@artblocks/abx-cli 0.1.0-alpha.27 → 0.1.0-alpha.29

package/CHANGELOG.md

@@ -1,5 +1,217 @@
 # @artblocks/abx-cli
 
+## 0.1.0-alpha.29
+
+### Minor Changes
+
+- c9f7aeb: Fold the burn, and make "canonically ABX v2" sayable — from abx-services' 2026-08-20 reply
+  (`reviews/2026-08/services-reply-docs-23.md`). All off-chain: no contract changed, no address moved.
+
+  **SDK — `foldSpine` now folds an ERC-721 burn, and `TokenState.minted` is replaced by `lifecycle`
+  (BREAKING).** A burn wrote the zero address into `TokenState.owner` — where nothing downstream could
+  tell it from a holder — and `minted` latched `true` at mint and was never recomputed, so a burned
+  token reconstructed as live. `lifecycle: 'unminted' | 'live' | 'burned' | 'no-live-copies'` replaces it,
+  and `owner` is `null` for a burned id rather than a sentinel. An enum rather than the `minted` +
+  `burned` pair the report asked for: a boolean whose `false` has two meanings leaves the burn case one
+  forgotten field away from rendering as "not yet minted", which is exactly what our own CLI did.
+
+  **`'burned'` is terminal and ERC-721-only; an edition at zero live copies is `'no-live-copies'`.** The
+  first cut of this enum shared `'burned'` across both standards, on the grounds that "one vocabulary on
+  both lanes" was the honest shape. It wasn't: the correct _response_ to destruction differs by standard
+  (a 721 id is gone forever and must `410`; an edition id can mint again and must not), so a shared word
+  put every consumer one forgotten `contractType` branch away from serving `410 Gone` for a token the
+  contract still resolves — and our own migration note told the first consumer to map the shared word
+  straight onto their `410` sites. abx-services caught it in review before it published. Splitting the
+  word moves the rule out of prose and into the type: **`lifecycle === 'burned'` is safe to treat as
+  permanent on either standard, with no carve-out**, which let the reference resolver's `isEditionState`
+  guard go away entirely. Pinned from both ends — no edition history can fold to `'burned'`, and the
+  route asserts its own standard-blindness.
+
+  **The two lanes now agree id-for-id.** The same review found `TokenRow.lifecycle` (head reads) reporting
+  `'unknown'` for a fully-burned edition id while the fold reported `'burned'` for that same id — under a
+  docstring claiming the two lanes used the same words. That is the sibling-drift class this repo treats
+  as a bug (see `TokenState.maxSupply`'s note, the last time one field name carried two meanings). Both
+  lanes now answer `'no-live-copies'` there: the fold _could_ distinguish never-minted from fully-burned
+  and deliberately does not, because the distinction has no consumer. `'unknown'` survives for the one
+  case where a head read genuinely cannot say — a 1/1 has no mint frontier, so a reverting `ownerOf`
+  there is evidence of nothing.
+
+  What the latched boolean was costing, all in our own tree: the effects harness re-rendered destroyed
+  tokens on every sweep, forever; `onchain-uri`'s probe reads the LOWEST live id, so burning token 0 made
+  a healthy collection's on-chain-URI lane report as **broken**; the resolver served metadata — and the
+  pre-mint _warming placeholder_, i.e. "still loading" forever — for ids the contract disowns; `mintedCount`
+  never went down; and `abx state` printed "not yet minted" for a token that had been destroyed.
+
+  **SDK — `BurnConfigured` and `MaxRoyaltyBpsUpdated` fold into `ProjectState.burnable` /
+  `.maxRoyaltyBps`.** Both events shipped in the ABI and in `SPINE_EVENT_DOC` and reached no field of
+  state; the upgrade memo then told consumers the doc entry _was_ the fold, which it has never been (it
+  supplies `register`/`what` on the event record, full stop). Both are tri-state: `null` means the spine
+  never stated it — an implementation with no `burn` entrypoint and an unpublished ceiling — which is not
+  `false`, and not 10%. The ceiling is deliberately not nested inside `royalty`, since clearing a royalty
+  nulls that field while the ceiling stays binding on chain.
+
+  **SDK — a fold-coverage guard, because this was the second instance in four days.** `DefaultMaxSupplySet`
+  did the same thing on 2026-08-17. `SPINE_EVENT_NO_FOLD` now lists the events that deliberately reach no
+  state _and why_ (a ping whose value is a head read, a factory's own log, a minter sibling, an allowance),
+  and `spine-fold-coverage.test.ts` asserts every decodable event is either folded or excused. A new event
+  is unfolded and unexcused until someone decides which.
+
+  **SDK — a burned 1/1 no longer vanishes from `listTokens`.** The id range fell back to `totalSupply`
+  (live: mints − burns) when a token type exposes no `nextTokenId`, so burning a 1/1's only token made the
+  listing enumerate ZERO ids — `abx tokens` printed nothing at all, indistinguishable from a collection
+  with no tokens. A 1/1's id space is `{0}` forever regardless of what is live. Found by burning a real
+  token on Sepolia rather than by any fixture, which is the only way this one surfaces.
+
+  **SDK — head reads can now say `burned`.** `nextTokenId` is a mint frontier that only rises, so an id
+  below it whose `ownerOf` reverts was minted and destroyed. `TokenRow.lifecycle` (`'live'` / `'burned'` /
+  `'unminted'` / `'unknown'`) and `TokenListing.burnedCount` (`nextTokenId − totalSupply`) drop out of that,
+  with no event log. `'unknown'` stays a real member where the chain declines to say: a 1/1 has no frontier,
+  and an edition's `supply == 0` cannot distinguish never-minted from fully-burned.
+
+  **SDK — `burned` joins `ServiceErrorCode`, paired with `410 Gone`.** A remote token API had nothing
+  honest to say about a destroyed id and was sending `410` with `code: 'not_registered'` — a statement
+  about the _contract_. The rule behind the pairing is the general one: **a resolver answers what the
+  contract's own URI getter answers.** A burned 721's `tokenURI` reverts `NonexistentToken`, so serving a
+  document would contradict the contract; an ERC-1155's `uri(id)` has no existence gate and a zero-supply
+  id can mint again, so **an edition never 410s** — it serves, with `supply: 0`.
+
+  **SDK — `readCollectionPolicy`, `canonicalFactories`, `verifyProvenance`: protocol knowledge moves out
+  of the CLI.** The CLI was declaring its own ABI fragments for `burnable`/`maxRoyaltyBps` and reading
+  them itself in two places, so no other integrator could reach either fact. `canonicalFactories(chainId)`
+  replaces two copies of the six-anchor enumeration inside `anchors.ts` — the list whose completeness _is_
+  the trust model. `verifyCanonical` gains `opts.factories`, which **replaces** the manifest set rather
+  than appending to it, so a multi-tenant operator's pinned allowlist can drive the gate without silently
+  widening it.
+
+  **SDK — anchor generations: "canonically ABX v2", not a bare `false`.** `verifyCanonical` reported
+  "deployed by an ABX factory since replaced" and "deployed outside the toolkit entirely" identically —
+  its own docstring admitted it — and the first is a perfectly good collection. `ANCHOR_GENERATIONS` keys
+  each generation of the six trust anchors by the **on-chain core version** its clones report, and
+  `verifyProvenance` returns `{canonical, generation: 'current' | 'prior' | null, coreVersion, factory,
+anchorsAnswered}`. The version is on the clone itself, so the answer is chain-verified rather than a
+  manifest claim, and it keeps working after a factory retires. Retired generations never feed
+  `verifyCanonical`: provenance is not trust — a superseded generation can predate a security remediation.
+  Pre-launch testnet generations are deliberately not backfilled.
+
+  **Redeploy process — a token-layer runtime change is a new anchor generation.** It bumps
+  `AbxVersion.CORE_VERSION` and moves the SDK's `isCurrent*` probes in lockstep. That is now a checklist
+  step (`contracts/README.md`, `CLAUDE.md`) _enforced by_ `deployments.test.ts`: recorded generations must
+  have unique, increasing core versions and the newest must match the constant in `AbxVersion.sol`, so a
+  batch cannot record a generation without bumping or bump without recording. The gap that prompted it: the
+  2026-08-20 batch added `burn()`, `burnable()`, `maxRoyaltyBps()` and `reduceMaxRoyaltyBps()` to the CORE
+  base — burn is not an extension, so no extension version moved either — and left the constant at 2, so
+  `abxVersion() == 2` cannot tell a burn-capable token from a pre-burn one.
+
+  **CLI — the royalty ceiling is shown with its rate, and headroom is named.** A ceiling above the live
+  rate is royalty the owner can add unilaterally, and a listing page never shows it. `abx state` prints the
+  pair and, when there is headroom, says the useful thing: reducing the cap **to** the current rate is what
+  turns "5% today" into "5%, provably, forever". (Named by abx-services as their `royalty-headroom` flag —
+  a marketplace can compute it, so a creator should hear it from us first.)
+
+  **Reference stack — the same fixes, so the reference is exemplary rather than the counter-example.**
+  `mintedCount` keeps its name and counts LIVE ids, with `burnedCount` added only when non-zero (so a
+  project with no burns serves byte-identical JSON, and a consumer's fixtures keep telling the truth);
+  the indexer projection carries `lifecycle`; the effects status route and the render sweep skip destroyed
+  ids; the dashboard badges a burned token instead of calling it minted; and `abx verify` / the migrate and
+  re-point probes never choose a burned token as their subject.
+
+  **CLI — `--send` is accepted on the deploy paths, and two lane flags is refused.** Every deploy's help
+  advertises the signing lanes as `--send hot/env key · --sign wallet page · --unsigned print tx`, in 25
+  places, and `--send` was the one of the three the deploy allowlist rejected: typing what the help showed
+  produced `unrecognized flag(s): --send` from the guard whose whole purpose is catching flags that would
+  be silently ignored — the guard firing on the tool's own documentation. Found by using the CLI as a cold
+  reader of its own `--help` while setting up an on-chain test. While there, lane resolution moved from
+  truthiness to **presence** (`--sign=` parses to `''`, which is falsy, so a caller who explicitly named
+  the wallet lane was routed to the unattended env key — the one direction of that bug that costs
+  something), and naming two lanes at once now refuses instead of resolving by an undocumented precedence.
+
+  **Packaging — every published tarball ships its CHANGELOG.** `files` was `['dist', 'LICENSE']` on the
+  SDK, indexer, storage, effects and token-api, so the only package whose release notes reached consumers
+  was the CLI. A downstream team upgrading the SDK had no CHANGELOG in the tarball and diffed two `dist/`
+  trees to find out what moved — then reported the release notes as missing, which cost a whole exchange
+  to adjudicate. One line each.
+
+  **Docs + spec.** The event spine gains a Burn section and the `MaxRoyaltyBpsUpdated` row, both with the
+  fold rules an indexer relies on; three stale deploy-event-order lists are corrected; the remote-services
+  error taxonomy gains the `410 burned` row and the edition carve-out; `owner-powers` explains headroom and
+  burn permanence; and `indexing-notes` states plainly that documenting an event is not folding it.
+
+### Patch Changes
+
+- Updated dependencies [c9f7aeb]
+  - @artblocks/abx-sdk@0.1.0-alpha.21
+  - @artblocks/abx-storage@0.1.0-alpha.21
+  - @artblocks/abx-indexer@0.1.0-alpha.22
+  - @artblocks/abx-token-api@0.1.0-alpha.24
+
+## 0.1.0-alpha.28
+
+### Patch Changes
+
+- 84ca9dd: Off-chain fixes from the 2026-08-19 production-readiness audit
+  (`reviews/2026-08/production-readiness-audit.md`). All are off-chain — no contract changed and no
+  address moved; the three NatSpec-precision items the audit also raised ride the next redeploy batch
+  instead (`docs/10-backlog.md` → _Contracts — the next redeploy batch_, B47).
+
+  **SDK — `HexColor` decode now masks to 24 bits, matching the chain (L-1).** `decodeScalarParam` for a
+  `HexColor` value greater than `0xFFFFFF` returned `#1ffffff` (7+ hex digits); the on-chain
+  `TokenDataLib.decodeScalar` masks with `& 0xffffff` and returns `#ffffff`. The governed write validates
+  `v <= 0xFFFFFF`, but the raw owner setter does not, so an out-of-domain value can be stored and later
+  governed by a `HexColor` schema — and the two serving planes would then decode it differently, splitting
+  `inputsHash`. The SDK now masks identically. Pinned on both sides so it cannot drift again:
+  `decodeScalarParam('HexColor', 0x1ffffffn) === '#ffffff'` (SDK) and the twin `test_DecodeScalars`
+  assertion in `contracts/test/FieldRenderer.t.sol`.
+
+  **SDK — gateway-prefix projection no longer trims (L-7).** `projectGatewayPrefix` dropped the `.trim()`
+  on the on-chain `abx_gateway_*` value: the deployed `_gatewayPrefix` returns the stored bytes verbatim,
+  so trimming here made the two planes disagree on a whitespace-padded prefix. The field store rejects an
+  empty value, so a set field is always non-empty. Clean prefixes (every real one) are unaffected.
+
+  **SDK — `permissionlessSalt` docstring hardened (L-3).** Now states explicitly: never use it for a
+  pre-published or pre-funded address — a third party can occupy the predicted address first with their own
+  `InitParams`. For any reserved address, use `saltFor` (its deployer-bound prefix is front-run-proof). No
+  behavior change; the shipped CLI/skill already deploy through `saltFor`.
+
+  **CLI — the edition schema advisory calls out a holder-writable `seed` by name (L-2).**
+  `editionSchemaAdvisory` already warned that a `TokenOwner` param on an edition is shared per-id
+  (last-writer-wins); it now adds a sharper note when that param is `seed`, because the normally-immutable
+  generative seed becomes re-rollable by _any_ holder of the id — changing the artwork for every
+  co-holder. The on-chain behavior is deliberately unchanged (the reassignable-seed feature is
+  buyer-verifiable via `paramSchema("seed")`); the guardrail is this warning, not a contract restriction.
+  A controller contract on the `Address` leg remains the way to govern it.
+
+- 84ca9dd: Finish the burn + royalty-cap surfacing, from the 2026-08-20 w6 agent sandbox sweep. All off-chain —
+  no contract changed, no address moved; the on-chain features were verified working end to end (a cold
+  agent deployed `--burnable --royalty-cap 42`, minted, burned, and proved the cap enforced on Sepolia).
+  The sweep's convergent finding was that the two new **permanent** deploy-time decisions were invisible
+  after you set them; this makes them visible everywhere they're decided or read, and adds the owner's
+  missing reduce lever.
+
+  - **New: `abx set-royalty-cap <address> --cap <0-10000>`** — the owner's reduce-only royalty-ceiling
+    lever (`RoyaltyExtension.reduceMaxRoyaltyBps`), the "after" the deploy-time "reduce-only after"
+    promise never had. Both ways the chain refuses are checked locally before signing: a value that
+    wouldn't decrease (`RoyaltyCapNotReduced`) or that would drop below the live royalty rate
+    (`RoyaltyCapBelowRoyalty`). SDK: `prepareReduceMaxRoyaltyBps`.
+  - **The deploy readout now shows `royalty cap` and `burnable` on every lane** (1/1, series, code, and
+    all three edition twins), whenever set. Critically it flags an **auto-raised** cap
+    (`royalty cap 25% (auto-raised to fit the royalty)`): omitting `--royalty-cap` while setting a
+    royalty above 10% silently raises the permanent ceiling to match, which was previously invisible.
+  - **`abx state` now surfaces `royaltyCap` and `burnable`** (human + `--json`), the post-deploy
+    verification surface, for both the 721 and edition readouts.
+  - **The skill documents the royalty cap** — the identity decision (`decisions.md`), the confirm-
+    identity step (`SKILL.md`), and a new `set-royalty-cap` owner-op row (`operating.md`); previously the
+    reduce-only ceiling feature had zero skill coverage.
+  - **Help/doc corrections:** `set-royalty --help` range `0-1000`→`0-10000` (stale from the hard-cap
+    era); `deploy-series --help` now lists `--royalty-cap`/`--burnable`; `deploy --help` states the cap
+    auto-raises; `abx inspect`'s trait-feasibility deep-dive points at public docs, not a repo path.
+
+- Updated dependencies [84ca9dd]
+- Updated dependencies [84ca9dd]
+  - @artblocks/abx-sdk@0.1.0-alpha.20
+  - @artblocks/abx-indexer@0.1.0-alpha.21
+  - @artblocks/abx-storage@0.1.0-alpha.20
+  - @artblocks/abx-token-api@0.1.0-alpha.23
+
 ## 0.1.0-alpha.27
 
 ### Patch Changes

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,KAAK,OAAO,EAMZ,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,YAAY,EAKjB,KAAK,qBAAqB,EAmD3B,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAC,KAAK,GAAG,EAAyC,MAAM,MAAM,CAAC;AACtE,OAAO,EAGL,KAAK,gBAAgB,EAmBtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAyB,KAAK,KAAK,EAA8E,MAAM,aAAa,CAAC;AAgE5I,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CAGzE,CAAC;AACF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOrD;AAQD;;;gEAGgE;AAChE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ3D;AAED;;;0CAG0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;oFACoF;AACpF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAShH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAAG,IAAI,CASzG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAWxD;AAID,wBAAsB,YAAY,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9F;AAUD,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBpE;AAKD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkB1E;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBxE;AAOD,eAAO,MAAM,gBAAgB,GAAI,OAAO,GAAG,KAAG,iBAI5C,CAAC;AAEH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,iBAO9C,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,iBAI1C,CAAC;AAEH;sFACsF;AACtF,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,iBAIvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,GAAG,SAAS,EAC3B,WAAW,MAAM,KAChB,iBAID,CAAC;AA6DH,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,KAAG,OAAsC,CAAC;AAEhF;;;;;;;;GAQG;AACH;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAGvF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAY/E;AAED;mGACmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC;AAExG,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,gBAAgB,EAC3B,KAAK,UAAO,EAAE,gEAAgE;AAC9E,OAAO,UAAQ,EAAE,gFAAgF;AACjG,SAAS,CAAC,EAAE,eAAe,EAAE,wEAAwE;AACrG,UAAU,CAAC,EAAE,MAAM,EAAE,uFAAuF;AAC5G,YAAY,GAAE,KAAU,GACvB,OAAO,CAAC;IAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC,CAkGlE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,EAAE,CAQlE;AAED,6GAA6G;AAC7G,eAAO,MAAM,qBAAqB,GAAI,OAAO,gBAAgB,EAAE,KAAG,iBAIhE,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAY/D;AAED;oEACoE;AACpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAGtG;AAED;kGACkG;AAClG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,EAAE,CAExD;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAInF;AAGD,wBAAsB,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,iBAiBhE;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBA4nBhH;AAkBD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmW1H;AAgBD,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,GAAG,iBAAiB,KAAG,qBAKnE,CAAC;AAEH,wBAAsB,eAAe,CAAC,KAAK,EAAE,KAAK,iBAMjD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAwiBjG;AAeD,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAkcvH;AAkED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAgB7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAmB1D;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDlH;AAED;iGACiG;AACjG,eAAO,MAAM,iBAAiB,aAmB5B,CAAC;AAGH,eAAO,MAAM,mBAAmB,UAU/B,CAAC;AAEF,eAAO,MAAM,YAAY,aAKvB,CAAC;AAEH,eAAO,MAAM,mBAAmB,aAM9B,CAAC;AASH,eAAO,MAAM,oBAAoB,aAAqG,CAAC;AACvI,eAAO,MAAM,2BAA2B,aAAqE,CAAC;AAE9G,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,iBAiB/C;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBA4mC/F;AAmBD,eAAO,MAAM,yBAAyB,aAkBpC,CAAC;AAEH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAoXtH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,QAAQ,GAAE,MAAM,GAAG,OAAgB,GAClC,OAAO,CAAC,OAAO,CAAC,CAmClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAoDlB"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,KAAK,OAAO,EAMZ,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,YAAY,EAKjB,KAAK,qBAAqB,EAmD3B,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAC,KAAK,GAAG,EAAyC,MAAM,MAAM,CAAC;AACtE,OAAO,EAGL,KAAK,gBAAgB,EAmBtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAyB,KAAK,KAAK,EAA8E,MAAM,aAAa,CAAC;AAgE5I,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CAGzE,CAAC;AACF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOrD;AAQD;;;gEAGgE;AAChE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ3D;AAED;;;0CAG0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;oFACoF;AACpF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAShH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAAG,IAAI,CASzG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAWxD;AAID,wBAAsB,YAAY,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9F;AAUD,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBpE;AAKD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkB1E;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBxE;AAOD,eAAO,MAAM,gBAAgB,GAAI,OAAO,GAAG,KAAG,iBAI5C,CAAC;AAEH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,iBAO9C,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,iBAI1C,CAAC;AAEH;sFACsF;AACtF,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,iBAIvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,GAAG,SAAS,EAC3B,WAAW,MAAM,KAChB,iBAID,CAAC;AA6DH,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,KAAG,OAAsC,CAAC;AAEhF;;;;;;;;GAQG;AACH;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAGvF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAY/E;AAED;mGACmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC;AAExG,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,gBAAgB,EAC3B,KAAK,UAAO,EAAE,gEAAgE;AAC9E,OAAO,UAAQ,EAAE,gFAAgF;AACjG,SAAS,CAAC,EAAE,eAAe,EAAE,wEAAwE;AACrG,UAAU,CAAC,EAAE,MAAM,EAAE,uFAAuF;AAC5G,YAAY,GAAE,KAAU,GACvB,OAAO,CAAC;IAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC,CAkGlE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,EAAE,CAQlE;AAED,6GAA6G;AAC7G,eAAO,MAAM,qBAAqB,GAAI,OAAO,gBAAgB,EAAE,KAAG,iBAIhE,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAY/D;AAED;oEACoE;AACpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAGtG;AAED;kGACkG;AAClG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,EAAE,CAExD;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAInF;AAGD,wBAAsB,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,iBAiBhE;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAyoBhH;AAkBD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAgX1H;AAgBD,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,GAAG,iBAAiB,KAAG,qBAKnE,CAAC;AAEH,wBAAsB,eAAe,CAAC,KAAK,EAAE,KAAK,iBAMjD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAmjBjG;AAeD,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+cvH;AAkED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAgB7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAmB1D;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDlH;AAED;iGACiG;AACjG,eAAO,MAAM,iBAAiB,aAmB5B,CAAC;AAGH,eAAO,MAAM,mBAAmB,UAiB/B,CAAC;AAEF,eAAO,MAAM,YAAY,aAKvB,CAAC;AAEH,eAAO,MAAM,mBAAmB,aAM9B,CAAC;AASH,eAAO,MAAM,oBAAoB,aAAqG,CAAC;AACvI,eAAO,MAAM,2BAA2B,aAAqE,CAAC;AAE9G,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,iBAiB/C;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAunC/F;AAmBD,eAAO,MAAM,yBAAyB,aAkBpC,CAAC;AAEH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+XtH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,QAAQ,GAAE,MAAM,GAAG,OAAgB,GAClC,OAAO,CAAC,OAAO,CAAC,CAmClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAoDlB"}

package/dist/commands/deploy.js

@@ -188,6 +188,8 @@ export function deployCommandLine(flags, salt) {
     bool('onchain-image');
     str('compress', flags.compress);
     str('royalty-bps', flags['royalty-bps']);
+    str('royalty-cap', flags['royalty-cap']);
+    bool('burnable');
     bool('no-mint');
     str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     str('backend', flags.backend);
@@ -237,6 +239,8 @@ export function deploySeriesCommandLine(flags, salt) {
     str('minter', flags.minter);
     str('primary-payee', flags['primary-payee']);
     str('royalty-bps', flags['royalty-bps']);
+    str('royalty-cap', flags['royalty-cap']);
+    bool('burnable');
     str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     if (flags.sign !== undefined)
         parts.push('--sign');
@@ -279,6 +283,8 @@ export function deployCodeCommandLine(flags, salt) {
     str('minter', flags.minter);
     str('primary-payee', flags['primary-payee']);
     str('royalty-bps', flags['royalty-bps']);
+    str('royalty-cap', flags['royalty-cap']);
+    bool('burnable');
     str('721c', flags['721c'] === 'true' ? 'recommended' : flags['721c']); // bare --721c ≡ recommended
     str('backend', flags.backend);
     str('gateway', flags.gateway);
@@ -638,6 +644,15 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
     // 1500, printed "royalty 15%" in the confirmation readout, and then lost the whole deploy to a
     // RoyaltyTooHigh() revert — the expensive tx, and one the creator had already approved.
     const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     // Creator traits (real OpenSea attributes). Off-chain operator metadata by default (cheap,
@@ -952,6 +967,8 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             tokenFields,
             // authorship + rights (creator / license / …) are collection-scope on-chain fields.
@@ -991,6 +1008,8 @@ export async function cmdDeployBody(flags, serveAfter, emit) {
         authorshipReadout(flags).forEach((line) => info(line));
         info(describeTraits(traits, traitsOnchain));
         info(`royalty ${royaltyBps / 100}% → ${deployer}${flags['royalty-bps'] ? '' : dim('  (default 5%)')}`);
+        info(`royalty cap ${maxRoyaltyBps / 100}%${flags['royalty-cap'] !== undefined ? '' : maxRoyaltyBps > 1000 ? dim('  (auto-raised to fit the royalty)') : dim('  (default 10%)')} ${dim('— reduce-only ceiling; lower later with `abx set-royalty-cap`')}`);
+        info(`burnable ${burnable ? `yes ${dim('— holders may burn their own token')}` : `no ${dim('(no token can be destroyed)')}`}`);
         info(contentNote);
         info(`tokenURI base   ${params.tokenURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
         // Same reasoning as above: this line derives token #0's URL from `predicted`, so it's only an
@@ -1281,6 +1300,15 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
     const name = flags.name ?? 'ABX Edition';
     const symbol = flags.symbol ?? 'ABXE';
     const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     const traits = parseDeployTraits(flags);
@@ -1446,6 +1474,8 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             editionSize,
             primaryPayee,
@@ -1484,6 +1514,8 @@ export async function cmdDeployOneOfOneEditionBody(flags, emit) {
         authorshipReadout(flags).forEach((line) => info(line));
         info(describeTraits(traits, traitsOnchain));
         info(`royalty ${royaltyBps / 100}% → ${deployer}${flags['royalty-bps'] ? '' : dim('  (default 5%)')}`);
+        info(`royalty cap ${maxRoyaltyBps / 100}%${flags['royalty-cap'] !== undefined ? '' : maxRoyaltyBps > 1000 ? dim('  (auto-raised to fit the royalty)') : dim('  (default 10%)')} ${dim('— reduce-only ceiling; lower later with `abx set-royalty-cap`')}`);
+        info(`burnable ${burnable ? `yes ${dim('— holders may burn their own token')}` : `no ${dim('(no token can be destroyed)')}`}`);
         info(contentNote);
         info(`tokenURI base   ${params.tokenURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
         info(`contractURI base ${params.contractURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
@@ -1642,6 +1674,15 @@ export async function cmdDeploySeriesBody(flags, emit) {
     const name = flags.name ?? 'ABX Series';
     const symbol = flags.symbol ?? 'ABXS';
     const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     console.log(bold(`\n  ABX Self-Host Toolkit — deploy series\n  ${dim('a multi-token drop, served from chain alone')}`));
@@ -1948,6 +1989,8 @@ export async function cmdDeploySeriesBody(flags, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             maxInvocations: count,
             primaryPayee,
@@ -1983,7 +2026,7 @@ export async function cmdDeploySeriesBody(flags, emit) {
         // readout for the no-salt case).
         if (explicitSalt)
             info(`deterministic address: ${predicted}`);
-        info(`name "${name}" · symbol ${symbol} · size ${count} · royalty ${royaltyBps / 100}%`);
+        info(`name "${name}" · symbol ${symbol} · size ${count} · royalty ${royaltyBps / 100}% · cap ${maxRoyaltyBps / 100}%${burnable ? ' · burnable' : ''}`);
         authorshipReadout(flags).forEach((line) => info(line));
         info(`mint: ${mintCount > 0 ? `${mintCount} token(s) in order → ${deployer} at deploy` : 'deferred (mint later / external minter)'}`);
         if (minter !== zeroAddress)
@@ -2203,6 +2246,15 @@ export async function cmdDeployEditionImageBody(flags, emit) {
     const name = flags.name ?? 'ABX Edition Series';
     const symbol = flags.symbol ?? 'ABXES';
     const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = flags['public-base-url'] ?? resolveBaseUrl(port);
     console.log(bold(`\n  ABX Self-Host Toolkit — deploy edition series\n  ${dim(editionSize === 0n
@@ -2489,6 +2541,8 @@ export async function cmdDeployEditionImageBody(flags, emit) {
             contractURIRenderer: renderer,
             royaltyReceiver: deployer,
             royaltyBps,
+            maxRoyaltyBps,
+            burnable,
             transferValidator,
             maxInvocations: count,
             editionSize,
@@ -2529,6 +2583,8 @@ export async function cmdDeployEditionImageBody(flags, emit) {
         info(`ids     ${count} (id-space cap)`);
         info(`copies  ${editionSize === 0n ? 'open (uncapped) per id' : `${editionSize} per id`}`);
         info(`royalty ${royaltyBps / 100}% → ${deployer}${flags['royalty-bps'] ? '' : dim('  (default 5%)')}`);
+        info(`royalty cap ${maxRoyaltyBps / 100}%${flags['royalty-cap'] !== undefined ? '' : maxRoyaltyBps > 1000 ? dim('  (auto-raised to fit the royalty)') : dim('  (default 10%)')} ${dim('— reduce-only ceiling; lower later with `abx set-royalty-cap`')}`);
+        info(`burnable ${burnable ? `yes ${dim('— holders may burn their own token')}` : `no ${dim('(no token can be destroyed)')}`}`);
         info(`tokenURI base   ${params.tokenURIBase || dim('(empty — resolves on-chain via the renderer)')}`);
         info(`mint: ${effectiveMintCount > 0 ? `${effectiveMintCount} id(s) × ${mintAmount} cop${mintAmount === 1n ? 'y' : 'ies'} → ${deployer} at deploy` : 'deferred'}`);
         if (minter !== zeroAddress)
@@ -2720,7 +2776,7 @@ export function projectionFingerprint(s) {
         royalty: s.royalty ? { bps: s.royalty.bps, receiver: s.royalty.receiver.toLowerCase() } : null,
         extensions: s.extensions.map((e) => e.name).sort(),
         collectionFields: s.collectionFields.map((f) => `${f.field}=${f.value}`).sort(),
-        tokens: s.tokens.map((t) => ({ id: t.tokenId, minted: t.minted, owner: t.owner?.toLowerCase() ?? null })),
+        tokens: s.tokens.map((t) => ({ id: t.tokenId, lifecycle: t.lifecycle, owner: t.owner?.toLowerCase() ?? null })),
         events: s.events.map((e) => `${e.blockNumber}:${e.logIndex}:${e.name}`),
     };
     return createHash('sha256').update(JSON.stringify(canonical)).digest('hex');
@@ -2788,8 +2844,8 @@ export async function walkthroughRebuild(indexer, address, before) {
 export async function walkthroughReadBack(state, baseUrl, onChainUri) {
     step('Read it back the way a marketplace would');
     const token = state.tokens[0];
-    if (!token?.minted) {
-        info('no minted token to read yet.');
+    if (token?.lifecycle !== 'live') {
+        info(token?.lifecycle === 'burned' ? 'token #0 was burned — nothing to read back.' : 'no minted token to read yet.');
         return;
     }
     if (onChainUri) {
@@ -2849,15 +2905,15 @@ export const DEPLOY_CODE_FLAGS = new Set([
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag), // creator · display-notes · creator-links · license
     'image-base', 'attributes-renderer', 'image-renderer',
     // supply + mint + economics
-    'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
+    'max', 'mint-count', 'mint-all', 'no-mint', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', 'royalty-cap', 'burnable', '721c',
     // params + dependencies
     'schema', 'no-seed', 'seed-source', 'no-delegation', 'dep', 'dep-registry',
     // serving lane
     'public-base-url', 'onchain-uri', 'generator', 'renderer', 'port',
     // storage (directory mode) — mirrors storageOverrides()
     'backend', 'endpoint', 'bucket', 'region', 'prefix', 'public-base', 'gateway', 'mode', 'api-url', 'upload-url', 'provider', 'storage-signer',
-    // signing lane + safety + trust anchor
-    'sign', 'unsigned', 'for', 'salt', 'factory', 'bootstrap-factory', 'sign-url-file',
+    // signing lane + safety + trust anchor ('send' = the default lane, stated explicitly; see SHARED_DEPLOY_FLAGS)
+    'send', 'sign', 'unsigned', 'for', 'salt', 'factory', 'bootstrap-factory', 'sign-url-file',
     // preview / confirm
     'dry-run', 'confirm', 'yes',
     'json', // B19: the deployed ADDRESS as data, narration to stderr
@@ -2871,6 +2927,13 @@ export const SHARED_DEPLOY_FLAGS = [
     // which is where the CLI uploads and probes; `--gateway` seeds these for the backend in use, and
     // these override it when the two should differ. Every deploy path takes them.
     'ipfs-gateway', 'arweave-gateway',
+    // `--send` is the DEFAULT lane, and it is accepted explicitly because every deploy's own help
+    // advertises it by name ("signing: --send hot/env key · --sign wallet page · --unsigned print tx").
+    // It was the one of the three the parser rejected, so a reader who typed what the help showed got
+    // `unrecognized flag(s): --send` from the guard whose whole job is catching flags that would be
+    // ignored — the guard firing on the tool's own documentation. Explicit is also better than bare for
+    // a script or an agent: the lane that signs and sends is worth stating out loud.
+    'send',
     'sign', 'unsigned', 'for', 'sign-url-file', 'dry-run', 'confirm', 'yes', 'salt', 'factory', 'bootstrap-factory', 'port', 'renderer', 'public-base-url',
     '721c', // opt-in ERC-721C enrollment (recommended | 0x…) — every deploy path takes it
     'json', // B19: the deployed ADDRESS as data, narration to stderr — every deploy path takes it
@@ -2878,13 +2941,13 @@ export const SHARED_DEPLOY_FLAGS = [
 // A 1/1 `abx deploy` accepts these (see `abx help deploy`). Anything else warns (typo'd/unsupported).
 export const DEPLOY_FLAGS = new Set([
     'image', 'name', 'symbol', 'type', 'description', 'description-onchain', 'external-url', 'traits', 'traits-onchain', 'attributes',
-    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'royalty-bps', 'no-mint',
+    'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'royalty-bps', 'royalty-cap', 'burnable', 'no-mint',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
     ...SHARED_DEPLOY_FLAGS,
 ]);
 // `abx deploy-series` accepts these (see `abx help deploy-series`).
 export const DEPLOY_SERIES_FLAGS = new Set([
-    'dir', 'count', 'name', 'symbol', 'description', 'external-url', 'royalty-bps', 'attributes', 'traits-onchain',
+    'dir', 'count', 'name', 'symbol', 'description', 'external-url', 'royalty-bps', 'royalty-cap', 'burnable', 'attributes', 'traits-onchain',
     'no-mint', 'mint-all', 'mint-count', 'unpaused', 'minter', 'primary-payee',
     'onchain-uri', 'onchain-image', 'compress', 'allow-unreadable-onchain', 'chunk-store',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
@@ -2956,6 +3019,15 @@ export async function cmdDeployCodeBody(flags, emit) {
         throw new Error(`--mint-count ${mintCount} exceeds --max ${max}`);
     const paused = flags.unpaused === undefined;
     const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = (flags['public-base-url'] ?? resolveBaseUrl(port)).replace(/\/$/, '');
     const hasPublicUrl = !!(flags['public-base-url'] || process.env.ABX_PUBLIC_BASE_URL);
@@ -3480,7 +3552,7 @@ export async function cmdDeployCodeBody(flags, emit) {
             info(`deployer: ${dim('not set')} — pass ${bold('--for 0x..')} (or set a signing key) to preview the exact deterministic address; the plan below is otherwise deployer-independent.`);
         if (shownAddr)
             info(`deterministic address: ${shownAddr}`);
-        info(`name "${name}" · symbol ${symbol} · max ${max}${maxProvided ? '' : ' ⚠ default — set --max N'} · royalty ${royaltyBps / 100}%${royaltyProvided ? '' : ' ⚠ default — set --royalty-bps N'}`);
+        info(`name "${name}" · symbol ${symbol} · max ${max}${maxProvided ? '' : ' ⚠ default — set --max N'} · royalty ${royaltyBps / 100}%${royaltyProvided ? '' : ' ⚠ default — set --royalty-bps N'} · cap ${maxRoyaltyBps / 100}%${burnable ? ' · burnable' : ''}`);
         if (!flags.description)
             warn(`no --description — the on-chain metadata ships with no description (the one creators most often forget). Add --description "…" or deploy bare.`);
         info(`content: ${contentSummary}`);
@@ -3724,6 +3796,8 @@ export async function cmdDeployCodeBody(flags, emit) {
         contractURIRenderer: foldIntoInit ? metadataRenderer : zeroAddress,
         royaltyReceiver: owner,
         royaltyBps,
+        maxRoyaltyBps,
+        burnable,
         transferValidator,
         maxInvocations: BigInt(max),
         primaryPayee: flags['primary-payee'] ?? zeroAddress,
@@ -4081,7 +4155,7 @@ export async function cmdDeployCodeBody(flags, emit) {
 export const DEPLOY_CODE_EDITION_FLAGS = new Set([
     'script', 'name', 'symbol', 'description', 'external-url', 'description-onchain',
     ...AUTHORSHIP_DEPLOY_FIELDS.map(([flag]) => flag),
-    'max', 'mint-count', 'mint-all', 'no-mint', 'mint-amount', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', '721c',
+    'max', 'mint-count', 'mint-all', 'no-mint', 'mint-amount', 'unpaused', 'minter', 'primary-payee', 'royalty-bps', 'royalty-cap', 'burnable', '721c',
     'schema', 'no-seed', 'seed-source',
     'public-base-url', 'onchain-uri', 'generator', 'renderer', 'port',
     'sign', 'unsigned', 'for', 'salt', 'factory', 'bootstrap-factory', 'sign-url-file',
@@ -4140,6 +4214,15 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
     }
     const paused = flags.unpaused === undefined;
     const royaltyBps = flags['royalty-bps'] === undefined ? 500 : parseRoyaltyBps(String(flags['royalty-bps']));
+    // B45: owner-set royalty ceiling (bps, up to 100%), reduce-only after deploy. Defaults to 10%,
+    // auto-raised to fit a higher --royalty-bps so a plausible input never errors; --royalty-cap overrides.
+    const maxRoyaltyBps = flags['royalty-cap'] === undefined
+        ? Math.max(1000, royaltyBps)
+        : parseRoyaltyBps(String(flags['royalty-cap']));
+    if (royaltyBps > maxRoyaltyBps) {
+        throw new Error(`--royalty-bps ${royaltyBps / 100}% exceeds --royalty-cap ${maxRoyaltyBps / 100}%; raise the cap or lower the royalty.`);
+    }
+    const burnable = flags.burnable === '' || flags.burnable === 'true';
     const port = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
     const baseUrl = (flags['public-base-url'] ?? resolveBaseUrl(port)).replace(/\/$/, '');
     const hasPublicUrl = !!(flags['public-base-url'] || process.env.ABX_PUBLIC_BASE_URL);
@@ -4282,6 +4365,8 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
         contractURIRenderer: zeroAddress,
         royaltyReceiver: owner,
         royaltyBps,
+        maxRoyaltyBps,
+        burnable,
         transferValidator,
         maxInvocations: BigInt(max),
         editionSize,
@@ -4375,7 +4460,7 @@ export async function cmdDeployEditionCodeBody(flags, emit) {
             info(`deployer: ${dim('not set')} — pass ${bold('--for 0x..')} to preview the exact deterministic address.`);
         if (shownAddr)
             info(`deterministic address: ${shownAddr}`);
-        info(`name "${name}" · symbol ${symbol} · max ${max} id(s) · royalty ${royaltyBps / 100}%`);
+        info(`name "${name}" · symbol ${symbol} · max ${max} id(s) · royalty ${royaltyBps / 100}% · cap ${maxRoyaltyBps / 100}%${burnable ? ' · burnable' : ''}`);
         // `source` is what this lane read; there has never been a `bytes` binding here, so this line
         // threw a ReferenceError for every `deploy-code --copies … --dry-run` — the dry run crashed at the
         // last step of the plan it was printing. Byte length, not UTF-16 code units, matching the 721 twin.