@artblocks/abx-cli 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/commands/deploy.js

@@ -15,20 +15,20 @@
 import { createHash } from 'node:crypto';
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { basename, extname, join as joinPath, resolve as resolvePath } from 'node:path';
-import { DEFAULT_CHAIN_KEY, DEP_RESOLUTION, METADATA_FIELD as F, METADATA_REPRESENTATION as R, analyzeScript, assertChainId, checkRegistryDeps, dependencySetupCalls, deployOneOfOne, deploySeries, deployOneOfOneEdition, deployEditionImage, discoverDeployBlock, encodeFieldRenderer, encodeTag, expectedChainComplete, makeHotSender, makePublicClient, makeWalletClient, normalizeAttributes, onchainUriSetupCalls, oneOfOneImageAbi, oneOfOneEditionAbi, parseTraitPairs, planResume, predictClone, prepareCodeSetup, prepareDeployOneOfOne, prepareDeploySeries, prepareDeploySeriesCode, prepareDeployOneOfOneEdition, prepareDeployEditionImage, prepareDeployEditionCode, redactRpcUrl, resolveChain, resolveDepRegistryPointer, resolveGenerator, resolveRecommendedTransferValidator, resolveRpcUrl, resolveSeedSource, resolveSeriesCodeFactory, saltFor, seriesCodeAbi, seriesCodeFactoryAbi, tryReadContract, } from '@artblocks/abx-sdk';
+import { DEFAULT_CHAIN_KEY, DEP_RESOLUTION, METADATA_FIELD as F, METADATA_REPRESENTATION as R, analyzeScript, assertChainId, checkRegistryDeps, dependencySetupCalls, deployOneOfOne, deploySeries, deployOneOfOneEdition, deployEditionImage, discoverDeployBlock, encodeFieldRenderer, encodeTag, expectedChainComplete, makeHotSender, makePublicClient, makeWalletClient, normalizeAttributes, onchainUriSetupCalls, oneOfOneImageAbi, oneOfOneEditionAbi, parseTraitPairs, planResume, predictClone, probeSeedSource, prepareCodeSetup, prepareDeployOneOfOne, prepareDeploySeries, prepareDeploySeriesCode, prepareDeployOneOfOneEdition, prepareDeployEditionImage, prepareDeployEditionCode, redactRpcUrl, resolveChain, resolveDepRegistryPointer, resolveGenerator, probeTransferValidator, resolveRecommendedTransferValidator, resolveRpcUrl, resolveSeedSource, resolveSeriesCodeFactory, saltFor, seriesCodeAbi, seriesCodeFactoryAbi, tryReadContract, } from '@artblocks/abx-sdk';
 import { DIRECT_URL_BACKENDS, contentTypeFromPath, decideImageContentLane, hashContent, isTurboArweave, resolveBackend, validateRenderStorageCombo, } from '@artblocks/abx-storage';
-import { DEFAULT_PORT, artContentHash, generateArt, resolveBaseUrl, startTokenApiServer } from '@artblocks/abx-token-api';
+import { DEFAULT_PORT, contentHash, generateContent, resolveBaseUrl, startTokenApiServer } from '@artblocks/abx-token-api';
 import { encodeFunctionData, toHex, zeroAddress } from 'viem';
 import { CHAIN, explorerBase, assertTurboFundsForUpload, backendResolution, collectContentLocators, ensureArweaveIdentityForUpload, factoryAddress, faucetHint, localIndexer, loopbackBaseUrl, noteArweavePlan, noteStorageReadiness, rendererAddress, seriesFactoryAddress, oneOfOneEditionFactoryAddress, editionFactoryAddress, editionCodeFactoryAddress, storageOptions, storageOverrides, storageSignerChoice, } from '../config.js';
 import { parseDepFlag } from '../deps.js';
-import { isDryRun, parseSaltFlag, refuseStrayFlags, warnSignWithoutFor } from '../flags.js';
+import { allowUnreadableOnchain, isDryRun, parseSaltFlag, refuseStrayFlags, warnSignWithoutFor } from '../flags.js';
 import { isEditionContract } from '../kind.js';
 import { jsonSafe, withJson } from '../jsonout.js';
 import { bold, c, dim, ensureFactory, ensureRenderer, ensureSeedSource, ensureSeriesCodeFactory, ensureSeriesFactory, ensureOneOfOneEditionFactory, ensureEditionFactory, ensureEditionCodeFactory, g, info, keepAlive, ok, p, portInUse, printServing, registerAndIndexLocally, reindexAfterDeploy, step, warn, } from '../output.js';
-import { AUTHORSHIP_DEPLOY_FIELDS, ONCHAIN_PROJECT_SOFT_LIMIT, authorshipContractFields, computeContentPlan, envStagingSender, parseCompress, parseTransferValidatorValue, previewImageStaging, sessionStagingSender, stageImageField, stageImageFieldsBatch, } from '../ownerops.js';
+import { AUTHORSHIP_DEPLOY_FIELDS, ONCHAIN_PROJECT_SOFT_LIMIT, ONCHAIN_READ_WARN_BYTES, tokenUriGasEstimate, authorshipContractFields, computeContentPlan, envStagingSender, parseCompress, parseSeedSourceValue, canonicalSeedSource, refuseUnusableSeedSource, parseTransferValidatorValue, guardOnChainSize, previewImageStaging, sessionStagingSender, stageImageField, stageImageFieldsBatch, } from '../ownerops.js';
 import { canonicalLabel } from '../remote.js';
 import { confirmSend, gatedSend, laneFromFlags } from '../riskgate.js';
-import { describeSchema, parseSchemaSpecs } from '../schema.js';
+import { describeSchema, editionSchemaAdvisory, parseSchemaSpecs } from '../schema.js';
 import { parseSeriesTraits } from '../series-traits.js';
 import { decodeOnChainJson } from '../served.js';
 import { openWalletSession, signHotSequence, signTx } from '../signer.js';
@@ -261,6 +261,7 @@ export function deployCodeCommandLine(flags, salt) {
     str('max', flags.max);
     str('schema', flags.schema);
     bool('no-seed');
+    str('seed-source', flags['seed-source']);
     bool('onchain-uri');
     str('generator', flags.generator);
     str('renderer', flags.renderer);
@@ -289,7 +290,7 @@ export function deployCodeCommandLine(flags, salt) {
 // Build the token's `image` field as an on-chain keccak256 commitment over the bytes,
 // and (with --image) store those bytes in custody keyed by that hash so the resolver
 // can serve + verify them. Without --image, fall back to the demo's generative-from-
-// address art (recomputable, nothing to store). Returns on-chain field inputs.
+// address content (recomputable, nothing to store). Returns on-chain field inputs.
 export const imageKeccakField = (value) => ({
     field: encodeTag(F.image),
     representation: encodeTag(R.keccak256),
@@ -364,12 +365,12 @@ walletAddr) {
         // off-chain mode commits its keccak and regenerates/serves it.
         if (onChain) {
             return {
-                tokenFields: [imageInlineField(generateArt(clone))],
+                tokenFields: [imageInlineField(generateContent(clone))],
                 contentNote: 'content: generative SVG, INLINE on-chain (self-resolving, no custody)',
             };
         }
         return {
-            tokenFields: [imageKeccakField(artContentHash(clone))],
+            tokenFields: [imageKeccakField(contentHash(clone))],
             contentNote: 'content: generative SVG from the contract address (demo default)',
         };
     }
@@ -509,7 +510,7 @@ export function describeTraits(traits, onchain) {
 // ── deploy (+ optionally serve) ──────────────────────────────────────────────
 export async function cmdDeploy(flags, serveAfter) {
     // `--copies <N|open>` routes to the ERC-1155 edition twin (OneOfOneEdition) — the flagship
-    // edition product: a priced open/limited edition of ONE artwork. Checked before anything else
+    // edition product: a priced open/limited edition of ONE work. Checked before anything else
     // touches `flags`, so the 721 lane (`cmdDeployBody`) below is reached ONLY when `--copies` is
     // absent, and is otherwise untouched by this feature — byte-identical to before editions shipped.
     if (flags.copies !== undefined) {
@@ -543,7 +544,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     // lockable) — mirrors the description model. On-chain wins if both ever set the same trait.
     const traits = parseDeployTraits(flags);
     console.log(serveAfter
-        ? bold(`\n  ABX · your first token\n  ${dim("we'll put art on a blockchain — then delete our copy and get all of it back")}`)
+        ? bold(`\n  ABX · your first token\n  ${dim("we'll put your work on a blockchain — then delete our copy and get all of it back")}`)
         : bold(`\n  ABX Self-Host Toolkit — deploy\n  ${dim('a project, served from chain alone')}`));
     // Signing lane. `demo` used to hard-force the hot lane, which SILENTLY dropped `--sign`: with no
     // env key it died confusingly, and WITH one it signed from that key while the operator had asked
@@ -639,17 +640,17 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     // otherwise leave it EMPTY rather than baking a misleading localhost into the contract.
     const hasPublicUrl = !!(flags['public-base-url'] || process.env.ABX_PUBLIC_BASE_URL);
     const onchainImage = !!flags['onchain-image'];
-    // `abx demo` defaults to FULLY ON-CHAIN. Its default art is a generative SVG, which the renderer
+    // `abx demo` defaults to FULLY ON-CHAIN. Its default content is a generative SVG, which the renderer
     // can inline — so the token self-resolves and, crucially, NO localhost gets baked into the
     // contract as the tokenURI base. The old default shipped a first-ever token that resolved for
     // nobody but its author (broken on every marketplace, dead the moment `abx serve` stops) and
-    // taught that as the normal shape of an NFT. It also undercut the demo's own claim: with the art
+    // taught that as the normal shape of an NFT. It also undercut the demo's own claim: with the content
     // on-chain, "rebuilt from the chain alone" now covers the IMAGE, not just the metadata.
     //
     // Opting back into off-chain custody is anything that says "I have somewhere to host": a real base
     // URL, an explicit --backend, or a RASTER --image. An SVG --image still goes on-chain — inlining is
     // exactly what the renderer supports (v1 is SVG-only), so there's no reason to send someone's own
-    // vector art down the localhost path. Raster stays off-chain because forcing it on-chain would
+    // vector content down the localhost path. Raster stays off-chain because forcing it on-chain would
     // silently inline a placeholder instead of their image.
     const demoImageInlineable = !flags.image || contentTypeFromPath(flags.image) === 'image/svg+xml';
     const demoDefaultsOnChain = serveAfter && demoImageInlineable && !flags.backend && !hasPublicUrl;
@@ -680,12 +681,12 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     // and it's invisible unless someone says it out loud. Two honest versions, because the answer is
     // genuinely different per lane. Demo only — `deploy` prints the same facts per-field.
     if (serveAfter && onChainUri) {
-        console.log(`    Your art goes ${bold('INTO')} the contract. Not a link to it — the image itself.`);
-        console.log(`    ${g('✦')} the chain will hold   ${dim('your art · your name on it · your royalty · you as owner')}`);
+        console.log(`    Your work goes ${bold('INTO')} the contract. Not a link to it — the image itself.`);
+        console.log(`    ${g('✦')} the chain will hold   ${dim('your work · your name on it · your royalty · you as owner')}`);
         console.log(`    ${g('✦')} you will need         ${dim('nothing else. no server, no IPFS pin, no monthly bill to forget')}`);
     }
     else if (serveAfter) {
-        console.log(`    ${g('✦')} the chain will hold   ${dim('your name · your royalty · you as owner · a fingerprint of the art')}`);
+        console.log(`    ${g('✦')} the chain will hold   ${dim('your name · your royalty · you as owner · a fingerprint of the work')}`);
         console.log(`    ${g('✦')} this computer holds   ${dim('the image bytes themselves')}`);
         info(dim('the chain proves the bytes are unaltered; it does not store them (that fingerprint is a keccak256 hash)'));
     }
@@ -702,7 +703,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one ` +
                 `(not marketplaces, not wallets, not even your own browser unless \`abx serve\` is running). Pick a real path:\n` +
-                `    • Fully on-chain, no host:  --onchain-image --compress fastlz     (best for small static art)\n` +
+                `    • Fully on-chain, no host:  --onchain-image --compress fastlz     (best for small static content)\n` +
                 `    • Hosted resolver:          --public-base-url https://your.domain (or set ABX_PUBLIC_BASE_URL)`;
             if (!devAllow) {
                 if (dryRun)
@@ -769,12 +770,12 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         }
         step('Stage on-chain image');
         if (dryRun) {
-            info(previewImageStaging(flags.image, parseCompress(flags.compress)));
+            info(previewImageStaging(flags.image, parseCompress(flags.compress), allowUnreadableOnchain(flags)));
         }
         else if (lane === 'send') {
             // hot lane: the env key stages now (deployer-independent — the manifest doesn't depend
             // on the clone address), then the deploy below bakes in the reader field.
-            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), envStagingSender());
+            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), envStagingSender(), allowUnreadableOnchain(flags));
             bakedImage = field;
             info(note);
         }
@@ -851,7 +852,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
             royaltyBps,
             transferValidator,
             tokenFields,
-            // authorship + rights (artist / license / …) are collection-scope on-chain fields.
+            // authorship + rights (creator / license / …) are collection-scope on-chain fields.
             contractFields: authorshipContractFields(flags),
         };
         return { clone, params, salt, contentNote };
@@ -917,7 +918,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         return;
     }
     // opt-in --confirm: a final y/N before the real send (no-op without --confirm; never blocks scripts)
-    await confirmSend(`About to deploy 1/1 "${name}" (${symbol})${flags.image ? ' with your image' : ' (generative demo art)'}; mint: ${noMint ? 'deferred' : 'token #0 at deploy'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
+    await confirmSend(`About to deploy 1/1 "${name}" (${symbol})${flags.image ? ' with your image' : ' (generative demo content)'}; mint: ${noMint ? 'deferred' : 'token #0 at deploy'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
         (transferValidator !== zeroAddress ? ` ERC-721C: enrolled at deploy, permanently (validator ${transferValidator}).` : ''), flags);
     if (lane === 'send') {
         // hot lane: the env key is the deployer, known up front.
@@ -960,7 +961,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         try {
             const signer = await session.connect();
             // Stage on-chain through the session (sets bakedImage, which buildForDeployer reads below).
-            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), sessionStagingSender(session));
+            const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), sessionStagingSender(session), allowUnreadableOnchain(flags));
             bakedImage = field;
             info(note);
             const { clone: predicted, params, salt, contentNote } = await buildForDeployer(signer);
@@ -1148,7 +1149,7 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     keepAlive();
 }
 // ── deploy --copies: OneOfOneEdition (the flagship ERC-1155 product) ─────────────────────────────
-// Copies of ONE artwork — a priced open/limited edition. The edition twin of `cmdDeployBody`,
+// Copies of ONE work — a priced open/limited edition. The edition twin of `cmdDeployBody`,
 // reusing every standard-agnostic helper it does (content custody, traits, authorship fields, the
 // `--721c`/`--1155c`-shared validator resolution, salt prediction, signing lanes) but written as its
 // own function rather than threaded into `cmdDeployBody` with `if (copies)` branches throughout —
@@ -1168,10 +1169,10 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     // `--type` is the 721 lane's OWN dimension seam (cmdDeployBody redirects `--type series` to
     // `deploy-series`) — it never even reaches this function for that redirect, since --copies routes
     // here before --type is ever inspected. Refuse the confusing combination explicitly rather than
-    // silently ignore it (a creator combining them almost certainly means the multi-artwork edition —
+    // silently ignore it (a creator combining them almost certainly means the multi-work edition —
     // `deploy-series --copies`, not this 1/1-edition lane).
     if (flags.type !== undefined && resolveDimension(flags.type) === 'series') {
-        throw new Error("--type series + --copies: this is the 1/1-edition lane (one artwork, copies of it) — for N artworks each with copies, " +
+        throw new Error("--type series + --copies: this is the 1/1-edition lane (one work, copies of it) — for N works each with copies, " +
             'use `abx deploy-series --copies <n|open> --dir <folder>` instead. Drop --type here.');
     }
     const editionSize = parseCopies(flags.copies);
@@ -1182,8 +1183,8 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     const traits = parseDeployTraits(flags);
     console.log(bold(`\n  ABX Self-Host Toolkit — deploy edition\n  ${dim(editionSize === 0n
-        ? 'OneOfOneEdition (ERC-1155) — an OPEN edition of one artwork, served from chain alone'
-        : `OneOfOneEdition (ERC-1155) — ${editionSize} cop${editionSize === 1n ? 'y' : 'ies'} of one artwork, served from chain alone`)}`));
+        ? 'OneOfOneEdition (ERC-1155) — an OPEN edition of one work, served from chain alone'
+        : `OneOfOneEdition (ERC-1155) — ${editionSize} cop${editionSize === 1n ? 'y' : 'ies'} of one work, served from chain alone`)}`));
     if (editionSize === 1n)
         info(copiesOneNote('deploy'));
     const lane = laneFromFlags(flags);
@@ -1257,7 +1258,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         if (!hasPublicUrl || loopback) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one. ` +
-                `Pick a real path:\n    • Fully on-chain (SVG art):     --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
+                `Pick a real path:\n    • Fully on-chain (SVG content): --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
             if (!devAllow) {
                 if (dryRun)
                     warn(`would REFUSE to deploy — ${msg}`);
@@ -1279,7 +1280,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     // connect, so the connecting wallet pays for and owns every chunk write. `stageNow` is the hot-lane
     // (and dry-run) path; the session branch below calls the same helper with a session-backed sender.
     const stageOnChainImage = async (sender) => {
-        const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), sender);
+        const { field, note } = await stageImageField(flags.image, parseCompress(flags.compress), sender, allowUnreadableOnchain(flags));
         bakedImage = field;
         info(note);
     };
@@ -1288,7 +1289,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
             throw new Error('--onchain-image needs --image <path> (the bytes to put on-chain)');
         step('Stage on-chain image');
         if (dryRun)
-            info(previewImageStaging(flags.image, parseCompress(flags.compress)));
+            info(previewImageStaging(flags.image, parseCompress(flags.compress), allowUnreadableOnchain(flags)));
         else if (lane === 'send')
             await stageOnChainImage(envStagingSender());
         // lane === 'sign' → staged inside the wallet session further down.
@@ -1399,7 +1400,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         emit(jsonSafe({ command: 'deploy', kind: '1of1-edition', copies: editionSize.toString(), dryRun: true, sent: false, address: explicitSalt ? predicted : null, chain: CHAIN, chainId: resolveChain(CHAIN).id, factory, salt, saltPinned: !!explicitSalt, name, symbol }));
         return;
     }
-    await confirmSend(`About to deploy an edition of "${name}" (${symbol}) — ${editionSize === 0n ? 'open' : editionSize.toString()} copies${flags.image ? ' with your image' : ' (generative demo art)'}; mint: ${mintAmount > 0n ? `${mintAmount} at deploy` : 'deferred'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
+    await confirmSend(`About to deploy an edition of "${name}" (${symbol}) — ${editionSize === 0n ? 'open' : editionSize.toString()} copies${flags.image ? ' with your image' : ' (generative demo content)'}; mint: ${mintAmount > 0n ? `${mintAmount} at deploy` : 'deferred'}; approvals: ${approvals} wallet approval(s); owner+royalty: your wallet @ ${royaltyBps / 100}%.` +
         (transferValidator !== zeroAddress ? ` ERC-1155C: enrolled at deploy, permanently (validator ${transferValidator}).` : ''), flags);
     if (lane === 'send') {
         const { wallet, account } = makeWalletClient({ chainKey: CHAIN });
@@ -1509,7 +1510,7 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
 // token (`0..N-1`, natural-sorted) — a token's metadata is its token id, and tokens mint
 // strictly in order. Content is hosted exactly like a 1/1, per token — three placements:
 //   • off-chain custody (default): keccak-committed, bytes served by the resolver.
-//   • `--onchain-uri`: inline each token's SVG on-chain (tiny art; SVG only).
+//   • `--onchain-uri`: inline each token's SVG on-chain (tiny content; SVG only).
 //   • `--onchain-image [--compress fastlz]`: stage each token's bytes (raster or SVG) into the
 //     shared chunk store and bake a per-token `reader` field — multi-chunk on-chain content,
 //     self-resolving via the renderer. Implies on-chain URI resolution.
@@ -1587,13 +1588,16 @@ export async function cmdDeploySeriesBody(flags, emit) {
         throw new Error('Staging on-chain images (--onchain-image) needs interactive signing — each chunk tx feeds ' +
             "the next, so it can't run on the cold lane (--unsigned). Use the hot lane (a funded key) or --sign (browser wallet).");
     }
-    // Whole-collection cost guard: per-file warnings fire during staging/preview, but a set of many
-    // small files can still sum to an expensive on-chain deploy — flag the total once, up front.
+    // Whole-collection WRITE-cost guard: a set of many small files can still sum to an expensive
+    // on-chain deploy, so flag the total once, up front. This is a cost signal only — the READ gate is
+    // per token (`guardOnChainSize`, fired per file during staging/preview), because each token's
+    // `tokenURI` assembles only its own content, so a 300-file collection of 5KB pieces reads fine.
     if (onchainImage) {
         const totalBytes = slots.reduce((n, s) => n + statSync(joinPath(dirPath, s)).size, 0);
         if (totalBytes > ONCHAIN_PROJECT_SOFT_LIMIT) {
-            warn(`on-chain collection total is ${Math.round(totalBytes / 1024)}KB across ${slots.length} file(s) — on-chain costs ~200 gas/byte, so this is expensive, not cheaper. ` +
-                `Past ~${Math.round(ONCHAIN_PROJECT_SOFT_LIMIT / 1024)}KB total, prefer off-chain: --backend arweave (pay-once, permanent) or a hosted resolver + IPFS.`);
+            warn(`on-chain collection total is ${Math.round(totalBytes / 1024)}KB across ${slots.length} file(s) — on-chain costs ~200 gas/byte to WRITE, so this is expensive, not cheaper. ` +
+                `Past ~${Math.round(ONCHAIN_PROJECT_SOFT_LIMIT / 1024)}KB total, prefer off-chain: --backend arweave (pay-once, permanent) or a hosted resolver + IPFS. ` +
+                `(Per-token readability is judged per file, not on this total.)`);
         }
     }
     const minter = flags.minter ?? zeroAddress;
@@ -1636,7 +1640,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
         if (!hasPublicUrl || loopback) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one. ` +
-                `Pick a real path:\n    • Fully on-chain (SVG art):     --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
+                `Pick a real path:\n    • Fully on-chain (SVG content): --onchain-uri\n    • Fully on-chain (any media):   --onchain-image --compress fastlz\n    • Hosted resolver:              --public-base-url https://your.domain`;
             if (!devAllow) {
                 if (dryRun)
                     warn(`would REFUSE to deploy — ${msg}`);
@@ -1719,7 +1723,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
     const buildImageFields = async (stage) => {
         // --onchain-image: stage every token's bytes into ONE shared chunk store, each a `reader` field.
         if (onchainImage) {
-            const { fields } = await stageImageFieldsBatch(tokenPaths.map((s) => s.path), compress, stage, flags['chunk-store']);
+            const { fields } = await stageImageFieldsBatch(tokenPaths.map((s) => s.path), compress, stage, flags['chunk-store'], allowUnreadableOnchain(flags));
             tokenFields = tokenPaths.map(({ tokenId }, i) => tokenFieldOf(tokenId, fields[i]));
             return;
         }
@@ -1835,7 +1839,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
             mintTo: mintCount > 0 ? deployer : zeroAddress,
             mintCount,
             tokenFields,
-            // image contract fields (the O(1) url-template) + authorship/rights (artist / license / …).
+            // image contract fields (the O(1) url-template) + authorship/rights (creator / license / …).
             contractFields: [...contractFields, ...authorshipContractFields(flags)],
         };
         return { clone, params, salt };
@@ -1887,7 +1891,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
         }
         if (onchainImage) {
             for (const { tokenId, name: fname, path } of tokenPaths) {
-                info(`token ${tokenId} ← ${fname}: ${previewImageStaging(path, compress)}`);
+                info(`token ${tokenId} ← ${fname}: ${previewImageStaging(path, compress, allowUnreadableOnchain(flags))}`);
             }
         }
         info(`approvals   ${approvals} wallet approval(s)`); // B2 — TX signatures only
@@ -2062,7 +2066,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
     console.log(`  ${bold(`abx refresh ${clone}`)}  ${dim('# nudge marketplaces once metadata is live')}\n`);
 }
 // ── deploy-series --copies: EditionImage ──────────────────────────────────────────────────────────
-// N distinct artworks (one per file, like a Series) × copies each. The edition twin of
+// N distinct works (one per file, like a Series) × copies each. The edition twin of
 // `cmdDeploySeriesBody`, kept as its OWN function for the same reason `cmdDeployOneOfOneEditionBody`
 // is (byte-identical 721 lane — see that function's module note).
 //
@@ -2176,7 +2180,7 @@ export async function cmdDeployEditionImageBody(flags, emit) {
         if (!hasPublicUrl || loopback) {
             const devAllow = process.env.ABX_DEV_ALLOW_LOCALHOST_URI === '1';
             const msg = `Off-chain metadata needs a PUBLIC resolver URL baked on-chain — ${hasPublicUrl ? baseUrl : 'localhost'} resolves for no one. ` +
-                `Pick a real path:\n    • Fully on-chain (SVG art):     --onchain-uri\n    • Hosted resolver:              --public-base-url https://your.domain`;
+                `Pick a real path:\n    • Fully on-chain (SVG content): --onchain-uri\n    • Hosted resolver:              --public-base-url https://your.domain`;
             if (!devAllow) {
                 if (dryRun)
                     warn(`would REFUSE to deploy — ${msg}`);
@@ -2194,8 +2198,8 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     const backendId = overrides.backend ?? process.env.ABX_STORAGE_BACKEND ?? 'fs';
     // Pattern 2 — image off-chain on a durable backend, JSON rendered on-chain, NOTHING to run. Ported
     // from the 721 Series twin, which has had it all along; `EditionImage` shipped without it, so a
-    // multi-artwork RASTER edition had no no-server option at all and `--onchain-uri` just refused the
-    // art. That pushed a cold agent into deploying one contract PER artwork to get permanence (B28).
+    // multi-work RASTER edition had no no-server option at all and `--onchain-uri` just refused the
+    // content. That pushed a cold agent into deploying one contract PER work to get permanence (B28).
     // Nothing on-chain needed changing: `EditionImageInitParams` already takes `contractFields`, and the
     // renderer's `url-template` substitutes `{id}` from whatever id it is called with — `uri(id)` on a
     // 1155 reaches it exactly as `tokenURI(id)` does on a 721.
@@ -2203,6 +2207,14 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     const offchainImageOnchainJson = onChainUri && !onchainImage && directUrlBackend;
     const backend = (offchainImageOnchainJson || (!onChainUri && !onchainImage)) && !dryRun ? resolveBackend(opts) : undefined;
     const tokenPaths = slots.map((s, i) => ({ tokenId: i, name: s, path: joinPath(dirPath, s) }));
+    // The render-gas gate on the dry run. Unlike the 721 Series twin this lane has no per-id
+    // `previewImageStaging` line to hang it off, so without this an oversized edition would only be
+    // refused once `buildFields` reached the first real staging call — i.e. after the chunk store was
+    // already deployed. Same per-id predicate either way (`guardOnChainSize` runs again during staging).
+    if (onchainImage && dryRun) {
+        for (const { name, path } of tokenPaths)
+            guardOnChainSize(statSync(path).size, name, allowUnreadableOnchain(flags));
+    }
     // Say WHICH backend holds the bytes, exactly as the 1/1 lane does. Both Series lanes resolved a
     // backend and never named it, so a creator asking for "images on IPFS" had no way to confirm from
     // the preview that their collection would actually pin there — the flag was accepted in silence.
@@ -2230,14 +2242,14 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     const tokenFields = [];
     // Collection-scope fields the image lane may add (the O(1) `url-template`). Kept separate from the
     // authorship fields and CONCATENATED at the params site — never assigned over them, or an
-    // `--artist`/`--license` value would silently vanish whenever pattern 2 is in play.
+    // `--creator`/`--license` value would silently vanish whenever pattern 2 is in play.
     let imageContractFields = [];
     const buildFields = async (stage) => {
         // Pattern 1: the bytes themselves on-chain, staged into the shared chunk store per id, each id's
         // field pointing at its manifest. Ported from the 721 Series twin — the edition lane refused this
         // outright before (B28), though nothing on-chain prevented it.
         if (onchainImage) {
-            const { fields } = await stageImageFieldsBatch(tokenPaths.map((s) => s.path), compress, stage, flags['chunk-store']);
+            const { fields } = await stageImageFieldsBatch(tokenPaths.map((s) => s.path), compress, stage, flags['chunk-store'], allowUnreadableOnchain(flags));
             tokenPaths.forEach(({ tokenId }, i) => tokenFields.push(tokenFieldOf(tokenId, fields[i])));
             if (seriesTraitsOnchain)
                 for (const [tokenId, attrs] of seriesTraits)
@@ -2296,13 +2308,13 @@ export async function cmdDeployEditionImageBody(flags, emit) {
                 const text = Buffer.from(bytes).toString('utf8');
                 if (!looksLikeSvg(text)) {
                     // Name the real alternatives, the way the 721 twin's version of this refusal does — a bare
-                    // "drop --onchain-uri" once sent a cold agent fanning a 3-artwork edition out into THREE
+                    // "drop --onchain-uri" once sent a cold agent fanning a 3-work edition out into THREE
                     // separate contracts to find permanence. The `--backend` route is now the first suggestion
                     // because it IS available on this lane (see `offchainImageOnchainJson` above).
-                    throw new Error(`--onchain-uri inlines SVG only; id ${tokenId} "${fname}" is ${contentType}. For raster art in ONE edition contract:\n` +
+                    throw new Error(`--onchain-uri inlines SVG only; id ${tokenId} "${fname}" is ${contentType}. For raster content in ONE edition contract:\n` +
                         `    • No server, images off-chain:  add --backend arweave (or ipfs/cloud) — the image URL is baked into the on-chain JSON\n` +
                         `    • Host the metadata yourself:   drop --onchain-uri and pass --public-base-url https://your.domain\n` +
-                        `    • Keep it SVG:                  supply SVG art and --onchain-uri inlines every id on-chain\n` +
+                        `    • Keep it SVG:                  supply SVG content and --onchain-uri inlines every id on-chain\n` +
                         `    • Bytes fully on-chain:         --onchain-image --compress fastlz (hot or --sign lane; --unsigned is refused)`);
                 }
                 tokenFields.push(tokenFieldOf(tokenId, imageInlineField(text)));
@@ -2319,7 +2331,7 @@ export async function cmdDeployEditionImageBody(flags, emit) {
             for (const [tokenId, attrs] of seriesTraits)
                 tokenFields.push(tokenFieldOf(tokenId, attributesInlineField(attrs)));
         // AFTER the per-id content actually validated — stating "resolves ON-CHAIN, no server" and then
-        // refusing the very art that was passed reads as the tool contradicting itself.
+        // refusing the very content that was passed reads as the tool contradicting itself.
         if (onChainUri) {
             info(`uri()/contractURI() resolve ON-CHAIN via the renderer — no resolver, no server, no localhost.`);
             if (!hasPublicUrl)
@@ -2360,7 +2372,7 @@ export async function cmdDeployEditionImageBody(flags, emit) {
             mintAmount,
             tokenFields,
             // Concatenate — the image lane's collection-scope url-template rides ALONGSIDE the authorship
-            // fields. Assigning either over the other would silently drop the creator's --artist/--license.
+            // fields. Assigning either over the other would silently drop the creator's --creator/--license.
             contractFields: [...authorshipContractFields(flags), ...imageContractFields],
         };
         return { clone, params, salt };
@@ -2519,8 +2531,40 @@ export async function cmdDeployEditionImageBody(flags, emit) {
  *                      (`putDirectory`; ipfs/arweave), its root as the `code` field
  *
  * Schemas: --schema key:Type:Auth[,key:Type:Auth…] (e.g. palette:HexColor:TokenOwner).
- * Seeds: canonical randomizer by default; --no-seed opts out.
+ * Seeds: the canonical pseudorandom seed source by default; --no-seed opts out.
+ */
+/**
+ * The one honest sentence about the canonical seed, printed beside the `seed source` line in the
+ * deploy plan — the moment a creator is choosing it, not an appendix. `AbxSeedSource` is
+ * pseudorandom from on-chain values: replayable after the mint (what makes generative output
+ * verifiable) and computable *during* it, so a buyer can decline an outcome for the price of gas.
+ * That rules out anything lottery-like; the escape hatch is a per-project address, so we name it —
+ * and now name it as the FLAG it is (`--seed-source 0x…`), not as an env var, because the flag is
+ * probed and the whole point of naming an escape hatch is that a creator can actually reach it.
+ */
+const seedHonestyNote = '  pseudorandom — replayable after the mint, computable DURING it (a buyer can decline an outcome).\n' +
+    '      Right for diversifying output; NOT strong enough for a raffle or prize draw — for that, pass\n' +
+    '      --seed-source 0x… pointing at your own IAbxSeedSource over commit-reveal or a VRF oracle\n' +
+    '      (a per-project swap, not a fork). Change it later with `abx set-seed-source`.';
+/**
+ * The `seed source` line of a deploy plan, for both code lanes. Three states, three different
+ * sentences — the honesty note describes `AbxSeedSource`'s OWN properties, so printing it beside a
+ * stranger's contract would be us vouching for randomness we have never seen.
  */
+function printSeedSourcePlan(seedSource, chainId) {
+    if (seedSource === zeroAddress) {
+        info('seed source: none (--no-seed / not configured)');
+        return;
+    }
+    if (seedSource.toLowerCase() === canonicalSeedSource(chainId).toLowerCase()) {
+        info(`seed source: ${seedSource} ${dim('(canonical AbxSeedSource)')}`);
+        info(seedHonestyNote);
+        return;
+    }
+    info(`seed source: ${seedSource} ${dim('— CUSTOM (yours, not the canonical AbxSeedSource)')}`);
+    info('  probed: it answers seed(uint256,address) with 32 bytes. Its randomness properties are YOURS to\n' +
+        '      state to buyers — ABX makes no claim about them, and the honesty note above does not apply.');
+}
 // ── the demo walkthrough: teaching sections, demo-only ────────────────────────
 //
 // `abx demo` is a TEACHING command, not a shortcut — the docs point a first-time reader here to
@@ -2608,7 +2652,7 @@ export async function walkthroughRebuild(indexer, address, before) {
  * Which is genuinely a different act per lane, so it reads from the real source in each case rather
  * than always going through the local server:
  *   • fully on-chain → call `tokenURI(0)` on the contract. That IS what a marketplace does, and on
- *     this lane the whole answer (art included) comes back from the chain with nothing else running.
+ *     this lane the whole answer (content included) comes back from the chain with nothing else running.
  *   • off-chain custody → fetch the resolver, because that's what the baked URI points at.
  * Reading the on-chain lane over HTTP would have quietly implied the local server was load-bearing
  * when it isn't — the opposite of the lesson.
@@ -2635,9 +2679,9 @@ export async function walkthroughReadBack(state, baseUrl, onChainUri) {
                 const img = typeof parsed.image === 'string' ? parsed.image : '';
                 console.log(`    ${g('✓')} came back with: ${bold(String(parsed.name ?? '(no name)'))}`);
                 console.log(`      ${dim(`image: ${img.slice(0, 48)}${img.length > 48 ? '…' : ''}`)}`);
-                // The punchline of the whole lane: a data: URI means the art travelled IN the answer.
+                // The punchline of the whole lane: a data: URI means the work travelled IN the answer.
                 if (img.startsWith('data:'))
-                    info(`${g('the art itself came back in that answer')} ${dim('— no link to follow, nothing to go missing')}`);
+                    info(`${g('the work itself came back in that answer')} ${dim('— no link to follow, nothing to go missing')}`);
             }
             else {
                 console.log(`    ${dim(uri.slice(0, 160))}${uri.length > 160 ? dim('…') : ''}`);
@@ -2674,12 +2718,12 @@ export async function walkthroughReadBack(state, baseUrl, onChainUri) {
 export const DEPLOY_CODE_FLAGS = new Set([
     // content + collection identity
     'script', 'code-dir', 'name', 'symbol', 'description', 'external-url', 'description-onchain',
-    ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag), // artist · display-notes · artist-links · license
+    ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag), // creator · display-notes · creator-links · license
     'image-base', 'attributes-renderer', 'image-renderer',
     // supply + mint + economics
     'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
     // params + dependencies
-    'schema', 'no-seed', 'no-delegation', 'dep', 'dep-registry',
+    'schema', 'no-seed', 'seed-source', 'no-delegation', 'dep', 'dep-registry',
     // serving lane
     'public-base-url', 'onchain-uri', 'generator', 'renderer', 'port',
     // storage (directory mode) — mirrors storageOverrides()
@@ -2701,7 +2745,7 @@ export const SHARED_DEPLOY_FLAGS = [
 // A 1/1 `abx deploy` accepts these (see `abx help deploy`). Anything else warns (typo'd/unsupported).
 export const DEPLOY_FLAGS = new Set([
     'image', 'name', 'symbol', 'type', 'description', 'description-onchain', 'external-url', 'traits', 'traits-onchain', 'attributes',
-    'onchain-uri', 'onchain-image', 'compress', 'royalty-bps', 'no-mint',
+    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'royalty-bps', 'no-mint',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     ...SHARED_DEPLOY_FLAGS,
 ]);
@@ -2709,7 +2753,7 @@ export const DEPLOY_FLAGS = new Set([
 export const DEPLOY_SERIES_FLAGS = new Set([
     'dir', 'count', 'name', 'symbol', 'description', 'external-url', 'royalty-bps', 'attributes', 'traits-onchain',
     'no-mint', 'mint-all', 'mint-count', 'unpaused', 'minter', 'primary-payee',
-    'onchain-uri', 'onchain-image', 'compress', 'chunk-store',
+    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'chunk-store',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     ...SHARED_DEPLOY_FLAGS,
 ]);
@@ -2743,7 +2787,7 @@ export async function cmdDeployCodeBody(flags, emit) {
     const usage = 'abx deploy-code (--script <file> | --code-dir <dir>) --name "Title" --symbol SYM ' +
         '(--public-base-url https://your.resolver.domain | --onchain-uri) ' +
         '[--description "<s>"] [--external-url <url>] [--image-base <url> | --image-renderer 0x..] [--attributes-renderer 0x..] ' +
-        '[--max N] [--mint-count N | --mint-all] [--schema key:Type:Auth,…] [--no-seed] ' +
+        '[--max N] [--mint-count N | --mint-all] [--schema key:Type:Auth,…] [--no-seed | --seed-source 0x..] ' +
         '[--dep <name@version|0x..>[,…]] [--dep-registry 0x..] ' +
         '[--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--721c recommended|0x..] [--backend ipfs|arweave] [--dry-run] [--confirm] [--bootstrap-factory]';
     const scriptPath = flags.script;
@@ -2835,11 +2879,7 @@ export async function cmdDeployCodeBody(flags, emit) {
     else {
         factory = await ensureSeriesCodeFactory(publicClient, flags.factory, !!flags['bootstrap-factory']);
     }
-    const seedSource = flags['no-seed'] !== undefined
-        ? zeroAddress
-        : dryRun
-            ? (resolveSeedSource(chainId) ?? zeroAddress)
-            : await ensureSeedSource(publicClient);
+    const seedSource = await resolveSeedSourceFlag(flags, publicClient, dryRun, chainId);
     // --onchain-uri: resolve the two canonical singletons the lane points at. The generator is
     // per-chain infrastructure (constructor-wired to the dependency registry, the abx.js/gunzip
     // runtime pointers, and default gateways), so it is NEVER auto-deployed — a chain without one
@@ -2890,6 +2930,13 @@ export async function cmdDeployCodeBody(flags, emit) {
     // schemas: key:Type:Auth (comma-separated), Type carrying optional Select options / Range bounds
     // (Select[A|B|C], Uint256Range[0..100], …) → key, enum indices, bytes32 min/max, selectOptions.
     const schemas = parseSchemaSpecs(flags.schema);
+    // Say it where the decision is made, not in a doc the creator may never open: on an edition, a
+    // holder-writable param is SHARED by every holder of that id. See `editionSchemaAdvisory`.
+    if (flags.copies !== undefined) {
+        const advisory = editionSchemaAdvisory(schemas);
+        if (advisory)
+            warn(advisory);
+    }
     // Dependencies: ordered `--dep` refs (repeatable / comma-separable) — index 0 = the runtime,
     // by convention. `name@version` ⇒ Resolution.Registry (resolved through the soft registry
     // pointer); `0x…` ⇒ Resolution.OnChain (a raw data contract, no registry involved). The legs
@@ -2969,7 +3016,7 @@ export async function cmdDeployCodeBody(flags, emit) {
     }
     else {
         // Renderer-only (in-chain SVG): no program to chunk — the image/attributes are Solidity field
-        // renderers. Nothing rides SSTORE2; the whole artwork is computed on-chain per view.
+        // renderers. Nothing rides SSTORE2; the whole work is computed on-chain per view.
         contentSummary = 'no program — image + traits computed on-chain by Solidity field renderers';
         ok(contentSummary);
     }
@@ -2994,14 +3041,14 @@ export async function cmdDeployCodeBody(flags, emit) {
         contractFields.push({ field: encodeTag(F.externalUrl), representation: encodeTag(R.inline), value: toHex(String(flags['external-url'])) });
         identityFields.push('external_url');
     }
-    // authorship + rights — same on-chain inline collection-field slot (artist / license / …).
+    // authorship + rights — same on-chain inline collection-field slot (creator / license / …).
     contractFields.push(...authorshipContractFields(flags));
     for (const [flag, field] of AUTHORSHIP_DEPLOY_FIELDS)
         if (flags[flag])
             identityFields.push(field);
     // --image-renderer: bake the on-chain `image` field to a `renderer` representation — the SVG is
     // COMPUTED on-chain by a Solidity IAbxFieldRenderer (e.g. a SeedSvgRenderer fork) from the token's
-    // seed + params. THE in-chain-art lane: the marketplace still lives in tokenURI itself — no bucket,
+    // seed + params. THE in-chain-renderer lane: the marketplace still lives in tokenURI itself — no bucket,
     // no effect runner, no resolver. Mutually exclusive with --image-base (both set `image`). Verified
     // like --attributes-renderer: a real deploy REFUSES a codeless address; dry-run probes best-effort.
     if (flags['image-renderer']) {
@@ -3210,7 +3257,15 @@ export async function cmdDeployCodeBody(flags, emit) {
     // TOKENURI PUBLIC-READ GAS — a large --onchain-uri document assembles on-chain per call; an
     // unauthenticated public read (Etherscan "Read Contract" with no wallet connected) can hit a client
     // gas cap and appear to REVERT. Expected, not a bug — a real session mis-diagnosed it as indexing lag.
-    const tokenUriGasRisk = onChainUri && !codeDir && (scriptAnalysis?.doc.estBytes ?? 0) > 30_000;
+    //
+    // Same threshold as the staged-bytes gate (`ONCHAIN_READ_WARN_BYTES`), since it is the same measured
+    // cost: `tokenURI` string-building runs ~360-405k gas per KB of assembled document (superlinear — the
+    // rate climbs with size). This one only WARNS
+    // where the staged-bytes path refuses, and deliberately so: `estBytes` is an ESTIMATE (a dependency
+    // of unknown size is undercounted — see `unknownDepSizes`), and a registry-hosted library like p5 is
+    // legitimately ~200KB on its own, so the honest move is to name the cost and point at the piecewise
+    // getters rather than to block a shipped lane on a heuristic.
+    const tokenUriGasRisk = onChainUri && !codeDir && (scriptAnalysis?.doc.estBytes ?? 0) >= ONCHAIN_READ_WARN_BYTES;
     // --onchain-uri legs (ride the setup multicall, before the mints): the animation_url field
     // pointing at the generator, and the two URI renderers. The param surface needs NO leg — the
     // generator enumerates it from the token on-chain (`contractParamKeys`/`tokenParamKeys`, kept in
@@ -3298,7 +3353,7 @@ export async function cmdDeployCodeBody(flags, emit) {
         if (!flags.description)
             warn(`no --description — the on-chain metadata ships with no description (the one creators most often forget). Add --description "…" or deploy bare.`);
         info(`content: ${contentSummary}`);
-        info(`seed source: ${seedSource === zeroAddress ? 'none (--no-seed / not configured)' : seedSource}`);
+        printSeedSourcePlan(seedSource, chainId);
         info(`PostParam schema(s): ${schemaSummary}`);
         info(`dependencies: ${deps.length ? deps.map((d, i) => `[${i}] ${d.display}`).join(' · ') + ` — ${deps.length} setDependency leg(s)` : 'none'}` +
             (depRegistry ? ` + setDependencyRegistry → ${depRegistry}` : hasRegistryDeps ? ' (no registry pointer — see the warning above)' : ''));
@@ -3335,7 +3390,9 @@ export async function cmdDeployCodeBody(flags, emit) {
             else
                 info(`  ${dim('nothing to run — image + traits are on-chain; a resolver is neither needed nor a benefit here.')}`);
             if (tokenUriGasRisk) {
-                info(`  ${dim('public-read note:')} this ${Math.round((scriptAnalysis?.doc.estBytes ?? 0) / 1000)}KB doc assembles on-chain per call, so an ${bold('unauthenticated read on Etherscan')} ("Read Contract", no wallet connected) may hit its gas cap and appear to ${bold('REVERT')} — ${dim('EXPECTED, not a broken token and NOT an indexing issue. Verify with `abx tokenuri`, or connect a wallet / use a high-gas RPC. Do not run `abx index --full` to "fix" it.')}`);
+                const docKb = Math.round((scriptAnalysis?.doc.estBytes ?? 0) / 1024);
+                info(`  ${dim('public-read note:')} this ~${docKb}KB doc assembles on-chain per call — ${bold(`~${Math.round(tokenUriGasEstimate(scriptAnalysis?.doc.estBytes ?? 0) / 1_000_000)}M gas per tokenURI`)} at the measured ~360-405k gas/KB (climbing with size). An ${bold('unauthenticated read on Etherscan')} ("Read Contract", no wallet connected) may hit its gas cap and appear to ${bold('REVERT')} — ${dim('EXPECTED, not a broken token and NOT an indexing issue. Verify with `abx tokenuri`, or connect a wallet / use a high-gas RPC. Do not run `abx index --full` to "fix" it.')}`);
+                info(`  ${dim('these are OFF-CHAIN view reads by design:')} past a node\'s cap, a client assembles from the generator\'s piecewise getters instead of one call — ${dim('`document`, `tokenDataJson`, `dependencyTag`, `abxJs`, `gunzipScript`, `registryScriptChunk`. No contract can call tokenURI inside a transaction at this size; nothing on-chain depends on it.')}`);
             }
         }
         else {
@@ -3849,7 +3906,7 @@ export async function cmdDeployCodeBody(flags, emit) {
 //   • `--code-dir` (directory-build code drops) — not ported; use `--script`.
 //   • `--dep` / `--dep-registry` (declared code dependencies) — not ported; ship a self-contained
 //     script (the skill already recommends zero-dependency vanilla JS as the cleanest option).
-//   • `--image-renderer` / `--attributes-renderer` / `--image-base` (the in-chain-Solidity-art and
+//   • `--image-renderer` / `--attributes-renderer` / `--image-base` (the in-chain-Solidity-renderer and
 //     deterministic-off-chain-thumbnail lanes) — not ported.
 //   • `--no-delegation` — refused outright: EditionCode has no TokenOwner-leg delegation to opt out
 //     of (its auth leg generalizes to "any holder", per the parity plan's ConfigurableParams note).
@@ -3861,7 +3918,7 @@ export const DEPLOY_CODE_EDITION_FLAGS = new Set([
     'script', 'name', 'symbol', 'description', 'external-url', 'description-onchain',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     'max', 'mint-count', 'mint-all', 'no-mint', 'mint-amount', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
-    'schema', 'no-seed',
+    'schema', 'no-seed', 'seed-source',
     'public-base-url', 'onchain-uri', 'generator', 'renderer', 'port',
     'sign', 'unsigned', 'for', 'salt', 'factory', 'bootstrap-factory', 'sign-url-file',
     'dry-run', 'confirm', 'yes', 'json', 'copies',
@@ -3875,7 +3932,7 @@ export const DEPLOY_CODE_EDITION_FLAGS = new Set([
 export async function cmdDeployEditionCodeBody(flags, emit) {
     const usage = 'abx deploy-code --copies <n|open> --script <file> --name "Title" --symbol SYM (--public-base-url https://your.resolver.domain | --onchain-uri) ' +
         '[--description "<s>"] [--external-url <url>] [--max N] [--mint-count N | --mint-all] [--mint-amount N] ' +
-        '[--schema key:Type:Auth,…] [--no-seed] [--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--721c recommended|0x..]';
+        '[--schema key:Type:Auth,…] [--no-seed | --seed-source 0x..] [--unpaused] [--minter 0x..] [--primary-payee 0x..] [--royalty-bps N] [--721c recommended|0x..]';
     refuseStrayFlags(flags, DEPLOY_CODE_EDITION_FLAGS, 'deploy-code');
     warnSignWithoutFor(flags);
     const editionSize = parseCopies(flags.copies);
@@ -3957,11 +4014,7 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
     else {
         factory = await ensureEditionCodeFactory(publicClient, flags.factory, !!flags['bootstrap-factory']);
     }
-    const seedSource = flags['no-seed'] !== undefined
-        ? zeroAddress
-        : dryRun
-            ? (resolveSeedSource(chainId) ?? zeroAddress)
-            : await ensureSeedSource(publicClient);
+    const seedSource = await resolveSeedSourceFlag(flags, publicClient, dryRun, chainId);
     let generator = zeroAddress;
     let metadataRenderer = zeroAddress;
     if (onChainUri) {
@@ -3986,6 +4039,13 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
             info('off-chain fallback pointer left empty (the renderer is authoritative); set --public-base-url to bake one anyway.');
     }
     const schemas = parseSchemaSpecs(flags.schema);
+    // Say it where the decision is made, not in a doc the creator may never open: on an edition, a
+    // holder-writable param is SHARED by every holder of that id. See `editionSchemaAdvisory`.
+    if (flags.copies !== undefined) {
+        const advisory = editionSchemaAdvisory(schemas);
+        if (advisory)
+            warn(advisory);
+    }
     // Dependencies — same shape as the 721 SeriesCode twin (see its block for the full reasoning).
     // `EditionCode` already inherits the `Dependencies` extension and calls `_initDependencies()`, and
     // the legs are the same `setDependency`/`setDependencyRegistry` calls on the same ABI, so this was
@@ -4149,7 +4209,7 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
             info(`deterministic address: ${shownAddr}`);
         info(`name "${name}" · symbol ${symbol} · max ${max} id(s) · royalty ${royaltyBps / 100}%`);
         info(`content: script ${bytes.length} bytes → ${scriptChunks.length} on-chain chunk(s)`);
-        info(`seed source: ${seedSource === zeroAddress ? 'none (--no-seed / not configured)' : seedSource}`);
+        printSeedSourcePlan(seedSource, chainId);
         info(`PostParam schema(s): ${schemas.length ? schemas.map((s) => describeSchema(s)).join(', ') : 'none'}`);
         info(`mint: ${mintCount > 0 ? `${mintCount} id(s) × ${mintAmount} cop${mintAmount === 1n ? 'y' : 'ies'} → ${deployer ?? 'your wallet'} at deploy` : 'deferred (mint later / external minter)'}`);
         info(`transactions: 2 — deploy + setup multicall (script chunks${schemas.length ? ' + schemas' : ''}${onChainUri ? ' + on-chain URI wiring' : ''}${mintCount > 0 ? ' + reserve mints' : ''})`);
@@ -4243,26 +4303,28 @@ export async function resolveTransferValidatorFlag(flags, publicClient, dryRun,
         return zeroAddress;
     const chainId = resolveChain(CHAIN).id;
     const validator = parseTransferValidatorValue(raw, { chainId, chainLabel: CHAIN });
-    // Has-code precheck — for the recommended constant too (presence on THIS chain is the fact that
-    // matters; a sandbox/private chain won't have it). A dry run tolerates an unreachable RPC (it
-    // sends nothing); a real deploy refuses to enroll blind.
-    let code;
-    try {
-        code = await publicClient.getCode({ address: validator });
-    }
-    catch (err) {
+    // Usability precheck — for the recommended constant too (presence on THIS chain is the fact that
+    // matters; a sandbox/private chain won't have it). This asks the same question the factory asks:
+    // has code AND is not a permissive fallback that would enforce nothing (a Safe, an uninitialised
+    // proxy, a 7702-delegated EOA all pass a bare has-code check and then wave every transfer
+    // through). A dry run tolerates an unreachable RPC (it sends nothing); a real deploy refuses to
+    // enroll blind.
+    const probe = await probeTransferValidator(publicClient, validator);
+    if (probe.verdict === 'unreachable') {
         if (!dryRun)
-            throw new Error(`--721c: couldn't verify the validator has code at ${validator} (${err.message}) — refusing to enroll blind; retry when the RPC answers.`);
-        code = null; // offline preview — note it below
+            throw new Error(`--721c: couldn't verify the validator at ${validator} (${probe.error ?? 'RPC did not answer'}) — refusing to enroll blind; retry when the RPC answers.`);
+        info(dim(`--721c: RPC unreachable, so the validator check is deferred — a real deploy verifies ${validator} is a usable validator first.`));
     }
-    if (code === null) {
-        info(dim(`--721c: RPC unreachable, so the validator code check is deferred — a real deploy verifies ${validator} has code first.`));
-    }
-    else if (!code || code === '0x') {
+    else if (probe.verdict !== 'ok') {
         const rec = resolveRecommendedTransferValidator(chainId);
-        throw new Error(`--721c: no contract code at ${validator} on ${CHAIN} — the deploy would revert InvalidTransferValidator(). ` +
-            `A transfer validator must be a DEPLOYED contract on this chain` +
-            (rec && rec !== validator ? ` (the known-good one: --721c recommended → ${rec})` : '') + `.`);
+        const recHint = rec && rec !== validator ? ` (the known-good one: --721c recommended → ${rec})` : '';
+        throw new Error(probe.verdict === 'no-code'
+            ? `--721c: no contract code at ${validator} on ${CHAIN} — the deploy would revert InvalidTransferValidator(). ` +
+                `A transfer validator must be a DEPLOYED contract on this chain${recHint}.`
+            : `--721c: ${validator} has code on ${CHAIN}, but it is not a transfer validator — it answers ANY function call ` +
+                `successfully (a Safe, an uninitialised proxy, or a 7702-delegated EOA does this), so every transfer would ` +
+                `silently pass validation while ERC-165 and getTransferValidator() reported enforcement as ON. The factory ` +
+                `refuses it too (InvalidTransferValidator()). Pass a real validator contract${recHint}, or drop --721c.`);
     }
     // The one plain statement — printed once, only when enrolling. Never appears un-enrolled.
     info(validator === resolveRecommendedTransferValidator(chainId)
@@ -4270,4 +4332,79 @@ export async function resolveTransferValidatorFlag(flags, publicClient, dryRun,
         : `ERC-${standard}: every non-mint transfer is checked by validator ${validator} — its policy decides which operators may transfer. Manage with \`abx set-transfer-validator\`.`);
     return validator;
 }
+/**
+ * Resolve the three-way seed decision into the InitParams `seedSource`, for both code lanes:
+ *
+ *   - `--no-seed`               → `zeroAddress`. No mint-time seed at all.
+ *   - nothing, or `canonical`   → the canonical `AbxSeedSource` via `ensureSeedSource` (manifest →
+ *                                 self-heal to the deterministic address → CREATE2-deploy it). This
+ *                                 is today's behaviour, byte-for-byte, and stays the default.
+ *   - `--seed-source 0x…`       → the creator's own `IAbxSeedSource`, **probed first**.
+ *
+ * The flag exists because we tell creators, in the docs and in this command's own help, that the fix
+ * for "the canonical seed isn't strong enough for my raffle" is to point `seedSource` at a
+ * commit-reveal / VRF-backed source of their own. Until now the only route was an `ABX_SEED_SOURCE`
+ * env var checked for nothing but code length, which made a first-class promise out of a
+ * side entrance.
+ *
+ * **Everything that isn't the canonical singleton gets probed**, including an address that arrived
+ * via `ABX_SEED_SOURCE` — so the env lane keeps working and stops being the unchecked one. The
+ * comparison is against the deterministic canonical address rather than "did a flag say so", because
+ * that is the actual question (is this our audited bytecode, or someone's contract we know nothing
+ * about?). A dry run tolerates an unreachable RPC and says the check is deferred; a real deploy
+ * refuses to bake a seed source it couldn't verify.
+ *
+ * The probe here runs with **no `from`**, unlike the owner op's (which calls as the token). That is
+ * not an oversight: the clone's address is a function of the CREATE2 salt, which isn't reserved yet
+ * at this point, so a source that gates on `msg.sender` could not have been told about this token in
+ * the first place. A gated/commit-reveal source is a deploy-then-`abx set-seed-source` flow by
+ * construction, and the `reverted` refusal says exactly that.
+ */
+export async function resolveSeedSourceFlag(flags, publicClient, dryRun, chainId) {
+    const raw = flags['seed-source'];
+    // `--resume` finishes an EXISTING contract, and the seed source is an InitParams field — fixed at
+    // creation, never in the setup multicall this replays. So there is nothing here to resolve, probe,
+    // or (worse) lazily DEPLOY. Not a refusal: `--resume`'s own contract is "pass the same content
+    // flags", so the creator's original command legitimately still carries `--no-seed`/`--seed-source`.
+    // Say plainly that it's read from chain, and name the verb that can actually change it.
+    if (flags.resume !== undefined) {
+        if (raw !== undefined || flags['no-seed'] !== undefined) {
+            info(dim(`--resume: the seed source was fixed when ${flags.resume} was created, so ${raw !== undefined ? '--seed-source' : '--no-seed'} has nothing to write here ` +
+                `(it isn't part of the setup transaction being replayed). Read it with \`abx state\`; change it with \`abx set-seed-source\`.`));
+        }
+        return zeroAddress; // unused by the resume legs
+    }
+    if (flags['no-seed'] !== undefined) {
+        // Two flags, one field. Refuse rather than pick a winner — a creator who passed both has a
+        // belief about the outcome, and either answer betrays half of them.
+        if (raw !== undefined) {
+            throw new Error('--no-seed and --seed-source contradict each other: one says "no mint-time seed at all", the other names where the seed comes from. Drop one.');
+        }
+        return zeroAddress;
+    }
+    const canonical = canonicalSeedSource(chainId);
+    const requested = raw === undefined ? canonical : parseSeedSourceValue(raw, { chainId });
+    // The canonical singleton keeps its existing bootstrap path (deploy it if this chain lacks one).
+    // Anything else must already exist — we never deploy a stranger's contract.
+    const same = (a, b) => a.toLowerCase() === b.toLowerCase();
+    let seedSource;
+    if (same(requested, canonical)) {
+        seedSource = dryRun ? (resolveSeedSource(chainId) ?? zeroAddress) : await ensureSeedSource(publicClient);
+    }
+    else {
+        seedSource = requested;
+    }
+    if (seedSource === zeroAddress || same(seedSource, canonical))
+        return seedSource;
+    // Custom source (flag or ABX_SEED_SOURCE) — ask it the question the mint will ask.
+    const probe = await probeSeedSource(publicClient, seedSource);
+    if (probe.verdict === 'unreachable' && dryRun) {
+        info(dim(`--seed-source: RPC unreachable, so the seed-source probe is deferred — a real deploy verifies ${seedSource} answers seed(uint256,address) with 32 bytes first.`));
+        return seedSource;
+    }
+    if (probe.verdict !== 'ok')
+        refuseUnusableSeedSource(probe, { flag: raw === undefined ? 'ABX_SEED_SOURCE' : '--seed-source', chainLabel: CHAIN });
+    info(`seed source: CUSTOM ${seedSource} ${dim('— answers seed(uint256,address) with 32 bytes (probed). Its randomness properties are yours to state to buyers; ABX makes no claim about them.')}`);
+    return seedSource;
+}
 //# sourceMappingURL=deploy.js.map