@artblocks/abx-cli 0.1.0-alpha.9 → 0.2.0

package/skill/reference/setup.md

@@ -1,42 +1,221 @@
-# Environment detail — RPC & troubleshooting
-
-[← back to SKILL.md](../SKILL.md)
-
-## Choosing an RPC (drives re-index speed)
-
-Reconstruction reads the event log via `eth_getLogs` **from the contract's deploy block** — the CLI records it at deploy and forwards it to a resolver on `add`, and discovers it on-chain (a getCode binary search) for a contract it didn't deploy here. So a normal deploy→index scans a *small, recent* window and is fast on **any** RPC. Providers cap the getLogs block range very differently **and these caps change** — treat any number as illustrative, re-verify before you quote it. *(Illustrative, Jun 2026: Alchemy free ≈10 blocks/call, Infura/Chainstack free ≈2000, PublicNode/dRPC vary; no-key public endpoints are the lowest-friction to try.)* The toolkit **auto-chunks**, so any RPC yields correct state — but a range cap is **not** cost-free to shrug off: a **from-genesis** or long-span reconstruction, or a resolver serving many code projects under load, is slow and rate-limit-prone on a capped endpoint. `abx doctor` rates each endpoint and flags a capped one; treat that flag as a real infra signal, not noise. **First diagnosis when indexing is slow or a hosted resolver won't serve: is it scanning from block 0? Check the scan floor before the RPC tier.**
-
-When `abx doctor` flags a tight range, or a reconstruction would be large/slow — **a decision point: research and present, don't power through:**
-1. **Do your own current research** (the limits rot) — find a free, range-generous, archive-capable endpoint for this chain *right now*.
-2. **Present clear choices with current specifics** — (a) point `ABX_RPC_URLS` at a higher-range endpoint *(recommended for anything large)*, with the exact signup/URL steps you found; or (b) stay on the current RPC and accept the wait.
-3. The CLI **stops a large job with an estimate** instead of grinding through thousands of requests; a better RPC is the real fix. To chunk through anyway, re-run with `--yes` (or raise `ABX_GETLOGS_MAX_CHUNKS`); `ABX_GETLOGS_RANGE` tunes the window.
-
-**One RPC var, network-scoped.** `ABX_RPC_URLS` is a comma/space-separated list of endpoints **for the active `ABX_CHAIN`** (there is no singular `ABX_RPC_URL`). The client **fails over** across them at request time — a request one endpoint rejects (a too-wide `eth_getLogs`) is retried on the next — and `abx doctor` **probes every endpoint** and reports a per-endpoint verdict (✓ wide range + archive · ⚠ usable but range-capped · ✗ unusable, with the reason, e.g. *archive refused* / *wrong network*), then names the best for reconstruction. So list a couple, let `doctor` pick, and order the list best-first. For **multiple chains**, set `ABX_RPC_URLS_<CHAIN>` (e.g. `ABX_RPC_URLS_BASE_SEPOLIA`, `ABX_RPC_URLS_SEPOLIA` — the default `ABX_CHAIN` is `base-sepolia`) — a per-chain list that overrides the bare var, never mixed, so one network's endpoints can't leak into another. The var *names* a network but the URL could point anywhere, so before any write the toolkit **verifies `eth_chainId` matches `ABX_CHAIN`** and hard-fails on a mismatch (reads stay unguarded/fast) — that's what makes "which network is this?" a checked fact, not a guess.
-
-**Named remotes follow the same env-name normalization**: `--remote my-provider` reads `ABX_REMOTE_MY_PROVIDER_URL` / `ABX_REMOTE_MY_PROVIDER_TOKEN` (uppercase, non-alphanumerics collapse to `_`). Inspect what's configured with `abx remote` ([hosting.md → Managed providers](hosting.md#managed-providers--a-resolver-someone-else-runs---remote-name)).
-
-**Re-index is incremental by default** — it resumes from the last-indexed block and only fetches new blocks, so routine re-indexing (after an owner op, or just refreshing) stays instant *regardless* of the range cap. Even the **first** reconstruction scans only from the **deploy block** (not genesis), so range/archive capability bites only on a genuinely long span — a forced full replay (`abx index --full`, a fresh projection, or the dashboard's "Re-index from chain" — the durability proof) of a contract deployed long ago. A "why is this scanning millions of blocks?" moment almost always means the scan floor is wrong (block 0), not that the RPC is inadequate.
-
-## Troubleshooting
-
-- **doctor: signing key** → **not fatal — a missing key is a fork, not a blocker.** A key in `.env` is only needed to sign *unattended* (hot lane). To sign in a browser wallet instead, run the write with `--sign` and no env key is needed. Offer both: add `SEPOLIA_WALLET_PK` (or `SEPOLIA_FUNDED_PK` / `ABX_DEPLOYER_PK` — any one) for autonomous signing, **or** use `--sign`. **deployer unfunded** → fund the printed address from a faucet for the active chain (Base Sepolia by default, else Sepolia).
-- **a write reverts with no clear reason (`--onchain-image` / staging)** → don't thrash by retrying variations. Get the actual reason: re-run the same call read-only with `cast call <addr> "<sig>" <args> --rpc-url <one of your ABX_RPC_URLS>`, which surfaces the revert string. The classic culprit is a stale chunk store (deployed before a contract upgrade) — the toolkit now detects this and auto-deploys a current store with a yellow notice, so you shouldn't hit the silent revert, but verify the resolved chunk-store/factory addresses are live (`cast code <addr>`; `abx doctor` / `abx status` print the factory) if anything looks off. **Never silently switch the representation you told the user you'd use** (e.g. fall back from `reader` to `inline`) — if the path changes, say so and why.
-- **storage 'cloud' missing accessKeyId/…** → set `ABX_S3_*` in `.env`. **'ipfs' unreachable** → Kubo not running or `PINATA_JWT` missing.
-- **re-index slow, or a "scan too large" stop** → **first check the scan floor: is it indexing from block 0 instead of the deploy block?** That's the usual cause of a "huge" scan (an `add` that lost the deploy block). The floor is `flags['from-block'] → the stored deploy block → on-chain discovery`; if none resolve, the CLI refuses rather than sweeping genesis. Only once the floor is correct does the RPC's `eth_getLogs` range matter: the toolkit chunks automatically, but a genuinely large job stops with an estimate rather than grinding. Real fix then: research a current higher-range free endpoint and set `ABX_RPC_URLS` (`abx doctor` reports your range); or re-run with `--yes` to chunk through. **archive-range getLogs refused** → use an archive-capable provider.
-- **`serve`/resolver returns `{"error":"unknown project"}`** → the resolver you hit doesn't have that contract in *its own* projection store **yet**. Two distinct situations — diagnose which, and NEVER default to "RPC limit":
-  - **A remote resolver you just registered** (`abx add … --remote`): it may still be **backfilling** — hit `GET /` (or `abx remote <name|url>`, which lists the projects the token sees) to see if it's appearing. If it's slow or stuck, the cause is almost always a **from-genesis scan (from-block=0)**, not the RPC tier — a fixed `abx add` forwards the deploy block, so re-run it and confirm the floor. (Fixed in-toolkit: a first remote add now forwards/derives the deploy block and refuses a genesis default.)
-  - **A local `abx serve`**: a **store/port** problem. Usual causes, in order: (1) a **stale/duplicate `abx serve` from an old session** holds the port and serves a *different* store — hit `GET /` and see what it lists; (2) you're serving a different store directory than the deploy indexed into; (3) the contract was never registered there. Fix the server/port/registration.
-- **`/a/…` returns `{"error":"no live view — not a code project"}` on a project that IS a code drop** → the resolver indexed *above* the deploy block, so it never saw the `code` field written at deploy — a scan-floor bug, **not** a resolver version/compat gap (do NOT redeploy as a static NFT). This is the *opposite* of the genesis bug: the floor is too **high**, not too low. It happened when a `--sign` code deploy spanned blocks (deploy at N, mint at N+2) and the mint block was recorded as the floor. Confirm: `GET /api/project/<addr>` → `collectionFields` is `[]` and `fromBlock` sits above the deploy block. Fix: `abx add <addr> --remote <url> --from-block <deployBlock>` — a *changed* floor forces a full replay that picks up the `code` field. Find the true deploy block with `abx add <addr>` locally (it prints "deploy block N (discovered on-chain)"). (Fixed in-toolkit: `deploy-code` now records the clone-CREATION block, and discovers it on-chain rather than trusting the last-tx receipt.)
-- **directory-mode live view 302s to a doubled URL** (`https://arweave.net/https://arweave.net/<txid>/index.html`) → the `code` locator was stored as a full gateway URL and the gateway got prefixed again. Fixed in-toolkit (deploy stores the bare txid/CID; the resolver serves an already-absolute locator verbatim). A resolver image built before the fix still doubles — redeploy it to pick up the resolver-side tolerance.
-- **the thumbnail stays a placeholder on a HOSTED resolver even after `abx render` reports `ran=1`** → the render bytes landed in a store the hosted resolver can't read. A local `abx render` with the default `fs` backend writes to your laptop; `ipfs`/`arweave` write a LOCAL key→CID index the resolver doesn't have. Fix: render **to** the resolver — `abx render <addr> --remote <resolver>` (uploads to your `ABX_STORAGE_BACKEND` home and **publishes** a locator/bytes the resolver serves), or stand up the runner beside it (`abx deploy-effects --resolver-url <resolver>`). Only a SHARED `s3`/`cloud` bucket makes a bare local render visible to a hosted resolver. Confirm with `abx verify <addr>`.
-- **resolver won't start / errors about `ABX_PUBLIC_BASE_URL`** → it refuses a placeholder `.example` base (a scaffold leftover) or a `localhost` base in a hosted image (`ABX_HOSTED=1`), because it bakes that base into every image/animation URL it serves — a bad one serves dead links, so a loud fail beats silent breakage. Set `ABX_PUBLIC_BASE_URL` to the resolver's real public URL (`fly secrets set ABX_PUBLIC_BASE_URL=https://<app>.fly.dev`, or your custom domain). The current scaffold bakes the real platform hostname by default, so this only bites a hand-edited/old artifact or a stripped env.
-- **a hosted resolver LOST its index (or its render thumbnails) after a redeploy** → the SQLite projection wasn't on a persistent volume. The scaffold creates `fly volumes create abx_data` **before** the first deploy so the store lives on `/data` (the mount); if you deployed WITHOUT the volume, the store sat on ephemeral disk and a redeploy wiped it. Fix: ensure the volume exists (`fly volumes list`), then re-index (`abx add <addr> --remote --from-block <deployBlock>`). Note published **render locators + traits live on that same volume** (producer-published, not chain-derived), so restoring them after a volume loss needs a runner re-sweep, not just a chain replay — re-run `abx render <addr> --remote <resolver>` (idempotent; it re-publishes from the storage home without re-rendering) or let the effects service sweep.
-- **the project's on-chain `tokenURI` points at a HOSTED resolver but it isn't serving** → **do NOT "fix" it by running `abx serve` locally and handing over a `localhost` link.** The baked URL is the hosted one; a local serve resolves for no one but you. Fix the HOSTED resolver instead: re-run `abx add <addr> --remote` (now forwards the deploy block), check `GET /` on the host, and vet its RPC with `abx doctor`. A local serve is only ever the answer when the baked base is that same local machine.
-- **port hygiene before `serve`** → check the port is free first (`lsof -i:8787`). If an old session holds it, kill that process or serve this project on a distinct `--port <n>` (and point its `--public-base-url`/tokenURI accordingly) — a stale server silently answering on the port is the #1 cause of "works for me, `unknown project` for everyone."
-- **serving code projects is RPC-heavier than static art** → the live view rebuilds `tokenData` per request, and template-mode script chunks + data-backed (`String`/`Bytes`) params are read **live per view** (scalar PostParams come from the indexed projection, so they don't hit RPC each view). A resolver serving many code projects under marketplace traffic wants a range-generous, reliable RPC — this is a genuine scaling consideration, distinct from the getLogs range cap above.
-- **a remote command returns 401 unauthorized** → the token the CLI resolved is missing/wrong for that target — the error names the var it used (`ABX_REMOTE_<NAME>_TOKEN` for a named remote, else `ABX_RESOLVER_ADMIN_TOKEN`, else `--remote-token`). Check that var, or rotate the key at the provider if it may have leaked. Named remotes deliberately never fall back to `ABX_RESOLVER_ADMIN_TOKEN`.
-- **a remote command returns 403 forbidden** → the key is **valid but not authorized** for this contract/chain — provider-side scoping, not a typo. Don't retry-loop and don't swap tokens blindly: check the provider dashboard, and the descriptor's `chains` (`abx remote <name>`).
-- **register refused with `unsupported_chain`** → the service doesn't serve the project's chain — its descriptor `chains` says which it does. Pick a provider that covers the chain, or self-host.
-- **`/.well-known/abx-service` 404s** → an older self-hosted node (fine if it's yours — the remote commands still work against it once redeployed to the current image) or **not an ABX service at all** — verify the URL with `abx remote <url>` before registering anything; don't register blind.
-- **wallet lane: "no injected wallet"** → the human has no extension wallet; fall back to the hot lane (`--send`) if they're comfortable, or the cold lane for a Safe.
-- **owner op reverts** → the signer isn't the owner/holder. Check `abx status` / the `/api/project` state for the current owner; sign as that wallet.
+# Setup and safety
+
+Use this reference when installing ABX, selecting a binary or signer, configuring a new environment,
+or preparing a real transaction.
+
+## Contents
+
+- [Resolve the tool before the project](#resolve-the-tool-before-the-project)
+- [Upgrade when a release is available](#upgrade-when-a-release-is-available)
+- [Never expose secrets](#never-expose-secrets)
+- [Select the chain explicitly through the environment](#select-the-chain-explicitly-through-the-environment)
+- [Choose one signing lane](#choose-one-signing-lane)
+- [Prepare without mutating](#prepare-without-mutating)
+- [New environment checklist](#new-environment-checklist)
+
+## Resolve the tool before the project
+
+Inside the ABX source repository run `pnpm abx …`; elsewhere run the installed `abx`. A bare global
+binary inside the repository may be older than the source. Start with:
+
+```bash
+abx version
+abx doctor
+abx capabilities --json
+abx skill install
+```
+
+`abx doctor` reports binary provenance, CLI/skill drift, active chain, RPC health and history reach,
+wallet readiness, canonical factories, storage, and configured remotes without exposing credentials.
+Treat a red check as an actionable setup state, not as permission to improvise a workaround.
+
+The shipped skill is named `abx`. `abx skill install` installs it to `.claude/skills/abx` and
+`.agents/skills/abx` by default; `--agent`, `--global`, and `--target` narrow the destination. During
+the rename transition the installer moves a recognized `abx-self-host` folder to
+`.abx-skill-backups/` before installing the new name. It preserves custom bytes rather than deleting
+them. For a custom skills parent, run `abx skill install --target <that-parent>`; do not move or merge
+the old folder manually. Restart the agent after installation.
+
+ABX requires Node 22.13 or newer. Prefer a project-local npm dependency for reproducible automation;
+use a global install for interactive machine-wide use. Avoid repeated `npx` execution when version
+provenance matters because caches can outlive an upgrade.
+
+## Upgrade when a release is available
+
+Treat an `update available` notice or an outdated `npm` row in `abx doctor` as a recommendation to
+upgrade before planning a deployment or preparing a write. Do not silently change a global install
+or a project's dependencies; tell the creator which version is installed, which version is
+available, and give the command for that install:
+
+```bash
+# Global install
+npm install -g @artblocks/abx-cli@latest
+
+# Project-local install
+npm install --save-dev @artblocks/abx-cli@latest
+```
+
+The latest ABX release retains support for canonical projects made with earlier releases unless a
+specific contract generation is explicitly quarantined for a security or correctness reason.
+Updating the CLI does not redeploy or mutate a project. New deployments may use newer factories or
+defaults, so rerun help, capabilities, and the JSON dry run after upgrading.
+
+Then refresh the copied skill in the same scope reported by the CLI, restart the agent, and check the
+environment again:
+
+```bash
+abx skill install           # project copy
+abx skill install --global  # global copy, when reported
+abx doctor
+```
+
+If the creator defers the upgrade, say so once and continue only with the installed release's live
+help and capability output. Never assume a newer flag or behavior exists in an older binary.
+
+## Never expose secrets
+
+Do not open, search, quote, or print `.env`. Do not echo variables to test whether they exist. Do not
+paste a private key into a command line, generated file, wallet page, bug report, or transcript.
+
+Sensitive values include:
+
+- `ABX_DEPLOYER_PK` and any wallet key;
+- credential-bearing `ABX_RPC_URLS*` values;
+- `PINATA_JWT`, S3/R2 keys, `ABX_SERVICES_API_KEY`, other remote-provider tokens, effects/admin
+  tokens;
+- Arweave JWK contents and browser signing-session URLs.
+
+Use `abx doctor`, `abx remote <name>`, `abx storage show --check`, and redacted CLI errors. If a tool
+ever emits an unredacted credential-bearing endpoint, stop, rotate the credential, and report the
+output bug without repeating the secret.
+
+## Select the chain explicitly through the environment
+
+Read the full `chains` array from `abx capabilities --json`. Do not rely on a remembered network
+list. ABX is adding networks, and status may change between releases. There is no `--chain` flag
+because ignoring a wrong-chain request could spend on the wrong network.
+
+Choose a production chain by intended users, then measured cost. Use the `pairedChain` reported by
+capabilities for the test run. Large onchain payloads cost more on every network, so compare the dry
+run with Arweave, IPFS, or cloud custody.
+
+Before any transaction on an `experimental` or `beta` network, name the network and support level,
+explain what the transaction or transaction group will do, and state the relevant contract,
+configuration, and real-funds risks. ABX has not had an independent third-party audit; bugs,
+misconfiguration, and nondeterministic agent behavior may cause permanent loss. Link to the open
+source, use-at-your-own-risk implementation at
+https://github.com/ArtBlocks/abx. Qualify the same flow on the paired testnet before production.
+
+Use per-chain RPC variables when operating more than one chain. `abx doctor` checks chain identity,
+wide-range `eth_getLogs`, archival reach, and nonce coherence. Put a healthy archive endpoint first:
+fallback transports rotate on errors, not on a successful but pruned empty log response.
+
+The local projection and managed Arweave identity remain in `.abx-self-host/` unless
+`ABX_DATA_DIR` overrides it. That runtime directory is separate from the renamed `abx` skill and is
+not being renamed. Back up the managed Arweave key with `abx storage backup-key`; never print it.
+
+Every WRITE command (`deploy*`, `add`, `index`, `mint`, `set-*`, …) resolves `.abx-self-host`
+strictly relative to the current directory — it never searches upward, so it never creates a
+project's state somewhere unexpected. A handful of READ commands (`status`, `state`, `verify`,
+`doctor`, `capabilities`, `tokens`, `tokenuri`, `contracturi`, `inspect`, `minter show`) DO search
+upward, git-style, for an already-existing `.abx-self-host` if the current directory doesn't have
+one of its own — bounded at the home directory, a `.git` root, or the filesystem root. Practical
+consequence: `cd`-ing into a project's `contracts/` subdirectory before `abx status` still finds
+that project; the same `cd` before `abx add`/`abx deploy*` creates a NEW, empty node right there
+instead. If a status/verify/etc. answer looks emptier than expected, or a write seems to have
+landed in the wrong place, run bare `abx status` — its `data: <path>` line names the exact
+directory that answered, including a note when it was found by searching upward — or set
+`ABX_DATA_DIR` explicitly rather than guessing. See [Local data
+directory](https://docs.abx.io/docs/using-abx/self-hosting#local-data-directory) for the full rule.
+
+## Choose one signing lane
+
+Every write uses one of four lanes:
+
+| Lane | Select | Use when |
+|---|---|---|
+| Sponsored | `--sponsor` | The live remote advertises sponsorship for this chain and command |
+| Hot | `--send` or default | An environment key may sign unattended |
+| Wallet | `--sign --for 0x…` | A human approves in their browser wallet |
+| Cold | `--unsigned --for 0x…` | A multisig/offline signer needs prepared transactions |
+
+Honor an explicit creator choice. Otherwise run `abx capabilities --json`, the command help, and
+`abx remote abx`. Prefer `--sponsor` when the provider advertises the active chain, the command and
+transaction group are eligible, and sponsorship is enabled—especially on a testnet, where it removes
+wallet and faucet setup. Sponsorship is provider policy, not protocol support: if it is unavailable,
+paused, or ineligible, fall back to the appropriate bring-your-own lane rather than treating the ABX
+operation as unsupported.
+
+Select the lane before the JSON dry run. The signer can affect ownership, salts, and predicted
+addresses. If the lane changes, rerun the dry run and summarize the revised plan before execution.
+
+Run `abx doctor --for <address>` before a wallet or cold operation. On the wallet lane, give the
+human the locally generated signing page; never request or handle their key. On the cold lane, verify
+chain, sender, target, calldata, value, and ordering before handing transactions over.
+
+`--onchain-image` staging cannot use the cold lane because each chunk transaction depends on the
+receipt of the preceding transaction. Use hot, wallet, or sponsored signing. Do not split staging
+into a homemade offline sequence.
+
+`ABX_DEPLOYER_PK` may be written with or without a `0x` prefix — the CLI and SDK normalize it. Foundry's
+`vm.envUint` does not: a custom forge script that reads the same `.env` needs the `0x` form.
+
+For any one EOA, run one write command at a time. ABX obtains pending and latest nonces once, takes the
+safe maximum, increments locally, waits for newly deployed code when a following transaction targets
+it, and throws typed reversion errors. Starting concurrent processes bypasses that serialization.
+
+## Prepare without mutating
+
+Use command help and dry runs, not guessed syntax:
+
+```bash
+abx help deploy-code
+abx deploy-code … --dry-run --json
+```
+
+A dry run may read contracts, probe endpoints, analyze files, or verify an address, but it does not
+send or store. Address prediction is meaningful only when the salt and deployer are pinned. Use
+`abx predict` when another contract or resolver must know the collection address before deployment.
+
+Before any real send, confirm:
+
+- active chain and deploying/owning address;
+- contract family and edition arithmetic;
+- name, symbol, royalties and royalty ceiling;
+- deploy-time options such as burnability and creator-token enrollment;
+- custody, public resolution, image/animation/trait surfaces;
+- mint amount, value, transaction count, and expected gas;
+- every irreversible lock or authority transfer.
+
+Do not make a real send merely because a dry run exited successfully. The dry run is the plan; the
+human confirmation authorizes execution.
+
+## New environment checklist
+
+1. Install Node 22.13+ and the desired CLI version.
+2. Install the co-versioned skill with `abx skill install`, then restart the agent.
+3. Select the testnet with `ABX_CHAIN` when the default is not appropriate.
+4. Add RPC and storage configuration outside the transcript. If the live first-party remote
+   advertises sponsorship for the chosen chain and command, recommend it before asking the creator
+   to configure a signer. Otherwise configure one of the bring-your-own lanes. For first-party hosted
+   services, run `abx auth login --no-open` in a short-yield or resumable session: immediately hand
+   its verified browser URL and matching code to the human, then resume that same polling process.
+   Let the CLI store `ABX_SERVICES_API_KEY` in ignored `.env` without printing it. Never ask for the
+   email OTP or key in chat, start duplicate login sessions, or add standing login instructions to
+   `AGENTS.md`/`CLAUDE.md`. The key is long-lived: reuse it across tasks and agent sessions. Run
+   `abx auth keys` before creating a separate credential if the account is at its five-key limit;
+   revoke an unused non-current key with `abx auth revoke-key <key-id>`. Run `abx auth logout` only
+   for intentional teardown, compromise, rotation, or cleanup of the current key.
+5. Run `abx doctor` and resolve every red check relevant to the chosen lane.
+6. Run `abx storage show --check` when bytes will leave the local disk.
+7. Run `abx remote <name>` before relying on a configured managed service.
+8. Run command help, then a JSON dry run.
+9. Confirm the plan and only then execute.
+
+For an eligible first-party account, `--sponsor` replaces local key and faucet setup with an
+account-bound creator wallet. The first use opens a Privy agent grant; later commands reuse that
+grant for up to 30 days, unless the creator revokes it first. Do not ask for another browser approval when the
+CLI resumes an existing grant. Use sponsorship only when the live descriptor and account
+capabilities advertise the active chain. Test the exact flow on the reported paired testnet before
+production. Read [services.md](services.md) before using it. Sponsorship is zero-value and never a
+reason to skip the dry run or transaction summary.

package/assets/renderer-scaffold/src/interfaces/IAbxFieldRenderer.sol

@@ -1,32 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.20;
-
-/// @title IAbxFieldRenderer — the contract your in-chain art implements
-/// @notice A field renderer returns ONE metadata field's value, COMPUTED from chain state
-///         (the token's seed + PostParams, its owner, anything readable on-chain). The ABX
-///         metadata renderer staticcalls it to build `tokenURI` — e.g. an `image` renderer's
-///         SVG becomes `data:image/svg+xml;base64,…`. Deploy your renderer, then wire it with
-///         `abx deploy-code --image-renderer <address> [--attributes-renderer <address>] --onchain-uri`.
-///
-/// @dev THE FIVE INVARIANTS (a reverting or malformed renderer bricks the WHOLE tokenURI —
-///      the metadata renderer staticcalls you with NO try/catch):
-///        1. NEVER revert for ANY (token, tokenId, field) — including the collection surface
-///           `tokenId == type(uint256).max` (used by `contractURI`). Return a neutral value.
-///        2. Return the correct `contentType` (`image/svg+xml` for an image; `application/json`
-///           for an `attributes` array).
-///        3. Guard `field`: revert only a truly unsupported field (a deploy-time miswiring), but
-///           still never revert on the fields you DO render.
-///        4. `view` + deterministic: same chain state → same bytes.
-///        5. Bounded output: keep it small (a few hundred bytes of SVG) so `tokenURI` stays a
-///           cheap single eth_call. `forge test` the never-revert cases before you wire it.
-interface IAbxFieldRenderer {
-    /// @param token   the ABX collection contract (read its params via {IAbxParams}).
-    /// @param tokenId the token, or `type(uint256).max` for the collection surface.
-    /// @param field   which field to compute (e.g. `"image"`, `"attributes"`).
-    /// @return contentType MIME of `data` (e.g. `image/svg+xml`, `application/json`).
-    /// @return data        the field's finished bytes.
-    function render(address token, uint256 tokenId, bytes32 field)
-        external
-        view
-        returns (string memory contentType, bytes memory data);
-}

package/assets/renderer-scaffold/src/interfaces/IAbxParams.sol

@@ -1,26 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.20;
-
-/// @title IAbxParams — read the token's on-chain params (seed + collector PostParams)
-/// @notice Your renderer reads live state through this. Each value is a `bytes32`; `isSet` tells
-///         you whether it exists (fall back to a default if not — see invariant #1). `valueIsHash`
-///         is true when the on-chain value is a keccak commitment to off-chain bytes (a literal
-///         scalar param like a `seed` or a `HexColor` palette is NOT a hash — check `!valueIsHash`).
-///
-///         The tokenData merge rule: a token-scope value overrides the contract-scope one. The
-///         common pattern is `tokenParam` first, then `contractParam` as a fallback (see the
-///         `_param` helper in MyRenderer.sol).
-interface IAbxParams {
-    /// Returns the token-scope param: its bytes32 `value`, `valueIsHash` (true if it commits to
-    /// off-chain bytes — a literal scalar like a seed/HexColor is false), and `isSet` (does it exist).
-    function tokenParam(uint256 tokenId, bytes32 key)
-        external
-        view
-        returns (bytes32 value, bool valueIsHash, bool isSet);
-
-    /// @notice The contract-scope (collection-wide) value — the fallback when a token has none.
-    function contractParam(bytes32 key)
-        external
-        view
-        returns (bytes32 value, bool valueIsHash, bool isSet);
-}

package/dist/inspect.d.ts

@@ -1,48 +0,0 @@
-/**
- * `abx inspect <script.js>` — static analysis of a generative script, BEFORE picking a lane.
- *
- * The membrane fix behind this: an agent (or creator) should DERIVE the deployment lane from what
- * the script actually needs — are there traits? are they reproducible on-chain? how big is the
- * assembled document (does a single `tokenURI` eth_call even fit)? — instead of guessing "fully
- * on-chain!" and walking it back. This module is the pure analysis; `cmdInspect` formats it.
- *
- * Static only — it never executes the script (that's the resolver/runner's job, and executing
- * untrusted art in the CLI would be a footgun). Everything here is regex/heuristic over the source.
- */
-export type TraitFeasibility = 'none' | 'exact-likely' | 'careful' | 'infeasible' | 'unknown';
-export interface ScriptAnalysis {
-    bytes: number;
-    estChunks: number;
-    traits: {
-        present: boolean;
-        keys: string[];
-    };
-    paramHints: string[];
-    prng: {
-        seeded: boolean;
-        usesBareRandom: boolean;
-        usesMathRandom: boolean;
-        usesNoise: boolean;
-    };
-    depHints: string[];
-    looksP5: boolean;
-    feasibility: {
-        verdict: TraitFeasibility;
-        reason: string;
-    };
-    doc: {
-        estBytes: number;
-        deps: string[];
-        fitsSingleCall: boolean;
-        unknownDepSizes: boolean;
-    };
-    runtime: {
-        readsTokenData: boolean;
-        reportsTraits: boolean;
-        wrongGlobal: string | null;
-    };
-}
-export declare function analyzeScript(source: string, declaredDeps?: string[]): ScriptAnalysis;
-/** A one-line lane recommendation derived from the analysis (the decision-tree output). */
-export declare function recommendLane(a: ScriptAnalysis): string;
-//# sourceMappingURL=inspect.d.ts.map

package/dist/inspect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../src/inspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAgBH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAE9F,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAC,CAAC;IAC3C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;IAC9F,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE;QAAC,OAAO,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC;IACzD,GAAG,EAAE;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAC,CAAC;IAM3F,OAAO,EAAE;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,CAAC;CACxF;AAsDD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAO,GAAG,cAAc,CAqEzF;AAED,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CA0BvD"}

package/dist/inspect.js

@@ -1,184 +0,0 @@
-/**
- * `abx inspect <script.js>` — static analysis of a generative script, BEFORE picking a lane.
- *
- * The membrane fix behind this: an agent (or creator) should DERIVE the deployment lane from what
- * the script actually needs — are there traits? are they reproducible on-chain? how big is the
- * assembled document (does a single `tokenURI` eth_call even fit)? — instead of guessing "fully
- * on-chain!" and walking it back. This module is the pure analysis; `cmdInspect` formats it.
- *
- * Static only — it never executes the script (that's the resolver/runner's job, and executing
- * untrusted art in the CLI would be a footgun). Everything here is regex/heuristic over the source.
- */
-/** Approx bytes a known on-chain dependency adds to the ASSEMBLED document (gzip'd + base64'd, as it
- *  rides in the inline data-URI). Measured from real drops; used only for the RPC-size estimate. */
-const KNOWN_DEP_DOC_BYTES = {
-    'p5@1.0.0': 200_000, // p5 1.0.0 (~623KB raw) rides ~200KB gzip+base64 in the document
-};
-/** The on-chain runtime the generator always inlines (abx.js + the gunzip bootstrap), base64'd. */
-const RUNTIME_DOC_BYTES = 13_000;
-/** A single `eth_call` returning `tokenURI` comfortably carries this much document on a default node
- *  (geth's 50M gas cap; memory expansion is ~quadratic). Past it, marketplaces that call `tokenURI`
- *  once may time out — prefer the generator's piecewise getters, directory mode, or a CDN dep. */
-const SINGLE_CALL_DOC_CEILING = 1_500_000;
-/** PostParam keys the script READS from tokenData — the palette-style customization inputs. A deploy
- *  that omits these from `--schema` silently drops them (the render sees `undefined` → its default),
- *  which is exactly how a real session "forgot" the palette it had itself identified. Heuristic (the
- *  script isn't executed): find identifiers aliased to `abx.tokenData`, then their property reads;
- *  plus direct `abx.tokenData.key`, destructuring, and `tokenData['key']`. `seed` is intrinsic, not a
- *  PostParam, so it's excluded. Advisory — over- or under-detection is a hint, never a hard gate. */
-function paramKeys(source) {
-    const keys = new Set();
-    const add = (k) => { if (k && k !== 'seed')
-        keys.add(k); };
-    // Identifiers aliased to the token-data object — either `abx.tokenData` (via abx.js) or the raw
-    // injected global `window.abxTokenData` (e.g. `var td = (window.abx && abx.tokenData) || {}`).
-    const aliases = new Set();
-    // The `(?!…\.[A-Za-z_$])` guard: only alias when the RHS is the tokenData OBJECT, not a PROPERTY of
-    // it — `const seed = abx.tokenData.seed` aliases `seed` to a scalar, so its method calls
-    // (`seed.startsWith(…)`) must NOT be read as params (the false-positive that flagged startsWith/slice).
-    const aliasRe = /\b([A-Za-z_$][\w$]*)\s*=\s*[^;\n]*(?:abx\s*\??\s*\.\s*tokenData|window\s*\??\s*\.\s*abxTokenData)(?!\s*\??\s*\.\s*[A-Za-z_$])/g;
-    let m;
-    while ((m = aliasRe.exec(source)) !== null)
-        aliases.add(m[1]);
-    for (const a of aliases) {
-        // `(?!\s*\()` excludes method CALLS (`td.slice(…)`) — a param read is a bare property, never a call.
-        const dotRe = new RegExp(`\\b${a.replace(/[$]/g, '\\$')}\\s*\\??\\s*\\.\\s*([A-Za-z_$][\\w$]*)(?!\\s*\\()`, 'g');
-        let d;
-        while ((d = dotRe.exec(source)) !== null)
-            add(d[1]);
-    }
-    // Direct `abx.tokenData.key` and `abx.tokenData['key']`.
-    const directRe = /abx\s*\??\s*\.\s*tokenData\s*\??\s*(?:\.\s*([A-Za-z_$][\w$]*)|\[\s*['"]([^'"]+)['"]\s*\])/g;
-    while ((m = directRe.exec(source)) !== null)
-        add(m[1] ?? m[2]);
-    // Destructuring: `const { palette, foo } = abx.tokenData` (or an alias).
-    const destrRe = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*[^;\n]*(?:abx\s*\.\s*tokenData|\b(?:tokenData|td)\b)/g;
-    while ((m = destrRe.exec(source)) !== null) {
-        for (const part of m[1].split(','))
-            add(part.split(':')[0].trim().replace(/\.\.\./, '') || undefined);
-    }
-    return [...keys];
-}
-/** Extract the key names from the first `abx.traits({ ... })` object literal (flat objects only). */
-function traitKeys(source) {
-    const m = source.match(/abx\s*\??\s*\.\s*traits\s*\(\s*\{([^}]*)\}/);
-    if (!m)
-        return [];
-    const keys = [];
-    // A key sits at the start of the object or right after a comma (so a ternary VALUE like
-    // `? 'Sparse' : 'Dense'` — a `:` not preceded by `,`/`{` — is never mistaken for a key). Allow
-    // leading whitespace after `^` so the FIRST key (preceded only by the newline after `{`) is caught.
-    // A key is EITHER a quoted string (arbitrary content — `'Plant Count'`, a spaced trait_type a
-    // marketplace shows) OR a bare identifier; a bare-identifier-only match silently dropped quoted
-    // keys, and "believe inspect" then sent authors chasing a phantom missing trait.
-    const re = /(?:^\s*|[,{]\s*)(?:(['"])([^'"]+)\1|([A-Za-z_$][\w$]*))\s*:/g;
-    let k;
-    while ((k = re.exec(m[1])) !== null)
-        keys.push(k[2] ?? k[3]);
-    return [...new Set(keys)];
-}
-export function analyzeScript(source, declaredDeps = []) {
-    const bytes = new TextEncoder().encode(source).length;
-    const keys = traitKeys(source);
-    const usesMathRandom = /Math\s*\.\s*random\s*\(/.test(source);
-    // p5's bare random(...) — a `random(` NOT preceded by `.` or a word char (so not Math.random / obj.random)
-    const usesBareRandom = /(^|[^.\w])random\s*\(/.test(source);
-    const seeded = /\brandomSeed\s*\(/.test(source);
-    const usesNoise = /\bnoise\s*\(/.test(source);
-    const looksP5 = /\bcreateCanvas\s*\(|function\s+setup\s*\(|function\s+draw\s*\(|\bp5\b/.test(source);
-    const depHints = [];
-    if (looksP5)
-        depHints.push('p5');
-    if (/\bTHREE\b/.test(source))
-        depHints.push('three');
-    if (/\bTone\b/.test(source))
-        depHints.push('tone');
-    // The abx.js runtime data contract — does the script read state + report traits the ONE way the
-    // toolkit injects/captures them? A near-miss global deploys fine but is silently broken.
-    // `\??\s*\.` tolerates optional chaining (`abx?.tokenData`) — a common, correct way to read it.
-    const readsTokenData = /abx\s*\??\s*\.\s*tokenData\b/.test(source) || /window\s*\??\s*\.\s*abxTokenData\b/.test(source);
-    const reportsTraits = /abx\s*\??\s*\.\s*traits\s*\(/.test(source);
-    let wrongGlobal = null;
-    if (!readsTokenData) {
-        if (/window\s*\.\s*tokenTraits\b/.test(source))
-            wrongGlobal = 'window.tokenTraits — traits are reported by CALLING abx.traits({…}), never by writing a global';
-        else if (/window\s*\.\s*tokenData\b/.test(source))
-            wrongGlobal = 'window.tokenData — abx injects window.abxTokenData (read it via abx.tokenData), not window.tokenData';
-        else if (/\btokenData\b/.test(source))
-            wrongGlobal = 'a bare `tokenData` — read abx.tokenData (via abx.js) or the raw window.abxTokenData global';
-    }
-    // Trait-reproducibility rubric (see docs/research/onchain-traits-feasibility.md).
-    let verdict;
-    let reason;
-    if (keys.length === 0) {
-        verdict = 'none';
-        reason = 'no abx.traits({…}) call → NO marketplace traits on ANY lane. A resolver captures the keys you pass to abx.traits(); it does not invent traits from internal variables or a global. Call abx.traits({…}) in the sketch if you want filterable traits.';
-    }
-    else if (usesMathRandom && !seeded) {
-        verdict = 'infeasible';
-        reason = 'traits derive from Math.random() (unseeded) — non-deterministic, reproducible nowhere. Serve attributes via a resolver, or ship without marketplace traits.';
-    }
-    else if (seeded && looksP5) {
-        verdict = 'exact-likely';
-        reason = 'seeded p5 random() is a documented LCG — integer floor/threshold/select traits port EXACTLY to Solidity. Confirm no trait keys off a raw float value. Wire with --attributes-renderer (see docs/research/onchain-traits-feasibility.md).';
-    }
-    else if (seeded) {
-        verdict = 'careful';
-        reason = "seeded, but the PRNG isn't identified as p5 — reproducible on-chain if you port that generator + the exact call order.";
-    }
-    else if (usesBareRandom) {
-        verdict = 'unknown';
-        reason = 'traits present and random() is used, but no randomSeed() was found — check the art is deterministic before attempting on-chain traits.';
-    }
-    else {
-        verdict = 'exact-likely';
-        reason = 'traits look derived from the seed/params directly (no PRNG) — reproducible on-chain via an attributes field-renderer.';
-    }
-    const deps = declaredDeps;
-    let unknownDepSizes = false;
-    let depDocBytes = 0;
-    for (const d of deps) {
-        if (d in KNOWN_DEP_DOC_BYTES)
-            depDocBytes += KNOWN_DEP_DOC_BYTES[d];
-        else
-            unknownDepSizes = true;
-    }
-    const estBytes = bytes + RUNTIME_DOC_BYTES + depDocBytes;
-    return {
-        bytes,
-        estChunks: Math.max(1, Math.ceil(bytes / 22_000)),
-        traits: { present: keys.length > 0, keys },
-        paramHints: paramKeys(source),
-        prng: { seeded, usesBareRandom, usesMathRandom, usesNoise },
-        depHints,
-        looksP5,
-        feasibility: { verdict, reason },
-        doc: { estBytes, deps, fitsSingleCall: estBytes <= SINGLE_CALL_DOC_CEILING && !unknownDepSizes, unknownDepSizes },
-        runtime: { readsTokenData, reportsTraits, wrongGlobal },
-    };
-}
-/** A one-line lane recommendation derived from the analysis (the decision-tree output). */
-export function recommendLane(a) {
-    const bigDoc = !a.doc.fitsSingleCall && !a.doc.unknownDepSizes;
-    if (bigDoc) {
-        return 'DIRECTORY mode (--code-dir) or a CDN dependency — the assembled document is too large for a single tokenURI eth_call to be reliable.';
-    }
-    if (a.feasibility.verdict === 'infeasible') {
-        return 'RESOLVER lane (--public-base-url) if marketplace traits matter (a server serves the JS-derived attributes), OR --onchain-uri and accept no marketplace traits (the tokenURI + animation are still fully on-chain).';
-    }
-    if (a.feasibility.verdict === 'exact-likely' || a.feasibility.verdict === 'none') {
-        const dep = a.depHints.length ? ` --dep ${a.depHints[0]}@<version>` : '';
-        const docKb = Math.round(a.doc.estBytes / 1000);
-        // Owner call (real-world experience): for a generative drop meant to sell, LEAD with the off-chain
-        // resolver — maneuverable over time + marketplaces fetch a SMALL tokenURI reliably. Fully-on-chain
-        // is the durability-max alternative, but its ~docKb tokenURI (whole doc per call) strains some
-        // marketplace/indexer reads. Traits are NOT a free flag on the on-chain lane (deployed renderer).
-        const traits = a.traits.present
-            ? ` Traits (${a.traits.keys.join(', ')}): the resolver serves them from the render with no Solidity; on the on-chain lane they need a DEPLOYED --attributes-renderer (fork SeedTraitsRenderer.sol) or they're omitted.`
-            : ``;
-        return (`RECOMMENDED for a drop you'll sell — OFF-CHAIN RESOLVER (--public-base-url + an effects runner): maneuverable (metadata/serving can evolve without on-chain surgery) and marketplaces fetch a SMALL tokenURI reliably.${traits}\n` +
-            `  ALTERNATIVE — FULLY ON-CHAIN (--onchain-uri${dep} --image-base <bucket>): maximal durability / no server, but the tokenURI carries the whole ~${docKb}KB document per call (some marketplace + indexer reads choke on a doc this big), stills are MANUAL, and later changes are on-chain re-points. Pick it when permanence + zero-infra outweigh maneuverability.`);
-    }
-    return (`RECOMMENDED — an OFF-CHAIN RESOLVER (--public-base-url): maneuverable, and it serves traits from the render regardless of the PRNG. --onchain-uri also works for tokenURI + animation, but first verify the script is deterministic (see the feasibility note), and note the large-tokenURI marketplace-read tradeoff; on that lane traits need a DEPLOYED --attributes-renderer or are omitted.`);
-}
-//# sourceMappingURL=inspect.js.map

package/dist/inspect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../src/inspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;oGACoG;AACpG,MAAM,mBAAmB,GAA2B;IAClD,UAAU,EAAE,OAAO,EAAE,iEAAiE;CACvF,CAAC;AAEF,mGAAmG;AACnG,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;kGAEkG;AAClG,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAsB1C;;;;;qGAKqG;AACrG,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,oGAAoG;IACpG,yFAAyF;IACzF,wGAAwG;IACxG,MAAM,OAAO,GAAG,gIAAgI,CAAC;IACjJ,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,qGAAqG;QACrG,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;QACjH,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,yDAAyD;IACzD,MAAM,QAAQ,GAAG,4FAA4F,CAAC;IAC9G,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,yEAAyE;IACzE,MAAM,OAAO,GAAG,6FAA6F,CAAC;IAC9G,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,qGAAqG;AACrG,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,wFAAwF;IACxF,+FAA+F;IAC/F,oGAAoG;IACpG,8FAA8F;IAC9F,gGAAgG;IAChG,iFAAiF;IACjF,MAAM,EAAE,GAAG,8DAA8D,CAAC;IAC1E,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,eAAyB,EAAE;IACvE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,2GAA2G;IAC3G,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,uEAAuE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnD,gGAAgG;IAChG,yFAAyF;IACzF,gGAAgG;IAChG,MAAM,cAAc,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxH,MAAM,aAAa,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,WAAW,GAAG,gGAAgG,CAAC;aAC1J,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,WAAW,GAAG,sGAAsG,CAAC;aACnK,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,WAAW,GAAG,4FAA4F,CAAC;IACpJ,CAAC;IAED,kFAAkF;IAClF,IAAI,OAAyB,CAAC;IAC9B,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,MAAM,CAAC;QACjB,MAAM,GAAG,sPAAsP,CAAC;IAClQ,CAAC;SAAM,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,GAAG,YAAY,CAAC;QACvB,MAAM,GAAG,6JAA6J,CAAC;IACzK,CAAC;SAAM,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,GAAG,cAAc,CAAC;QACzB,MAAM,GAAG,0OAA0O,CAAC;IACtP,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,GAAG,wHAAwH,CAAC;IACpI,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,GAAG,wIAAwI,CAAC;IACpJ,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,cAAc,CAAC;QACzB,MAAM,GAAG,uHAAuH,CAAC;IACnI,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC;IAC1B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,mBAAmB;YAAE,WAAW,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;;YAC/D,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,GAAG,iBAAiB,GAAG,WAAW,CAAC;IACzD,OAAO;QACL,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,EAAC,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAC;QACxC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,EAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAC;QACzD,QAAQ;QACR,OAAO;QACP,WAAW,EAAE,EAAC,OAAO,EAAE,MAAM,EAAC;QAC9B,GAAG,EAAE,EAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,IAAI,uBAAuB,IAAI,CAAC,eAAe,EAAE,eAAe,EAAC;QAC/G,OAAO,EAAE,EAAC,cAAc,EAAE,aAAa,EAAE,WAAW,EAAC;KACtD,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,CAAiB;IAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;IAC/D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,sIAAsI,CAAC;IAChJ,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QAC3C,OAAO,oNAAoN,CAAC;IAC9N,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,WAAW,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAChD,mGAAmG;QACnG,mGAAmG;QACnG,+FAA+F;QAC/F,kGAAkG;QAClG,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO;YAC7B,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iLAAiL;YACvN,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CACL,yNAAyN,MAAM,IAAI;YACnO,gDAAgD,GAAG,gGAAgG,KAAK,8MAA8M,CACvW,CAAC;IACJ,CAAC;IACD,OAAO,CACL,kYAAkY,CACnY,CAAC;AACJ,CAAC"}