@artblocks/abx-cli 0.1.0-alpha.29 → 0.1.0-alpha.30

package/dist/ownerops.js

@@ -9,7 +9,7 @@
 import { MAX_ROYALTY_BPS, assertChainId, ensureChunkStore as sdkEnsureChunkStore, predictFixedPriceMinter, predictFixedPriceMinter1155, makeHotSender, makePublicClient, makeWalletClient, oneOfOneImageAbi, oneOfOneEditionAbi, seriesImageAbi, deployFixedPriceMinter, deployFixedPriceMinter1155, prepareConfigureSale, prepareConfigureSale1155, preparePurchase, preparePurchase1155, readSaleConfig, readSaleConfig1155, prepareEditionMint, prepareEditionTransfer, prepareSetMaxSupply, preparePingURI, prepareLockContractField, prepareLockContractURI, prepareLockTokenField, prepareLockTokenURI, prepareMint, mintedTokenIds, prepareSeriesMintMany, prepareSetMinter, prepareSetMaxInvocations, prepareSetPrimaryPayee, prepareSetPaused, prepareSetContractField, prepareSetContractURIBase, prepareSetContractURIOverride, prepareSetContractURIRenderer, prepareSetParamHooks, prepareSetParamSchema, prepareRetireParam, readParamSchema, PARAM_TYPES, prepareSetRoyalty, prepareReduceMaxRoyaltyBps, prepareSetTokenField, batchOps, prepareSetTokenURIBase, prepareSetTokenURIOverride, prepareSetTokenURIRenderer, prepareSetTransferValidator, prepareSetSeedSource, probeSeedSource, readSeedSource, predictSeedSource, getDeployment, prepareTransfer, prepareTransferOwnership, probeTransferValidator, readCreatorTokenStatus, resolveRecommendedTransferValidator, RECOMMENDED_TRANSFER_VALIDATOR, KNOWN_CHAIN_KEYS, resolveChain, resolveRpcUrl, redactRpcUrl, encodeTag, METADATA_FIELD as F, METADATA_REPRESENTATION as R, stageFieldContent, planStagedContent, exceedsOnchainSoftLimit, classifyOnchainReadSize, tokenUriGasEstimate, ONCHAIN_IMAGE_SOFT_LIMIT, ONCHAIN_PROJECT_SOFT_LIMIT, ONCHAIN_READ_WARN_BYTES, ONCHAIN_READ_REFUSE_BYTES, } from '@artblocks/abx-sdk';
 import { encodeScalarParam, encodeTag as encodeTagSdk, isAccepted, prepareConfigureTokenParam, prepareConfigureTokenParamData, prepareSetContractParam, prepareSetContractParamData, seriesCodeAbi, tryReadContract, } from '@artblocks/abx-sdk';
 import { hasParamEnumeration, GATEWAY_FIELD, GATEWAY_FLOOR, gatewayPrefixFrom, readCollectionPolicy, readEnv } from '@artblocks/abx-sdk';
-import { decodeFieldRenderer, resolveGenerator, DEP_RESOLUTION, parseDependencyRef, prepareLockDependencies, prepareLockParamHooks, prepareLockScript, prepareRemoveLastDependency, prepareSetDependency, prepareSetDependencyRegistry, } from '@artblocks/abx-sdk';
+import { decodeFieldRenderer, encodeFieldRenderer, resolveGenerator, DEP_RESOLUTION, parseDependencyRef, prepareLockDependencies, prepareLockParamHooks, prepareLockScript, prepareRemoveLastDependency, prepareSetDependency, prepareSetDependencyRegistry, } from '@artblocks/abx-sdk';
 import { contentTypeFromPath } from '@artblocks/abx-storage';
 import { toHex as toHexSdk } from 'viem';
 import { readFileSync } from 'node:fs';
@@ -18,7 +18,7 @@ import { gzipSync } from 'node:zlib';
 import { formatEther, getAddress, isAddress, parseEther, toHex, zeroAddress } from 'viem';
 import { backendResolution, CHAIN, chainId, fixedPriceMinterAddress, fixedPriceMinter1155Address, localIndexer } from './config.js';
 import { CliError } from './errors.js';
-import { detectTokenKind, assertHasParamsSurface } from './kind.js';
+import { detectTokenKind, isEditionContract, assertHasParamsSurface } from './kind.js';
 import { openWalletSession } from './signer.js';
 import { gatedSend, laneFromFlags } from './riskgate.js';
 import { withJson } from './jsonout.js';
@@ -1670,6 +1670,101 @@ export async function stageImageFieldsBatch(imagePaths, compress, send, storeOve
 // failure class this toolkit refuses rather than warns about, so pointing a legacy token at the
 // current generator is REFUSED. (Repointing the metadata RENDERER is safe and unguarded: a v4
 // renderer on a legacy token just emits no params block.)
+// ── structured representations: `--value` is not raw bytes ───────────────────
+// Two representations carry a STRUCTURE rather than content, and the metadata renderer decodes
+// them before it can resolve the field: `renderer` is `abi.encode(address fieldRenderer)` (32
+// bytes) and `reader`/`reader-gzip` is `abi.encode(address reader, address pointer)` (64 bytes).
+//
+// `--value` used to be written to chain VERBATIM. So the natural input — a bare 20-byte address,
+// exactly what `--image-renderer` takes at deploy — landed as 20 bytes, and `abi.decode(v,
+// (address))` reverts on anything shorter than a word. The field itself read back fine, which is
+// what made this so hard to see from outside: `contractField("image")` returned the right
+// representation and the right-looking address, and `tokenURI` reverted for EVERY token in the
+// collection. Re-pointing at the renderer the collection was deployed with didn't fix it either —
+// every post-deploy write had the same wrong shape, so it looked permanent and looked like the
+// protocol's fault. Reported from the field on alpha.29 after four builds on Base Sepolia.
+//
+// Enforce, don't warn: normalize what is unambiguous (a bare address IS the field renderer),
+// refuse what is not, and never let a shape the renderer cannot decode reach the chain.
+/** Canonical `abi.encode(address)` — 24 zero nibbles then the 40 address nibbles. */
+const ABI_WORD_PAD = '0'.repeat(24);
+/**
+ * The on-chain bytes for `--value` under `representation`. For a structured representation this
+ * normalizes (a bare address → `abi.encode(address)`) and REFUSES anything the renderer could not
+ * decode; every other representation carries raw bytes and passes through untouched.
+ */
+export function encodeStructuredFieldValue(representation, value) {
+    const hex = value.trim();
+    if (representation === R.renderer) {
+        // A bare 20-byte address: the shape `--image-renderer` takes, and what anyone reading
+        // `contractField` back sees. Encode it rather than making the creator pad it by hand.
+        if (/^0x[0-9a-fA-F]{40}$/.test(hex))
+            return encodeFieldRenderer(getAddress(hex));
+        if (/^0x[0-9a-fA-F]{64}$/.test(hex)) {
+            if (hex.slice(2, 26).toLowerCase() !== ABI_WORD_PAD) {
+                throw new CliError(`--representation renderer needs abi.encode(address) — a 32-byte word whose first 12 bytes are zero.\n` +
+                    `  ${hex} is 32 bytes but its high bytes are not zero, so it decodes to a garbage address and every\n` +
+                    `  tokenURI in the collection would revert. Pass the field renderer's plain 0x address instead.`);
+            }
+            return hex.toLowerCase();
+        }
+        throw new CliError(`--representation renderer expects the field renderer's 0x address (20 bytes) — not ${byteLen(hex)}.\n` +
+            `  The chain stores this field as abi.encode(address) and the metadata renderer abi.decode()s it before\n` +
+            `  it can call render(); any other length reverts tokenURI for the WHOLE collection.\n` +
+            `  Example: abx set-field <token> --field image --value 0xYourFieldRenderer --representation renderer --collection`);
+    }
+    if (representation === R.reader || representation === R.readerGzip) {
+        const ok = /^0x[0-9a-fA-F]{128}$/.test(hex) &&
+            hex.slice(2, 26).toLowerCase() === ABI_WORD_PAD &&
+            hex.slice(66, 90).toLowerCase() === ABI_WORD_PAD;
+        if (!ok) {
+            throw new CliError(`--representation ${representation} expects abi.encode(address reader, address pointer) — 64 bytes, two\n` +
+                `  zero-padded address words — not ${byteLen(hex)}. Hand-encoding this is rarely what you want:\n` +
+                `  \`abx set-field <token> --field <name> --file <path>\` stages the bytes on chain and writes the\n` +
+                `  reader value for you, correctly.`);
+        }
+        return hex.toLowerCase();
+    }
+    return hex;
+}
+/** "20 bytes" / "not hex" — the half of the message that says what the input actually was. */
+function byteLen(hex) {
+    if (!/^0x([0-9a-fA-F]{2})*$/.test(hex))
+        return `'${hex}' (not an even-length 0x hex string)`;
+    const n = (hex.length - 2) / 2;
+    return `${n} byte${n === 1 ? '' : 's'}`;
+}
+/**
+ * Refuse a `renderer` field that points at an address with NO CODE — the same guard
+ * `deploy-code --image-renderer` applies, now on the post-deploy path it was missing from. A
+ * codeless target passes every static check and still reverts every tokenURI.
+ */
+export async function assertFieldRendererDeployed(value) {
+    let target;
+    try {
+        target = decodeFieldRenderer(value);
+    }
+    catch {
+        return; // not decodable as an address — encodeStructuredFieldValue already refused those
+    }
+    if (target === zeroAddress) {
+        throw new CliError('a `renderer` field pointing at the zero address reverts every tokenURI. To stop computing this field on\n' +
+            '  chain, set it to a real representation (--text / --value with `inline`, `url`, `ipfs`, …) instead.');
+    }
+    const publicClient = makePublicClient({ chainKey: CHAIN });
+    let code;
+    try {
+        code = await publicClient.getCode({ address: target });
+    }
+    catch {
+        return; // node unreachable — the owner read upstream already proved it was, so don't invent a failure
+    }
+    if (!code || code === '0x') {
+        throw new CliError(`${target} has NO code on '${CHAIN}' — that is not a deployed IAbxFieldRenderer, and pointing a field at it\n` +
+            `  reverts tokenURI for every token in the collection. Deploy the renderer first (\`abx scaffold-renderer\`\n` +
+            `  → forge test → forge script), then pass the address it printed.`);
+    }
+}
 /** The field-renderer address a `--value` names: the canonical `abi.encode(address)` (32 bytes),
  *  or a bare 20-byte address. Null when it is neither. */
 function fieldRendererTarget(value) {
@@ -1795,7 +1890,62 @@ export async function cmdSetField(address, flags) {
         value = requireFlag(flags, 'value', 'abx set-field <address> --field <name> --text … | --value 0x…');
         representation = flags.representation ?? R.keccak256;
     }
-    await runWrite(contract, buildTx(value, representation), flags, owner);
+    // A structured representation is decoded on chain before the field can resolve — normalize the
+    // shape and refuse an undecodable one HERE, where it costs nothing, rather than on the read path
+    // where it costs the whole collection's tokenURI. (Staged content already arrives correctly
+    // encoded from putContentOnChain; this only ever changes a hand-passed --value.)
+    value = encodeStructuredFieldValue(representation, value);
+    if (representation === R.renderer)
+        await assertFieldRendererDeployed(value);
+    const sent = await runWrite(contract, buildTx(value, representation), flags, owner);
+    // Then prove the thing the creator actually cares about: that the served document still reads.
+    // A field renderer is the project's OWN contract — it can revert for reasons no static check
+    // sees — so the honest confirmation is to call tokenURI once, after the write.
+    if (sent)
+        await reportUriAfterFieldWrite(contract, collection, flags);
+}
+/**
+ * After a field write lands, staticcall what a marketplace calls and say plainly whether it still
+ * resolves. The write is already on chain, so this never throws — a reverting `tokenURI` is
+ * reported with the read that proves it and the write that undoes it.
+ *
+ * This is the check that would have caught the `renderer` encoding bug on the first collection
+ * instead of the fourth: `abx verify` surfaced the reverting tokenURI, but only when it was next
+ * run, and nothing tied it back to the write that caused it.
+ */
+async function reportUriAfterFieldWrite(contract, collection, flags) {
+    const publicClient = makePublicClient({ chainKey: CHAIN });
+    const tokenId = BigInt(flags.token ?? '0');
+    // An ERC-1155 edition serves `uri(id)`, not `tokenURI(id)` — read the one this contract has, or the
+    // check would report a healthy edition as broken.
+    const edition = await isEditionContract(publicClient, contract).catch(() => false);
+    const fn = edition ? 'uri' : 'tokenURI';
+    const abi = edition ? oneOfOneEditionAbi : oneOfOneImageAbi;
+    const uri = await tryReadContract(publicClient, { address: contract, abi, functionName: fn, args: [tokenId] });
+    if (uri !== undefined) {
+        console.log(`  ${green('✓')} ${fn}(${tokenId}) still resolves`);
+        return;
+    }
+    {
+        // A collection with nothing minted yet has no token to read — not a failure, just nothing to
+        // prove. Separate that from a real revert before alarming anyone.
+        const supply = await tryReadContract(publicClient, {
+            address: contract,
+            abi: oneOfOneImageAbi,
+            functionName: 'totalSupply',
+            args: [],
+        });
+        if (supply === 0n) {
+            console.log(dim(`  (no tokens minted yet — nothing to read back; run \`abx verify ${contract}\` after the first mint)`));
+            return;
+        }
+        console.log(yellow('  ⚠ ') +
+            `${fn}(${tokenId}) REVERTS after this write — the field is on chain but the served document no longer reads.\n` +
+            `  confirm: abx tokenuri ${contract} ${tokenId}\n` +
+            `  This is recoverable: the field is not locked until you \`abx lock-field\` it, so re-setting '${flags.field}'\n` +
+            `  to a working value${collection ? ' --collection' : ''} restores it. Check the renderer's own render() first —\n` +
+            `  a field renderer must NEVER revert.`);
+    }
 }
 // ── attach (the data-plane verb: put a named file on a token) ─────────────────
 /**