v1 state

MetadataStatic

// base URI fixed at creation

MetadataReveal

// placeholder until one committed reveal

MetadataMutable

// creator may change the base URI until frozen

metadata

metadata decides what TokenURI answers. Once frozen, the base URI can never change again; only then can traits be committed.

contentAddressed

contentAddressed accepts an IPFS path that resolves to the same files for good: a server behind any other scheme could change them at will, and an empty CID, a "." or ".." segment, an escape, a query or a fragment could make a gateway resolve it elsewhere, a mutable IPNS name included.

validBaseURI

A base URI is a directory: token n resolves to \<base>\<n>.json.

validHash

RevealCommitment

RevealCommitment is what a creator commits to at creation and opens at Reveal: sha256("launchpad-reveal-v1|\<creator>|\<salt>|\<base URI>"), with a salt of 64 hex digits the creator keeps secret until then. The salt keeps a guessed URI from being confirmed before the reveal. The creator's address keeps another account from reusing the commitment: a collection's ID does not exist yet when its creator commits, so the account stands in for it.

newMetadata

emitMetadata

Reveal

Reveal publishes the base URI committed at creation, with the salt that opens the commitment, and fixes it for good. The commitment stays bound to the account that created the collection, whoever holds the creator role now.

mutable

SetBaseURI

SetBaseURI points a mutable collection at new metadata. Every change is announced with its revision number.

FreezeMetadata

FreezeMetadata gives up the right to change a mutable collection's base URI.

CommitTraits

CommitTraits records, once, the Merkle root of the collection's traits. It waits for frozen metadata so the root cannot outlive the files it describes. A leaf is sha256(0x00 || "launchpad-trait-v1|\<collection>|\<number>|\<type>=\<value>") in a p/samcrew/launchpad/merkle/v1 tree, where neither the type nor the value contains "=" or "|": a leaf has then one reading only, and a leaf that breaks the rule matches no trait offer. The ledger cannot check the root against the files; whoever relies on it must recompute it from them.

TraitsRoot

TraitsRoot is empty until the creator commits one.

dropsPath

marketPath

ModeOpen

ModeRoyaltyProtected

ModeSoulbound

StatusActive

StatusBurned

StatusRevoked

Info

Info is a collection's public record. The creator may edit the profile fields until FreezeProfile, hand the creator role over and seal the supply; everything else is immutable.

collection

lastID

collections

// collection key -> \*collection

holdings

// owner -> \*avl.Tree of "\<collection key>/\<number key>" -> custody ID

lastCustody

// the last custody ID given

isIssuer

isIssuer reports whether a realm may create collections and mint into its own: the drops realm always, and every realm on config's add-only list.

gate

gate stops a new collection or a new mint while its lane is paused, so the pauser is a brake on every issuer config may add, whatever that issuer checks. The drops realm is not asked twice: it applies the same gate itself, with the currency it charges, before it calls here.

callingRealm

actor

check

checkProfile

mustCollection

tokenID

holdingKey

hold

hold and release keep the holdings index equal to ownership: one tree per owner, so a page of an account's tokens costs the same wherever it starts.

renew

renew gives a held token a new custody ID, as a move does: a change of its single-token approval starts a new custody too.

release

Create

Create registers a collection for a creator the calling issuer realm has authenticated and charged. The issuer is recorded on the collection and no other realm can mint into it. royalties is "address:bps;address:bps" with addresses in strictly ascending order, or empty; the metadata arguments are those of newMetadata.

MintTo

MintTo issues the next token number. Only the collection's issuer calls it, after its own accounting of stages and payment. The ledger mints to whoever the issuer names: it is the issuer's duty to mint a soulbound token only to the wallet that asked for it.

operator

operator reports whether who may be approved for, or move, a token of c. Soulbound tokens never move. A royalty-protected token moves only through a realm on the collection's market list. The ledger cannot make a realm pay: the creator who lists one vouches that it pays the collection's royalties.

denied

TransferFrom

TransferFrom moves a token when the collection's mode lets the caller move one, and the caller owns it or is approved for it.

Approve

Approve lets one account move one token; an empty address clears it. A soulbound token takes no approval at all, a royalty-protected one only a listed market.

SetApprovalForAll

SetApprovalForAll lets, or stops letting, one account move every token the caller holds in the collection.

ownerOf

retire

Burn

Burn is the holder's alone, in every mode. No creator, operator or admin can destroy a token somebody else holds, except through Revoke.

Revoke

Revoke retires a credential. It exists only for soulbound collections created as revocable, a term every holder could read before claiming. A holder who burns first leaves a burned token, not a revoked one.

creatorOf

creatorOf returns the collection when the caller is its creator.

ProposeCreator

ProposeCreator starts handing the creator role to another account. Nothing changes until that account accepts; an empty address withdraws the offer.

AcceptCreator

AcceptCreator makes the caller the creator it was proposed as.

SetIssuer

SetIssuer moves the collection's minting to another issuer realm, for instance a later version of the one that created it. Only the creator can choose it, and only among realms allowed to issue.

SealSupply

SealSupply ends minting for good, whatever the cap was.

profileOwner

SetProfile

FreezeProfile

GetInfo

Count

BalanceOf

OwnerOf

TotalSupply

GetApproved

IsApprovedForAll

statusOf

Epoch

Epoch returns the ID of a token's current custody: a new one at every move and every change of its single-token approval (the same approval again changes nothing), never one given before; 0 for a retired token. A market binds an order to it, so the order dies with the custody it was made under.

StatusOf

TokenURI

TokenURI answers for every minted number, retired or not: the metadata of a burned token is still part of the collection's public record.

Render

maxRoyaltyReceivers

Hard limits, fixed for the life of this realm.

maxRoyaltyBPS

// 10% of a sale, across all receivers

maxMarkets

Hard limits, fixed for the life of this realm.

royalty

royalty is one receiver's share of every sale, in basis points.

RoyaltyPayout

parseBPS

parseBPS reads a positive decimal with no sign, space or leading zero.

parseRoyalties

parseRoyalties reads "address:bps;address:bps". Strictly ascending addresses give every split exactly one encoding and rule out duplicates.

validName

validName is the chain's rule for one segment of a package path: a letter first, then letters and digits, joined by single "\_" or "-".

validMarketPath

A market may be any realm the chain can host, a third party's included, so its path follows the chain's own rule for a realm path: "gno.land/r/", then names separated by "/", none ending in "\_test", in at most 200 bytes. A slot is permanent: none is given to a path no realm can have. The rule for issuers is config's and is narrower (plain segments in our own namespace): an issuer is one of ours, a market need not be.

RoyaltyBPS

RoyaltyQuote

RoyaltyQuote floors each receiver's share of price. The seller keeps the rounding remainder.

AllowMarket

AllowMarket adds a realm through which a royalty-protected collection's tokens may be sold. The list starts with the Launchpad market and only grows: a holder's way out can be widened, never taken away. The ledger cannot make a realm pay: the creator vouches that the market it lists pays this collection's royalties, and every holder can read the list.

maxPage

Lists are paged: a zero-based page of 1 to maxPage entries.

num

int64 values are decimal strings so a JSON client cannot round them.

listJSON

listJSON renders one page of a tree in key order. The tree seeks the first entry by subtree sizes, so a deep page costs what the first one does.

CollectionJSON

royaltiesJSON

addressesJSON

CapabilitiesJSON

CapabilitiesJSON tells a wallet or a market what a holder of this collection can do, without it knowing the modes. "markets" is empty when any operator may be approved. Royalties are paid by markets at sale. "royaltyEnforcement" is "none" without royalties; "market\_sales" for an open collection, where the ledger enforces nothing: a market that honours royalties pays them at a sale, and a direct transfer or any other realm pays none; "listed\_markets" when the ledger lets a token move only through the realms in "markets". Whether a listed realm pays is the word of the creator who listed it. "creatorRevoke" is the creator's right to revoke a token of a revocable soulbound collection.

ListCollectionsJSON

ListCollectionsJSON pages through a summary of every collection, in creation order. CollectionJSON has the full record.

tokenJSON

TokenJSON

TokenJSON describes one minted number. A retired token has no owner.

ApprovalJSON

ApprovalJSON answers, in one read, whether operator may move an active token: by a single-token approval or by the owner's collection-wide one.

TokensJSON

TokensJSON pages through a collection's minted numbers in order, retired ones included.

HoldingsJSON

HoldingsJSON pages through the tokens an account holds, across every collection, in collection then number order.