen = scriptChunks.length + schemas.length + depLegs + (onchainUriLegs?.calls.length ?? 0) + setupMintCount;
+        const setupLen = scriptChunks.length + schemas.length + depLegs + (onchainUriLegs?.length ?? 0) + setupMintCount;
         step(`Deploy plan — a ${max}-token code project to ${CHAIN}`);
         if (deployer)
             info(`deployer ${deployer}`);
@@ -3677,7 +3737,7 @@ async function cmdDeployCode(flags) {
                     : `; no animation_url (renderer-only — image + attributes computed on-chain by your Solidity renderer(s))`));
             if (hasProgram) {
                 info(`  on-chain URI legs (ride the setup multicall): collection animation_url field (renderer rep → ${generator}) · ` +
-                    `params.keys = "${paramsKeysCsv}" (${onchainUriLegs.paramsKeysEncoding === 'literal' ? 'literal bytes32' : `data-backed, ${paramsKeysCsv.length}B`}) · setTokenURIRenderer · setContractURIRenderer`);
+                    `setTokenURIRenderer · setContractURIRenderer ${dim('(the param surface enumerates on-chain — no leg, nothing to maintain)')}`);
             }
             else {
                 info(`  on-chain URI wiring rides the ${bold('deploy tx')} itself (tokenURI/contractURI renderers${mintCount > 0 ? ' + the reserve mint' : ''} in init) — no separate setup tx for it.`);
@@ -3729,7 +3789,7 @@ async function cmdDeployCode(flags) {
                 BigInt(storedBytes) * 216n + // ~200 gas/byte code deposit + ~16 gas/byte calldata
                 BigInt(schemas.length) * 45000n +
                 BigInt(depLegs) * 55000n +
-                BigInt(onchainUriLegs?.calls.length ?? 0) * 60000n +
+                BigInt(onchainUriLegs?.length ?? 0) * 60000n +
                 BigInt(mintCount) * 65000n;
             const gasPrice = await publicClient.getGasPrice();
             const eth = Number(roughGas * gasPrice) / 1e18;
@@ -3819,6 +3879,7 @@ async function cmdDeployCode(flags) {
         contractURIRenderer: foldIntoInit ? metadataRenderer : zeroAddress,
         royaltyReceiver: owner,
         royaltyBps,
+        transferValidator,
         maxInvocations: BigInt(max),
         primaryPayee: flags['primary-payee'] ?? zeroAddress,
         minter: flags.minter ?? zeroAddress,
@@ -3835,7 +3896,7 @@ async function cmdDeployCode(flags) {
         ...scriptChunks.map((chunk, i) => encodeFunctionData({ abi: seriesCodeAbi, functionName: 'setScriptChunk', args: [BigInt(i), chunk] })),
         ...schemas.map(({ key, paramType, auth, authAddress, lockAfter, min, max, selectOptions }) => encodeFunctionData({ abi: seriesCodeAbi, functionName: 'setParamSchema', args: [encodeTag(key), paramType, auth, authAddress, lockAfter, min, max, selectOptions] })),
         ...dependencySetupCalls(deps, depRegistry), // setDependency legs in index order (+ the soft registry pointer)
-        ...(onchainUriLegs?.calls ?? []), // program lane only: animation_url field · params.keys · the URI renderers (before the mints)
+        ...(onchainUriLegs ?? []), // program lane only: animation_url field · the URI renderers (before the mints)
     ].concat(Array.from({ length: setupMintCount }, () => encodeFunctionData({ abi: seriesCodeAbi, functionName: 'mint', args: [owner] }))); // folded mints ride init, not here
     const cid = resolveChain(CHAIN).id;
     const preparedFor = async (owner) => {
@@ -3935,7 +3996,7 @@ async function cmdDeployCode(flags) {
         step('On-chain URI');
         ok(`tokenURI/contractURI resolve ON-CHAIN via the renderer ${metadataRenderer} — any RPC returns the metadata, no server in the graph`);
         if (hasProgram)
-            info(`animation_url computes on-chain via the generator ${generator} · params.keys = "${paramsKeysCsv}" (auto-managed; keep it in sync when adding param keys)`);
+            info(`animation_url computes on-chain via the generator ${generator} — it enumerates this token's params from chain, so there is no key list to maintain`);
         else
             info(`renderer-only — image + attributes computed on-chain by your Solidity renderer(s); no animation_url · ${g('fully on-chain')}, zero dependency outside the EVM`);
         if (hasProgram && !codeDir) {
@@ -4365,6 +4426,18 @@ async function cmdVerify(address, flags) {
                     console.log(`    ${c.orange}⚠${c.reset} no animation_url in the on-chain JSON — the generator field may be missing or unrenderable`);
                 }
             }
+            // The READ-side envelope. Params enumerate on-chain, so the write side is unbounded — but
+            // tokenURI and tokenData assemble EVERY enumerated param per call, and that is what grows.
+            // ~64 keys is the documented design envelope; hard failure only nears at several hundred.
+            // Advisory (never a ✗) — a big surface is a legitimate choice, it just isn't free.
+            const set = await readSetParamKeys(client, state.address, probe ? BigInt(probe.tokenId) : undefined);
+            if (set) {
+                const total = new Set([...set.contract, ...set.token]).size;
+                if (total > 64) {
+                    console.log(`    ${c.orange}⚠${c.reset} ${total} params enumerate on-chain${probe ? ` for token #${probe.tokenId}` : ''} — tokenURI and tokenData assemble every one of them per call, so both grow with this count. ` +
+                        dim('The documented design envelope is ~64; past a few hundred a public eth_call can hit its gas cap.'));
+                }
+            }
         }
         catch (e) {
             console.log(`    ${c.orange}⚠${c.reset} on-chain URI check unavailable: ${e.message}`);
@@ -4543,29 +4616,35 @@ async function reportRemoteByteIntegrity(address, remote, base) {
 // Read tokenURI(id) STRAIGHT FROM THE CONTRACT on-chain (no server, no node) and decode
 // the data: URI. For a fully on-chain token (`--onchain-uri`), this is the proof it
 // self-resolves: the renderer assembles the JSON on-chain; any RPC returns it.
-function decodeOnChainJson(uri) {
+function decodeOnChainJson(uri, verbatim = false) {
     const m = /^data:application\/json(;[^,]*)?,([\s\S]*)$/.exec(uri);
     if (!m)
         return null;
     const raw = (m[1] ?? '').includes('base64') ? Buffer.from(m[2], 'base64').toString('utf8') : decodeURIComponent(m[2]);
     try {
         const obj = JSON.parse(raw);
+        // `verbatim` (--json) returns the document EXACTLY as the chain assembled it. Everything below is
+        // a courtesy for human eyes, and abbreviating for eyes is fine — abbreviating for a PROGRAM is
+        // not. An integrator scraped this output, got a `data:` URI cut to 96 chars that still looked
+        // valid, and stored it; the only way to read their own token was to reimplement `eth_call`.
+        if (verbatim)
+            return JSON.stringify(obj, null, 2);
         for (const k of Object.keys(obj)) {
             const v = obj[k];
             // Truncate only huge inline `data:` blobs (base64 SVGs/images); show plain locator URLs
             // (http/ipfs/ar) IN FULL so the creator can verify where the image actually resolves.
             if (typeof v === 'string' && v.startsWith('data:') && v.length > 96)
-                obj[k] = `${v.slice(0, 96)}… (${v.length} chars)`;
+                obj[k] = `${v.slice(0, 96)}… (${v.length} chars)  [--json for the full value]`;
         }
         return JSON.stringify(obj, null, 2);
     }
     catch {
-        return raw.slice(0, 600);
+        return verbatim ? raw : raw.slice(0, 600);
     }
 }
 async function cmdTokenUri(address, flags) {
     if (!address || address.startsWith('--')) {
-        console.error('usage: abx tokenuri <address> [--token <id>]\n');
+        console.error('usage: abx tokenuri <address> [--token <id>] [--json]\n');
         process.exit(1);
     }
     if (!/^0x[0-9a-fA-F]{40}$/.test(address)) {
@@ -4600,6 +4679,12 @@ async function cmdTokenUri(address, flags) {
         }
         process.exit(1);
     }
+    // --json: the verbatim document, nothing else on stdout — no banner, no ANSI, no truncation, so
+    // `abx tokenuri <addr> --json | jq` is a supported read path rather than something to regex.
+    if (flags.json !== undefined) {
+        process.stdout.write((decodeOnChainJson(uri, true) ?? uri) + '\n');
+        return;
+    }
     console.log(`\n  ${bold(`tokenURI(${tokenId})`)} ${dim(`— read directly from ${address} on ${CHAIN}, no server`)}`);
     const json = decodeOnChainJson(uri);
     if (json) {
@@ -4844,7 +4929,7 @@ async function cmdStorage(rest) {
  */
 async function cmdStorageUpload(path, flags) {
     if (!path || path.startsWith('--')) {
-        console.error('usage: abx storage upload <path> [--backend ipfs|arweave|cloud] [--key <name>]\n  uploads one file and prints its locator (the URI `abx attach` wants).\n');
+        console.error('usage: abx storage upload <path> [--backend ipfs|arweave|cloud] [--key <name>] [--json]\n  uploads one file and prints its locator (the URI `abx attach` wants); --json emits it as data.\n');
         process.exit(1);
     }
     const abs = resolvePath(path);
@@ -4856,7 +4941,9 @@ async function cmdStorageUpload(path, flags) {
         throw new Error("the 'fs' backend has no public URL — an attached file must be reachable off this machine. " +
             'Upload with `--backend arweave` (pay-once permanent) or `--backend ipfs` (keep it pinned), or `--backend cloud` (your S3/R2).');
     }
-    noteArweavePlan(opts, bytes.length); // free-vs-credit readout for the arweave lane
+    const jsonMode = flags.json !== undefined;
+    if (!jsonMode)
+        noteArweavePlan(opts, bytes.length); // free-vs-credit readout for the arweave lane
     const name = (flags.key && flags.key !== 'true' ? flags.key : basename(abs)).replace(/^\/+/, '');
     // --dry-run: an upload is IRREVERSIBLE and can happen even keyless (Arweave's free tier under
     // 100 KB auto-creates an identity), so a "preview" that actually uploaded would surprise. Show
@@ -4866,17 +4953,37 @@ async function cmdStorageUpload(path, flags) {
         console.log(`\n  ${bold('◆ storage upload')} ${dim('(dry run — nothing uploaded)')}`);
         console.log(`    ${dim('file'.padEnd(10))} ${basename(abs)} ${dim(`(${bytes.length} bytes, ${contentType})`)}`);
         console.log(`    ${dim('backend'.padEnd(10))} ${backend.id}`);
+        // Name the IPFS mode, and say what an absent credential actually means. There is no silent
+        // fallback to local `fs` (an earlier skill line wrongly claimed one) — without PINATA_JWT the
+        // backend resolves to kubo against a LOCAL node, so a dry run that looked fine would fail at
+        // upload for anyone not running one. A preview should surface that, not defer it to the failure.
+        if (backend.id === 'ipfs' && !process.env.PINATA_JWT && !process.env.ABX_IPFS_MODE) {
+            warn(`no ${bold('PINATA_JWT')} set → this resolves to a LOCAL IPFS node (kubo at ${process.env.ABX_IPFS_API_URL ?? 'http://127.0.0.1:5001'}). The real upload fails unless that node is running — set PINATA_JWT for the managed lane, or ${bold('--backend arweave')} for no-setup permanent storage.`);
+        }
         console.log(`    ${dim('locator'.padEnd(10))} ${shape} ${dim('(filename preserved → declared type survives)')}`);
         console.log(dim(`\n  Re-run without --dry-run to upload, then: `) + `${g(`abx attach <address> <key> ${shape}`)}\n`);
         return;
     }
-    console.log(`  uploading ${bold(basename(abs))} ${dim(`(${bytes.length} bytes, ${contentType})`)} to '${backend.id}' …`);
+    // In --json mode nothing but the JSON may touch stdout; progress still goes out, on stderr.
+    const progress = (line) => (jsonMode ? process.stderr.write(line + '\n') : console.log(line));
+    progress(`  uploading ${bold(basename(abs))} ${dim(`(${bytes.length} bytes, ${contentType})`)} to '${backend.id}' …`);
     // The returned locator MUST carry the filename so the declared mimeType survives when attached
     // (the on-chain field has no MIME slot — the URL extension IS the declaration). uploadAndLocate
     // encapsulates the capability-based branch (cloud key / dir-wrap / bare fallback).
     const { locator, filenamePreserved, fallbackReason } = await uploadAndLocate(backend, name, { bytes, contentType });
     if (!filenamePreserved && fallbackReason) {
-        warn(`couldn't wrap the file with its name (${fallbackReason}) — the locator has no extension, so its declared type will be application/octet-stream when attached.`);
+        const msg = `couldn't wrap the file with its name (${fallbackReason}) — the locator has no extension, so its declared type will be application/octet-stream when attached.`;
+        if (jsonMode)
+            process.stderr.write(`    ⚠  ${msg}\n`);
+        else
+            warn(msg);
+    }
+    // --json: the locator as data, not as prose. An integrator scraped this line, captured the ANSI
+    // colour codes along with the URL, wrote the result into a STORED player URL, and only found out
+    // when it 404'd in production. A value a program needs must be obtainable without parsing output.
+    if (jsonMode) {
+        process.stdout.write(JSON.stringify({ locator, backend: backend.id, name, bytes: bytes.length, contentType, filenamePreserved }) + '\n');
+        return;
     }
     console.log(`  ${g('✓')} uploaded → ${bold(locator)}`);
     if (contentType === 'application/octet-stream') {
@@ -4955,6 +5062,9 @@ const STATE_ABI = [
     { type: 'function', name: 'primaryPayee', stateMutability: 'view', inputs: [], outputs: [{ type: 'address' }] },
     { type: 'function', name: 'tokenURIRenderer', stateMutability: 'view', inputs: [], outputs: [{ type: 'address' }] },
     { type: 'function', name: 'royaltyInfo', stateMutability: 'view', inputs: [{ type: 'uint256' }, { type: 'uint256' }], outputs: [{ type: 'address' }, { type: 'uint256' }] },
+    // ERC-721C (creator token) — ERC-165 advertises ICreatorToken ONLY when enrolled at deploy.
+    { type: 'function', name: 'supportsInterface', stateMutability: 'view', inputs: [{ type: 'bytes4' }], outputs: [{ type: 'bool' }] },
+    { type: 'function', name: 'getTransferValidator', stateMutability: 'view', inputs: [], outputs: [{ type: 'address' }] },
 ];
 async function cmdState(address, flags) {
     if (!address || address.startsWith('--')) {
@@ -4971,7 +5081,7 @@ async function cmdState(address, flags) {
             return undefined; // getter absent (extension not composed) or contract has no code
         }
     };
-    const [owner, totalSupply, nextTokenId, maxInvocations, paused, minter, primaryPayee, renderer, royalty] = await Promise.all([
+    const [owner, totalSupply, nextTokenId, maxInvocations, paused, minter, primaryPayee, renderer, royalty, creatorToken, transferValidator] = await Promise.all([
         read('owner'),
         read('totalSupply'),
         read('nextTokenId'),
@@ -4981,6 +5091,8 @@ async function cmdState(address, flags) {
         read('primaryPayee'),
         read('tokenURIRenderer'),
         read('royaltyInfo', [0n, 10000n]),
+        read('supportsInterface', [CREATOR_TOKEN_INTERFACE_ID]),
+        read('getTransferValidator'),
     ]);
     if (owner === undefined && totalSupply === undefined) {
         throw new Error(`no ABX contract state at ${address} on ${CHAIN} (no code, or not an ABX token).`);
@@ -5005,31 +5117,51 @@ async function cmdState(address, flags) {
     if (royalty)
         info(`royalty        ${Number(royalty[1]) / 100}% → ${royalty[0]}`);
     info(`renderer       ${renderer && renderer !== zeroAddress ? `on-chain (${renderer})` : dim('off-chain (stored URI base / override)')}`);
-    // The governed PostParam surface. There is no on-chain enumeration of schema keys, so the source
-    // is the project's own `params.keys` list — which is also what the on-chain generator reads, so
-    // anything missing from it is invisible to renders anyway. Read-only, best-effort, and skipped
-    // entirely for a project that has none (a 1/1, or a code project with no params).
+    // ERC-721C: shown ONLY for an enrolled collection — an unenrolled token is a plain ERC-721
+    // (indistinguishable from a pre-721C token) and shows nothing new here.
+    if (creatorToken) {
+        info(`721C validator ${transferValidator && transferValidator !== zeroAddress ? transferValidator : `${c.orange}suspended${c.reset} ${dim('(zero — enforcement off; re-enable with `abx set-transfer-validator`)')}`}`);
+    }
+    // The PostParam surface, read straight from chain: `paramSchemaKeys()` is the DECLARED (governed)
+    // set — append-only, and it includes keys declared but never yet written, which nothing off-chain
+    // could otherwise discover — and `contractParamKeys()` is the collection-scope set values. Both
+    // are maintained by the contract's own write paths, so there is no list to drift. Read-only,
+    // best-effort, and skipped entirely for a project that has none (a 1/1, or a code project with
+    // no params). LEGACY projects (deployed before enumeration) expose neither getter: they fall back
+    // to the retired `params.keys` CSV so `abx state` still describes them.
     try {
-        const csv = await readParamsKeys(publicClient, address);
-        const keys = (csv ?? '').split(',').map((k) => k.trim()).filter((k) => k && k !== 'params.keys');
-        if (keys.length) {
-            const rows = await Promise.all(keys.map(async (key) => ({ key, s: await readParamSchema(publicClient, address, key) })));
-            const governed = rows.filter((r) => r.s.exists);
-            const now = Math.floor(Date.now() / 1000);
-            if (governed.length) {
-                console.log(`\n  ${bold('PostParams')}  ${dim(`${governed.length} governed · collectors/artist set these; the generator injects them`)}`);
-                for (const { key, s } of governed) {
-                    const retired = s.lockAfter !== 0 && s.lockAfter < now;
-                    const locks = s.lockAfter !== 0 && !retired ? dim(`  locks ${new Date(s.lockAfter * 1000).toISOString().slice(0, 10)}`) : '';
-                    const tag = retired ? `  ${c.orange}retired${c.reset}${dim(' — writes revert')}` : locks;
-                    console.log(`    ${describeSchema({ key, paramType: s.paramType, auth: s.auth, authAddress: s.authAddress, lockAfter: 0, min: s.min, max: s.max, selectOptions: s.selectOptions })}${tag}`);
-                }
+        let keys = await readParamSchemaKeys(publicClient, address);
+        let legacy = false;
+        if (keys === null) {
+            // The pre-enumeration lane, READ-ONLY. Nothing writes this CSV any more.
+            keys = (await readLegacyParamsKeys(publicClient, address).catch(() => null)) ?? [];
+            legacy = keys.length > 0;
+        }
+        const rows = keys.length
+            ? await Promise.all(keys.map(async (key) => ({ key, s: await readParamSchema(publicClient, address, key) })))
+            : [];
+        const governed = rows.filter((r) => r.s.exists);
+        const now = Math.floor(Date.now() / 1000);
+        if (governed.length) {
+            console.log(`\n  ${bold('PostParams')}  ${dim(`${governed.length} governed · collectors/artist set these; the generator injects them`)}` +
+                (legacy ? dim('  (legacy project — read from its params.keys list)') : ''));
+            for (const { key, s } of governed) {
+                const retired = s.lockAfter !== 0 && s.lockAfter < now;
+                const locks = s.lockAfter !== 0 && !retired ? dim(`  locks ${new Date(s.lockAfter * 1000).toISOString().slice(0, 10)}`) : '';
+                const tag = retired ? `  ${c.orange}retired${c.reset}${dim(' — writes revert')}` : locks;
+                console.log(`    ${describeSchema({ key, paramType: s.paramType, auth: s.auth, authAddress: s.authAddress, lockAfter: 0, min: s.min, max: s.max, selectOptions: s.selectOptions })}${tag}`);
             }
-            // Listed but ungoverned: the generator will inject the key with whatever raw value is set (or
-            // nothing). Not an error — say it plainly rather than leaving a silent discrepancy.
-            const ungoverned = rows.filter((r) => !r.s.exists).map((r) => r.key);
-            if (ungoverned.length)
-                info(`${dim('also in params.keys, no schema:')} ${ungoverned.join(', ')}`);
+        }
+        // Legacy only: a key the old CSV lists with no schema behind it. On an enumerating project the
+        // class doesn't exist — schema keys come from the schema list, set values from the value lists.
+        const ungoverned = legacy ? rows.filter((r) => !r.s.exists).map((r) => r.key) : [];
+        if (ungoverned.length)
+            info(`${dim('also in params.keys, no schema:')} ${ungoverned.join(', ')}`);
+        // Collection-scope values (every token sees these). `seed` is per-token and never enumerated —
+        // it is a tokenData coordinate, read directly.
+        const set = legacy ? null : await readSetParamKeys(publicClient, address);
+        if (set?.contract.length) {
+            info(`${dim('contract-scope params set:')} ${[...set.contract].sort().join(', ')} ${dim('(apply to every token)')}`);
         }
     }
     catch {
@@ -5936,6 +6068,10 @@ const COMMAND_HELP = {
     ${g('--compress')} none|fastlz|gzip   for --onchain-image (default none): ${g('fastlz')} = on-chain decode (stays renderable);
                             ${g('gzip')} = smaller but off-chain decode only
     --royalty-bps <0-10000>   default 500 (5%)
+    ${g('--721c')} [recommended|0x..]   opt-in ERC-721C: enroll at deploy, PERMANENTLY, with that transfer validator
+                            (${g('recommended')} = OpenSea's validator for creator-fee enforcement — only owner-initiated
+                            transfers + authorized sales move the token). Absent = plain ERC-721, forever (the default).
+                            Manage later with ${g('abx set-transfer-validator')} (re-point or suspend; never un-enroll).
     ${g('--no-mint')}             deploy without minting (warm the resolver, then ${g('abx mint')})
     --salt 0x..<64hex>    deploy to a reserved / vanity address (see ${g('abx predict')})
     --public-base-url <url>   bake a public resolver URL on-chain (off-chain custody REQUIRES a public URL; localhost is refused)
@@ -5965,6 +6101,8 @@ const COMMAND_HELP = {
                           a huge collection should set traits post-deploy via ${g('abx set-field')} under a gas budget.
     --minter 0x..         authorize a single minting contract   --primary-payee 0x..   primary-sale payout
     --unpaused            open the mint at deploy (default: paused ⇒ owner-only until ${g('abx unpause')})
+    ${g('--721c')} [recommended|0x..]   opt-in ERC-721C: enroll at deploy, PERMANENTLY, with that transfer validator (absent = plain
+                          ERC-721 forever). ${g('recommended')} = OpenSea's creator-fee-enforcement validator. Manage: ${g('abx set-transfer-validator')}
     --salt 0x.. · --backend … (storage override) · ${g('--storage-signer')} arweave|eth (who pays Turbo uploads) · signing: ${g('--send')} · ${g('--sign')} · ${g('--unsigned')}
     ${g('--dry-run')}             preview (address · per-token plan · custody · mint plan) WITHOUT sending or storing
                             ${dim('(a dry-run needs a deployer to compute the address — pass --for 0x.. if no signing key is set)')}
@@ -6018,8 +6156,8 @@ const COMMAND_HELP = {
     ${g('--onchain-uri')}         the CHAIN-COMPLETE lane: tokenURI/contractURI resolve ON-CHAIN via the canonical metadata renderer, and
                           animation_url is COMPUTED on-chain by the canonical ${bold('AbxGenerator')} (template: the full HTML document;
                           directory: a parameterized gateway URL — 8KB URL budget, gateway liveness applies). No resolver base is baked
-                          (no --public-base-url needed); the ${g('params.keys')} contract param is written automatically from the schema
-                          flags. The marketplace still is rendered off-chain by the effect runner ${bold('for a JS program')} (--script/--code-dir) — but with ${g('--image-renderer')} the image is computed ON-CHAIN too (nothing to render). Verify with ${g('abx verify <addr>')}.
+                          (no --public-base-url needed); the param surface is enumerated ON-CHAIN, so there is nothing to declare or
+                          keep in sync. The marketplace still is rendered off-chain by the effect runner ${bold('for a JS program')} (--script/--code-dir) — but with ${g('--image-renderer')} the image is computed ON-CHAIN too (nothing to render). Verify with ${g('abx verify <addr>')}.
                           (--generator 0x.. / --renderer 0x.. override the canonical singletons; ABX_GENERATOR / ABX_RENDERER via env.)
     --schema key:Type:Auth,…   governed PostParams (e.g. ${g('palette:HexColor:TokenOwner')}) — set values later with ${g('abx configure-param')},
                           change the SCHEMA later with ${g('abx set-schema')}. An Address leg names its writer inline —
@@ -6046,6 +6184,8 @@ const COMMAND_HELP = {
                           a CDN-served record is the normal production path, on-chain bytes are the durability floor).
     --max N               supply cap (default 16)   mint timing: ${g('--mint-all')} · ${g('--mint-count')} N · (default: defer, then ${g('abx mint')})
     --no-seed             opt out of the canonical mint-time seed (seeds settle once assigned; curated pre-set seeds win)
+    ${g('--721c')} [recommended|0x..]   opt-in ERC-721C: enroll at deploy, PERMANENTLY, with that transfer validator (absent = plain
+                          ERC-721 forever). ${g('recommended')} = OpenSea's creator-fee-enforcement validator. Manage: ${g('abx set-transfer-validator')}
     --backend ipfs|arweave   directory-mode custody for the build upload   ${g('--unpaused')} · --minter 0x.. · --primary-payee 0x..
     ${dim('a fixed-price PRIMARY SALE is set up AFTER deploy, not by these flags: ')}${g('abx minter configure <addr> --price <eth>')}${dim(' → ')}${g('set-minter')}${dim(' → ')}${g('set-primary-payee')}${dim(' → ')}${g('unpause')}${dim(' (see `abx minter --help`). --minter/--primary-payee here only pre-authorize an already-known minter.')}
     signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} ${dim('(needs --for 0x..)')}   ${g('--bootstrap-factory')} ${dim('(private chains/sandboxes only)')}
@@ -6112,8 +6252,8 @@ const COMMAND_HELP = {
     Select by label, address, bool). Auth is per the schema leg (Artist=owner · TokenOwner — delegate.xyz honored · Address).
     A change ${bold('re-addresses renders')} → the still becomes a placeholder until you re-render (${g('abx render <addr> <id>')} or the runner).
     ${g('<tokenId> "-"')}        CONTRACT scope (owner-only raw setter; schema-less keys only) — the write path of well-known params
-                          like ${g('params.keys')} / ${g('display.gateway')}. ≤31 printable-ASCII chars ride as a literal bytes32; longer takes the data path.
-                          After a token write, a project whose ${g('params.keys')} doesn't list the key gets a one-line fix suggestion.
+                          like ${g('display.gateway')}. ≤31 printable-ASCII chars ride as a literal bytes32; longer takes the data path.
+                          A contract-scope param applies to every token, and enumerates on-chain like any other.
     --file <path>         read the value from a file (String / Bytes payloads)
     ${g('--remote [name|url]')}  nudge a REMOTE resolver to re-index IMMEDIATELY after the change (else ABX_PUBLIC_BASE_URL) — it pings
                           the resolver's effect runner, so the thumbnail re-renders without waiting. Usually OPTIONAL now: a
@@ -6150,7 +6290,8 @@ const COMMAND_HELP = {
     signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')}`,
     state: `
   ${bold('abx state')} <address> ${dim('— read-only, on-chain operational snapshot (no tx, no local index).')}
-    Shows owner · supply (minted / max, nextTokenId) · paused · minter · primary payee · royalty · renderer.
+    Shows owner · supply (minted / max, nextTokenId) · paused · minter · primary payee · royalty · renderer
+    (+ the 721C transfer validator, for a collection that enrolled at deploy — plain ERC-721s show nothing new).
     Series-only fields are shown for a Series; a 1/1 shows just supply + royalty + renderer.
     Handy before/after owner ops (mint · pause/unpause · set-minter · set-primary-payee).
     ${dim('state = what the CHAIN says. For who is SERVING it and how fresh that is, see `abx status`.')}`,
@@ -6205,6 +6346,14 @@ const COMMAND_HELP = {
     deploy to Vercel). ${dim('Offer this after a sale is live (configure → set-minter → set-primary-payee → unpause).')}`,
     'set-royalty': `
   ${bold('abx set-royalty')} <address> --bps <0-10000> [--receiver 0x..] ${dim('— change the royalty. Sends a tx.')}`,
+    'set-transfer-validator': `
+  ${bold('abx set-transfer-validator')} <address> <0x..|none|recommended> ${dim('— manage an ERC-721C collection\'s transfer validator. Owner-only. Sends a tx.')}
+    <0x..>                re-point enforcement at that validator (must be a DEPLOYED contract — checked before any gas)
+    ${g('none')}                  suspend enforcement (validator → address(0); the collection STAYS enrolled)
+    ${g('recommended')}           the chain's recommended validator (OpenSea's, for creator-fee enforcement)
+    ${dim('Only for a collection that enrolled AT DEPLOY (--721c on the deploy commands) — a plain ERC-721 is refused')}
+    ${dim('up front: enrollment is a deploy-time decision and can never be added (or fully removed) later.')}
+    signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')} preview (encodes + shows the tx, sends nothing)`,
     attach: `
   ${bold('abx attach')} <address> <key> <ipfs://… | ar://… | https://…> ${dim('— attach a named file to a token. Sends a tx.')}
     ${dim('The data-plane verb: the file joins the token\'s served')} ${bold('artifacts')} ${dim('manifest as {key, mimeType, uri}.')}
@@ -6215,7 +6364,8 @@ const COMMAND_HELP = {
     ${g('--dry-run')}             preview the tx, send nothing   ·   signing: ${g('--send')} (default, needs a hot key) · ${g('--sign')} (browser wallet, no key) · ${g('--unsigned')}
     ${dim('Need the URI first? Upload the file with')} ${g('abx storage upload <path> --backend arweave|ipfs')} ${dim('— it prints the locator to pass here.')}
     ${dim('mimeType is declared from the URL EXTENSION (…/master.tiff → image/tiff) — give the file a real extension.')}
-    ${dim('Surfaces in a resolver\'s artifacts listing (/data/<key> fetches it); a bare on-chain tokenURI shows reserved fields only.')}
+    ${dim('Surfaces in a resolver\'s artifacts listing (/data/<key> fetches it); a bare on-chain tokenURI shows reserved fields + abx_params only —')}
+    ${dim('configured params DO appear on-chain (as')} ${bold('abx_params')}${dim('); ATTACHMENTS are the surface that needs a resolver.')}
     ${dim('The image/animation are just reserved members of the same manifest. `artifacts` itself is COMPUTED — not settable.')}`,
     'set-field': `
   ${bold('abx set-field')} <address> --field <name> ${dim('— set an on-chain metadata field (the low-level primitive). Sends a tx.')}
@@ -6223,7 +6373,7 @@ const COMMAND_HELP = {
     --field <name>        a reserved display field (image · description · animation_url · external_url · attributes ·
                           background_color · …), a collection authorship/rights field with ${g('--collection')}
                           (artist · display_notes · artist_links · license), OR any custom key (which becomes an
-                          ${bold('artifacts')} entry). NOT ${g('artifacts')}/${g('abx_provenance')} (computed).
+                          ${bold('artifacts')} entry). NOT ${g('artifacts')}/${g('abx_params')}/${g('abx_provenance')} (computed).
     --text "<s>"          store literal UTF-8 ON-CHAIN (representation defaults ${g('inline')}) — NOT for an off-chain URL (use ${bold('attach')})
     --file <path>         store a FILE on-chain in SSTORE2 chunks behind the shared reader (any size; multi-chunk)
     ${g('--compress')} none|fastlz|gzip   for --file (default none): ${g('fastlz')} = on-chain decode, stays renderable, cheaper storage;
@@ -6285,7 +6435,7 @@ const COMMAND_HELP = {
     storage: `
   ${bold('abx storage')} <show|upload|balance|topup|backup-key> ${dim('— inspect / operate byte custody. Mostly read-only.')}
     ${g('show')}                  the resolved backend (fs | cloud | ipfs | arweave) + where each value came from
-    ${g('upload')} <path>         upload ONE file → prints its locator (the URI ${g('abx attach')} wants)   [--backend …] [--dry-run]
+    ${g('upload')} <path>         upload ONE file → prints its locator (the URI ${g('abx attach')} wants)   [--backend …] [--dry-run] [${g('--json')}]
     ${g('balance')} · ${g('topup')} --usd <n>   Turbo (arweave) upload credits   ·   ${g('backup-key')} --out <path>   copy the managed key`,
     demo: `
   ${bold('abx demo')} <${dim('no args')}> ${dim('— deploy a throwaway 1/1 to the testnet, index it, and serve it — a guided first run. Sends a tx.')}
@@ -6437,6 +6587,7 @@ function help() {
     ${g('abx set-contract-uri')} <addr> re-point the collection URI        --uri <url>
     ${g('abx migrate')} <addr>       move off-chain state to a NEW resolver (verifies parity; no cutover)   --from <old> --to <new>
     ${g('abx set-royalty')} <addr>  change royalty   --bps <0-10000> [--receiver 0x..]
+    ${g('abx set-transfer-validator')} <addr> <0x..|none|recommended>   manage an ERC-721C collection's validator (enrolled-at-deploy only)
     ${g('abx attach')} <addr> <key> <ipfs://…|ar://…|https://…>   attach a named file → the token's ${bold('artifacts')} manifest (data plane)
     ${g('abx set-field')} <addr>    set an on-chain metadata field (low-level)   --field <name> (--text "…" | --value 0x..) [--collection]
     ${g('abx lock-field')} <addr>   freeze a field forever   --field <name> [--collection]
@@ -6470,6 +6621,48 @@ function help() {
   ${dim('abx checks npm for a newer release (every 6h, notify-only). Silence with')} ${g('ABX_NO_UPDATE_CHECK=1')} ${dim('or')} ${g('--no-update-check')}${dim('.')}
 `);
 }
+/**
+ * Resolve `--721c` into the InitParams `transferValidator`. Absent → `zeroAddress`: a plain
+ * ERC-721, byte-for-byte the pre-721C deploy — no prompts, no output, no mention of 721C.
+ * `--721c` / `--721c recommended` → the per-chain recommended validator (refused, naming the
+ * chains that have one, when the manifest has no entry); `--721c 0x…` → checksum-validated AND
+ * pre-checked for code on this chain (the factory would revert `InvalidTransferValidator()` —
+ * surface it before any upload/staging/gas). When enrolling, prints the one plain statement of
+ * what enforcement means — once, adapted to the chosen validator.
+ */
+async function resolveTransferValidatorFlag(flags, publicClient, dryRun) {
+    const raw = flags['721c'];
+    if (raw === undefined)
+        return zeroAddress;
+    const chainId = resolveChain(CHAIN).id;
+    const validator = parseTransferValidatorValue(raw, { chainId, chainLabel: CHAIN });
+    // Has-code precheck — for the recommended constant too (presence on THIS chain is the fact that
+    // matters; a sandbox/private chain won't have it). A dry run tolerates an unreachable RPC (it
+    // sends nothing); a real deploy refuses to enroll blind.
+    let code;
+    try {
+        code = await publicClient.getCode({ address: validator });
+    }
+    catch (err) {
+        if (!dryRun)
+            throw new Error(`--721c: couldn't verify the validator has code at ${validator} (${err.message}) — refusing to enroll blind; retry when the RPC answers.`);
+        code = null; // offline preview — note it below
+    }
+    if (code === null) {
+        info(dim(`--721c: RPC unreachable, so the validator code check is deferred — a real deploy verifies ${validator} has code first.`));
+    }
+    else if (!code || code === '0x') {
+        const rec = resolveRecommendedTransferValidator(chainId);
+        throw new Error(`--721c: no contract code at ${validator} on ${CHAIN} — the deploy would revert InvalidTransferValidator(). ` +
+            `A transfer validator must be a DEPLOYED contract on this chain` +
+            (rec && rec !== validator ? ` (the known-good one: --721c recommended → ${rec})` : '') + `.`);
+    }
+    // The one plain statement — printed once, only when enrolling. Never appears un-enrolled.
+    info(validator === resolveRecommendedTransferValidator(chainId)
+        ? `ERC-721C enforcement: only owner-initiated transfers and OpenSea-authorized sales will transfer; other marketplaces/operators are blocked. Manage with \`abx set-transfer-validator\`.`
+        : `ERC-721C enforcement: every non-mint transfer is checked by validator ${validator} — its policy decides which operators may transfer. Manage with \`abx set-transfer-validator\`.`);
+    return validator;
+}
 /** Validate an explicit --salt (a 32-byte hex). Undefined when absent. */
 function parseSaltFlag(raw) {
     if (!raw || raw === 'true')