@artblocks/abx-cli 0.1.0-alpha.4 → 0.1.0-alpha.5

package/dist/main.js

@@ -43,7 +43,7 @@
  * the tx for a multisig / offline signer). The agent picks the lane; the CLI signs.
  */
 import { appendFileSync, copyFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { basename, extname, join as joinPath, resolve as resolvePath } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
@@ -986,7 +986,9 @@ async function cmdDeploy(flags, serveAfter) {
     // editable later via `abx add --traits`); `--traits-onchain` inlines them on-chain (durable,
     // lockable) — mirrors the description model. On-chain wins if both ever set the same trait.
     const traits = parseDeployTraits(flags);
-    console.log(bold(`\n  ABX Self-Host Toolkit — ${serveAfter ? 'demo' : 'deploy'}\n  ${dim('a project, served from chain alone')}`));
+    console.log(serveAfter
+        ? bold(`\n  ABX — guided first run\n  ${dim('a token deployed, then rebuilt from the chain alone')}`)
+        : bold(`\n  ABX Self-Host Toolkit — deploy\n  ${dim('a project, served from chain alone')}`));
     // Signing lane. `demo` used to hard-force the hot lane, which SILENTLY dropped `--sign`: with no
     // env key it died confusingly, and WITH one it signed from that key while the operator had asked
     // for their browser wallet — a signing choke point that ignored the lane it was handed. The demo
@@ -1005,6 +1007,17 @@ async function cmdDeploy(flags, serveAfter) {
         throw new Error('`abx demo --dry-run` can\'t work: a dry run sends nothing, and the demo indexes + serves what ' +
             'it deployed. Use `abx deploy --dry-run` to preview a 1/1 deploy without sending.');
     }
+    // Port preflight BEFORE anything irreversible. The demo ends by serving, and `listen` used to be
+    // the first thing to discover the port was taken — after the deploy tx had already been signed and
+    // paid for, so a second `abx demo` (a very normal thing to try) spent gas and then died with a raw
+    // Node EADDRINUSE stack trace. Check first, and name the fix.
+    if (serveAfter) {
+        const wanted = Number(flags.port ?? process.env.ABX_PORT ?? DEFAULT_PORT);
+        if (await portInUse(wanted)) {
+            throw new Error(`port ${wanted} is already in use — probably an \`abx demo\`/\`abx serve\` still running in another terminal.\n` +
+                `  Nothing was deployed. Stop that one (Ctrl-C), or run this on another port: \`abx demo --port ${wanted + 1}\`.`);
+        }
+    }
     const dryRun = !serveAfter && !!flags['dry-run']; // preview only — no send, no custody, no factory deploy
     const publicClient = makePublicClient({ chainKey: CHAIN });
     // Verify the RPC really is CHAIN before any send (factory/renderer/staging/deploy). A dry run
@@ -1050,6 +1063,12 @@ async function cmdDeploy(flags, serveAfter) {
     else {
         factory = await ensureFactory(flags.factory, !!flags['bootstrap-factory']);
     }
+    // The demo explains what it just did; `deploy` stays terse. The authenticity point is the least
+    // obvious thing about ABX and the easiest to get wrong, so it's worth a sentence here.
+    if (serveAfter) {
+        info(dim('why it matters: a contract counts as ABX because THIS factory made it (isAbxClone),'));
+        info(dim('not because it emitted an event claiming to be — anyone can emit that event.'));
+    }
     // --onchain-uri: resolve tokenURI/contractURI fully on-chain via the canonical renderer
     // (the JSON is assembled from on-chain fields → no resolver needed, ever). The off-chain
     // URLs are still baked as a fallback if the renderer is later cleared.
@@ -1076,7 +1095,13 @@ async function cmdDeploy(flags, serveAfter) {
             renderer = await ensureRenderer(flags.renderer);
         }
     }
-    step(`Deploy a ${DIMENSIONS[dimension].label} (--type ${dimension}) to ${CHAIN}`);
+    step(serveAfter ? `Deploy — one transaction to ${CHAIN}` : `Deploy a ${DIMENSIONS[dimension].label} (--type ${dimension}) to ${CHAIN}`);
+    // The custody split is the single most useful thing to understand about an ABX token, and it's
+    // invisible unless someone says it out loud. Demo only — `deploy` prints the same facts per-field.
+    if (serveAfter) {
+        info(dim(`on chain:     name · symbol · royalty · a tokenURI base · a keccak256 commitment to the image`));
+        info(dim(`NOT on chain: the image bytes themselves — this node serves them, the chain pins their hash`));
+    }
     // Off-chain custody (no renderer) bakes the resolver URL straight into the on-chain
     // tokenURI/contractURI at deploy. A localhost / loopback URL there resolves for NO ONE —
     // not marketplaces, not wallets, not even your own browser unless `abx serve` is running —
@@ -1374,10 +1399,13 @@ async function cmdDeploy(flags, serveAfter) {
         attributes: offChainTraits,
     };
     indexer.register(baseReg);
-    const { state, elapsedMs } = await indexer.reindex(clone);
-    ok(`reconstructed ${state.eventCount} events in ${elapsedMs}ms — no provider involved`);
+    const { state, elapsedMs } = await reindexAfterDeploy(indexer, clone);
+    if (state.eventCount > 0)
+        ok(`reconstructed ${state.eventCount} events in ${elapsedMs}ms — no provider involved`);
     info(`name "${state.name}" · owner ${state.owner} · canonical: ${state.isCanonical ? 'yes (factory-verified)' : 'unverified'}`);
     info(`extensions: ${state.extensions.map((e) => e.name).join(', ') || 'none'}`);
+    if (serveAfter)
+        walkthroughSpine(state);
     // For off-chain custody (image committed as keccak256), resolve the durable locator (ipfs://…)
     // from this machine's content index and store it on the registration — so the LOCAL resolver
     // points `image` at IPFS, and `abx add --remote` can ship it to a hosted one (the localhost-image fix).
@@ -1426,8 +1454,17 @@ async function cmdDeploy(flags, serveAfter) {
         }
         return;
     }
-    step('Serve the token API + dashboard');
+    // The demo's teaching sections — see the walkthrough helpers. `deploy` skips them: someone
+    // shipping real work doesn't need their projection deleted to make a point.
+    if (serveAfter)
+        await walkthroughRebuild(indexer, clone, state);
+    // Start the server BEFORE the read-back step (which fetches the served metadata over HTTP), but
+    // print the serve banner after it — otherwise the "Serve" step header lands with nothing under it
+    // while the read-back prints below, which reads like the step failed.
     const { url } = await startTokenApiServer({ indexer, port, baseUrl, storage: resolveBackend(storageOptions()) });
+    if (serveAfter)
+        await walkthroughReadBack(state, url);
+    step('Serve the token API + dashboard');
     printServing(url, clone);
     keepAlive();
 }
@@ -1898,8 +1935,9 @@ async function cmdDeploySeries(flags) {
         tokenAttributes: offChainTokenTraits,
     };
     indexer.register(baseReg);
-    const { state, elapsedMs } = await indexer.reindex(clone);
-    ok(`reconstructed ${state.eventCount} events in ${elapsedMs}ms — ${state.tokens.length} token(s), max ${state.maxInvocations}`);
+    const { state, elapsedMs } = await reindexAfterDeploy(indexer, clone);
+    if (state.eventCount > 0)
+        ok(`reconstructed ${state.eventCount} events in ${elapsedMs}ms — ${state.tokens.length} token(s), max ${state.maxInvocations}`);
     info(`extensions: ${state.extensions.map((e) => e.name).join(', ') || 'none'}`);
     // Off-chain custody: bridge each token's keccak → durable locator so the resolver (local and,
     // via `abx add --remote`, a hosted one) points images off this node.
@@ -2163,7 +2201,11 @@ async function cmdAdd(address, flags) {
             info(`scanning blocks ${start}${dim(' → ')}${head} ${dim(`(~${span} blocks)`)} — on a range-capped RPC (see ${g('abx doctor')}) this can take a few minutes with no per-block output; leave it running.`);
     }
     catch { /* advisory only — the real scan still runs */ }
-    const { state, elapsedMs } = await indexer.reindex(address);
+    // Don't accept a zero here either: `deploy-code` finishes through this command, so this IS the
+    // post-deploy index for a code project — and a real ABX clone always emits a spine (its extension
+    // registrations at minimum), so 0 events means the RPC hasn't served the logs yet, not that the
+    // project is empty. See reindexAfterDeploy.
+    const { state, elapsedMs } = await reindexAfterDeploy(indexer, address);
     // Resolve durable locators for off-chain-by-hash content from this machine's index.
     const locators = await collectContentLocators(state, resolveBackend(storageOptions(storageOverrides(flags))));
     if (Object.keys(locators).length) {
@@ -2180,7 +2222,14 @@ async function cmdAdd(address, flags) {
             contentLocators: JSON.stringify(locators),
         });
     }
-    ok(`registered + indexed ${state.name ?? address} LOCALLY (this machine): ${state.eventCount} events in ${elapsedMs}ms`);
+    // A ✓ on 0 events is the lie that produced an empty dashboard; reindexAfterDeploy has already
+    // explained the failure and named the recovery command, so don't stamp it as success too.
+    if (state.eventCount > 0) {
+        ok(`registered + indexed ${state.name ?? address} LOCALLY (this machine): ${state.eventCount} events in ${elapsedMs}ms`);
+    }
+    else {
+        warn(`registered ${state.name ?? address}, but with NO reconstructed state — it will serve empty until the index succeeds.`);
+    }
     info(`serve it from here with ${bold('abx serve')} — or push it to a hosted resolver with ${bold('abx add ' + address + ' --remote')}`);
 }
 /** The code-project trust anchor: use the canonical factory, else deploy one (a sandbox /
@@ -2247,6 +2296,158 @@ async function ensureSeedSource(publicClient) {
  * Schemas: --schema key:Type:Auth[,key:Type:Auth…] (e.g. palette:HexColor:TokenOwner).
  * Seeds: canonical randomizer by default; --no-seed opts out.
  */
+// ── the demo walkthrough: teaching sections, demo-only ────────────────────────
+//
+// `abx demo` is a TEACHING command, not a shortcut — the docs point a first-time reader here to
+// learn what the toolkit does on their behalf. Its old form asserted the interesting claims
+// ("reconstructed 9 events — no provider involved") without ever showing them, which made it a
+// smoke test wearing a demo's clothes. These sections demonstrate instead: print the spine the
+// chain now holds, throw the local projection away and rebuild it, then read the token back the way
+// a marketplace would. They run only for `demo` (never `deploy`), and never pause — an agent or CI
+// run has to behave identically.
+/**
+ * The deterministic part of a projection: everything that is a pure function of the chain.
+ * Deliberately EXCLUDES `reconstructedAt`, `rpcUrl` and `toBlock` — a timestamp, the endpoint that
+ * happened to answer, and the head at scan time all legitimately differ between two replays, so
+ * folding them in would make the rebuild proof fail for reasons that aren't about correctness.
+ */
+function projectionFingerprint(s) {
+    const canonical = {
+        address: s.address.toLowerCase(),
+        name: s.name,
+        symbol: s.symbol,
+        owner: s.owner?.toLowerCase() ?? null,
+        isCanonical: s.isCanonical,
+        deployBlock: s.deployBlock,
+        eventCount: s.eventCount,
+        royalty: s.royalty ? { bps: s.royalty.bps, receiver: s.royalty.receiver.toLowerCase() } : null,
+        extensions: s.extensions.map((e) => e.name).sort(),
+        collectionFields: s.collectionFields.map((f) => `${f.field}=${f.value}`).sort(),
+        tokens: s.tokens.map((t) => ({ id: t.tokenId, minted: t.minted, owner: t.owner?.toLowerCase() ?? null })),
+        events: s.events.map((e) => `${e.blockNumber}:${e.logIndex}:${e.name}`),
+    };
+    return createHash('sha256').update(JSON.stringify(canonical)).digest('hex');
+}
+/**
+ * Print the reconstructed spine — the point being that this list IS the database. Rendered inside
+ * the index step (no header of its own: "Index it — replay the event spine" immediately followed by
+ * a separate "The event spine" step read as a stutter).
+ */
+function walkthroughSpine(state) {
+    if (state.events.length === 0) {
+        warn('no events to show (the index came back empty — see the recovery hint above).');
+        return;
+    }
+    const width = Math.max(...state.events.map((e) => e.name.length));
+    state.events.forEach((e, i) => {
+        // ERC vs ABX register: standard ERC-721 events a marketplace already understands, versus ABX's
+        // own. Worth surfacing — it's why an ABX token indexes fine on tools that know nothing about ABX.
+        const reg = e.register === 2 ? p('ABX') : dim('ERC');
+        console.log(`    ${dim(`#${String(i + 1).padStart(2)}`)} ${reg} ${e.name.padEnd(width)}  ${dim(e.what)}`);
+    });
+    console.log(`    ${dim('→')} those ${bold(String(state.events.length))} rows are the entire database — ` +
+        dim('no row in a server anywhere is authoritative.'));
+    console.log(`      ${p('ABX')} ${dim('= a native ABX event')}   ${dim('ERC')} ${dim('= plain ERC-721/7572, so wallets and marketplaces that have never heard of ABX still index this token.')}`);
+}
+/**
+ * [4] The claim, demonstrated: delete the local projection and rebuild it from the chain.
+ *
+ * This is the one step that can't be faked by good output — it drops the projection for real
+ * (registration kept), confirms it's gone, replays from the deploy block, and compares a
+ * fingerprint of everything chain-derived. If ABX's premise is wrong, this step fails loudly.
+ */
+async function walkthroughRebuild(indexer, address, before) {
+    step('Prove it — rebuild from nothing');
+    const fpBefore = projectionFingerprint(before);
+    indexer.dropProjection(address);
+    const gone = indexer.getProject(address) === null;
+    console.log(`    ${dim('deleting this machine\'s projection …')}   ${gone ? g('✓ gone') : `${c.orange}⚠ still present${c.reset}`}`);
+    const { state: after, elapsedMs } = await indexer.reindex(address, { full: true });
+    const fpAfter = projectionFingerprint(after);
+    console.log(`    ${dim(`replaying from block ${after.deployBlock ?? after.fromBlock} …`)}   ` +
+        `${g('✓')} ${after.eventCount} events in ${elapsedMs}ms`);
+    if (fpBefore === fpAfter) {
+        ok(`identical state ${dim(`(sha256 ${fpAfter.slice(0, 12)}… over every chain-derived field)`)}`);
+        info('no provider, no backup, no API key — an RPC endpoint and the chain were enough.');
+    }
+    else {
+        warn('the rebuilt state does NOT match what we just had — that is a real bug, please report it.');
+        info(`before ${fpBefore.slice(0, 16)}… · after ${fpAfter.slice(0, 16)}…`);
+    }
+}
+/** [5] Read the token back the way a marketplace would, and check the bytes against the chain. */
+async function walkthroughReadBack(state, baseUrl) {
+    step('Read it back the way a marketplace would');
+    const token = state.tokens[0];
+    if (!token?.minted) {
+        info('no minted token to read yet.');
+        return;
+    }
+    const uri = token.tokenURI;
+    info(`tokenURI(0) ${dim('on chain →')} ${uri ?? dim('(none)')}`);
+    // The demo's default is off-chain custody: the CHAIN holds a keccak256 commitment to the image and
+    // a URI base; this NODE holds the bytes. That split is the thing worth understanding, so name it
+    // rather than implying the JSON came from the chain.
+    info(dim('the chain stored a URI base + a keccak256 commitment; this node serves the bytes.'));
+    try {
+        const res = await fetch(`${baseUrl}/t/${resolveChain(CHAIN).id}/${state.address}/0`);
+        const json = (await res.json());
+        const shown = { name: json.name, image: json.image };
+        console.log(`    ${dim(JSON.stringify(shown))}`);
+        if (Array.isArray(json.abx_provenance)) {
+            info(dim(`every field is tagged with where it came from (abx_provenance: ${json.abx_provenance.length} entries)`));
+        }
+    }
+    catch (e) {
+        info(dim(`could not read the served metadata: ${e.message}`));
+    }
+    console.log(`    ${dim('prove the bytes match the chain:')} ${bold(`abx verify ${state.address}`)}`);
+}
+/** Is a TCP port already bound on localhost? Used to preflight a serve BEFORE spending a tx. */
+async function portInUse(port) {
+    const { createServer } = await import('node:net');
+    return new Promise((resolve) => {
+        const probe = createServer();
+        probe.once('error', (e) => resolve(e.code === 'EADDRINUSE'));
+        probe.once('listening', () => probe.close(() => resolve(false)));
+        probe.listen(port);
+    });
+}
+/**
+ * Index a project we *just* deployed — and don't believe a zero.
+ *
+ * `eth_getLogs` is read-after-write inconsistent on load-balanced RPCs: `waitForTransactionReceipt`
+ * resolves against a node that has the block, then the log query lands on one that doesn't yet, and
+ * returns an empty set for a block we KNOW contains our deploy. The old code took that single read at
+ * face value, printed `✓ reconstructed 0 events`, stored the empty projection, and served an empty
+ * dashboard — a first-run that looks like the toolkit simply doesn't work. It reproduced 100% of the
+ * time on `https://sepolia.base.org`, which is the DEFAULT endpoint when there's no `.env`, i.e. the
+ * documented first run was the broken path. The same block returned all 9 logs seconds later.
+ *
+ * We have the one thing that makes this checkable: we just minted, so the spine cannot be empty.
+ * So verify instead of trusting — re-scan with backoff until events appear, and if they never do,
+ * say so as a FAILURE with the recovery command rather than dressing a zero up as a ✓.
+ */
+async function reindexAfterDeploy(indexer, address, opts = {}) {
+    const attempts = opts.attempts ?? 6;
+    const delayMs = opts.delayMs ?? 1500;
+    let last = await indexer.reindex(address);
+    for (let i = 1; i < attempts && last.state.eventCount === 0; i++) {
+        if (i === 1) {
+            info(dim("no events yet — the RPC hasn't served the logs for that block; re-scanning…"));
+        }
+        await new Promise((r) => setTimeout(r, delayMs));
+        // `full: true` — the stored projection has 0 events, so there is no valid checkpoint to
+        // resume from; a full replay from the deploy block is the only correct re-scan.
+        last = await indexer.reindex(address, { full: true });
+    }
+    if (last.state.eventCount === 0) {
+        warn(`the RPC still reports no logs for this project after ${attempts} tries — the deploy DID succeed ` +
+            `(it's on chain), but this node can't reconstruct it yet.`);
+        console.log(`    ${dim('recover with')} ${bold(`abx index ${address} --full`)} ${dim('in a minute, or point ABX_RPC_URLS at a better endpoint (`abx doctor` ranks them).')}`);
+    }
+    return last;
+}
 /**
  * `abx preview` — serve the program on localhost, live, for as long as the work is being made.
  *
@@ -4376,7 +4577,13 @@ function printServing(url, address) {
         console.log(`    ${dim('image      ')}${url}/t/${cid}/${address}/0/image`);
         console.log(`    ${dim('state API  ')}${url}/api/project/${address}`);
     }
-    console.log(`\n  ${dim('Open the dashboard, then hit “Re-index from chain” to watch state rebuild live.')}`);
+    // The dashboard is READ-ONLY: re-index/verify are admin actions that 404 unless the node has an
+    // ABX_RESOLVER_ADMIN_TOKEN, so there is no button to press. This line used to say "hit Re-index
+    // from chain", which sent every first-run user hunting for a control that isn't there.
+    console.log(`\n  ${dim('The dashboard shows the event spine it replayed — that table IS the reconstruction.')}`);
+    if (address) {
+        console.log(`  ${dim('Rebuild it yourself (read-only, safe):')} ${bold(`abx index ${address} --full`)} ${dim('— replays from the deploy block and must land on identical state.')}`);
+    }
     console.log(`  ${dim('Ctrl-C to stop.')}\n`);
 }
 // ── deploy-resolver: scaffold a hosted resolver for a provider the operator owns ──────────