@artblocks/abx-cli 0.1.0-alpha.20 → 0.1.0-alpha.22

package/dist/commands/deploy.js

@@ -15,20 +15,20 @@
 import { createHash } from 'node:crypto';
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { basename, extname, join as joinPath, resolve as resolvePath } from 'node:path';
-import { DEFAULT_CHAIN_KEY, DEP_RESOLUTION, METADATA_FIELD as F, METADATA_REPRESENTATION as R, analyzeScript, assertChainId, checkRegistryDeps, dependencySetupCalls, deployOneOfOne, deploySeries, deployOneOfOneEdition, deployEditionImage, discoverDeployBlock, encodeFieldRenderer, encodeTag, expectedChainComplete, makeHotSender, makePublicClient, makeWalletClient, normalizeAttributes, onchainUriSetupCalls, oneOfOneImageAbi, oneOfOneEditionAbi, parseTraitPairs, planResume, predictClone, prepareCodeSetup, prepareDeployOneOfOne, prepareDeploySeries, prepareDeploySeriesCode, prepareDeployOneOfOneEdition, prepareDeployEditionImage, prepareDeployEditionCode, redactRpcUrl, resolveChain, resolveDepRegistryPointer, resolveGenerator, resolveRecommendedTransferValidator, resolveRpcUrl, resolveSeedSource, resolveSeriesCodeFactory, saltFor, seriesCodeAbi, seriesCodeFactoryAbi, tryReadContract, } from '@artblocks/abx-sdk';
+import { DEFAULT_CHAIN_KEY, DEP_RESOLUTION, METADATA_FIELD as F, METADATA_REPRESENTATION as R, analyzeScript, assertChainId, checkRegistryDeps, dependencySetupCalls, deployOneOfOne, deploySeries, deployOneOfOneEdition, deployEditionImage, discoverDeployBlock, encodeFieldRenderer, encodeTag, expectedChainComplete, makeHotSender, makePublicClient, makeWalletClient, normalizeAttributes, onchainUriSetupCalls, oneOfOneImageAbi, oneOfOneEditionAbi, parseTraitPairs, planResume, predictClone, probeSeedSource, prepareCodeSetup, prepareDeployOneOfOne, prepareDeploySeries, prepareDeploySeriesCode, prepareDeployOneOfOneEdition, prepareDeployEditionImage, prepareDeployEditionCode, redactRpcUrl, resolveChain, resolveDepRegistryPointer, resolveGenerator, probeTransferValidator, resolveRecommendedTransferValidator, resolveRpcUrl, resolveSeedSource, resolveSeriesCodeFactory, saltFor, seriesCodeAbi, seriesCodeFactoryAbi, tryReadContract, } from '@artblocks/abx-sdk';
 import { DIRECT_URL_BACKENDS, contentTypeFromPath, decideImageContentLane, hashContent, isTurboArweave, resolveBackend, validateRenderStorageCombo, } from '@artblocks/abx-storage';
-import { DEFAULT_PORT, artContentHash, generateArt, resolveBaseUrl, startTokenApiServer } from '@artblocks/abx-token-api';
+import { DEFAULT_PORT, contentHash, generateContent, resolveBaseUrl, startTokenApiServer } from '@artblocks/abx-token-api';
 import { encodeFunctionData, toHex, zeroAddress } from 'viem';
 import { CHAIN, explorerBase, assertTurboFundsForUpload, backendResolution, collectContentLocators, ensureArweaveIdentityForUpload, factoryAddress, faucetHint, localIndexer, loopbackBaseUrl, noteArweavePlan, noteStorageReadiness, rendererAddress, seriesFactoryAddress, oneOfOneEditionFactoryAddress, editionFactoryAddress, editionCodeFactoryAddress, storageOptions, storageOverrides, storageSignerChoice, } from '../config.js';
 import { parseDepFlag } from '../deps.js';
-import { isDryRun, parseSaltFlag, refuseStrayFlags, warnSignWithoutFor } from '../flags.js';
+import { allowUnreadableOnchain, isDryRun, parseSaltFlag, refuseStrayFlags, warnSignWithoutFor } from '../flags.js';
 import { isEditionContract } from '../kind.js';
 import { jsonSafe, withJson } from '../jsonout.js';
 import { bold, c, dim, ensureFactory, ensureRenderer, ensureSeedSource, ensureSeriesCodeFactory, ensureSeriesFactory, ensureOneOfOneEditionFactory, ensureEditionFactory, ensureEditionCodeFactory, g, info, keepAlive, ok, p, portInUse, printServing, registerAndIndexLocally, reindexAfterDeploy, step, warn, } from '../output.js';
-import { AUTHORSHIP_DEPLOY_FIELDS, ONCHAIN_PROJECT_SOFT_LIMIT, authorshipContractFields, computeContentPlan, envStagingSender, parseCompress, parseTransferValidatorValue, previewImageStaging, sessionStagingSender, stageImageField, stageImageFieldsBatch, } from '../ownerops.js';
+import { AUTHORSHIP_DEPLOY_FIELDS, ONCHAIN_PROJECT_SOFT_LIMIT, ONCHAIN_READ_WARN_BYTES, tokenUriGasEstimate, authorshipContractFields, computeContentPlan, envStagingSender, parseCompress, parseSeedSourceValue, canonicalSeedSource, refuseUnusableSeedSource, parseTransferValidatorValue, guardOnChainSize, previewImageStaging, sessionStagingSender, stageImageField, stageImageFieldsBatch, } from '../ownerops.js';
 import { canonicalLabel } from '../remote.js';
 import { confirmSend, gatedSend, laneFromFlags } from '../riskgate.js';
-import { describeSchema, parseSchemaSpecs } from '../schema.js';
+import { describeSchema, editionSchemaAdvisory, parseSchemaSpecs } from '../schema.js';
 import { parseSeriesTraits } from '../series-traits.js';
 import { decodeOnChainJson } from '../served.js';
 import { openWalletSession, signHotSequence, signTx } from '../signer.js';
@@ -261,6 +261,7 @@ export function deployCodeCommandLine(flags, salt) {
     str('max', flags.max);
     str('schema', flags.schema);
     bool('no-seed');
+    str('seed-source', flags['seed-source']);
     bool('onchain-uri');
     str('generator', flags.generator);
     str('renderer', flags.renderer);
@@ -289,7 +290,7 @@ export function deployCodeCommandLine(flags, salt) {
 // Build the token's `image` field as an on-chain keccak256 commitment over the bytes,
 // and (with --image) store those bytes in custody keyed by that hash so the resolver
 // can serve + verify them. Without --image, fall back to the demo's generative-from-
-// address art (recomputable, nothing to store). Returns on-chain field inputs.
+// address content (recomputable, nothing to store). Returns on-chain field inputs.
 export const imageKeccakField = (value) => ({
     field: encodeTag(F.image),
     representation: encodeTag(R.keccak256),
@@ -364,12 +365,12 @@ walletAddr) {
         // off-chain mode commits its keccak and regenerates/serves it.
         if (onChain) {
             return {
-                tokenFields: [imageInlineField(generateArt(clone))],
+                tokenFields: [imageInlineField(generateContent(clone))],
                 contentNote: 'content: generative SVG, INLINE on-chain (self-resolving, no custody)',
             };
         }
         return {
-            tokenFields: [imageKeccakField(artContentHash(clone))],
+            tokenFields: [imageKeccakField(contentHash(clone))],
             contentNote: 'content: generative SVG from the contract address (demo default)',
         };
     }
@@ -509,7 +510,7 @@ export function describeTraits(traits, onchain) {
 // ── deploy (+ optionally serve) ──────────────────────────────────────────────
 export async function cmdDeploy(flags, serveAfter) {
     // `--copies <N|open>` routes to the ERC-1155 edition twin (OneOfOneEdition) — the flagship
-    // edition product: a priced open/limited edition of ONE artwork. Checked before anything else
+    // edition product: a priced open/limited edition of ONE work. Checked before anything else
     // touches `flags`, so the 721 lane (`cmdDeployBody`) below is reached ONLY when `--copies` is
     // absent, and is otherwise untouched by this feature — byte-identical to before editions shipped.
     if (flags.copies !== undefined) {
@@ -543,7 +544,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     // lockable) — mirrors the description model. On-chain wins if both ever set the same trait.
     const traits = parseDeployTraits(flags);
     console.log(serveAfter
-        ? bold(`\n  ABX · your first token\n  ${dim("we'll put art on a blockchain — then delete our copy and get all of it back")}`)
+        ? bold(`\n  ABX · your first token\n  ${dim("we'll put your work on a blockchain — then delete our copy and get all of it back")}`)
         : bold(`\n  ABX Self-Host Toolkit — deploy\n  ${dim('a project, served from chain alone')}`));
     // Signing lane. `demo` used to hard-force the hot lane, which SILENTLY dropped `--sign`: with no
     // env key it died confusingly, and WITH one it signed from that key while the operator had asked
@@ -639,17 +640,17 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     // otherwise leave it EMPTY rather than baking a misleading localhost into the contract.
     const hasPublicUrl = !!(flags['public-base-url'] || process.env.ABX_PUBLIC_BASE_URL);
     const onchainImage = !!flags['onchain-image'];
-    // `abx demo` defaults to FULLY ON-CHAIN. Its default art is a generative SVG, which the renderer
+    // `abx demo` defaults to FULLY ON-CHAIN. Its default content is a generative SVG, which the renderer
     // can inline — so the token self-resolves and, crucially, NO localhost gets baked into the
     // contract as the tokenURI base. The old default shipped a first-ever token that resolved for
     // nobody but its author (broken on every marketplace, dead the moment `abx serve` stops) and
-    // taught that as the normal shape of an NFT. It also undercut the demo's own claim: with the art
+    // taught that as the normal shape of an NFT. It also undercut the demo's own claim: with the content
     // on-chain, "rebuilt from the chain alone" now covers the IMAGE, not just the metadata.
     //
     // Opting back into off-chain custody is anything that says "I have somewhere to host": a real base
     // URL, an explicit --backend, or a RASTER --image. An SVG --image still goes on-chain — inlining is
     // exactly what the renderer supports (v1 is SVG-only), so there's no reason to send someone's own
-    // vector art down the localhost path. Raster stays off-chain because forcing it on-chain would
+    // vector content down the localhost path. Raster stays off-chain because forcing it on-chain would
     // silently inline a placeholder instead of their image.
     const demoImageInlineable = !flags.image || contentTypeFromPath(flags.image) === 'image/svg+xml';
     const demoDefaultsOnChain = serveAfter && demoImageInlineable && !flags.backend && !hasPublicUrl;
@@ -680,12 +681,12 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     // and it's invisible unless someone says it out loud. Two honest versions, because the answer is
     // genuinely different per lane. Demo only — `deploy` prints the same facts per-field.
     if (serveAfter && onChainUri) {
-        console.log(`    Your art goes ${bold('INTO')} the contract. Not a link to it — the image itself.`);
-        console.log(`    ${g('✦')} the chain will hold   ${dim('your art · your name on it · your royalty · you as owner')}`);
+        console.log(`    Your work goes ${bold('INTO')} the contract. Not a link to it — the image itself.`);
+        console.log(`    ${g('✦')} the chain will hold   ${dim('your work · your name on it · your royalty · you as owner')}`);
         console.log(`    ${g('✦')} you will need         ${dim('nothing else. no server, no IPFS pin, no monthly bill to forget')}`);
     }
     else if (serveAfter) {
-        console.log(`    ${g('✦')} the chain will hold   ${dim('your name · your royalty · you as owner · a fingerprint of the art')}`);
+        console.log(`    ${g('✦')} the chain will hold   ${dim('your name · your royalty · you as owner · a fingerprint of the work')}`);
         console.log(`    ${g('✦')} this computer holds   ${dim('the image bytes themselves')}`);
         info(dim('the chain proves the bytes are unaltered; it does not store them (that fingerprint is a keccak256 hash)'));
     }
@@ -702,7 +703,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one ` +
                 `(not marketplaces, not wallets, not even your own browser unless \`abx serve\` is running). Pick a real path:\n` +
-                `    • Fully on-chain, no host:  --onchain-image --compress fastlz     (best for small static art)\n` +
+                `    • Fully on-chain, no host:  --onchain-image --compress fastlz     (best for small static content)\n` +
                 `    • Hosted resolver:          --public-base-url https://your.domain (or set ABX_PUBLIC_BASE_URL)`;
             if (!devAllow) {
                 if (dryRun)
@@ -769,12 +770,12 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         }
         step('Stage on-chain image');
         if (dryRun) {
-            info(previewImageStaging(flags.image, parseCompress(flags.compress)));
+            info(previewImageStaging(flags.image, parseCompress(flags.compress), allowUnreadableOnchain(flags)));
         }
         else if (lane === 'send') {
             // hot lane: the env key stages now (deployer-independent — the manifest doesn't depend
             // on the clone address), then the deploy below bakes in the reader field.
-            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), envStagingSender());
+            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), envStagingSender(), allowUnreadableOnchain(flags));
             bakedImage = field;
             info(note);
         }
@@ -851,7 +852,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
             royaltyBps,
             transferValidator,
             tokenFields,
-            // authorship + rights (artist / license / …) are collection-scope on-chain fields.
+            // authorship + rights (creator / license / …) are collection-scope on-chain fields.
             contractFields: authorshipContractFields(flags),
         };
         return { clone, params, salt, contentNote };
@@ -917,7 +918,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         return;
     }
     // opt-in --confirm: a final y/N before the real send (no-op without --confirm; never blocks scripts)
-    await confirmSend(`About to deploy 1/1 "${name}" (${symbol})${flags.image ? ' with your image' : ' (generative demo art)'}; mint: ${noMint ? 'deferred' : 'token #0 at deploy'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
+    await confirmSend(`About to deploy 1/1 "${name}" (${symbol})${flags.image ? ' with your image' : ' (generative demo content)'}; mint: ${noMint ? 'deferred' : 'token #0 at deploy'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
         (transferValidator !== zeroAddress ? ` ERC-721C: enrolled at deploy, permanently (validator ${transferValidator}).` : ''), flags);
     if (lane === 'send') {
         // hot lane: the env key is the deployer, known up front.
@@ -960,7 +961,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         try {
             const signer = await session.connect();
             // Stage on-chain through the session (sets bakedImage, which buildForDeployer reads below).
-            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), sessionStagingSender(session));
+            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), sessionStagingSender(session), allowUnreadableOnchain(flags));
             bakedImage = field;
             info(note);
             const { clone: predicted, params, salt, contentNote } = await buildForDeployer(signer);
@@ -1148,7 +1149,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     keepAlive();
 }
 // ── deploy --copies: OneOfOneEdition (the flagship ERC-1155 product) ─────────────────────────────
-// Copies of ONE artwork — a priced open/limited edition. The edition twin of `cmdDeployBody`,
+// Copies of ONE work — a priced open/limited edition. The edition twin of `cmdDeployBody`,
 // reusing every standard-agnostic helper it does (content custody, traits, authorship fields, the
 // `--721c`/`--1155c`-shared validator resolution, salt prediction, signing lanes) but written as its
 // own function rather than threaded into `cmdDeployBody` with `if (copies)` branches throughout —
@@ -1168,10 +1169,10 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     // `--type` is the 721 lane's OWN dimension seam (cmdDeployBody redirects `--type series` to
     // `deploy-series`) — it never even reaches this function for that redirect, since --copies routes
     // here before --type is ever inspected. Refuse the confusing combination explicitly rather than
-    // silently ignore it (a creator combining them almost certainly means the multi-artwork edition —
+    // silently ignore it (a creator combining them almost certainly means the multi-work edition —
     // `deploy-series --copies`, not this 1/1-edition lane).
     if (flags.type !== undefined && resolveDimension(flags.type) === 'series') {
-        throw new Error("--type series + --copies: this is the 1/1-edition lane (one artwork, copies of it) — for N artworks each with copies, " +
+        throw new Error("--type series + --copies: this is the 1/1-edition lane (one work, copies of it) — for N works each with copies, " +
             'use `abx deploy-series --copies <n|open> --dir <folder>` instead. Drop --type here.');
     }
     const editionSize = parseCopies(flags.copies);
@@ -1182,21 +1183,23 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     const traits = parseDeployTraits(flags);
     console.log(bold(`\n  ABX Self-Host Toolkit — deploy edition\n  ${dim(editionSize === 0n
-        ? 'OneOfOneEdition (ERC-1155) — an OPEN edition of one artwork, served from chain alone'
-        : `OneOfOneEdition (ERC-1155) — ${editionSize} cop${editionSize === 1n ? 'y' : 'ies'} of one artwork, served from chain alone`)}`));
+        ? 'OneOfOneEdition (ERC-1155) — an OPEN edition of one work, served from chain alone'
+        : `OneOfOneEdition (ERC-1155) — ${editionSize} cop${editionSize === 1n ? 'y' : 'ies'} of one work, served from chain alone`)}`));
     if (editionSize === 1n)
         info(copiesOneNote('deploy'));
     const lane = laneFromFlags(flags);
     const dryRun = isDryRun(flags);
     const onchainImage = !!flags['onchain-image'];
     // Pure flag-combo validation — checked BEFORE any chain read (predict/factory/renderer all touch
-    // the network), same reasoning every other "this combo can never work" refusal in this file uses
-    // (e.g. the localhost-URL checks). Sequential staging (chunk tx → deploy) can't be split across
-    // the wallet-session/cold lanes in this pass (see the module-level scope note) — refuse rather
-    // than half-build it.
-    if (onchainImage && lane !== 'send') {
-        throw new Error('--onchain-image on an edition deploy is wired for the hot lane only right now (a funded ABX_DEPLOYER_PK) — ' +
-            'drop --onchain-image (off-chain custody or --onchain-uri still work on every lane), or switch to the hot lane. Tracked as a follow-up.');
+    // the network), same reasoning every other "this combo can never work" refusal in this file uses.
+    // Staging is a SEQUENCE (chunk write(s) → the deploy that references the manifest) where each tx's
+    // receipt feeds the next, so it cannot be signed offline in one run — the cold lane is refused on
+    // every lineage, 721 and edition alike. The wallet lane CAN do it (one session signs the chunk
+    // writes and the deploy); this edition path was hot-lane-only purely because it lacked that
+    // session branch, which it now has.
+    if (onchainImage && lane === 'unsigned') {
+        throw new Error('Staging an on-chain image (--onchain-image) needs interactive signing — each chunk tx feeds ' +
+            "the next, so it can't run on the cold lane (--unsigned). Use the hot lane (a funded key) or --sign (browser wallet).");
     }
     if (dryRun)
         assertPreviewDeployer(flags);
@@ -1255,7 +1258,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         if (!hasPublicUrl || loopback) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one. ` +
-                `Pick a real path:\n    • Fully on-chain (SVG art):     --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
+                `Pick a real path:\n    • Fully on-chain (SVG content): --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
             if (!devAllow) {
                 if (dryRun)
                     warn(`would REFUSE to deploy — ${msg}`);
@@ -1273,18 +1276,23 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     }
     step(`Deploy an edition of "${name}" to ${CHAIN}`);
     let bakedImage;
+    // On the WALLET lane staging cannot happen here — it has to run inside the sign session, after the
+    // connect, so the connecting wallet pays for and owns every chunk write. `stageNow` is the hot-lane
+    // (and dry-run) path; the session branch below calls the same helper with a session-backed sender.
+    const stageOnChainImage = async (sender) => {
+        const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), sender, allowUnreadableOnchain(flags));
+        bakedImage = field;
+        info(note);
+    };
     if (onchainImage) {
         if (!flags.image)
             throw new Error('--onchain-image needs --image <path> (the bytes to put on-chain)');
         step('Stage on-chain image');
-        if (dryRun) {
-            info(previewImageStaging(flags.image, parseCompress(flags.compress)));
-        }
-        else {
-            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), envStagingSender());
-            bakedImage = field;
-            info(note);
-        }
+        if (dryRun)
+            info(previewImageStaging(flags.image, parseCompress(flags.compress), allowUnreadableOnchain(flags)));
+        else if (lane === 'send')
+            await stageOnChainImage(envStagingSender());
+        // lane === 'sign' → staged inside the wallet session further down.
     }
     const explicitSalt = parseSaltFlag(flags.salt);
     const noMint = flags['no-mint'] !== undefined;
@@ -1295,6 +1303,21 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     const minter = flags.minter ?? zeroAddress;
     const primaryPayee = flags['primary-payee'] ?? zeroAddress;
     const paused = flags.unpaused === undefined;
+    // Same wallet-signature math as the 721 twin (see `cmdDeployBody`): staging tx(s) + the deploy tx.
+    // The edition paths shipped without this and without the readout line below, so `--copies` previews
+    // silently dropped the approval count the skill promises "every preview" prints — leaving an agent
+    // with nothing to tell the creator about how many wallet prompts to expect.
+    const approvals = onchainImage
+        ? (() => {
+            const plan = computeContentPlan(readFileSync(resolvePath(flags.image)), parseCompress(flags.compress)).plan;
+            return (plan.mode === 'single' ? 1 : plan.txCount) + 1;
+        })()
+        : 1;
+    if (onChainUri) {
+        info(`uri()/contractURI() resolve ON-CHAIN via the renderer — no resolver, no server, no localhost.`);
+        if (!hasPublicUrl)
+            info('off-chain fallback pointer left empty (the renderer is authoritative); set --public-base-url to bake one anyway.');
+    }
     const buildForDeployer = async (deployer) => {
         const salt = explicitSalt ?? saltFor(deployer);
         const clone = await predictClone(publicClient, { factory, salt });
@@ -1367,6 +1390,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         if (primaryPayee !== zeroAddress)
             info(`primary payee  ${primaryPayee}`);
         info(`paused  ${paused}${flags.unpaused ? '' : dim('  (default — pass --unpaused to open at deploy)')}`);
+        info(`approvals   ${approvals} wallet approval(s)`); // parity with the 721 twin — TX signatures only
         if (!explicitSalt) {
             console.log(`\n  ${bold('salt')}  ${g(salt)}`);
             info(`address: pinned by salt — re-run with ${bold(`--salt ${salt}`)} (same address), or ${bold(`abx predict --salt ${salt} --for ${deployer} --copies ${flags.copies}`)}.`);
@@ -1376,7 +1400,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         emit(jsonSafe({ command: 'deploy', kind: '1of1-edition', copies: editionSize.toString(), dryRun: true, sent: false, address: explicitSalt ? predicted : null, chain: CHAIN, chainId: resolveChain(CHAIN).id, factory, salt, saltPinned: !!explicitSalt, name, symbol }));
         return;
     }
-    await confirmSend(`About to deploy an edition of "${name}" (${symbol}) — ${editionSize === 0n ? 'open' : editionSize.toString()} copies${flags.image ? ' with your image' : ' (generative demo art)'}; mint: ${mintAmount > 0n ? `${mintAmount} at deploy` : 'deferred'}; owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
+    await confirmSend(`About to deploy an edition of "${name}" (${symbol}) — ${editionSize === 0n ? 'open' : editionSize.toString()} copies${flags.image ? ' with your image' : ' (generative demo content)'}; mint: ${mintAmount > 0n ? `${mintAmount} at deploy` : 'deferred'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
         (transferValidator !== zeroAddress ? ` ERC-1155C: enrolled at deploy, permanently (validator ${transferValidator}).` : ''), flags);
     if (lane === 'send') {
         const { wallet, account } = makeWalletClient({ chainKey: CHAIN });
@@ -1394,8 +1418,39 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         ok(`deployed ${clone}`);
         info(`tx ${explorerBase()}/tx/${r.txHash}  (block ${blockNumber})`);
     }
+    else if (lane === 'sign' && onchainImage) {
+        // Wallet lane + on-chain staging: ONE sign session signs every chunk write AND the deploy, so the
+        // connecting wallet pays for and owns all of it. Staging can't precede the connect, so it runs
+        // inside the session and the deploy then bakes in the resulting manifest field.
+        // `--onchain-image` implies on-chain resolution, so nothing points at baseUrl — mirrors the 721 1/1.
+        info('a wallet will become the owner; the edition resolves from chain — no URI base is baked in.');
+        const session = await openWalletSession({
+            chainKey: CHAIN,
+            expectedSigner: flags.for,
+            total: approvals, // the SAME staging-tx math the preview's `approvals` line reports
+            port: flags.port ? Number(flags.port) : undefined,
+            signUrlFile: flags['sign-url-file'],
+        });
+        let r;
+        try {
+            const signer = await session.connect();
+            await stageOnChainImage(sessionStagingSender(session)); // sets bakedImage, read by buildForDeployer
+            const { clone: predicted, params, salt, contentNote } = await buildForDeployer(signer);
+            info(contentNote);
+            info(mintAmount > 0n ? `mint: ${mintAmount} cop${mintAmount === 1n ? 'y' : 'ies'} of #0 → ${signer} at deploy` : 'mint: deferred — mint later with `abx mint`');
+            const sent = await session.send(prepareDeployOneOfOneEdition({ factory, params, salt, chainId: resolveChain(CHAIN).id, clone: predicted }));
+            r = { txHash: sent.txHash, blockNumber: sent.receipt.blockNumber };
+            clone = predicted;
+        }
+        finally {
+            session.close();
+        }
+        blockNumber = r.blockNumber;
+        ok(`deployed ${clone}`);
+        info(`tx ${explorerBase()}/tx/${r.txHash}  (block ${blockNumber})`);
+    }
     else {
-        // wallet lane (no on-chain-image staging — refused above) or the cold lane: a single deploy tx.
+        // wallet lane without staging, or the cold lane: a single deploy tx.
         info(onChainUri ? 'a wallet will become the owner; the token resolves from chain — no URI base is baked in.' : `a wallet will become the owner; URIs point at ${baseUrl}`);
         const result = await signTx(async (signer) => {
             const { clone: predicted, params, salt } = await buildForDeployer(signer);
@@ -1455,7 +1510,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
 // token (`0..N-1`, natural-sorted) — a token's metadata is its token id, and tokens mint
 // strictly in order. Content is hosted exactly like a 1/1, per token — three placements:
 //   • off-chain custody (default): keccak-committed, bytes served by the resolver.
-//   • `--onchain-uri`: inline each token's SVG on-chain (tiny art; SVG only).
+//   • `--onchain-uri`: inline each token's SVG on-chain (tiny content; SVG only).
 //   • `--onchain-image [--compress fastlz]`: stage each token's bytes (raster or SVG) into the
 //     shared chunk store and bake a per-token `reader` field — multi-chunk on-chain content,
 //     self-resolving via the renderer. Implies on-chain URI resolution.
@@ -1533,13 +1588,16 @@ export async function cmdDeploySeriesBody(flags, emit) {
         throw new Error('Staging on-chain images (--onchain-image) needs interactive signing — each chunk tx feeds ' +
             "the next, so it can't run on the cold lane (--unsigned). Use the hot lane (a funded key) or --sign (browser wallet).");
     }
-    // Whole-collection cost guard: per-file warnings fire during staging/preview, but a set of many
-    // small files can still sum to an expensive on-chain deploy — flag the total once, up front.
+    // Whole-collection WRITE-cost guard: a set of many small files can still sum to an expensive
+    // on-chain deploy, so flag the total once, up front. This is a cost signal only — the READ gate is
+    // per token (`guardOnChainSize`, fired per file during staging/preview), because each token's
+    // `tokenURI` assembles only its own content, so a 300-file collection of 5KB pieces reads fine.
     if (onchainImage) {
         const totalBytes = slots.reduce((n, s) => n + statSync(joinPath(dirPath, s)).size, 0);
         if (totalBytes > ONCHAIN_PROJECT_SOFT_LIMIT) {
-            warn(`on-chain collection total is ${Math.round(totalBytes / 1024)}KB across ${slots.length} file(s) — on-chain costs ~200 gas/byte, so this is expensive, not cheaper. ` +
-                `Past ~${Math.round(ONCHAIN_PROJECT_SOFT_LIMIT / 1024)}KB total, prefer off-chain: --backend arweave (pay-once, permanent) or a hosted resolver + IPFS.`);
+            warn(`on-chain collection total is ${Math.round(totalBytes / 1024)}KB across ${slots.length} file(s) — on-chain costs ~200 gas/byte to WRITE, so this is expensive, not cheaper. ` +
+                `Past ~${Math.round(ONCHAIN_PROJECT_SOFT_LIMIT / 1024)}KB total, prefer off-chain: --backend arweave (pay-once, permanent) or a hosted resolver + IPFS. ` +
+                `(Per-token readability is judged per file, not on this total.)`);
         }
     }
     const minter = flags.minter ?? zeroAddress;
@@ -1570,6 +1628,10 @@ export async function cmdDeploySeriesBody(flags, emit) {
     if (onChainUri) {
         step('On-chain renderer');
         renderer = dryRun ? (rendererAddress(flags.renderer) ?? zeroAddress) : await ensureRenderer(flags.renderer);
+        // Say WHICH renderer, like the 1/1 lane does. Both series lanes printed the step header with
+        // nothing under it, while the skill's confirm-readout template implies an address is quotable
+        // there — so an agent relaying the readout had a blank line to explain.
+        info(renderer === zeroAddress ? 'would deploy the canonical renderer first' : `${dryRun ? 'would use' : 'using'} renderer ${renderer}`);
     }
     // Off-chain custody bakes the resolver URL on-chain — a localhost URL resolves for no one.
     // (Not a concern with --onchain-uri: the renderer is authoritative and resolves from chain.)
@@ -1578,7 +1640,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
         if (!hasPublicUrl || loopback) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one. ` +
-                `Pick a real path:\n    • Fully on-chain (SVG art):     --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
+                `Pick a real path:\n    • Fully on-chain (SVG content): --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
             if (!devAllow) {
                 if (dryRun)
                     warn(`would REFUSE to deploy — ${msg}`);
@@ -1607,6 +1669,16 @@ export async function cmdDeploySeriesBody(flags, emit) {
     const offchainImageOnchainJson = onChainUri && !onchainImage && directUrlBackend;
     const backend = (offchainImageOnchainJson || !onChainUri) && !dryRun ? resolveBackend(opts) : undefined;
     const tokenPaths = slots.map((s, i) => ({ tokenId: i, name: s, path: joinPath(dirPath, s) }));
+    // Say WHICH backend holds the bytes, exactly as the 1/1 lane does. Both Series lanes resolved a
+    // backend and never named it, so a creator asking for "images on IPFS" had no way to confirm from
+    // the preview that their collection would actually pin there — the flag was accepted in silence.
+    if (!onchainImage && (offchainImageOnchainJson || !onChainUri)) {
+        const sr = backendResolution(overrides);
+        info(`storage: ${sr.backend} ${dim(`(${sr.source === 'flag' ? '--backend' : sr.source === 'env' ? 'env' : 'default'})`)} — byte custody for the image(s)`);
+        const gwWarn = localGatewayWarning(flags);
+        if (gwWarn)
+            warn(gwWarn);
+    }
     // Wallet-signature count for THIS deploy — the same per-token chunk math that sizes the
     // wallet-lane session `total` below (B2), computed ONCE so preview/confirm text and the real
     // session can never disagree. TX signatures only — see the 1/1's `approvals` for the same note
@@ -1651,7 +1723,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
     const buildImageFields = async (stage) => {
         // --onchain-image: stage every token's bytes into ONE shared chunk store, each a `reader` field.
         if (onchainImage) {
-            const { fields } = await stageImageFieldsBatch(tokenPaths.map((s) => s.path), compress, stage, flags['chunk-store']);
+            const { fields } = await stageImageFieldsBatch(tokenPaths.map((s) => s.path), compress, stage, flags['chunk-store'], allowUnreadableOnchain(flags));
             tokenFields = tokenPaths.map(({ tokenId }, i) => tokenFieldOf(tokenId, fields[i]));
             return;
         }
@@ -1767,7 +1839,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
             mintTo: mintCount > 0 ? deployer : zeroAddress,
             mintCount,
             tokenFields,
-            // image contract fields (the O(1) url-template) + authorship/rights (artist / license / …).
+            // image contract fields (the O(1) url-template) + authorship/rights (creator / license / …).
             contractFields: [...contractFields, ...authorshipContractFields(flags)],
         };
         return { clone, params, salt };
@@ -1819,7 +1891,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
         }
         if (onchainImage) {
             for (const { tokenId, name: fname, path } of tokenPaths) {
-                info(`token ${tokenId} ← ${fname}: ${previewImageStaging(path, compress)}`);
+                info(`token ${tokenId} ← ${fname}: ${previewImageStaging(path, compress, allowUnreadableOnchain(flags))}`);
             }
         }
         info(`approvals   ${approvals} wallet approval(s)`); // B2 — TX signatures only
@@ -1994,7 +2066,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
     console.log(`  ${bold(`abx refresh ${clone}`)}  ${dim('# nudge marketplaces once metadata is live')}\n`);
 }
 // ── deploy-series --copies: EditionImage ──────────────────────────────────────────────────────────
-// N distinct artworks (one per file, like a Series) × copies each. The edition twin of
+// N distinct works (one per file, like a Series) × copies each. The edition twin of
 // `cmdDeploySeriesBody`, kept as its OWN function for the same reason `cmdDeployOneOfOneEditionBody`
 // is (byte-identical 721 lane — see that function's module note).
 //
@@ -2019,9 +2091,6 @@ export async function cmdDeployEditionImageBody(flags, emit) {
         : `EditionImage (ERC-1155) — N ids from the folder × ${editionSize} cop${editionSize === 1n ? 'y' : 'ies'} each`)}`));
     if (editionSize === 1n)
         info(copiesOneNote('deploy-series'));
-    if (flags['onchain-image']) {
-        throw new Error('--onchain-image is not yet supported for edition deploys (--copies) — use --onchain-uri (inline SVG) or off-chain custody (--backend ipfs|arweave|cloud) instead. Tracked as a follow-up.');
-    }
     if (!flags.dir) {
         throw new Error('abx deploy-series --copies <n|open> --dir <media-dir> [--count N] [--mint-all | --mint-count N | --no-mint] [--mint-amount N] ' +
             '[--onchain-uri (inline SVG) | --backend ipfs|arweave|cloud (off-chain, hosted resolver) | --public-base-url https://…] ' +
@@ -2044,6 +2113,15 @@ export async function cmdDeployEditionImageBody(flags, emit) {
         assertPreviewDeployer(flags);
     assertRealIdentity(flags, { name, symbol, dryRun });
     const lane = laneFromFlags(flags);
+    const onchainImage = !!flags['onchain-image'];
+    const compress = parseCompress(flags.compress);
+    // Staging is a SEQUENCE (chunk writes → the deploy that references each manifest) where every tx's
+    // receipt feeds the next, so it can't be signed offline in one run. Refused on the cold lane for the
+    // same reason on every lineage, 721 and edition alike; hot + wallet both work.
+    if (onchainImage && lane === 'unsigned') {
+        throw new Error('Staging on-chain images (--onchain-image) needs interactive signing — each chunk tx feeds ' +
+            "the next, so it can't run on the cold lane (--unsigned). Use the hot lane (a funded key) or --sign (browser wallet).");
+    }
     const publicClient = makePublicClient({ chainKey: CHAIN });
     await assertChainId(CHAIN, { allowUnreachable: dryRun });
     const transferValidator = await resolveTransferValidatorFlag(flags, publicClient, dryRun, '1155C');
@@ -2060,7 +2138,12 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     if (effectiveMintCount > 0 && mintAmount === 0n) {
         throw new Error('--mint-amount 0 with ids being pre-minted at deploy makes no sense — pass a positive --mint-amount, or drop --mint-all/--mint-count to defer minting entirely.');
     }
-    const onChainUri = !!flags['onchain-uri'];
+    // `--onchain-image` IMPLIES on-chain resolution — bytes on-chain behind a renderer that has no
+    // reason to defer to a server. Every sibling lane already reads it that way (the 1/1, the
+    // 1/1-edition, the 721 Series); this one didn't, which was harmless only while `--onchain-image`
+    // was refused here. Now that it's wired, omitting it would demand a `--public-base-url` for a drop
+    // whose bytes are already on-chain — incoherent, and it would bake a resolver URL nobody needs.
+    const onChainUri = !!flags['onchain-uri'] || onchainImage;
     const minter = flags.minter ?? zeroAddress;
     const paused = flags.unpaused === undefined;
     const primaryPayee = flags['primary-payee'] ?? zeroAddress;
@@ -2087,13 +2170,17 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     if (onChainUri) {
         step('On-chain renderer');
         renderer = dryRun ? (rendererAddress(flags.renderer) ?? zeroAddress) : await ensureRenderer(flags.renderer);
+        // Say WHICH renderer, like the 1/1 lane does. Both series lanes printed the step header with
+        // nothing under it, while the skill's confirm-readout template implies an address is quotable
+        // there — so an agent relaying the readout had a blank line to explain.
+        info(renderer === zeroAddress ? 'would deploy the canonical renderer first' : `${dryRun ? 'would use' : 'using'} renderer ${renderer}`);
     }
     if (!onChainUri) {
         const loopback = loopbackBaseUrl(baseUrl);
         if (!hasPublicUrl || loopback) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one. ` +
-                `Pick a real path:\n    • Fully on-chain (SVG art):     --onchain-uri\n    • Hosted resolver:              --public-base-url https://your.domain`;
+                `Pick a real path:\n    • Fully on-chain (SVG content): --onchain-uri\n    • Hosted resolver:              --public-base-url https://your.domain`;
             if (!devAllow) {
                 if (dryRun)
                     warn(`would REFUSE to deploy — ${msg}`);
@@ -2109,22 +2196,126 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     const overrides = storageOverrides(flags);
     const opts = storageOptions(overrides);
     const backendId = overrides.backend ?? process.env.ABX_STORAGE_BACKEND ?? 'fs';
-    const backend = !onChainUri && !dryRun ? resolveBackend(opts) : undefined;
+    // Pattern 2 — image off-chain on a durable backend, JSON rendered on-chain, NOTHING to run. Ported
+    // from the 721 Series twin, which has had it all along; `EditionImage` shipped without it, so a
+    // multi-work RASTER edition had no no-server option at all and `--onchain-uri` just refused the
+    // content. That pushed a cold agent into deploying one contract PER work to get permanence (B28).
+    // Nothing on-chain needed changing: `EditionImageInitParams` already takes `contractFields`, and the
+    // renderer's `url-template` substitutes `{id}` from whatever id it is called with — `uri(id)` on a
+    // 1155 reaches it exactly as `tokenURI(id)` does on a 721.
+    const directUrlBackend = backendId === 'ipfs' || backendId === 'arweave' || backendId === 'cloud';
+    const offchainImageOnchainJson = onChainUri && !onchainImage && directUrlBackend;
+    const backend = (offchainImageOnchainJson || (!onChainUri && !onchainImage)) && !dryRun ? resolveBackend(opts) : undefined;
     const tokenPaths = slots.map((s, i) => ({ tokenId: i, name: s, path: joinPath(dirPath, s) }));
+    // The render-gas gate on the dry run. Unlike the 721 Series twin this lane has no per-id
+    // `previewImageStaging` line to hang it off, so without this an oversized edition would only be
+    // refused once `buildFields` reached the first real staging call — i.e. after the chunk store was
+    // already deployed. Same per-id predicate either way (`guardOnChainSize` runs again during staging).
+    if (onchainImage && dryRun) {
+        for (const { name, path } of tokenPaths)
+            guardOnChainSize(statSync(path).size, name, allowUnreadableOnchain(flags));
+    }
+    // Say WHICH backend holds the bytes, exactly as the 1/1 lane does. Both Series lanes resolved a
+    // backend and never named it, so a creator asking for "images on IPFS" had no way to confirm from
+    // the preview that their collection would actually pin there — the flag was accepted in silence.
+    if (!onchainImage && (offchainImageOnchainJson || !onChainUri)) {
+        const sr = backendResolution(overrides);
+        info(`storage: ${sr.backend} ${dim(`(${sr.source === 'flag' ? '--backend' : sr.source === 'env' ? 'env' : 'default'})`)} — byte custody for the image(s)`);
+        const gwWarn = localGatewayWarning(flags);
+        if (gwWarn)
+            warn(gwWarn);
+    }
     const seriesTraits = parseSeriesTraits(flags.attributes ? readFileSync(resolvePath(process.cwd(), flags.attributes), 'utf8') : undefined, slots);
     const seriesTraitsOnchain = seriesTraits.size > 0 && (!!flags['traits-onchain'] || onChainUri);
     const offChainTokenTraits = seriesTraits.size && !seriesTraitsOnchain
         ? JSON.stringify(Object.fromEntries([...seriesTraits].map(([id, a]) => [String(id), a])))
         : undefined;
+    // Wallet-signature count for THIS deploy — parity with the 721 Series twin, which prints it and
+    // whose count the skill promises "every preview" shows. Same per-id chunk math as that twin, so the
+    // preview, the confirm text, and the wallet session's `total` can never disagree.
+    const approvals = onchainImage
+        ? tokenPaths.reduce((n, { path }) => {
+            const plan = computeContentPlan(readFileSync(path), compress).plan;
+            return n + (plan.mode === 'single' ? 1 : plan.txCount);
+        }, 0) + 1 // + the deploy tx
+        : 1;
     const tokenFields = [];
-    const buildFields = async () => {
+    // Collection-scope fields the image lane may add (the O(1) `url-template`). Kept separate from the
+    // authorship fields and CONCATENATED at the params site — never assigned over them, or an
+    // `--creator`/`--license` value would silently vanish whenever pattern 2 is in play.
+    let imageContractFields = [];
+    const buildFields = async (stage) => {
+        // Pattern 1: the bytes themselves on-chain, staged into the shared chunk store per id, each id's
+        // field pointing at its manifest. Ported from the 721 Series twin — the edition lane refused this
+        // outright before (B28), though nothing on-chain prevented it.
+        if (onchainImage) {
+            const { fields } = await stageImageFieldsBatch(tokenPaths.map((s) => s.path), compress, stage, flags['chunk-store'], allowUnreadableOnchain(flags));
+            tokenPaths.forEach(({ tokenId }, i) => tokenFields.push(tokenFieldOf(tokenId, fields[i])));
+            if (seriesTraitsOnchain)
+                for (const [tokenId, attrs] of seriesTraits)
+                    tokenFields.push(tokenFieldOf(tokenId, attributesInlineField(attrs)));
+            info(`uri()/contractURI() resolve ON-CHAIN via the renderer — the image BYTES are on-chain too, nothing off-chain at all.`);
+            return;
+        }
+        // Pattern 2: one durable upload per id, then a locator on-chain instead of the bytes.
+        if (offchainImageOnchainJson) {
+            const exts = tokenPaths.map(({ path }) => extname(path).toLowerCase());
+            const uniform = exts[0] !== '' && exts.every((e) => e === exts[0]);
+            if (dryRun || !backend) {
+                if (uniform) {
+                    imageContractFields = [imageUrlTemplateField(`<${backendId}-dir>/{id}${exts[0]}`)];
+                    info(`would upload ${tokenPaths.length} file(s) as ONE ${backendId} directory → collection image url-template <${backendId}-dir>/{id}${exts[0]} (O(1))`);
+                }
+                else {
+                    for (const { tokenId } of tokenPaths)
+                        tokenFields.push(tokenFieldOf(tokenId, imageUrlField(`<${backendId}-url-${tokenId}>`)));
+                    info(`would upload ${tokenPaths.length} file(s) to ${backendId} → per-id url image fields (mixed extensions, O(N))`);
+                }
+            }
+            else if (uniform && backend.putDirectory) {
+                // O(1) directory-base: upload the folder renamed to {id}{ext}; ONE collection url-template.
+                const entries = tokenPaths.map(({ tokenId, path }) => ({ name: `${tokenId}${exts[0]}`, bytes: new Uint8Array(readFileSync(path)), contentType: contentTypeFromPath(path) }));
+                const { base } = await backend.putDirectory(entries);
+                const template = `${base}/{id}${exts[0]}`;
+                imageContractFields = [imageUrlTemplateField(template)];
+                info(`uploaded ${entries.length} file(s) as one ${backendId} directory`);
+                info(`collection image (url-template): ${template}  ${dim('— one field covers every id (O(1))')}`);
+            }
+            else {
+                // mixed extensions (or no directory support): per-id url fields (O(N)).
+                for (const { tokenId, name: fname, path } of tokenPaths) {
+                    const bytes = new Uint8Array(readFileSync(path));
+                    const hash = hashContent(bytes);
+                    await backend.put(hash, { bytes, contentType: contentTypeFromPath(path) });
+                    const locator = (await backend.locator?.(hash)) ?? '';
+                    if (!locator)
+                        throw new Error(`backend ${backendId} returned no public locator for id ${tokenId} — a durable backend (ipfs/arweave/cloud) is required for --onchain-uri image hosting`);
+                    tokenFields.push(tokenFieldOf(tokenId, imageUrlField(locator)));
+                    info(`id ${tokenId} ← ${fname} → ${locator}`);
+                }
+                info(`mixed file extensions → per-id url fields (O(N)); a uniform extension enables the O(1) directory template`);
+            }
+            if (seriesTraitsOnchain)
+                for (const [tokenId, attrs] of seriesTraits)
+                    tokenFields.push(tokenFieldOf(tokenId, attributesInlineField(attrs)));
+            info(`uri()/contractURI() resolve ON-CHAIN via the renderer — the image bytes live on ${backendId}, so there is still no server to run.`);
+            return;
+        }
         for (const { tokenId, name: fname, path } of tokenPaths) {
             const bytes = new Uint8Array(readFileSync(path));
             const contentType = contentTypeFromPath(path);
             if (onChainUri) {
                 const text = Buffer.from(bytes).toString('utf8');
                 if (!looksLikeSvg(text)) {
-                    throw new Error(`--onchain-uri inlines SVG only; id ${tokenId} "${fname}" is ${contentType}. Drop --onchain-uri for off-chain custody instead.`);
+                    // Name the real alternatives, the way the 721 twin's version of this refusal does — a bare
+                    // "drop --onchain-uri" once sent a cold agent fanning a 3-work edition out into THREE
+                    // separate contracts to find permanence. The `--backend` route is now the first suggestion
+                    // because it IS available on this lane (see `offchainImageOnchainJson` above).
+                    throw new Error(`--onchain-uri inlines SVG only; id ${tokenId} "${fname}" is ${contentType}. For raster content in ONE edition contract:\n` +
+                        `    • No server, images off-chain:  add --backend arweave (or ipfs/cloud) — the image URL is baked into the on-chain JSON\n` +
+                        `    • Host the metadata yourself:   drop --onchain-uri and pass --public-base-url https://your.domain\n` +
+                        `    • Keep it SVG:                  supply SVG content and --onchain-uri inlines every id on-chain\n` +
+                        `    • Bytes fully on-chain:         --onchain-image --compress fastlz (hot or --sign lane; --unsigned is refused)`);
                 }
                 tokenFields.push(tokenFieldOf(tokenId, imageInlineField(text)));
             }
@@ -2139,14 +2330,24 @@ export async function cmdDeployEditionImageBody(flags, emit) {
         if (seriesTraitsOnchain)
             for (const [tokenId, attrs] of seriesTraits)
                 tokenFields.push(tokenFieldOf(tokenId, attributesInlineField(attrs)));
+        // AFTER the per-id content actually validated — stating "resolves ON-CHAIN, no server" and then
+        // refusing the very content that was passed reads as the tool contradicting itself.
+        if (onChainUri) {
+            info(`uri()/contractURI() resolve ON-CHAIN via the renderer — no resolver, no server, no localhost.`);
+            if (!hasPublicUrl)
+                info('off-chain fallback pointer left empty (the renderer is authoritative); set --public-base-url to bake one anyway.');
+        }
     };
     if (!dryRun) {
         const custody = onChainUri ? 'inline SVG on-chain' : `off-chain custody (${backendId})`;
         await confirmSend(`About to deploy an edition series "${name}" (${symbol}) — ${count} id(s) × ${editionSize === 0n ? 'open' : editionSize.toString()} cop${editionSize === 1n ? 'y' : 'ies'} each; ${custody}; ` +
-            `mint: ${effectiveMintCount > 0 ? `${effectiveMintCount} id(s) × ${mintAmount} at deploy` : 'deferred'}; owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
+            `mint: ${effectiveMintCount > 0 ? `${effectiveMintCount} id(s) × ${mintAmount} at deploy` : 'deferred'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
             (transferValidator !== zeroAddress ? ` ERC-1155C: enrolled at deploy, permanently (validator ${transferValidator}).` : ''), flags);
     }
-    await buildFields();
+    // `--onchain-image` defers field-building to a lane branch below: the hot lane stages with the env
+    // key, the wallet lane inside its sign session. Every other custody mode can build up front.
+    if (!onchainImage)
+        await buildFields();
     const buildForDeployer = async (deployer) => {
         const salt = explicitSalt ?? saltFor(deployer);
         const clone = await predictClone(publicClient, { factory, salt });
@@ -2170,7 +2371,9 @@ export async function cmdDeployEditionImageBody(flags, emit) {
             mintCount: effectiveMintCount,
             mintAmount,
             tokenFields,
-            contractFields: authorshipContractFields(flags),
+            // Concatenate — the image lane's collection-scope url-template rides ALONGSIDE the authorship
+            // fields. Assigning either over the other would silently drop the creator's --creator/--license.
+            contractFields: [...authorshipContractFields(flags), ...imageContractFields],
         };
         return { clone, params, salt };
     };
@@ -2204,6 +2407,10 @@ export async function cmdDeployEditionImageBody(flags, emit) {
             info(`minter  ${minter}`);
         if (primaryPayee !== zeroAddress)
             info(`primary payee  ${primaryPayee}`);
+        // `paused` gates whether the public can mint at all — the 1/1-edition twin prints it and an
+        // edition sale is the point of the lane, so it belongs in the readout, not just in the params.
+        info(`paused  ${paused}${flags.unpaused ? '' : dim('  (default — pass --unpaused to open at deploy)')}`);
+        info(`approvals   ${approvals} wallet approval(s)`); // parity with the 721 Series twin
         if (!explicitSalt) {
             console.log(`\n  ${bold('salt')}  ${g(salt)}`);
             info(`address: pinned by salt — re-run with ${bold(`--salt ${salt}`)} (same address).`);
@@ -2214,6 +2421,9 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     }
     if (lane === 'send') {
         const { wallet, account } = makeWalletClient({ chainKey: CHAIN });
+        // hot lane: the env key stages every id up front (deployer-independent), then deploys.
+        if (onchainImage)
+            await buildFields(envStagingSender());
         const { clone: predicted, params, salt } = await buildForDeployer(account.address);
         info(`deterministic address: ${predicted}`);
         info(`mint: ${effectiveMintCount > 0 ? `${effectiveMintCount} id(s) × ${mintAmount} cop${mintAmount === 1n ? 'y' : 'ies'} → ${account.address} at deploy` : 'deferred'}`);
@@ -2224,6 +2434,35 @@ export async function cmdDeployEditionImageBody(flags, emit) {
         ok(`deployed ${clone}`);
         info(`tx ${explorerBase()}/tx/${r.txHash}  (block ${blockNumber})`);
     }
+    else if (lane === 'sign' && onchainImage) {
+        // Wallet lane + on-chain staging: ONE session signs every chunk write across all ids AND the
+        // deploy. The connecting wallet pays for (and owns) it; staging can't precede the connect, so it
+        // runs inside the session and the deploy then bakes in every id's manifest.
+        info(`a wallet will become the owner; it will approve ${approvals - 1} staging tx(s) + the deploy in one session.`);
+        const session = await openWalletSession({
+            chainKey: CHAIN,
+            expectedSigner: flags.for,
+            total: approvals, // the SAME staging-tx math the preview's `approvals` line reports
+            port: flags.port ? Number(flags.port) : undefined,
+            signUrlFile: flags['sign-url-file'],
+        });
+        let r;
+        try {
+            const signer = await session.connect();
+            await buildFields(sessionStagingSender(session));
+            const { clone: predicted, params, salt } = await buildForDeployer(signer);
+            info(`mint: ${effectiveMintCount > 0 ? `${effectiveMintCount} id(s) × ${mintAmount} cop${mintAmount === 1n ? 'y' : 'ies'} → ${signer} at deploy` : 'deferred'}`);
+            const sent = await session.send(prepareDeployEditionImage({ factory, params, salt, chainId: resolveChain(CHAIN).id, clone: predicted }));
+            r = { txHash: sent.txHash, blockNumber: sent.receipt.blockNumber };
+            clone = predicted;
+        }
+        finally {
+            session.close();
+        }
+        blockNumber = r.blockNumber;
+        ok(`deployed ${clone}`);
+        info(`tx ${explorerBase()}/tx/${r.txHash}  (block ${blockNumber})`);
+    }
     else {
         info(onChainUri ? 'a wallet will become the owner; the tokens resolve from chain — no URI base is baked in.' : `a wallet will become the owner; URIs point at ${baseUrl}`);
         const result = await signTx(async (signer) => {
@@ -2292,8 +2531,40 @@ export async function cmdDeployEditionImageBody(flags, emit) {
  *                      (`putDirectory`; ipfs/arweave), its root as the `code` field
  *
  * Schemas: --schema key:Type:Auth[,key:Type:Auth…] (e.g. palette:HexColor:TokenOwner).
- * Seeds: canonical randomizer by default; --no-seed opts out.
+ * Seeds: the canonical pseudorandom seed source by default; --no-seed opts out.
+ */
+/**
+ * The one honest sentence about the canonical seed, printed beside the `seed source` line in the
+ * deploy plan — the moment a creator is choosing it, not an appendix. `AbxSeedSource` is
+ * pseudorandom from on-chain values: replayable after the mint (what makes generative output
+ * verifiable) and computable *during* it, so a buyer can decline an outcome for the price of gas.
+ * That rules out anything lottery-like; the escape hatch is a per-project address, so we name it —
+ * and now name it as the FLAG it is (`--seed-source 0x…`), not as an env var, because the flag is
+ * probed and the whole point of naming an escape hatch is that a creator can actually reach it.
+ */
+const seedHonestyNote = '  pseudorandom — replayable after the mint, computable DURING it (a buyer can decline an outcome).\n' +
+    '      Right for diversifying output; NOT strong enough for a raffle or prize draw — for that, pass\n' +
+    '      --seed-source 0x… pointing at your own IAbxSeedSource over commit-reveal or a VRF oracle\n' +
+    '      (a per-project swap, not a fork). Change it later with `abx set-seed-source`.';
+/**
+ * The `seed source` line of a deploy plan, for both code lanes. Three states, three different
+ * sentences — the honesty note describes `AbxSeedSource`'s OWN properties, so printing it beside a
+ * stranger's contract would be us vouching for randomness we have never seen.
  */
+function printSeedSourcePlan(seedSource, chainId) {
+    if (seedSource === zeroAddress) {
+        info('seed source: none (--no-seed / not configured)');
+        return;
+    }
+    if (seedSource.toLowerCase() === canonicalSeedSource(chainId).toLowerCase()) {
+        info(`seed source: ${seedSource} ${dim('(canonical AbxSeedSource)')}`);
+        info(seedHonestyNote);
+        return;
+    }
+    info(`seed source: ${seedSource} ${dim('— CUSTOM (yours, not the canonical AbxSeedSource)')}`);
+    info('  probed: it answers seed(uint256,address) with 32 bytes. Its randomness properties are YOURS to\n' +
+        '      state to buyers — ABX makes no claim about them, and the honesty note above does not apply.');
+}
 // ── the demo walkthrough: teaching sections, demo-only ────────────────────────
 //
 // `abx demo` is a TEACHING command, not a shortcut — the docs point a first-time reader here to
@@ -2381,7 +2652,7 @@ export async function walkthroughRebuild(indexer, address, before) {
  * Which is genuinely a different act per lane, so it reads from the real source in each case rather
  * than always going through the local server:
  *   • fully on-chain → call `tokenURI(0)` on the contract. That IS what a marketplace does, and on
- *     this lane the whole answer (art included) comes back from the chain with nothing else running.
+ *     this lane the whole answer (content included) comes back from the chain with nothing else running.
  *   • off-chain custody → fetch the resolver, because that's what the baked URI points at.
  * Reading the on-chain lane over HTTP would have quietly implied the local server was load-bearing
  * when it isn't — the opposite of the lesson.
@@ -2408,9 +2679,9 @@ export async function walkthroughReadBack(state, baseUrl, onChainUri) {
                 const img = typeof parsed.image === 'string' ? parsed.image : '';
                 console.log(`    ${g('✓')} came back with: ${bold(String(parsed.name ?? '(no name)'))}`);
                 console.log(`      ${dim(`image: ${img.slice(0, 48)}${img.length > 48 ? '…' : ''}`)}`);
-                // The punchline of the whole lane: a data: URI means the art travelled IN the answer.
+                // The punchline of the whole lane: a data: URI means the work travelled IN the answer.
                 if (img.startsWith('data:'))
-                    info(`${g('the art itself came back in that answer')} ${dim('— no link to follow, nothing to go missing')}`);
+                    info(`${g('the work itself came back in that answer')} ${dim('— no link to follow, nothing to go missing')}`);
             }
             else {
                 console.log(`    ${dim(uri.slice(0, 160))}${uri.length > 160 ? dim('…') : ''}`);
@@ -2447,12 +2718,12 @@ export async function walkthroughReadBack(state, baseUrl, onChainUri) {
 export const DEPLOY_CODE_FLAGS = new Set([
     // content + collection identity
     'script', 'code-dir', 'name', 'symbol', 'description', 'external-url', 'description-onchain',
-    ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag), // artist · display-notes · artist-links · license
+    ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag), // creator · display-notes · creator-links · license
     'image-base', 'attributes-renderer', 'image-renderer',
     // supply + mint + economics
     'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
     // params + dependencies
-    'schema', 'no-seed', 'no-delegation', 'dep', 'dep-registry',
+    'schema', 'no-seed', 'seed-source', 'no-delegation', 'dep', 'dep-registry',
     // serving lane
     'public-base-url', 'onchain-uri', 'generator', 'renderer', 'port',
     // storage (directory mode) — mirrors storageOverrides()
@@ -2474,7 +2745,7 @@ export const SHARED_DEPLOY_FLAGS = [
 // A 1/1 `abx deploy` accepts these (see `abx help deploy`). Anything else warns (typo'd/unsupported).
 export const DEPLOY_FLAGS = new Set([
     'image', 'name', 'symbol', 'type', 'description', 'description-onchain', 'external-url', 'traits', 'traits-onchain', 'attributes',
-    'onchain-uri', 'onchain-image', 'compress', 'royalty-bps', 'no-mint',
+    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'royalty-bps', 'no-mint',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     ...SHARED_DEPLOY_FLAGS,
 ]);
@@ -2482,7 +2753,7 @@ export const DEPLOY_FLAGS = new Set([
 export const DEPLOY_SERIES_FLAGS = new Set([
     'dir', 'count', 'name', 'symbol', 'description', 'external-url', 'royalty-bps', 'attributes', 'traits-onchain',
     'no-mint', 'mint-all', 'mint-count', 'unpaused', 'minter', 'primary-payee',
-    'onchain-uri', 'onchain-image', 'compress', 'chunk-store',
+    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'chunk-store',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     ...SHARED_DEPLOY_FLAGS,
 ]);
@@ -2516,7 +2787,7 @@ export async function cmdDeployCodeBody(flags, emit) {
     const usage = 'abx deploy-code (--script <file> | --code-dir <dir>) --name "Title" --symbol SYM ' +
         '(--public-base-url https://your.resolver.domain | --onchain-uri) ' +
         '[--description "<s>"] [--external-url <url>] [--image-base <url> | --image-renderer 0x..] [--attributes-renderer 0x..] ' +
-        '[--max N] [--mint-count N | --mint-all] [--schema key:Type:Auth,…] [--no-seed] ' +
+        '[--max N] [--mint-count N | --mint-all] [--schema key:Type:Auth,…] [--no-seed | --seed-source 0x..] ' +
         '[--dep <name@version|0x..>[,…]] [--dep-registry 0x..] ' +
         '[--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--721c recommended|0x..] [--backend ipfs|arweave] [--dry-run] [--confirm] [--bootstrap-factory]';
     const scriptPath = flags.script;
@@ -2608,11 +2879,7 @@ export async function cmdDeployCodeBody(flags, emit) {
     else {
         factory = await ensureSeriesCodeFactory(publicClient, flags.factory, !!flags['bootstrap-factory']);
     }
-    const seedSource = flags['no-seed'] !== undefined
-        ? zeroAddress
-        : dryRun
-            ? (resolveSeedSource(chainId) ?? zeroAddress)
-            : await ensureSeedSource(publicClient);
+    const seedSource = await resolveSeedSourceFlag(flags, publicClient, dryRun, chainId);
     // --onchain-uri: resolve the two canonical singletons the lane points at. The generator is
     // per-chain infrastructure (constructor-wired to the dependency registry, the abx.js/gunzip
     // runtime pointers, and default gateways), so it is NEVER auto-deployed — a chain without one
@@ -2663,6 +2930,13 @@ export async function cmdDeployCodeBody(flags, emit) {
     // schemas: key:Type:Auth (comma-separated), Type carrying optional Select options / Range bounds
     // (Select[A|B|C], Uint256Range[0..100], …) → key, enum indices, bytes32 min/max, selectOptions.
     const schemas = parseSchemaSpecs(flags.schema);
+    // Say it where the decision is made, not in a doc the creator may never open: on an edition, a
+    // holder-writable param is SHARED by every holder of that id. See `editionSchemaAdvisory`.
+    if (flags.copies !== undefined) {
+        const advisory = editionSchemaAdvisory(schemas);
+        if (advisory)
+            warn(advisory);
+    }
     // Dependencies: ordered `--dep` refs (repeatable / comma-separable) — index 0 = the runtime,
     // by convention. `name@version` ⇒ Resolution.Registry (resolved through the soft registry
     // pointer); `0x…` ⇒ Resolution.OnChain (a raw data contract, no registry involved). The legs
@@ -2742,7 +3016,7 @@ export async function cmdDeployCodeBody(flags, emit) {
     }
     else {
         // Renderer-only (in-chain SVG): no program to chunk — the image/attributes are Solidity field
-        // renderers. Nothing rides SSTORE2; the whole artwork is computed on-chain per view.
+        // renderers. Nothing rides SSTORE2; the whole work is computed on-chain per view.
         contentSummary = 'no program — image + traits computed on-chain by Solidity field renderers';
         ok(contentSummary);
     }
@@ -2767,14 +3041,14 @@ export async function cmdDeployCodeBody(flags, emit) {
         contractFields.push({ field: encodeTag(F.externalUrl), representation: encodeTag(R.inline), value: toHex(String(flags['external-url'])) });
         identityFields.push('external_url');
     }
-    // authorship + rights — same on-chain inline collection-field slot (artist / license / …).
+    // authorship + rights — same on-chain inline collection-field slot (creator / license / …).
     contractFields.push(...authorshipContractFields(flags));
     for (const [flag, field] of AUTHORSHIP_DEPLOY_FIELDS)
         if (flags[flag])
             identityFields.push(field);
     // --image-renderer: bake the on-chain `image` field to a `renderer` representation — the SVG is
     // COMPUTED on-chain by a Solidity IAbxFieldRenderer (e.g. a SeedSvgRenderer fork) from the token's
-    // seed + params. THE in-chain-art lane: the marketplace still lives in tokenURI itself — no bucket,
+    // seed + params. THE in-chain-renderer lane: the marketplace still lives in tokenURI itself — no bucket,
     // no effect runner, no resolver. Mutually exclusive with --image-base (both set `image`). Verified
     // like --attributes-renderer: a real deploy REFUSES a codeless address; dry-run probes best-effort.
     if (flags['image-renderer']) {
@@ -2983,7 +3257,15 @@ export async function cmdDeployCodeBody(flags, emit) {
     // TOKENURI PUBLIC-READ GAS — a large --onchain-uri document assembles on-chain per call; an
     // unauthenticated public read (Etherscan "Read Contract" with no wallet connected) can hit a client
     // gas cap and appear to REVERT. Expected, not a bug — a real session mis-diagnosed it as indexing lag.
-    const tokenUriGasRisk = onChainUri && !codeDir && (scriptAnalysis?.doc.estBytes ?? 0) > 30_000;
+    //
+    // Same threshold as the staged-bytes gate (`ONCHAIN_READ_WARN_BYTES`), since it is the same measured
+    // cost: `tokenURI` string-building runs ~360-405k gas per KB of assembled document (superlinear — the
+    // rate climbs with size). This one only WARNS
+    // where the staged-bytes path refuses, and deliberately so: `estBytes` is an ESTIMATE (a dependency
+    // of unknown size is undercounted — see `unknownDepSizes`), and a registry-hosted library like p5 is
+    // legitimately ~200KB on its own, so the honest move is to name the cost and point at the piecewise
+    // getters rather than to block a shipped lane on a heuristic.
+    const tokenUriGasRisk = onChainUri && !codeDir && (scriptAnalysis?.doc.estBytes ?? 0) >= ONCHAIN_READ_WARN_BYTES;
     // --onchain-uri legs (ride the setup multicall, before the mints): the animation_url field
     // pointing at the generator, and the two URI renderers. The param surface needs NO leg — the
     // generator enumerates it from the token on-chain (`contractParamKeys`/`tokenParamKeys`, kept in
@@ -3071,7 +3353,7 @@ export async function cmdDeployCodeBody(flags, emit) {
         if (!flags.description)
             warn(`no --description — the on-chain metadata ships with no description (the one creators most often forget). Add --description "…" or deploy bare.`);
         info(`content: ${contentSummary}`);
-        info(`seed source: ${seedSource === zeroAddress ? 'none (--no-seed / not configured)' : seedSource}`);
+        printSeedSourcePlan(seedSource, chainId);
         info(`PostParam schema(s): ${schemaSummary}`);
         info(`dependencies: ${deps.length ? deps.map((d, i) => `[${i}] ${d.display}`).join(' · ') + ` — ${deps.length} setDependency leg(s)` : 'none'}` +
             (depRegistry ? ` + setDependencyRegistry → ${depRegistry}` : hasRegistryDeps ? ' (no registry pointer — see the warning above)' : ''));
@@ -3108,7 +3390,9 @@ export async function cmdDeployCodeBody(flags, emit) {
             else
                 info(`  ${dim('nothing to run — image + traits are on-chain; a resolver is neither needed nor a benefit here.')}`);
             if (tokenUriGasRisk) {
-                info(`  ${dim('public-read note:')} this ${Math.round((scriptAnalysis?.doc.estBytes ?? 0) / 1000)}KB doc assembles on-chain per call, so an ${bold('unauthenticated read on Etherscan')} ("Read Contract", no wallet connected) may hit its gas cap and appear to ${bold('REVERT')} — ${dim('EXPECTED, not a broken token and NOT an indexing issue. Verify with `abx tokenuri`, or connect a wallet / use a high-gas RPC. Do not run `abx index --full` to "fix" it.')}`);
+                const docKb = Math.round((scriptAnalysis?.doc.estBytes ?? 0) / 1024);
+                info(`  ${dim('public-read note:')} this ~${docKb}KB doc assembles on-chain per call — ${bold(`~${Math.round(tokenUriGasEstimate(scriptAnalysis?.doc.estBytes ?? 0) / 1_000_000)}M gas per tokenURI`)} at the measured ~360-405k gas/KB (climbing with size). An ${bold('unauthenticated read on Etherscan')} ("Read Contract", no wallet connected) may hit its gas cap and appear to ${bold('REVERT')} — ${dim('EXPECTED, not a broken token and NOT an indexing issue. Verify with `abx tokenuri`, or connect a wallet / use a high-gas RPC. Do not run `abx index --full` to "fix" it.')}`);
+                info(`  ${dim('these are OFF-CHAIN view reads by design:')} past a node\'s cap, a client assembles from the generator\'s piecewise getters instead of one call — ${dim('`document`, `tokenDataJson`, `dependencyTag`, `abxJs`, `gunzipScript`, `registryScriptChunk`. No contract can call tokenURI inside a transaction at this size; nothing on-chain depends on it.')}`);
             }
         }
         else {
@@ -3622,7 +3906,7 @@ export async function cmdDeployCodeBody(flags, emit) {
 //   • `--code-dir` (directory-build code drops) — not ported; use `--script`.
 //   • `--dep` / `--dep-registry` (declared code dependencies) — not ported; ship a self-contained
 //     script (the skill already recommends zero-dependency vanilla JS as the cleanest option).
-//   • `--image-renderer` / `--attributes-renderer` / `--image-base` (the in-chain-Solidity-art and
+//   • `--image-renderer` / `--attributes-renderer` / `--image-base` (the in-chain-Solidity-renderer and
 //     deterministic-off-chain-thumbnail lanes) — not ported.
 //   • `--no-delegation` — refused outright: EditionCode has no TokenOwner-leg delegation to opt out
 //     of (its auth leg generalizes to "any holder", per the parity plan's ConfigurableParams note).
@@ -3634,7 +3918,7 @@ export const DEPLOY_CODE_EDITION_FLAGS = new Set([
     'script', 'name', 'symbol', 'description', 'external-url', 'description-onchain',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     'max', 'mint-count', 'mint-all', 'no-mint', 'mint-amount', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
-    'schema', 'no-seed',
+    'schema', 'no-seed', 'seed-source',
     'public-base-url', 'onchain-uri', 'generator', 'renderer', 'port',
     'sign', 'unsigned', 'for', 'salt', 'factory', 'bootstrap-factory', 'sign-url-file',
     'dry-run', 'confirm', 'yes', 'json', 'copies',
@@ -3648,7 +3932,7 @@ export const DEPLOY_CODE_EDITION_FLAGS = new Set([
 export async function cmdDeployEditionCodeBody(flags, emit) {
     const usage = 'abx deploy-code --copies <n|open> --script <file> --name "Title" --symbol SYM (--public-base-url https://your.resolver.domain | --onchain-uri) ' +
         '[--description "<s>"] [--external-url <url>] [--max N] [--mint-count N | --mint-all] [--mint-amount N] ' +
-        '[--schema key:Type:Auth,…] [--no-seed] [--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--721c recommended|0x..]';
+        '[--schema key:Type:Auth,…] [--no-seed | --seed-source 0x..] [--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--721c recommended|0x..]';
     refuseStrayFlags(flags, DEPLOY_CODE_EDITION_FLAGS, 'deploy-code');
     warnSignWithoutFor(flags);
     const editionSize = parseCopies(flags.copies);
@@ -3657,10 +3941,6 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
     }
     if (!flags.script)
         throw new Error(usage);
-    if (flags.dep || flags['dep-registry']) {
-        throw new Error('--dep/--dep-registry are not yet supported for edition code deploys (--copies) — ship a self-contained script ' +
-            '(no external dependency declarations) for now, or drop --copies for the 721 lane. Tracked as a follow-up.');
-    }
     if (flags['image-renderer'] || flags['attributes-renderer'] || flags['image-base']) {
         throw new Error('--image-renderer/--attributes-renderer/--image-base are not yet supported for edition code deploys (--copies). Tracked as a follow-up.');
     }
@@ -3734,11 +4014,7 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
     else {
         factory = await ensureEditionCodeFactory(publicClient, flags.factory, !!flags['bootstrap-factory']);
     }
-    const seedSource = flags['no-seed'] !== undefined
-        ? zeroAddress
-        : dryRun
-            ? (resolveSeedSource(chainId) ?? zeroAddress)
-            : await ensureSeedSource(publicClient);
+    const seedSource = await resolveSeedSourceFlag(flags, publicClient, dryRun, chainId);
     let generator = zeroAddress;
     let metadataRenderer = zeroAddress;
     if (onChainUri) {
@@ -3763,6 +4039,50 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
             info('off-chain fallback pointer left empty (the renderer is authoritative); set --public-base-url to bake one anyway.');
     }
     const schemas = parseSchemaSpecs(flags.schema);
+    // Say it where the decision is made, not in a doc the creator may never open: on an edition, a
+    // holder-writable param is SHARED by every holder of that id. See `editionSchemaAdvisory`.
+    if (flags.copies !== undefined) {
+        const advisory = editionSchemaAdvisory(schemas);
+        if (advisory)
+            warn(advisory);
+    }
+    // Dependencies — same shape as the 721 SeriesCode twin (see its block for the full reasoning).
+    // `EditionCode` already inherits the `Dependencies` extension and calls `_initDependencies()`, and
+    // the legs are the same `setDependency`/`setDependencyRegistry` calls on the same ABI, so this was
+    // never a contract gap: only the CLI refused it (B28). It matters because "an edition of my p5
+    // sketch, with p5 coming from the chain" is a thing creators ask for directly, and the refusal sent
+    // them to the 721 lane (unique tokens) or to shipping a sketch whose library never loads.
+    const deps = parseDepFlag(flags.dep);
+    const hasRegistryDeps = deps.some((d) => d.resolution === DEP_RESOLUTION.registry);
+    const depPointer = hasRegistryDeps
+        ? resolveDepRegistryPointer(flags['dep-registry'], chainId)
+        : { registry: null, source: 'none' };
+    const depRegistry = depPointer.registry;
+    if (deps.length) {
+        step('Dependencies');
+        deps.forEach((d, i) => info(`[${i}] ${bold(d.display)} ${dim(d.resolution === DEP_RESOLUTION.registry ? '(registry name@version)' : '(on-chain data contract — read directly)')}${i === 0 ? dim(' · index 0 = the runtime') : ''}`));
+        if (hasRegistryDeps) {
+            if (depRegistry) {
+                info(`registry pointer → ${depRegistry} ${dim(depPointer.source === 'flag' ? '(--dep-registry)' : "(the chain's AB Dependency Registry — soft, non-validating)")}`);
+                const { checks, rpcOk } = await checkRegistryDeps(publicClient, depRegistry, deps);
+                for (const chk of checks) {
+                    if (chk.status === 'found') {
+                        ok(chk.details.availableOnChain
+                            ? `${chk.dep} — on registry; ON-CHAIN bytes available (${chk.details.scriptCount} chunk(s)) — chain-complete capable`
+                            : `${chk.dep} — on registry; served from CDN ${chk.details.preferredCDN || '(none listed)'} ${dim('— the normal production path, not a degradation')}`);
+                    }
+                    else if (chk.status === 'not-found') {
+                        warn(`${bold(chk.dep)} NOT FOUND on registry ${depRegistry} — the resolver won't resolve it from there. Deploy proceeds (you may intend a custom registry / a pending addition); double-check the exact name@version spelling.`);
+                    }
+                }
+                if (!rpcOk)
+                    info('registry check skipped (RPC unreachable) — the deploy does not depend on it.');
+            }
+            else {
+                warn('no dependency registry known for this chain — skipping the setDependencyRegistry leg (the pointer is SOFT; the resolver falls back to its built-in CDN map). Pass --dep-registry 0x… or run `abx set-dependency-registry` later.');
+            }
+        }
+    }
     step('Content');
     const scriptPath = flags.script;
     const source = readFileSync(resolvePath(scriptPath), 'utf8');
@@ -3823,6 +4143,10 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
                 args: [encodeTag(s.key), s.paramType, s.auth, s.authAddress, s.lockAfter, s.min, s.max, s.selectOptions],
             }));
         }
+        // Dependency legs, ordered (index 0 = the runtime) + the SOFT registry pointer when one resolved.
+        // Built by the SDK's shared `dependencySetupCalls` — the same function the 721 lane uses — so the
+        // two lanes can never encode `setDependency` differently.
+        calls.push(...dependencySetupCalls(deps, depRegistry));
         calls.push(...onchainUriLegs);
         // Reserve mints: one `mint(to, id, amount)` per premint id — the edition twin of the 721 lane's
         // N identical `mint(owner)` calls, one id finer (a specific amount of copies, not just "one").
@@ -3849,7 +4173,11 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
         }
         return { clone, txs };
     };
-    const approvals = 1 + (scriptChunks.length + schemas.length + onchainUriLegs.length + mintCount > 0 ? 1 : 0);
+    // deps ride the same single setup multicall as chunks/schemas/mints, so they don't add an approval —
+    // but they must be COUNTED in the "is there a setup multicall at all" test, or a deps-only project
+    // (a script with no schemas and no premints) would report 1 approval and send 2 transactions.
+    const depLegCount = dependencySetupCalls(deps, depRegistry).length;
+    const approvals = 1 + (scriptChunks.length + schemas.length + depLegCount + onchainUriLegs.length + mintCount > 0 ? 1 : 0);
     if (!dryRun) {
         await confirmSend(`About to deploy an edition code project "${name}" (${symbol}) — script ${bytes.length} bytes → ${scriptChunks.length} chunk(s); ` +
             `up to ${max} id(s) × ${editionSize === 0n ? 'open' : editionSize.toString()} cop${editionSize === 1n ? 'y' : 'ies'} each; ` +
@@ -3881,10 +4209,11 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
             info(`deterministic address: ${shownAddr}`);
         info(`name "${name}" · symbol ${symbol} · max ${max} id(s) · royalty ${royaltyBps / 100}%`);
         info(`content: script ${bytes.length} bytes → ${scriptChunks.length} on-chain chunk(s)`);
-        info(`seed source: ${seedSource === zeroAddress ? 'none (--no-seed / not configured)' : seedSource}`);
+        printSeedSourcePlan(seedSource, chainId);
         info(`PostParam schema(s): ${schemas.length ? schemas.map((s) => describeSchema(s)).join(', ') : 'none'}`);
         info(`mint: ${mintCount > 0 ? `${mintCount} id(s) × ${mintAmount} cop${mintAmount === 1n ? 'y' : 'ies'} → ${deployer ?? 'your wallet'} at deploy` : 'deferred (mint later / external minter)'}`);
         info(`transactions: 2 — deploy + setup multicall (script chunks${schemas.length ? ' + schemas' : ''}${onChainUri ? ' + on-chain URI wiring' : ''}${mintCount > 0 ? ' + reserve mints' : ''})`);
+        info(`approvals   ${approvals} wallet approval(s)`); // parity with the 721 code twin — it had this only in the --confirm sentence
         if (!explicitSalt && deployer) {
             console.log(`\n  ${bold('salt')}  ${g(salt)}`);
             info(`address: pinned by salt — re-run with ${bold(`--salt ${salt}`)} (same address).`);
@@ -3974,26 +4303,28 @@ export async function resolveTransferValidatorFlag(flags, publicClient, dryRun,
         return zeroAddress;
     const chainId = resolveChain(CHAIN).id;
     const validator = parseTransferValidatorValue(raw, { chainId, chainLabel: CHAIN });
-    // Has-code precheck — for the recommended constant too (presence on THIS chain is the fact that
-    // matters; a sandbox/private chain won't have it). A dry run tolerates an unreachable RPC (it
-    // sends nothing); a real deploy refuses to enroll blind.
-    let code;
-    try {
-        code = await publicClient.getCode({ address: validator });
-    }
-    catch (err) {
+    // Usability precheck — for the recommended constant too (presence on THIS chain is the fact that
+    // matters; a sandbox/private chain won't have it). This asks the same question the factory asks:
+    // has code AND is not a permissive fallback that would enforce nothing (a Safe, an uninitialised
+    // proxy, a 7702-delegated EOA all pass a bare has-code check and then wave every transfer
+    // through). A dry run tolerates an unreachable RPC (it sends nothing); a real deploy refuses to
+    // enroll blind.
+    const probe = await probeTransferValidator(publicClient, validator);
+    if (probe.verdict === 'unreachable') {
         if (!dryRun)
-            throw new Error(`--721c: couldn't verify the validator has code at ${validator} (${err.message}) — refusing to enroll blind; retry when the RPC answers.`);
-        code = null; // offline preview — note it below
-    }
-    if (code === null) {
-        info(dim(`--721c: RPC unreachable, so the validator code check is deferred — a real deploy verifies ${validator} has code first.`));
+            throw new Error(`--721c: couldn't verify the validator at ${validator} (${probe.error ?? 'RPC did not answer'}) — refusing to enroll blind; retry when the RPC answers.`);
+        info(dim(`--721c: RPC unreachable, so the validator check is deferred — a real deploy verifies ${validator} is a usable validator first.`));
     }
-    else if (!code || code === '0x') {
+    else if (probe.verdict !== 'ok') {
         const rec = resolveRecommendedTransferValidator(chainId);
-        throw new Error(`--721c: no contract code at ${validator} on ${CHAIN} — the deploy would revert InvalidTransferValidator(). ` +
-            `A transfer validator must be a DEPLOYED contract on this chain` +
-            (rec && rec !== validator ? ` (the known-good one: --721c recommended → ${rec})` : '') + `.`);
+        const recHint = rec && rec !== validator ? ` (the known-good one: --721c recommended → ${rec})` : '';
+        throw new Error(probe.verdict === 'no-code'
+            ? `--721c: no contract code at ${validator} on ${CHAIN} — the deploy would revert InvalidTransferValidator(). ` +
+                `A transfer validator must be a DEPLOYED contract on this chain${recHint}.`
+            : `--721c: ${validator} has code on ${CHAIN}, but it is not a transfer validator — it answers ANY function call ` +
+                `successfully (a Safe, an uninitialised proxy, or a 7702-delegated EOA does this), so every transfer would ` +
+                `silently pass validation while ERC-165 and getTransferValidator() reported enforcement as ON. The factory ` +
+                `refuses it too (InvalidTransferValidator()). Pass a real validator contract${recHint}, or drop --721c.`);
     }
     // The one plain statement — printed once, only when enrolling. Never appears un-enrolled.
     info(validator === resolveRecommendedTransferValidator(chainId)
@@ -4001,4 +4332,79 @@ export async function resolveTransferValidatorFlag(flags, publicClient, dryRun,
         : `ERC-${standard}: every non-mint transfer is checked by validator ${validator} — its policy decides which operators may transfer. Manage with \`abx set-transfer-validator\`.`);
     return validator;
 }
+/**
+ * Resolve the three-way seed decision into the InitParams `seedSource`, for both code lanes:
+ *
+ *   - `--no-seed`               → `zeroAddress`. No mint-time seed at all.
+ *   - nothing, or `canonical`   → the canonical `AbxSeedSource` via `ensureSeedSource` (manifest →
+ *                                 self-heal to the deterministic address → CREATE2-deploy it). This
+ *                                 is today's behaviour, byte-for-byte, and stays the default.
+ *   - `--seed-source 0x…`       → the creator's own `IAbxSeedSource`, **probed first**.
+ *
+ * The flag exists because we tell creators, in the docs and in this command's own help, that the fix
+ * for "the canonical seed isn't strong enough for my raffle" is to point `seedSource` at a
+ * commit-reveal / VRF-backed source of their own. Until now the only route was an `ABX_SEED_SOURCE`
+ * env var checked for nothing but code length, which made a first-class promise out of a
+ * side entrance.
+ *
+ * **Everything that isn't the canonical singleton gets probed**, including an address that arrived
+ * via `ABX_SEED_SOURCE` — so the env lane keeps working and stops being the unchecked one. The
+ * comparison is against the deterministic canonical address rather than "did a flag say so", because
+ * that is the actual question (is this our audited bytecode, or someone's contract we know nothing
+ * about?). A dry run tolerates an unreachable RPC and says the check is deferred; a real deploy
+ * refuses to bake a seed source it couldn't verify.
+ *
+ * The probe here runs with **no `from`**, unlike the owner op's (which calls as the token). That is
+ * not an oversight: the clone's address is a function of the CREATE2 salt, which isn't reserved yet
+ * at this point, so a source that gates on `msg.sender` could not have been told about this token in
+ * the first place. A gated/commit-reveal source is a deploy-then-`abx set-seed-source` flow by
+ * construction, and the `reverted` refusal says exactly that.
+ */
+export async function resolveSeedSourceFlag(flags, publicClient, dryRun, chainId) {
+    const raw = flags['seed-source'];
+    // `--resume` finishes an EXISTING contract, and the seed source is an InitParams field — fixed at
+    // creation, never in the setup multicall this replays. So there is nothing here to resolve, probe,
+    // or (worse) lazily DEPLOY. Not a refusal: `--resume`'s own contract is "pass the same content
+    // flags", so the creator's original command legitimately still carries `--no-seed`/`--seed-source`.
+    // Say plainly that it's read from chain, and name the verb that can actually change it.
+    if (flags.resume !== undefined) {
+        if (raw !== undefined || flags['no-seed'] !== undefined) {
+            info(dim(`--resume: the seed source was fixed when ${flags.resume} was created, so ${raw !== undefined ? '--seed-source' : '--no-seed'} has nothing to write here ` +
+                `(it isn't part of the setup transaction being replayed). Read it with \`abx state\`; change it with \`abx set-seed-source\`.`));
+        }
+        return zeroAddress; // unused by the resume legs
+    }
+    if (flags['no-seed'] !== undefined) {
+        // Two flags, one field. Refuse rather than pick a winner — a creator who passed both has a
+        // belief about the outcome, and either answer betrays half of them.
+        if (raw !== undefined) {
+            throw new Error('--no-seed and --seed-source contradict each other: one says "no mint-time seed at all", the other names where the seed comes from. Drop one.');
+        }
+        return zeroAddress;
+    }
+    const canonical = canonicalSeedSource(chainId);
+    const requested = raw === undefined ? canonical : parseSeedSourceValue(raw, { chainId });
+    // The canonical singleton keeps its existing bootstrap path (deploy it if this chain lacks one).
+    // Anything else must already exist — we never deploy a stranger's contract.
+    const same = (a, b) => a.toLowerCase() === b.toLowerCase();
+    let seedSource;
+    if (same(requested, canonical)) {
+        seedSource = dryRun ? (resolveSeedSource(chainId) ?? zeroAddress) : await ensureSeedSource(publicClient);
+    }
+    else {
+        seedSource = requested;
+    }
+    if (seedSource === zeroAddress || same(seedSource, canonical))
+        return seedSource;
+    // Custom source (flag or ABX_SEED_SOURCE) — ask it the question the mint will ask.
+    const probe = await probeSeedSource(publicClient, seedSource);
+    if (probe.verdict === 'unreachable' && dryRun) {
+        info(dim(`--seed-source: RPC unreachable, so the seed-source probe is deferred — a real deploy verifies ${seedSource} answers seed(uint256,address) with 32 bytes first.`));
+        return seedSource;
+    }
+    if (probe.verdict !== 'ok')
+        refuseUnusableSeedSource(probe, { flag: raw === undefined ? 'ABX_SEED_SOURCE' : '--seed-source', chainLabel: CHAIN });
+    info(`seed source: CUSTOM ${seedSource} ${dim('— answers seed(uint256,address) with 32 bytes (probed). Its randomness properties are yours to state to buyers; ABX makes no claim about them.')}`);
+    return seedSource;
+}
 //# sourceMappingURL=deploy.js.map