v1 source realm

AcceptCreator makes the caller the creator it was proposed as.

AllowMarket adds a realm through which a royalty-protected collection's tokens may be sold. The list starts with the Launchpad market and only grows: a holder's way out can be widened, never taken away. The ledger cannot make a realm pay: the creator vouches that the market it lists pays this collection's royalties, and every holder can read the list.

ApprovalJSON answers, in one read, whether operator may move an active token: by a single-token approval or by the owner's collection-wide one.

Approve lets one account move one token; an empty address clears it. A soulbound token takes no approval at all, a royalty-protected one only a listed market.

Burn is the holder's alone, in every mode. No creator, operator or admin can destroy a token somebody else holds, except through Revoke.

CapabilitiesJSON tells a wallet or a market what a holder of this collection can do, without it knowing the modes. "markets" is empty when any operator may be approved. Royalties are paid by markets at sale. "royaltyEnforcement" is "none" without royalties; "market_sales" for an open collection, where the ledger enforces nothing: a market that honours royalties pays them at a sale, and a direct transfer or any other realm pays none; "listed_markets" when the ledger lets a token move only through the realms in "markets". Whether a listed realm pays is the word of the creator who listed it. "creatorRevoke" is the creator's right to revoke a token of a revocable soulbound collection.

CommitTraits records, once, the Merkle root of the collection's traits. It waits for frozen metadata so the root cannot outlive the files it describes. A leaf is sha256(0x00 || "launchpad-trait-v1|<collection>|<number>|<type>=<value>") in a p/samcrew/launchpad/merkle/v1 tree, where neither the type nor the value contains "=" or "|": a leaf has then one reading only, and a leaf that breaks the rule matches no trait offer. The ledger cannot check the root against the files; whoever relies on it must recompute it from them.

Create registers a collection for a creator the calling issuer realm has authenticated and charged. The issuer is recorded on the collection and no other realm can mint into it. royalties is "address:bps;address:bps" with addresses in strictly ascending order, or empty; the metadata arguments are those of newMetadata.

Epoch returns the ID of a token's current custody: a new one at every move and every change of its single-token approval (the same approval again changes nothing), never one given before; 0 for a retired token. A market binds an order to it, so the order dies with the custody it was made under.

FreezeMetadata gives up the right to change a mutable collection's base URI.

HoldingsJSON pages through the tokens an account holds, across every collection, in collection then number order.

ListCollectionsJSON pages through a summary of every collection, in creation order. CollectionJSON has the full record.

MintTo issues the next token number. Only the collection's issuer calls it, after its own accounting of stages and payment. The ledger mints to whoever the issuer names: it is the issuer's duty to mint a soulbound token only to the wallet that asked for it.

ProposeCreator starts handing the creator role to another account. Nothing changes until that account accepts; an empty address withdraws the offer.

Reveal publishes the base URI committed at creation, with the salt that opens the commitment, and fixes it for good. The commitment stays bound to the account that created the collection, whoever holds the creator role now.

RevealCommitment is what a creator commits to at creation and opens at Reveal: sha256("launchpad-reveal-v1|<creator>|<salt>|<base URI>"), with a salt of 64 hex digits the creator keeps secret until then. The salt keeps a guessed URI from being confirmed before the reveal. The creator's address keeps another account from reusing the commitment: a collection's ID does not exist yet when its creator commits, so the account stands in for it.

Revoke retires a credential. It exists only for soulbound collections created as revocable, a term every holder could read before claiming. A holder who burns first leaves a burned token, not a revoked one.

SealSupply ends minting for good, whatever the cap was.

SetApprovalForAll lets, or stops letting, one account move every token the caller holds in the collection.

SetBaseURI points a mutable collection at new metadata. Every change is announced with its revision number.

SetIssuer moves the collection's minting to another issuer realm, for instance a later version of the one that created it. Only the creator can choose it, and only among realms allowed to issue.

TokenJSON describes one minted number. A retired token has no owner.

TokenURI answers for every minted number, retired or not: the metadata of a burned token is still part of the collection's public record.

TokensJSON pages through a collection's minted numbers in order, retired ones included.

TraitsRoot is empty until the creator commits one.

TransferFrom moves a token when the collection's mode lets the caller move one, and the caller owns it or is approved for it.

RoyaltyQuote floors each receiver's share of price. The seller keeps the rounding remainder.

Info is a collection's public record. The creator may edit the profile fields until FreezeProfile, hand the creator role over and seal the supply; everything else is immutable.