@hyperscale0/hsx 1.0.265 → 1.0.284

package/dist/src/std-bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"std-bundle.js","sourceRoot":"","sources":["../../src/std-bundle.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,MAAM,CAAC,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAiB;IACpF,CAAC,aAAa,EAAE,soLAAsoL,CAAC;IACvpL,CAAC,WAAW,EAAE,6wMAA6wM,CAAC;IAC5xM,CAAC,iBAAiB,EAAE,2sNAA2sN,CAAC;IAChuN,CAAC,YAAY,EAAE,yjQAAyjQ,CAAC;IACzkQ,CAAC,eAAe,EAAE,6nrFAA6nrF,CAAC;IAChprF,CAAC,eAAe,EAAE,41LAA41L,CAAC;IAC/2L,CAAC,aAAa,EAAE,03UAA03U,CAAC;IAC34U,CAAC,iBAAiB,EAAE,syTAAsyT,CAAC;IAC3zT,CAAC,WAAW,EAAE,8zYAA8zY,CAAC;IAC70Y,CAAC,eAAe,EAAE,ir2BAAir2B,CAAC;IACps2B,CAAC,aAAa,EAAE,4hKAA4hK,CAAC;IAC7iK,CAAC,YAAY,EAAE,2zIAA2zI,CAAC;CAC50I,CAAC,CAAC"}
+{"version":3,"file":"std-bundle.js","sourceRoot":"","sources":["../../src/std-bundle.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,MAAM,CAAC,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAiB;IACpF,CAAC,aAAa,EAAE,m7LAAm7L,CAAC;IACp8L,CAAC,WAAW,EAAE,6wMAA6wM,CAAC;IAC5xM,CAAC,iBAAiB,EAAE,qrNAAqrN,CAAC;IAC1sN,CAAC,YAAY,EAAE,mkOAAmkO,CAAC;IACnlO,CAAC,eAAe,EAAE,kinFAAkinF,CAAC;IACrjnF,CAAC,eAAe,EAAE,41LAA41L,CAAC;IAC/2L,CAAC,aAAa,EAAE,03UAA03U,CAAC;IAC34U,CAAC,iBAAiB,EAAE,syTAAsyT,CAAC;IAC3zT,CAAC,WAAW,EAAE,ogYAAogY,CAAC;IACnhY,CAAC,cAAc,EAAE,svJAAsvJ,CAAC;IACxwJ,CAAC,eAAe,EAAE,4o1BAA4o1B,CAAC;IAC/p1B,CAAC,aAAa,EAAE,4hKAA4hK,CAAC;IAC7iK,CAAC,YAAY,EAAE,2zIAA2zI,CAAC;CAC50I,CAAC,CAAC"}

package/docs/README.md

@@ -42,10 +42,10 @@ hsx cost lesson.hsx
 `check` exits zero without output on success. `build` writes canonical UDL;
 without `--out` it prints to stdout. `cost` prints instruction counts, described
 below. `format` prints formatted source or writes it with `--out`. `headers --json`
-prints the header manifest. These commands have no `--strict` or `--catalog` option.
-Exit 1 means invalid source; exit 2 means a command or file error. Diagnostics name
-the source, line, column, code, problem and suggested fix. UDL validation keeps
-its UDL diagnostic codes; binding errors can have names such as
+prints the header manifest. Exit 1 means invalid source; exit 2 means a command
+or file error. Diagnostics name the source, line, column, code, problem and
+suggested fix. UDL validation keeps its UDL diagnostic codes; binding errors can
+have names such as
 `subject_party_unbound`. Read the message and fix, not just the code.
 
 At runtime, create a lesson object first, then call `book_lesson` to create its
@@ -57,38 +57,37 @@ and party IDs are not metadata supplied by the caller.
 ## A rental deposit in one hour
 
 Open [rental-deposit.hsx](../examples/rental-deposit.hsx). It is a complete source
-file for a business renting equipment from the program operator. Copy it to
+file for a customer renting equipment from the program operator. Copy it to
 `rental.hsx` and run the same check, build and cost commands against that file.
 No header import is needed because it declares its own instrument.
 
-The terms are a 1,000 SAR deposit and a one-time 50 SAR late fee. The supplied
-`dueAt` timestamp is the cutoff: a return before it gets the whole deposit back;
-a return at or after it gets 950 SAR back. The operator receives the other 50 SAR.
-The late fee is not a daily charge and is not `financing.late_charge`, which
+The terms are a 1,000 SAR deposit and one late charge of 50 SAR plus 15% VAT,
+which is 7.50 SAR. The record's `startsAt` and `dueAt` timestamps reach the
+agreement through `rename`, so `agree_rental` reads them from the object. A
+return before `dueAt` gets the whole deposit back; a return at or after it gets
+942.50 SAR back. The operator receives 50 SAR and `programTax` receives 7.50 SAR.
+The late charge is not a daily charge and is not `financing.late_charge`, which
 requires a financing plan and an overdue installment.
 
-| Step                         | Public action           | Actor and required values                                                             | Money effect                                       |
-| ---------------------------- | ----------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------- |
-| Create the object            | Host object creation    | Optional `equipment` metadata                                                         | None                                               |
-| Agree terms                  | `agree_rental`          | Bound renter; `dueAt`, for example `2027-01-10T12:00:00+03:00`, must be in the future | Creates the agreement's held account               |
-| Fund before the cutoff       | `pay_deposit`           | Bound renter with 1,000 SAR available                                                 | Renter pays 1,000 SAR into held                    |
-| Record an on-time return     | `return_equipment`      | Operator; `returnReference` metadata                                                  | Held pays 1,000 SAR to renter                      |
-| Or record a late return      | `return_equipment_late` | Operator; `returnReference` metadata                                                  | Held pays 50 SAR to operator and 950 SAR to renter |
-| Cancel an unfunded agreement | `cancel_rental`         | Bound renter, while pending                                                           | None                                               |
+| Step                         | Public action           | Actor and required values                                                                                 | Money effect                                                           |
+| ---------------------------- | ----------------------- | --------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+| Create the object            | Host object creation    | Optional `equipment`, `serialNumber`, `renterName`, `startsAt` and `dueAt` metadata                       | None                                                                   |
+| Agree terms                  | `agree_rental`          | Bound renter; `startsAt` and `dueAt`, for example `2027-01-10T12:00:00+03:00`, both future, `dueAt` later | Creates the agreement's held account                                   |
+| Fund before pickup           | `pay_deposit`           | Bound renter with 1,000 SAR available, before `startsAt`                                                  | Renter pays 1,000 SAR into held                                        |
+| Record an on-time return     | `return_equipment`      | Operator, before `dueAt`; `returnReference` metadata                                                      | Held pays 1,000 SAR to renter                                          |
+| Or record a late return      | `return_equipment_late` | Operator, at or after `dueAt`; `returnReference` metadata                                                 | Held pays 50 SAR to operator, 7.50 SAR to tax and 942.50 SAR to renter |
+| Cancel before pickup         | `cancel_before_pickup`  | Bound renter on a funded agreement, before `startsAt`                                                     | Held pays 1,000 SAR back to renter                                     |
+| Cancel an unfunded agreement | `cancel_unpaid_rental`  | Bound renter, while pending                                                                               | None                                                                   |
 
 Choose one return action. Both finish the agreement, so the fee and refund cannot
-repeat. The late action calculates the refund from the held balance before either
+repeat. The late action calculates the refund from the held balance before any
 move runs. Both paths empty the held account. `returnReference` records the
 operator's return evidence; it does not verify the physical return. Time means
 the executor's current time when the action runs, not a caller-supplied return date.
 A late `due` permits the operator action; it does not schedule that action.
 
-This sample binds a declared business named `renter` in Product configuration.
-The renter is one business for the whole Build, so the instrument takes no
-parameters. Changing the renter binding is a Build configuration decision, not a
-different party ID on each request. For per-object participants, give a program
-instrument parameters as a header would, such as `instrument purse(holder: party)`,
-and bind `holder: owner` or `holder: actor` in each `attach` block. A
+The renter is a party parameter bound to the rental object's `owner`. Each rental
+can belong to a different customer without a fixed business binding. A
 parameterized program instrument exists only through its attachments. A `fee` on
 a move of an action input, such as `moves input.amount from holder to self.held
 fee { seller: 1% }`, is calculated when that action runs. Reusable custom headers
@@ -97,8 +96,7 @@ this CLI.
 
 Inspect `objects` in the compiled UDL for the attachment and public names, then
 its instrument for fields, transitions, actors, requirements and ordered moves.
-The `hide deposit.*` lines remove public names from the unattached declaration;
-the attachment exposes its own copy. `money.hold` and `escrow.hold` both refund
+`money.hold` and `escrow.hold` both refund
 whole amounts, so neither implements this partial-refund policy by itself.
 
 A local compile gives you a contract. Executing it needs a host with authenticated
@@ -189,7 +187,7 @@ and basis points. Fee and tax calculations round down. Split percentages sum to
 schedules use positions 1 through n and put the division remainder in position 1.
 Amortizing financing is the exception: it rounds half up and puts the remainder in
 the last instalment, as a standard amortization table does.
-Tax binds `programTax`. Fees default to `programOperator`. Fine, recovery and
+Tax binds `programTax`. Fees go to `programOperator`. Fine, recovery and
 residual destinations are party tunables.
 
 Attached actions are private unless the attachment exposes them with
@@ -284,8 +282,9 @@ maxAge 1d` requires a recent completed provider check.
 only to reservations. Fees settle with create moves, never reservations. A fee move
 also derives `<action>_<move>_debit`, the payer's whole debit: amount plus fee and
 tax when the buyer pays, the amount alone when the seller pays. Repeated clauses keep
-their declaration order. The JSON-like clause form remains accepted and lowers
-to the same [UDL clauses](https://github.com/hyperscale0/hyperscale-udl/blob/main/spec/README.md).
+their declaration order. A clause list after a colon, such as `calculate: [{ ... }]`
+or `invoke: [{ ... }]`, writes [UDL clauses](https://github.com/hyperscale0/hyperscale-udl/blob/main/spec/README.md)
+directly; the std headers use it for calculations, `set` and invocations.
 Use `economics { purpose: earning, sourceParty: merchant }` on a move to
 classify posted money. Other purposes are `principal`, `participant_payout`,
 `internal`, `prepaid_credit`, and `pass_through`. `reversalOf: self.originalTransfer` links a
@@ -369,7 +368,8 @@ the selection limit, so a count is an upper bound rather than observed usage.
 Zero-valued moves can cost fewer actual transfers than their static count.
 
 The rental attachment's create declares one owned account, fund declares one
-transfer, on-time return one, and late return two. These are counts, not SAR
+transfer, on-time return one, and late return three: the charge, its VAT and
+the refund. These are counts, not SAR
 prices. The executor's tariff supplies commercial prices and actual usage.
 
 The compiler API is `compile(source)`. On success, `result.verdict` is `valid`
@@ -395,7 +395,16 @@ customer: `financing.limits` and `financing.installments` (borrower),
 (member). Several customers can each start one on the same record. A plan,
 commitment or other reference resolves the sibling that binds the same
 accounts to the parties both share, so each customer's plan finds its own
-escrow and each investor's commitment finds their own wallet.
+checkout and each investor's commitment finds their own wallet.
+
+A financed purchase connects `financing.installments` to `escrow.hold` through
+`purchase.checkout`. Bind the plan's `funds` to checkout, checkout's `funds` to
+the hold, and checkout's `plans` to the plan. Give the hold the funding policy
+`{ controllers: [checkout], reference: "funds", blocking_states: [active] }`.
+If a marketplace reservation contributes a deposit, its `converters` also names
+checkout. Create the hold, then checkout, then the plan. The coordinator collects
+the missing down payment and returns outstanding lender capital before a buyer
+refund. See [library.hsx](../examples/library.hsx) for the complete wiring.
 
 `financing.limits` and `financing.portfolio_limit` declare `scope: product`.
 Create and approve the portfolio limit once per Product and the borrower limit

package/examples/library.hsx

@@ -3,6 +3,7 @@
 program cars "Riyadh used van finance"
 use escrow
 use financing
+use purchase
 party dealer: business
 
 // Bind dealer to the vehicle seller. Set price to its gross 34,500 SAR invoice;
@@ -13,6 +14,7 @@ object car "Financed van purchase" {
   columns: [make, model, year, vin, price]
   attach sale = escrow.hold {
     payer: actor, payee: dealer
+    funding: { controllers: [checkout], reference: "funds", blocking_states: [active] }
     fee: { seller: 2%, tax: 15% }
     deliver_within: 7d, accept_within: 3d
     expose create as agree_van_purchase
@@ -42,10 +44,14 @@ object car "Financed van purchase" {
   // At 34,500 SAR, 2.5% flat profit is 862.50 SAR for the whole term.
   // Financing fee: 0%, tax: 0% on principal; no separate financing service fee.
   // Supply three future monthly dates and a unique settlementIdentity.
+  attach checkout = purchase.checkout {
+    plans: plan, funds: sale, borrower: actor, capital: operator
+    expose create as prepare_financed_purchase
+  }
   attach plan = financing.installments {
     borrower: actor, capital: operator, share: 0%
     months: 3, pricing: flat_total, profit_rate: 2.5%
-    funds: sale, limits: limits, portfolio: ceiling
+    funds: checkout, limits: limits, portfolio: ceiling
     returned_goods: refund_all, refund_within: 30d, write_off_after: 90d
     expose create as finance
     expose sign as sign_finance_agreement

package/examples/rental-deposit.hsx

@@ -1,11 +1,10 @@
-// Dammam equipment hire holds a 1,000 SAR deposit for a business renter.
+// Equipment rental holds a 1,000 SAR deposit for the customer who owns each rental.
 // Return the deposit in full, or deduct a single 50 SAR late charge plus 7.50 SAR VAT.
-program equipment_rental "Dammam equipment hire"
-party renter: business
+program equipment_rental "Equipment rental deposits"
 
-// Bind renter to the business hiring the equipment. The deposit has fee 0%
+// Bind renter to the customer who owns this rental. The deposit has fee 0%
 // and tax 0% because it stays refundable principal. The late service has 15% VAT.
-instrument deposit {
+instrument deposit(renter: party) {
   summary: "Hold security until return, with one disclosed late charge."
   fields {
     renter: account of renter
@@ -56,6 +55,7 @@ object rental "Equipment deposit" {
   fields { equipment: text, serialNumber: text, renterName: text }
   columns: [equipment, serialNumber, renterName, startsAt, dueAt]
   attach security = deposit {
+    renter: owner
     rename { startsAt: startsAt, dueAt: dueAt }
     expose create as agree_rental
     expose fund as pay_deposit
@@ -65,10 +65,3 @@ object rental "Equipment deposit" {
     expose cancel as cancel_unpaid_rental
   }
 }
-
-hide deposit.create
-hide deposit.fund
-hide deposit.return_on_time
-hide deposit.return_late
-hide deposit.refund_before_pickup
-hide deposit.cancel

package/examples/serviced.hsx

@@ -3,6 +3,7 @@
 program car_financing "Dammam delivery van finance"
 use escrow
 use financing
+use purchase
 use collections
 party dealer: business
 
@@ -13,6 +14,7 @@ object car "Delivery van finance" {
   columns: [make, model, year, vin, price]
   attach sale = escrow.hold {
     payer: actor, payee: dealer
+    funding: { controllers: [checkout], reference: "funds", blocking_states: [active] }
     fee: { seller: 1%, tax: 15% }, deliver_within: 14d, accept_within: 3d
     expose create as agree_van_purchase
     expose fund as pay_cash_instead
@@ -40,13 +42,17 @@ object car "Delivery van finance" {
   // Down payment is 6,900 SAR. Capital is 62,100 SAR; total flat profit is
   // 5,278.50 SAR. Financing service fee: 0%, tax: 0% on principal repayments.
   // Supply 36 future monthly dates. Approve limits before collecting and funding.
+  attach checkout = purchase.checkout {
+    plans: plan, funds: sale, borrower: actor, capital: operator
+    expose create as prepare_financed_purchase
+  }
   attach plan = financing.installments {
     borrower: actor, capital: operator, share: 0%
     months: 36, pricing: flat_total, profit_rate: 8.5%, down_payment: 10%
     apply: fines_profit_principal, payoff_rebate: 100%, write_off_after: 90d
     refund_within: 30d, payoff_quote_expiry: 1h, returned_goods: refund_all
     max_extension: 60d, max_amendments: 2, amendment_expiry: 7d
-    funds: sale, limits: limits, portfolio: ceiling
+    funds: checkout, limits: limits, portfolio: ceiling
     expose create as finance
     expose sign as sign_contract
     expose collect_down_payment as pay_down_payment

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperscale0/hsx",
-  "version": "1.0.265",
+  "version": "1.0.284",
   "description": "The strictly typed HSX language: compile total financial programs into canonical UDL.",
   "keywords": [
     "hsx",
@@ -90,8 +90,8 @@
     "bases:bundle": "bun scripts/bundle-bases.ts"
   },
   "dependencies": {
-    "@hyperscale0/adl": "1.0.265",
-    "@hyperscale0/udl": "1.0.265",
+    "@hyperscale0/adl": "1.0.284",
+    "@hyperscale0/udl": "1.0.284",
     "fast-sha256": "1.3.0"
   },
   "devDependencies": {
@@ -103,5 +103,5 @@
     "Amir Ayub",
     "Sara AlBakaawi"
   ],
-  "gitHead": "3bbe4d5b8ed1989e198ac9e803b7317649682988"
+  "gitHead": "f4101f194e0e7c24997b0625ab1d48bec1255508"
 }

package/src/compile.ts

@@ -241,6 +241,24 @@ const automatic = (actor: UdlAction["actor"]) =>
   (actor !== null && typeof actor === "object" && "parent" in actor);
 const title = (name: string) =>
   name[0]!.toUpperCase() + name.slice(1).replaceAll("_", " ");
+/** Parties an instrument names itself: account owners, actors, move endpoints. */
+function namedParties(instrument: UdlInstrument): string[] {
+  const names = instrument.fields.flatMap((field) =>
+    field.type === "account" && typeof field.owner === "string"
+      ? [field.owner]
+      : [],
+  );
+  for (const action of Object.values(instrument.actions)) {
+    if (typeof action.actor === "object" && "party" in action.actor)
+      names.push(action.actor.party);
+    for (const move of action.moves) {
+      if (move.economics) names.push(move.economics.sourceParty);
+      for (const endpoint of "from" in move ? [move.from, move.to] : [])
+        if (endpoint.startsWith("party.")) names.push(endpoint.slice(6));
+    }
+  }
+  return names;
+}
 function entries(block: BlockExpr): Map<string, Expr> {
   const map = new Map<string, Expr>();
   for (const row of block.entries) {
@@ -283,6 +301,12 @@ function text(expr: Expr): string {
   );
 }
 function decimal(raw: string, scale: number, expr: Expr): string {
+  if (raw.startsWith("-"))
+    fail(
+      expr,
+      "literal cannot be negative",
+      "write a positive value; a move's from and to set its direction",
+    );
   const [whole = "", fraction = ""] = raw.split(".");
   if (!/^\d+$/.test(whole) || fraction.length > scale)
     fail(
@@ -389,6 +413,12 @@ function literal(expr: Expr, expectedType?: string): string | number | boolean {
   if (expr.kind === "text") return expr.value;
   if (expr.kind === "name" && ["true", "false"].includes(expr.value))
     return expr.value === "true";
+  if (expr.kind === "name" && expr.value === "runtime")
+    fail(
+      expr,
+      "this value is fixed when the program compiles, so it cannot be runtime",
+      "write a literal value",
+    );
   return fail(expr, "expected a literal", "write a typed constant");
 }
 
@@ -1453,7 +1483,7 @@ export function compile(
               )
                 fail(
                   v,
-                  `${param.key} is outside ${bounds.minimum}..${bounds.maximum}`,
+                  `value is outside ${bounds.minimum}..${bounds.maximum}`,
                   "choose a value inside the tunable's bounds",
                 );
             } catch (error) {
@@ -1524,7 +1554,7 @@ export function compile(
             "name the compared tunables",
           );
         const numericKind = (expr: Expr) =>
-          expr.kind === "name" && /^P/.test(expr.value)
+          expr.kind === "name" && /^P(?:\d|T)/.test(expr.value)
             ? "duration"
             : expr.kind;
         if (
@@ -1627,6 +1657,7 @@ export function compile(
         return lowered;
       };
       const fields: UdlField[] = [];
+      const boundaryReceipts = new Map<string, string>();
       const calculations: UdlCalculation[] = [];
       let currentAction: UdlAction | undefined;
       let currentActionName: string | undefined;
@@ -2070,6 +2101,38 @@ export function compile(
         actions: Object.create(null) as UdlInstrument["actions"],
         actionOrder: [],
       };
+      const actionTargets = new Set<string>();
+      const collectTargets = (block: BlockExpr): void => {
+        for (const entry of block.entries)
+          if (entry.key.startsWith("when "))
+            collectTargets(asBlock(entry.value));
+          else if (entry.key === "calculate")
+            for (const item of entry.value.kind === "list"
+              ? entry.value.items
+              : [entry.value]) {
+              const target =
+                item.kind === "block" ? entries(item).get("target") : undefined;
+              if (target) actionTargets.add(String(data(target)));
+            }
+      };
+      for (const row of decl.body.entries)
+        if (row.key.startsWith("action ")) collectTargets(asBlock(row.value));
+      // Instrument calculations run before every action, create included, so
+      // a fee or split calculates there only on an amount held from create.
+      const heldFromCreate = (amount: UdlValue): boolean => {
+        if (!("field" in amount)) return true;
+        const [root, name, ...rest] = amount.field.split(".");
+        const field = fields.find((item) => item.name === name);
+        return (
+          root === "self" &&
+          !rest.length &&
+          !!field &&
+          !actionTargets.has(name!) &&
+          (!field.optional ||
+            "value" in field ||
+            calculations.some((node) => node.target === name))
+        );
+      };
       for (const row of decl.body.entries.filter((e) =>
         e.key.startsWith("action "),
       )) {
@@ -2407,7 +2470,7 @@ export function compile(
           ...(actionSubject ? { subject: actionSubject } : {}),
         };
         authored.set(a, row.value);
-        const actionFeeCalculations: UdlCalculation[] = [];
+        const moveCalculations: UdlCalculation[] = [];
         for (const binding of boundaryBindings)
           if (
             !a.subject?.adapters.find((entry) => entry.binding === binding)
@@ -2447,12 +2510,28 @@ export function compile(
               const op = parts.has("operation")
                 ? String(data(parts.get("operation")!))
                 : "internal_transfer.create";
-              if (op === "internal_transfer.reserve" && !parts.has("capture"))
-                fail(
-                  move,
-                  "reserve needs a receipt field",
-                  "add capture: receipt_name",
-                );
+              if (op === "internal_transfer.reserve" && !parts.has("capture")) {
+                if (!parts.has("boundary"))
+                  fail(
+                    move,
+                    "reserve needs a receipt field",
+                    "add capture: receipt_name",
+                  );
+                const capture = `${name}Receipt`;
+                if (fields.some((field) => field.name === capture))
+                  fail(
+                    move,
+                    "boundary receipt name is already used",
+                    "name each reservation with an explicit capture",
+                  );
+                fields.push({ name: capture, type: "text", optional: true });
+                boundaryReceipts.set(name, capture);
+                parts.set("capture", {
+                  kind: "text",
+                  value: capture,
+                  span: move.span,
+                });
+              }
               if (
                 (op === "internal_transfer.post" ||
                   op === "internal_transfer.void") &&
@@ -2643,6 +2722,7 @@ export function compile(
                     );
                   let total = 0;
                   const pieces: UdlValue[] = [];
+                  const perAction = !heldFromCreate(val(amount));
                   for (const [index, [party, rate]] of shares.entries()) {
                     const recipient = resolve({
                       kind: "name",
@@ -2694,8 +2774,12 @@ export function compile(
                         "split field name conflicts",
                         "rename the move key",
                       );
-                    fields.push({ name: target, type: "money" });
-                    calculations.push(
+                    fields.push({
+                      name: target,
+                      type: "money",
+                      ...(perAction ? { optional: true } : {}),
+                    });
+                    (perAction ? moveCalculations : calculations).push(
                       index === shares.length - 1 && pieces.length
                         ? {
                             target,
@@ -2797,6 +2881,22 @@ export function compile(
                       "write seller: 1% or buyer: 1%",
                     );
                   const quoted = terms.get(paidBy)!;
+                  // An account the agreement owns holds only what was moved
+                  // into it, so a charge on top has nothing to come from.
+                  if (
+                    paidBy === "buyer" &&
+                    fields.some(
+                      (field) =>
+                        `self.${field.name}` === transfer.from &&
+                        field.type === "account" &&
+                        field.owner === "self",
+                    )
+                  )
+                    fail(
+                      quoted,
+                      `a buyer fee cannot come from \`${transfer.from.slice("self.".length)}\`, which holds only the moved amount`,
+                      "use a seller fee, which comes out of the held amount",
+                    );
                   const rate = quoted.kind === "capped" ? quoted.rate : quoted;
                   if (rate.kind !== "percent")
                     fail(
@@ -2805,11 +2905,7 @@ export function compile(
                       "write a percentage such as 1%",
                     );
                   const prefix = `${name}_${key}`;
-                  // Instrument calculations run at create, before any action
-                  // input exists, so a fee on an input amount runs with its action.
-                  const perAction =
-                    "field" in transfer.amount &&
-                    transfer.amount.field.startsWith("input.");
+                  const perAction = !heldFromCreate(transfer.amount);
                   const derived = (
                     suffix: string,
                     label: string,
@@ -2828,7 +2924,7 @@ export function compile(
                       label,
                       ...(perAction ? { optional: true } : {}),
                     });
-                    (perAction ? actionFeeCalculations : calculations).push({
+                    (perAction ? moveCalculations : calculations).push({
                       ...calculation,
                       target,
                     } as UdlCalculation);
@@ -2960,8 +3056,8 @@ export function compile(
             }
           } else (a as unknown as Record<string, unknown>)[key] = data(expr);
         }
-        if (actionFeeCalculations.length)
-          a.calculate = [...(a.calculate ?? []), ...actionFeeCalculations];
+        if (moveCalculations.length)
+          a.calculate = [...(a.calculate ?? []), ...moveCalculations];
         if (attachmentInfo) {
           if (attachmentInfo.exposed.has(name)) {
             if (automatic(a.actor))
@@ -3060,6 +3156,14 @@ export function compile(
         inst.actions[name] = a;
         inst.actionOrder.push(name);
       }
+      for (const action of Object.values(inst.actions))
+        for (const move of action.moves)
+          if ("transfer" in move) {
+            const receipt = boundaryReceipts.get(
+              move.transfer.replace(/^self\./, ""),
+            );
+            if (receipt) move.transfer = `self.${receipt}`;
+          }
       if (attachmentInfo && !attachmentInfo.child)
         applyAttachmentEconomics(
           document,
@@ -3339,6 +3443,21 @@ export function compile(
           bindingDiagnostics.push(error.diagnostic);
           continue;
         }
+        // A business the instrument names itself binds like a parameter, so
+        // Build asks for it and the engine resolves its account and principal.
+        // programOperator and programTax are the company's own accounts.
+        for (const party of document.instruments
+          .slice(firstAttachedInstrument)
+          .flatMap(namedParties))
+          if (
+            document.parties[party]?.kind === "business" &&
+            party !== "programOperator" &&
+            party !== "programTax" &&
+            !Object.values(parties).some(
+              (binding) => "party" in binding && binding.party === party,
+            )
+          )
+            parties[party] ??= { party };
         const attachedInst = document.instruments.find((i) => i.id === instId);
         for (const createdInst of document.instruments
           .slice(firstAttachedInstrument)