@artblocks/abx-cli 0.1.0-alpha.9 → 0.2.0

package/skill/SKILL.md

@@ -1,359 +1,218 @@
 ---
-name: abx-self-host
-description: Launch and operate a self-hosted ABX NFT end to end with the ABX CLI (`abx`) on testnet — a 1/1 (`abx deploy`), a multi-token Series from a folder of media (`abx deploy-series`), or a generative/code drop (`abx deploy-code`). Covers on-chain vs off-chain metadata, storage custody (local disk, S3/R2, IPFS, Arweave), deploy + mint (now or pre-warmed at a predicted address), rendered thumbnails and on-chain traits for code art, primary sales via the shared fixed-price minter, and owner ops (transfer, refresh, re-point URIs, royalties, lock fields, pause/unpause, supply cap, delegate minting). Use when the user wants to self-host an ABX project, take an image to an NFT on testnet, deploy a collection from a folder of images, launch generative/code art, mint or run a primary sale, refresh a listing, operate a project they launched, choose a storage backend, stand up hosting they own, or point a project at a hosted/managed metadata provider with an API key.
-compatibility: Drives the abx CLI (@artblocks/abx-cli). Co-versioned with it — install/refresh with `abx skill install` so this skill matches the CLI's `abx version`. Requires Node 22.5+.
+name: abx
+description: >-
+  Use the ABX CLI (`abx`) to plan, launch, host, inspect, and operate ABX NFT projects on supported
+  networks: static 1/1s, image series, editions, JavaScript/code drops, and Solidity-rendered projects.
+  Covers on-chain and off-chain content, managed or self-hosted resolvers, storage, minting and sales,
+  PostParams, hooks, custom minters, migrations, feedback, locks, and capability questions. Use for
+  requests to create, deploy, mint, host, serve, verify, repair, migrate, report ABX feedback, or
+  change an ABX collection, or to determine whether ABX supports a mechanic.
+compatibility: Drives @artblocks/abx-cli on Node 22.13+. Co-versioned with the CLI; install or refresh with `abx skill install`.
 metadata:
-  version: "0.1.0-alpha.9"
+  version: "0.2.0"
 ---
 
-# ABX Self-Host Toolkit (`abx`)
-
-L3 agentic surface: image → live self-hosted NFT the creator owns — a **1/1** (`abx deploy`) or a multi-token **Series** from a folder (`abx deploy-series`, see [Series](#series-multi-token-drops)) — and operate it after, with no central service in the loop. Wraps `@artblocks/abx-sdk`.
-
-**You drive this for a creator.** Do the mechanical work yourself; surface only genuine decisions, each a simple choice + a recommendation. If *you* hold the signing wallet (an agent releasing its own work), you *are* the human — pick defaults, run the hot lane.
-
-## Read first (every session)
-
-- **YOU run the `abx` commands — never tell the creator to run one.** You have a shell; use it. Run `doctor`, `ls`, `--dry-run`, `tokenuri`, `state`, `refresh`, `balance`, etc. yourself and read the output — don't paste a command and wait for them to run it or copy back results. The creator's hands-on steps are approving in their **browser wallet** (`--sign`), giving you a value you asked for (their address, a name), and **looking at the art in `abx preview`** — you run that command, but the URL it prints is theirs to open and play with ([Phase 0](#phase-0--make-the-work-first-skip-every-gate-below-until-its-good)). Even "next steps" after a deploy: **run the read-only ones** (`tokenuri` to prove it resolves) and **offer to run** the actions (`refresh`, `unpause`, `mint`) — don't hand over a list of commands to run. Exceptions: a genuinely interactive/again-in-their-env command (an OS login, `gcloud auth`), and the **in-chain Solidity lane's Foundry step** (`forge build/test/deploy` a renderer — `abx` never compiles/deploys Solidity; see [Code projects](#code-projects-generative--code-based-drops)) — then run it if you have the tool, else hand it over.
-- **Version drift — act on it, never just report it.** Two checks, both yours to fix, both **before** you deploy anything:
-  - **Skill ⇄ CLI.** This skill is co-versioned with the CLI. Run `abx version`, compare to this file's frontmatter `metadata.version`. Differ → `abx skill install`, then reload the skill before continuing.
-  - **CLI ⇄ npm.** If any `abx` command prints **`update available`**, upgrade it yourself: `npm i -g @artblocks/abx-cli@latest` (global install) or `npm i --save-dev @artblocks/abx-cli@latest` (project-local — match however it was installed), then `abx skill install`, then reload. Do **not** relay the notice and carry on: a stale CLI can hold canonical addresses that have since moved, so it deploys against dead singletons, and a mid-run `… is not a function` is usually this. You have a shell — upgrading is your job, not the creator's.
-- **Resolve the CLI before you install anything — local beats global.** Probe `npx --no-install abx version` (project-local), then `abx version` (global); only install if both miss, and default to the **project-local** `npm install --save-dev @artblocks/abx-cli`. The package is `@artblocks/abx-cli`; `@artblocks/abx-sdk` is the library and ships no binary. Full ladder + why `--no-install` matters → [Setup](#setup--environment).
-- **`abx doctor` first, always** — full preflight (Node, pnpm, RPC, signing key, storage). Fix any ✗ before deploying ([Setup](#setup--environment)). A missing public-base-url is not a "set up IPFS" signal: for tiny art go on-chain, for larger art pick an off-chain backend — see [Quick start](#quick-start).
-- **Never collect secrets in chat, and never `cat`/`grep` `.env`.** Keys, `PINATA_JWT`, S3 secrets, provider API keys → the project's `.env`. The Arweave/Turbo key is a CLI-managed file (`.abx-self-host/arweave-key.json`) — never paste it. Name the var/file; never take the value. **To see what's configured, ask the tool, not the file:** `abx doctor` and `abx remote` report each credential as set/unset without ever printing one. Reading `.env` spills every secret in it into the transcript — irreversible, and a plain `abx doctor` tells you the same thing.
-- **Testnet only today** — every launch is on a testnet: **Base Sepolia by default** (`ABX_CHAIN` unset), with **Sepolia** also shipped (`ABX_CHAIN=sepolia`). Say "testnet"; don't imply mainnet. **Testnet IS the preview + e2e environment**: it runs the *real* wiring (renderers, generator, on-chain tokenURI assembly), so a creator should deploy there, inspect the actual result (`abx tokenuri` / the live view / `abx verify`), confirm it looks right, and only *then* go to mainnet — no separate local "preview" is as faithful as the real testnet drop, and a testnet deploy is ~free + ~minutes. **One cross-chain gotcha: on-chain library deps (`--dep p5@…`) resolve to on-chain bytes only where an Art Blocks dependency registry exists — that's Sepolia, NOT Base Sepolia.** A no-dependency script (vanilla JS/GLSL) goes fully on-chain on either; a drop that needs a registry-hosted library on-chain must target `ABX_CHAIN=sepolia` (or run the resolver lane).
-- **Scope today = ERC-721 on testnet.** The shipped token standard is **ERC-721** (a 1/1, or a **Series** for many tokens), on Base Sepolia (default) or Sepolia via `ABX_CHAIN`. There is **no `--chain` flag (pick the chain with `ABX_CHAIN`) and no `--erc1155`/`--standard` flag** — don't invent one; mainnet + ERC-1155 are roadmap, not something you flip here. Map the ask to what ships: **"an edition of N" / "N copies"** → an ERC-721 **Series** (`abx deploy-series`, N tokens; for a priced sale of one piece, a 1-token Series). If a creator needs a true ERC-1155 shared-supply edition or an unsupported chain, say plainly it's not in the toolkit today rather than fabricating a recipe.
-- **Is the work finished yet?** If the creator is still *making* the piece, you're in **[Phase 0](#phase-0--make-the-work-first-skip-every-gate-below-until-its-good)** — iterate on the art and keep every deploy question off the table until they say ship. The gates below apply to launching something that already exists.
-- **Two gates decide everything: (1) demo or real? (2) who signs?** Settle both first — *once there's something to launch*.
-- **Confirm the full config before any on-chain write** ([readout](#confirm-before-sending)); wait for go-ahead. Never invent a field silently (name/symbol from filename, an auto description) — show it, flag it `inferred`.
-- **Safe to explore:** `abx <cmd> --help` and `abx deploy --dry-run` never send. You never run a real write just to learn flags.
-- **`deploy` returns; `demo`/`serve`/`preview` block** (they serve) — background them or warn. Background `abx preview` and relay its URL, then keep working while the creator looks; `--shoot` is the one preview mode that exits on its own.
-
-## Which command — what are you launching?
-
-Route by the **content** first, then apply the gates below. The three paths differ most in what you have to *keep running* and where the thumbnail comes from:
-
-| You have | Command | `tokenURI` resolves | Thumbnail (marketplace still) |
-|---|---|---|---|
-| **one image** (a 1/1) | `abx deploy` | on-chain (tiny art) or off-chain — **no server possible** | the image itself |
-| **a folder of images** | `abx deploy-series` | same — on-chain or off-chain, **no server possible** | each image itself |
-| **a program** (generative / code) | `abx deploy-code` | **a resolver you run** (live seed + PostParam injection) — OR `--onchain-uri` (tokenURI on-chain; the canonical generator computes the live view) | **rendered off-chain** by the effect runner, else a placeholder |
-
-**The dividing line is static art vs a running program.** Static art is self-resolving (the file *is* the thumbnail, nothing to keep running); **a code project's thumbnail is *rendered* off-chain, so it ALWAYS needs a public home you provide (`--image-base` bucket, or a resolver) — settle that infra fork with the creator FIRST** (details in [Code projects](#code-projects-generative--code-based-drops)). Nail the project type before the gates.
-
-**Planning a priced primary sale? Decide 1/1 vs Series BEFORE deploying — it's irreversible.** The shared fixed-price minter sells a **Series** (mint-on-purchase); a plain `abx deploy` **1/1 has no minter/pause/payee**, so its only post-mint move is `abx transfer` (settle an off-chain sale). To run a native fixed-price sale of even a *single* piece, deploy it as a **1-token Series** (`abx deploy-series --count 1`), not a 1/1. abx has **no secondary-listing feature** — reselling a held token means an external marketplace or a manual `transfer`. Full detail: [operating.md → Selling](reference/operating.md#selling--the-shared-fixed-price-minter).
-
-## Phase 0 — make the work first (skip every gate below until it's good)
-
-**If the creator is still making the piece, you are in the studio, not in a deploy. Stay there until they say ship.** The gates and decisions below are for *launching* something that already exists — reaching for them while someone is still designing is the single most common way this skill feels wrong to use. A real session: the creator said *"I want to work on one with you"* and got asked about metadata resolution, hosting, and wallet ownership before a single pixel existed. They had to push back with *"let's work on actually designing the piece together first."* Don't make them.
-
-**Which mode are you in?**
-- **They handed you a finished file** (`sketch.js`, a build dir, an image folder) → skip this section, go to [Gate 1](#gate-1--demo-or-real-launch).
-- **They brought an idea, a reference, a vibe, or "let's make one together"** → Phase 0. The deploy is a footnote at the end of an afternoon of work; treat it that way.
-
-**During Phase 0, these are OFF the table** — do not ask, do not "just quickly confirm," do not pre-emptively lay out the tradeoffs: hosting/lane, thumbnails, traits-on-chain, storage permanence, wallet address, supply cap, royalties, mint count, name/symbol. Every one of them is answerable in five minutes *after* the art is right, and asking early reads as pressure to ship something half-made. The **one** exception is a constraint that changes what you'd *write*: if they want an on-chain library (`p5`), say early that on-chain deps mean `ABX_CHAIN=sepolia` — that's an authoring constraint, not a deploy decision.
-
-**The loop** — depth + the `--shoot` details → [reference/code-projects.md → Studio loop](reference/code-projects.md#studio-loop--iterate-on-the-art-before-you-deploy-anything):
-
-1. **Write against the real runtime contract from the first draft** — `abx.tokenData.seed` for randomness, `abx.traits({…})` for features. Not `Math.random()` "for now": a piece prototyped on `Math.random()` looks finished and then deploys as N identical tokens, and retrofitting the seed late means re-tuning every visual you just approved.
-2. **Run `abx preview --script art.js` and give the creator the URL.** It serves the *same document the generator serves* (real `abx.js`, real tokenData) on `localhost:8788`, so they get a seed shuffle, real inputs for every `--schema` PostParam, a live traits readout, and `/grid` for N seeds at once. **This is the one place you hand over a link instead of running it for them** — the art is theirs to judge, and an animated piece cannot be judged from a screenshot. Don't hand-roll a preview page; a stub you write yourself will run a sketch that reads its seed wrong.
-3. **Edit and tell them to refresh.** The program is re-read from disk per render — no restart, no watcher. To check your own work between rounds (you have no browser), `abx preview --script art.js --shoot ./frames` renders the same document headlessly and flags the two silent killers: no traits reported, or identical traits across every seed.
-4. **Take feedback and go again.** Expect several rounds. Rounds are the point — "add faces to the shapes" is a normal Phase 0 request, not scope creep.
-
-**Exit only on an explicit ship signal** ("let's deploy this", "I'm happy with it"). Then run `abx inspect <script>` and open the deploy decisions — and say plainly that some are irreversible, so it's worth a few minutes ([Code projects](#code-projects-generative--code-based-drops)). If *you* feel the pull to start the deploy conversation while they're still iterating: don't. Ask what they want to try next.
-
-## Gate 1 — demo or real launch?
-
-| | **Demo** (`abx demo`) | **Real launch** (`abx deploy` → operate) |
-|---|---|---|
-| Art | generative-from-address | the creator's `--image` |
-| Storage | none — the SVG is inlined **on-chain** | a permanence decision |
-| Host URL | none — nothing is hosted, nothing to bake | a public URL baked on-chain (off-chain custody only) |
-| Key | any funded testnet key (the active `ABX_CHAIN`) | the wallet that should **own** it |
-| Decisions | none — just run it | the framework below |
-
-Just want to see it work? `abx demo`, skip the rest.
-
-## Gate 2 — who signs? (three lanes)
-
-Every write builds an unsigned tx; pick the lane by stakes:
-
-| Lane | Flag | Signs | Use when |
-|---|---|---|---|
-| **Hot** | default (or `--send`) | env key, in-process | autonomous agent · testnet · low value |
-| **Wallet** | `--sign` | human's own wallet (MetaMask/Ledger) | real value · key shouldn't touch `.env` |
-| **Cold** | `--unsigned` | multisig / offline signer | a Safe / advanced setup |
-
-- **Lane detection:** you hold the key + low stakes → hot. Human owns the valuable wallet → wallet. Multisig → cold. Beyond throwaway testnet, lead with `--sign`.
-- **Missing key is a fork, not a blocker.** If you'd pick hot but `.env` has no key, offer both: add a funded key, or `--sign` in a browser wallet.
-- **On the wallet lane, ALWAYS ask "which wallet will you connect?" and pass `--for <addr>` — don't offer a "just connect whatever" path.** The connecting wallet becomes owner + mint recipient + royalty receiver, so `--for` pins it and makes the sign page + CLI refuse a mismatched wallet (a real session skipped this and let a random connected wallet own the collection). All three deploy commands **warn on `--sign` without `--for`** (*"whichever wallet connects becomes owner + royalty receiver + mint recipient — pass --for to PIN it"*); treat that as a prompt to get the address, not to proceed.
-- **`--for` is a DEPLOY concern, not an owner-op one.** It pins who *becomes* the owner at deploy. Post-launch owner ops (`set-royalty`, `transfer`, `minter configure`, `set-minter`, `pause`, …) already sign as the contract's **current on-chain owner** — the wallet lane targets that automatically — so `--for` isn't needed there (passing it is harmless but ignored). Just connect the owner wallet.
-
-**⚠ `--sign` BLOCKS until the human signs — ALWAYS background it with `--sign-url-file`, NEVER foreground.** Foreground hangs your whole turn (you can't read the URL or talk to the human) and looks frozen. The #1 way agents break the wallet lane. The flow:
-
-1. Background-run `--sign --sign-url-file <path>` (e.g. `/tmp/abx-sign-url`).
-2. Read the URL from that file (fallback: grep output for `ABX_SIGN_URL=`) **every time — never assume the port**. Each op gets a fresh server; if the friendly port (8799) is still busy it auto-falls back to a different one, so the file is the source of truth. Server binds in ~1–2s; poll a couple times.
-3. Relay: "Open `<url>`, connect your wallet, approve." Don't auto-open (node may be remote). Multi-tx → tell them it's N approvals in one session.
-4. Human approves; only the signed tx hash returns.
-5. Let the background command finish (it signs + confirms + re-indexes), then report. Don't kill it.
-
-**⚠ Run wallet-lane ops ONE AT A TIME — never start the next `--sign` op until the previous background command has finished (step 5).** Each op is its own process serving its own page; overlapping them means the human can land on the *previous* action's page, which (having already completed) shows "done" instantly — that "done" is the last op, not the new one. If a session is genuinely stuck (human never signs), the next op will open a *fresh, different* URL — so relay the new URL from the file and tell them to open that one, not the old tab.
-
-- **Sign page is operation-aware** — shows decoded intent ("Transfer #0 → 0x…"), gates on network + signing wallet + the tx, and the CLI refuses a mismatched signer server-side too.
-- **Multi-tx signs in ONE session** (hot + wallet only). `--onchain-image` stages bytes before the deploy that references them; the human connects once and walks `Transaction 1 of N`. Cold can't (staging is interactive) — `--unsigned --onchain-image` errors; use `--send`/`--sign`.
-- **Keep tx count low and say it up front.** A configured token deploys in one tx; `--onchain-image` adds staging tx(s); several owner edits collapse into one atomic `multicall`.
-- **Off-chain storage uploads are NOT wallet approvals — never count them as signatures.** An IPFS upload (Pinata `PINATA_JWT`) or a managed-key Arweave upload happens *before* signing with **no wallet prompt**; only **on-chain staging + the deploy** are approvals. So an off-chain IPFS/Arweave deploy is **one** wallet approval (the deploy). Say it that way — *"1 approval (the deploy); your N images upload to IPFS first, no signature"* — don't fold uploads into the MetaMask count (the classic "2 txs, approve both" mistake). *Exception:* `--storage-signer eth --sign` makes each upload a `personal_sign` in the same session (no gas) — then, and only then, they're approvals too.
-
-## Quick start
-
-**Custody is the master call; resolve it before signing/identity.** The rule, by size:
-
-| Art size | Default | Why |
-|---|---|---|
-| **Tiny** (≲ 24 KB/file, ≲ 256 KB total) | fully **on-chain** (`--onchain-image --compress fastlz`) | no host, renders forever, cheaper *at this size* |
-| **Bigger / photographic** (most PNG/JPEG) | image **off-chain**, JSON on-chain (`--onchain-uri --backend arweave`) | on-chain is ~200 gas/byte → far more expensive here; Arweave is pay-once permanent |
-
-On-chain's edge past tiny is self-resolution/permanence, **never cost** — don't call it "cheaper" above the thresholds. The CLI warns when an on-chain image exceeds them.
-
-**When the user names off-chain custody for tiny art ("deploy it as an IPFS NFT"), lead with the on-chain recommendation in your *first* reply** — don't bury it, and don't collect resolver-URL details for a path you're about to advise against. "For a 2.4 KB SVG I'd go fully on-chain — no server, renders forever, cheaper. Want that, or IPFS?" Then let them choose (you surface the better default; you don't override the request). Defaulting to "IPFS" for tiny art is what lands it at a broken localhost URI.
-
-Tiny-art path:
-1. **Confirm identity** (name, symbol, `--description`, royalty, owner) via the [readout](#confirm-before-sending).
-2. **Deploy + mint in one go:**
-   ```bash
-   abx deploy --image art.svg --name "…" --symbol … --description "…" --onchain-image --compress fastlz [--sign --for 0x…]
-   ```
-   = staging tx(s) + one deploy-that-mints. **Mint at deploy — no `--no-mint`** (nothing to warm).
-3. **Prove + finish:** `abx tokenuri <addr>` (reads metadata straight from chain) · `abx refresh <addr>` (nudge marketplaces) · lock later once it resolves: `abx lock-field <addr> --field image` then `abx lock-uri <addr>`.
-
-For large/dynamic media, off-chain custody, or operating an existing project, use the framework + reference files below.
-
-## Series (multi-token drops)
-
-One contract, **N tokens**, static creator metadata — a folder of media → a collection. **Everything from the 1/1 applies per token** (custody, on-chain vs off-chain, signing lanes, identity, locking, warming); only the three points below are new. Reach for it when there's more than one piece; a single image is `abx deploy`.
-
-```bash
-abx deploy-series --dir <media-dir> --name "…" --symbol … [--onchain-uri --backend arweave|ipfs|cloud | --onchain-image --compress fastlz | --onchain-uri | --public-base-url https://…] [--mint-all | --mint-count N | --no-mint]
-```
-**Quick start — a folder of photos, permanent, no server:**
-```bash
-abx deploy-series --dir ./photos --name "My Series" --symbol MS --onchain-uri --backend arweave --mint-all --sign
-```
-Files natural-sort into **tokens `0…N-1`** (`--count N` uses the first N); a token's metadata is its token id. `--dry-run` and the [readout](#confirm-before-sending) work identically (token count + mint plan). **Content placement is per token — the same custody call as a 1/1 (see [Decisions](#decisions-real-launch)).** The one Series-specific win: a **same-extension folder** uploads as ONE directory/manifest → a single collection `url-template` (O(1) on-chain, any size); mixed extensions fall back to per-token `url` fields (still no server). `cloud` needs `--public-base`. **Per-token traits: `--attributes <file.json>`** — a JSON **array** indexed by token id, or an **object** keyed by filename / token id (each value an attributes array or a `{name:value}` map). **Lane-aware, exactly like the 1/1's traits**: off-chain operator metadata by default (resolver-served, editable later via `abx add <addr> --attributes`), inlined **on-chain** when the token resolves on-chain (`--onchain-uri`) or you pass `--traits-onchain` — small/medium collections; a huge series sets on-chain traits post-deploy via `set-field` under a gas budget. *(For **generative** traits computed from a seed, that's a code project — `abx.traits()` / `--attributes-renderer` — not a static Series.)*
-
-## Code projects (generative / code-based drops)
-
-A **program is the content** (`abx deploy-code` → a `SeriesCode`): output is a function of live on-chain state (`tokenData`: coordinates + `seed` + PostParams), injected at view time. Everything from a [Series](#series-multi-token-drops) applies (mint order, lanes, identity, supply cap, minter, pause). This section is the **decision tree**; the operating depth — what to keep running, the resume loop, verify steps, render ops, lane internals, the arweave delay, selling — lives in **[reference/code-projects.md](reference/code-projects.md)**.
-
-**Infra fork FIRST (before any lane talk): a code project's thumbnail is *rendered* off-chain, so it ALWAYS needs a PUBLIC home you provide — there is NO zero-infrastructure code drop, and "fully on-chain" does NOT mean "nothing to run."** Settle the shape with the creator up front:
-- **Off-chain resolver** (`--public-base-url` + rendering, ~a few $/mo self-hosted) — **the default for a drop you'll sell.** Auto-renders every mint + param change, serves traits with no Solidity, and stays **maneuverable** (metadata/serving evolve with no on-chain surgery) while marketplaces fetch a **small** `tokenURI`. A **managed provider whose descriptor says `render.attached`** covers both halves with one API key — no effects runner to stand up ([hosting.md → Managed providers](reference/hosting.md#managed-providers--a-resolver-someone-else-runs---remote-name)).
-- **Fully on-chain** (`--onchain-uri --image-base <a bucket you own>`) — maximal durability, no always-on service. Trade-offs: the whole ~200KB+ doc rides each `tokenURI` (some marketplace/indexer reads choke), **manual** stills (`abx render`), on-chain traits need a deployed renderer, later changes are on-chain re-points. Choose it deliberately when permanence outweighs maneuverability. *(The one zero-infra-AND-on-chain exception: the in-chain **Solidity** lane below.)*
-
-**Writing the program yourself (the creator brought an *idea*, not a file)? There's ONE runtime contract — get it right or the drop is silently broken** (seed never injects → every token identical; traits empty). The program reads state via **`abx.tokenData`** (a flat object: `.seed`, and each `--schema` key flat, e.g. `.palette`) and reports traits via **`abx.traits({…})`** — never an invented global (`window.tokenData`, `window.tokenTraits`) and never "defensively across variants." `abx.traits()` is the ONLY thing captured into `attributes`, on the resolver lane too. Verify with `abx inspect` (its **PostParams** + **Traits** lines reflect what the program actually reads/reports — if they're empty but you intended a param/traits, you read it the wrong way), THEN pick a lane. Full contract: [reference/code-projects.md → Authoring the program](reference/code-projects.md#authoring-the-program--the-abxjs-runtime-contract-get-this-right-first).
-
-**Run `abx inspect <script>` before proposing any lane, then adopt the recommended lane it prints — don't hand-assemble a different flag set.** (Exception: the in-chain **Solidity-render** lane below has no JS script to inspect — go straight to it. `abx inspect` only analyzes a JS file.) A code project has surfaces that each must land *somewhere public* — the fatal mistake (seen in real sessions) is picking *“fully on-chain, no server!”* and only discovering, one at a time after deploy, that it carries no thumbnail, no traits, and dropped a PostParam. **These are all DEPLOY-TIME decisions — an on-chain field with no pointer CANNOT be backfilled** (least of all to localhost). `abx inspect` and `deploy-code --dry-run` print a **Surfaces block** grading each one; **every ⚠ there is a marketplace-facing hole you must close before deploy — trust it over your own read.** Resolve all of them into ONE coherent lane with the creator BEFORE you collect identity or show a config:
-
-| Surface | On-chain | Off-chain |
+# ABX
+
+Use `abx` as the execution and truth surface. Help, capability output, dry runs, on-chain reads, and
+typed errors outrank remembered prose.
+
+## Non-negotiable rules
+
+- Never read or print `.env`, private keys, RPC URLs, provider tokens, storage credentials, wallet
+  session URLs, or Arweave JWK contents. Use `abx doctor`, `abx remote`, and `abx storage show` to
+  inspect configuration safely.
+- Use `pnpm abx …` inside the ABX source repository. Use `abx …` in a creator project or installed
+  environment. Run `abx version` if provenance is uncertain.
+- Treat an available CLI update as an action item. Recommend upgrading before further planning or
+  preparing a write: current ABX releases retain support for canonical projects created by earlier
+  releases, and updating local tooling does not change deployed contracts. Never upgrade silently.
+  After an upgrade, run the scope-appropriate `abx skill install`, restart the agent, and rerun
+  `abx doctor` plus any help or dry run used for the plan. If the creator defers, state that the
+  installed version remains behind and use only that version's live help and capabilities.
+- Read the full `chains` array from `abx capabilities --json` before choosing a network. Never
+  operate on a `disabled` chain. Call out `experimental` or `beta` status and its risks before a
+  transaction. Select with `ABX_CHAIN=<chain>`; there is deliberately no `--chain` flag.
+- On a production `beta` network, say that real funds and irreversible state are at risk; ABX has
+  not had an independent third-party audit; bugs, misconfiguration, and
+  nondeterministic agent behavior may cause permanent loss. Link to https://github.com/ArtBlocks/abx,
+  prove the same flow on the paired testnet, and summarize the network, signer, transaction group,
+  value, and irreversible choices before asking to send. An environment key may still sign deliberate
+  automation; do not impose a browser-wallet requirement the creator did not choose.
+- Run `abx help <command>` immediately before composing a non-trivial command. Do not recover flag
+  syntax from this skill.
+- Never infer that a capability is absent because a flag is absent. Run `abx capabilities --json`,
+  identify a native lane or extension seam, and read [capabilities.md](reference/capabilities.md).
+- Never hand-roll transactions, nonces, retry loops, resolver URLs, or contract-type detection when
+  the CLI exposes the operation. One EOA must have one serialized write sequence.
+- Never send, mint, transfer, lower a cap, change authority, or apply a lock until the human confirms
+  the exact action. Locks, ownership transfers, and several deploy choices are irreversible.
+- **Never lock a token or collection URI to a domain the creator does not own.** The base URI remains
+  updatable only until it is locked. Do not point at a managed remote and then lock that provider's
+  domain. If the provider supports custom domains, route a creator-controlled domain to it, verify
+  the production path, and lock only that domain. ABX Services does not currently support
+  custom-domain routing, so never lock an `abx.io` URI.
+- Never submit feedback, project data, logs, or agent/session context to ABX or a remote provider
+  until the human reviews the preview and approves that specific report. Redact credentials and
+  unrelated personal or project information. `abx feedback` previews by default; `--yes` sends.
+- Never fold `abx submit-app` into deployment. Listing is a separate, optional post-deploy action.
+
+## Use the lifecycle
+
+Follow this state machine instead of accumulating retries:
+
+1. **Discover** — identify the working directory, CLI provenance/version, active chain, artifacts,
+   existing contract addresses, configured remote, and signer preference. Run `abx doctor` for a
+   deployment or unfamiliar environment. Surface and recommend any available CLI update before
+   planning a deployment or write; do not bury the notice in setup output. If the creator has not
+   chosen a signer, inspect the live remote and prefer `--sponsor` when the active chain and command
+   are advertised as eligible; otherwise choose the appropriate bring-your-own lane. Never silently
+   replace an explicit signer choice.
+2. **Classify surfaces** — decide collection shape, runtime, required public surfaces, custody,
+   resolution, authority, mutability, and mint/sale timing. Use the model below.
+3. **Inspect** — run `abx capabilities --json`; for code run `abx inspect` and `abx preview`. For an
+   existing collection run `abx state`, `abx tokens`, `abx tokenuri`, and `abx verify` as relevant.
+4. **Plan** — use the selected deploy command with `--dry-run --json`. Read its normalized shape,
+   addresses, surface warnings, transaction count, storage activity, and irreversible choices back
+   to the creator. A dry run may perform read-only network probes; it must not send or store. Select
+   the signer before this dry run; changing lanes can change the owner, salt, and predicted address,
+   so rerun the preview after any signer change.
+5. **Confirm** — confirm name, symbol, token standard, code-capable/static type, burnability,
+   ERC-721C/ERC-1155C enrollment, edition arithmetic, royalty ceiling, signer, costs, public URLs,
+   initial mint, and every requested lock.
+6. **Execute** — let the CLI sign and serialize the operation. Do not start a second write process
+   with the same EOA. Honor structured lifecycle states and terminal errors.
+7. **Verify** — verify the contract and each promised surface from its canonical path. Use on-chain
+   reads for self-resolving metadata and `abx verify`/remote status for hosted surfaces. Mint token 0
+   before expecting token-specific renders.
+8. **Operate** — configure sales, publish renders, migrate, refresh marketplaces, transfer authority,
+   or lock only after verification. Record the contract address, chain, deploy block, custody,
+   resolution, owner powers, and remaining mutable surfaces.
+
+When diagnosing, identify the current state and choose one next transition. Read
+[diagnose.md](reference/diagnose.md); do not build a ladder of speculative retries.
+
+## Model the project by independent dimensions
+
+Keep these concepts separate. Most bad ABX plans collapse two of them into “hosting.”
+
+| Dimension | Decide |
+|---|---|
+| **Collection shape** | one work; N unique works; one or N ids with limited/open copies |
+| **Runtime** | static media; JavaScript program; build directory; Solidity field renderer |
+| **Public surfaces** | metadata, image, animation, traits, attachments, PostParams |
+| **Custody** | on-chain bytes, Arweave, IPFS, cloud, or local development storage |
+| **Resolution** | on-chain renderer, hosted resolver, or on-chain JSON pointing at external media |
+| **Rendering** | no derived render, one-shot stills, continuous effects, or Solidity-computed fields |
+| **Authority** | owner, token holder, delegated address, minter, hook, transfer validator |
+| **Mutability** | editable values/pointers, governed values, and the locks applied after verification |
+
+Use precise language:
+
+- **On-chain bytes** describes custody. **Self-resolving** describes resolution.
+- **Chain-complete** means the requested document has no off-chain dependency. It does not promise
+  immutability or that every third-party RPC can execute a large read.
+- **Locked** names a particular stored value or pointer. It does not prove that code behind a proxy
+  is immutable or that every output input is frozen.
+- Marketplace refresh re-fetches a projection; it does not mutate canonical state.
+
+## Choose the native deployment family
+
+Run `abx capabilities --json` for the current matrix, then load [deploy.md](reference/deploy.md).
+
+| Intent | Command | Default contract shape |
 |---|---|---|
-| **tokenURI + animation** | `--onchain-uri` — *if* script + every dep fit one `tokenURI` eth_call (`abx inspect` estimates) | a resolver (`--public-base-url`) |
-| **thumbnail (`image`)** | ❌ never computed on-chain — needs a public destination: `--image-base <S3/R2/CDN you own>`. **No destination ⇒ placeholder FOREVER + orphaned render, not backfillable. Never localhost.** | a resolver's `/image` |
-| **traits (`attributes`)** | a Solidity `--attributes-renderer 0x…` you **DEPLOY** (fork `SeedTraitsRenderer`) — **not a free flag or guessable address** (`deploy-code` refuses a codeless one; "ports to Solidity" ≠ "deployed") | a resolver stitches the JS `abx.traits()` |
-| **PostParams** | declare EVERY key the script reads: `--schema key:Type:Auth` (a palette collectors set = `palette:HexColor:TokenOwner`) — else silently dropped at render | — |
-
-**The resolver is the pivot: choosing *no resolver* forecloses the off-chain column for thumbnail + traits.** (On `--onchain-uri`, an unauthenticated Etherscan "Read Contract" can hit its gas cap on the big doc and look like a revert — expected; verify with `abx tokenuri`, never `abx index --full` to "fix" it. Diagnosis depth → [reference/troubleshooting.md](reference/troubleshooting.md).)
-
-**Pick your code lane** (all `abx deploy-code`):
-
-| Your sketch | Flags | Result |
-|---|---|---|
-| Vanilla JS, no libraries | `--script f.js --onchain-uri` | **fully on-chain** — resolves from any RPC forever |
-| Script + a library on-chain (e.g. `p5@1.0.0`, **Sepolia only** — needs the AB dependency registry, absent on Base Sepolia) | `--script f.js --onchain-uri --dep p5@1.0.0` | **fully on-chain** — *iff the dep report says “ON-CHAIN bytes available”* |
-| Script + a CDN-only library, or very large params | `--script f.js --public-base-url https://…` | **resolver lane** — you host a resolver; live metadata |
-| A pre-built app (webpack/vite output) | `--code-dir build/` (+ `--onchain-uri` or `--public-base-url`) | **no server to run**, gateway-served → **never** chain-complete (8KB param budget) |
-| A **Solidity renderer** (SVG on-chain, from seed+params) | `--image-renderer 0x<svg> [--attributes-renderer 0x<traits>] --onchain-uri` (**no `--script`**) | **truly in-chain** — image + traits computed on-chain, tokenURI on-chain, **zero infra** |
-
-**⭐ In-chain Solidity lane — recommend on-chain `tokenURI` without hesitation.** The artwork is a Solidity `IAbxFieldRenderer` returning an SVG from seed+params (not a JS program), wired `--image-renderer 0x… [--attributes-renderer 0x…] --onchain-uri` with **no `--script`/`--code-dir`**: image AND traits computed on-chain, `tokenURI` assembled on-chain — **genuinely nothing to run** (a small SVG, so the large-`tokenURI` caveat doesn't apply). **NOT no-code, though**: the renderer is a contract the creator compiles + deploys with Foundry. **`abx scaffold-renderer <dir>`** writes a ready-to-build project (worked renderer + coherent traits + the interfaces with invariants + never-revert tests + deploy script); they `forge test`, deploy, and hand the address to `--image-renderer 0x…` (which verifies code-at-address, never compiles/deploys Solidity). Not comfortable with Solidity? Steer to the resolver or (tiny static SVG) `--onchain-image`. Depth → [reference/code-projects.md](reference/code-projects.md#in-chain-solidity-svg--the-zero-dependency-lane) · interface/invariants → https://abx.docs.artblocks.io/protocol/renderers/.
-
-## Decisions (real launch)
-
-Master call is **custody × mutability**:
-
-| | **Mutable** (name/desc/traits may change) | **Immutable** (never changes) |
-|---|---|---|
-| **Tiny static** (≲ 24 KB/file, ≲ 256 KB total) | **on-chain renderer** — `--onchain-image --compress fastlz`. No host, mutable via `set-field`, permanent. | on-chain renderer + `lock-field` + `lock-uri` once it resolves. |
-| **Bigger / dynamic** (most PNG/JPEG) | **image off-chain, JSON on-chain, no server** — `--onchain-uri --backend arweave` (or `ipfs`). Renderer assembles JSON pointing at the bytes; many files → one `url-template` (O(1)). For metadata you edit often, a **resolver** instead — a managed provider or your own (`abx deploy-resolver`), [hosting.md](reference/hosting.md). Not fully on-chain (~200 gas/byte). | image off-chain (Arweave = permanent) + on-chain renderer + `lock-field`/`lock-uri`. Or a frozen `ipfs://` override + `lock-uri`. |
-
-**Four patterns, by where bytes live × how `tokenURI` resolves:**
-1. **Fully on-chain** (`--onchain-image`) — bytes + JSON on-chain. Tiny art only.
-2. **Image off-chain, JSON on-chain, no server** (`--onchain-uri --backend arweave|ipfs|cloud`) — the sweet spot for static art. Arweave/IPFS (permanent, content-addressed) or your S3/CDN (`--backend cloud --public-base <url>`; centralized, mutable). Many files → one `url-template`.
-3. **Remote resolver** (`--public-base-url` + a node) — for mutable/dynamic metadata; **self-hosted** (`abx deploy-resolver`, you run it) or a **managed provider** (an API key, they run it). Same interface — swap with one re-point.
-4. **Inline SVG on-chain** — self-contained vector art inlined into `tokenURI`. For a **1/1** that's `abx deploy … --onchain-uri`; for a **Series** of tiny SVGs use `abx deploy-series … --onchain-image --compress fastlz` (bare `--onchain-uri` on a folder does NOT inline the images — it's the image-custody flag `--onchain-image` that puts SVG bytes on-chain per token).
-
-**Picking IPFS (or Arweave) does NOT mean running a server.** The `--onchain-uri --backend ipfs|arweave` path (pattern 2) bakes the image's public **gateway** URL into on-chain JSON — a pinning service's read endpoint (a *dedicated* Pinata gateway for IPFS), not a resolver you host. So when a creator chooses IPFS, **default to this no-server path** — image on IPFS, JSON on-chain, nothing to keep running (just keep the pin alive). You only need a **resolver** (pattern 3 — managed or self-hosted) if they want *freely editable* metadata. Never present IPFS as blocked on "a public URL" or "a server always online": the gateway belongs to the pinning service and the JSON lives on-chain. (The one real input IPFS needs is `PINATA_JWT` in `.env` for pinning — that's an API upload, not a host.)
-
-**No-server tradeoff (patterns 1, 2, 4):** with the on-chain renderer only the *image* is off-chain — any **description / traits / animation_url live on-chain** (gas to write, permanent, lockable), vs a hosted resolver where they're free to edit. Cheap (a shared value is **one collection-scope field**, not one per token — the renderer falls back token→collection), but the creator should choose "no server" knowing their text metadata is on-chain.
-
-Get decisions 1–2 right before deploy (image commitment + resolver URL are written then; re-pointable, but):
-
-**1. Storage permanence** — where bytes live. Not irreversible: bytes are content-addressed by their on-chain keccak, so start on one backend and move later (`abx verify` confirms the hash). Don't let it block a first deploy.
-- `arweave` = pay-once permanent, no recurring fee. `cloud` (S3/R2) = durable, you maintain it. `ipfs` = decentralized, you pin it. `fs` = zero-config start, dies with the disk → move before it matters.
-- **`arweave` is nearly as easy as `fs` for small art** — Turbo default: **under 100 KB free, no setup** (a managed `.abx-self-host/arweave-key.json` minted on first upload; back it up with `abx storage backup-key`). Choose per command with `--backend` (stateless, no config file); a backend missing its secret falls back to `fs`.
-- **Who pays is a lane (`--storage-signer`)** — Turbo credits attach to an identity (managed key · `.env` key · browser wallet). **Before any top-up, check BOTH balances** (`abx storage balance --backend arweave` shows the managed key AND the wallet — spend the wallet's credits if present). On an upload error surface it verbatim — `…already been uploaded…` is *success* (dedup); don't reflexively top-up or switch to IPFS. Full lanes + failure playbook → [hosting.md](reference/hosting.md#arweave-via-turbo--the-easy-permanent-path-read-before-quoting-setup).
-
-**2. Public host URL — and who runs the resolver** (**off-chain custody only**). Baked into `tokenURI` at deploy, so the CLI **refuses an off-chain deploy without a public URL** (`ABX_PUBLIC_BASE_URL` or `--public-base-url https://…`) and **never bakes localhost** (that token resolves for no one). No exceptions.
-- **First ask whether you need a host at all** — tiny art is cheaper and more durable on-chain (no host). For bigger art, Arweave (no host to run) beats a resolver unless you need mutability or serve many files.
-- **A named remote is already configured (`ABX_REMOTE_<NAME>_URL` in `.env`)? Use it.** The creator already chose a provider — don't stand up new infrastructure beside it. **Run `abx remote <name>` FIRST, before registering anything**: it prints the provider's chain coverage + whether rendering is managed, and it *validates the key* (`401` = the token in `ABX_REMOTE_<NAME>_TOKEN` is stale/wrong → they replace the value in `.env`; `403` = the key is fine but not authorized for this contract/chain → provider-side scoping, don't touch the key). Then register: `abx add <addr> --remote <name>`. Testing a replacement key without editing `.env` first: `abx remote <name> --remote-token <new-key>`.
-- **Otherwise, two equal ways to have a resolver, one config change apart.** A **managed provider** — one base URL + one API key, no cloud account, nothing to keep alive; often **managed rendering** too, so a code drop needs no effects runner (**lead with this when the creator doesn't already run infrastructure or doesn't want to** — [hosting.md → Managed providers](reference/hosting.md#managed-providers--a-resolver-someone-else-runs---remote-name)). Or **self-host** (`abx deploy-resolver`, [hosting.md](reference/hosting.md)) — the creator owns the node and the cloud account. Same interface, same commands; a project moves between them with one re-point + re-register. **No provider key in hand and none to get? Self-host is the fully-supported path today** — the provider market is only starting to form; never invent or recommend a provider that isn't in front of you.
-- **Tunnels (ngrok/cloudflared) are preview-only — never bake one on-chain** (dies on sleep, rotates on restart). A real launch puts the resolver on a host you control under your own domain (move = a DNS re-point), or behind a provider.
-
-**3. Identity** — `--name`, `--symbol`, `--royalty-bps` (default 500 = 5%), `--description "…"`, `--external-url <url>` (both served in the metadata — set them or the description is boilerplate). Owner + royalty receiver = the deploying wallet. These default to off-chain operator metadata (editable via `abx add <addr> --description "…"`). For a description that should outlast any node, add `--description-onchain` (or later `abx set-field <addr> --field description --text "…"`) → on-chain, freezable via `lock-field`; the resolver prefers the on-chain value. This is the per-field on-chain model — any field on-chain or off, one active `representation` (inline · reader · keccak256 · arweave · ipfs · url). Background: [metadata model](https://abx.docs.artblocks.io/protocol/metadata/).
-- **Credit + license** — deploy flags `--artist "…"` · `--license "…"` (also `--display-notes`, `--artist-links`) bake authorship + rights ON-CHAIN in the deploy tx (all three deploy commands); or set/change them later with `abx set-field <addr> --collection --field artist|license --text "…"`. Reserved collection fields served in `contractURI`, on any type (1/1 · Series · code). Detail: [operating.md → Authorship + rights](reference/operating.md#authorship--rights-credit--license).
-- **Propose a real name/symbol and confirm — never silently bake a generic folder-name guess.** A folder called `series`/`images`/`photos` infers junk ("Series" / "SRS"), and on all three deploy commands the CLI *refuses* a real send that would bake its own placeholder identity (`--name`/`--symbol` missing) — because on-chain identity is effectively permanent. **In `--dry-run` the same check only warns** (so a preview still runs before you have the creator's title); don't read that warning as "the CLI allows it" — the real deploy stops. Suggest a specific title + a short ticker-style symbol drawn from the actual work, and get an explicit yes before deploying. Inference is a suggestion to confirm, not a default to ship — if the folder name is generic, say so and ask rather than proposing it.
-
-**4. Image placement** — `--image <path>` (png · jpg · gif · svg · webp). The on-chain keccak256 (`image` field) anchors integrity; size is bounded by the backend, not the chain.
-- *Off-chain:* the served `image` is the backend's **gateway HTTPS URL** (`https://<gateway>/ipfs/<cid>`), not raw `ipfs://` (wallets/marketplaces can't render that). So off-chain needs a pinning service + a **public** gateway — with Pinata use a **dedicated** gateway (`--gateway https://<you>.mypinata.cloud`); a local kubo gateway is preview-only. The keccak stays the anchor → move gateways without a tx.
-- *Fully on-chain:* `abx set-field <addr> --field image --file <path> [--compress fastlz]` splits into SSTORE2 chunks behind the shared reader; or bake it in with `abx deploy --image <path> --onchain-image [--compress fastlz]`.
-
-**Inline vs reader — default to the reader for real artwork.** `--onchain-uri` alone inlines the SVG (1 tx, ~700 gas/byte); `--onchain-image --compress fastlz` stages via SSTORE2 + a small `reader` pointer (~200 gas/byte, +1 tx) — **cheaper above ~0.5 KB** and widening with size. So: tiny (<~0.5 KB, a one-line SVG/short text) → `--onchain-uri` inline; real artwork (a few KB+) → `--onchain-image --compress fastlz`. **Never `--compress gzip` for an on-chain-rendered token** — gzip decodes off-chain only, breaking `--onchain-uri`; use fastlz (it decodes *in* the reader).
-
-**5. On-chain vs off-chain resolution** — by default `tokenURI`/`contractURI` point at your resolver. `--onchain-uri` = JSON assembled *on-chain* by the shared `AbxMetadataRenderer`, self-resolving forever — so it pairs with on-chain content, cost-effective only for tiny art (thresholds above).
-- **Fully on-chain = no server.** Don't stand one up; never cite a localhost URL. **Prove it with `abx tokenuri <addr>`** (reads `tokenURI(0)` over RPC, no `serve`). `abx serve` is only for off-chain-resolving tokens.
-- **The off-chain `tokenURI` is a base, not a per-token URL** — the contract stores a base and derives `{base}/{chainId}/{address}/{tokenId}`. Set via `--public-base-url` or `set-token-uri --uri <base>` later.
-- **Don't default to a frozen `ipfs://` tokenURI** — every edit then = re-pin + on-chain re-point, and the event spine stops driving the token (exiting the spec). Right only for true immutability, then lock it (`set-token-uri --override ipfs://<cid>` then `lock-uri`).
-- **Store ≠ lock; lock last.** On-chain ≠ frozen. Deploy unlocked, confirm it resolves in production, *then* freeze. Two locks: `lock-field <addr> --field <name>` (a value) + `lock-uri <addr>` (how it resolves). Both = provably immutable. A deliberate follow-up, not the first deploy.
-
-**6. When to mint** → [Deploy strategy](#deploy-strategy--when-to-mint).
-
-## Confirm before sending
-
-Run `abx deploy --dry-run` for real values, present **this exact shape** — one row per on-chain value — then wait for go-ahead. **Mirror the dry-run's values; don't compose your own.**
-
-**No signing key in `.env` yet? `--dry-run` still needs a deployer address — pass `--for 0x<the creator's wallet>`.** The address is a pure function of (factory, salt, deployer), so a preview can't compute it from nothing; it signs nothing, so no key is involved. Ask the creator for their wallet address once, up front — it's also what the real wallet-lane deploy takes (`--sign --for 0x…`).
-
-```
-Deploy config — confirm before I send (everything below is written on-chain):
-
-  Name          Donuts & Cake            ⚠ inferred from filename — confirm or rename
-  Symbol        DONUTS                   ⚠ inferred — confirm
-  Description   "<the creator's words>"  ⚠ I have nothing from you — give me a line, or I deploy with none
-  Traits        none                     ⚠ none written — add --traits "Key=Value" or skip
-  Image         donuts-cake.svg · 2.4 KB → reader (fastlz, 1 chunk) · on-chain
-  Resolution    on-chain via renderer 0x5F36…1829 — no server, no localhost
-  Royalty       5% (500 bps) → 0x0248…b13C   (default; confirm rate + receiver)
-  Owner         0x0248…b13C  (the deploying wallet)
-  Mint          token #0 → owner, at deploy
-  Address       0x2619…9Da9  (salt-pinned: --salt 0x…)
-  Locking       deploying UNLOCKED — lock later, after verifying it resolves
-  Transactions  stage image (1) + deploy + mint (1) = 2
-
-  Reply to change anything, or say go.
-```
-
-Rules:
-- **The readout is a contract: what's shown is *exactly* what deploys.** Every value = a flag you pass. Not going on-chain → the row says `none`, never an invented placeholder.
-- **Every line must be *verified*, never aspirational — a value that depends on an external contract that must already exist** (`--attributes-renderer`, `--minter`, a `0x…` `--dep`, a gateway) **may appear as committed only once the dry-run confirms it resolves.** Never bake in a guessed/placeholder address; if it's unverified, show it `⚠ requires <X> — not yet deployed/verified` or leave the surface out. (The real-session trap: presenting "Traits computed on-chain via `--attributes-renderer 0x…`" off a *guessed* address — `deploy-code` now refuses an address with no code, so trust the dry-run over the assumption.)
-- **Flag every inferred/defaulted value** with `⚠` + where it came from (name/symbol from filename, royalty default, owner = signing key).
-- **The description is the one people forget** — never deploy an auto-written or empty description quietly. State what's written and whether it's on-chain (`--description-onchain`) or off. For a real piece, ask for the creator's words.
-- **Traits are the creator's** (the OpenSea `attributes` array) — ask (`--traits "Background=Blue"` or `--attributes file.json`); never invent traits, never put protocol facts there. Off-chain by default; `--traits-onchain` to commit them.
-- **Show real values** — the real name, description, address + pinned salt, chunk/tx count from the dry-run.
-- Adapt rows to the config (off-chain shows storage backend + host URL instead of the renderer; `--no-mint` shows a deferred mint) — but always one row per written value, always the ⚠ flags, always an explicit confirm.
-
-## Deploy strategy — when to mint
-
-The deploy address is **deterministic** — a pure function of `(factory, salt)`, knowable before signing (`abx predict`). So you can warm the resolver at that exact address first → the moment a marketplace sees the mint it fetches live metadata, not a cached blank. Minting is optional at deploy (`--no-mint`); there's a one-shot `abx mint`.
-
-| Path | When | Flow |
-|---|---|---|
-| **Express** *(default)* | demo, or pre-mint to your own wallet | `deploy` (mints #0) → `serve` → `refresh` |
-| **Careful** *(real launch, off-chain resolver)* | metadata live the instant it's listable | `deploy --no-mint` → `serve` (warm) → verify → `mint` → `refresh` |
-| **Primary sale** | token issued at point of sale | `deploy --no-mint` → settle off-chain → `mint --to <buyer>` → `refresh` |
-
-- **Fully on-chain ⇒ mint at deploy; do NOT add `--no-mint`.** The careful path warms an *off-chain resolver*; a fully on-chain token has none (the renderer resolves the instant the contract exists). Deferring buys nothing and adds a tx. Defer an on-chain mint only for a genuine primary sale.
-- **`abx predict [--salt 0x..] [--for 0x..]`** pre-computes the address. No `--salt` → reserves a fresh, front-run-proof salt to the deployer; pass `--salt` for a vanity/known address. The salt's leading 20 bytes are an access guard: zero ⇒ anyone may deploy; non-zero ⇒ only that signer.
-- **The address depends on the salt — preview one, you MUST pin it.** Without `--salt`, every invocation (incl. `--dry-run`) reserves a *fresh* salt → a plain `deploy` lands at a different address than the dry-run showed. `--dry-run` prints the exact `--salt …` it used; pass that same salt to the real deploy. Never quote a previewed address without pinning its salt.
-- **`abx refresh <addr>`** asks marketplaces to re-index. We emit **ERC-4906** on URI changes so 4906-aware marketplaces self-refresh; `refresh` is the fallback (+ genesis mint). With `OPENSEA_API_KEY` it calls OpenSea directly; else it prints the links to click.
-- **There is no "add it to a marketplace" step — don't offer one.** Marketplaces discover the collection from chain (the mint + ERC-4906); `abx refresh` is the only nudge. Suggesting a manual listing implies work that doesn't exist.
-- A `--no-mint` deploy reconstructs + serves normally (dashboard shows #0 "not yet minted"; metadata/image already resolve).
-- **Etherscan source is already verified** — your deploys are EIP-1167 clones Etherscan auto-recognizes as proxies of the verified implementation.
-
-## What a token carries — files beyond the image (the data plane)
-
-A token is **not "just a picture."** It anchors **named, typed files** ("artifacts"), and the served metadata JSON carries an **`artifacts`** list — the *complete* set of the token's files, each `{key, mimeType, uri}`. The `image` / `animation_url` are just reserved members of that same set; alongside them a token can carry a hi-res master, a certificate, source files, a README — any number of named files. (Background: [data plane](https://abx.docs.artblocks.io/protocol/data-plane/).)
-
-```json
-"artifacts": [
-  { "key": "image",   "mimeType": "image/svg+xml", "uri": "…/image" },
-  { "key": "print",   "mimeType": "image/tiff",    "uri": "ipfs://Qm…/master.tiff" },
-  { "key": "readme",  "mimeType": "text/markdown; charset=utf-8", "uri": "ar://…/README.md" }
-]
-```
-
-- **Attach a file:** `abx attach <addr> <key> <ipfs://… | ar://… | https://…>` — `<key>` is any name you choose (`print`, `certificate`, `stems`, `readme`) and becomes the manifest entry's key. The representation is **auto-detected** from the URI scheme; the `mimeType` is declared from the file **extension** (`…/master.tiff` → `image/tiff`), so point the URI at the file itself. Tiny bytes with no external host can go **on-chain** with `--file <path>`. Token scope by default; `--collection` for a collection-wide file. Any signing lane; `--dry-run` previews. It's one file per call, run **after deploy**.
-- **Don't have a URL yet? Upload first.** `attach` takes a locator you already host. `abx storage upload <path> --backend arweave|ipfs` uploads one file and prints a locator that **keeps the filename** (so the declared type survives) plus the ready-to-run `attach` line (Arweave = pay-once permanent; the same backends `deploy` uses; `--dry-run` to preview without uploading). Full flow: `abx storage upload master.tiff --backend arweave` → copy the printed locator → `abx attach <addr> print <that-locator>`.
-- **`artifacts` is COMPUTED, never a field you set.** The resolver/renderer assembles the list from your fields — setting a field literally named `artifacts` is refused. You attach one file per key; the manifest builds itself.
-- **The complete listing is a resolver surface.** A resolver serves the full `artifacts` list at `/t/<chainId>/<addr>/<id>`, and `/data/<key>` fetches each file. The bare on-chain `tokenURI` enumerates **reserved fields only** (there's no on-chain enumeration of arbitrary keys) — so a project that must surface extra files to consumers today runs a resolver (attached files are still stored on-chain + keccak-anchored regardless).
-- **Effect outputs are artifacts too.** A code project's effect runner publishes `render/image`, `render/traits`, and any extra declared output (e.g. a hi-res `render/print`) into the same manifest automatically, at the current settled state — files appear as tokens are minted and params change (see [code-projects](reference/code-projects.md)).
-- **Not the same as a Series.** `deploy-series` makes **N separate tokens, one file each**. The data plane is how **one** token holds several named files. Depth (representations, verify, reserved keys, on-chain-vs-resolver) → [operating.md](reference/operating.md#attaching-files--the-data-plane).
-- **Set expectations honestly (say it up front).** No mainstream marketplace (OpenSea/Blur) shows a "files" tab **today** — they render `image`/`animation_url` only. Attached files are a durable, cryptographically-anchored part of the token *now*, read by **data-plane-aware tools and any resolver**; broad marketplace display is future adoption. So a creator verifies an attach by **curling their resolver's listing**, not by refreshing OpenSea (which won't show it).
-
-## After launch — tell the creator (durability + owner care)
-
-Once it's live, cover these in plain language; don't wait to be asked.
-
-- **Durability depends on the backend.** Arweave = **pay once, kept for centuries** (a storage endowment funds ~200 years; resolves as long as the network + any gateway are up) — nothing to renew. IPFS/Pinata = **the creator must keep it pinned** — the image serves through their gateway, and if pinning lapses the bytes can disappear. `cloud`/`fs` = they maintain them. Say which one this drop uses and what it implies. For a real drop, lead toward Arweave (or start elsewhere and re-host later — bytes are keccak-anchored, so re-upload to the new backend + re-point with `set-field`, verified by `abx verify`).
-- **Moving backend/gateway later is an owner-signed on-chain edit.** The on-chain keccak anchors the bytes so they're portable, but re-pointing (`set-field`/`migrate`) is a tx from the **owner** wallet — so that wallet must stay secure and reachable.
-- **Owner-wallet hygiene (suggest as follow-ons).** The owner wallet controls mint, royalties, URIs, and ownership itself. Recommend: a hardware/dedicated wallet over a throwaway hot key; for anything valuable, hand ownership to a multisig (`abx set-admin <addr> --to <safe>`); and **back up `.abx-self-host/arweave-key.json`** — it holds any prepaid Turbo credits, lose it and they're stranded.
-
-## Setup + environment
-
-`abx` needs **Node ≥ 22.5** at runtime (the projection store uses built-in SQLite).
-
-### Find `abx` before you install it — local first, then global
-
-**Resolve in this order and use the first hit.** Don't jump to a global install; a project-local CLI is pinned in the creator's `package.json` (reproducible, and what `abx skill install` version-locks against), so it wins whenever it exists:
-
-```bash
-npx --no-install abx version   # 1. project-local (./node_modules/.bin/abx) — PREFER this
-abx version                    # 2. a global install already on PATH
-```
-
-- **`--no-install` is mandatory on that probe.** The bare `abx` name on npm is an **unrelated squatted package** — a plain `npx abx` with nothing local would *download that*, not this CLI. `--no-install` makes the probe fail cleanly instead.
-- In the **abx source repo** (contributor), neither applies: use `pnpm abx <cmd>`, which runs the live `tsx` source.
-
-**Nothing found → install.** The package is **`@artblocks/abx-cli`** (not `@artblocks/abx-sdk` — that's the library, and installing it gets you no `abx` binary; a real session lost a cycle to exactly that mistake):
-
-| Situation | Install | Then invoke as |
-|---|---|---|
-| The creator has a project dir (a `package.json`) — **default** | `npm install --save-dev @artblocks/abx-cli` | `npx abx …` |
-| No project, or they asked for a machine-wide tool | `npm install -g @artblocks/abx-cli` | `abx …` |
-
-Ask before installing **globally** — it's a machine-wide change to their PATH, and the per-project install is the reversible one. A project install needs no permission beyond the usual.
-
-Whichever you land on, **keep using that same invocation for every command in the session** (`npx abx …` vs `abx …`) — don't mix them, or you'll silently drive two different CLI versions. Then run `abx doctor` (preflight: signing key/wallet, RPC, canonical factory, storage).
-
-`.env` (in the creator's project dir) = **secrets only**:
-- **Signing:** a key (`SEPOLIA_FUNDED_PK` / `ABX_DEPLOYER_PK` / `SEPOLIA_WALLET_PK`) is needed ONLY for hot/unattended signing. If the creator owns a wallet, prefer **`--sign`** — no key in `.env`. `doctor`'s missing-key ✗ is **not fatal** on the `--sign` path.
-- `ABX_RPC_URLS`, `ABX_PUBLIC_BASE_URL` (remote-resolver custody only), optional `OPENSEA_API_KEY`, plus any backend secret.
-- **Two resolver credentials — don't mix them up.** `ABX_RESOLVER_ADMIN_TOKEN` = **a node you run** (`deploy-resolver` generates it; it's the operator secret, and bare `--remote` uses it). `ABX_REMOTE_<NAME>_TOKEN` (+ `_URL`) = **a managed provider's per-account API key** for `--remote <name>` (same name normalization as `ABX_RPC_URLS_<CHAIN>`). A named remote deliberately never falls back to the node-admin token, so putting a provider key in `ABX_RESOLVER_ADMIN_TOKEN` silently won't work. Only `_URL`/`_TOKEN` are read — `ABX_REMOTE_<NAME>_KEY` is ignored (the CLI now flags a near-miss name).
-
-<sub>Working from the abx **source repo** (contributor)? `pnpm install`, then `pnpm abx <cmd>` or `pnpm sandbox`. Every command below is identical.</sub>
-
-**Indexing reads the event log via `eth_getLogs` from the contract's deploy block** — the CLI records it at deploy and forwards it to a resolver on `add` (discovering it on-chain for a contract it didn't deploy here). So a normal deploy→index scans a small, recent window and is fast on **any** RPC, and re-index is incremental (resumes from the last block). It **auto-chunks**, so a range cap never yields *wrong* state — but don't wave a cap away: a **from-genesis** or long-span reconstruction, or a resolver serving many code projects under load, is slow and rate-limit-prone on a getLogs-**range-capped** endpoint. `abx doctor` rates each endpoint and flags a capped one — treat that as a real infra signal, and give a resolver you'll run under load a range-generous **archive** RPC. **If indexing is slow, or a hosted resolver won't serve, check the scan floor FIRST (is it scanning from block 0?), not the RPC tier** — that mis-diagnosis is a known trap. RPC deep-dive + troubleshooting → [reference/setup.md](reference/setup.md).
-
-## Reference files
-
-- **Public docs — the human-facing companion** at **https://abx.docs.artblocks.io** (quickstart, guides, the CLI/SDK reference, the protocol model). This skill is YOUR operating manual and stays authoritative for how to drive the CLI; the docs site is what you **link the creator to** for background/onboarding, and a place you can read if you want the protocol rationale behind a command. Don't send the creator commands to run (you run them) — send them the docs to *read*.
-- **Code projects — operating depth** (what to keep running, the resume loop, verify-it-resolves, render ops, `--onchain-uri`/`--image-base`/traits internals, arweave delay, `deploy-code` flags, mint timing/pause/supply) → **[reference/code-projects.md](reference/code-projects.md)**
-- **Operating an existing project** (owner ops, **artist credit + license fields**, **attaching files / the data plane**, selling via the shared minter, `abx mint-page`, moving hosting, resolver→resolver `migrate`) → **[reference/operating.md](reference/operating.md)**
-- **Hosting infrastructure** (storage backends, Turbo lanes + failure playbook, **managed providers + named remotes + the service descriptor**, `deploy-resolver`, `deploy-effects`, local-vs-remote stores, token API routes, Docker) → **[reference/hosting.md](reference/hosting.md)**
-- **Environment detail** (RPC selection + failover, multi-chain, troubleshooting) → **[reference/setup.md](reference/setup.md)**
-- **Troubleshooting — "my NFT looks wrong"** (gray placeholder, stale-on-marketplace, tokenURI reverts, localhost baked, "not registered") — diagnose before acting → **[reference/troubleshooting.md](reference/troubleshooting.md)**
-
-## Guarantees
-
-- **Reconstruction from chain alone** — deterministic, idempotent; delete the projection, replay yields identical state.
-- **Trust = the factory** — a clone is canonical only when the ownerless factory's `isAbxClone` confirms it (the `AbxDeployed` beacon is discovery, and spoofable).
-- **Content is verifiable** — the on-chain keccak256 lets anyone re-hash the served bytes (the `verify` route), zero trust in the node.
-- **Keys stay with their owner** — the wallet lane signs in the user's own wallet; the CLI never sees the key. Runtime data lives in `./.abx-self-host/` (gitignored).
-
-Protocol model + full docs → **https://abx.docs.artblocks.io** ([protocol](https://abx.docs.artblocks.io/protocol/), [using ABX](https://abx.docs.artblocks.io/using-abx/), [CLI/SDK reference](https://abx.docs.artblocks.io/reference/)).
+| One static work | `abx deploy` | ERC-721 1/1 |
+| Folder of distinct static works | `abx deploy-series` | ERC-721 Series |
+| Program or state-derived work | `abx deploy-code` | ERC-721 SeriesCode |
+| One program, each token carries its own data | `deploy-code --script` + `<key>:Bytes:Creator` | SeriesCode + payload param |
+| Copies of any family | add `--copies <n|open>` | corresponding ERC-1155 edition |
+
+Important boundaries:
+
+- `deploy-code --copies` supports `--script`, `--code-dir`, dependencies, Solidity image/attributes
+  renderers, `--image-base` (a deterministic per-id off-chain still, mutually exclusive with
+  `--image-renderer`), and `--resume` (a per-id mint diff — pass the same content flags plus
+  `--mint-amount` if the original deploy premint ids).
+- `--onchain-image` works for static 721s and editions in hot, wallet, or sponsored lanes. It cannot
+  be prepared as one cold `--unsigned` bundle because staged transactions depend on prior receipts.
+  It stores SVG, PNG, JPEG, GIF, WebP, and AVIF files, declaring each raster's type in
+  `abx_image_type`. See `reference/deploy.md` for repairing a raster that serves as SVG.
+- Deploy tested custom hooks/renderers from exact compiled initcode with `abx deploy-contract`.
+  ABX sends the bytes; it does not compile, link, audit, or infer constructor types. Test on the
+  paired testnet and source-verify before wiring a production address. Under `--sponsor`, the
+  keyless CREATE2 proxy is the constructor caller, so pass ownership explicitly instead of relying
+  on `msg.sender` in the constructor.
+- A code project may need no public host when its image/traits are computed by Solidity renderers.
+  A JavaScript program still needs a deliberate marketplace-image plan even when its animation is
+  chain-complete.
+- Content size is not a fixed refusal. The CLI measures write cost and the active RPC's read reach.
+  State the measured reach; never generalize it to every marketplace endpoint.
+
+## Treat public surfaces as an acceptance test
+
+Before deploying, write down the promised value for each applicable row:
+
+| Surface | Verify with |
+|---|---|
+| Contract identity and owner powers | `abx state <addr>` and the deploy readout |
+| Token metadata | `abx tokenuri <addr> --token <id>` |
+| Collection metadata | `abx contracturi <addr>` |
+| Image | decoded metadata plus a successful fetch or on-chain field provenance |
+| Animation/live view | the decoded `animation_url`, loaded with a real minted token |
+| Marketplace traits | decoded `attributes`, not merely console output from the program |
+| Parameters and values | `abx state` for schemas; `abx tokens --json` for token values |
+| Attached artifacts | `abx artifacts <addr> --token <id>` (entries + current/stale effect rows); attachments are not enumerable in bare on-chain metadata |
+| Byte integrity | `abx verify <addr>` |
+| Hosted lifecycle | `abx status --remote <name> --watch` or provider status |
+
+Do not call a launch complete because the transaction mined. Complete it when every promised surface
+has the expected provenance and is retrievable through the path collectors will use.
+
+## Confirm irreversible and shared-state choices
+
+Before any real deploy, say these choices explicitly when relevant:
+
+- The contract family and ERC-721 versus ERC-1155 edition shape cannot be changed later.
+- Hooks and PostParams require a code-capable contract. A static image contract cannot gain them.
+- `--burnable` and creator-token enrollment are deploy-time choices.
+- A royalty cap only moves downward.
+- Edition arithmetic is **number of ids × copies per id**. For one work with 100 copies, use one id;
+  do not accidentally create the code default's multiple-id space.
+- An ERC-721 Series cap is lifetime minted ids: burning never reopens a slot. An ERC-1155 edition's
+  per-id cap is live supply: when burnable, a burned copy may be minted again.
+- PostParams on an edition are stored per id, not per physical copy. A holder-authorized value is
+  shared by all holders of that id, and the last valid writer wins.
+- Metadata, URI, script, dependency, hook, schema/value, and authority locks are distinct. Verify
+  first and lock last.
+
+## Use capability classification, not optimism or refusal
+
+Classify an unusual request as exactly one of:
+
+1. **Native** — a documented CLI lane performs it.
+2. **Extension** — a custom minter, configure/transfer/augment hook, field renderer, or seed source
+   performs it while the token remains a canonical factory clone.
+3. **Unsupported or foreclosed** — the capability contract lists it, or the existing collection's
+   irreversible type/flags already exclude it.
+4. **Unknown** — no route has been proven. Inspect code/help/contracts and report uncertainty; do not
+   turn absence from a no-list into a promise.
+
+Custom Solidity is built and tested outside `abx`; `abx scaffold-renderer` supplies a Foundry
+starting point, and `abx deploy-contract` can send its exact compiled initcode through any signing
+lane. Read [capabilities.md](reference/capabilities.md) before designing a custom mechanic.
+
+## Load only the reference needed
+
+- Environment, installation, signer lanes, and safe setup → [setup.md](reference/setup.md)
+- Static projects, editions, placement, costs, and deploy confirmation → [deploy.md](reference/deploy.md)
+- Programs, renderers, thumbnails, traits, PostParams, seeds, and dependencies → [code.md](reference/code.md)
+- First-party hosted services, OAuth device login, and core/provider feedback → [services.md](reference/services.md)
+- Generic remotes, self-hosted resolvers/effects, storage, lifecycle, and migration → [hosting.md](reference/hosting.md)
+- Existing-project reads, mint/sales, fields, transfers, authority, and locks → [operate.md](reference/operate.md)
+- Failure classification, resume, RPC/storage/rendering faults, and retry discipline → [diagnose.md](reference/diagnose.md)
+- Capability questions, extension seams, mechanics, and hard boundaries → [capabilities.md](reference/capabilities.md)
+- ERC-721C/ERC-1155C enrollment and validator operations → [creator-token.md](reference/creator-token.md)
+
+Read every reference applicable to the requested workflow before sending a real transaction. Do not
+load unrelated references merely because they exist.