@artblocks/abx-cli 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/main.js

@@ -14,7 +14,7 @@
  *   abx demo                 deploy a 1/1 to Sepolia, index it, and serve it
  *   abx deploy [--image ..]  deploy + index a 1/1 (--image to custody your own bytes; --no-mint to defer)
  *                            --copies <n|open> routes to the ERC-1155 edition twin instead — copies of the
- *                            SAME artwork (an open edition, with --copies open, is the flagship edition product)
+ *                            SAME work (an open edition, with --copies open, is the flagship edition product)
  *   abx deploy-series        a multi-token image Series from a folder of media; --copies <n|open> makes it
  *                            an edition (N ids from the folder × copies each) — see `abx help deploy-series`
  *   abx predict [--salt ..]  pre-compute a deploy address (reserve / vanity it before signing); --copies-aware
@@ -32,7 +32,8 @@
  *                            never hand-build a resolver path)
  *   abx tokens <address>     every token's owner + seed + params, from chain alone (--json for the machine
  *                            path); on an edition, supply/maxSupply per id instead of an owner
- *   abx configure-param <addr> <id> <key> <value>  set a governed PostParam (typed encode; any lane)
+   *   abx configure-param <addr> <id> <key> <value>  set a governed PostParam (typed encode; any lane)
+   *   abx submit-app <collection>  list a deployed ABX collection in the App Store (optional, after deploy)
  *   abx set-param-hooks <addr>  wire/clear a SeriesCode's configure/augment/transfer param hooks
  *   abx render <addr> [id…]  effect-runner repair lane: render missing stills/traits
  *                            (enqueues via ABX_EFFECTS_URL when a runner is up, else inline)
@@ -41,7 +42,7 @@
  *                            (required unless a 1/1-edition) + --amount (copies of that id, default 1)
  *   abx set-max-supply <addr>  edition-only: lower ONE id's ERC-1155 supply cap (the per-id twin of
  *                            set-max-invocations) — --token-id <n> --cap <n> (never "open"; caps only decrease)
- *   abx ping-uri <addr>      edition-only, permissionless: re-emit the native URI event for --token-ids
+ *   abx ping-uri <addr>      edition-only, owner-only: re-emit the native URI event for --token-ids
  *                            <csv|range> after a re-point, so URI-only indexers/marketplaces re-index
  *   abx refresh <addr>       ask marketplaces to (re)index a token's metadata
  *   abx transfer <addr>      sell/transfer a token  ·  set-admin: hand over contract ownership
@@ -74,12 +75,13 @@ import { cmdContractUri, cmdInspect, cmdPreview, cmdRender, cmdTokenUri, cmdToke
 import { cmdStorage } from './commands/storage.js';
 import { cmdDeployEffects, cmdDeployResolver, cmdEffects, cmdMigrate, cmdRemote, cmdServe, } from './commands/service.js';
 import { cmdDoctor, cmdMintPage, cmdScaffoldRenderer, cmdSkill } from './commands/scaffold.js';
+import { cmdSubmitApp } from './commands/submit-app.js';
 import { CHAIN } from './config.js';
 import { CliError } from './errors.js';
 import { allowlistFor } from './flag-allowlists.js';
 import { parseFlags, positionalArgs, warnStrayFlags } from './flags.js';
 import { bold, c, dim, ensureRenderer, g } from './output.js';
-import { cmdAttach, cmdConfigureParam, cmdLockDependencies, cmdLockField, cmdLockUri, cmdMint, cmdMinterBuy, cmdMinterConfigure, cmdMinterShow, cmdPause, cmdPingUri, cmdRefresh, cmdRemoveLastDependency, cmdRetireParam, cmdSetAdmin, cmdSetContractUri, cmdSetDependency, cmdSetDependencyRegistry, cmdSetField, cmdSetMaxInvocations, cmdSetMaxSupply, cmdSetMinter, cmdSetParamHooks, cmdSetPrimaryPayee, cmdSetRenderer, cmdSetRoyalty, cmdSetSchema, cmdSetTokenUri, cmdSetTransferValidator, cmdTransfer, cmdUnpause, } from './ownerops.js';
+import { cmdAttach, cmdConfigureParam, cmdLockDependencies, cmdLockParamHooks, cmdLockScript, cmdLockField, cmdLockUri, cmdMint, cmdMinterBuy, cmdMinterConfigure, cmdMinterShow, cmdPause, cmdPingUri, cmdRefresh, cmdRemoveLastDependency, cmdRetireParam, cmdSetAdmin, cmdSetContractUri, cmdSetDependency, cmdSetDependencyRegistry, cmdSetField, cmdSetMaxInvocations, cmdSetMaxSupply, cmdSetMinter, cmdSetParamHooks, cmdSetPrimaryPayee, cmdSetRenderer, cmdSetRoyalty, cmdSetSchema, cmdSetTokenUri, cmdSetTransferValidator, cmdSetSeedSource, cmdTransfer, cmdUnpause, } from './ownerops.js';
 import { DEFAULT_PREVIEW_PORT } from './preview.js';
 import { checkForCliUpdate, compareVersions, installedSkillCopies, readCliVersion, skillRefreshCommands } from './update-check.js';
 /**
@@ -214,6 +216,7 @@ async function main() {
         case 'serve': return cmdServe(flags);
         // owner operations — write + sign (hot/wallet/cold lane), then re-index
         case 'mint': return cmdMint(rest[0], flags);
+        case 'submit-app': return cmdSubmitApp(rest[0], flags);
         case 'set-minter': return cmdSetMinter(rest[0], flags);
         case 'set-max-invocations': return cmdSetMaxInvocations(rest[0], flags);
         case 'set-max-supply': return cmdSetMaxSupply(rest[0], flags);
@@ -226,6 +229,8 @@ async function main() {
         case 'remove-last-dependency': return cmdRemoveLastDependency(rest[0], flags);
         case 'set-dependency-registry': return cmdSetDependencyRegistry(rest[0], rest.slice(1), flags);
         case 'lock-dependencies': return cmdLockDependencies(rest[0], flags);
+        case 'lock-script': return cmdLockScript(rest[0], flags);
+        case 'lock-param-hooks': return cmdLockParamHooks(rest[0], flags);
         case 'set-primary-payee': return cmdSetPrimaryPayee(rest[0], flags);
         case 'minter': return cmdMinter(rest);
         case 'pause': return cmdPause(rest[0], flags);
@@ -239,6 +244,7 @@ async function main() {
         case 'mint-page': return cmdMintPage(rest[0], flags);
         case 'set-royalty': return cmdSetRoyalty(rest[0], flags);
         case 'set-transfer-validator': return cmdSetTransferValidator(rest[0], rest.slice(1), flags);
+        case 'set-seed-source': return cmdSetSeedSource(rest[0], rest.slice(1), flags);
         case 'set-field': return cmdSetField(rest[0], flags);
         case 'attach': return cmdAttach(rest, flags);
         case 'lock-field': return cmdLockField(rest[0], flags);
@@ -308,17 +314,24 @@ const COMMAND_HELP = {
     ${dim('cross-agent installer also works (not version-locked):')} ${g('npx skills add ArtBlocks/abx --skill abx-self-host')}`,
     deploy: `
   ${bold('abx deploy')} ${dim('— deploy + index a 1/1 (no server). Sends a tx in the chosen lane.')}
-    --image <path>        custody your own image (png · jpg · gif · svg · webp); else generative demo art
+    --image <path>        custody your own image (png · jpg · gif · svg · webp); else generative demo content
     --name <s> --symbol <s>   ERC-721 identity
     --description "<s>"   the creator's words, served in token metadata   --external-url <url>
     --description-onchain   store the description ON-CHAIN (durable, reconstructable from chain alone)
-    --artist "<s>" · --license "<s>"   authorship + rights, ON-CHAIN collection fields served in contractURI (also --display-notes, --artist-links)
+    --creator "<s>" · --license "<s>"   authorship + rights, ON-CHAIN collection fields served in contractURI (also --display-notes, --creator-links)
     --traits "K=V; K2=V2"   real OpenSea traits (the marketplace trait array)   --attributes <file.json>   (array or {name: value} map)
     --traits-onchain        store traits ON-CHAIN (inline JSON, lockable); else off-chain operator metadata (editable via ${g('abx add --traits')})
     ${g('--onchain-uri')}         resolve tokenURI/contractURI FULLY ON-CHAIN (renderer assembles JSON from fields;
                             image inlined as SVG, description on-chain) — the token self-resolves, no server needed
     ${g('--onchain-image')}       stage ${g('--image')} bytes on-chain (chunk store) and bake a reader field INTO the deploy —
-                            large content with NO post-deploy tx (implies --onchain-uri)
+                            content with NO post-deploy tx (implies --onchain-uri)
+                            ${dim('READ COST decides the ceiling, not storage: tokenURI reassembles the whole document per call at')}
+                            ${dim('~360-405k gas/KB of on-chain content, climbing with size (same for inline and reader). Under')}
+                            ${dim('~40KB reads routinely (~15M gas); 40-100KB needs a high-gas RPC (warned); past ~100KB (~40M) it is')}
+                            ${dim('refused — a margin below the ~120KB where geth\'s own 50M cap runs out, since hosts cap lower (')}
+                            ${dim('override with --allow-unreadable-onchain).')}
+    ${g('--allow-unreadable-onchain')}   ship on-chain content past ~100KB anyway. You accept that ordinary RPC tooling —
+                            ${dim('marketplaces, indexers, other contracts — sees a revert instead of your token, and rendering needs a high-gas endpoint.')}
     ${g('--compress')} none|fastlz|gzip   for --onchain-image (default none): ${g('fastlz')} = on-chain decode (stays renderable);
                             ${g('gzip')} = smaller but off-chain decode only
     --royalty-bps <0-10000>   default 500 (5%)
@@ -326,6 +339,8 @@ const COMMAND_HELP = {
                             (${g('recommended')} = OpenSea's validator for creator-fee enforcement — only owner-initiated
                             transfers + authorized sales move the token). Absent = plain ERC-721, forever (the default).
                             Manage later with ${g('abx set-transfer-validator')} (re-point or suspend; never un-enroll).
+                            ${dim('A validator must be a deployed contract that REFUSES calls it does not implement — a Safe or a bare')}
+                            ${dim('proxy is refused before any gas, since it would enforce nothing while every read said enforcement was ON.')}
     ${g('--no-mint')}             deploy without minting (warm the resolver, then ${g('abx mint')})
     --salt 0x..<64hex>    deploy to a reserved / vanity address (see ${g('abx predict')})
     --public-base-url <url>   bake a public resolver URL on-chain (off-chain custody REQUIRES a public URL; localhost is refused)
@@ -338,7 +353,7 @@ const COMMAND_HELP = {
                             ${dim('(needs a deployer to compute anything address-dependent — pass --for 0x.. if no signing key is set)')}
                             ${dim('address only prints WITH --salt (it is the only thing that pins it) — without --salt this shows the salt + how to pin it, or use `abx predict`.')}
     ${g('--confirm')}             interactive y/N gate before the real send (opt-in; --yes or non-TTY proceeds)
-    ${bold(g('--copies <n|open>'))}     ${dim('routes to the ERC-1155 edition twin (OneOfOneEdition) — copies of the SAME artwork, not a unique token.')}
+    ${bold(g('--copies <n|open>'))}     ${dim('routes to the ERC-1155 edition twin (OneOfOneEdition) — copies of the SAME work, not a unique token.')}
                             ${g('open')} = an uncapped OPEN EDITION (the flagship edition product) · a number = that many copies max.
                             ${g('--copies 1')} is legal (a single-copy edition) but almost never what you want — drop --copies for the plain 721 lane instead.
                             Adds: ${g('--mint-amount <n>')} (copies of #0 to premint at deploy; default 1, 0 ≡ --no-mint) ·
@@ -352,14 +367,16 @@ const COMMAND_HELP = {
     --dir <folder>        media directory; files sort → token ids 0,1,2,… (metadata = token id)
     --count <n>           deploy fewer than the folder holds (default: all files)   --name <s> --symbol <s> --royalty-bps
     mint timing: ${g('--mint-all')} (mint every token at deploy) · ${g('--mint-count')} N (first N) · ${g('--no-mint')} (defer)
-    ${bold('image custody')} — how the artwork is stored + resolved:
-      ${g('--onchain-image')} [--compress fastlz]   bytes ON-CHAIN (chunk store) — tiny art only (~200 gas/byte)
+    ${bold('image custody')} — how the work is stored + resolved:
+      ${g('--onchain-image')} [--compress fastlz]   bytes ON-CHAIN (chunk store) — small content (~200 gas/byte to write, and
+                            ${dim('~360-405k gas/KB per tokenURI to READ, climbing with size: under ~40KB/token reads routinely, past ~100KB refused —')}
+                            ${dim('override with')} ${g('--allow-unreadable-onchain')}${dim('. The gate is per token; a big collection of small files reads fine.)')}
       ${g('--onchain-uri --backend arweave|ipfs|cloud')}   image OFF-CHAIN, JSON on-chain via the renderer — ${bold('NO server')};
                             same-extension folders upload as ONE directory/manifest → a single collection url-template (O(1)).
                             ${dim('cloud/S3 also needs --public-base <bucket-or-cdn-url>')}
       --public-base-url <url>   hosted resolver (off-chain custody; you run a node) — for mutable metadata
     --description "<s>" · --external-url <url>   collection identity, served in the metadata (set them or the description is boilerplate)
-    --artist "<s>" · --license "<s>"   authorship + rights, ON-CHAIN collection fields served in contractURI (also --display-notes, --artist-links)
+    --creator "<s>" · --license "<s>"   authorship + rights, ON-CHAIN collection fields served in contractURI (also --display-notes, --creator-links)
     ${g('--attributes <file.json>')}   ${bold('per-token marketplace traits')} (written ON-CHAIN): a JSON ARRAY indexed by token id, OR an OBJECT
                           keyed by filename / token id — each value an attributes array or a ${dim('{name: value}')} map. Small/medium series;
                           a huge collection should set traits post-deploy via ${g('abx set-field')} under a gas budget.
@@ -394,7 +411,7 @@ const COMMAND_HELP = {
     seed, so what you iterate on is what deploys. Routes: ${g('/')} studio (seed + params + live traits) · ${g('/grid')} N seeds at once,
     all live · ${g('/view')} the bare document. The program is re-read from disk per render, so ${bold('edit and refresh')} — no watcher.
     Unlike a still-image sweep this shows ${bold('animation')}, which is most of what a screenshot throws away.
-    ${dim('Still do both after the art settles:')} ${g('abx inspect')} ${dim('(is it wired right?) and a testnet deploy (the faithful end-to-end).')}
+    ${dim('Still do both after the work settles:')} ${g('abx inspect')} ${dim('(is it wired right?) and a testnet deploy (the faithful end-to-end).')}
       ${g('abx preview')} --script art.js --schema palette:HexColor:TokenOwner
       ${g('abx preview')} --script art.js --shoot ./frames --count 12`,
     inspect: `
@@ -406,7 +423,7 @@ const COMMAND_HELP = {
     Ends with a recommended lane (fully-on-chain / resolver / directory). Run it BEFORE ${g('abx deploy-code')} to derive the
     lane instead of guessing. Deep dive: docs/research/onchain-traits-feasibility.md`,
     'scaffold-renderer': `
-  ${bold('abx scaffold-renderer')} [<dir>] ${dim('— write a buildable Foundry project for the in-chain Solidity art lane (default dir: ./my-renderer). No tx.')}
+  ${bold('abx scaffold-renderer')} [<dir>] ${dim('— write a buildable Foundry project for the in-chain Solidity renderer lane (default dir: ./my-renderer). No tx.')}
     Writes: ${g('src/MyRenderer.sol')} (an ${bold('image')} renderer — a seed → SVG, tinted by a ${g('palette')} HexColor PostParam), ${g('src/MyTraits.sol')}
     (an ${bold('attributes')} renderer reading the SAME seed math, so image + traits agree), the two ABX interfaces you implement/read
     (${g('src/interfaces/')} — read ${bold('IAbxFieldRenderer.sol')} for the five invariants, above all ${bold('never revert')}), a ${g('forge test')} proving
@@ -443,11 +460,11 @@ const COMMAND_HELP = {
                           ${g('key:Type:Address(0x…)')} (a CONTRACT may hold it: the controller pattern for open participation).
                           Append ${g(':lock=<when>')} (ISO date, unix seconds, or ${g('now')}) to freeze the value after that time.
                           ${dim('repeatable OR comma-separable (like --dep): ')}${g('--schema a --schema b')}${dim(' ≡ ')}${g('--schema a,b')}
-                          Type ∈ Bool·Select·Uint256Range·Int256Range·DecimalRange·HexColor·Timestamp·String·Bytes; Auth ∈ Artist·TokenOwner·Address (+ Or-combos).
+                          Type ∈ Bool·Select·Uint256Range·Int256Range·DecimalRange·HexColor·Timestamp·String·Bytes; Auth ∈ Creator·TokenOwner·Address (+ Or-combos).
                           ${bold('a Select declares its options')}: ${g('mood:Select[Calm|Wild|Chaotic]:TokenOwner')}; ${bold('a Range takes bounds')}: ${g('density:Uint256Range[0..100]:TokenOwner')} (Int/Decimal/Timestamp too; bounds optional)
     --description "<s>" · --external-url <url>   collection identity, written as ON-CHAIN collection fields in the deploy tx
-    --artist "<s>" · --license "<s>"   authorship + rights, ON-CHAIN collection fields served in contractURI (also --display-notes, --artist-links)
-    ${g('--image-renderer 0x..')}   THE in-chain-art lane: bake the on-chain ${g('image')} to a Solidity IAbxFieldRenderer → the SVG is COMPUTED
+    --creator "<s>" · --license "<s>"   authorship + rights, ON-CHAIN collection fields served in contractURI (also --display-notes, --creator-links)
+    ${g('--image-renderer 0x..')}   THE in-chain-renderer lane: bake the on-chain ${g('image')} to a Solidity IAbxFieldRenderer → the SVG is COMPUTED
                           on-chain from the token's seed + params (fork ${g('SeedSvgRenderer.sol')}). No ${g('--script')} needed; no bucket, no runner, no
                           resolver — the marketplace still lives in ${g('tokenURI')} itself. Mutually exclusive with ${g('--image-base')} (both set ${g('image')}).
     ${g('--image-base <url>')}    bake the on-chain ${g('image')} as a url-template (${g('{base}/{id}.png')}) — the marketplace thumbnail lives OFF-CHAIN at a
@@ -462,7 +479,15 @@ const COMMAND_HELP = {
                           none known → warned + skipped — never blocks). Registry deps are existence-checked before deploy (best-effort;
                           a CDN-served record is the normal production path, on-chain bytes are the durability floor).
     --max N               supply cap (default 16)   mint timing: ${g('--mint-all')} · ${g('--mint-count')} N · (default: defer, then ${g('abx mint')})
-    --no-seed             opt out of the canonical mint-time seed (seeds settle once assigned; curated pre-set seeds win)
+    --no-seed             opt out of a mint-time seed entirely (seeds settle once assigned; curated pre-set seeds win)
+    ${g('--seed-source 0x..')}    WHERE the mint seed comes from. Default (omit it) = the canonical ${bold('AbxSeedSource')} we deploy;
+                          ${g('canonical')} says that out loud. Pass an address for ${bold('your own IAbxSeedSource')} — commit-reveal, a VRF
+                          oracle, a curated queue. ${bold('Probed before any gas')}: it must answer ${g('seed(uint256,address)')} with 32 bytes,
+                          else the deploy is refused (a bad source is silent until the first buyer, then every mint reverts).
+                          ${dim('the canonical seed is PSEUDORANDOM — replayable after the mint, and computable DURING it (a buyer can decline an')}
+                          ${dim('outcome; on an edition, where the BUYER names the id and the id feeds the seed, they can also shop the unminted')}
+                          ${dim('ids): right for diversifying output, NOT strong enough for a raffle or prize draw. Need that? that is what')}
+                          ${dim('--seed-source is for. Change it later with ')}${g('abx set-seed-source')}${dim(' (future mints only).')}
     ${g('--721c')} [recommended|0x..]   opt-in ERC-721C: enroll at deploy, PERMANENTLY, with that transfer validator (absent = plain
                           ERC-721 forever). ${g('recommended')} = OpenSea's creator-fee-enforcement validator. Manage: ${g('abx set-transfer-validator')}
     --backend ipfs|arweave   directory-mode custody for the build upload   ${g('--unpaused')} · --minter 0x.. · --primary-payee 0x..
@@ -486,7 +511,7 @@ const COMMAND_HELP = {
     Renders each ${bold('minted')} token whose still is missing at the CURRENT inputsHash (a param change re-addresses it → a plain render fills it in).
     No tokenId → sweeps all minted tokens; pass ids (${g('0 1 2')}) to target specific tokens.
     ${g('--force')}               RE-RENDER even when the still already exists — the fix for a bad / blank / timed-out capture
-                          (the art is otherwise deterministic, so a plain render idempotent-skips an existing still). Overwrites it (+ republishes on --remote).
+                          (the render is otherwise deterministic, so a plain render idempotent-skips an existing still). Overwrites it (+ republishes on --remote).
     ${g('--remote [name|url]')}   register each render with a REMOTE resolver: the bytes go to ${bold('ABX_STORAGE_BACKEND')} (YOU hold them), and
                           POST /v1/effect-artifacts hands the resolver the URL — it redirects there and never proxies. Traits are the
                           exception: they stitch into the token JSON, so their content (≤64KB) goes to the resolver itself.
@@ -531,12 +556,12 @@ const COMMAND_HELP = {
     Reads the current schema and changes ONLY the lock, so type/auth/bounds/options are carried forward untouched.
     What it does NOT do: remove the key (a governed key stays governed forever) or erase a value already stored — that
     value keeps serving in token data. A value written under a TokenOwner/Address leg came from a collector, and the
-    artist deliberately cannot delete it.
+    creator deliberately cannot delete it.
     ${g('--dry-run')}           print the exact tx and send nothing`,
     'configure-param': `
   ${bold('abx configure-param')} <address> <tokenId|-> <key> <value> ${dim('— set a PostParam (typed, canonical encode). Sends a tx.')}
     Reads the on-chain schema for <key> and canonically encodes <value> (${g('#rrggbb')} for HexColor, fixed-decimal ranges,
-    Select by label, address, bool). Auth is per the schema leg (Artist=owner · TokenOwner — delegate.xyz honored · Address).
+    Select by label, address, bool). Auth is per the schema leg (Creator=owner · TokenOwner — delegate.xyz honored · Address).
     A change ${bold('re-addresses renders')} → the still becomes a placeholder until you re-render (${g('abx render <addr> <id>')} or the runner).
     ${g('<tokenId> "-"')}        CONTRACT scope (owner-only raw setter; schema-less keys only) — the write path of well-known params
                           like ${g('display.gateway')}. ≤31 printable-ASCII chars ride as a literal bytes32; longer takes the data path.
@@ -550,12 +575,35 @@ const COMMAND_HELP = {
                           resolver running the chain watcher (the ${g('abx serve')} default) sees the change on its next poll (~12s)
                           and auto-re-renders on its own. Keep --remote for a watcher-disabled resolver or when seconds matter.
     signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')} preview (encodes + shows the tx, sends nothing)`,
+    'submit-app': `
+  ${bold('abx submit-app')} <collection> ${dim('— list a deployed ABX collection in the App Store. Optional; not part of deploy. Sends txs.')}
+    After ${g('abx deploy')} / ${g('deploy-series')} / ${g('deploy-code')} succeeds, offer this. It is an opt-in: factory events can
+    find every ABX clone, but only minting into the App Store registry makes it an app entry.
+    Does ${bold('not')} reuse the collection's ${g('--name')} / ${g('--description')} — those are NFT metadata. Confirm store copy
+    with the creator (what someone can ${bold('do')}), then run this. The connected wallet must own the collection
+    (or, on a retry, hold the entry token). ${g('built-on-abx')} is forced; the gated minter checks ${g('isAbxClone')} + owner.
+    If the collection is already claimed, skips the mint and only writes params (same as the store's ${g('/update')} page).
+    Metadata is split across a few signatures — one multicall of every field exceeds the chain's per-tx gas cap.
+    ${g('--name')} <s>            listing title (required; ≤100 chars) — not the collection name unless the creator says so
+    ${g('--summary')} "<s>"       one sentence, what someone can do (required; ≤240)
+    ${g('--description')} "<s>"   full description (required; ≤2000)
+    ${g('--mark')} <s>            icon monogram, ≤3 chars (default ${g('A/')})
+    ${g('--tone')} acid|coral|blue|violet|amber|mint   icon color (default ${g('acid')})
+    ${g('--category')} Create|Games|"Physical world"|Records|Coordination|Utilities|"Developer tools"   (default ${g('Create')})
+    ${g('--stage')} Live|Prototype|Concept   (default ${g('Prototype')})
+    ${g('--url')} https://…       launch URL (optional)
+    ${g('--url-label')} "<s>"     launch button label (optional)
+    ${g('--image')} https://…     custom icon URL (optional; otherwise the on-chain SVG from mark/tone)
+    ${g('--tags')} a,b,c          up to 12 tags
+    ${g('--registry')} 0x…        App Store registry (default: shipped address for this chain, or ${g('ABX_APP_STORE_REGISTRY')})
+    ${g('--minter')} 0x…          gated minter (default: shipped address for this chain, or ${g('ABX_APP_STORE_MINTER')})
+    signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')} preview (encodes + shows the txs, sends nothing)`,
     'set-param-hooks': `
   ${bold('abx set-param-hooks')} <address> ${dim('— wire/clear the three SeriesCode param-lifecycle hooks (owner-only). Sends a tx.')}
     The three optional hook addresses a PostParams project may wire (${bold('SeriesCode only')} — a 1/1 / plain Series has none):
     ${g('--configure 0x…')}     write-time veto/validator — a governed ${g('configure-param')} reverts if this hook reverts
     ${g('--augment 0x…')}       read-time derivation folded into tokenData — the opt-in to LIVE data (view reads chain per view)
-    ${g('--transfer 0x…')}      ownership-change lifecycle, best-effort — a revert here never blocks the transfer
+    ${g('--transfer 0x…')}      ownership-change lifecycle, a ${bold('VETO')} — a revert here FAILS the transfer, and mints too (mint = transfer from 0x0)
     The contract has ${bold('no per-hook setter')} — it writes all three at once — so this READS the current trio and re-sends
     it with your change applied: ${bold('omit a role to keep it')}, pass an address to set it, or ${g('none')} to clear it. ${g('--clear')} clears all three.
     Run with ${bold('no flags')} to print the current hooks (mutates nothing).
@@ -578,6 +626,21 @@ const COMMAND_HELP = {
     'lock-dependencies': `
   ${bold('abx lock-dependencies')} <address> ${dim('— freeze the dependency set (list + registry pointer) FOREVER (irreversible). Sends a tx.')}
     signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')}`,
+    'lock-script': `
+  ${bold('abx lock-script')} <address> ${dim('— freeze the on-chain program (script chunks) FOREVER (irreversible). Sends a tx.')}
+    ${dim('This is the lock that freezes the WORK of a code project — after it, setScriptChunk/removeLastScriptChunk revert.')}
+    ${dim('lock-field/lock-uri only freeze metadata; the full set for a code drop is lock-script + lock-dependencies + lock-field/lock-uri.')}
+    ${dim('That freezes what THIS contract stores — not necessarily what the token renders: params stay writable, and a')}
+    ${dim('Registry dependency fetches its bytes live from a contract the registry owner can change. Say "locked metadata", not "immutable output".')}
+    signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')}`,
+    'lock-param-hooks': `
+  ${bold('abx lock-param-hooks')} <address> ${dim('— freeze the three param-lifecycle hook addresses FOREVER (irreversible). Sends a tx.')}
+    ${dim('The lock aimed at a BUYER, not at metadata: the transfer hook is a VETO (its revert fails a transfer, and a mint too),')}
+    ${dim('so until this is sent the owner holds a standing power over whether a collector can sell. After it, set-param-hooks reverts.')}
+    ${dim('You give up: arming a transfer veto, arming a configure veto, and re-pointing/clearing the augment hook. There is no way back.')}
+    ${dim('With no transfer hook set, this is how you PROVE you can never add one. A hook already set stays live — freezing the SET is not disarming it.')}
+    ${dim('Prints the exact three addresses it will freeze before it sends. SeriesCode/EditionCode only. Read it back with `abx state`.')}
+    signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')} preview (encodes + shows the tx, sends nothing)`,
     state: `
   ${bold('abx state')} <address> ${dim('— read-only, on-chain operational snapshot (no tx, no local index).')}
     Shows owner · supply (minted / max, nextTokenId) · paused · minter · primary payee · royalty · renderer
@@ -603,7 +666,7 @@ const COMMAND_HELP = {
     ${dim('minting is sequential (by token id); repeat with different --to for an airdrop to N wallets.')}
     ${bold('editions')} ${dim('(OneOfOneEdition/EditionImage/EditionCode) mint COPIES of one id instead — --count is refused there:')}
     ${g('--token-id <n>')}       which id to mint copies of. Defaults to 0 on a 1/1-edition (its only id); REQUIRED on
-                          EditionImage/EditionCode (ids are caller-named artworks — see \`abx tokens <addr>\` for existing ones)
+                          EditionImage/EditionCode (ids are caller-named works — see \`abx tokens <addr>\` for existing ones)
     ${g('--amount <n>')}         copies to mint (default 1)
     ${dim('--token-id/--amount are refused on a 721 target; --count is refused on an edition — pointed either way.')}
     signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')} preview`,
@@ -656,12 +719,27 @@ const COMMAND_HELP = {
     'set-royalty': `
   ${bold('abx set-royalty')} <address> --bps <0-10000> [--receiver 0x..] ${dim('— change the royalty. Sends a tx.')}`,
     'set-transfer-validator': `
-  ${bold('abx set-transfer-validator')} <address> <0x..|none|recommended> ${dim('— manage an ERC-721C collection\'s transfer validator. Owner-only. Sends a tx.')}
-    <0x..>                re-point enforcement at that validator (must be a DEPLOYED contract — checked before any gas)
+  ${bold('abx set-transfer-validator')} <address> <0x..|none|recommended> ${dim('— manage an ERC-721C/1155C collection\'s transfer validator. Owner-only (one exception below). Sends a tx.')}
+    <0x..>                re-point enforcement at that validator. ${dim('Must be a DEPLOYED contract AND must refuse a call it')}
+                          ${dim('does not implement — probed before any gas, so a Safe / bare proxy / 7702-delegated EOA is refused:')}
+                          ${dim('validateTransfer returns nothing, so such an address would enforce NOTHING while every read said ON.')}
     ${g('none')}                  suspend enforcement (validator → address(0); the collection STAYS enrolled)
     ${g('recommended')}           the chain's recommended validator (OpenSea's, for creator-fee enforcement)
     ${dim('Only for a collection that enrolled AT DEPLOY (--721c on the deploy commands) — a plain ERC-721 is refused')}
     ${dim('up front: enrollment is a deploy-time decision and can never be added (or fully removed) later.')}
+    ${dim('Owner-only WHILE THERE IS AN OWNER: on a renounced collection (owner() == 0x0) ANYONE may send `none` to')}
+    ${dim('suspend, and NOBODY may arm a validator again — the release valve for a stuck, abandoned collection.')}
+    signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')} preview (encodes + shows the tx, sends nothing)`,
+    'set-seed-source': `
+  ${bold('abx set-seed-source')} <address> <0x..|canonical|none> ${dim('— re-point where a CODE project draws its mint seeds. Owner-only. Sends a tx.')}
+    <0x..>                your own ${bold('IAbxSeedSource')} — commit-reveal, a VRF oracle, a curated queue. ${bold('Probed before any gas')}:
+                          it must answer ${g('seed(uint256,address)')} with 32 bytes, or every mint would revert. Refused if it can't.
+    ${g('canonical')}             the shared ${bold('AbxSeedSource')} ABX deploys — pseudorandom, and the default at deploy
+    ${g('none')}                  stop drawing seeds (future mints get none; a generative program expecting one renders blank)
+    ${dim('FUTURE MINTS ONLY — a seed settles the instant it is assigned, so nothing already minted changes. On a part-sold')}
+    ${dim('drop that means the collection spans two sources; the change is public (SeedSourceSet), but early buyers are not told.')}
+    ${dim('Code projects only (`abx deploy-code`) — an image 1/1 or Series has no seed source, and one cannot be added.')}
+    ${dim('Set it at birth instead with')} ${g('abx deploy-code --seed-source 0x..')}${dim('.')}
     signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')} preview (encodes + shows the tx, sends nothing)`,
     attach: `
   ${bold('abx attach')} <address> <key> <uri> [<key> <uri> …] ${dim('— attach named file(s) to a token. Sends ONE tx.')}
@@ -676,18 +754,20 @@ const COMMAND_HELP = {
     ${g('--dry-run')}             preview the tx, send nothing   ·   signing: ${g('--send')} (default, needs a hot key) · ${g('--sign')} (browser wallet, no key) · ${g('--unsigned')}
     ${dim('Need the URI first? Upload the file with')} ${g('abx storage upload <path> --backend arweave|ipfs')} ${dim('— it prints the locator to pass here.')}
     ${dim('mimeType is declared from the URL EXTENSION (…/master.tiff → image/tiff) — give the file a real extension.')}
-    ${dim('Surfaces in a resolver\'s artifacts listing (/data/<key> fetches it); a bare on-chain tokenURI shows reserved fields + abx_params only —')}
-    ${dim('configured params DO appear on-chain (as')} ${bold('abx_params')}${dim('); ATTACHMENTS are the surface that needs a resolver.')}
+    ${dim('Surfaces in a resolver\'s artifacts listing (/data/<key> fetches it); a bare on-chain tokenURI shows reserved fields only —')}
+    ${dim('params are chain STATE, read with')} ${bold('abx tokens')}${dim(' or tokenParamKeys/tokenParam (not projected into tokenURI); ATTACHMENTS need a resolver.')}
     ${dim('The image/animation are just reserved members of the same manifest. `artifacts` itself is COMPUTED — not settable.')}`,
     'set-field': `
   ${bold('abx set-field')} <address> --field <name> ${dim('— set an on-chain metadata field (the low-level primitive). Sends a tx.')}
     ${dim('To attach an off-chain FILE (the common case), prefer')} ${bold('abx attach')} ${dim('— it auto-picks the representation.')}
     --field <name>        a reserved display field (image · description · animation_url · external_url · attributes ·
                           background_color · …), a collection authorship/rights field with ${g('--collection')}
-                          (artist · display_notes · artist_links · license), OR any custom key (which becomes an
+                          (creator · display_notes · creator_links · license), OR any custom key (which becomes an
                           ${bold('artifacts')} entry). NOT ${g('artifacts')}/${g('abx_params')}/${g('abx_provenance')} (computed).
     --text "<s>"          store literal UTF-8 ON-CHAIN (representation defaults ${g('inline')}) — NOT for an off-chain URL (use ${bold('attach')})
-    --file <path>         store a FILE on-chain in SSTORE2 chunks behind the shared reader (any size; multi-chunk)
+    --file <path>         store a FILE on-chain in SSTORE2 chunks behind the shared reader (multi-chunk)
+                          ${dim('~360-405k gas/KB per tokenURI to READ it back (climbing with size): under ~40KB reads routinely, 40-100KB needs a high-gas RPC,')}
+                          ${dim('past ~100KB a default node refuses the read (override with')} ${g('--allow-unreadable-onchain')}${dim(').')}
     ${g('--compress')} none|fastlz|gzip   for --file (default none): ${g('fastlz')} = on-chain decode, stays renderable, cheaper storage;
                           ${g('gzip')} = smallest but off-chain decode only (sets the ${g('reader-gzip')} representation)
     --value 0x..          store raw bytes / hash (representation defaults keccak256)
@@ -712,7 +792,9 @@ const COMMAND_HELP = {
     'lock-uri': `
   ${bold('abx lock-uri')} <address> ${dim('— freeze the URI config (pointer + renderer) FOREVER. Sends a tx.')}
     --collection          target the collection scope · else the token URI
-    ${dim('with the fields also locked (lock-field), the resolved metadata is provably immutable.')}`,
+    ${dim('with the fields also locked (lock-field), the stored metadata can never change again.')}
+    ${dim('Locked metadata is NOT a locked OUTPUT: params have no lock, and a locked dependency POINTER can still resolve')}
+    ${dim('to bytes someone else controls. Some tokens live-adapt to chain state on purpose — see')} https://abx.docs.artblocks.io/protocol/owner-powers/`,
     'set-admin': `
   ${bold('abx set-admin')} <address> --to 0x.. ${dim('— hand over contract ownership. Sends a tx.')}`,
     'set-minter': `
@@ -743,10 +825,10 @@ const COMMAND_HELP = {
                           ${dim('overridden is already open (its --copies default from deploy); there is nothing to set.')}
     ${dim('Refused on a 721 target (use set-max-invocations instead).')}   signing: ${g('--send')} (default) · ${g('--sign')} · ${g('--unsigned')} · ${g('--dry-run')}`,
     'ping-uri': `
-  ${bold('abx ping-uri')} <address> --token-ids <csv|range> ${dim('— edition-only, PERMISSIONLESS: re-emit the native URI event. Sends tx(s).')}
+  ${bold('abx ping-uri')} <address> --token-ids <csv|range> ${dim('— edition-only, OWNER-ONLY: re-emit the native URI event. Sends tx(s).')}
     Re-emits ERC-1155's native ${g('URI(string,uint256)')} event for the given ids — the fix for a marketplace/indexer that
     only honors the native event, after a contract-wide re-point (${g('abx set-token-uri')} / ${g('abx set-renderer')}) which
-    emits only its own config event, not a per-id one. ${dim('(721 has no equivalent verb — ERC-4906 MetadataUpdate covers that case there.)')}
+    emits the ERC-4906 range form, not a per-id native event. ${dim('(721 has no equivalent verb — it has no native per-id URI event to re-emit.)')}
     --token-ids <csv|range>   e.g. ${g('0,1,2')} or ${g('0-99')} or mixed ${g('0-9,20,25-30')}
     ${dim('Permissionless by design — it only re-emits already-public, current truth, so ANY signer may call it (no owner')}
     ${dim('check, no --for pinning). Chunks large id lists into several transactions (200 ids/tx) — each previews under --dry-run.')}
@@ -922,12 +1004,12 @@ function help() {
                             storage override (else uses config): --backend --endpoint --bucket --region --gateway --upload-url
                             signing: ${g('--send')} hot/env key (default) · ${g('--sign')} wallet page · ${g('--unsigned')} print tx
                             ${g('--dry-run')}  preview (commitment · URIs · mint plan · approvals) without sending or storing — address only WITH --salt
-                            ${bold(g('--copies <n|open>'))}  copies of this SAME artwork (ERC-1155 edition) instead of a unique token —
+                            ${bold(g('--copies <n|open>'))}  copies of this SAME work (ERC-1155 edition) instead of a unique token —
                               ${g('open')} = uncapped OPEN EDITION, the flagship edition product. See ${g('abx help deploy')}.
     ${g('abx deploy-series')} --dir <folder>  deploy a ${bold('multi-token collection')} from a folder of media (one contract, N tokens)
                             mint timing: ${g('--mint-all')} | ${g('--mint-count')} N | ${g('--no-mint')}   ·   --count N --name --symbol --royalty-bps
-                            image custody: ${g('--onchain-image')} (bytes on-chain, tiny art) ·
-                              ${g('--onchain-uri --backend arweave|ipfs|cloud')} (image off-chain, JSON on-chain, ${bold('no server')} — best for most art) ·
+                            image custody: ${g('--onchain-image')} (bytes on-chain, tiny content) ·
+                              ${g('--onchain-uri --backend arweave|ipfs|cloud')} (image off-chain, JSON on-chain, ${bold('no server')} — best for most projects) ·
                               --public-base-url <url> (hosted resolver)
                             --minter 0x.. · --primary-payee 0x.. · --unpaused · ${g('--dry-run')}   ·   see ${g('abx help deploy-series')}
                             ${bold(g('--copies <n|open>'))}  N ids from the folder × copies each (EditionImage) instead of N unique tokens
@@ -949,13 +1031,14 @@ function help() {
     ${g('abx preview')} (--script <f> | --code-dir <d>)   ${bold('while you are still making it')} — run the program on localhost, live: refresh for new seeds,
                             drive your PostParams, watch it animate. Same document the generator serves. ${g('--shoot <dir>')} for headless frames. No chain.
     ${g('abx inspect')} <script.js>   ${bold('before you pick a lane')} — static analysis (traits + on-chain reproducibility, deps, doc size → RPC viability) + a lane recommendation
-    ${g('abx scaffold-renderer')} [<dir>]   write a buildable Foundry project for the ${bold('in-chain Solidity art lane')} (seed + PostParam → on-chain SVG + traits; you forge build/test/deploy)
-    ${g('abx deploy-code')} (--script <file> | --code-dir <dir> | ${g('--image-renderer 0x..')})   deploy a ${bold('generative / code project')} (on-chain script, a build directory, or a Solidity SVG renderer — in-chain art)
+    ${g('abx scaffold-renderer')} [<dir>]   write a buildable Foundry project for the ${bold('in-chain Solidity renderer lane')} (seed + PostParam → on-chain SVG + traits; you forge build/test/deploy)
+    ${g('abx deploy-code')} (--script <file> | --code-dir <dir> | ${g('--image-renderer 0x..')})   deploy a ${bold('generative / code project')} (on-chain script, a build directory, or a Solidity SVG renderer — in-chain rendering)
                             ${bold('--public-base-url <url>')} OR ${bold('--onchain-uri')} · --schema key:Type:Auth · ${g('--dep')} name@version|0x.. (ordered; index 0 = the runtime) ·
                             --dep-registry 0x.. · --description "<s>" · --external-url <url> · ${g('--image-base <url>')} (off-chain thumbnails at a deterministic /{id} URL) ·
                             ${g('--attributes-renderer 0x..')} (traits on-chain) · --max N · ${g('--mint-all')}|${g('--mint-count')} N · --backend ipfs|arweave · ${g('--dry-run')}
                             ${bold(g('--copies <n|open>'))}  a generative drop minted as copies (EditionCode) — v1 scope: --script only, no --dep/--code-dir/--image-renderer
     ${g('abx configure-param')} <addr> <id> <key> <value>   set a governed PostParam (typed encode; a change re-addresses the render)
+    ${g('abx submit-app')} <collection>   list that collection in the ABX App Store (optional, after deploy — mint + catalog copy)
     ${g('abx set-schema')} <addr> --schema key:Type:Auth[:lock=<when>]   attach or replace ONE key's schema, any time after deploy
     ${g('abx retire-param')} <addr> <key>   stop all further writes to a param, permanently (the closest thing to removing one)
     ${g('abx set-dependency')} <addr> <index> <ref>   declare/replace a code dependency (name@version via the registry pointer, or 0x.. on-chain)
@@ -968,21 +1051,26 @@ function help() {
   ${bold('owner operations')} ${dim('— operate a project after launch')}
     ${g('abx mint')} <addr>         issue token #0   flags: [--to 0x.. (default: owner)]
                             ${dim('edition:')} ${g('--token-id <n>')} (required unless a 1/1-edition) + ${g('--amount <n>')} (copies, default 1) — ${g('--count')} refused
+    ${g('abx submit-app')} <collection>  list a deployed collection in the ABX App Store (opt-in; not part of deploy)
+                            --name --summary --description   [--mark] [--tone] [--category] [--stage] [--url] [--tags]
     ${g('abx refresh')} <addr>      ask marketplaces to re-index   flags: [--token 0]
     ${g('abx transfer')} <addr>     sell/transfer a token   flags: --to 0x.. [--token 0 | --token-id 0]
                             ${dim('edition:')} ${g('--amount <n>')} copies + ${g('--from 0x..')} (required — many holders, no single on-chain owner)
     ${g('abx set-max-supply')} <addr>  --token-id <n> --cap <n>   edition-only: lower ONE id's ERC-1155 cap (never "open" — caps only decrease)
-    ${g('abx ping-uri')} <addr>     --token-ids <csv|range>   edition-only, permissionless: re-emit the native URI event after a re-point
+    ${g('abx ping-uri')} <addr>     --token-ids <csv|range>   edition-only, owner-only: re-emit the native URI event after a re-point
     ${g('abx set-token-uri')} <addr>    re-point a token's metadata URI   --uri <url>
     ${g('abx set-contract-uri')} <addr> re-point the collection URI        --uri <url>
     ${g('abx migrate')} <addr>       move off-chain state to a NEW resolver (verifies parity; no cutover)   --from <old> --to <new>
     ${g('abx set-royalty')} <addr>  change royalty   --bps <0-10000> [--receiver 0x..]
     ${g('abx set-transfer-validator')} <addr> <0x..|none|recommended>   manage an ERC-721C collection's validator (enrolled-at-deploy only)
+    ${g('abx set-seed-source')} <addr> <0x..|canonical|none>   re-point a CODE project's mint-seed source (probed; future mints only)
     ${g('abx attach')} <addr> <key> <ipfs://…|ar://…|https://…>   attach a named file → the token's ${bold('artifacts')} manifest (data plane)
     ${g('abx set-field')} <addr>    set an on-chain metadata field (low-level)   --field <name> (--text "…" | --value 0x..) [--collection]
     ${g('abx lock-field')} <addr>   freeze a field forever   --field <name> [--collection]
     ${g('abx set-renderer')} <addr> toggle URI resolution on-chain ↔ off-chain   [--off] [--renderer 0x..] [--collection]
     ${g('abx lock-uri')} <addr>     freeze the URI config (pointer + renderer) forever   [--collection]
+    ${g('abx lock-script')} <addr>  freeze the on-chain program (script chunks) forever — the lock that freezes a code project's ${bold('work')}
+    ${g('abx lock-param-hooks')} <addr>  freeze the three hook addresses forever — the ${bold('transfer hook is a veto')}, so this is the guarantee a buyer reads
     ${g('abx set-admin')} <addr>    hand over contract ownership   --to 0x..
     ${dim('Series-only:')} ${g('abx mint')} <addr> mints the ${dim('next')} token in order (or ${g('--count')} N)
     ${g('abx pause')} / ${g('abx unpause')} <addr>   Series mint gate (paused ⇒ owner-only minting)