@artblocks/abx-cli 0.1.0-alpha.9 → 0.2.0

package/dist/riskgate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskgate.d.ts","sourceRoot":"","sources":["../src/riskgate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAA8C,KAAK,YAAY,EAAC,MAAM,MAAM,CAAC;AAGpF,OAAO,EAOL,KAAK,OAAO,EAEb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAS,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAC,MAAM,aAAa,CAAC;AAChF,OAAO,EAAW,KAAK,KAAK,EAAC,MAAM,YAAY,CAAC;AAOhD;yFACyF;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAqBhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAUpD;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9E;AAaD,MAAM,WAAW,gBAAgB;IAC/B;;;iGAG6F;IAC7F,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,SAAS,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;2GAGuG;IACvG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;oCAEgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAkBjD;AA2JD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB;+DAC2D;IAC3D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;yFACqF;IACrF,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;iGACiG;AACjG,wBAAgB,aAAa,CAC3B,KAAK,EAAE,KAAK,EACZ,QAAQ,CAAC,EAAE,OAAO,EAClB,UAAU,GAAE,KAAK,MAAM,EAAE,GAAG,SAA2B,GACtD,OAAO,GAAG,SAAS,CAQrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoCtH"}

package/dist/riskgate.js

@@ -0,0 +1,343 @@
+/**
+ * The CLI's one risk gate for a write — the choke point every signing path (owner-op or deploy)
+ * routes an already-prepared tx through, so `--dry-run` and `--confirm` behave IDENTICALLY no
+ * matter which command reached them.
+ *
+ * Before this module existed, the same three-part shape (preview-and-stop under `--dry-run` →
+ * optional interactive `--confirm` → pick a lane → sign) was hand-written THREE times: ownerops.ts's
+ * `runWrite` (every owner-op), a near-identical `runMinterWrite` ("the minter path does not go
+ * through runWrite, so it needs its OWN dry-run guard" — its own comment conceding the duplication),
+ * and a third copy inline in main.ts's `deploy-code --resume` send path. Each could drift from the
+ * others without anyone deciding it should — and the two owner-op copies HAD already drifted: only
+ * one of them printed the `owner` line on a dry-run preview when the caller supplied one.
+ *
+ * `gatedSend` is the merge. Callers that had NO `--confirm` support (every owner-op) gain it for
+ * free just by routing through here — there is no owner-op-specific reason they lacked it; it was
+ * simply never wired.
+ */
+import { decodeErrorResult, formatEther, zeroAddress } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+import { createInterface } from 'node:readline';
+import { assertChainId, envSigningKey, makePublicClient, pinGas, seriesCodeAbi, GasEstimateBelowFloorError, } from '@artblocks/abx-sdk';
+import { signTx } from './signer.js';
+import { isDryRun } from './flags.js';
+// ── tiny ANSI (kept local — every module here stands alone; see signer.ts/ownerops.ts) ───────
+const C = { reset: '\x1b[0m', dim: '\x1b[2m', bold: '\x1b[1m', green: '\x1b[38;5;115m', orange: '\x1b[38;5;215m' };
+const dim = (s) => `${C.dim}${s}${C.reset}`;
+const bold = (s) => `${C.bold}${s}${C.reset}`;
+/** Resolve the signing lane from flags: `--unsigned` (cold) · `--sign` (wallet) · `--sponsor`
+ *  (ABX creator wallet) · default hot. The one place every write makes this decision. */
+export function laneFromFlags(flags) {
+    // Two lane flags at once is always a mistake, and silently picking one is how a caller ends up in a
+    // lane they did not choose — an agent writing `--send --sign` from two different help lines gets a
+    // browser wallet page when it meant the env key, and reads the wait as a hang. Refuse instead: the
+    // precedence order below is an implementation detail, not an interface.
+    const named = ['send', 'sign', 'sponsor', 'unsigned'].filter((k) => flags[k] !== undefined);
+    if (named.length > 1) {
+        throw new Error(`pick ONE signing lane, not ${named.length}: ${named.map((n) => `--${n}`).join(' and ')}. ` +
+            `--send signs with the hot/env key (the default, so it can also be omitted) · --sign opens a ` +
+            `wallet page · --sponsor uses your ABX creator wallet · --unsigned prints the transaction for you to sign elsewhere.`);
+    }
+    // PRESENCE, not truthiness. A bare `--sign` parses to `'true'`, but `--sign=` parses to `''`, which
+    // is falsy — so a truthiness test sent that caller down the hot-key lane after they explicitly named
+    // the wallet one. That is the one direction that matters: asking for a browser approval and getting
+    // an unattended key signature instead. Naming a lane selects it, full stop.
+    if (named.includes('unsigned'))
+        return 'unsigned';
+    if (named.includes('sign'))
+        return 'sign';
+    if (named.includes('sponsor'))
+        return 'sponsor';
+    return 'send';
+}
+/**
+ * Refuse a real deploy on the HOT lane when there is no key to sign with — before the command has
+ * spent anything.
+ *
+ * The signing lanes are checked at *signing* time, which is the end of a deploy. Everything that
+ * makes a deploy possible happens first, and some of it is neither free nor reversible: `--backend
+ * arweave|ipfs|cloud` UPLOADS the creator's art before any transaction is prepared. So a deploy run
+ * with no key, and no `--dry-run` to say "preview only", would mint an Arweave identity, publish the
+ * art, and only THEN discover it could never have deployed. Under Turbo's free tier the upload
+ * *succeeds*, so the art is published permanently — an irreversible side effect from a run that was
+ * always going to fail.
+ *
+ * `--dry-run` guards every signing choke point (`isDryRun`, `gatedSend`); this is the same idea one
+ * step earlier, and the rule it enforces is the sibling of that one: **a spend or a publish never
+ * precedes the check that this run can be signed at all.** Only the hot lane is checked — `--sign`
+ * (browser wallet) and `--unsigned` (offline signer) deliberately have no local key, and a preview
+ * spends nothing.
+ */
+export function assertLaneCanSign(flags) {
+    if (isDryRun(flags))
+        return; // a preview neither signs nor spends
+    if (laneFromFlags(flags) !== 'send')
+        return; // wallet/cold lanes have no local key BY DESIGN
+    if (envSigningKey())
+        return;
+    throw new Error('no signing key, so this run could not be sent — stopping before it uploads or spends anything. ' +
+        'Pick a lane: --sign --for 0x.. (you approve in your own wallet, no key here) · --unsigned (print the tx ' +
+        'for an offline signer) · or set ABX_DEPLOYER_PK in .env for the unattended hot lane. ' +
+        'To preview without any of them, add --dry-run --for 0x...');
+}
+/**
+ * Opt-in pre-send confirmation gate (`--confirm`). OFF by default → scripted use is untouched. Even
+ * when opted in, it never blocks automation: `--yes` or a non-TTY stdin proceeds silently. Only an
+ * interactive `--confirm` prints the summary and waits for a y/N. Aborts on anything but yes.
+ */
+export async function confirmSend(summary, flags) {
+    if (flags.confirm === undefined)
+        return; // not opted in
+    if (flags.yes !== undefined || !process.stdin.isTTY)
+        return; // don't stall scripts/CI
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => rl.question(`\n  ${summary}\n  Proceed? [y/N] `, resolve));
+    rl.close();
+    if (!/^y(es)?$/i.test(answer.trim()))
+        throw new Error('aborted at --confirm (nothing sent).');
+}
+async function resolveProvider(provider, signer) {
+    return typeof provider === 'function' ? await provider(signer) : provider;
+}
+function printDryRunPreview(prepared, expectedSigner) {
+    console.log(`\n  ${bold('◆ ' + prepared.summary)}  ${dim('(dry run — nothing sent)')}`);
+    for (const [k, v] of Object.entries(prepared.fields))
+        console.log(`    ${dim(k.padEnd(12))} ${v}`);
+    console.log(`    ${dim('to'.padEnd(12))} ${prepared.to ?? dim('(contract deploy)')}`);
+    if (expectedSigner)
+        console.log(`    ${dim('signer'.padEnd(12))} ${expectedSigner}`);
+}
+/**
+ * A revert's own name, when the payload carries one — `RoyaltyTooHigh()` instead of a raw hex dump
+ * or "reverted for an unknown reason".
+ *
+ * Whether we get one is the NODE's choice, not ours: many public endpoints (measured:
+ * `base-sepolia-rpc.publicnode.com` and `sepolia.base.org`) answer a failed `eth_call` with a bare
+ * `execution reverted` and no data at all. So the no-data case says *that*, rather than implying we
+ * looked at a reason and couldn't read it.
+ */
+export function revertReason(err) {
+    const data = err?.data ?? err?.cause?.data;
+    const hex = typeof data === 'string' ? data : data?.data;
+    if (typeof hex === 'string' && hex.length >= 10) {
+        try {
+            const decoded = decodeErrorResult({ abi: seriesCodeAbi, data: hex });
+            return `${decoded.errorName}(${(decoded.args ?? []).join(', ')})`;
+        }
+        catch {
+            /* not one of ours — fall through to the message */
+        }
+    }
+    const short = err?.shortMessage ?? err?.message ?? 'reverted';
+    // viem's phrasing for "the node sent no revert data" reads like OUR failure to decode. Say what
+    // actually happened, and what it almost always means.
+    if (/unknown reason/i.test(short)) {
+        return 'reverted (this RPC returns no revert data) — usually a precondition the contract enforces: a lock, a cap, or the wrong signer';
+    }
+    return short;
+}
+/**
+ * Simulate the prepared transaction against current state, and say what would happen — honestly.
+ *
+ * This is what makes `--dry-run` an *answer* rather than an echo of its own input. It matters most
+ * for a **multicall** — `attach`'s batched pairs, `deploy-code`'s setup — because a multicall is one
+ * transaction, so simulating it exercises the whole sequence atomically against real state, with no
+ * fork and no new surface.
+ *
+ * A dry run that reports `would-succeed` for a send whose real gas turned out to need 49% more than
+ * this function used to check, then failed for real, is a preview asserting an outcome it never
+ * established — the same class of bug fixed for `verify --remote --json` (see `cmdVerifyRemote`'s
+ * fail-closed comment in commands/project.ts): a payload must not claim success it hasn't earned.
+ * Two things had to be true before this could say "would succeed", and neither was checked:
+ *   1. The call executes without reverting — the ORIGINAL check (an `eth_call`, now folded into
+ *      {@link pinGas} below instead of a separate unconstrained call, so the preview shares the
+ *      real send's own gas math, not a second copy of it that could quietly disagree).
+ *   2. The signer can actually PAY for it. `estimateGas` succeeding proves the call is valid; it says
+ *      nothing about whether the account sending it has the ETH to cover `gas × gasPrice (+ value)`.
+ *      A preview that skips this is not "optimistic", it is wrong — the failure this fixes.
+ *
+ * Reports **unknown**, never a false green, whenever it cannot actually prove EITHER of those: no
+ * signer to simulate as, a contract deploy, a target that does not exist yet, an unreachable node, or
+ * a gas estimate that comes back below the transaction's provable floor even after retrying (the
+ * exact same refusal a real send makes — see {@link GasEstimateBelowFloorError}). `unknown` is never
+ * collapsed into `would-succeed` (an optimistic guess) or `would-revert` (a false alarm) — it says
+ * plainly that the question could not be answered, and why.
+ *
+ * `clientOverride` exists for tests: production callers always omit it and get a real client built
+ * from `chainKey`, exactly as before.
+ */
+async function simulateDryRun(prepared, chainKey, expectedSigner, narrate = true, clientOverride, sponsored = false) {
+    const label = 'simulation'.padEnd(12);
+    const unknown = (why) => {
+        if (narrate)
+            console.log(`    ${dim(label)} ${dim(`unknown — ${why}`)}`);
+        return { status: 'unknown', reason: why };
+    };
+    if (!expectedSigner || expectedSigner === zeroAddress) {
+        return unknown('no signer known to simulate as the caller — set a signing key, or use --sign; some commands ' +
+            '(e.g. deploy, predict) also accept --for 0x..');
+    }
+    // Everything below is best-effort: a dry run must work OFFLINE and against an unknown chain (the
+    // preview is the product; the simulation is a bonus). So even constructing the client is guarded —
+    // `resolveChain` throws on a chain key it doesn't know, and that must degrade to `unknown`, never
+    // turn a preview into a failure.
+    let client;
+    try {
+        client = clientOverride ?? makePublicClient({ chainKey });
+    }
+    catch (err) {
+        return unknown(`could not run the simulation (${revertReason(err)})`);
+    }
+    if (prepared.to) {
+        try {
+            const code = await client.getCode({ address: prepared.to });
+            if (!code || code === '0x')
+                return unknown(`${prepared.to} has no code yet on this chain`);
+        }
+        catch (err) {
+            return unknown(`could not run the simulation (${revertReason(err)})`);
+        }
+    }
+    // Reuse the REAL send's own gas selection (`pinGas`, execute.ts — the exact function
+    // `makeHotSender` calls at send time) instead of a second, separately-written `eth_call`. Two
+    // benefits: (a) the preview can never independently drift from what the send would actually do,
+    // and (b) a transaction whose real send would REFUSE (every estimate attempt below the provable
+    // floor) is reported as such here too, rather than "succeeding" against an unconstrained call.
+    let gas;
+    try {
+        gas = await pinGas(client, {
+            from: expectedSigner,
+            to: prepared.to,
+            data: prepared.data,
+            value: prepared.value,
+            gasFloor: prepared.gasFloor,
+        });
+    }
+    catch (err) {
+        if (err instanceof GasEstimateBelowFloorError) {
+            // Not a contract-logic revert and not a network hiccup — this is "cannot be determined safe",
+            // the same refusal a real send makes. Reported as `unknown`, never folded into `would-revert`
+            // (nothing was proven to revert) or `would-succeed` (nothing was proven safe either).
+            return unknown(`the gas estimate (${err.estimate}) came back below the ${err.floor} this transaction provably needs, ` +
+                `even after retrying — the same reason a real send would refuse rather than risk an under-funded ` +
+                `transaction. Retry in a few seconds, or against a different RPC.`);
+        }
+        const reason = revertReason(err);
+        // A node that cannot answer is not a failing transaction — do not report one as the other.
+        if (/fetch|network|timeout|ECONN|unknown chain/i.test(reason))
+            return unknown(`could not run the simulation (${reason})`);
+        if (narrate) {
+            console.log(`    ${dim(label)} ${C.orange}✗ would REVERT${C.reset} — ${reason}`);
+            console.log(`    ${dim(''.padEnd(12))} ${dim('sending this now would burn gas and change nothing.')}`);
+        }
+        return { status: 'would-revert', reason };
+    }
+    // The call is provably executable at `gas`. A sponsored wallet is not the gas payer: price the
+    // request for review, but leave provider-policy acceptance pending until the live send.
+    if (sponsored) {
+        try {
+            const gasPrice = await client.getGasPrice();
+            const value = prepared.value && prepared.value !== '0x0' ? BigInt(prepared.value) : 0n;
+            const cost = gas * gasPrice + value;
+            const reason = 'the transaction executes in simulation; live sponsorship policy is checked only when it is sent';
+            if (narrate)
+                console.log(`    ${dim(label)} ${dim(`provider check pending — ${reason}`)}`);
+            return { status: 'unknown', reason, estimatedGas: gas.toString(), estimatedCostWei: cost.toString() };
+        }
+        catch (err) {
+            return unknown(`the transaction executes in simulation, but its sponsored cost could not be priced (${revertReason(err)})`);
+        }
+    }
+    // On every user-paid lane, what's left is whether the signer can actually PAY for it. This is the
+    // check that was missing entirely: a preview that never compares cost against balance is asserting
+    // an outcome it has not earned.
+    let gasPrice;
+    let balance;
+    try {
+        [gasPrice, balance] = await Promise.all([client.getGasPrice(), client.getBalance({ address: expectedSigner })]);
+    }
+    catch (err) {
+        // We proved the call itself would succeed; we just can't price it. Say so — do NOT fall back to
+        // a bare "would succeed" that quietly drops the affordability question it was just asked.
+        return unknown(`the call would succeed, but the cost to send it could not be priced (${revertReason(err)})`);
+    }
+    const value = prepared.value && prepared.value !== '0x0' ? BigInt(prepared.value) : 0n;
+    const cost = gas * gasPrice + value;
+    const priced = { estimatedGas: gas.toString(), estimatedCostWei: cost.toString(), balanceWei: balance.toString() };
+    if (balance < cost) {
+        const reason = `insufficient funds — this send needs ≈${formatEther(cost)} ETH (${gas} gas × ${formatEther(gasPrice)} ` +
+            `ETH/gas${value > 0n ? ` + ${formatEther(value)} ETH value` : ''}) but ${expectedSigner} has only ` +
+            `${formatEther(balance)} ETH — short by ${formatEther(cost - balance)} ETH.`;
+        if (narrate) {
+            console.log(`    ${dim(label)} ${C.orange}✗ would FAIL${C.reset} — ${reason}`);
+            console.log(`    ${dim(''.padEnd(12))} ${dim('sending this now would run out of funds before it lands.')}`);
+        }
+        return { status: 'would-revert', reason, ...priced };
+    }
+    if (narrate) {
+        console.log(`    ${dim(label)} ${C.green}✓${C.reset} would succeed ${dim(`(≈${gas} gas, ≈${formatEther(cost)} ETH — signer holds ${formatEther(balance)} ETH)`)}`);
+    }
+    return { status: 'would-succeed', ...priced };
+}
+/** Resolve the signer a preview should simulate from the same source the hot send will use.
+ * Explicit owner/buyer pinning always wins; wallet and cold lanes cannot be inferred locally. */
+export function previewSigner(flags, explicit, signingKey = envSigningKey()) {
+    if (explicit)
+        return explicit;
+    if (laneFromFlags(flags) !== 'send' || !signingKey)
+        return undefined;
+    try {
+        return privateKeyToAccount(signingKey).address;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The one send choke point for a SINGLE already-prepared write: `--dry-run` preview (nothing sent,
+ * returns `null`) → optional `--confirm` prompt → lane selection → `signTx`. Every caller — an
+ * owner-op's `runWrite`/`runMinterWrite`, or the deploy family's resumed-setup send — resolves to
+ * this, so the two families can never again each carry their own (possibly diverging) idea of what
+ * `--dry-run` or `--confirm` means. The historical bug class this forecloses structurally: a write
+ * reaching the send lane under `--dry-run` because some caller re-derived the check by hand and
+ * missed a branch.
+ */
+export async function gatedSend(provider, flags, opts) {
+    const expectedSigner = previewSigner(flags, opts.expectedSigner);
+    const lane = laneFromFlags(flags);
+    if (isDryRun(flags)) {
+        const prepared = await resolveProvider(provider, expectedSigner ?? zeroAddress);
+        if (flags.json !== undefined) {
+            const simulation = await simulateDryRun(prepared, opts.chainKey, expectedSigner, false, opts.client, lane === 'sponsor');
+            console.log(JSON.stringify({
+                dryRun: true,
+                sent: false,
+                lane,
+                expectedSigner: expectedSigner ?? null,
+                transaction: prepared,
+                // `transaction.gasFloor` (when present) is a PROVEN MINIMUM used to detect an implausible
+                // gas estimate — not a prediction of total cost. `simulation.estimatedGas`/`estimatedCostWei`
+                // are the real numbers, from the same gas selection the send itself uses; trust those.
+                simulation,
+            }, null, 2));
+        }
+        else {
+            printDryRunPreview(prepared, expectedSigner);
+            await simulateDryRun(prepared, opts.chainKey, expectedSigner, true, opts.client, lane === 'sponsor');
+            console.log(dim(`\n  Re-run without --dry-run to send (lane: ${lane}).\n`));
+        }
+        return null;
+    }
+    await assertChainId(opts.chainKey); // verify the RPC really is the target chain before any irreversible write
+    const preview = await resolveProvider(provider, expectedSigner ?? zeroAddress);
+    await confirmSend(preview.summary, flags);
+    return signTx(provider, {
+        lane,
+        chainKey: opts.chainKey,
+        expectedSigner,
+        yes: !!flags.yes,
+        port: flags.port ? Number(flags.port) : undefined,
+        signUrlFile: flags['sign-url-file'],
+    });
+}
+//# sourceMappingURL=riskgate.js.map

package/dist/riskgate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskgate.js","sourceRoot":"","sources":["../src/riskgate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAC,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAoB,MAAM,MAAM,CAAC;AACpF,OAAO,EAAC,mBAAmB,EAAC,MAAM,eAAe,CAAC;AAClD,OAAO,EAAC,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,MAAM,EACN,aAAa,EACb,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,MAAM,EAA8C,MAAM,aAAa,CAAC;AAChF,OAAO,EAAC,QAAQ,EAAa,MAAM,YAAY,CAAC;AAEhD,gGAAgG;AAChG,MAAM,CAAC,GAAG,EAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAC,CAAC;AACjH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;AACpD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;AAEtD;yFACyF;AACzF,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,oGAAoG;IACpG,mGAAmG;IACnG,mGAAmG;IACnG,wEAAwE;IACxE,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACvG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YACzF,8FAA8F;YAC9F,qHAAqH,CACxH,CAAC;IACJ,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,oGAAoG;IACpG,4EAA4E;IAC5E,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAY;IAC5C,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,qCAAqC;IAClE,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,MAAM;QAAE,OAAO,CAAC,gDAAgD;IAC7F,IAAI,aAAa,EAAE;QAAE,OAAO;IAC5B,MAAM,IAAI,KAAK,CACb,iGAAiG;QAC/F,0GAA0G;QAC1G,uFAAuF;QACvF,2DAA2D,CAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,KAAY;IAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe;IACxD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,yBAAyB;IACtF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,OAAO,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;IACjH,EAAE,CAAC,KAAK,EAAE,CAAC;IACX,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAoB,EAAE,MAAe;IAClE,OAAO,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAoB,EAAE,cAAwB;IACxE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,EAAE,IAAI,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,cAAc;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;AACvF,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,IAAI,GAAI,GAAkD,EAAE,IAAI,IAAK,GAAkC,EAAE,KAAK,EAAE,IAAI,CAAC;IAC3H,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAoC,EAAE,IAAI,CAAC;IAC1F,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,GAAoB,EAAC,CAAC,CAAC;YACpF,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAI,GAA+B,EAAE,YAAY,IAAK,GAAa,EAAE,OAAO,IAAI,UAAU,CAAC;IACtG,gGAAgG;IAChG,sDAAsD;IACtD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,+HAA+H,CAAC;IACzI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAoB,EACpB,QAAgB,EAChB,cAAwB,EACxB,OAAO,GAAG,IAAI,EACd,cAA6B,EAC7B,SAAS,GAAG,KAAK;IAEjB,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAoB,EAAE;QAChD,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,EAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAC,CAAC;IAC1C,CAAC,CAAC;IACF,IAAI,CAAC,cAAc,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,OAAO,CACZ,8FAA8F;YAC5F,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,iCAAiC;IACjC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,IAAI,gBAAgB,CAAC,EAAC,QAAQ,EAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,iCAAiC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,gCAAgC,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,iCAAiC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE;YACzB,IAAI,EAAE,cAAc;YACpB,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;YAC9C,8FAA8F;YAC9F,8FAA8F;YAC9F,sFAAsF;YACtF,OAAO,OAAO,CACZ,qBAAqB,GAAG,CAAC,QAAQ,yBAAyB,GAAG,CAAC,KAAK,oCAAoC;gBACrG,kGAAkG;gBAClG,kEAAkE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,2FAA2F;QAC3F,IAAI,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC,iCAAiC,MAAM,GAAG,CAAC,CAAC;QAC1H,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,CAAC,KAAK,MAAM,MAAM,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,EAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAC,CAAC;IAC1C,CAAC;IAED,+FAA+F;IAC/F,wFAAwF;IACxF,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,GAAG,GAAG,GAAG,QAAQ,GAAG,KAAK,CAAC;YACpC,MAAM,MAAM,GAAG,iGAAiG,CAAC;YACjH,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,4BAA4B,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3F,OAAO,EAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,uFAAuF,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9H,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,mGAAmG;IACnG,gCAAgC;IAChC,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAC,OAAO,EAAE,cAAc,EAAC,CAAC,CAAC,CAAC,CAAC;IAChH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gGAAgG;QAChG,0FAA0F;QAC1F,OAAO,OAAO,CAAC,wEAAwE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,IAAI,GAAG,GAAG,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpC,MAAM,MAAM,GAAG,EAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAC,CAAC;IAEjH,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACnB,MAAM,MAAM,GACV,yCAAyC,WAAW,CAAC,IAAI,CAAC,SAAS,GAAG,UAAU,WAAW,CAAC,QAAQ,CAAC,GAAG;YACxG,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,cAAc,YAAY;YACnG,GAAG,WAAW,CAAC,OAAO,CAAC,mBAAmB,WAAW,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/E,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,KAAK,MAAM,MAAM,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,0DAA0D,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,EAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,EAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CACT,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,kBAAkB,GAAG,CAAC,KAAK,GAAG,UAAU,WAAW,CAAC,IAAI,CAAC,uBAAuB,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACtJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,EAAC,CAAC;AAC9C,CAAC;AAYD;iGACiG;AACjG,MAAM,UAAU,aAAa,CAC3B,KAAY,EACZ,QAAkB,EAClB,aAAwC,aAAa,EAAE;IAEvD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,MAAM,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAoB,EAAE,KAAY,EAAE,IAAsB;IACxF,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,IAAI,WAAW,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC;YACzH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACzB,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,KAAK;gBACX,IAAI;gBACJ,cAAc,EAAE,cAAc,IAAI,IAAI;gBACtC,WAAW,EAAE,QAAQ;gBACrB,0FAA0F;gBAC1F,8FAA8F;gBAC9F,uFAAuF;gBACvF,UAAU;aACX,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC7C,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC;YACrG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,+CAA+C,IAAI,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,0EAA0E;IAC9G,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,IAAI,WAAW,CAAC,CAAC;IAC/E,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,EAAE;QACtB,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc;QACd,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACjD,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC;KACpC,CAAC,CAAC;AACL,CAAC"}

package/dist/scaffold.d.ts

@@ -0,0 +1,12 @@
+/** The file whose presence means the renderer copy genuinely happened (not just `mkdir`). */
+export declare const SCAFFOLD_ANCHOR: string;
+/**
+ * Copy the scaffold at `src` into `dir`, omitting build/dependency dirs.
+ *
+ * Throws if the copy produced no files — the caller must not print a success banner over an empty
+ * directory. Returns nothing on success; `anchor` is guaranteed to exist relative to `dir`.
+ */
+export declare function copyScaffold(src: string, dir: string, anchor: string): void;
+/** @deprecated thin wrapper kept for the existing call sites/tests — prefer {@link copyScaffold}. */
+export declare function copyRendererScaffold(src: string, dir: string): void;
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AA6BA,6FAA6F;AAC7F,eAAO,MAAM,eAAe,QAAgC,CAAC;AAE7D;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAiB3E;AAED,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAEnE"}

package/dist/scaffold.js

@@ -0,0 +1,56 @@
+/**
+ * Copying the bundled renderer scaffold onto a creator's disk.
+ *
+ * This lives in its own module because the inline version of it shipped broken for six releases
+ * (alpha.9 → alpha.14) and could not be reproduced in a dev checkout. `abx scaffold-renderer`
+ * created the directory, printed the whole success walkthrough, exited 0, and wrote **zero files** —
+ * for every user, on every invocation form, while working perfectly for us.
+ *
+ * The cause was a path filter that judged absolute paths:
+ *
+ *     filter: (s) => !/(^|\/)(out|cache|dependencies|broadcast|node_modules)(\/|$)/.test(s)
+ *
+ * `cpSync` hands `filter` ABSOLUTE source paths. An installed CLI lives at
+ * `…/node_modules/@artblocks/abx-cli/assets/renderer-scaffold`, so that pattern matched the source
+ * ROOT — `cpSync` skips a directory's entire subtree when the directory itself is filtered out, and
+ * silently copies nothing rather than erroring. A dev checkout's path
+ * (`…/plan/abx/packages/cli/assets/…`) contains no `node_modules`, so every test we ran passed.
+ *
+ * Two rules follow, and the tests in `test/scaffold.test.ts` pin both:
+ *   1. Judge paths RELATIVE to the source root, never the absolute string.
+ *   2. Never report success without asserting the output actually landed.
+ */
+import { cpSync, existsSync, mkdirSync } from 'node:fs';
+import { join, relative } from 'node:path';
+/** Build/dependency dirs that must never ride along into a fresh scaffold. Matched against the
+ *  path RELATIVE to the scaffold root — see the module note. */
+const SKIP_DIR = /^(out|cache|dependencies|broadcast|node_modules)(\/|$)/;
+/** The file whose presence means the renderer copy genuinely happened (not just `mkdir`). */
+export const SCAFFOLD_ANCHOR = join('src', 'MyRenderer.sol');
+/**
+ * Copy the scaffold at `src` into `dir`, omitting build/dependency dirs.
+ *
+ * Throws if the copy produced no files — the caller must not print a success banner over an empty
+ * directory. Returns nothing on success; `anchor` is guaranteed to exist relative to `dir`.
+ */
+export function copyScaffold(src, dir, anchor) {
+    mkdirSync(dir, { recursive: true });
+    cpSync(src, dir, {
+        recursive: true,
+        filter: (s) => {
+            // Normalise separators so the same pattern holds on Windows.
+            const rel = relative(src, s).split(/[/\\]/).join('/');
+            return rel === '' || !SKIP_DIR.test(rel);
+        },
+    });
+    if (!existsSync(join(dir, anchor))) {
+        throw new Error(`scaffold copy wrote no files into ${dir} (expected ${anchor}) — nothing was written, ` +
+            `so don't build here. Scaffold source: ${src}. ` +
+            `Please report this along with your install path: https://docs.abx.io`);
+    }
+}
+/** @deprecated thin wrapper kept for the existing call sites/tests — prefer {@link copyScaffold}. */
+export function copyRendererScaffold(src, dir) {
+    copyScaffold(src, dir, SCAFFOLD_ANCHOR);
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAC,MAAM,SAAS,CAAC;AACtD,OAAO,EAAC,IAAI,EAAE,QAAQ,EAAC,MAAM,WAAW,CAAC;AAEzC;gEACgE;AAChE,MAAM,QAAQ,GAAG,wDAAwD,CAAC;AAE1E,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAW,EAAE,MAAc;IACnE,SAAS,CAAC,GAAG,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE;QACf,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,6DAA6D;YAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,cAAc,MAAM,2BAA2B;YACrF,yCAAyC,GAAG,IAAI;YAChD,sEAAsE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,GAAW;IAC3D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAC1C,CAAC"}

package/dist/schema.d.ts

@@ -1,15 +1,50 @@
-import type { Hex } from 'viem';
+import type { Address, Hex } from 'viem';
+/** The `--schema` type/auth/format catalog, shown wherever the CLI nudges `--schema`. Kept accurate
+ *  to the on-chain enums (PARAM_TYPES / AUTH_OPTIONS) + the Select-options / Range-bounds format —
+ *  the old hint advertised non-existent `Anyone`/`Admin` auth legs. Used by both `deploy-code`
+ *  (commands/deploy.ts) and `inspect` (commands/reads.ts), so it lives here beside the rest of the
+ *  `--schema` machinery rather than in either command module. */
+export declare const SCHEMA_CATALOG: string;
 export interface ParsedSchema {
     key: string;
     paramType: number;
     auth: number;
+    /** Required by (and only valid for) an Address-bearing auth leg; the contract pairs them strictly. */
+    authAddress: Address;
+    /** Unix seconds after which the VALUE can no longer change. 0 = never locks. A timestamp in the
+     *  past locks it immediately and permanently — that is the supported way to retire a parameter. */
+    lockAfter: number;
     min: Hex;
     max: Hex;
     selectOptions: string[];
 }
+/**
+ * A point in time for `lock=`: unix seconds, an ISO date, or `now` (which means "immediately and
+ * forever" — the retire idiom). Reuses the Timestamp encoder so `lock=2026-12-31` parses exactly
+ * like a `Timestamp[..]` bound does; one date grammar for the whole flag.
+ */
+export declare function parseWhen(raw: string): number;
 export declare function parseSchemaSpec(spec: string): ParsedSchema;
 /** Parse a full `--schema` value: comma-separated specs. */
 export declare function parseSchemaSpecs(raw: string | undefined): ParsedSchema[];
+/** The advisory an EDITION deploy needs before it commits to a schema, or `null` when there is
+ *  nothing to say. Returned rather than printed so the deploy lane decides where it lands.
+ *
+ *  Two things are true on an ERC-1155 edition and on nothing else, and a creator setting up their
+ *  first collector-configurable drop will not have thought about either:
+ *
+ *   1. **Params are per id, so every holder of that id shares one value.** `TokenOwner` means ANY
+ *      holder, and it is last-writer-wins. A "name your copy" schema does not name a copy — it
+ *      renames the work for all 1,000 holders.
+ *   2. **A data param has no on-chain size budget.** One holder can store a large valid value under
+ *      every declared key and make the shared id's `tokenURI` too expensive for common RPC limits —
+ *      for every co-holder, permanently if a `lockAfter` then bites. That is a deliberate protocol
+ *      choice (byte accounting on chain would cost every project to police a configuration almost
+ *      nobody should use), which makes saying it here the actual mitigation.
+ *
+ *  Both are fine when intended: a 1-of-1 edition behaves like a 721, and aggregate state (a counter,
+ *  a shared mood) is exactly what shared params are good at. */
+export declare function editionSchemaAdvisory(schemas: ParsedSchema[]): string | null;
 /** A human one-line rendering of a parsed schema (for the confirm readout). */
 export declare function describeSchema(s: ParsedSchema): string;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAC,GAAG,EAAC,MAAM,MAAM,CAAC;AAO9B,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,CAAC;IACT,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAyD1D;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,EAAE,CAMxE;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAWtD"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAC,OAAO,EAAE,GAAG,EAAC,MAAM,MAAM,CAAC;AAIvC;;;;iEAIiE;AACjE,eAAO,MAAM,cAAc,QAI+B,CAAC;AAK3D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,WAAW,EAAE,OAAO,CAAC;IACrB;uGACmG;IACnG,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,CAAC;IACT,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU7C;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA2F1D;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,EAAE,CAMxE;AAED;;;;;;;;;;;;;;;;gEAgBgE;AAChE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CA0B5E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAatD"}