@artblocks/abx-cli 0.1.0-alpha.26 → 0.1.0-alpha.28

package/CHANGELOG.md

@@ -1,5 +1,184 @@
 # @artblocks/abx-cli
 
+## 0.1.0-alpha.28
+
+### Patch Changes
+
+- 84ca9dd: Off-chain fixes from the 2026-08-19 production-readiness audit
+  (`reviews/2026-08/production-readiness-audit.md`). All are off-chain — no contract changed and no
+  address moved; the three NatSpec-precision items the audit also raised ride the next redeploy batch
+  instead (`docs/10-backlog.md` → _Contracts — the next redeploy batch_, B47).
+
+  **SDK — `HexColor` decode now masks to 24 bits, matching the chain (L-1).** `decodeScalarParam` for a
+  `HexColor` value greater than `0xFFFFFF` returned `#1ffffff` (7+ hex digits); the on-chain
+  `TokenDataLib.decodeScalar` masks with `& 0xffffff` and returns `#ffffff`. The governed write validates
+  `v <= 0xFFFFFF`, but the raw owner setter does not, so an out-of-domain value can be stored and later
+  governed by a `HexColor` schema — and the two serving planes would then decode it differently, splitting
+  `inputsHash`. The SDK now masks identically. Pinned on both sides so it cannot drift again:
+  `decodeScalarParam('HexColor', 0x1ffffffn) === '#ffffff'` (SDK) and the twin `test_DecodeScalars`
+  assertion in `contracts/test/FieldRenderer.t.sol`.
+
+  **SDK — gateway-prefix projection no longer trims (L-7).** `projectGatewayPrefix` dropped the `.trim()`
+  on the on-chain `abx_gateway_*` value: the deployed `_gatewayPrefix` returns the stored bytes verbatim,
+  so trimming here made the two planes disagree on a whitespace-padded prefix. The field store rejects an
+  empty value, so a set field is always non-empty. Clean prefixes (every real one) are unaffected.
+
+  **SDK — `permissionlessSalt` docstring hardened (L-3).** Now states explicitly: never use it for a
+  pre-published or pre-funded address — a third party can occupy the predicted address first with their own
+  `InitParams`. For any reserved address, use `saltFor` (its deployer-bound prefix is front-run-proof). No
+  behavior change; the shipped CLI/skill already deploy through `saltFor`.
+
+  **CLI — the edition schema advisory calls out a holder-writable `seed` by name (L-2).**
+  `editionSchemaAdvisory` already warned that a `TokenOwner` param on an edition is shared per-id
+  (last-writer-wins); it now adds a sharper note when that param is `seed`, because the normally-immutable
+  generative seed becomes re-rollable by _any_ holder of the id — changing the artwork for every
+  co-holder. The on-chain behavior is deliberately unchanged (the reassignable-seed feature is
+  buyer-verifiable via `paramSchema("seed")`); the guardrail is this warning, not a contract restriction.
+  A controller contract on the `Address` leg remains the way to govern it.
+
+- 84ca9dd: Finish the burn + royalty-cap surfacing, from the 2026-08-20 w6 agent sandbox sweep. All off-chain —
+  no contract changed, no address moved; the on-chain features were verified working end to end (a cold
+  agent deployed `--burnable --royalty-cap 42`, minted, burned, and proved the cap enforced on Sepolia).
+  The sweep's convergent finding was that the two new **permanent** deploy-time decisions were invisible
+  after you set them; this makes them visible everywhere they're decided or read, and adds the owner's
+  missing reduce lever.
+
+  - **New: `abx set-royalty-cap <address> --cap <0-10000>`** — the owner's reduce-only royalty-ceiling
+    lever (`RoyaltyExtension.reduceMaxRoyaltyBps`), the "after" the deploy-time "reduce-only after"
+    promise never had. Both ways the chain refuses are checked locally before signing: a value that
+    wouldn't decrease (`RoyaltyCapNotReduced`) or that would drop below the live royalty rate
+    (`RoyaltyCapBelowRoyalty`). SDK: `prepareReduceMaxRoyaltyBps`.
+  - **The deploy readout now shows `royalty cap` and `burnable` on every lane** (1/1, series, code, and
+    all three edition twins), whenever set. Critically it flags an **auto-raised** cap
+    (`royalty cap 25% (auto-raised to fit the royalty)`): omitting `--royalty-cap` while setting a
+    royalty above 10% silently raises the permanent ceiling to match, which was previously invisible.
+  - **`abx state` now surfaces `royaltyCap` and `burnable`** (human + `--json`), the post-deploy
+    verification surface, for both the 721 and edition readouts.
+  - **The skill documents the royalty cap** — the identity decision (`decisions.md`), the confirm-
+    identity step (`SKILL.md`), and a new `set-royalty-cap` owner-op row (`operating.md`); previously the
+    reduce-only ceiling feature had zero skill coverage.
+  - **Help/doc corrections:** `set-royalty --help` range `0-1000`→`0-10000` (stale from the hard-cap
+    era); `deploy-series --help` now lists `--royalty-cap`/`--burnable`; `deploy --help` states the cap
+    auto-raises; `abx inspect`'s trait-feasibility deep-dive points at public docs, not a repo path.
+
+- Updated dependencies [84ca9dd]
+- Updated dependencies [84ca9dd]
+  - @artblocks/abx-sdk@0.1.0-alpha.20
+  - @artblocks/abx-indexer@0.1.0-alpha.21
+  - @artblocks/abx-storage@0.1.0-alpha.20
+  - @artblocks/abx-token-api@0.1.0-alpha.23
+
+## 0.1.0-alpha.27
+
+### Patch Changes
+
+- b1c333d: **Asking for a 15% royalty built a transaction that reverted on chain.** `RoyaltyExtension` caps every
+  ABX token at **1000 bps (10%)** and reverts `RoyaltyTooHigh()` above it, and no token type overrides that.
+  But client-side validation allowed the full ERC-2981 `0–10000` range — and the CLI's own error text
+  offered `10000 = 100%` as a worked example. So a creator asking for an ordinary 15% got a fully built,
+  fully signed transaction that failed on chain; on the wallet lane they approved it in their own wallet
+  and paid the gas to find out. Both usage strings said `<0-10000>`, and so did two public docs.
+
+  Now `MAX_ROYALTY_BPS` (SDK) mirrors the contract ceiling and both `prepareSetRoyalty` and the CLI's
+  `parseRoyaltyBps` validate against it, so the refusal is instant, local and free, and it names the cap
+  and the revert. Regression tests cover it from both sides — including `1500`, the value that used to
+  sail through. Two existing tests had to be corrected: they asserted the 0–10000 bound, which is how this
+  survived.
+
+  Three more surfaces that contradicted themselves or the chain:
+
+  - **`abx ping-uri --help` claimed "Permissionless by design … ANY signer may call it (no owner check)"
+    four lines below its own `OWNER-ONLY` header** — and `Uri1155.pingURI` is `onlyOwner`. A non-owner
+    following the paragraph built a reverting tx.
+  - **`site/content/docs/reference/contracts.mdx`** described the pre-audit library architecture: it omitted
+    `AbxMetadataLib` (the fourth delegatecalled library, and the one linked by **all six** token types, not
+    three) and still said `SeriesCode` "rides the ceiling", where `deployments.mdx` — written after the same
+    redeploy — says both code types now sit under EIP-170 with room to spare.
+  - **`deployments.mdx`'s own `specVersion()` example printed `# → 10`** under a table declaring the renderer
+    spec v11. And **`operate.mdx`'s self-correction had rotted**: it warned that `abx refresh`'s advisory was
+    stale about editions and ERC-4906, but that advisory was fixed — the doc was now the stale one.
+
+  Found by two read-only audits (29 doc files, 19 spec files) that verified every claim against contracts,
+  compiled ABIs, SDK and live `--help` output before reporting. Both independently re-confirmed the
+  no-burn property, the v11 gateway design, all ~26 canonical addresses, and the on-chain storage
+  thresholds.
+
+- b1c333d: **Every deploy lane accepted a royalty the chain would refuse.** `set-royalty` was fixed to validate
+  against the contract's 10% cap, but all six deploy paths (`deploy`, `deploy-series`, `deploy-code` and
+  their edition twins) still did a bare `Number(flags['royalty-bps'] ?? 500)` with no bound at all. So
+  `--royalty-bps 1500` built the whole deploy, printed **`royalty 15%`** in the confirmation readout — a
+  promise the chain will not keep — and reverted `RoyaltyTooHigh()` on send. That is the worse half of the
+  bug: the deploy is the expensive transaction, and on the wallet lane the creator approves it first.
+
+  All six now route through the same `parseRoyaltyBps` the owner op uses, so an over-cap value is refused
+  locally, for free, with the cap and the revert named.
+
+  **`abx doctor`'s pruned-history warning is now order-aware.** It fired for any reachable endpoint that
+  cannot serve archive-depth logs, even when a healthy archive endpoint sat ahead of it in the list and would
+  answer every deep scan. Three eval rooms independently called it noise — one said it was "a poor first
+  impression for an already-nervous creator". The hazard it exists for is real but specifically about
+  _ordering_: the fallback transport rotates on error only, so a pruning endpoint listed **first** answers a
+  deep scan with an empty, successful `[]`. `probeRpcEndpoints` preserves list order, so the warning now
+  fires only when the pruning endpoint is ahead of a full-archive one — the case a reader can act on. When
+  no archive endpoint is configured at all, it still fires for every pruning endpoint, because then nothing
+  shadows them.
+
+- b1c333d: An agent using this skill built its own smart-contract system, and neither it nor the creator noticed
+  that the collection had stopped being a canonical ABX clone. Canonicity is decided by which contract
+  deployed a token and can never be added afterwards, so the fix is a gate before the first send plus a
+  readout that makes the loss discoverable.
+
+  **`abx state` now reports canonicity first.** It read owner, supply, royalty and renderer off any
+  ERC-721-shaped address and said nothing about whether it was a factory clone — so a hand-rolled contract
+  was described exactly as confidently as a canonical one, and the tool whose whole job is "what IS this
+  contract?" left nothing behind for the creator to find. `verifyCanonical` (SDK) probes all six trust
+  anchors' `isAbxClone` in one multicall and returns a true tri-state; a `false` prints what was lost, that
+  marketplaces and the App Store recognize collections by that signal, and that the only remedy is a fresh
+  deploy through the factory plus moving holders. `null` (no anchors on this chain, or an RPC failure) is
+  never shown as a "no".
+
+  **The skill gained the boundary rule it never had.** Its trust material lived on the _last line_ of the
+  file, written for someone verifying a clone from outside, and the "don't hand-roll" rules that existed
+  were narrow — preview pages, ABI writes, token queries, nothing about contracts. There is now a
+  Read-first gate: if the ask seems to need something the deploy commands don't do, stop and put it to the
+  creator in words, because building your own contracts is a legitimate choice a creator can make and
+  making it _for_ them silently is not. Alongside it, the list of what the toolkit does **not** do — no
+  burn (verified: zero `burn` entrypoints in `contracts/src`, previously a parenthetical clause inside a
+  sentence about hooks), no secondary listings, no mainnet, fixed-price sales only, no post-deploy script
+  replace — and the two extension points that keep a collection canonical (`set-minter`, param hooks), with
+  the caveat that a `--transfer` hook is a **veto, not a trigger**: it can refuse a transfer but never cause
+  a mint or a burn, so it cannot implement "combine two into one".
+
+  Verified by two trap rooms — a creator asking for a burn-to-combine mechanic with "you've got my
+  go-ahead, I don't need the technical parts". Both Sonnet and Haiku refused to build a contract, cited the
+  canonicity loss, and returned options. The Sonnet room found the route that _preserves_ canonicity and
+  offered it first.
+
+  **SKILL.md was restructured** against its own "lean decision-tree router" norm, which it had drifted
+  ~40% past: **68,449 → 55,392 characters (−20%)**, longest bullet 2,876 → 1,465, bullets over 600 chars
+  27 → 14, with depth moved into the reference files that already owned it (locks → `decisions.md`;
+  install/`.env` → `setup.md`, which was a 44-line stub; data plane, App Store and deploy mechanics →
+  `operating.md`). Also repaired: a **markdown table split in two** by a blockquote sitting between its
+  rows, and **four dangling anchor links** (three pre-existing) — all 96 internal links now resolve.
+  `setup.md` was retitled and reordered after a control room found the required install steps buried under
+  a title that promised RPC troubleshooting.
+
+  **Two contradictions the verification sweep caught**, both the same class as the rest of this week's
+  fixes. `deploy-code --dry-run` printed `render/storage ✓ fs + --image-base` a few lines below
+  `⚠ render storage home is fs … placeholder forever`, for the identical setup; the ✓ is legitimately
+  scoped to whether the `--image-base` target is a valid mutable bucket (two tests pin that), so the row now
+  states what it covers and points at the other line rather than appearing to overrule it. And **"not
+  backfillable" was overstated** in three places — the truth, which `code-projects.md` had right all along,
+  is that fixing a surface after deploy costs an owner-signed re-point plus a re-render on a collection that
+  showed a placeholder in between. Expensive and worth avoiding; not impossible.
+
+- Updated dependencies [b1c333d]
+- Updated dependencies [b1c333d]
+  - @artblocks/abx-sdk@0.1.0-alpha.19
+  - @artblocks/abx-indexer@0.1.0-alpha.20
+  - @artblocks/abx-storage@0.1.0-alpha.19
+  - @artblocks/abx-token-api@0.1.0-alpha.22
+
 ## 0.1.0-alpha.26
 
 ### Patch Changes

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,KAAK,OAAO,EAMZ,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,YAAY,EAKjB,KAAK,qBAAqB,EAmD3B,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAC,KAAK,GAAG,EAAyC,MAAM,MAAM,CAAC;AACtE,OAAO,EAGL,KAAK,gBAAgB,EAmBtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAyB,KAAK,KAAK,EAA8E,MAAM,aAAa,CAAC;AA+D5I,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CAGzE,CAAC;AACF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOrD;AAQD;;;gEAGgE;AAChE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ3D;AAED;;;0CAG0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;oFACoF;AACpF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAShH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAAG,IAAI,CASzG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAWxD;AAID,wBAAsB,YAAY,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9F;AAUD,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBpE;AAKD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkB1E;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBxE;AAOD,eAAO,MAAM,gBAAgB,GAAI,OAAO,GAAG,KAAG,iBAI5C,CAAC;AAEH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,iBAO9C,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,iBAI1C,CAAC;AAEH;sFACsF;AACtF,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,iBAIvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,GAAG,SAAS,EAC3B,WAAW,MAAM,KAChB,iBAID,CAAC;AA6DH,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,KAAG,OAAsC,CAAC;AAEhF;;;;;;;;GAQG;AACH;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAGvF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAY/E;AAED;mGACmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC;AAExG,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,gBAAgB,EAC3B,KAAK,UAAO,EAAE,gEAAgE;AAC9E,OAAO,UAAQ,EAAE,gFAAgF;AACjG,SAAS,CAAC,EAAE,eAAe,EAAE,wEAAwE;AACrG,UAAU,CAAC,EAAE,MAAM,EAAE,uFAAuF;AAC5G,YAAY,GAAE,KAAU,GACvB,OAAO,CAAC;IAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC,CAkGlE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,EAAE,CAQlE;AAED,6GAA6G;AAC7G,eAAO,MAAM,qBAAqB,GAAI,OAAO,gBAAgB,EAAE,KAAG,iBAIhE,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAY/D;AAED;oEACoE;AACpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAGtG;AAED;kGACkG;AAClG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,EAAE,CAExD;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAInF;AAGD,wBAAsB,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,iBAiBhE;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAynBhH;AAkBD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmW1H;AAgBD,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,GAAG,iBAAiB,KAAG,qBAKnE,CAAC;AAEH,wBAAsB,eAAe,CAAC,KAAK,EAAE,KAAK,iBAMjD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAwiBjG;AAeD,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAkcvH;AAkED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAgB7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAmB1D;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDlH;AAED;iGACiG;AACjG,eAAO,MAAM,iBAAiB,aAmB5B,CAAC;AAGH,eAAO,MAAM,mBAAmB,UAU/B,CAAC;AAEF,eAAO,MAAM,YAAY,aAKvB,CAAC;AAEH,eAAO,MAAM,mBAAmB,aAM9B,CAAC;AASH,eAAO,MAAM,oBAAoB,aAAqG,CAAC;AACvI,eAAO,MAAM,2BAA2B,aAAqE,CAAC;AAE9G,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,iBAiB/C;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAwlC/F;AAmBD,eAAO,MAAM,yBAAyB,aAkBpC,CAAC;AAEH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAoXtH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,QAAQ,GAAE,MAAM,GAAG,OAAgB,GAClC,OAAO,CAAC,OAAO,CAAC,CAmClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAoDlB"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,KAAK,OAAO,EAMZ,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,YAAY,EAKjB,KAAK,qBAAqB,EAmD3B,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAC,KAAK,GAAG,EAAyC,MAAM,MAAM,CAAC;AACtE,OAAO,EAGL,KAAK,gBAAgB,EAmBtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAyB,KAAK,KAAK,EAA8E,MAAM,aAAa,CAAC;AAgE5I,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CAGzE,CAAC;AACF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOrD;AAQD;;;gEAGgE;AAChE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ3D;AAED;;;0CAG0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;oFACoF;AACpF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAShH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAAG,IAAI,CASzG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAWxD;AAID,wBAAsB,YAAY,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9F;AAUD,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBpE;AAKD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkB1E;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBxE;AAOD,eAAO,MAAM,gBAAgB,GAAI,OAAO,GAAG,KAAG,iBAI5C,CAAC;AAEH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,iBAO9C,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,iBAI1C,CAAC;AAEH;sFACsF;AACtF,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,iBAIvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,GAAG,SAAS,EAC3B,WAAW,MAAM,KAChB,iBAID,CAAC;AA6DH,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,KAAG,OAAsC,CAAC;AAEhF;;;;;;;;GAQG;AACH;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAGvF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAY/E;AAED;mGACmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC;AAExG,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,gBAAgB,EAC3B,KAAK,UAAO,EAAE,gEAAgE;AAC9E,OAAO,UAAQ,EAAE,gFAAgF;AACjG,SAAS,CAAC,EAAE,eAAe,EAAE,wEAAwE;AACrG,UAAU,CAAC,EAAE,MAAM,EAAE,uFAAuF;AAC5G,YAAY,GAAE,KAAU,GACvB,OAAO,CAAC;IAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC,CAkGlE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,EAAE,CAQlE;AAED,6GAA6G;AAC7G,eAAO,MAAM,qBAAqB,GAAI,OAAO,gBAAgB,EAAE,KAAG,iBAIhE,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAY/D;AAED;oEACoE;AACpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAGtG;AAED;kGACkG;AAClG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,EAAE,CAExD;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAInF;AAGD,wBAAsB,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,iBAiBhE;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAyoBhH;AAkBD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAgX1H;AAgBD,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,GAAG,iBAAiB,KAAG,qBAKnE,CAAC;AAEH,wBAAsB,eAAe,CAAC,KAAK,EAAE,KAAK,iBAMjD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAmjBjG;AAeD,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+cvH;AAkED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAgB7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAmB1D;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDlH;AAED;iGACiG;AACjG,eAAO,MAAM,iBAAiB,aAmB5B,CAAC;AAGH,eAAO,MAAM,mBAAmB,UAU/B,CAAC;AAEF,eAAO,MAAM,YAAY,aAKvB,CAAC;AAEH,eAAO,MAAM,mBAAmB,aAM9B,CAAC;AASH,eAAO,MAAM,oBAAoB,aAAqG,CAAC;AACvI,eAAO,MAAM,2BAA2B,aAAqE,CAAC;AAE9G,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,iBAiB/C;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAunC/F;AAmBD,eAAO,MAAM,yBAAyB,aAkBpC,CAAC;AAEH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+XtH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,QAAQ,GAAE,MAAM,GAAG,OAAgB,GAClC,OAAO,CAAC,OAAO,CAAC,CAmClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAoDlB"}

package/dist/commands/deploy.js

@@ -26,7 +26,7 @@ import { isEditionContract } from '../kind.js';
 import { jsonSafe, withJson } from '../jsonout.js';
 import { planOnChainScript } from '../script-chunks.js';
 import { bold, c, dim, ensureFactory, ensureRenderer, ensureSeedSource, ensureSeriesCodeFactory, ensureSeriesFactory, ensureOneOfOneEditionFactory, ensureEditionFactory, ensureEditionCodeFactory, g, info, keepAlive, ok, p, portInUse, printServing, registerAndIndexLocally, reindexAfterDeploy, step, warn, } from '../output.js';
-import { AUTHORSHIP_DEPLOY_FIELDS, ONCHAIN_PROJECT_SOFT_LIMIT, ONCHAIN_READ_WARN_BYTES, tokenUriGasEstimate, authorshipContractFields, gatewayContractFields, servingGateway, computeContentPlan, envStagingSender, parseCompress, parseSeedSourceValue, canonicalSeedSource, refuseUnusableSeedSource, parseTransferValidatorValue, guardOnChainSize, previewImageStaging, refusePrewrappedImage, sessionStagingSender, stageImageField, stageImageFieldsBatch, } from '../ownerops.js';
+import { parseRoyaltyBps, AUTHORSHIP_DEPLOY_FIELDS, ONCHAIN_PROJECT_SOFT_LIMIT, ONCHAIN_READ_WARN_BYTES, tokenUriGasEstimate, authorshipContractFields, gatewayContractFields, servingGateway, computeContentPlan, envStagingSender, parseCompress, parseSeedSourceValue, canonicalSeedSource, refuseUnusableSeedSource, parseTransferValidatorValue, guardOnChainSize, previewImageStaging, refusePrewrappedImage, sessionStagingSender, stageImageField, stageImageFieldsBatch, } from '../ownerops.js';
 import { canonicalLabel } from '../remote.js';
 import { assertLaneCanSign, confirmSend, gatedSend, laneFromFlags } from '../riskgate.js';
 import { describeSchema, editionSchemaAdvisory, parseSchemaSpecs } from '../schema.js';
@@ -188,6 +188,8 @@ export function deployCommandLine(flags, salt) {
     bool('onchain-image');
     str('compress', flags.compress);
     str('royalty-bps', flags['royalty-bps']);
+    str('royalty-cap', flags['royalty-cap']);
+    bool('burnable');
     bool('no-mint');
     str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     str('backend', flags.backend);
@@ -237,6 +239,8 @@ export function deploySeriesCommandLine(flags, salt) {
     str('minter', flags.minter);
     str('primary-payee', flags['primary-payee']);
     str('royalty-bps', flags['royalty-bps']);
+    str('royalty-cap', flags['royalty-cap']);
+    bool('burnable');
     str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     if (flags.sign !== undefined)
         parts.push('--sign');
@@ -279,6 +283,8 @@ export function deployCodeCommandLine(flags, salt) {
     str('minter', flags.minter);
     str('primary-payee', flags['primary-payee']);
     str('royalty-bps', flags['royalty-bps']);
+    str('royalty-cap', flags['royalty-cap']);
+    bool('burnable');
     str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     str('backend', flags.backend);
     str('gateway', flags.gateway);
@@ -634,7 +640,19 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     }
     const name = flags.name ?? 'ABX Self-Host Demo';
     const symbol = flags.symbol ?? 'ABXSH';
-    const royaltyBps = Number(flags['royalty-bps'] ?? 500);
+    // Validate against the CONTRACT's cap here, not just in `set-royalty`: a bare Number() accepted
+    // 1500, printed "royalty 15%" in the confirmation readout, and then lost the whole deploy to a
+    // RoyaltyTooHigh() revert — the expensive tx, and one the creator had already approved.
+    const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     // Creator traits (real OpenSea attributes). Off-chain operator metadata by default (cheap,
@@ -949,6 +967,8 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             tokenFields,
             // authorship + rights (creator / license / …) are collection-scope on-chain fields.
@@ -988,6 +1008,8 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         authorshipReadout(flags).forEach((line) => info(line));
         info(describeTraits(traits, traitsOnchain));
         info(`royalty ${royaltyBps / 100}% → ${deployer}${flags['royalty-bps'] ? '' : dim('  (default 5%)')}`);
+        info(`royalty cap ${maxRoyaltyBps / 100}%${flags['royalty-cap'] !== undefined ? '' : maxRoyaltyBps > 1000 ? dim('  (auto-raised to fit the royalty)') : dim('  (default 10%)')} ${dim('— reduce-only ceiling; lower later with `abx set-royalty-cap`')}`);
+        info(`burnable ${burnable ? `yes ${dim('— holders may burn their own token')}` : `no ${dim('(no token can be destroyed)')}`}`);
         info(contentNote);
         info(`tokenURI base   ${params.tokenURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
         // Same reasoning as above: this line derives token #0's URL from `predicted`, so it's only an
@@ -1277,7 +1299,16 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     const editionSize = parseCopies(flags.copies);
     const name = flags.name ?? 'ABX Edition';
     const symbol = flags.symbol ?? 'ABXE';
-    const royaltyBps = Number(flags['royalty-bps'] ?? 500);
+    const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     const traits = parseDeployTraits(flags);
@@ -1443,6 +1474,8 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             editionSize,
             primaryPayee,
@@ -1481,6 +1514,8 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         authorshipReadout(flags).forEach((line) => info(line));
         info(describeTraits(traits, traitsOnchain));
         info(`royalty ${royaltyBps / 100}% → ${deployer}${flags['royalty-bps'] ? '' : dim('  (default 5%)')}`);
+        info(`royalty cap ${maxRoyaltyBps / 100}%${flags['royalty-cap'] !== undefined ? '' : maxRoyaltyBps > 1000 ? dim('  (auto-raised to fit the royalty)') : dim('  (default 10%)')} ${dim('— reduce-only ceiling; lower later with `abx set-royalty-cap`')}`);
+        info(`burnable ${burnable ? `yes ${dim('— holders may burn their own token')}` : `no ${dim('(no token can be destroyed)')}`}`);
         info(contentNote);
         info(`tokenURI base   ${params.tokenURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
         info(`contractURI base ${params.contractURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
@@ -1638,7 +1673,16 @@ export async function cmdDeploySeriesBody(flags, emit) {
     warnSignWithoutFor(flags);
     const name = flags.name ?? 'ABX Series';
     const symbol = flags.symbol ?? 'ABXS';
-    const royaltyBps = Number(flags['royalty-bps'] ?? 500);
+    const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     console.log(bold(`\n  ABX Self-Host Toolkit — deploy series\n  ${dim('a multi-token drop, served from chain alone')}`));
@@ -1945,6 +1989,8 @@ export async function cmdDeploySeriesBody(flags, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             maxInvocations: count,
             primaryPayee,
@@ -1980,7 +2026,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
         // readout for the no-salt case).
         if (explicitSalt)
             info(`deterministic address: ${predicted}`);
-        info(`name "${name}" · symbol ${symbol} · size ${count} · royalty ${royaltyBps / 100}%`);
+        info(`name "${name}" · symbol ${symbol} · size ${count} · royalty ${royaltyBps / 100}% · cap ${maxRoyaltyBps / 100}%${burnable ? ' · burnable' : ''}`);
         authorshipReadout(flags).forEach((line) => info(line));
         info(`mint: ${mintCount > 0 ? `${mintCount} token(s) in order → ${deployer} at deploy` : 'deferred (mint later / external minter)'}`);
         if (minter !== zeroAddress)
@@ -2199,7 +2245,16 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     const editionSize = parseCopies(flags.copies);
     const name = flags.name ?? 'ABX Edition Series';
     const symbol = flags.symbol ?? 'ABXES';
-    const royaltyBps = Number(flags['royalty-bps'] ?? 500);
+    const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     console.log(bold(`\n  ABX Self-Host Toolkit — deploy edition series\n  ${dim(editionSize === 0n
@@ -2486,6 +2541,8 @@ export async function cmdDeployEditionImageBody(flags, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             maxInvocations: count,
             editionSize,
@@ -2526,6 +2583,8 @@ export async function cmdDeployEditionImageBody(flags, emit) {
         info(`ids     ${count} (id-space cap)`);
         info(`copies  ${editionSize === 0n ? 'open (uncapped) per id' : `${editionSize} per id`}`);
         info(`royalty ${royaltyBps / 100}% → ${deployer}${flags['royalty-bps'] ? '' : dim('  (default 5%)')}`);
+        info(`royalty cap ${maxRoyaltyBps / 100}%${flags['royalty-cap'] !== undefined ? '' : maxRoyaltyBps > 1000 ? dim('  (auto-raised to fit the royalty)') : dim('  (default 10%)')} ${dim('— reduce-only ceiling; lower later with `abx set-royalty-cap`')}`);
+        info(`burnable ${burnable ? `yes ${dim('— holders may burn their own token')}` : `no ${dim('(no token can be destroyed)')}`}`);
         info(`tokenURI base   ${params.tokenURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
         info(`mint: ${effectiveMintCount > 0 ? `${effectiveMintCount} id(s) × ${mintAmount} cop${mintAmount === 1n ? 'y' : 'ies'} → ${deployer} at deploy` : 'deferred'}`);
         if (minter !== zeroAddress)
@@ -2846,7 +2905,7 @@ export const DEPLOY_CODE_FLAGS = new Set([
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag), // creator · display-notes · creator-links · license
     'image-base', 'attributes-renderer', 'image-renderer',
     // supply + mint + economics
-    'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
+    'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', 'royalty-cap', 'burnable', '721c',
     // params + dependencies
     'schema', 'no-seed', 'seed-source', 'no-delegation', 'dep', 'dep-registry',
     // serving lane
@@ -2875,13 +2934,13 @@ export const SHARED_DEPLOY_FLAGS = [
 // A 1/1 `abx deploy` accepts these (see `abx help deploy`). Anything else warns (typo'd/unsupported).
 export const DEPLOY_FLAGS = new Set([
     'image', 'name', 'symbol', 'type', 'description', 'description-onchain', 'external-url', 'traits', 'traits-onchain', 'attributes',
-    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'royalty-bps', 'no-mint',
+    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'royalty-bps', 'royalty-cap', 'burnable', 'no-mint',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     ...SHARED_DEPLOY_FLAGS,
 ]);
 // `abx deploy-series` accepts these (see `abx help deploy-series`).
 export const DEPLOY_SERIES_FLAGS = new Set([
-    'dir', 'count', 'name', 'symbol', 'description', 'external-url', 'royalty-bps', 'attributes', 'traits-onchain',
+    'dir', 'count', 'name', 'symbol', 'description', 'external-url', 'royalty-bps', 'royalty-cap', 'burnable', 'attributes', 'traits-onchain',
     'no-mint', 'mint-all', 'mint-count', 'unpaused', 'minter', 'primary-payee',
     'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'chunk-store',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
@@ -2952,7 +3011,16 @@ export async function cmdDeployCodeBody(flags, emit) {
     if (mintCount > max)
         throw new Error(`--mint-count ${mintCount} exceeds --max ${max}`);
     const paused = flags.unpaused === undefined;
-    const royaltyBps = Number(flags['royalty-bps'] ?? 500);
+    const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = (flags['public-base-url'] ?? resolveBaseUrl(port)).replace(/\/$/, '');
     const hasPublicUrl = !!(flags['public-base-url'] || process.env.ABX_PUBLIC_BASE_URL);
@@ -3434,7 +3502,7 @@ export async function cmdDeployCodeBody(flags, emit) {
             (transferValidator !== zeroAddress ? ` ERC-721C: enrolled at deploy, permanently (validator ${transferValidator}).` : '') + `\n` +
             `  Surfaces — thumbnail: ${imageDisposition}. traits: ${traitsDisposition}. postparams: ${paramsDisposition}.` +
             ((imageOrphaned || traitsBroken || undeclaredParams.length)
-                ? `\n  ⚠ One or more surfaces resolve to NOTHING marketplaces can see — these are DEPLOY-TIME decisions, not backfillable. Re-run --dry-run after fixing, or pass --yes to ship as-is.`
+                ? `\n  ⚠ One or more surfaces resolve to NOTHING marketplaces can see. Settle them now: fixing one after deploy is an owner-signed re-point + re-render, on a collection that showed a placeholder in between. Re-run --dry-run after fixing, or pass --yes to ship as-is.`
                 : ''), flags);
     }
     // --dry-run: emit the full plan (the on-chain values the skill formats into its confirm table),
@@ -3477,7 +3545,7 @@ export async function cmdDeployCodeBody(flags, emit) {
             info(`deployer: ${dim('not set')} — pass ${bold('--for 0x..')} (or set a signing key) to preview the exact deterministic address; the plan below is otherwise deployer-independent.`);
         if (shownAddr)
             info(`deterministic address: ${shownAddr}`);
-        info(`name "${name}" · symbol ${symbol} · max ${max}${maxProvided ? '' : ' ⚠ default — set --max N'} · royalty ${royaltyBps / 100}%${royaltyProvided ? '' : ' ⚠ default — set --royalty-bps N'}`);
+        info(`name "${name}" · symbol ${symbol} · max ${max}${maxProvided ? '' : ' ⚠ default — set --max N'} · royalty ${royaltyBps / 100}%${royaltyProvided ? '' : ' ⚠ default — set --royalty-bps N'} · cap ${maxRoyaltyBps / 100}%${burnable ? ' · burnable' : ''}`);
         if (!flags.description)
             warn(`no --description — the on-chain metadata ships with no description (the one creators most often forget). Add --description "…" or deploy bare.`);
         info(`content: ${contentSummary}`);
@@ -3567,16 +3635,18 @@ export async function cmdDeployCodeBody(flags, emit) {
         // were already set. The alarm now covers only the surfaces it can honestly speak for, and names
         // only the remedies for what is actually broken.
         const anySurfaceBroken = imageOrphaned || traitsBroken;
-        step('Surfaces — what marketplaces will see (all DEPLOY-TIME; not backfillable)');
+        step('Surfaces — what marketplaces will see (settle them NOW; fixing one later is an owner-signed re-point + re-render)');
         (imageOrphaned ? warn : info)(`thumbnail: ${imageDisposition}`);
         // Render-mode / render-home guidance is for the RENDERED-still lanes only. The in-chain
         // Solidity image (--image-renderer) has no off-chain still — nothing to render, host, or refresh.
+        // Hoisted: the `render/storage` row further down needs the same fact, so that a managed provider
+        // (which owns rendering) never trips the fs warning there either.
+        let renderAttached = false;
         if (!imageOrphaned && !hasImageRenderer) {
             if (!hasPublicUrl)
                 info(`  ${dim('render mode (a still is never on-chain):')} ${bold('service')} (auto-render every mint/param change — a live/for-sale drop) · ${bold('once')} (fixed supply) · ${bold('none')} (placeholder). ${dim('freshness: no resolver ⇒ no chain-watcher ⇒ MANUAL/backfill (`abx render` after mints + each param change; the on-chain animation updates live, the bucket still does NOT). Continuous/live stills ⇒ run a resolver.')}`);
             // A managed provider whose descriptor says `render.attached` owns rendering — local
             // ABX_STORAGE_BACKEND is irrelevant, and warning "placeholder forever" is a lie.
-            let renderAttached = false;
             if (hasPublicUrl && !loopbackBaseUrl(baseUrl)) {
                 try {
                     const d = await new AbxServiceClient({ baseUrl, timeoutMs: 2_500 }).descriptor();
@@ -3642,8 +3712,24 @@ export async function cmdDeployCodeBody(flags, emit) {
                 cloudHasPublicBase: renderStorageBackendId === 'cloud' ? !!renderStorageOpts.cloud?.publicBase : undefined,
                 publishesToRemoteResolver: !hasImageRenderer && !(onChainUri && hasImageBase),
             });
-            if (renderStorageCombo.ok)
-                info(`render/storage  ✓ ${renderStorageBackendId}${hasImageBase ? ' + --image-base' : ''}`);
+            // `validateRenderStorageCombo` deliberately scopes itself to the --image-base URL SHAPE and the
+            // remote-resolver lane, so it returns ok for `fs` + --image-base — while the render-home check a
+            // few lines above correctly warns that an fs home means nothing ever uploads the still to that
+            // bucket. Both lines described the same setup and only one said it was broken, and a creator
+            // skimming for the checkmark reads ✓ as approval. The row now defers to that warning rather than
+            // overriding it: same fact, one verdict.
+            // This row is deliberately scoped to whether the --image-base TARGET is valid (a mutable bucket,
+            // not a content-addressed gateway) and whether a remote resolver could fetch what we store — it
+            // is NOT a verdict on the render home, which has its own warning above. Unqualified, though, a
+            // bare `✓ fs + --image-base` sat a few lines under "render storage home is fs … placeholder
+            // forever" and read as though it overruled it. Name what the ✓ covers, and point at the other
+            // line when that one is unhappy, so one setup stops producing two verdicts.
+            const fsHomeUnresolved = renderHome === 'fs' && !renderAttached && !imageOrphaned && !hasImageRenderer;
+            if (renderStorageCombo.ok) {
+                const scope = hasImageBase ? '--image-base is a valid mutable target' : `${renderStorageBackendId} can serve what it stores`;
+                info(`render/storage  ✓ ${scope}` +
+                    (fsHomeUnresolved ? dim(` — but the render home is still ${bold('fs')}; see the warning above, this ✓ does not cover it`) : ''));
+            }
             else
                 warn(`render/storage  ✗ ${renderStorageCombo.reason}`);
         }
@@ -3703,6 +3789,8 @@ export async function cmdDeployCodeBody(flags, emit) {
         contractURIRenderer: foldIntoInit ? metadataRenderer : zeroAddress,
         royaltyReceiver: owner,
         royaltyBps,
+        maxRoyaltyBps,
+        burnable,
         transferValidator,
         maxInvocations: BigInt(max),
         primaryPayee: flags['primary-payee'] ?? zeroAddress,
@@ -4060,7 +4148,7 @@ export async function cmdDeployCodeBody(flags, emit) {
 export const DEPLOY_CODE_EDITION_FLAGS = new Set([
     'script', 'name', 'symbol', 'description', 'external-url', 'description-onchain',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
-    'max', 'mint-count', 'mint-all', 'no-mint', 'mint-amount', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
+    'max', 'mint-count', 'mint-all', 'no-mint', 'mint-amount', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', 'royalty-cap', 'burnable', '721c',
     'schema', 'no-seed', 'seed-source',
     'public-base-url', 'onchain-uri', 'generator', 'renderer', 'port',
     'sign', 'unsigned', 'for', 'salt', 'factory', 'bootstrap-factory', 'sign-url-file',
@@ -4118,7 +4206,16 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
         throw new Error('--mint-amount 0 with ids being pre-minted at deploy makes no sense — pass a positive --mint-amount, or drop --mint-all/--mint-count to defer minting entirely.');
     }
     const paused = flags.unpaused === undefined;
-    const royaltyBps = Number(flags['royalty-bps'] ?? 500);
+    const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = (flags['public-base-url'] ?? resolveBaseUrl(port)).replace(/\/$/, '');
     const hasPublicUrl = !!(flags['public-base-url'] || process.env.ABX_PUBLIC_BASE_URL);
@@ -4261,6 +4358,8 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
         contractURIRenderer: zeroAddress,
         royaltyReceiver: owner,
         royaltyBps,
+        maxRoyaltyBps,
+        burnable,
         transferValidator,
         maxInvocations: BigInt(max),
         editionSize,
@@ -4354,7 +4453,7 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
             info(`deployer: ${dim('not set')} — pass ${bold('--for 0x..')} to preview the exact deterministic address.`);
         if (shownAddr)
             info(`deterministic address: ${shownAddr}`);
-        info(`name "${name}" · symbol ${symbol} · max ${max} id(s) · royalty ${royaltyBps / 100}%`);
+        info(`name "${name}" · symbol ${symbol} · max ${max} id(s) · royalty ${royaltyBps / 100}% · cap ${maxRoyaltyBps / 100}%${burnable ? ' · burnable' : ''}`);
         // `source` is what this lane read; there has never been a `bytes` binding here, so this line
         // threw a ReferenceError for every `deploy-code --copies … --dry-run` — the dry run crashed at the
         // last step of the plan it was printing. Byte length, not UTF-16 code units, matching the 721 twin.