@artblocks/abx-cli 0.1.0-alpha.41 → 0.1.0-alpha.42

package/dist/ownerops.js

@@ -16,7 +16,7 @@ import { toHex as toHexSdk } from 'viem';
 import { existsSync, readFileSync } from 'node:fs';
 import { basename, resolve as resolvePath } from 'node:path';
 import { gzipSync } from 'node:zlib';
-import { formatEther, getAddress, isAddress, parseEther, toHex, zeroAddress } from 'viem';
+import { formatEther, getAddress, hexToBytes, isAddress, parseEther, toHex, zeroAddress } from 'viem';
 import { backendResolution, CHAIN, chainId, fixedPriceMinterAddress, fixedPriceMinter1155Address, localIndexer } from './config.js';
 import { CliError } from './errors.js';
 import { detectTokenKind, isEditionContract, assertHasParamsSurface, hasParamsSurface } from './kind.js';
@@ -557,6 +557,53 @@ function chainScriptReader(contract) {
         },
     };
 }
+/**
+ * The `gasFloor` `replace-script` restates for its batched multicall (see the call site's own
+ * comment for WHY it restates rather than sums the per-op values `prepareSetScriptChunk` already
+ * computes). This used to be `writeByteCounts.reduce((sum, n) => sum + n * 200, 0)` — code-deposit
+ * cost alone, mirroring `prepareSetScriptChunk`'s own per-chunk floor exactly.
+ *
+ * A funded on-chain sweep found that number 49% below what a real replace-script send actually
+ * needed, and the send failed after passing a `--dry-run` that called it "would succeed" (see
+ * riskgate.ts's `simulateDryRun`, fixed alongside this for the OTHER half of that finding: the dry
+ * run never checked gas/cost at all, floor included). Investigating this specific number: the
+ * deposit-only floor was never WRONG about what it claims — it is still a true lower bound — but it
+ * was radically INCOMPLETE for a multi-chunk replacement, because it omits two costs that are just as
+ * unconditionally "physics" as the 200 gas/byte deposit, and are not "an invented estimate" the
+ * codebase's own philosophy (see execute.ts's `pinGas` doc) warns against including:
+ *
+ *   - `Gcreate` = 32,000 gas per `setScriptChunk` WRITE. `OnChainScript.setScriptChunk` stores its
+ *     bytes via `SSTORE2.write`, which is one `CREATE` per call — a fixed opcode cost incurred
+ *     regardless of chain state, chunk size, or whether the index already held something. A replace
+ *     that (say) uses a small `--chunk-size` to spread one program over many chunks pays this 32,000
+ *     once per chunk; the old floor counted 0 of it, so the gap grows with chunk COUNT, not just
+ *     total bytes — exactly the shape a small-`--chunk-size` multi-chunk replacement produces.
+ *   - The intrinsic cost of the multicall's own calldata — 16 gas per non-zero byte, 4 gas per zero
+ *     byte (EIP-2028), plus the flat 21,000 base every transaction pays (EIP-2) — computed from the
+ *     REAL encoded `data`, not approximated from chunk byte counts. `eth_estimateGas` (what `pinGas`
+ *     compares the floor against) always includes both; the old floor included neither, so it could
+ *     never clear this amount even for a single-chunk replacement with no removes at all.
+ *
+ * Deliberately still NOT included, because — unlike the two above — they genuinely depend on
+ * on-chain state this function doesn't read, and a floor that could overstate the true minimum stops
+ * being a floor: the SSTORE cost of the chunk-pointer mapping and the chunk-count counter (cold vs.
+ * warm, zero-vs-nonzero all vary by what's on chain now), `removeLastScriptChunk`'s own cost, and any
+ * gas refund (refunds apply AFTER execution and never reduce what a transaction must be GIVEN to
+ * avoid running out mid-execution, so they could only ever justify a LOWER floor, working against the
+ * "never send an under-funded tx" goal this exists for). So this remains a floor, not an estimate —
+ * `simulateDryRun`'s new `estimatedGas`/`estimatedCostWei` (from `pinGas`'s real `eth_estimateGas`,
+ * the same call the send itself makes) is the number to trust for cost guidance; this is only ever
+ * the threshold that flags an implausible one.
+ */
+function replaceScriptGasFloor(finalCalldata, writeByteCounts) {
+    const bytes = hexToBytes(finalCalldata);
+    let calldataGas = 0n;
+    for (const b of bytes)
+        calldataGas += b === 0 ? 4n : 16n;
+    const createBase = BigInt(writeByteCounts.length) * 32000n;
+    const depositGas = writeByteCounts.reduce((sum, n) => sum + BigInt(n) * 200n, 0n);
+    return 21000n + calldataGas + createBase + depositGas;
+}
 /**
  * `abx replace-script <address> --script <path>` — the safe, first-class way to replace an
  * UNLOCKED code project's on-chain program (#119). `OnChainScript.sol` permits `setScriptChunk`/
@@ -646,11 +693,14 @@ export async function cmdReplaceScript(address, flags) {
         throw new Error(`replace-script expected to batch ${ops.length} op(s) into one transaction, got ${batched.length}`);
     }
     // `batchOps`/`prepareMulticall` don't sum a folded gasFloor from their sub-ops (each PER-CHUNK
-    // gasFloor is real physics — see prepareSetScriptChunk's own doc — but is dropped once several
-    // ops merge into one multicall PreparedTx). Restate it here so the eth_estimateGas sanity check
-    // still fires for a replacement that stores real bytes.
-    const depositBytes = plan.toWrite.reduce((sum, w) => sum + (w.hex.length - 2) / 2, 0);
-    const tx = depositBytes > 0 ? { ...batched[0], gasFloor: `0x${(depositBytes * 200).toString(16)}` } : batched[0];
+    // gasFloor is real physics — see prepareSetScriptChunk's own doc — but is dropped once several ops
+    // merge into one multicall PreparedTx). Restate it here — using the REAL final calldata, not an
+    // approximation — so the eth_estimateGas sanity check fires for any replacement that changes
+    // anything on-chain, writes or pure removes alike. See replaceScriptGasFloor's own doc for what
+    // changed here and why (a real sweep found the deposit-only version 49% under the true minimum).
+    const writeByteCounts = plan.toWrite.map((w) => (w.hex.length - 2) / 2);
+    const floor = replaceScriptGasFloor(batched[0].data, writeByteCounts);
+    const tx = { ...batched[0], gasFloor: `0x${floor.toString(16)}` };
     const sent = await runWrite(contract, tx, flags, owner);
     if (!sent)
         return; // dry run, or the cold lane — nothing landed to verify yet
@@ -2370,19 +2420,128 @@ async function refuseIfParamKey(contract, field) {
         `\`abx inspect ${contract}\`.)\n` +
         `  If you really did mean the metadata field "${field}" and not the param, re-run with --force-field.`);
 }
+/**
+ * Which scope actually SERVES `field` right now — the same question `abx tokenuri`'s
+ * `abx_provenance` line answers, and the one `lock-field` used not to ask (#F7, cold-agent sweep):
+ * `lock-field --field description --token 0` reported "would succeed" — and DID succeed — on a
+ * project where `description` is COLLECTION-scoped, freezing an empty token-scope slot while the
+ * value every viewer actually sees (the collection one) stayed completely mutable. Every statement
+ * the CLI made was true; together they promised a permanent freeze that never happened.
+ *
+ * Mirrors the renderer's own fallback (`AbxMetadataRenderer._field` / `fieldWithFallback` in
+ * token-api/metadata.ts): a token-scope value wins when set; only when the token slot is empty does
+ * the collection-scope value show through. Best-effort by design — a read that could not be
+ * answered (RPC unreachable, or a contract predating the on-chain-metadata extension) returns
+ * `null` rather than asserting a scope this call does not actually know, matching
+ * `refuseIfParamKey`'s posture just above.
+ *
+ * Exported with an injected `client` (mirrors `readCollectionLocks` in project.ts) so a test can
+ * exercise the real chain-read shape against a mocked `PublicClient` — no network, no live fixture.
+ */
+export async function fieldScopePresence(client, contract, tokenId, field) {
+    const tag = encodeTag(field);
+    const [tokenEntry, collectionEntry] = await Promise.all([
+        tryReadContract(client, { address: contract, abi: oneOfOneImageAbi, functionName: 'tokenField', args: [tokenId, tag] }),
+        tryReadContract(client, { address: contract, abi: oneOfOneImageAbi, functionName: 'contractField', args: [tag] }),
+    ]);
+    if (!tokenEntry || !collectionEntry)
+        return null;
+    return { token: tokenEntry[1] !== '0x', collection: collectionEntry[1] !== '0x' };
+}
+/**
+ * Pure decision core for the wrong-scope lock check (#F7, cold-agent sweep) — exported so it's
+ * unit-testable with no chain at all, matching `computeAvailability`'s split (project.ts): the
+ * chain read is a thin, low-risk passthrough; the judgment call belongs in a function a test can
+ * call directly.
+ *
+ * Mirrors the renderer's own fallback (`AbxMetadataRenderer._field` / `fieldWithFallback` in
+ * token-api/metadata.ts): a token-scope value wins over collection when both are set, so the scope
+ * that's actually SERVED can differ from the scope the caller names. Returns `null` — nothing to
+ * flag — when the chosen scope already IS what's served, or when genuinely neither scope carries a
+ * value yet (locking a truly empty field is unambiguous: there's no "other" visible value this
+ * command could fail to protect).
+ */
+export function detectLockFieldScopeMismatch(presence, chosen) {
+    const effective = presence.token ? 'token' : presence.collection ? 'collection' : 'none';
+    if (effective === 'none' || effective === chosen)
+        return null;
+    return { effective, chosen };
+}
+/**
+ * Refuse, or (under `--force-field`) loudly warn but proceed — the two allowed outcomes of a
+ * detected mismatch, decided PURELY from the mismatch + whether the override flag was passed, so
+ * this is unit-testable without a chain or a console.
+ *
+ * Deliberately does NOT refuse unconditionally with no escape hatch: pre-locking an empty slot so
+ * it can never be filled — e.g. permanently guaranteeing one token can never diverge from the
+ * collection default — is a legitimate, deliberate use of this same command, and an unconditional
+ * refusal would just trade one bug (a silent no-op freeze) for another (a real, protocol-supported
+ * shape the CLI now falsely claims is impossible — see "false refusal is a membrane defect").
+ * `--force-field` is lock-field's existing general override for its own protective checks (see
+ * `refuseIfParamKey` above); this reuses it rather than adding a second, narrower flag for the same
+ * "yes, I really mean this" answer.
+ */
+export function lockFieldScopeVerdict(mismatch, opts) {
+    const { effective, chosen } = mismatch;
+    const correctCmd = effective === 'collection'
+        ? `abx lock-field ${opts.contract} --field ${opts.field} --collection`
+        : `abx lock-field ${opts.contract} --field ${opts.field} --token ${opts.tokenId}`;
+    const servedFrom = effective === 'collection' ? 'COLLECTION scope (shared across every token)' : `TOKEN #${opts.tokenId}'s own scope (a per-token override)`;
+    const chosenDesc = chosen === 'collection' ? 'the COLLECTION scope' : `token #${opts.tokenId}'s scope`;
+    if (!opts.forced) {
+        return {
+            action: 'refuse',
+            message: `locking ${chosenDesc} would report "permanent" and DO NOTHING to freeze what's actually shown: '${opts.field}' for token #${opts.tokenId} ` +
+                `is currently served from ${servedFrom}, not the scope you're about to lock. Lock the scope that's actually visible instead:\n` +
+                `    ${correctCmd}\n` +
+                `  If you deliberately want to freeze ${chosenDesc}'s slot forever anyway (e.g. guaranteeing this token can never diverge from the ` +
+                `collection default), re-run with --force-field — it will proceed, with a loud warning that ${servedFrom} stays unfrozen.`,
+        };
+    }
+    return {
+        action: 'warn',
+        message: `⚠⚠ LOCKING A SLOT THAT IS NOT WHAT'S DISPLAYED ⚠⚠\n` +
+            `    '${opts.field}' for token #${opts.tokenId} is currently served from ${servedFrom} — THIS LOCK DOES NOT FREEZE THAT VALUE.\n` +
+            `    You are about to PERMANENTLY lock ${chosenDesc}'s slot instead (proceeding because of --force-field). That value can never change again, ` +
+            `but the value viewers actually see today is untouched by this operation and remains fully mutable.`,
+    };
+}
+/**
+ * Refuse (or, under `--force-field`, loudly warn but proceed) a `lock-field` whose CHOSEN scope is
+ * not the scope actually serving `field` right now. Best-effort by design: a read that could not be
+ * answered (RPC unreachable, or a contract predating the on-chain-metadata extension) skips the
+ * check rather than asserting a scope this call does not actually know, matching
+ * `refuseIfParamKey`'s posture above. Runs BEFORE `runWrite`, so `--dry-run` and a real send see
+ * this identically.
+ */
+async function warnOrRefuseWrongScope(contract, tokenId, field, collection, flags) {
+    const presence = await fieldScopePresence(makePublicClient({ chainKey: CHAIN }), contract, tokenId, field);
+    if (!presence)
+        return; // couldn't determine either scope — don't block on a fact we don't have
+    const chosen = collection ? 'collection' : 'token';
+    const mismatch = detectLockFieldScopeMismatch(presence, chosen);
+    if (!mismatch)
+        return; // nothing to freeze, or the right scope
+    const verdict = lockFieldScopeVerdict(mismatch, { contract, tokenId, field, forced: flags['force-field'] !== undefined });
+    if (verdict.action === 'refuse')
+        throw new Error(verdict.message);
+    console.log(`    ${red(verdict.message)}`);
+}
 export async function cmdLockField(address, flags) {
     const contract = requireAddress(address, 'abx lock-field <address> --field <name> [--collection | --token 0] [--sign|--unsigned]');
     const field = requireFlag(flags, 'field', 'abx lock-field <address> --field <name>');
     const collection = !!flags.collection;
+    const tokenId = BigInt(flags.token ?? '0');
     // The metadata field and a same-named param are different things; only an explicit --force-field
     // says "yes, I mean the field". See refuseIfParamKey.
     if (flags['force-field'] === undefined)
         await refuseIfParamKey(contract, field);
+    await warnOrRefuseWrongScope(contract, tokenId, field, collection, flags);
     const owner = await read(contract, 'owner');
     console.log(dim(`  note: locking the '${field}' field is permanent and irreversible (freezes all its representations).`));
     const tx = collection
         ? prepareLockContractField({ contract, field, chainId: chainId() })
-        : prepareLockTokenField({ contract, tokenId: BigInt(flags.token ?? '0'), field, chainId: chainId() });
+        : prepareLockTokenField({ contract, tokenId, field, chainId: chainId() });
     await runWrite(contract, tx, flags, owner);
 }
 // ── set-renderer (toggle on-chain URI resolution) ─────────────────────────────