@artblocks/abx-sdk 0.1.0-alpha.12 → 0.1.0-alpha.14

package/dist/create2.js

@@ -1,5 +1,5 @@
 import { concat, getContractAddress, keccak256, toBytes } from 'viem';
-import { abxChunkStoreBytecode, abxFixedPriceMinterBytecode, abxFixedPriceMinter1155Bytecode, abxMetadataRendererBytecode, abxSeedSourceBytecode, editionImageFactoryBytecode, oneOfOneEditionFactoryBytecode, } from './abi/index.js';
+import { abxChunkStoreBytecode, abxCodeLibBytecode, abxEditionLibBytecode, abxMetadataLibBytecode, abxFixedPriceMinterBytecode, abxFixedPriceMinter1155Bytecode, abxMetadataRendererBytecode, abxParamsLibBytecode, abxSeedSourceBytecode, editionCodeFactoryBytecode, editionImageFactoryBytecode, oneOfOneEditionFactoryBytecode, oneOfOneImageFactoryBytecode, seriesCodeFactoryBytecode, seriesImageFactoryBytecode, } from './abi/index.js';
 /**
  * Keyless CREATE2 deployment — the TS twin of `contracts/script/AbxSalts.sol`.
  *
@@ -12,7 +12,9 @@ import { abxChunkStoreBytecode, abxFixedPriceMinterBytecode, abxFixedPriceMinter
 /** The keyless CREATE2 proxy (Arachnid deterministic-deployment-proxy). Same address on every chain. */
 export const CREATE2_PROXY = '0x4e59b44847b379578588920cA78FbF26c0B4956C';
 /** Canonical salt strings — MUST stay byte-identical to `contracts/script/AbxSalts.sol`, since the
- *  deterministic address is `keccak256(0xff ++ proxy ++ keccak256(salt) ++ keccak256(initcode))`. */
+ *  deterministic address is `keccak256(0xff ++ proxy ++ keccak256(salt) ++ keccak256(initcode))`.
+ *  `test/create2-salts.test.ts` diffs this table against that file, both ways, so drift can't be
+ *  quiet: the two halves have to be one fact. */
 export const ABX_SALT = {
     oneOfOneFactory: 'abx.factory.one-of-one.v1',
     seriesFactory: 'abx.factory.series.v1',
@@ -22,14 +24,17 @@ export const ABX_SALT = {
     fixedPriceMinter: 'abx.minter.fixed-price.v1',
     seedSource: 'abx.seed-source.v1',
     generator: 'abx.generator.v1',
-    // ERC-1155 editions (twins of the above; naming follows the parity plan verbatim). Listed here
-    // for parity with `AbxSalts.sol` even though `editionCodeFactory`'s salt (like
-    // `seriesCodeFactory`'s above) is never fed to `predictCreate2Address` — see the class-level
-    // dev note below on why the lib-linked factory has no SDK-side prediction.
+    // ERC-1155 editions (twins of the above; naming follows the parity plan verbatim).
     oneOfOneEditionFactory: 'abx.one-of-one-edition-factory.v1',
     editionFactory: 'abx.edition-factory.v1',
     editionCodeFactory: 'abx.edition-code-factory.v1',
     fixedPriceMinter1155: 'abx.fixed-price-minter-1155.v1',
+    // Delegatecalled write-path libraries — CREATE2 like everything else here (see the
+    // "delegatecalled write-path libraries" note below, and `DeployLibraries.s.sol`).
+    paramsLib: 'abx.lib.params.v1',
+    codeLib: 'abx.lib.code.v1',
+    editionLib: 'abx.lib.edition.v1',
+    metadataLib: 'abx.lib.metadata.v1',
 };
 /** The 32-byte salt a CREATE2 deploy uses (`keccak256` of the canonical string). */
 export const saltHash = (salt) => keccak256(toBytes(salt));
@@ -55,21 +60,145 @@ export const predictSeedSource = () => predictCreate2Address(ABX_SALT.seedSource
 // ── ERC-1155 editions ──────────────────────────────────────────────────────────
 //
 // `DeployOneOfOneEdition.s.sol` / `DeployEdition.s.sol` / `DeployMinter1155.s.sol` each deploy
-// their contract with a fixed `AbxSalts` salt and NO constructor args, so — exactly like the
-// renderer/chunk-store/1155-minter-free singletons above — the SDK's own bytecode (from
-// `generated.ts`) is sufficient to predict the address before any deploy. `EditionCodeFactory` is
-// the one exception: its implementation `delegatecall`s three externally-linked libraries
-// (`AbxParamsLib`/`AbxCodeLib`/`AbxEditionLib`), so its FINAL initcode embeds those libraries'
-// deployed addresses — which are nonce-dependent, not fixed by source alone — and is therefore
-// not something the SDK can predict ahead of a deploy. Mirrors exactly why `SeriesCodeFactory` has
-// no `predict*` here either (see `deploySeriesCodeFactory`'s own doc comment in `deploy.ts`).
-/** The canonical (cross-chain-identical) `OneOfOneEditionFactory` address for the current
- *  bytecode — the 1/1-edition trust anchor. */
-export const predictOneOfOneEditionFactory = () => predictCreate2Address(ABX_SALT.oneOfOneEditionFactory, oneOfOneEditionFactoryBytecode);
-/** The canonical (cross-chain-identical) `EditionImageFactory` address for the current
- *  bytecode — the multi-artwork edition trust anchor. */
-export const predictEditionFactory = () => predictCreate2Address(ABX_SALT.editionFactory, editionImageFactoryBytecode);
+// their contract with a fixed `AbxSalts` salt and NO constructor args, so the salt + this build's
+// bytecode fix the address before any deploy. `AbxFixedPriceMinter1155` is a plain singleton and is
+// predicted right below; the two edition IMAGE factories are not — `OneOfOneEdition`/`EditionImage`
+// both delegate bodies into `AbxEditionLib`, so their factories carry a link placeholder and their
+// predictions live with the library-linked factories in the write-path-library section below
+// (`predictOneOfOneEditionFactory`/`predictEditionFactory`), next to the two code factories.
+/** The canonical (cross-chain-identical) `OneOfOneImageFactory` address for the current bytecode —
+ *  the 721 1/1 trust anchor. */
+export const predictFactory = () => predictCreate2Address(ABX_SALT.oneOfOneFactory, linkFactory());
+/** The canonical (cross-chain-identical) `SeriesImageFactory` address for the current bytecode —
+ *  the 721 multi-token trust anchor. */
+export const predictSeriesFactory = () => predictCreate2Address(ABX_SALT.seriesFactory, linkSeriesFactory());
 /** The canonical (cross-chain-identical) `AbxFixedPriceMinter1155` address for the current
  *  bytecode — the shared, ownerless edition sale singleton. */
 export const predictFixedPriceMinter1155 = () => predictCreate2Address(ABX_SALT.fixedPriceMinter1155, abxFixedPriceMinter1155Bytecode);
+// ── delegatecalled write-path libraries ────────────────────────────────────────
+//
+// A `public` library function is compiled as a `delegatecall` to a SEPARATELY deployed copy of the
+// library, and solc leaves a `__$<id>$__` placeholder in the caller's bytecode where that copy's
+// address goes. Linking is the substitution of an address into that placeholder.
+//
+// **Linking does not cost determinism.** These libraries are deployed through the same keyless
+// CREATE2 proxy at the canonical salts above (`DeployLibraries.s.sol` is the forge twin), so a
+// library's address is `f(proxy, salt, creation bytecode)` and nothing else — the deployer's nonce
+// is not an input to a CREATE2 address (it is an input to plain `CREATE`, which is where the
+// confusion came from). Predict the libraries, substitute them, and the linked factory's initcode
+// is fixed too — hence the FOUR `predict*Factory` helpers at the bottom of this section.
+//
+// Worth stating plainly, because the opposite belief was load-bearing: two ERC-1155 token types
+// (`OneOfOneEdition`/`EditionImage`) were held library-free and an EIP-170 size floor was relaxed to
+// avoid "losing" a factory's deterministic address. What was actually true was narrower and
+// self-inflicted — the SDK deployed its libraries with a plain EOA `CREATE` (`to: null`) by its own
+// choice, so *it* could not predict them, and that local limitation was written up as a property of
+// libraries in general. It isn't one. The broadcast artifacts always said so: every recorded library
+// deploy went through the keyless proxy, and `AbxParamsLib` landed at ONE address on Sepolia and
+// Base Sepolia from deployer nonces 215 apart. Both of those token types now delegate into
+// `AbxEditionLib` exactly as `EditionCode` does, so FOUR factories here are library-linked, not two.
+//
+// **Losing track of that is a bug class, not a footnote.** Three separate times a contract became
+// library-linked and this file went on hashing its UNLINKED bytecode, and the failure is silent:
+// viem does not reject a `__$…$__` placeholder, it UTF-8-encodes it — so the prediction is a
+// real-looking address that is the hash of ASCII garbage, for the addresses platforms allowlist, and
+// the same bytes would go out as initcode. `link.test.ts`'s "nothing deployable carries a
+// placeholder" guard derives its subject set from the exported bytecodes rather than a list of
+// names, precisely so the next contract to become library-linked cannot escape the same way.
+//
+// **The real trap is compile-time linking, not linking.** Substituting into the placeholder happens
+// AFTER compilation, so it cannot change the library's own creation bytecode. Handing solc the
+// addresses at build time instead (`forge build/script --libraries src/…:Lib:0x…`) writes the
+// library map into `settings.libraries` in every artifact's metadata, and the metadata hash is
+// appended to the creation bytecode — so the library's own address moves, and so does the linked
+// factory's. Optimizer settings do the same (the code tokens compile at `optimizer_runs = 200`,
+// everything else at 1,000,000). One canonical bytecode per library, therefore: the one
+// `sync-abis` reads from a plain `forge build`, which is what these predictions use.
+/** Fully-qualified library names (solc's link keys — path-sensitive, so they must match how the
+ *  contracts are compiled: `src/libraries/…` as `foundry.toml` sees them). */
+export const LIB_FQN = {
+    paramsLib: 'src/libraries/AbxParamsLib.sol:AbxParamsLib',
+    codeLib: 'src/libraries/AbxCodeLib.sol:AbxCodeLib',
+    editionLib: 'src/libraries/AbxEditionLib.sol:AbxEditionLib',
+    metadataLib: 'src/libraries/AbxMetadataLib.sol:AbxMetadataLib',
+};
+/** The solc link placeholder for a fully-qualified library name: `__$<keccak(fqn)[0:34]>$__`. */
+export const libPlaceholder = (fullyQualified) => `__$${keccak256(toBytes(fullyQualified)).slice(2, 36)}$__`;
+/**
+ * Link `bytecode` against deployed libraries — the post-compile placeholder substitution `forge`
+ * does at build time, done here so a sandbox / fresh chain needs no forge. Throws if any
+ * placeholder is left over, since an unlinked `__$…$__` is not valid hex and the RPC would reject
+ * the transaction with an opaque `Invalid byte sequence`.
+ */
+export function linkLibraries(bytecode, links) {
+    let out = bytecode;
+    for (const [fqn, address] of links)
+        out = out.split(libPlaceholder(fqn)).join(address.slice(2).toLowerCase());
+    if (out.includes('__$'))
+        throw new Error(`unlinked library placeholder remains: ${/__\$[0-9a-f]{34}\$__/.exec(out)?.[0]}`);
+    return out;
+}
+/** The canonical (cross-chain-identical) `AbxParamsLib` address — the params write path both code
+ *  token types delegatecall. */
+export const predictParamsLib = () => predictCreate2Address(ABX_SALT.paramsLib, abxParamsLibBytecode);
+/** The canonical (cross-chain-identical) `AbxCodeLib` address — the script/code write path. */
+export const predictCodeLib = () => predictCreate2Address(ABX_SALT.codeLib, abxCodeLibBytecode);
+/** The canonical (cross-chain-identical) `AbxEditionLib` address — the 1155 uri / creator-token /
+ *  edition-supply write path that **all three** edition token types (`OneOfOneEdition`,
+ *  `EditionImage`, `EditionCode`) delegatecall.
+ *  `AbxEditionLib` itself delegatecalls `AbxParamsLib`, so it is linked before it is deployed: the
+ *  one library here whose own initcode depends on another library's address. */
+export const predictEditionLib = () => predictCreate2Address(ABX_SALT.editionLib, linkEditionLib());
+/** The canonical `AbxMetadataLib` address. Linked by ALL SIX token types — the metadata field store
+ *  was inlined into every one of them until the 2026-08-14 audit asked for EIP-170 headroom before
+ *  further remediation, so externalizing it is what made even the plainest 721 factory
+ *  library-linked. It links nothing itself, so it is deployed first. */
+export const predictMetadataLib = () => predictCreate2Address(ABX_SALT.metadataLib, abxMetadataLibBytecode);
+/** `AbxEditionLib`'s canonical initcode: its shipped bytecode linked against `AbxParamsLib`. */
+export const linkEditionLib = () => linkLibraries(abxEditionLibBytecode, [[LIB_FQN.paramsLib, predictParamsLib()]]);
+/** `OneOfOneEditionFactory`'s canonical initcode: linked against `AbxEditionLib` (the only library
+ *  its embedded `OneOfOneEdition` implementation delegates into). `AbxEditionLib`'s own address
+ *  already accounts for its `AbxParamsLib` link — see {@link predictEditionLib}. */
+export const linkOneOfOneEditionFactory = () => linkLibraries(oneOfOneEditionFactoryBytecode, [
+    [LIB_FQN.editionLib, predictEditionLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** `EditionImageFactory`'s canonical initcode: linked against `AbxEditionLib`, the sibling of
+ *  {@link linkOneOfOneEditionFactory}. */
+export const linkEditionFactory = () => linkLibraries(editionImageFactoryBytecode, [
+    [LIB_FQN.editionLib, predictEditionLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** `SeriesCodeFactory`'s canonical initcode: linked against the two write-path libraries. */
+export const linkSeriesCodeFactory = () => linkLibraries(seriesCodeFactoryBytecode, [
+    [LIB_FQN.paramsLib, predictParamsLib()],
+    [LIB_FQN.codeLib, predictCodeLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** `EditionCodeFactory`'s canonical initcode: linked against all three write-path libraries. */
+export const linkEditionCodeFactory = () => linkLibraries(editionCodeFactoryBytecode, [
+    [LIB_FQN.paramsLib, predictParamsLib()],
+    [LIB_FQN.codeLib, predictCodeLib()],
+    [LIB_FQN.editionLib, predictEditionLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** The two ERC-721 image factories' canonical initcode. They linked NOTHING until the metadata
+ *  field store was externalized; now every token type is library-linked. */
+export const linkFactory = () => linkLibraries(oneOfOneImageFactoryBytecode, [[LIB_FQN.metadataLib, predictMetadataLib()]]);
+export const linkSeriesFactory = () => linkLibraries(seriesImageFactoryBytecode, [[LIB_FQN.metadataLib, predictMetadataLib()]]);
+/** The canonical (cross-chain-identical) `SeriesCodeFactory` address — the code-project trust
+ *  anchor. Predictable because its libraries are (see the section note above). */
+export const predictSeriesCodeFactory = () => predictCreate2Address(ABX_SALT.seriesCodeFactory, linkSeriesCodeFactory());
+/** The canonical (cross-chain-identical) `EditionCodeFactory` address — the code-project EDITION
+ *  trust anchor. */
+export const predictEditionCodeFactory = () => predictCreate2Address(ABX_SALT.editionCodeFactory, linkEditionCodeFactory());
+/** The canonical (cross-chain-identical) `OneOfOneEditionFactory` address — the 1/1-edition trust
+ *  anchor. Predicted from LINKED initcode: `OneOfOneEdition` delegates its uri / creator-token /
+ *  edition-supply bodies into `AbxEditionLib`, so the shipped factory bytecode carries a link
+ *  placeholder (hashing it unlinked yields a plausible-looking address for a trust anchor that
+ *  nothing can ever be deployed to — see the section note). */
+export const predictOneOfOneEditionFactory = () => predictCreate2Address(ABX_SALT.oneOfOneEditionFactory, linkOneOfOneEditionFactory());
+/** The canonical (cross-chain-identical) `EditionImageFactory` address — the multi-work edition
+ *  trust anchor, the sibling of {@link predictOneOfOneEditionFactory} (same single library link). */
+export const predictEditionFactory = () => predictCreate2Address(ABX_SALT.editionFactory, linkEditionFactory());
 //# sourceMappingURL=create2.js.map

package/dist/create2.js.map

@@ -1 +1 @@
-{"version":3,"file":"create2.js","sourceRoot":"","sources":["../src/create2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,EAAyB,MAAM,MAAM,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,+BAA+B,EAC/B,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;GAQG;AAEH,wGAAwG;AACxG,MAAM,CAAC,MAAM,aAAa,GAAY,4CAA4C,CAAC;AAEnF;qGACqG;AACrG,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,eAAe,EAAE,2BAA2B;IAC5C,aAAa,EAAE,uBAAuB;IACtC,iBAAiB,EAAE,4BAA4B;IAC/C,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,oBAAoB;IAChC,gBAAgB,EAAE,2BAA2B;IAC7C,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,kBAAkB;IAC7B,+FAA+F;IAC/F,+EAA+E;IAC/E,6FAA6F;IAC7F,2EAA2E;IAC3E,sBAAsB,EAAE,mCAAmC;IAC3D,cAAc,EAAE,wBAAwB;IACxC,kBAAkB,EAAE,6BAA6B;IACjD,oBAAoB,EAAE,gCAAgC;CAC9C,CAAC;AAEX,oFAAoF;AACpF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAExE;6CAC6C;AAC7C,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAa;IAC/D,OAAO,kBAAkB,CAAC,EAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAC,CAAC,CAAC;AACtG,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAa;IACzD,OAAO,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAElH,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;AAEpH,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,EAAE,CACnD,qBAAqB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;AAEhF;;mGAEmG;AACnG,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAElH,kFAAkF;AAClF,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,wFAAwF;AACxF,kGAAkG;AAClG,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,mGAAmG;AACnG,8FAA8F;AAE9F;+CAC+C;AAC/C,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAY,EAAE,CACzD,qBAAqB,CAAC,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC;AAEzF;yDACyD;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAY,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AAE9E;+DAC+D;AAC/D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAY,EAAE,CACvD,qBAAqB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC"}
+{"version":3,"file":"create2.js","sourceRoot":"","sources":["../src/create2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,EAAyB,MAAM,MAAM,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,+BAA+B,EAC/B,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,EAC9B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;GAQG;AAEH,wGAAwG;AACxG,MAAM,CAAC,MAAM,aAAa,GAAY,4CAA4C,CAAC;AAEnF;;;iDAGiD;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,eAAe,EAAE,2BAA2B;IAC5C,aAAa,EAAE,uBAAuB;IACtC,iBAAiB,EAAE,4BAA4B;IAC/C,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,oBAAoB;IAChC,gBAAgB,EAAE,2BAA2B;IAC7C,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,kBAAkB;IAC7B,mFAAmF;IACnF,sBAAsB,EAAE,mCAAmC;IAC3D,cAAc,EAAE,wBAAwB;IACxC,kBAAkB,EAAE,6BAA6B;IACjD,oBAAoB,EAAE,gCAAgC;IACtD,mFAAmF;IACnF,kFAAkF;IAClF,SAAS,EAAE,mBAAmB;IAC9B,OAAO,EAAE,iBAAiB;IAC1B,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,qBAAqB;CAC1B,CAAC;AAEX,oFAAoF;AACpF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAExE;6CAC6C;AAC7C,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAa;IAC/D,OAAO,kBAAkB,CAAC,EAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAC,CAAC,CAAC;AACtG,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAa;IACzD,OAAO,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAElH,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;AAEpH,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,EAAE,CACnD,qBAAqB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;AAEhF;;mGAEmG;AACnG,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAElH,kFAAkF;AAClF,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,6FAA6F;AAC7F,6FAA6F;AAE7F;gCACgC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAY,EAAE,CAC1C,qBAAqB,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;AAEjE;wCACwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAY,EAAE,CAChD,qBAAqB,CAAC,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAErE;+DAC+D;AAC/D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAY,EAAE,CACvD,qBAAqB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;AAExF,kFAAkF;AAClF,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,iFAAiF;AACjF,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,mGAAmG;AACnG,6FAA6F;AAC7F,kGAAkG;AAClG,yFAAyF;AACzF,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,4FAA4F;AAC5F,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,iGAAiG;AACjG,2FAA2F;AAC3F,qGAAqG;AACrG,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,qGAAqG;AACrG,0FAA0F;AAC1F,+FAA+F;AAC/F,6FAA6F;AAC7F,EAAE;AACF,oGAAoG;AACpG,+FAA+F;AAC/F,8FAA8F;AAC9F,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,wFAAwF;AACxF,qFAAqF;AAErF;8EAC8E;AAC9E,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,SAAS,EAAE,6CAA6C;IACxD,OAAO,EAAE,yCAAyC;IAClD,UAAU,EAAE,+CAA+C;IAC3D,WAAW,EAAE,iDAAiD;CACtD,CAAC;AAEX,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,cAAsB,EAAU,EAAE,CAC/D,MAAM,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAa,EAAE,KAA8D;IACzG,IAAI,GAAG,GAAW,QAAQ,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9G,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3H,OAAO,GAAU,CAAC;AACpB,CAAC;AAED;gCACgC;AAChC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAE/G,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAEzG;;;;gFAIgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAC7C,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;AAE/D;;;wEAGwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,qBAAqB,CAAC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAEtE,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAQ,EAAE,CACtC,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;AAElF;;oFAEoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAQ,EAAE,CAClD,aAAa,CAAC,8BAA8B,EAAE;IAC5C,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL;0CAC0C;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAQ,EAAE,CAC1C,aAAa,CAAC,2BAA2B,EAAE;IACzC,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAQ,EAAE,CAC7C,aAAa,CAAC,yBAAyB,EAAE;IACvC,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvC,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAQ,EAAE,CAC9C,aAAa,CAAC,0BAA0B,EAAE;IACxC,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvC,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL;4EAC4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,GAAQ,EAAE,CACnC,aAAa,CAAC,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAQ,EAAE,CACzC,aAAa,CAAC,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAE3F;kFACkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAY,EAAE,CACpD,qBAAqB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAE7E;oBACoB;AACpB,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAY,EAAE,CACrD,qBAAqB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAE/E;;;;+DAI+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAY,EAAE,CACzD,qBAAqB,CAAC,QAAQ,CAAC,sBAAsB,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAEvF;qGACqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAY,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC"}

package/dist/creator-token.d.ts

@@ -8,6 +8,15 @@
  * zero — never un-enrolls. Every transfer that isn't a mint/burn (or the validator's own)
  * staticcalls `validateTransfer(caller, from, to, tokenId)` on the validator; a policy
  * violation reverts and bubbles.
+ *
+ * **`setTransferValidator` is owner-only only while the collection has an owner.** Once
+ * `owner() == address(0)` the contract opens one asymmetric door: **anyone** may suspend
+ * enforcement by passing `zeroAddress`, and nobody — including that caller — may ever arm a
+ * validator again. That is the dead-man release for the worst reachable state (a validator that
+ * reverts every transfer on a collection with nobody left to re-point it, which would otherwise
+ * strand every collector's token forever). An integrator building for collectors should expose
+ * that suspension path on a renounced collection rather than gating it behind an owner check that
+ * can no longer be satisfied — see {@link prepareSetTransferValidator}.
  */
 import { type Address, type PublicClient } from 'viem';
 import type { PreparedTx } from './ops.js';
@@ -50,12 +59,70 @@ export interface CreatorTokenStatus {
  * must read as `{enrolled: false, validator: zeroAddress}`, not as an error.
  */
 export declare function readCreatorTokenStatus(client: PublicClient, contract: Address): Promise<CreatorTokenStatus>;
+/** What {@link probeTransferValidator} found. Only `ok` may be written to a live collection.
+ *
+ *  - `ok`                  — the address has code and refuses a selector no validator implements,
+ *                            which is what every live validator does (see the probe's doc).
+ *  - `no-code`             — nothing deployed at this address on this chain. Enforcement would read
+ *                            as ON everywhere and check nothing.
+ *  - `permissive-fallback` — it has code, but it answers an unknown selector *successfully*. A
+ *                            Safe, an uninitialised proxy, or a 7702-delegated EOA does this, and
+ *                            because `validateTransfer` returns nothing there is no ABI decode to
+ *                            fail — so every transfer would silently pass validation.
+ *  - `unreachable`         — the RPC didn't answer. Says nothing about the address; retry.
+ */
+export type TransferValidatorVerdict = 'ok' | 'no-code' | 'permissive-fallback' | 'unreachable';
+/** The result of {@link probeTransferValidator} — verdict plus what was observed, for a message. */
+export interface TransferValidatorProbe {
+    verdict: TransferValidatorVerdict;
+    address: Address;
+    /** First line of the revert/transport error, when there was one. */
+    error?: string;
+}
+/**
+ * Ask a candidate transfer validator a question no validator can answer, and require it to FAIL.
+ *
+ * **`code.length > 0` is not enough**, which is why this exists and why the on-chain guard was
+ * rewritten to match. Two shapes enforce nothing while every read surface — ERC-165,
+ * `getTransferValidator()`, the extension beacon — reports enforcement as on: no code at all, and a
+ * *permissive fallback* that succeeds for any selector. `validateTransfer` returns nothing, so
+ * there is no ABI decode to fail; a Safe (its `FallbackManager.fallback()` returns empty when no
+ * handler is set), an uninitialised proxy, and an EIP-7702-delegated EOA all pass a has-code check
+ * and then wave every transfer through. A creator pasting their own Safe is the likely real case.
+ *
+ * So the probe inverts the question: a real validator **reverts** here (verified against OpenSea's
+ * SATSR and three Limit Break deployments on mainnet and Sepolia), and a permissive one returns
+ * empty success. This mirrors the contract exactly — the same selector, the same "must fail" rule —
+ * so an address that passes here is an address the token will accept, and the CLI stops reporting
+ * "no code on this chain" for an address that plainly has code.
+ *
+ * An ERC-165 gate was measured and rejected: none of those four live validators advertises
+ * `ITransferValidator`/`ITransferValidator1155`, so requiring an id would refuse the entire
+ * ecosystem, including the validator ABX itself recommends.
+ *
+ * **A misconfiguration guard, not a security boundary** — a contract can always be written to pass
+ * this and enforce nothing. It catches the honest mistake. Never throws for an on-chain reason:
+ * every failure is a verdict (mirrors `probeSeedSource`).
+ */
+export declare function probeTransferValidator(client: PublicClient, validator: Address, 
+/** The enrolling/enrolled token, when known — the probe is made as the token, because that is
+ *  the `msg.sender` the contract's own staticcall presents. */
+opts?: {
+    as?: Address;
+}): Promise<TransferValidatorProbe>;
 /**
  * Re-point an enrolled token's transfer validator, or suspend enforcement with
- * `zeroAddress` (the token stays enrolled). Signer must be the owner. Reverts
- * `NotCreatorToken()` on a token that didn't enroll at deploy — enrollment can never be
- * added later — and `InvalidTransferValidator()` on a non-zero validator with no code;
- * callers should read {@link readCreatorTokenStatus} first and refuse those before gas.
+ * `zeroAddress` (the token stays enrolled). Reverts `NotCreatorToken()` on a token that didn't
+ * enroll at deploy — enrollment can never be added later — and `InvalidTransferValidator()` on a
+ * validator the chain's own probe refuses (no code on this chain, **or** a permissive fallback that
+ * would enforce nothing); call {@link probeTransferValidator} first and refuse those before gas.
+ *
+ * **Who may sign:** the owner, while there is one. On a collection whose `owner()` is
+ * `address(0)`, **any** signer may send this with `validator = zeroAddress` to suspend enforcement
+ * permanently — the dead-man release described in this module's header. Arming a validator is still
+ * owner-only, so an ownerless collection can only move toward transferability, never back. A UX for
+ * collectors should offer that suspension when it sees a renounced, enforcing collection; gating it
+ * on `owner()` would hide the one recovery a stranded holder has.
  */
 export declare function prepareSetTransferValidator(args: {
     contract: Address;

package/dist/creator-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"creator-token.d.ts","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAkC,KAAK,OAAO,EAAE,KAAK,YAAY,EAAC,MAAM,MAAM,CAAC;AAEtF,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,UAAU,CAAC;AAEzC,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,EAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,eAAO,MAAM,iCAAiC,EAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,EACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAKlE,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAExF;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,UAAU,CAiBb"}
+{"version":3,"file":"creator-token.d.ts","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAkC,KAAK,OAAO,EAAY,KAAK,YAAY,EAAC,MAAM,MAAM,CAAC;AAEhG,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,UAAU,CAAC;AAEzC,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,EAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,eAAO,MAAM,iCAAiC,EAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,EACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAKlE,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAExF;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,qBAAqB,GAAG,aAAa,CAAC;AAEhG,oGAAoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,OAAO;AAClB;+DAC+D;AAC/D,IAAI,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAsBjC;AAoBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,UAAU,CAiBb"}

package/dist/creator-token.js

@@ -8,6 +8,15 @@
  * zero — never un-enrolls. Every transfer that isn't a mint/burn (or the validator's own)
  * staticcalls `validateTransfer(caller, from, to, tokenId)` on the validator; a policy
  * violation reverts and bubbles.
+ *
+ * **`setTransferValidator` is owner-only only while the collection has an owner.** Once
+ * `owner() == address(0)` the contract opens one asymmetric door: **anyone** may suspend
+ * enforcement by passing `zeroAddress`, and nobody — including that caller — may ever arm a
+ * validator again. That is the dead-man release for the worst reachable state (a validator that
+ * reverts every transfer on a collection with nobody left to re-point it, which would otherwise
+ * strand every collector's token forever). An integrator building for collectors should expose
+ * that suspension path on a renounced collection rather than gating it behind an owner check that
+ * can no longer be satisfied — see {@link prepareSetTransferValidator}.
  */
 import { encodeFunctionData, zeroAddress } from 'viem';
 import { oneOfOneImageAbi } from './abi/index.js';
@@ -65,12 +74,93 @@ export async function readCreatorTokenStatus(client, contract) {
     ]);
     return { enrolled, validator };
 }
+/**
+ * A selector no transfer validator implements — the probe question. Same constant the contract's
+ * own `_requireHasCode` uses, so the SDK and the chain agree about which addresses are refused.
+ */
+const NOT_A_VALIDATOR_SELECTOR = '0xa9b1c2d3';
+/**
+ * Ask a candidate transfer validator a question no validator can answer, and require it to FAIL.
+ *
+ * **`code.length > 0` is not enough**, which is why this exists and why the on-chain guard was
+ * rewritten to match. Two shapes enforce nothing while every read surface — ERC-165,
+ * `getTransferValidator()`, the extension beacon — reports enforcement as on: no code at all, and a
+ * *permissive fallback* that succeeds for any selector. `validateTransfer` returns nothing, so
+ * there is no ABI decode to fail; a Safe (its `FallbackManager.fallback()` returns empty when no
+ * handler is set), an uninitialised proxy, and an EIP-7702-delegated EOA all pass a has-code check
+ * and then wave every transfer through. A creator pasting their own Safe is the likely real case.
+ *
+ * So the probe inverts the question: a real validator **reverts** here (verified against OpenSea's
+ * SATSR and three Limit Break deployments on mainnet and Sepolia), and a permissive one returns
+ * empty success. This mirrors the contract exactly — the same selector, the same "must fail" rule —
+ * so an address that passes here is an address the token will accept, and the CLI stops reporting
+ * "no code on this chain" for an address that plainly has code.
+ *
+ * An ERC-165 gate was measured and rejected: none of those four live validators advertises
+ * `ITransferValidator`/`ITransferValidator1155`, so requiring an id would refuse the entire
+ * ecosystem, including the validator ABX itself recommends.
+ *
+ * **A misconfiguration guard, not a security boundary** — a contract can always be written to pass
+ * this and enforce nothing. It catches the honest mistake. Never throws for an on-chain reason:
+ * every failure is a verdict (mirrors `probeSeedSource`).
+ */
+export async function probeTransferValidator(client, validator, 
+/** The enrolling/enrolled token, when known — the probe is made as the token, because that is
+ *  the `msg.sender` the contract's own staticcall presents. */
+opts = {}) {
+    let code;
+    try {
+        code = await client.getCode({ address: validator });
+    }
+    catch (err) {
+        return { verdict: 'unreachable', address: validator, error: firstLine(err) };
+    }
+    if (!code || code === '0x')
+        return { verdict: 'no-code', address: validator };
+    try {
+        await client.call({
+            to: validator,
+            data: NOT_A_VALIDATOR_SELECTOR,
+            ...(opts.as ? { account: opts.as } : {}),
+        });
+    }
+    catch (err) {
+        // A revert is the PASS: this is what a real validator does with an unknown selector. A
+        // transport failure lands here too, so classify it rather than calling a broken RPC "ok".
+        return isTransportFailure(err)
+            ? { verdict: 'unreachable', address: validator, error: firstLine(err) }
+            : { verdict: 'ok', address: validator };
+    }
+    return { verdict: 'permissive-fallback', address: validator };
+}
+/** First line of an error message — a revert reason is readable; viem's full dump is not. */
+function firstLine(err) {
+    return String(err?.message ?? err).split('\n')[0].trim();
+}
+/** Distinguish "the node said this call reverted" (a verdict) from "the node didn't answer" (retry).
+ *  viem reports a revert as an execution error carrying revert data or the word itself; anything
+ *  that never reached execution (timeout, socket, HTTP status, rate limit) must not read as a pass. */
+function isTransportFailure(err) {
+    const name = err?.name ?? '';
+    const msg = String(err?.message ?? err);
+    if (/execution reverted|reverted with|revert reason|InvalidTransferValidator/i.test(msg))
+        return false;
+    return (/Timeout|Socket|Network|HttpRequest|Connection|RateLimit|InternalRpc|LimitExceeded/i.test(name) ||
+        /timed? out|timeout|socket hang up|ECONN|fetch failed|status code|too many requests|rate limit/i.test(msg));
+}
 /**
  * Re-point an enrolled token's transfer validator, or suspend enforcement with
- * `zeroAddress` (the token stays enrolled). Signer must be the owner. Reverts
- * `NotCreatorToken()` on a token that didn't enroll at deploy — enrollment can never be
- * added later — and `InvalidTransferValidator()` on a non-zero validator with no code;
- * callers should read {@link readCreatorTokenStatus} first and refuse those before gas.
+ * `zeroAddress` (the token stays enrolled). Reverts `NotCreatorToken()` on a token that didn't
+ * enroll at deploy — enrollment can never be added later — and `InvalidTransferValidator()` on a
+ * validator the chain's own probe refuses (no code on this chain, **or** a permissive fallback that
+ * would enforce nothing); call {@link probeTransferValidator} first and refuse those before gas.
+ *
+ * **Who may sign:** the owner, while there is one. On a collection whose `owner()` is
+ * `address(0)`, **any** signer may send this with `validator = zeroAddress` to suspend enforcement
+ * permanently — the dead-man release described in this module's header. Arming a validator is still
+ * owner-only, so an ownerless collection can only move toward transferability, never back. A UX for
+ * collectors should offer that suspension when it sees a renounced, enforcing collection; gating it
+ * on `owner()` would hide the one recovery a stranded holder has.
  */
 export function prepareSetTransferValidator(args) {
     const suspending = args.validator === zeroAddress;

package/dist/creator-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"creator-token.js","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAC,kBAAkB,EAAE,WAAW,EAAkC,MAAM,MAAM,CAAC;AACtF,OAAO,EAAC,gBAAgB,EAAC,MAAM,gBAAgB,CAAC;AAGhD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,MAAM,CAAC,MAAM,iCAAiC,GAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA4B;IACrE,oBAAoB;IACpB,QAAQ,EAAE,4CAA4C;IACtD,yBAAyB;IACzB,KAAK,EAAE,4CAA4C;CACpD,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,QAAiB;IAEjB,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,MAAM;aACH,YAAY,CAAC;YACZ,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,0BAA0B,CAAC;SACnC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAqB;QACzC,MAAM;aACH,YAAY,CAAC,EAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAC,CAAC;aAC9F,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAqB;KAChD,CAAC,CAAC;IACH,OAAO,EAAC,QAAQ,EAAE,SAAS,EAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAI3C;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,WAAW,CAAC;IAClD,OAAO;QACL,EAAE,EAAE,wBAAwB;QAC5B,EAAE,EAAE,IAAI,CAAC,QAAQ;QACjB,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,sBAAsB;YACpC,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SACvB,CAAC;QACF,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,qCAAqC,IAAI,CAAC,SAAS,EAAE;QACzD,MAAM,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAC;KAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"creator-token.js","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAC,kBAAkB,EAAE,WAAW,EAA4C,MAAM,MAAM,CAAC;AAChG,OAAO,EAAC,gBAAgB,EAAC,MAAM,gBAAgB,CAAC;AAGhD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,MAAM,CAAC,MAAM,iCAAiC,GAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA4B;IACrE,oBAAoB;IACpB,QAAQ,EAAE,4CAA4C;IACtD,yBAAyB;IACzB,KAAK,EAAE,4CAA4C;CACpD,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,QAAiB;IAEjB,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,MAAM;aACH,YAAY,CAAC;YACZ,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,0BAA0B,CAAC;SACnC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAqB;QACzC,MAAM;aACH,YAAY,CAAC,EAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAC,CAAC;aAC9F,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAqB;KAChD,CAAC,CAAC;IACH,OAAO,EAAC,QAAQ,EAAE,SAAS,EAAC,CAAC;AAC/B,CAAC;AAwBD;;;GAGG;AACH,MAAM,wBAAwB,GAAG,YAAmB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,SAAkB;AAClB;+DAC+D;AAC/D,OAAuB,EAAE;IAEzB,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,wBAAwB;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,0FAA0F;QAC1F,OAAO,kBAAkB,CAAC,GAAG,CAAC;YAC5B,CAAC,CAAC,EAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAC;YACrE,CAAC,CAAC,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAC,CAAC;AAC9D,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;;uGAEuG;AACvG,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,IAAI,GAAI,GAAuB,EAAE,IAAI,IAAI,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;IACnD,IAAI,0EAA0E,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvG,OAAO,CACL,oFAAoF,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/F,gGAAgG,CAAC,IAAI,CAAC,GAAG,CAAC,CAC3G,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAI3C;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,WAAW,CAAC;IAClD,OAAO;QACL,EAAE,EAAE,wBAAwB;QAC5B,EAAE,EAAE,IAAI,CAAC,QAAQ;QACjB,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,sBAAsB;YACpC,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SACvB,CAAC;QACF,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,qCAAqC,IAAI,CAAC,SAAS,EAAE;QACzD,MAAM,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAC;KAC7D,CAAC;AACJ,CAAC"}

package/dist/deploy.d.ts

@@ -86,7 +86,7 @@ export interface SeriesCodeInitParams extends SeriesInitParams {
  *  of {@link SeriesTokenFieldInput} (identical shape; ABX's `OnChainMetadata.TokenFieldInput` has
  *  no standard-specific fields). Reused directly rather than duplicated. */
 export type EditionTokenFieldInput = SeriesTokenFieldInput;
-/** Mirrors `OneOfOneEdition.InitParams` — copies of a single artwork, id space fixed to `{0}`. */
+/** Mirrors `OneOfOneEdition.InitParams` — copies of a single work, id space fixed to `{0}`. */
 export interface OneOfOneEditionInitParams {
     owner: Address;
     /** Recipient of the deploy-time mint (`0x0` or `mintAmount: 0` ⇒ defer all minting). */
@@ -120,7 +120,7 @@ export interface OneOfOneEditionInitParams {
     tokenFields: OnChainFieldInput[];
     contractFields: OnChainFieldInput[];
 }
-/** Mirrors `EditionImage.InitParams` — copies of many distinct artworks (N ids × copies each). */
+/** Mirrors `EditionImage.InitParams` — copies of many distinct works (N ids × copies each). */
 export interface EditionImageInitParams {
     owner: Address;
     name: string;
@@ -132,7 +132,7 @@ export interface EditionImageInitParams {
     royaltyReceiver: Address;
     royaltyBps: number;
     transferValidator: Address;
-    /** The id-space cap N (> 0): the number of distinct artworks this project may ever have.
+    /** The id-space cap N (> 0): the number of distinct works this project may ever have.
      *  Monotonically non-increasing (floor = the id high-water mark, NOT `totalSupply()` — ids are
      *  caller-named, not sequential). */
     maxInvocations: bigint | number;
@@ -143,7 +143,7 @@ export interface EditionImageInitParams {
     paused: boolean;
     /** Recipient for the deploy-time mint (`0x0` ⇒ defer all minting). */
     mintTo: Address;
-    /** Distinct artworks to mint at deploy, ids `[0, mintCount)`; `<= maxInvocations`. */
+    /** Distinct works to mint at deploy, ids `[0, mintCount)`; `<= maxInvocations`. */
     mintCount: bigint | number;
     /** Copies of EACH deploy-minted id (must be `> 0` if `mintCount > 0`). */
     mintAmount: bigint | number;
@@ -189,6 +189,7 @@ export declare function saltGuard(salt: Hex): Address;
 export declare function deployFactory(send: SendTx, publicClient: PublicClient): Promise<DeployResult<'factory'> & {
     factory: Address;
     implementation: Address;
+    metadataLib: Address;
 }>;
 /**
  * Deploy the canonical Series clone factory — the trust anchor for multi-token drops.
@@ -198,20 +199,27 @@ export declare function deployFactory(send: SendTx, publicClient: PublicClient):
 export declare function deploySeriesFactory(send: SendTx, publicClient: PublicClient): Promise<DeployResult<'seriesFactory'> & {
     factory: Address;
     implementation: Address;
+    metadataLib: Address;
 }>;
 /**
- * Deploy the code-project trust root on a chain with no canonical set: the two
- * delegatecalled write-path libraries first ({AbxParamsLib}, {AbxCodeLib}), the factory
- * bytecode LINKED against them (solc placeholders replaced — what forge does at build
- * time, done here so a sandbox/fresh chain needs no forge), then the factory (whose
- * constructor deploys the {SeriesCode} implementation). Each of the three deploys is a
- * plain contract creation (no canonical/CREATE2 address — the libraries' addresses are
- * nonce-dependent, so there is nothing to predict), sent through `send` in order since the
- * factory's bytecode can only be linked once the two library addresses are known.
+ * Deploy the code-project trust root on a chain with no canonical set: the two delegatecalled
+ * write-path libraries first ({AbxParamsLib}, {AbxCodeLib}), the factory bytecode LINKED against
+ * them (solc placeholders replaced — what forge does at build time, done here so a sandbox/fresh
+ * chain needs no forge), then the factory (whose constructor deploys the {SeriesCode}
+ * implementation).
+ *
+ * All three go through the keyless CREATE2 proxy at canonical `AbxSalts` salts, so all three land at
+ * addresses that are the same on every chain and computable before the first transaction — the
+ * factory's included: linking substitutes an address into already-compiled bytecode, so once the
+ * libraries are predictable the linked initcode is fixed too (`predictSeriesCodeFactory()`). The
+ * ordering below is still sequential, but now for a plain data-dependency reason rather than a
+ * nonce one. See `create2.ts`'s write-path-library note for why the old "libraries are
+ * nonce-dependent" story was wrong, and for the compile-time-linking trap that IS real.
  */
 export declare function deploySeriesCodeFactory(send: SendTx, publicClient: PublicClient): Promise<{
     factory: Address;
     implementation: Address;
+    metadataLib: Address;
     paramsLib: Address;
     codeLib: Address;
     txHash: Hex;
@@ -286,18 +294,30 @@ export declare function deploySeries(send: SendTx, publicClient: PublicClient, a
  * keyless CREATE2 proxy with the canonical `AbxSalts.ONE_OF_ONE_EDITION_FACTORY` salt — matching
  * how `contracts/script/DeployOneOfOneEdition.s.sol` actually deploys it — so its address is the
  * SAME on every chain and predictable before the deploy tx (`predictOneOfOneEditionFactory()`).
+ *
+ * Library-linked, like the two code factories: `OneOfOneEdition` delegates its uri /
+ * creator-token / edition-supply bodies into `AbxEditionLib`, so this deploys `AbxParamsLib` +
+ * `AbxEditionLib` first ({@link ensureEditionLibraries}) and sends the factory's initcode LINKED
+ * against the settled library address. Linking costs nothing in determinism — see `create2.ts`'s
+ * write-path-library note.
  */
 export declare function deployOneOfOneEditionFactory(send: SendTx, publicClient: PublicClient): Promise<DeployResult<'factory'> & {
     factory: Address;
     implementation: Address;
+    metadataLib: Address;
+    paramsLib: Address;
+    editionLib: Address;
 }>;
-/** Deploy the canonical `EditionImageFactory` — the multi-artwork edition trust anchor. CREATE2
+/** Deploy the canonical `EditionImageFactory` — the multi-work edition trust anchor. CREATE2
  *  via the keyless proxy + the canonical `AbxSalts.EDITION_FACTORY` salt (see {@link
  *  deployOneOfOneEditionFactory}'s doc note on why this differs from the 721 series factory's
- *  plain-creation bootstrap). */
+ *  plain-creation bootstrap, and why `AbxEditionLib` has to land first). */
 export declare function deployEditionFactory(send: SendTx, publicClient: PublicClient): Promise<DeployResult<'factory'> & {
     factory: Address;
     implementation: Address;
+    metadataLib: Address;
+    paramsLib: Address;
+    editionLib: Address;
 }>;
 /** Deploy `AbxFixedPriceMinter1155` — the canonical, ownerless, multi-tenant edition sale
  *  singleton (the Minter spine's edition lane). Sibling of `deployFixedPriceMinter`, one id
@@ -319,7 +339,7 @@ export declare function deployOneOfOneEdition(send: SendTx, publicClient: Public
     clone: Address;
 }>;
 /**
- * Deploy an EditionImage (multi-artwork edition) NFT as an immutable EIP-1167 clone, at a
+ * Deploy an EditionImage (multi-work edition) NFT as an immutable EIP-1167 clone, at a
  * deterministic address. The edition twin of `deploySeries`.
  */
 export declare function deployEditionImage(send: SendTx, publicClient: PublicClient, args: {
@@ -332,18 +352,24 @@ export declare function deployEditionImage(send: SendTx, publicClient: PublicCli
 /**
  * Deploy the code-project edition trust root on a chain with no canonical set: the THREE
  * delegatecalled write-path libraries first ({AbxParamsLib}, {AbxCodeLib}, {AbxEditionLib} — the
- * edition twin of `deploySeriesCodeFactory`'s two-lib dance, extended by the one library
- * `EditionCode` alone needs — see `AbxEditionLib`'s class-level dev note), the factory bytecode
- * LINKED against all three (solc placeholders replaced — what forge does at build time, done here
- * so a sandbox/fresh chain needs no forge), then the factory (whose constructor deploys the
- * {EditionCode} implementation). Each deploy is a plain contract creation (no canonical/CREATE2
- * address — the libraries' addresses are nonce-dependent, so there is nothing to predict; see
- * `create2.ts`'s class-level dev note on the ERC-1155-editions section), sent through `send` in
- * order since the factory's bytecode can only be linked once all three library addresses are known.
+ * edition twin of `deploySeriesCodeFactory`'s two-lib dance, plus the 1155 write path {@link
+ * deployOneOfOneEditionFactory} and {@link deployEditionFactory} link too), the factory bytecode
+ * LINKED against all three, then the factory (whose constructor deploys the {EditionCode}
+ * implementation). CREATE2 at canonical `AbxSalts` salts throughout, exactly like
+ * {@link deploySeriesCodeFactory}, so the whole set is cross-chain-identical and predictable
+ * (`predictEditionCodeFactory()`). This is the only factory linking all three libraries; it is NOT
+ * the only one linking {AbxEditionLib} — all three 1155 token types delegate into it.
+ *
+ * One wrinkle the 721 twin doesn't have: {AbxEditionLib} delegatecalls {AbxParamsLib}, so its OWN
+ * shipped bytecode carries an unlinked placeholder and has to be linked before it can be deployed
+ * ({@link ensureEditionLib} does this via `linkEditionLib()`). Deploying it raw is what made this
+ * function fail with an opaque `Invalid byte sequence` — `__$…$__` is not hex, and the old
+ * unlinked-placeholder guard only checked the factory's bytecode, never the library's.
  */
 export declare function deployEditionCodeFactory(send: SendTx, publicClient: PublicClient): Promise<{
     factory: Address;
     implementation: Address;
+    metadataLib: Address;
     paramsLib: Address;
     codeLib: Address;
     editionLib: Address;