@hyperscale0/hsx 1.0.128 → 1.0.132

package/dist/src/std-bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"std-bundle.js","sourceRoot":"","sources":["../../src/std-bundle.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,MAAM,CAAC,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAiB;IACpF,CAAC,aAAa,EAAE,soLAAsoL,CAAC;IACvpL,CAAC,WAAW,EAAE,2oKAA2oK,CAAC;IAC1pK,CAAC,iBAAiB,EAAE,2sNAA2sN,CAAC;IAChuN,CAAC,YAAY,EAAE,i9JAAi9J,CAAC;IACj+J,CAAC,eAAe,EAAE,uzpEAAuzpE,CAAC;IAC10pE,CAAC,eAAe,EAAE,uxLAAuxL,CAAC;IAC1yL,CAAC,aAAa,EAAE,qwTAAqwT,CAAC;IACtxT,CAAC,iBAAiB,EAAE,mpTAAmpT,CAAC;IACxqT,CAAC,WAAW,EAAE,+1VAA+1V,CAAC;IAC92V,CAAC,eAAe,EAAE,+q2BAA+q2B,CAAC;IACls2B,CAAC,aAAa,EAAE,85JAA85J,CAAC;IAC/6J,CAAC,YAAY,EAAE,kyHAAkyH,CAAC;CACnzH,CAAC,CAAC"}
+{"version":3,"file":"std-bundle.js","sourceRoot":"","sources":["../../src/std-bundle.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,MAAM,CAAC,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAiB;IACpF,CAAC,aAAa,EAAE,soLAAsoL,CAAC;IACvpL,CAAC,WAAW,EAAE,6wMAA6wM,CAAC;IAC5xM,CAAC,iBAAiB,EAAE,2sNAA2sN,CAAC;IAChuN,CAAC,YAAY,EAAE,yjQAAyjQ,CAAC;IACzkQ,CAAC,eAAe,EAAE,6nrFAA6nrF,CAAC;IAChprF,CAAC,eAAe,EAAE,41LAA41L,CAAC;IAC/2L,CAAC,aAAa,EAAE,03UAA03U,CAAC;IAC34U,CAAC,iBAAiB,EAAE,syTAAsyT,CAAC;IAC3zT,CAAC,WAAW,EAAE,4zYAA4zY,CAAC;IAC30Y,CAAC,eAAe,EAAE,+q2BAA+q2B,CAAC;IACls2B,CAAC,aAAa,EAAE,ohKAAohK,CAAC;IACriK,CAAC,YAAY,EAAE,2zIAA2zI,CAAC;CAC50I,CAAC,CAAC"}

package/docs/README.md

@@ -110,11 +110,15 @@ executor. Compilation cannot establish balances, permissions or provider readine
 Every attached party parameter binds to `owner`, `actor`, `operator`, a declared
 business, or a declared staff party with a supported role. Configure declared
 business participants per Build. The host binds a declared business to an
-organization customer that holds one open balance account in the Product, so the
-Product exists before the binding and a recomposition adds it. Declared person
+organization customer of this company, and that business must be a customer with
+an account before the Build that binds it is saved. It also needs an open balance
+account in this Product before it takes part in a payment. Declared person
 parties cannot bind attachments.
 `owner` is the object's resolved customer or business, `actor` is the authenticated
-caller, and `operator` is the program operator. A parameter with one of these
+caller, or the customer a Product key or member names in `onBehalfOf`, and
+`operator` is the program operator. `programOperator`, the default
+of many std party parameters, is the same company: it resolves to the Product's
+own company, and a Build binding for it is ignored. A parameter with one of these
 names binds by name. Other required party parameters use a same-named eligible
 declaration, a header default, or an explicit binding. An optional party parameter
 stays unset unless the attachment binds it. Explicit bindings take precedence.
@@ -128,7 +132,10 @@ compiler freezes the adapter identity, digest and requirements. An unavailable
 declaration leaves a null snapshot in compiled output. Product creation and
 recomposition reject unresolved or changed declarations during Build admission.
 Execution checks the frozen declaration too; later adapter unavailability can
-block actions on an already saved Build.
+block actions on an already saved Build. A boundary adapter, such
+as `conformance_boundary`, only binds its accounts and needs no evidence. Any
+other adapter also needs a matching `requires evidence` rule on the action, or
+preview and execution refuse with `subject_adapter_unbound`.
 
 An attachment can use `rename { price: salePrice }` to separate requirements with
 different meanings. Matching names must match types and constraints. The compiler
@@ -140,6 +147,19 @@ Creation accepts `{}`. Every normalized field, including adapter requirements,
 is optional at creation. Only a named action requires its subject metadata.
 Use `attach` inside the object block to configure its financial instruments.
 
+A required instrument field with no fixed value is a local creation value by
+default. It becomes create `input` on that agreement and never an object field,
+so two agreements on one object keep separate amounts and a wallet spend never
+prefills a later fee. Only a rename such as `rename { dueAt: dueAt }` shares
+it as record metadata: the value then comes from the object field as a create
+subject requirement. An authored object field of the same name does not share
+it; write `rename { price: price }` when the agreement should read that field.
+Later actions still read `self.amount` from the agreement either way. An
+attachment whose create needs input must expose `create`, or compilation fails,
+because a public action on a fresh attachment creates it first with no input.
+A rename binds only fields of the attached instrument itself; renaming a record
+field such as `insurance.cover`'s slice `premium` reports `subject_field_unknown`.
+
 ## Headers and tunables
 
 The header defines the available policies. The company chooses percentages, amounts, durations,
@@ -244,6 +264,13 @@ a literal. `requires unique "order" on [self.order]` fixes an identity namespace
 `requires count of { instrument: child, reference: "parent", anchor: self.id,
 states: [pending], limit: 12 } == 12` checks a typed selection; `sum "amount" of`
 uses the same selection syntax. `invariants` accepts these requirement expressions.
+The reference is a `ref` field or a party account; `reference: "traveller",
+anchor: self.traveller` selects every record of the same traveller. `overlaps:
+{ start: departure, end: returning, from: { field: self.departure }, until: {
+field: self.returning } }` keeps rows whose own `[departure, returning)` period
+meets the range, so a stay ending on the 8th and one starting on the 8th do not
+overlap. `count of { instrument: current(), ..., overlaps: ... } <= 1` stops one
+traveller holding two trips on the same dates.
 `requires hours self.now between 8 and 20 timezone "Asia/Riyadh"` checks local hours.
 `requires evidence self.payer family registry check ownership result verified
 maxAge 1d` requires a recent completed provider check.
@@ -252,7 +279,9 @@ maxAge 1d` requires a recent completed provider check.
 `moves post self.receipt` posts it and `moves void self.receipt` releases it.
 `moves amount from payer shares shares` expands a declared split. Optional `fee`,
 `capture`, `key` and `boundary` modifiers describe a move. `boundary` applies
-only to reservations. Fees settle with create moves, never reservations. Repeated clauses keep
+only to reservations. Fees settle with create moves, never reservations. A fee move
+also derives `<action>_<move>_debit`, the payer's whole debit: amount plus fee and
+tax when the buyer pays, the amount alone when the seller pays. Repeated clauses keep
 their declaration order. The JSON-like clause form remains accepted and lowers
 to the same [UDL clauses](https://github.com/hyperscale0/hyperscale-udl/blob/main/spec/README.md).
 Use `economics { purpose: earning, sourceParty: merchant }` on a move to
@@ -393,27 +422,38 @@ Read the instrument's states, time gates and moves before promising a money
 outcome. A compiler pass does not prove that required actions are exposed,
 adapters are bound, participants have funds, or the flow can finish.
 
-| Instrument                                 | Behavior                                                                                                                                                                                                                                                               |
-| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `financing.installments`                   | `share` allocates collected profit to a cash payable owned by `capital`. It does not itself pay operator income.                                                                                                                                                       |
-| `financing.limits`                         | `per_borrower` caps outstanding principal. Both borrower and portfolio limits must be approved before disbursement; attaching them does not approve them.                                                                                                              |
-| `lending.round`                            | The target is the linked plan's principal. Closing requires commitments and held funds to equal that amount.                                                                                                                                                           |
-| `lending.distribution`                     | Cash distribution needs an eligible recorded settlement, `prepare_cash`, one share record per funded commitment, then `distribute_cash`. Attaching it moves nothing.                                                                                                   |
-| `insurance.cover.slice`                    | `collect` credits premium net of commission to the insurer account. The tenant retains commission. `refund` returns both portions; claims reserve insurer funds. External settlement uses the boundary protocol.                                                       |
-| `financing.installments`, `savings.circle` | Supply explicit date lists when creating agreements. A term count does not generate a monthly calendar. Savings supports at most 60 distinct member seats.                                                                                                             |
-| `escrow.hold`                              | `fund` takes the whole price. Financing into pending escrow collects the remaining down payment and adds capital principal at disbursement; `fund` is not a down-payment checkout.                                                                                     |
-| `escrow.hold`                              | Acceptance timeout enters `disputed` without paying the seller. Delivery and return verification belong to `payee`; rebinding it also changes who receives accepted funds.                                                                                             |
-| `escrow.hold`                              | `deliver_within` (default `14d`) starts at funding. After it passes without delivery, an exposed `refund_undelivered` lets the payer take the whole held price back. Nothing runs it automatically.                                                                    |
-| `wallet.balance`                           | `topup_fee` (default `0%`) takes a floored percentage of each top-up for the Company. At `1%`, a 100.00 top-up credits 99.00 and earns 1.00.                                                                                                                           |
-| `booking.reservation`                      | The balance is payable only from `deposit_paid`, so a cancelled booking never takes it. `middle_forfeit` and `late_forfeit` default to `0%`, so every cancellation returns all held money until the author sets them. The clock completes a paid booking at departure. |
-| `financing.late_charge`                    | `fine` is a fixed money amount, not a percentage of overdue principal.                                                                                                                                                                                                 |
-| `cards.card`                               | `spend_limit` is a per-authorization ceiling, not a monthly aggregate.                                                                                                                                                                                                 |
+| Instrument                                 | Behavior                                                                                                                                                                                                                                                                                                                                 |
+| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `financing.installments`                   | `share` allocates collected profit to a cash payable owned by `capital`. It does not itself pay operator income.                                                                                                                                                                                                                         |
+| `financing.limits`                         | `per_borrower` caps outstanding principal. Both borrower and portfolio limits must be approved before disbursement; attaching them does not approve them.                                                                                                                                                                                |
+| `lending.round`                            | The target is the linked plan's principal. Closing requires commitments and held funds to equal that amount.                                                                                                                                                                                                                             |
+| `lending.distribution`                     | Cash distribution needs an eligible recorded settlement, `prepare_cash`, one share record per funded commitment, then `distribute_cash`. Attaching it moves nothing.                                                                                                                                                                     |
+| `insurance.cover.slice`                    | `collect` credits premium net of commission to the insurer account. The tenant retains commission. `refund` returns both portions; claims reserve insurer funds. External settlement uses the boundary protocol.                                                                                                                         |
+| `financing.installments`, `savings.circle` | Supply explicit date lists when creating agreements. A term count does not generate a monthly calendar. Savings supports at most 60 distinct member seats.                                                                                                                                                                               |
+| `escrow.hold`                              | `fund` takes the whole price. Financing into pending escrow collects the remaining down payment and adds capital principal at disbursement; `fund` is not a down-payment checkout.                                                                                                                                                       |
+| `escrow.hold`                              | Acceptance timeout enters `disputed` without paying the seller. Delivery and return verification belong to `payee`; rebinding it also changes who receives accepted funds.                                                                                                                                                               |
+| `escrow.hold`                              | `deliver_within` (default `14d`) starts at funding. After it passes without delivery, an exposed `refund_undelivered` lets the payer take the whole held price back. Nothing runs it automatically.                                                                                                                                      |
+| `wallet.balance`                           | `topup_fee` (default `0%`) takes a floored percentage of each top-up for the Company. At `1%`, a 100.00 top-up credits 99.00 and earns 1.00.                                                                                                                                                                                             |
+| `booking.reservation`                      | The balance is payable only from `deposit_paid`, so a cancelled booking never takes it. `middle_forfeit` and `late_forfeit` default to `0%`, so every cancellation returns all held money until the author sets them. At departure the clock completes a paid booking and lapses an unpaid one on `late_forfeit`.                        |
+| `financing.late_charge`                    | `fine` is a fixed money amount, not a percentage of overdue principal.                                                                                                                                                                                                                                                                   |
+| `cards.card`                               | `spend_limit` is a per-authorization ceiling, not a monthly aggregate. Bind `person` to the cardholder's `holder`, such as `person: actor`; create refuses any other party. The person freezes, unfreezes and cancels; the issuer uses `issuer_freeze`, `issuer_unfreeze` and `issuer_cancel`, and only `issuer_unfreeze` lifts a block. |
 
 A seller-owned marketplace object can declare `entryActions: [create_order]`
 when `create_order` exposes an attachment's create action with its buyer bound
 to `actor`. This admits active enrolled customers to that action. The default
 is closed. A retained buyer can read the record and run its buyer actions;
 the seller remains owner. Entry never grants access to an existing escrow.
+Without entry actions, the company runs a two-customer sale from its Product
+key: create the record with `onBehalfOf` naming the seller, then run the buyer's
+steps with `onBehalfOf` naming the buyer.
+
+The same rule admits the other std creates whose starting party can be a
+customer: `financing.limits` and `financing.installments` (borrower),
+`insurance.cover` (holder), `wallet.balance` (holder) and `savings.membership`
+(member). Several customers can each start one on the same record. A plan,
+commitment or other reference resolves the sibling that binds the same
+accounts to the parties both share, so each customer's plan finds its own
+escrow and each investor's commitment finds their own wallet.
 
 `financing.limits` and `financing.portfolio_limit` declare `scope: product`.
 Create and approve the portfolio limit once per Product and the borrower limit
@@ -426,8 +466,10 @@ The account primitive creates it automatically and shares it across the Product.
 Zero-tax escrow releases need no additional party setup.
 
 The financing, collections and lending samples expose payment creation, payment,
-refund and payoff quotes through the object's existing action routes. A child
-alias names the full attachment path, for example:
+refund and payoff quotes through the object's existing action routes. Record
+actions are private: the parent still runs them, but a caller sees one only
+after the program exposes it. A child alias names the full attachment path, for
+example:
 
 ```hsx
 expose enrolment.tuition.payment.create as create_payment
@@ -449,9 +491,10 @@ allocation order and payoff rebate; aliases do not change those terms.
 
 The [lending sample](../examples/lending.hsx) also exposes share creation. Callers
 still need dates, agreement inputs, funded wallets and eligible settlements.
-References without an explicit creation input require one matching agreement on
-the object. In particular, lending distributions with multiple settlements or
-commitments need authored selectors before callers can choose among them.
+Every agreement reference is an optional creation input on an exposed create.
+With one matching agreement on the object the engine picks it; with several,
+such as a plan's slices or a lending round's settlements, the caller passes the
+chosen instance ID under the reference's name.
 Insurance needs premium-slice records and actions. Savings needs dated
 contribution records. Read each header's creation and lifecycle requirements.
 
@@ -481,7 +524,8 @@ cost assessment is a separate record.
 
 Bind `insurance.cover.broker` to the agency that receives commission. Collection
 pays the insurer's net premium and the broker's commission as two moves. Refunds
-reverse those same portions. The default broker is the program operator.
+reverse those same portions. The default broker, `programOperator`, is the
+Product's own company and needs no binding.
 `claim.deny` accepts only `submitted`; after approval, `pay` or expiry consumes
 the reservation. `claim_limit` is the sum insured, supplied per cover at creation:
 approved and paid claims on one cover never total more. `adapter` names a
@@ -493,6 +537,13 @@ separately for eligible premium refunds before the paid period starts. Active
 and expired premium periods are excluded. A card transaction needs a captured
 authorization and its own record before refund, but no authorization-expiry wait.
 
+A booking runs two clock actions at departure. `complete` takes a `paid`
+booking and pays the held money to `operator`. `lapse` takes a booking still
+`reserved` or `deposit_paid` to `cancelled`: `operator` keeps `late_forfeit` of
+the held money and the customer gets the rest back. An unpaid balance at
+departure therefore costs the customer the same as `cancel_late`, and with the
+default `0%` it costs nothing. Nothing stays held after departure.
+
 A savings membership becomes `received` after its pot payout. Its contribution
 records become `paid` independently. Future contributions can remain pending
 after the member receives the pot; paying a contribution does not advance their
@@ -506,7 +557,7 @@ An attachment can declare the purpose of an imported action's money:
 
 ```hsx
 attach visit = wallet.spend {
-  wallet: balance, payee: operator
+  wallet: balance, payee: operator, holder: owner
   economics pay { purpose: earning, sourceParty: owner }
   expose pay as charge_visit
 }

package/examples/cards.hsx

@@ -1,6 +1,10 @@
 // A company issues expense cards to employees and reserves each supplier payment before capture.
 program team_expense_cards "Team expense cards"
 use cards
+// supplier is a business this program declares, so plan needs {"partyBindings":{"supplier":"<partyId>"}}.
+// That partyId is an organization customer's: create the Product from this source without the payment
+// and receipt attachments, add the customer with customer.create, activate its access, open its
+// customer_balance account, then compose this source with the binding.
 party supplier: business
 
 object employee "Employee card" {
@@ -14,10 +18,12 @@ object employee "Employee card" {
   }
   attach card = cards.card {
     expose create as create_card
-    holder: holder, spend_limit: 5000 SAR
+    holder: holder, person: owner, spend_limit: 5000 SAR
     expose activate as activate_card
     expose freeze as freeze_card
     expose unfreeze as unfreeze_card
+    expose issuer_freeze as block_card
+    expose issuer_unfreeze as unblock_card
   }
   attach payment = cards.authorization {
     expose create as create_payment

package/examples/collections.hsx

@@ -2,6 +2,10 @@
 program business_collections "Small business collections"
 use collections
 use financing
+// agency is a business this program declares, so plan needs {"partyBindings":{"agency":"<partyId>"}}.
+// That partyId is an organization customer's: create the Product from this source without the recovery
+// and contact attachments, add the customer with customer.create, activate its access, open its
+// customer_balance account, then compose this source with the binding.
 party agency: business
 
 object facility "Business loan" {

package/examples/cost-table.json

@@ -4,15 +4,14 @@
     "declaredMeters": [
       "account.active_month",
       "instrument.event.count",
-      "transfer.internal.count",
-      "transfer.internal.volume_sar"
+      "transfer.internal.count"
     ],
-    "effectiveTableDigest": "2d53121d200de2cb7567113ebf5bc0ce9377e7089fd4697f4b694bd557e32063",
+    "effectiveTableDigest": "e58f5c33766a44254880f328f1f9fb886b63d510bf3dfa0f9fb529a0638d74c6",
     "fixed": {
       "activationBaseMinor": "500000",
-      "activationPerPointMinor": "100000",
+      "activationPerPointMinor": "10000",
       "monthlyBaseMinor": "100000",
-      "monthlyPerPointMinor": "20000",
+      "monthlyPerPointMinor": "2000",
       "weights": {
         "aggregate_invariant": 2,
         "flow": 1,
@@ -69,7 +68,7 @@
         "bps": 0,
         "meter": "account.active_month",
         "payer": "product",
-        "perEventMinor": "27500",
+        "perEventMinor": "500",
         "settlement": "invoice",
         "signature": "meters.account.active_month"
       },
@@ -77,18 +76,25 @@
         "bps": 0,
         "meter": "instrument.event.count",
         "payer": "product",
-        "perEventMinor": "150",
+        "perEventMinor": "25",
         "settlement": "invoice",
         "signature": "meters.instrument.event.count"
       },
       {
-        "bps": 6,
+        "bps": 0,
         "meter": "transfer.internal.count",
-        "payer": "end_customer",
-        "perEventMinor": "75",
-        "settlement": "per_event",
-        "signature": "moves.transfer.internal",
-        "volumeMeter": "transfer.internal.volume_sar"
+        "payer": "product",
+        "perEventMinor": "25",
+        "settlement": "invoice",
+        "signature": "meters.transfer.internal.count"
+      },
+      {
+        "bps": 0,
+        "meter": "instrument.event.count",
+        "payer": "product",
+        "perEventMinor": "0",
+        "settlement": "invoice",
+        "signature": "moves.transfer.internal"
       },
       {
         "bps": 0,
@@ -155,22 +161,21 @@
         "signature": "unwinds.void"
       }
     ],
-    "version": "2026-09-02.1"
+    "version": "2026-09-27.1"
   },
   {
     "currency": "USD",
     "declaredMeters": [
       "account.active_month",
       "instrument.event.count",
-      "transfer.internal.count",
-      "transfer.internal.volume_usd"
+      "transfer.internal.count"
     ],
-    "effectiveTableDigest": "44fa81226359fcafa8bd66b70c2311ee999c9bae66ff59c85ccb14d7d68126a9",
+    "effectiveTableDigest": "f2845819ad077745ed5d0af924b33f34210b20da703522e78aa2629d9be5040e",
     "fixed": {
       "activationBaseMinor": "133300",
-      "activationPerPointMinor": "26700",
+      "activationPerPointMinor": "2700",
       "monthlyBaseMinor": "26700",
-      "monthlyPerPointMinor": "5300",
+      "monthlyPerPointMinor": "500",
       "weights": {
         "aggregate_invariant": 2,
         "flow": 1,
@@ -227,7 +232,7 @@
         "bps": 0,
         "meter": "account.active_month",
         "payer": "product",
-        "perEventMinor": "7333",
+        "perEventMinor": "133",
         "settlement": "invoice",
         "signature": "meters.account.active_month"
       },
@@ -235,18 +240,25 @@
         "bps": 0,
         "meter": "instrument.event.count",
         "payer": "product",
-        "perEventMinor": "40",
+        "perEventMinor": "7",
         "settlement": "invoice",
         "signature": "meters.instrument.event.count"
       },
       {
-        "bps": 6,
+        "bps": 0,
         "meter": "transfer.internal.count",
-        "payer": "end_customer",
-        "perEventMinor": "20",
-        "settlement": "per_event",
-        "signature": "moves.transfer.internal",
-        "volumeMeter": "transfer.internal.volume_usd"
+        "payer": "product",
+        "perEventMinor": "7",
+        "settlement": "invoice",
+        "signature": "meters.transfer.internal.count"
+      },
+      {
+        "bps": 0,
+        "meter": "instrument.event.count",
+        "payer": "product",
+        "perEventMinor": "0",
+        "settlement": "invoice",
+        "signature": "moves.transfer.internal"
       },
       {
         "bps": 0,
@@ -313,22 +325,21 @@
         "signature": "unwinds.void"
       }
     ],
-    "version": "2026-09-02.1"
+    "version": "2026-09-27.1"
   },
   {
     "currency": "EUR",
     "declaredMeters": [
       "account.active_month",
       "instrument.event.count",
-      "transfer.internal.count",
-      "transfer.internal.volume_eur"
+      "transfer.internal.count"
     ],
-    "effectiveTableDigest": "613d900e38f98a6bf3934e7940ff4d06c76f1dddc695c79ee3b5ee1ad45b8636",
+    "effectiveTableDigest": "f741132e1aa38a860d855a83f20f12c0ec8a7ec5379117c407799e2012e63335",
     "fixed": {
       "activationBaseMinor": "125000",
-      "activationPerPointMinor": "25000",
+      "activationPerPointMinor": "2500",
       "monthlyBaseMinor": "25000",
-      "monthlyPerPointMinor": "5000",
+      "monthlyPerPointMinor": "500",
       "weights": {
         "aggregate_invariant": 2,
         "flow": 1,
@@ -385,7 +396,7 @@
         "bps": 0,
         "meter": "account.active_month",
         "payer": "product",
-        "perEventMinor": "6875",
+        "perEventMinor": "125",
         "settlement": "invoice",
         "signature": "meters.account.active_month"
       },
@@ -393,18 +404,25 @@
         "bps": 0,
         "meter": "instrument.event.count",
         "payer": "product",
-        "perEventMinor": "38",
+        "perEventMinor": "6",
         "settlement": "invoice",
         "signature": "meters.instrument.event.count"
       },
       {
-        "bps": 6,
+        "bps": 0,
         "meter": "transfer.internal.count",
-        "payer": "end_customer",
-        "perEventMinor": "19",
-        "settlement": "per_event",
-        "signature": "moves.transfer.internal",
-        "volumeMeter": "transfer.internal.volume_eur"
+        "payer": "product",
+        "perEventMinor": "6",
+        "settlement": "invoice",
+        "signature": "meters.transfer.internal.count"
+      },
+      {
+        "bps": 0,
+        "meter": "instrument.event.count",
+        "payer": "product",
+        "perEventMinor": "0",
+        "settlement": "invoice",
+        "signature": "moves.transfer.internal"
       },
       {
         "bps": 0,
@@ -471,22 +489,21 @@
         "signature": "unwinds.void"
       }
     ],
-    "version": "2026-09-02.1"
+    "version": "2026-09-27.1"
   },
   {
     "currency": "GBP",
     "declaredMeters": [
       "account.active_month",
       "instrument.event.count",
-      "transfer.internal.count",
-      "transfer.internal.volume_gbp"
+      "transfer.internal.count"
     ],
-    "effectiveTableDigest": "11ff399b5078ba8ba544a518d5483fced9da63da9c7b1cc2124fea1f17a5b01c",
+    "effectiveTableDigest": "12ed3fa44010e80ae20c114d7dd94f277686225c040576a8bb96d12a0fe5333a",
     "fixed": {
       "activationBaseMinor": "104200",
-      "activationPerPointMinor": "20800",
+      "activationPerPointMinor": "2100",
       "monthlyBaseMinor": "20800",
-      "monthlyPerPointMinor": "4200",
+      "monthlyPerPointMinor": "400",
       "weights": {
         "aggregate_invariant": 2,
         "flow": 1,
@@ -543,7 +560,7 @@
         "bps": 0,
         "meter": "account.active_month",
         "payer": "product",
-        "perEventMinor": "5729",
+        "perEventMinor": "104",
         "settlement": "invoice",
         "signature": "meters.account.active_month"
       },
@@ -551,18 +568,25 @@
         "bps": 0,
         "meter": "instrument.event.count",
         "payer": "product",
-        "perEventMinor": "31",
+        "perEventMinor": "5",
         "settlement": "invoice",
         "signature": "meters.instrument.event.count"
       },
       {
-        "bps": 6,
+        "bps": 0,
         "meter": "transfer.internal.count",
-        "payer": "end_customer",
-        "perEventMinor": "16",
-        "settlement": "per_event",
-        "signature": "moves.transfer.internal",
-        "volumeMeter": "transfer.internal.volume_gbp"
+        "payer": "product",
+        "perEventMinor": "5",
+        "settlement": "invoice",
+        "signature": "meters.transfer.internal.count"
+      },
+      {
+        "bps": 0,
+        "meter": "instrument.event.count",
+        "payer": "product",
+        "perEventMinor": "0",
+        "settlement": "invoice",
+        "signature": "moves.transfer.internal"
       },
       {
         "bps": 0,
@@ -629,6 +653,6 @@
         "signature": "unwinds.void"
       }
     ],
-    "version": "2026-09-02.1"
+    "version": "2026-09-27.1"
   }
 ]

package/examples/insurance.hsx

@@ -13,7 +13,8 @@ object device "Insured device" {
     expose pay as pay_for_device
   }
   // conformance_boundary is the sandbox insurer adapter; swap in the insurer's registered adapter to go live.
-  // Premiums net of commission go to its account. claim_limit is the sum insured, set per cover at creation.
+  // Premiums net of commission go to its account. The default broker is the retailer, which keeps the commission.
+  // claim_limit is the sum insured, set per cover at creation.
   attach protection = insurance.cover {
     expose create as create_protection
     holder: owner, adapter: "conformance_boundary", commission: 10%, covers: purchase

package/examples/marketplace.hsx

@@ -7,14 +7,16 @@ object project "Project" {
   fields { brief: text, deliverable: text, price: money }
   columns: [brief, deliverable, price]
   attach offer = marketplace.listing {
+    rename { price: price }
     expose create as create_offer
     seller: owner
     expose publish as publish_offer
     expose withdraw as withdraw_offer
   }
   attach order = marketplace.order {
+    rename { price: price }
     expose create as create_order
-    listing: offer, buyer: actor
+    listing: offer, buyer: actor, fulfiller: owner
     expose commit as place_order
     expose fulfill as finish_order
   }

package/examples/rental-deposit.hsx

@@ -45,6 +45,8 @@ object rental "Equipment rental" {
   fields { equipment: text }
   columns: [equipment, dueAt]
   attach security = deposit {
+    // dueAt is a column, so it stays shared object metadata.
+    rename { dueAt: dueAt }
     expose create as agree_rental
     expose fund as pay_deposit
     expose return_on_time as return_equipment

package/examples/wallet.hsx

@@ -15,7 +15,7 @@ object membership "Membership" {
   }
   attach visit = wallet.spend {
     expose create as create_visit
-    wallet: balance, payee: operator
+    wallet: balance, payee: operator, holder: owner
     economics pay { purpose: earning, sourceParty: owner }
     expose reserve as reserve_visit
     expose pay as charge_visit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperscale0/hsx",
-  "version": "1.0.128",
+  "version": "1.0.132",
   "description": "The strictly typed HSX language: compile total financial programs into canonical UDL.",
   "keywords": [
     "hsx",
@@ -84,8 +84,8 @@
     "examples:bundle": "bun scripts/bundle-examples.ts"
   },
   "dependencies": {
-    "@hyperscale0/adl": "1.0.128",
-    "@hyperscale0/udl": "1.0.128",
+    "@hyperscale0/adl": "1.0.132",
+    "@hyperscale0/udl": "1.0.132",
     "fast-sha256": "1.3.0"
   },
   "devDependencies": {
@@ -97,5 +97,5 @@
     "Amir Ayub",
     "Sara AlBakaawi"
   ],
-  "gitHead": "d22a6727cbbb9fc59ffc1625b2d162711dccbe98"
+  "gitHead": "3449c1fe1ea4ee1ae40edc3775ab7bebf890e91b"
 }

package/src/cli.ts

@@ -87,7 +87,7 @@ export async function runCli(argv: readonly string[], io: Io): Promise<number> {
       const result = compile(source, { standardLibrary });
       for (const d of result.diagnostics)
         io.err(
-          `${d.source && d.source !== "program" ? d.source : file}:${d.line}:${d.column}: ${d.code} ${d.message}. ${d.fix}`,
+          `${d.source && d.source !== "program" ? d.source : file}:${d.line}:${d.column}: ${d.code} ${d.message.replace(/[^.?!]$/, "$&.")} ${d.fix}`,
         );
       if (!result.artifacts || result.verdict !== "valid") return 1;
       if (command === "check") return 0;