@artblocks/abx-sdk 0.1.0-alpha.8 → 0.1.0

package/dist/create2.js

@@ -1,5 +1,5 @@
 import { concat, getContractAddress, keccak256, toBytes } from 'viem';
-import { abxChunkStoreBytecode, abxFixedPriceMinterBytecode, abxMetadataRendererBytecode, abxSeedSourceBytecode, } from './abi/index.js';
+import { abxChunkStoreBytecode, abxCodeLibBytecode, abxEditionLibBytecode, abxMetadataLibBytecode, abxFixedPriceMinterBytecode, abxFixedPriceMinter1155Bytecode, abxMetadataRendererBytecode, abxParamsLibBytecode, abxSeedSourceBytecode, editionCodeFactoryBytecode, editionImageFactoryBytecode, oneOfOneEditionFactoryBytecode, oneOfOneImageFactoryBytecode, seriesCodeFactoryBytecode, seriesImageFactoryBytecode, } from './abi/index.js';
 /**
  * Keyless CREATE2 deployment — the TS twin of `contracts/script/AbxSalts.sol`.
  *
@@ -12,7 +12,9 @@ import { abxChunkStoreBytecode, abxFixedPriceMinterBytecode, abxMetadataRenderer
 /** The keyless CREATE2 proxy (Arachnid deterministic-deployment-proxy). Same address on every chain. */
 export const CREATE2_PROXY = '0x4e59b44847b379578588920cA78FbF26c0B4956C';
 /** Canonical salt strings — MUST stay byte-identical to `contracts/script/AbxSalts.sol`, since the
- *  deterministic address is `keccak256(0xff ++ proxy ++ keccak256(salt) ++ keccak256(initcode))`. */
+ *  deterministic address is `keccak256(0xff ++ proxy ++ keccak256(salt) ++ keccak256(initcode))`.
+ *  `test/create2-salts.test.ts` diffs this table against that file, both ways, so drift can't be
+ *  quiet: the two halves have to be one fact. */
 export const ABX_SALT = {
     oneOfOneFactory: 'abx.factory.one-of-one.v1',
     seriesFactory: 'abx.factory.series.v1',
@@ -22,17 +24,42 @@ export const ABX_SALT = {
     fixedPriceMinter: 'abx.minter.fixed-price.v1',
     seedSource: 'abx.seed-source.v1',
     generator: 'abx.generator.v1',
+    // ERC-1155 editions (twins of the above; naming follows the parity plan verbatim).
+    oneOfOneEditionFactory: 'abx.one-of-one-edition-factory.v1',
+    editionFactory: 'abx.edition-factory.v1',
+    editionCodeFactory: 'abx.edition-code-factory.v1',
+    fixedPriceMinter1155: 'abx.fixed-price-minter-1155.v1',
+    // Delegatecalled write-path libraries — CREATE2 like everything else here (see the
+    // "delegatecalled write-path libraries" note below, and `DeployLibraries.s.sol`).
+    paramsLib: 'abx.lib.params.v1',
+    codeLib: 'abx.lib.code.v1',
+    editionLib: 'abx.lib.edition.v1',
+    metadataLib: 'abx.lib.metadata.v1',
 };
 /** The 32-byte salt a CREATE2 deploy uses (`keccak256` of the canonical string). */
 export const saltHash = (salt) => keccak256(toBytes(salt));
+function exactCreate2Salt(salt) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(salt)) {
+        throw new Error('CREATE2 salt must be exactly 32 bytes (0x + 64 hex characters).');
+    }
+    return salt.toLowerCase();
+}
+/** The deterministic address for an already-hashed/raw 32-byte CREATE2 salt. */
+export function predictCreate2AddressFromSalt(salt, bytecode) {
+    return getContractAddress({ opcode: 'CREATE2', from: CREATE2_PROXY, salt: exactCreate2Salt(salt), bytecode });
+}
+/** Proxy calldata for an already-hashed/raw 32-byte CREATE2 salt. */
+export function create2CalldataFromSalt(salt, bytecode) {
+    return concat([exactCreate2Salt(salt), bytecode]);
+}
 /** The deterministic address `bytecode` deploys to under `salt` via the keyless proxy — identical
  *  on every chain. Pure: no chain access. */
 export function predictCreate2Address(salt, bytecode) {
-    return getContractAddress({ opcode: 'CREATE2', from: CREATE2_PROXY, salt: saltHash(salt), bytecode });
+    return predictCreate2AddressFromSalt(saltHash(salt), bytecode);
 }
 /** The calldata a CREATE2-proxy deploy sends: 32-byte salt ++ initcode (the proxy CREATE2-deploys it). */
 export function create2Calldata(salt, bytecode) {
-    return concat([saltHash(salt), bytecode]);
+    return create2CalldataFromSalt(saltHash(salt), bytecode);
 }
 /** The canonical (cross-chain-identical) AbxChunkStore address for the current bytecode. */
 export const predictChunkStore = () => predictCreate2Address(ABX_SALT.chunkStore, abxChunkStoreBytecode);
@@ -44,4 +71,147 @@ export const predictFixedPriceMinter = () => predictCreate2Address(ABX_SALT.fixe
  *  (`DeploySeedSource.s.sol`) so it compiles at the default profile — bundling it with the
  *  SeriesCode factory's `clone-impl` unit yields a different, non-canonical bytecode + address. */
 export const predictSeedSource = () => predictCreate2Address(ABX_SALT.seedSource, abxSeedSourceBytecode);
+// ── ERC-1155 editions ──────────────────────────────────────────────────────────
+//
+// `DeployOneOfOneEdition.s.sol` / `DeployEdition.s.sol` / `DeployMinter1155.s.sol` each deploy
+// their contract with a fixed `AbxSalts` salt and NO constructor args, so the salt + this build's
+// bytecode fix the address before any deploy. `AbxFixedPriceMinter1155` is a plain singleton and is
+// predicted right below; the two edition IMAGE factories are not — `OneOfOneEdition`/`EditionImage`
+// both delegate bodies into `AbxEditionLib`, so their factories carry a link placeholder and their
+// predictions live with the library-linked factories in the write-path-library section below
+// (`predictOneOfOneEditionFactory`/`predictEditionFactory`), next to the two code factories.
+/** The canonical (cross-chain-identical) `OneOfOneImageFactory` address for the current bytecode —
+ *  the 721 1/1 trust anchor. */
+export const predictFactory = () => predictCreate2Address(ABX_SALT.oneOfOneFactory, linkFactory());
+/** The canonical (cross-chain-identical) `SeriesImageFactory` address for the current bytecode —
+ *  the 721 multi-token trust anchor. */
+export const predictSeriesFactory = () => predictCreate2Address(ABX_SALT.seriesFactory, linkSeriesFactory());
+/** The canonical (cross-chain-identical) `AbxFixedPriceMinter1155` address for the current
+ *  bytecode — the shared, ownerless edition sale singleton. */
+export const predictFixedPriceMinter1155 = () => predictCreate2Address(ABX_SALT.fixedPriceMinter1155, abxFixedPriceMinter1155Bytecode);
+// ── delegatecalled write-path libraries ────────────────────────────────────────
+//
+// A `public` library function is compiled as a `delegatecall` to a SEPARATELY deployed copy of the
+// library, and solc leaves a `__$<id>$__` placeholder in the caller's bytecode where that copy's
+// address goes. Linking is the substitution of an address into that placeholder.
+//
+// **Linking does not cost determinism.** These libraries are deployed through the same keyless
+// CREATE2 proxy at the canonical salts above (`DeployLibraries.s.sol` is the forge twin), so a
+// library's address is `f(proxy, salt, creation bytecode)` and nothing else — the deployer's nonce
+// is not an input to a CREATE2 address (it is an input to plain `CREATE`, which is where the
+// confusion came from). Predict the libraries, substitute them, and the linked factory's initcode
+// is fixed too — hence the FOUR `predict*Factory` helpers at the bottom of this section.
+//
+// Worth stating plainly, because the opposite belief was load-bearing: two ERC-1155 token types
+// (`OneOfOneEdition`/`EditionImage`) were held library-free and an EIP-170 size floor was relaxed to
+// avoid "losing" a factory's deterministic address. What was actually true was narrower and
+// self-inflicted — the SDK deployed its libraries with a plain EOA `CREATE` (`to: null`) by its own
+// choice, so *it* could not predict them, and that local limitation was written up as a property of
+// libraries in general. It isn't one. The broadcast artifacts always said so: every recorded library
+// deploy went through the keyless proxy, and `AbxParamsLib` landed at ONE address on Sepolia and
+// Base Sepolia from deployer nonces 215 apart. Both of those token types now delegate into
+// `AbxEditionLib` exactly as `EditionCode` does, so FOUR factories here are library-linked, not two.
+//
+// **Losing track of that is a bug class, not a footnote.** Three separate times a contract became
+// library-linked and this file went on hashing its UNLINKED bytecode, and the failure is silent:
+// viem does not reject a `__$…$__` placeholder, it UTF-8-encodes it — so the prediction is a
+// real-looking address that is the hash of ASCII garbage, for the addresses platforms allowlist, and
+// the same bytes would go out as initcode. `link.test.ts`'s "nothing deployable carries a
+// placeholder" guard derives its subject set from the exported bytecodes rather than a list of
+// names, precisely so the next contract to become library-linked cannot escape the same way.
+//
+// **The real trap is compile-time linking, not linking.** Substituting into the placeholder happens
+// AFTER compilation, so it cannot change the library's own creation bytecode. Handing solc the
+// addresses at build time instead (`forge build/script --libraries src/…:Lib:0x…`) writes the
+// library map into `settings.libraries` in every artifact's metadata, and the metadata hash is
+// appended to the creation bytecode — so the library's own address moves, and so does the linked
+// factory's. Optimizer settings do the same (the code tokens compile at `optimizer_runs = 200`,
+// everything else at 1,000,000). One canonical bytecode per library, therefore: the one
+// `sync-abis` reads from a plain `forge build`, which is what these predictions use.
+/** Fully-qualified library names (solc's link keys — path-sensitive, so they must match how the
+ *  contracts are compiled: `src/libraries/…` as `foundry.toml` sees them). */
+export const LIB_FQN = {
+    paramsLib: 'src/libraries/AbxParamsLib.sol:AbxParamsLib',
+    codeLib: 'src/libraries/AbxCodeLib.sol:AbxCodeLib',
+    editionLib: 'src/libraries/AbxEditionLib.sol:AbxEditionLib',
+    metadataLib: 'src/libraries/AbxMetadataLib.sol:AbxMetadataLib',
+};
+/** The solc link placeholder for a fully-qualified library name: `__$<keccak(fqn)[0:34]>$__`. */
+export const libPlaceholder = (fullyQualified) => `__$${keccak256(toBytes(fullyQualified)).slice(2, 36)}$__`;
+/**
+ * Link `bytecode` against deployed libraries — the post-compile placeholder substitution `forge`
+ * does at build time, done here so a sandbox / fresh chain needs no forge. Throws if any
+ * placeholder is left over, since an unlinked `__$…$__` is not valid hex and the RPC would reject
+ * the transaction with an opaque `Invalid byte sequence`.
+ */
+export function linkLibraries(bytecode, links) {
+    let out = bytecode;
+    for (const [fqn, address] of links)
+        out = out.split(libPlaceholder(fqn)).join(address.slice(2).toLowerCase());
+    if (out.includes('__$'))
+        throw new Error(`unlinked library placeholder remains: ${/__\$[0-9a-f]{34}\$__/.exec(out)?.[0]}`);
+    return out;
+}
+/** The canonical (cross-chain-identical) `AbxParamsLib` address — the params write path both code
+ *  token types delegatecall. */
+export const predictParamsLib = () => predictCreate2Address(ABX_SALT.paramsLib, abxParamsLibBytecode);
+/** The canonical (cross-chain-identical) `AbxCodeLib` address — the script/code write path. */
+export const predictCodeLib = () => predictCreate2Address(ABX_SALT.codeLib, abxCodeLibBytecode);
+/** The canonical (cross-chain-identical) `AbxEditionLib` address — the 1155 uri / creator-token /
+ *  edition-supply write path that **all three** edition token types (`OneOfOneEdition`,
+ *  `EditionImage`, `EditionCode`) delegatecall.
+ *  `AbxEditionLib` itself delegatecalls `AbxParamsLib`, so it is linked before it is deployed: the
+ *  one library here whose own initcode depends on another library's address. */
+export const predictEditionLib = () => predictCreate2Address(ABX_SALT.editionLib, linkEditionLib());
+/** The canonical `AbxMetadataLib` address. Linked by ALL SIX token types to preserve EIP-170
+ *  headroom; externalizing the metadata field store makes even the plainest 721 factory
+ *  library-linked. It links nothing itself, so it is deployed first. */
+export const predictMetadataLib = () => predictCreate2Address(ABX_SALT.metadataLib, abxMetadataLibBytecode);
+/** `AbxEditionLib`'s canonical initcode: its shipped bytecode linked against `AbxParamsLib`. */
+export const linkEditionLib = () => linkLibraries(abxEditionLibBytecode, [[LIB_FQN.paramsLib, predictParamsLib()]]);
+/** `OneOfOneEditionFactory`'s canonical initcode: linked against `AbxEditionLib` (the only library
+ *  its embedded `OneOfOneEdition` implementation delegates into). `AbxEditionLib`'s own address
+ *  already accounts for its `AbxParamsLib` link — see {@link predictEditionLib}. */
+export const linkOneOfOneEditionFactory = () => linkLibraries(oneOfOneEditionFactoryBytecode, [
+    [LIB_FQN.editionLib, predictEditionLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** `EditionImageFactory`'s canonical initcode: linked against `AbxEditionLib`, the sibling of
+ *  {@link linkOneOfOneEditionFactory}. */
+export const linkEditionFactory = () => linkLibraries(editionImageFactoryBytecode, [
+    [LIB_FQN.editionLib, predictEditionLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** `SeriesCodeFactory`'s canonical initcode: linked against the two write-path libraries. */
+export const linkSeriesCodeFactory = () => linkLibraries(seriesCodeFactoryBytecode, [
+    [LIB_FQN.paramsLib, predictParamsLib()],
+    [LIB_FQN.codeLib, predictCodeLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** `EditionCodeFactory`'s canonical initcode: linked against all three write-path libraries. */
+export const linkEditionCodeFactory = () => linkLibraries(editionCodeFactoryBytecode, [
+    [LIB_FQN.paramsLib, predictParamsLib()],
+    [LIB_FQN.codeLib, predictCodeLib()],
+    [LIB_FQN.editionLib, predictEditionLib()],
+    [LIB_FQN.metadataLib, predictMetadataLib()],
+]);
+/** The two ERC-721 image factories' canonical initcode. They linked NOTHING until the metadata
+ *  field store was externalized; now every token type is library-linked. */
+export const linkFactory = () => linkLibraries(oneOfOneImageFactoryBytecode, [[LIB_FQN.metadataLib, predictMetadataLib()]]);
+export const linkSeriesFactory = () => linkLibraries(seriesImageFactoryBytecode, [[LIB_FQN.metadataLib, predictMetadataLib()]]);
+/** The canonical (cross-chain-identical) `SeriesCodeFactory` address — the code-project trust
+ *  anchor. Predictable because its libraries are (see the section note above). */
+export const predictSeriesCodeFactory = () => predictCreate2Address(ABX_SALT.seriesCodeFactory, linkSeriesCodeFactory());
+/** The canonical (cross-chain-identical) `EditionCodeFactory` address — the code-project EDITION
+ *  trust anchor. */
+export const predictEditionCodeFactory = () => predictCreate2Address(ABX_SALT.editionCodeFactory, linkEditionCodeFactory());
+/** The canonical (cross-chain-identical) `OneOfOneEditionFactory` address — the 1/1-edition trust
+ *  anchor. Predicted from LINKED initcode: `OneOfOneEdition` delegates its uri / creator-token /
+ *  edition-supply bodies into `AbxEditionLib`, so the shipped factory bytecode carries a link
+ *  placeholder (hashing it unlinked yields a plausible-looking address for a trust anchor that
+ *  nothing can ever be deployed to — see the section note). */
+export const predictOneOfOneEditionFactory = () => predictCreate2Address(ABX_SALT.oneOfOneEditionFactory, linkOneOfOneEditionFactory());
+/** The canonical (cross-chain-identical) `EditionImageFactory` address — the multi-work edition
+ *  trust anchor, the sibling of {@link predictOneOfOneEditionFactory} (same single library link). */
+export const predictEditionFactory = () => predictCreate2Address(ABX_SALT.editionFactory, linkEditionFactory());
 //# sourceMappingURL=create2.js.map

package/dist/create2.js.map

@@ -1 +1 @@
-{"version":3,"file":"create2.js","sourceRoot":"","sources":["../src/create2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,EAAyB,MAAM,MAAM,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;GAQG;AAEH,wGAAwG;AACxG,MAAM,CAAC,MAAM,aAAa,GAAY,4CAA4C,CAAC;AAEnF;qGACqG;AACrG,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,eAAe,EAAE,2BAA2B;IAC5C,aAAa,EAAE,uBAAuB;IACtC,iBAAiB,EAAE,4BAA4B;IAC/C,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,oBAAoB;IAChC,gBAAgB,EAAE,2BAA2B;IAC7C,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,kBAAkB;CACrB,CAAC;AAEX,oFAAoF;AACpF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAExE;6CAC6C;AAC7C,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAa;IAC/D,OAAO,kBAAkB,CAAC,EAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAC,CAAC,CAAC;AACtG,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAa;IACzD,OAAO,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAElH,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;AAEpH,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,EAAE,CACnD,qBAAqB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;AAEhF;;mGAEmG;AACnG,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"create2.js","sourceRoot":"","sources":["../src/create2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,EAAyB,MAAM,MAAM,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,+BAA+B,EAC/B,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,EAC9B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;GAQG;AAEH,wGAAwG;AACxG,MAAM,CAAC,MAAM,aAAa,GAAY,4CAA4C,CAAC;AAEnF;;;iDAGiD;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,eAAe,EAAE,2BAA2B;IAC5C,aAAa,EAAE,uBAAuB;IACtC,iBAAiB,EAAE,4BAA4B;IAC/C,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,oBAAoB;IAChC,gBAAgB,EAAE,2BAA2B;IAC7C,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,kBAAkB;IAC7B,mFAAmF;IACnF,sBAAsB,EAAE,mCAAmC;IAC3D,cAAc,EAAE,wBAAwB;IACxC,kBAAkB,EAAE,6BAA6B;IACjD,oBAAoB,EAAE,gCAAgC;IACtD,mFAAmF;IACnF,kFAAkF;IAClF,SAAS,EAAE,mBAAmB;IAC9B,OAAO,EAAE,iBAAiB;IAC1B,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,qBAAqB;CAC1B,CAAC;AAEX,oFAAoF;AACpF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAExE,SAAS,gBAAgB,CAAC,IAAS;IACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAS,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,6BAA6B,CAAC,IAAS,EAAE,QAAa;IACpE,OAAO,kBAAkB,CAAC,EAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAC,CAAC,CAAC;AAC9G,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,IAAS,EAAE,QAAa;IAC9D,OAAO,MAAM,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;6CAC6C;AAC7C,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAa;IAC/D,OAAO,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAa;IACzD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAElH,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;AAEpH,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,EAAE,CACnD,qBAAqB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;AAEhF;;mGAEmG;AACnG,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAElH,kFAAkF;AAClF,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,6FAA6F;AAC7F,6FAA6F;AAE7F;gCACgC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAY,EAAE,CAC1C,qBAAqB,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;AAEjE;wCACwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAY,EAAE,CAChD,qBAAqB,CAAC,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAErE;+DAC+D;AAC/D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAY,EAAE,CACvD,qBAAqB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;AAExF,kFAAkF;AAClF,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,iFAAiF;AACjF,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,mGAAmG;AACnG,6FAA6F;AAC7F,kGAAkG;AAClG,yFAAyF;AACzF,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,4FAA4F;AAC5F,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,iGAAiG;AACjG,2FAA2F;AAC3F,qGAAqG;AACrG,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,qGAAqG;AACrG,0FAA0F;AAC1F,+FAA+F;AAC/F,6FAA6F;AAC7F,EAAE;AACF,oGAAoG;AACpG,+FAA+F;AAC/F,8FAA8F;AAC9F,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,wFAAwF;AACxF,qFAAqF;AAErF;8EAC8E;AAC9E,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,SAAS,EAAE,6CAA6C;IACxD,OAAO,EAAE,yCAAyC;IAClD,UAAU,EAAE,+CAA+C;IAC3D,WAAW,EAAE,iDAAiD;CACtD,CAAC;AAEX,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,cAAsB,EAAU,EAAE,CAC/D,MAAM,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAa,EAAE,KAA8D;IACzG,IAAI,GAAG,GAAW,QAAQ,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9G,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3H,OAAO,GAAU,CAAC;AACpB,CAAC;AAED;gCACgC;AAChC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAE/G,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAY,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAEzG;;;;gFAIgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAC7C,qBAAqB,CAAC,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;AAE/D;;wEAEwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,qBAAqB,CAAC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAEtE,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAQ,EAAE,CACtC,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;AAElF;;oFAEoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAQ,EAAE,CAClD,aAAa,CAAC,8BAA8B,EAAE;IAC5C,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL;0CAC0C;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAQ,EAAE,CAC1C,aAAa,CAAC,2BAA2B,EAAE;IACzC,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAQ,EAAE,CAC7C,aAAa,CAAC,yBAAyB,EAAE;IACvC,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvC,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAQ,EAAE,CAC9C,aAAa,CAAC,0BAA0B,EAAE;IACxC,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvC,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEL;4EAC4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,GAAQ,EAAE,CACnC,aAAa,CAAC,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAQ,EAAE,CACzC,aAAa,CAAC,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAE3F;kFACkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAY,EAAE,CACpD,qBAAqB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAE7E;oBACoB;AACpB,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAY,EAAE,CACrD,qBAAqB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAE/E;;;;+DAI+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAY,EAAE,CACzD,qBAAqB,CAAC,QAAQ,CAAC,sBAAsB,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAEvF;qGACqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAY,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC"}

package/dist/creator-token.d.ts

@@ -8,6 +8,15 @@
  * zero — never un-enrolls. Every transfer that isn't a mint/burn (or the validator's own)
  * staticcalls `validateTransfer(caller, from, to, tokenId)` on the validator; a policy
  * violation reverts and bubbles.
+ *
+ * **`setTransferValidator` is owner-only only while the collection has an owner.** Once
+ * `owner() == address(0)` the contract opens one asymmetric door: **anyone** may suspend
+ * enforcement by passing `zeroAddress`, and nobody — including that caller — may ever arm a
+ * validator again. That is the dead-man release for the worst reachable state (a validator that
+ * reverts every transfer on a collection with nobody left to re-point it, which would otherwise
+ * strand every collector's token forever). An integrator building for collectors should expose
+ * that suspension path on a renounced collection rather than gating it behind an owner check that
+ * can no longer be satisfied — see {@link prepareSetTransferValidator}.
  */
 import { type Address, type PublicClient } from 'viem';
 import type { PreparedTx } from './ops.js';
@@ -20,10 +29,10 @@ export declare const CREATOR_TOKEN_EXTENSION_ID: "0x0839e7ed7fc1f5db3f253851d61b
 /**
  * The recommended transfer validator per chain — OpenSea's
  * **StrictAuthorizedTransferSecurityRegistry**, the validator their creator-fee-enforcement
- * doc recommends for enforcement eligibility (docs.opensea.io "Creator Fee Enforcement",
- * checked 2026-08; the named alternative is Limit Break's CreatorTokenTransferValidator
- * 0x721C0078c2328597Ca70F5451ffF5A7B38D4E947). Verified empirically against the LIVE
- * contracts on 2026-08-04 (`cast call --from <collection>` on the 4-arg
+ * doc recommends for enforcement eligibility (docs.opensea.io "Creator Fee Enforcement"; the named
+ * alternative is Limit Break's CreatorTokenTransferValidator
+ * 0x721C0078c2328597Ca70F5451ffF5A7B38D4E947). Verified empirically against the live contracts with
+ * `cast call --from <collection>` on the 4-arg
  * `validateTransfer(address,address,address,uint256)` overload, both chains):
  * an owner-initiated (OTC) transfer succeeds; an unauthorized operator reverts
  * `StrictAuthorizedTransferSecurityRegistry__UnauthorizedTransfer()`.
@@ -50,12 +59,70 @@ export interface CreatorTokenStatus {
  * must read as `{enrolled: false, validator: zeroAddress}`, not as an error.
  */
 export declare function readCreatorTokenStatus(client: PublicClient, contract: Address): Promise<CreatorTokenStatus>;
+/** What {@link probeTransferValidator} found. Only `ok` may be written to a live collection.
+ *
+ *  - `ok`                  — the address has code and refuses a selector no validator implements,
+ *                            which is what every live validator does (see the probe's doc).
+ *  - `no-code`             — nothing deployed at this address on this chain. Enforcement would read
+ *                            as ON everywhere and check nothing.
+ *  - `permissive-fallback` — it has code, but it answers an unknown selector *successfully*. A
+ *                            Safe, an uninitialised proxy, or a 7702-delegated EOA does this, and
+ *                            because `validateTransfer` returns nothing there is no ABI decode to
+ *                            fail — so every transfer would silently pass validation.
+ *  - `unreachable`         — the RPC didn't answer. Says nothing about the address; retry.
+ */
+export type TransferValidatorVerdict = 'ok' | 'no-code' | 'permissive-fallback' | 'unreachable';
+/** The result of {@link probeTransferValidator} — verdict plus what was observed, for a message. */
+export interface TransferValidatorProbe {
+    verdict: TransferValidatorVerdict;
+    address: Address;
+    /** First line of the revert/transport error, when there was one. */
+    error?: string;
+}
+/**
+ * Ask a candidate transfer validator a question no validator can answer, and require it to FAIL.
+ *
+ * **`code.length > 0` is not enough**, which is why this exists and why the on-chain guard was
+ * rewritten to match. Two shapes enforce nothing while every read surface — ERC-165,
+ * `getTransferValidator()`, the extension beacon — reports enforcement as on: no code at all, and a
+ * *permissive fallback* that succeeds for any selector. `validateTransfer` returns nothing, so
+ * there is no ABI decode to fail; a Safe (its `FallbackManager.fallback()` returns empty when no
+ * handler is set), an uninitialised proxy, and an EIP-7702-delegated EOA all pass a has-code check
+ * and then wave every transfer through. A creator pasting their own Safe is the likely real case.
+ *
+ * So the probe inverts the question: a real validator **reverts** here (verified against OpenSea's
+ * SATSR and three Limit Break deployments on mainnet and Sepolia), and a permissive one returns
+ * empty success. This mirrors the contract exactly — the same selector, the same "must fail" rule —
+ * so an address that passes here is an address the token will accept, and the CLI stops reporting
+ * "no code on this chain" for an address that plainly has code.
+ *
+ * An ERC-165 gate was measured and rejected: none of those four live validators advertises
+ * `ITransferValidator`/`ITransferValidator1155`, so requiring an id would refuse the entire
+ * ecosystem, including the validator ABX itself recommends.
+ *
+ * **A misconfiguration guard, not a security boundary** — a contract can always be written to pass
+ * this and enforce nothing. It catches the honest mistake. Never throws for an on-chain reason:
+ * every failure is a verdict (mirrors `probeSeedSource`).
+ */
+export declare function probeTransferValidator(client: PublicClient, validator: Address, 
+/** The enrolling/enrolled token, when known — the probe is made as the token, because that is
+ *  the `msg.sender` the contract's own staticcall presents. */
+opts?: {
+    as?: Address;
+}): Promise<TransferValidatorProbe>;
 /**
  * Re-point an enrolled token's transfer validator, or suspend enforcement with
- * `zeroAddress` (the token stays enrolled). Signer must be the owner. Reverts
- * `NotCreatorToken()` on a token that didn't enroll at deploy — enrollment can never be
- * added later — and `InvalidTransferValidator()` on a non-zero validator with no code;
- * callers should read {@link readCreatorTokenStatus} first and refuse those before gas.
+ * `zeroAddress` (the token stays enrolled). Reverts `NotCreatorToken()` on a token that didn't
+ * enroll at deploy — enrollment can never be added later — and `InvalidTransferValidator()` on a
+ * validator the chain's own probe refuses (no code on this chain, **or** a permissive fallback that
+ * would enforce nothing); call {@link probeTransferValidator} first and refuse those before gas.
+ *
+ * **Who may sign:** the owner, while there is one. On a collection whose `owner()` is
+ * `address(0)`, **any** signer may send this with `validator = zeroAddress` to suspend enforcement
+ * permanently — the dead-man release described in this module's header. Arming a validator is still
+ * owner-only, so an ownerless collection can only move toward transferability, never back. A UX for
+ * collectors should offer that suspension when it sees a renounced, enforcing collection; gating it
+ * on `owner()` would hide the one recovery a stranded holder has.
  */
 export declare function prepareSetTransferValidator(args: {
     contract: Address;

package/dist/creator-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"creator-token.d.ts","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAkC,KAAK,OAAO,EAAE,KAAK,YAAY,EAAC,MAAM,MAAM,CAAC;AAEtF,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,UAAU,CAAC;AAEzC,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,EAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,eAAO,MAAM,iCAAiC,EAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,EACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAKlE,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAExF;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,UAAU,CAiBb"}
+{"version":3,"file":"creator-token.d.ts","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAkC,KAAK,OAAO,EAAY,KAAK,YAAY,EAAC,MAAM,MAAM,CAAC;AAEhG,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,UAAU,CAAC;AAEzC,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,EAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,eAAO,MAAM,iCAAiC,EAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,EACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAKlE,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAExF;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,qBAAqB,GAAG,aAAa,CAAC;AAEhG,oGAAoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,OAAO;AAClB;+DAC+D;AAC/D,IAAI,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAsBjC;AAoBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,UAAU,CAiBb"}

package/dist/creator-token.js

@@ -8,6 +8,15 @@
  * zero — never un-enrolls. Every transfer that isn't a mint/burn (or the validator's own)
  * staticcalls `validateTransfer(caller, from, to, tokenId)` on the validator; a policy
  * violation reverts and bubbles.
+ *
+ * **`setTransferValidator` is owner-only only while the collection has an owner.** Once
+ * `owner() == address(0)` the contract opens one asymmetric door: **anyone** may suspend
+ * enforcement by passing `zeroAddress`, and nobody — including that caller — may ever arm a
+ * validator again. That is the dead-man release for the worst reachable state (a validator that
+ * reverts every transfer on a collection with nobody left to re-point it, which would otherwise
+ * strand every collector's token forever). An integrator building for collectors should expose
+ * that suspension path on a renounced collection rather than gating it behind an owner check that
+ * can no longer be satisfied — see {@link prepareSetTransferValidator}.
  */
 import { encodeFunctionData, zeroAddress } from 'viem';
 import { oneOfOneImageAbi } from './abi/index.js';
@@ -20,10 +29,10 @@ export const CREATOR_TOKEN_EXTENSION_ID = '0x0839e7ed7fc1f5db3f253851d61b10f8520
 /**
  * The recommended transfer validator per chain — OpenSea's
  * **StrictAuthorizedTransferSecurityRegistry**, the validator their creator-fee-enforcement
- * doc recommends for enforcement eligibility (docs.opensea.io "Creator Fee Enforcement",
- * checked 2026-08; the named alternative is Limit Break's CreatorTokenTransferValidator
- * 0x721C0078c2328597Ca70F5451ffF5A7B38D4E947). Verified empirically against the LIVE
- * contracts on 2026-08-04 (`cast call --from <collection>` on the 4-arg
+ * doc recommends for enforcement eligibility (docs.opensea.io "Creator Fee Enforcement"; the named
+ * alternative is Limit Break's CreatorTokenTransferValidator
+ * 0x721C0078c2328597Ca70F5451ffF5A7B38D4E947). Verified empirically against the live contracts with
+ * `cast call --from <collection>` on the 4-arg
  * `validateTransfer(address,address,address,uint256)` overload, both chains):
  * an owner-initiated (OTC) transfer succeeds; an unauthorized operator reverts
  * `StrictAuthorizedTransferSecurityRegistry__UnauthorizedTransfer()`.
@@ -65,12 +74,93 @@ export async function readCreatorTokenStatus(client, contract) {
     ]);
     return { enrolled, validator };
 }
+/**
+ * A selector no transfer validator implements — the probe question. Same constant the contract's
+ * own `_requireHasCode` uses, so the SDK and the chain agree about which addresses are refused.
+ */
+const NOT_A_VALIDATOR_SELECTOR = '0xa9b1c2d3';
+/**
+ * Ask a candidate transfer validator a question no validator can answer, and require it to FAIL.
+ *
+ * **`code.length > 0` is not enough**, which is why this exists and why the on-chain guard was
+ * rewritten to match. Two shapes enforce nothing while every read surface — ERC-165,
+ * `getTransferValidator()`, the extension beacon — reports enforcement as on: no code at all, and a
+ * *permissive fallback* that succeeds for any selector. `validateTransfer` returns nothing, so
+ * there is no ABI decode to fail; a Safe (its `FallbackManager.fallback()` returns empty when no
+ * handler is set), an uninitialised proxy, and an EIP-7702-delegated EOA all pass a has-code check
+ * and then wave every transfer through. A creator pasting their own Safe is the likely real case.
+ *
+ * So the probe inverts the question: a real validator **reverts** here (verified against OpenSea's
+ * SATSR and three Limit Break deployments on mainnet and Sepolia), and a permissive one returns
+ * empty success. This mirrors the contract exactly — the same selector, the same "must fail" rule —
+ * so an address that passes here is an address the token will accept, and the CLI stops reporting
+ * "no code on this chain" for an address that plainly has code.
+ *
+ * An ERC-165 gate was measured and rejected: none of those four live validators advertises
+ * `ITransferValidator`/`ITransferValidator1155`, so requiring an id would refuse the entire
+ * ecosystem, including the validator ABX itself recommends.
+ *
+ * **A misconfiguration guard, not a security boundary** — a contract can always be written to pass
+ * this and enforce nothing. It catches the honest mistake. Never throws for an on-chain reason:
+ * every failure is a verdict (mirrors `probeSeedSource`).
+ */
+export async function probeTransferValidator(client, validator, 
+/** The enrolling/enrolled token, when known — the probe is made as the token, because that is
+ *  the `msg.sender` the contract's own staticcall presents. */
+opts = {}) {
+    let code;
+    try {
+        code = await client.getCode({ address: validator });
+    }
+    catch (err) {
+        return { verdict: 'unreachable', address: validator, error: firstLine(err) };
+    }
+    if (!code || code === '0x')
+        return { verdict: 'no-code', address: validator };
+    try {
+        await client.call({
+            to: validator,
+            data: NOT_A_VALIDATOR_SELECTOR,
+            ...(opts.as ? { account: opts.as } : {}),
+        });
+    }
+    catch (err) {
+        // A revert is the PASS: this is what a real validator does with an unknown selector. A
+        // transport failure lands here too, so classify it rather than calling a broken RPC "ok".
+        return isTransportFailure(err)
+            ? { verdict: 'unreachable', address: validator, error: firstLine(err) }
+            : { verdict: 'ok', address: validator };
+    }
+    return { verdict: 'permissive-fallback', address: validator };
+}
+/** First line of an error message — a revert reason is readable; viem's full dump is not. */
+function firstLine(err) {
+    return String(err?.message ?? err).split('\n')[0].trim();
+}
+/** Distinguish "the node said this call reverted" (a verdict) from "the node didn't answer" (retry).
+ *  viem reports a revert as an execution error carrying revert data or the word itself; anything
+ *  that never reached execution (timeout, socket, HTTP status, rate limit) must not read as a pass. */
+function isTransportFailure(err) {
+    const name = err?.name ?? '';
+    const msg = String(err?.message ?? err);
+    if (/execution reverted|reverted with|revert reason|InvalidTransferValidator/i.test(msg))
+        return false;
+    return (/Timeout|Socket|Network|HttpRequest|Connection|RateLimit|InternalRpc|LimitExceeded/i.test(name) ||
+        /timed? out|timeout|socket hang up|ECONN|fetch failed|status code|too many requests|rate limit/i.test(msg));
+}
 /**
  * Re-point an enrolled token's transfer validator, or suspend enforcement with
- * `zeroAddress` (the token stays enrolled). Signer must be the owner. Reverts
- * `NotCreatorToken()` on a token that didn't enroll at deploy — enrollment can never be
- * added later — and `InvalidTransferValidator()` on a non-zero validator with no code;
- * callers should read {@link readCreatorTokenStatus} first and refuse those before gas.
+ * `zeroAddress` (the token stays enrolled). Reverts `NotCreatorToken()` on a token that didn't
+ * enroll at deploy — enrollment can never be added later — and `InvalidTransferValidator()` on a
+ * validator the chain's own probe refuses (no code on this chain, **or** a permissive fallback that
+ * would enforce nothing); call {@link probeTransferValidator} first and refuse those before gas.
+ *
+ * **Who may sign:** the owner, while there is one. On a collection whose `owner()` is
+ * `address(0)`, **any** signer may send this with `validator = zeroAddress` to suspend enforcement
+ * permanently — the dead-man release described in this module's header. Arming a validator is still
+ * owner-only, so an ownerless collection can only move toward transferability, never back. A UX for
+ * collectors should offer that suspension when it sees a renounced, enforcing collection; gating it
+ * on `owner()` would hide the one recovery a stranded holder has.
  */
 export function prepareSetTransferValidator(args) {
     const suspending = args.validator === zeroAddress;

package/dist/creator-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"creator-token.js","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAC,kBAAkB,EAAE,WAAW,EAAkC,MAAM,MAAM,CAAC;AACtF,OAAO,EAAC,gBAAgB,EAAC,MAAM,gBAAgB,CAAC;AAGhD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,MAAM,CAAC,MAAM,iCAAiC,GAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA4B;IACrE,oBAAoB;IACpB,QAAQ,EAAE,4CAA4C;IACtD,yBAAyB;IACzB,KAAK,EAAE,4CAA4C;CACpD,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,QAAiB;IAEjB,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,MAAM;aACH,YAAY,CAAC;YACZ,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,0BAA0B,CAAC;SACnC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAqB;QACzC,MAAM;aACH,YAAY,CAAC,EAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAC,CAAC;aAC9F,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAqB;KAChD,CAAC,CAAC;IACH,OAAO,EAAC,QAAQ,EAAE,SAAS,EAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAI3C;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,WAAW,CAAC;IAClD,OAAO;QACL,EAAE,EAAE,wBAAwB;QAC5B,EAAE,EAAE,IAAI,CAAC,QAAQ;QACjB,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,sBAAsB;YACpC,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SACvB,CAAC;QACF,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,qCAAqC,IAAI,CAAC,SAAS,EAAE;QACzD,MAAM,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAC;KAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"creator-token.js","sourceRoot":"","sources":["../src/creator-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAC,kBAAkB,EAAE,WAAW,EAA4C,MAAM,MAAM,CAAC;AAChG,OAAO,EAAC,gBAAgB,EAAC,MAAM,gBAAgB,CAAC;AAGhD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAqB,CAAC;AAChE,qFAAqF;AACrF,MAAM,CAAC,MAAM,iCAAiC,GAAG,YAAqB,CAAC;AACvE,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GACrC,oEAA6E,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA4B;IACrE,oBAAoB;IACpB,QAAQ,EAAE,4CAA4C;IACtD,yBAAyB;IACzB,KAAK,EAAE,4CAA4C;CACpD,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,QAAiB;IAEjB,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,MAAM;aACH,YAAY,CAAC;YACZ,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,0BAA0B,CAAC;SACnC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAqB;QACzC,MAAM;aACH,YAAY,CAAC,EAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAC,CAAC;aAC9F,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAqB;KAChD,CAAC,CAAC;IACH,OAAO,EAAC,QAAQ,EAAE,SAAS,EAAC,CAAC;AAC/B,CAAC;AAwBD;;;GAGG;AACH,MAAM,wBAAwB,GAAG,YAAmB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,SAAkB;AAClB;+DAC+D;AAC/D,OAAuB,EAAE;IAEzB,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,wBAAwB;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,0FAA0F;QAC1F,OAAO,kBAAkB,CAAC,GAAG,CAAC;YAC5B,CAAC,CAAC,EAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAC;YACrE,CAAC,CAAC,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAC,CAAC;AAC9D,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;;uGAEuG;AACvG,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,IAAI,GAAI,GAAuB,EAAE,IAAI,IAAI,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;IACnD,IAAI,0EAA0E,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvG,OAAO,CACL,oFAAoF,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/F,gGAAgG,CAAC,IAAI,CAAC,GAAG,CAAC,CAC3G,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAI3C;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,WAAW,CAAC;IAClD,OAAO;QACL,EAAE,EAAE,wBAAwB;QAC5B,EAAE,EAAE,IAAI,CAAC,QAAQ;QACjB,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,gBAAgB;YACrB,YAAY,EAAE,sBAAsB;YACpC,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SACvB,CAAC;QACF,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,qCAAqC,IAAI,CAAC,SAAS,EAAE;QACzD,MAAM,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAC;KAC7D,CAAC;AACJ,CAAC"}

package/dist/creators-service.d.ts

@@ -0,0 +1,79 @@
+import type { Address, Hex } from 'viem';
+export type CreatorOperationState = 'prepared' | 'submitting' | 'pending' | 'confirmed' | 'failed' | 'unknown';
+export interface CreatorWallet {
+    address: Address;
+    provider: 'privy';
+    /** Public Privy application identifier used for the creator's device authorization. */
+    providerAppId: string;
+}
+export interface CreatorAccount {
+    accountId: string;
+    emailVerified: boolean;
+    wallet: CreatorWallet | null;
+    capabilities: {
+        wallet: boolean;
+        sponsorship: boolean;
+        sponsoredChains: number[];
+    };
+}
+export interface CreatorOperation {
+    operationId: string;
+    chainId: number;
+    walletId: string;
+    state: CreatorOperationState;
+    providerTransactionId: string | null;
+    transactionHash: Hex | null;
+    userOperationHash: Hex | null;
+    errorCode: string | null;
+    updatedAt: string;
+}
+export interface CreatorSigningRequest {
+    walletId: string;
+    idempotencyKey: string;
+    requestExpiry: string;
+    body: Record<string, unknown>;
+}
+export interface CreatorPreparedOperation {
+    operation: CreatorOperation;
+    signingRequest: CreatorSigningRequest;
+}
+export interface CreatorApiClientOptions {
+    /** Explicit provider endpoint, normally resolved from `abx-creator-wallet/v1` in its remote descriptor. */
+    baseUrl: string;
+    token: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare class CreatorApiError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number);
+}
+/** Account/wallet API client. It never receives a wallet key or authorization token. */
+export declare class CreatorApiClient {
+    #private;
+    constructor(options: CreatorApiClientOptions);
+    account(): Promise<CreatorAccount>;
+    provisionWallet(): Promise<CreatorWallet & {
+        created: boolean;
+    }>;
+    prepare(input: {
+        operationId: string;
+        chainId: number;
+        /** Sponsored operations are calls; custom-contract deployment targets the CREATE2 proxy. */
+        to: Address;
+        value: Hex;
+        data: Hex;
+        gasLimit: number;
+    }): Promise<CreatorPreparedOperation>;
+    submit(operationId: string, input: {
+        requestExpiry: string;
+        data: Hex;
+        signed: {
+            url: string;
+            headers: Record<string, string>;
+        };
+    }): Promise<CreatorOperation>;
+    getOperation(operationId: string): Promise<CreatorOperation>;
+}
+//# sourceMappingURL=creators-service.d.ts.map

package/dist/creators-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creators-service.d.ts","sourceRoot":"","sources":["../src/creators-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,OAAO,EAAE,GAAG,EAAC,MAAM,MAAM,CAAC;AAEvC,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,EAAE,CAAA;KAAC,CAAC;CAClF;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,eAAe,EAAE,GAAG,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,GAAG,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,cAAc,EAAE,qBAAqB,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,2GAA2G;IAC3G,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B;AA8CD,wFAAwF;AACxF,qBAAa,gBAAgB;;gBAMf,OAAO,EAAE,uBAAuB;IAWtC,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;IA0BlC,eAAe,IAAI,OAAO,CAAC,aAAa,GAAG;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC;IAU9D,OAAO,CAAC,KAAK,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,4FAA4F;QAC5F,EAAE,EAAE,OAAO,CAAC;QACZ,KAAK,EAAE,GAAG,CAAC;QACX,IAAI,EAAE,GAAG,CAAC;QACV,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAc/B,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAC,CAAA;KAAC,GAChG,OAAO,CAAC,gBAAgB,CAAC;IA+BtB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA6BnE"}