@hyperscale0/udl 2.6.1 → 3.0.1

package/dist/finance.js

@@ -1,755 +1,251 @@
-import { UDL_LIMITS } from "./limits.js";
-const EMPTY = { kind: "empty" };
-const UNKNOWN = { kind: "unknown" };
-// A funded balance is the exact set of amount identities currently held.
-// Distinct identities stack (a partitioned funding); re-crediting an identity
-// already present degrades to unknown, which keeps the state space finite.
-function funded(amounts) {
-    if (amounts.length === 0)
-        return EMPTY;
-    return { kind: "funded", amounts: [...amounts].sort() };
-}
-function withoutPiece(amounts, amount) {
-    const index = amounts.indexOf(amount);
-    return amounts.filter((_, position) => position !== index);
-}
-/**
- * One financial typestate owner for canonical UDL and static instrument contracts.
- * It proves a tracked escrow account holds an exact set of funded amounts,
- * models held transfers through reserve/post/void, consumes every direct
- * debit piece by piece, and makes the quoted refund's sole remainder an
- * exactly-once penalty payout.
- */
-export function analyzeInstrumentFinance(instrument, options = {}) {
-    const issues = [];
-    const seenIssues = new Set();
-    const add = (path, message, code = "UDL4001") => {
-        const key = `${path.join(".")}\0${message}`;
-        if (seenIssues.has(key))
-            return;
-        seenIssues.add(key);
-        issues.push({ code, message, path });
-    };
-    const admissionProblem = financeAdmissionProblem(instrument);
-    if (admissionProblem) {
-        add(["lifecycle"], admissionProblem, "UDL1004");
-        return issues;
-    }
-    const trackedAccounts = productEscrowAccounts(instrument);
-    const quotes = quoteFacts(instrument, options);
-    const refundSources = new Map();
-    for (const quote of quotes) {
-        const commitTransfer = instrument.actions[quote.commit]?.moves?.filter((move) => move.operation === "internal_transfer.create")[0];
-        const source = canonicalAccount(instrument, commitTransfer?.bind.sourceAccountId);
-        if (!source)
-            continue;
-        refundSources.set(quote.commit, source);
-        trackedAccounts.add(source);
-    }
-    const refundSourceAccounts = new Set(refundSources.values());
-    for (const quote of quotes) {
-        validateChargePayout(instrument, quote, refundSources.get(quote.commit), add);
-    }
-    if (trackedAccounts.size === 0)
-        return issues;
-    if (trackedAccounts.size > UDL_LIMITS.financeAccounts) {
-        add(["actions"], `financial analysis exceeds ${UDL_LIMITS.financeAccounts} tracked accounts`, "UDL1004");
-        return issues;
-    }
-    const reservations = reservationsByKey(instrument);
-    let pathVariants = 0;
-    let work = 0;
-    for (const account of trackedAccounts) {
-        const effects = effectsByAction(instrument, account, reservations, quotes);
-        const createEffects = effects.get("create") ?? [];
-        work += 1 + createEffects.length;
-        if (work > UDL_LIMITS.financeWork) {
-            add(["lifecycle"], `financial analysis exceeds ${UDL_LIMITS.financeWork} deterministic work units`, "UDL1004");
-            return issues;
-        }
-        const initial = applyEffects(instrument, account, "create", { balance: EMPTY, holds: {} }, createEffects, reservations, refundSourceAccounts.has(account), add);
-        const states = new Map([
-            [instrument.lifecycle.initial, new Map([[stateKey(initial), initial]])],
-        ]);
-        pathVariants += 1;
-        const pending = [instrument.lifecycle.initial];
-        while (pending.length > 0) {
-            const from = pending.shift();
-            const sourceStates = states.get(from);
-            if (!sourceStates)
-                continue;
-            for (const [action, transition] of Object.entries(instrument.lifecycle.transitions)) {
-                if (!transition.from.includes(from))
-                    continue;
-                const targetStates = states.get(transition.to) ?? new Map();
-                states.set(transition.to, targetStates);
-                let grew = false;
-                for (const sourceState of sourceStates.values()) {
-                    const transitionEffects = effects.get(action) ?? [];
-                    work += 1 + transitionEffects.length;
-                    if (work > UDL_LIMITS.financeWork) {
-                        add(["lifecycle"], `financial analysis exceeds ${UDL_LIMITS.financeWork} deterministic work units`, "UDL1004");
-                        return issues;
-                    }
-                    const targetState = applyEffects(instrument, account, action, sourceState, transitionEffects, reservations, refundSourceAccounts.has(account), add);
-                    const key = stateKey(targetState);
-                    if (targetStates.has(key))
-                        continue;
-                    targetStates.set(key, targetState);
-                    pathVariants += 1;
-                    if (pathVariants > UDL_LIMITS.financePathVariants) {
-                        add(["lifecycle"], `financial analysis exceeds ${UDL_LIMITS.financePathVariants} distinct path variants`, "UDL1004");
-                        return issues;
-                    }
-                    grew = true;
-                }
-                if (grew && !pending.includes(transition.to))
-                    pending.push(transition.to);
-            }
-        }
-        const nonterminalStates = new Set(Object.values(instrument.lifecycle.transitions).flatMap((transition) => transition.from));
-        if (account.startsWith("ref:")) {
-            for (const [state, variants] of states) {
-                if (nonterminalStates.has(state))
-                    continue;
-                for (const variant of variants.values()) {
-                    if (variant.balance.kind === "empty" &&
-                        Object.keys(variant.holds).length === 0) {
-                        continue;
+const add = (a, b, sign = 1n) => {
+    if (a === null || b === null)
+        return null;
+    const result = new Map(a);
+    for (const [key, value] of b) {
+        const next = (result.get(key) ?? 0n) + value * sign;
+        if (next)
+            result.set(key, next);
+        else
+            result.delete(key);
+    }
+    return result;
+};
+const show = (sum) => sum === null
+    ? "unknown"
+    : JSON.stringify([...sum]
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([key, value]) => [key, String(value)]));
+const same = (a, b) => show(a) === show(b);
+/** Join loop balances conservatively; a balance equality proves an unknown balance empty. */
+export function analyzeInstrumentFinance(instrument, document) {
+    const owned = new Set(instrument.fields
+        .filter((f) => f.type === "account" && f.owner === "self")
+        .map((f) => `self.${f.name}`));
+    const shared = new Set();
+    for (const owner of document?.instruments ?? []) {
+        if (owner.id === instrument.id)
+            continue;
+        for (const action of Object.values(owner.actions))
+            for (const move of action.moves)
+                if ("amount" in move)
+                    for (const endpoint of [move.from, move.to]) {
+                        const parts = endpoint.split(".");
+                        if (parts.shift() !== "self")
+                            continue;
+                        let targets = [owner];
+                        while (parts.length > 1) {
+                            const key = parts.shift();
+                            targets = targets.flatMap((target) => {
+                                const reference = target.fields.find((field) => field.name === key);
+                                if (reference?.type !== "ref")
+                                    return [];
+                                const ids = typeof reference.target === "string"
+                                    ? [reference.target]
+                                    : reference.target;
+                                return (document?.instruments.filter((candidate) => ids.includes(candidate.id)) ?? []);
+                            });
+                        }
+                        if (parts.length === 1 &&
+                            targets.some((target) => target.id === instrument.id) &&
+                            owned.has(`self.${parts[0]}`))
+                            shared.add(`self.${parts[0]}`);
                     }
-                    add(["lifecycle", "states", instrument.lifecycle.states.indexOf(state)], `terminal state ${state} can strand value in ${formatAccount(account)}`);
-                }
-            }
-        }
-    }
-    return issues;
-}
-export function financeAdmissionProblem(instrument) {
-    if (instrument.lifecycle.states.length > UDL_LIMITS.financeStates) {
-        return `financial analysis exceeds ${UDL_LIMITS.financeStates} lifecycle states`;
-    }
-    let transitionCount = 0;
-    let transitionEdges = 0;
-    for (const name in instrument.lifecycle.transitions) {
-        if (!Object.hasOwn(instrument.lifecycle.transitions, name))
-            continue;
-        transitionCount += 1;
-        if (transitionCount > UDL_LIMITS.financeTransitions) {
-            return `financial analysis exceeds ${UDL_LIMITS.financeTransitions} lifecycle transitions`;
-        }
-        transitionEdges += instrument.lifecycle.transitions[name]?.from.length ?? 0;
-        if (transitionEdges > UDL_LIMITS.financeTransitionEdges) {
-            return `financial analysis exceeds ${UDL_LIMITS.financeTransitionEdges} lifecycle transition edges`;
-        }
     }
-    let actionCount = 0;
-    let effectCount = 0;
-    for (const name in instrument.actions) {
-        if (!Object.hasOwn(instrument.actions, name))
-            continue;
-        actionCount += 1;
-        if (actionCount > UDL_LIMITS.financeActions) {
-            return `financial analysis exceeds ${UDL_LIMITS.financeActions} actions`;
-        }
-        const action = instrument.actions[name];
-        effectCount += (action?.steps.length ?? 0) + (action?.moves?.length ?? 0);
-        if (effectCount > UDL_LIMITS.financeEffects) {
-            return `financial analysis exceeds ${UDL_LIMITS.financeEffects} kernel effects`;
-        }
-    }
-    return undefined;
-}
-function productEscrowAccounts(instrument) {
-    const accounts = new Set();
-    for (const action of Object.values(instrument.actions)) {
-        for (const step of action.steps) {
-            // This operation fixes the escrow role; an omitted redundant binding
-            // must not exempt its captured account from the conservation proof.
-            if (step.operation !== "account.escrow.provision")
-                continue;
-            for (const [key, result] of Object.entries(step.capture ?? {})) {
-                if (result === "accountId")
-                    accounts.add(`ref:${key}`);
-            }
-        }
-    }
-    // `product_escrow` also backs open-ended balance products such as wallets.
-    // Only instance-bound amounts claim static conservation; caller-sized flows
-    // remain runtime balance checks. Commit sources are added separately above.
-    return new Set([...accounts].filter((account) => Object.values(instrument.actions).some((action) => {
-        if (action.contributionStage &&
-            canonicalAccountPath(instrument, action.contributionStage.accountPath) === account) {
-            return true;
-        }
-        return (action.moves ?? []).some((step) => {
-            if ((step.operation !== "internal_transfer.create" &&
-                step.operation !== "internal_transfer.reserve") ||
-                step.bind.amount?.from !== "instance") {
-                return false;
-            }
-            return (canonicalAccount(instrument, step.bind.sourceAccountId) ===
-                account ||
-                canonicalAccount(instrument, step.bind.destinationAccountId) ===
-                    account);
-        });
-    })));
-}
-function reservationsByKey(instrument) {
-    const reservations = new Map();
-    for (const action of Object.values(instrument.actions)) {
-        for (const step of action.moves ?? []) {
-            if (step.operation !== "internal_transfer.reserve")
-                continue;
-            const source = canonicalAccount(instrument, step.bind.sourceAccountId);
-            const destination = canonicalAccount(instrument, step.bind.destinationAccountId);
-            const amount = amountIdentity(step.bind.amount);
-            for (const [key, result] of Object.entries(step.capture ?? {})) {
-                if (result === "transferId") {
-                    reservations.set(key, {
-                        amount,
-                        ...(destination ? { destination } : {}),
-                        ...(source ? { source } : {}),
-                    });
-                }
-            }
-        }
-    }
-    return reservations;
-}
-function effectsByAction(instrument, account, reservations, quotes) {
-    const quoteByCommit = new Map(quotes.map((quote) => [quote.commit, quote]));
-    const chargePaths = new Map(quotes.map((quote) => [`refs.${quote.chargeRef}`, quote]));
-    return new Map(Object.entries(instrument.actions).map(([actionName, action]) => {
-        const stageEffects = [];
-        if (action.contributionStage && instrument.contributions) {
-            const stage = action.contributionStage;
-            const stageAccount = canonicalAccountPath(instrument, stage.accountPath);
-            if (stageAccount &&
-                accountsMayAlias(instrument, stageAccount, account)) {
-                const path = ["actions", actionName, "contributionStage"];
-                const totalAmount = `fields.${instrument.contributions.totalField}`;
-                if (stage.stage === "fund") {
-                    stageEffects.push({
-                        amount: totalAmount,
-                        kind: "credit",
-                        path,
-                    });
-                }
-                else if (stage.stage === "refund") {
-                    stageEffects.push({
-                        amount: totalAmount,
-                        kind: "debit",
-                        path,
-                    });
-                }
-            }
-        }
-        const moveEffects = (action.moves ?? []).flatMap((step, stepIndex) => {
-            const path = [
-                "actions",
-                actionName,
-                "moves",
-                stepIndex,
-                "bind",
-            ];
-            if (step.operation === "internal_transfer.create") {
-                const effects = [];
-                const amount = amountIdentity(step.bind.amount);
-                if (canonicalAccount(instrument, step.bind.destinationAccountId) ===
-                    account) {
-                    effects.push({ amount, kind: "credit", path });
-                }
-                const source = canonicalAccount(instrument, step.bind.sourceAccountId);
-                if (source && accountsMayAlias(instrument, source, account)) {
-                    const committed = quoteByCommit.get(actionName);
-                    const amountPath = step.bind.amount?.from === "instance"
-                        ? step.bind.amount.path
-                        : undefined;
-                    const refunded = committed && amountPath === `refs.${committed.netRef}`
-                        ? committed
-                        : undefined;
-                    const charged = amountPath
-                        ? chargePaths.get(amountPath)
-                        : undefined;
-                    const kind = refunded
-                        ? "refund"
-                        : charged
-                            ? "penalty_debit"
-                            : amountPath !== undefined
-                                ? "debit"
-                                : "dynamic_debit";
-                    effects.push({
-                        amount: refunded && !refunded.chargeCanBeNonzero
-                            ? "refund_without_penalty"
-                            : amount,
-                        kind,
-                        path,
-                        ...(refunded ? { refundable: refunded.baseField } : {}),
-                    });
-                }
-                return effects;
-            }
-            if (step.operation === "internal_transfer.reserve") {
-                const reservation = transferRefKey(step) ?? `${actionName}:${stepIndex}`;
-                const effects = [];
-                const source = canonicalAccount(instrument, step.bind.sourceAccountId);
-                if (source && accountsMayAlias(instrument, source, account)) {
-                    effects.push({
-                        amount: amountIdentity(step.bind.amount),
-                        kind: "outgoing_reserve",
-                        path,
-                        reservation,
-                    });
-                }
-                if (canonicalAccount(instrument, step.bind.destinationAccountId) ===
-                    account) {
-                    effects.push({
-                        amount: amountIdentity(step.bind.amount),
-                        kind: "incoming_reserve",
-                        path,
-                        reservation,
-                    });
-                }
-                return effects;
-            }
-            if (step.operation === "internal_transfer.post" ||
-                step.operation === "internal_transfer.void") {
-                const reservation = boundTransferRefKey(step);
-                if (!reservation)
-                    return [];
-                const reserved = reservations.get(reservation);
-                if (!reserved ||
-                    (!(reserved.source &&
-                        accountsMayAlias(instrument, reserved.source, account)) &&
-                        reserved.destination !== account)) {
-                    return [];
-                }
-                return [
-                    {
-                        amount: reserved.amount,
-                        kind: step.operation === "internal_transfer.post" ? "post" : "void",
-                        path,
-                        reservation,
-                    },
+    const problems = [];
+    const report = (message) => problems.push({ path: ".actions", message });
+    const equations = new Map();
+    for (const field of instrument.fields)
+        if (field.type === "money" && field.value !== undefined)
+            equations.set(`self.${field.name}`, new Map([["#", BigInt(field.value)]]));
+    for (const calc of instrument.calculate) {
+        if (calc.op === "sum" || calc.op === "subtract") {
+            const terms = calc.op === "sum"
+                ? calc.values.map((v) => [v, 1n])
+                : [
+                    [calc.base, 1n],
+                    ...calc.subtract.map((v) => [v, -1n]),
                 ];
-            }
-            return [];
-        });
-        return [actionName, [...stageEffects, ...moveEffects]];
-    }));
-}
-function getInstrumentPartitions(instrument) {
-    if (!instrument.partitions)
-        return [];
-    const partitions = [];
-    for (const p of instrument.partitions) {
-        if (!p.totalField || !p.pieceFields || p.pieceFields.length === 0)
-            continue;
-        const total = `fields.${p.totalField}`;
-        const pieces = p.pieceFields.map((f) => `fields.${f}`);
-        if (new Set(pieces).size !== pieces.length)
-            continue;
-        if (pieces.includes(total) && pieces.length > 1)
-            continue;
-        partitions.push({ total, pieces });
-    }
-    return partitions;
-}
-function tryPartitionSubstitution(instrument, balance, holds, exchanged, targetAmount) {
-    if (exchanged)
-        return null;
-    if (balance.kind !== "funded")
-        return null;
-    if (Object.keys(holds).length > 0)
-        return null;
-    const declaredPartitions = getInstrumentPartitions(instrument);
-    if (declaredPartitions.length === 0)
-        return null;
-    for (const pOut of declaredPartitions) {
-        const total = pOut.total;
-        let candidateOutPieces = null;
-        if (pOut.pieces.includes(targetAmount)) {
-            candidateOutPieces = pOut.pieces;
-        }
-        else if (targetAmount === total) {
-            candidateOutPieces = [total];
-        }
-        if (!candidateOutPieces)
-            continue;
-        if (candidateOutPieces.length === 0)
-            continue;
-        if (new Set(candidateOutPieces).size !== candidateOutPieces.length)
-            continue;
-        const incomingCandidates = [];
-        if (balance.amounts.includes(total)) {
-            incomingCandidates.push([total]);
-        }
-        for (const pIn of declaredPartitions) {
-            if (pIn.total !== total)
-                continue;
-            if (pIn.pieces.every((piece) => balance.amounts.includes(piece))) {
-                incomingCandidates.push(pIn.pieces);
-            }
-        }
-        for (const candidateInPieces of incomingCandidates) {
-            if (candidateInPieces.length === candidateOutPieces.length &&
-                candidateInPieces.every((piece) => candidateOutPieces.includes(piece))) {
-                continue;
-            }
-            if (balance.amounts.length === candidateInPieces.length &&
-                candidateInPieces.every((piece) => balance.amounts.includes(piece))) {
-                return funded(candidateOutPieces);
-            }
-        }
-    }
-    return null;
-}
-function applyEffects(instrument, account, action, input, effects, reservations, exactBalance, add) {
-    let balance = input.balance;
-    const holds = { ...input.holds };
-    let exchanged = input.exchanged ?? false;
-    const accountLabel = formatAccount(account);
-    for (const effect of effects) {
-        const fail = (message) => add([...effect.path, "sourceAccountId"], `action ${action} ${message}`);
-        if (effect.kind === "credit") {
-            if (exactBalance &&
-                (balance.kind !== "empty" || Object.keys(holds).length > 0)) {
-                add([...effect.path, "destinationAccountId"], `action ${action} funds ${accountLabel} while earlier value may remain; quoted funding must establish exactly one refundable balance`);
-                balance = UNKNOWN;
-                continue;
-            }
-            const pieces = balance.kind === "funded" ? balance.amounts : [];
-            const stacks = (balance.kind === "empty" || balance.kind === "funded") &&
-                !pieces.includes(effect.amount);
-            balance = stacks ? funded([...pieces, effect.amount]) : UNKNOWN;
-            continue;
-        }
-        if (effect.kind === "incoming_reserve")
-            continue;
-        if (effect.kind === "outgoing_reserve") {
-            let held = balance.kind === "funded" && balance.amounts.includes(effect.amount);
-            if (!held && balance.kind === "funded") {
-                const substituted = tryPartitionSubstitution(instrument, balance, holds, exchanged, effect.amount);
-                if (substituted !== null) {
-                    exchanged = true;
-                    balance = substituted;
-                    held =
-                        balance.kind === "funded" &&
-                            balance.amounts.includes(effect.amount);
-                }
-            }
-            if (!held) {
-                fail(`cannot reserve ${effect.amount} from ${accountLabel}; that exact balance is not guaranteed`);
-            }
-            holds[effect.reservation] = held
-                ? { kind: "funded", amounts: [effect.amount] }
-                : UNKNOWN;
-            balance =
-                held && balance.kind === "funded"
-                    ? funded(withoutPiece(balance.amounts, effect.amount))
-                    : EMPTY;
-            continue;
-        }
-        if (effect.kind === "post" || effect.kind === "void") {
-            const key = effect.reservation;
-            const reservation = reservations.get(key);
-            if (reservation?.source &&
-                accountsMayAlias(instrument, reservation.source, account)) {
-                const held = holds[key];
-                delete holds[key];
-                if (effect.kind === "void" && held) {
-                    const pieces = balance.kind === "funded" ? balance.amounts : [];
-                    const restorable = held.kind === "funded" &&
-                        (balance.kind === "empty" ||
-                            (balance.kind === "funded" &&
-                                held.amounts.every((piece) => !pieces.includes(piece))));
-                    if (restorable && held.kind === "funded") {
-                        balance = funded([...pieces, ...held.amounts]);
-                    }
-                    else if (balance.kind === "empty") {
-                        balance = held;
+            let result = new Map();
+            for (const [value, sign] of terms)
+                result = add(result, raw(value, "create"), sign);
+            equations.set(`self.${calc.target}`, result);
+        }
+    }
+    function raw(value, invocation) {
+        return "field" in value
+            ? new Map([
+                [
+                    value.field.startsWith("input.")
+                        ? `${invocation}:${value.field}`
+                        : value.field,
+                    1n,
+                ],
+            ])
+            : new Map([["#", BigInt(String(value.literal))]]);
+    }
+    function expand(sum, seen = new Set()) {
+        let result = new Map();
+        for (const [key, coefficient] of sum) {
+            const equation = equations.get(key);
+            result = add(result, equation && !seen.has(key)
+                ? expand(equation, new Set([...seen, key]))
+                : new Map([[key, 1n]]), coefficient);
+        }
+        return result;
+    }
+    let invocation = 0;
+    const apply = (state, action, name) => {
+        const scope = `${name}#${invocation++}`;
+        const calculated = new Map();
+        const local = new Map((action.calculate ?? []).map((c) => [`self.${c.target}`, c]));
+        const amount = (value, seen = new Set()) => {
+            if ("field" in value) {
+                if (calculated.has(value.field))
+                    return calculated.get(value.field);
+                if (value.field.endsWith(".balance") &&
+                    owned.has(value.field.slice(0, -8)))
+                    return state.balances.get(value.field.slice(0, -8)) ?? null;
+                const calculation = local.get(value.field);
+                if (calculation && !seen.has(value.field)) {
+                    const next = new Set([...seen, value.field]);
+                    if (calculation.op === "sum")
+                        return calculation.values.reduce((sum, value) => add(sum, amount(value, next)), new Map());
+                    if (calculation.op === "subtract")
+                        return calculation.subtract.reduce((sum, value) => add(sum, amount(value, next), -1n), amount(calculation.base, next));
+                    return new Map([[`${scope}:${value.field}`, 1n]]);
+                }
+            }
+            return expand(raw(value, scope));
+        };
+        for (const requirement of action.requires)
+            if (requirement.kind === "compare" && requirement.operator === "==") {
+                for (const [left, right] of [
+                    [requirement.left, requirement.right],
+                    [requirement.right, requirement.left],
+                ]) {
+                    if ("field" in left && left.field.endsWith(".balance")) {
+                        const account = left.field.slice(0, -8);
+                        if (owned.has(account))
+                            state.balances.set(account, amount(right));
                     }
-                    else {
-                        add([...effect.path, "transferId"], `action ${action} restores a held ${accountLabel} balance on top of existing value`);
-                        balance = UNKNOWN;
-                    }
-                }
-            }
-            if (effect.kind === "post" && reservation?.destination === account) {
-                if (balance.kind !== "empty" || Object.keys(holds).length > 0) {
-                    add([...effect.path, "transferId"], `action ${action} posts funding into ${accountLabel} while earlier value may remain`);
-                    balance = UNKNOWN;
-                }
-                else {
-                    balance = { kind: "funded", amounts: [effect.amount] };
                 }
             }
-            continue;
-        }
-        if (effect.kind === "refund") {
-            const refundable = `fields.${effect.refundable ?? ""}`;
-            if (balance.kind !== "funded" ||
-                balance.amounts.length !== 1 ||
-                balance.amounts[0] !== refundable) {
-                fail(`cannot refund ${refundable} from ${accountLabel}; that exact balance is not guaranteed`);
-                balance = UNKNOWN;
+        for (const key of local.keys())
+            calculated.set(key, amount({ field: key }));
+        const debit = (account, value) => {
+            if (owned.has(account))
+                state.balances.set(account, add(state.balances.has(account)
+                    ? state.balances.get(account)
+                    : new Map(), value, -1n));
+        };
+        const credit = (account, value) => {
+            if (owned.has(account))
+                state.balances.set(account, add(state.balances.has(account)
+                    ? state.balances.get(account)
+                    : new Map(), value));
+        };
+        for (const move of action.moves) {
+            if ("amount" in move) {
+                const value = amount(move.amount);
+                debit(move.from, value);
+                if (move.operation === "internal_transfer.reserve") {
+                    const key = `self.${move.capture}`;
+                    if (state.holds.has(key))
+                        report(`${move.capture} overwrites a live reservation`);
+                    state.holds.set(key, { from: move.from, to: move.to, amount: value });
+                }
+                else
+                    credit(move.to, value);
             }
             else {
-                balance =
-                    effect.amount === "refund_without_penalty"
-                        ? EMPTY
-                        : { kind: "penalty" };
-            }
-            continue;
-        }
-        if (effect.kind === "penalty_debit") {
-            if (balance.kind !== "penalty") {
-                fail(`cannot pay the quoted charge from ${accountLabel} before the refund leaves that exact remainder`);
-            }
-            balance = EMPTY;
-            continue;
-        }
-        if (effect.kind === "dynamic_debit") {
-            if (balance.kind === "empty") {
-                fail(`can debit unfunded ${accountLabel}`);
-            }
-            else if (balance.kind === "penalty") {
-                fail(`can debit ${accountLabel} after its refund left only the quoted charge`);
-            }
-            balance = balance.kind === "empty" ? EMPTY : { kind: "unknown" };
-            continue;
-        }
-        if (balance.kind === "funded") {
-            if (balance.amounts.includes(effect.amount)) {
-                balance = funded(withoutPiece(balance.amounts, effect.amount));
-                continue;
-            }
-            const substituted = tryPartitionSubstitution(instrument, balance, holds, exchanged, effect.amount);
-            if (substituted !== null) {
-                exchanged = true;
-                balance = substituted;
-                if (balance.kind === "funded" &&
-                    balance.amounts.includes(effect.amount)) {
-                    balance = funded(withoutPiece(balance.amounts, effect.amount));
+                const hold = state.holds.get(move.transfer);
+                if (!hold) {
+                    report(`${move.key} consumes a missing reservation ${move.transfer}`);
                     continue;
                 }
+                credit(move.operation === "internal_transfer.post" ? hold.to : hold.from, hold.amount);
+                state.holds.delete(move.transfer);
             }
         }
-        if (balance.kind === "empty") {
-            fail(exchanged
-                ? `cannot prove ${effect.amount} is available after the substituted partition was spent from ${accountLabel}`
-                : `can debit unfunded ${accountLabel}`);
-        }
-        else if (balance.kind === "penalty") {
-            fail(`can debit ${accountLabel} after its refund left only the quoted charge`);
-        }
-        else if (balance.kind === "funded" || exactBalance) {
-            fail(`cannot prove ${effect.amount} is the exact available balance of ${accountLabel}`);
-        }
-        balance = EMPTY;
-    }
-    // A held account permits at most one equal-partition substitution per funded
-    // balance, preventing cycles, duplicate minting, and double spending. When an
-    // account is completely drained to empty with no active holds, the exchange
-    // record resets for any distinct subsequent funding.
-    if (balance.kind === "empty" && Object.keys(holds).length === 0) {
-        exchanged = false;
-    }
-    return { balance, holds, exchanged };
-}
-/**
- * Flattens every quote-commit pair the instrument declares. A quoting action
- * with no committing action, or a commit naming a non-quoting action, is a
- * validator failure rather than a typestate one, so it is simply skipped here.
- */
-function quoteFacts(instrument, options) {
-    const facts = [];
-    for (const [quoting, action] of Object.entries(instrument.actions)) {
-        const quote = action.quote;
-        if (!quote)
-            continue;
-        const commit = Object.entries(instrument.actions).find(([, candidate]) => candidate.commit === quoting)?.[0];
-        if (commit === undefined)
-            continue;
-        const chargePath = `refs.${quote.chargeRef}`;
-        const declaresChargePayout = Object.values(instrument.actions).some((candidate) => (candidate.moves ?? []).some((move) => Object.values(move.bind).some((binding) => binding.from === "instance" && binding.path === chargePath)));
-        facts.push({
-            baseField: quote.baseField,
-            chargeCanBeNonzero: options.penaltyMayBeNonzero === true ||
-                declaresChargePayout ||
-                quote.charges.some((tier) => tier.bps > 0),
-            chargeRef: quote.chargeRef,
-            chargeRetainedBy: quote.chargeRetainedBy,
-            commit,
-            netRef: quote.netRef,
-            quoting,
-        });
-    }
-    return facts;
-}
-/**
- * The quoted charge is the exact remainder the commit leaves behind, so it may
- * fund one transfer, out of the same account the refund left, in its own
- * one-way action directly after the commit.
- */
-function validateChargePayout(instrument, quote, refundSource, add) {
-    const chargePath = `refs.${quote.chargeRef}`;
-    const uses = Object.entries(instrument.actions).flatMap(([actionName, action]) => (action.moves ?? []).flatMap((step, stepIndex) => Object.entries(step.bind).flatMap(([target, binding]) => binding.from === "instance" && binding.path === chargePath
-        ? [{ binding, step, stepIndex, target, action, actionName }]
-        : [])));
-    if (quote.chargeRetainedBy !== undefined) {
-        const role = quote.chargeRetainedBy;
-        const partyField = Object.hasOwn(instrument.parties ?? {}, role)
-            ? instrument.parties?.[role]
-            : undefined;
-        if (!partyField) {
-            add(["actions", quote.quoting, "quote", "chargeRetainedBy"], `quoting action ${quote.quoting} retains charge by undeclared party role ${role}`);
-        }
-        else {
-            const expectedSource = `field:${partyField}`;
-            if (refundSource === undefined) {
-                add(["actions", quote.commit, "moves"], `commit action ${quote.commit} refund source cannot be resolved to charge-retaining party field ${partyField}`);
-            }
-            else if (refundSource !== expectedSource) {
-                if (refundSource.startsWith("ref:")) {
-                    add(["actions", quote.commit, "moves"], `commit action ${quote.commit} refund source cannot be a product escrow ref for a retained quote`);
-                }
-                else {
-                    add(["actions", quote.commit, "moves"], `commit action ${quote.commit} refund source ${refundSource} does not match charge-retaining party field ${partyField}`);
-                }
-            }
-        }
-        if (uses.length > 0) {
-            add(["actions"], `${chargePath} is retained by ${role} and cannot be consumed by an action`);
-            for (const use of uses) {
-                add([
-                    "actions",
-                    use.actionName,
-                    "moves",
-                    use.stepIndex,
-                    "bind",
-                    use.target,
-                ], `${chargePath} is retained by ${role} and cannot be consumed by an action`);
-            }
-        }
-        return;
-    }
-    if (quote.chargeCanBeNonzero && uses.length !== 1) {
-        add(["actions"], `${chargePath} is consumed ${uses.length} times; a nonzero charge schedule requires exactly one payout`);
-    }
-    if (uses.length === 0)
-        return;
-    if (uses.length !== 1) {
-        if (!quote.chargeCanBeNonzero) {
-            add(["actions"], `${chargePath} is consumed ${uses.length} times; it may fund at most one payout`);
-        }
-        return;
-    }
-    const use = uses[0];
-    const payoutTransition = instrument.lifecycle.transitions[use.actionName];
-    const commitTarget = instrument.lifecycle.transitions[quote.commit]?.to;
-    const source = canonicalAccount(instrument, use.step.bind.sourceAccountId);
-    const destination = canonicalAccount(instrument, use.step.bind.destinationAccountId);
-    const directAfterCommit = commitTarget !== undefined &&
-        payoutTransition?.from.length === 1 &&
-        payoutTransition.from[0] === commitTarget;
-    const oneWay = payoutTransition !== undefined &&
-        payoutTransition.to !== commitTarget &&
-        !stateCanReach(instrument, payoutTransition.to, commitTarget);
-    const valid = use.target === "amount" &&
-        use.step.operation === "internal_transfer.create" &&
-        (use.action.moves?.length ?? 0) === 1 &&
-        directAfterCommit &&
-        oneWay &&
-        source !== undefined &&
-        source === refundSource &&
-        destination !== undefined &&
-        !accountsMayAlias(instrument, source, destination);
-    if (!valid) {
-        add(["actions", use.actionName, "moves", use.stepIndex, "bind", use.target], `${chargePath} must be the amount of one internal transfer from the quoted refund source to a different account, in its own one-way action directly after ${quote.commit}`);
-    }
-}
-function canonicalAccount(instrument, binding) {
-    if (binding?.from !== "instance")
-        return undefined;
-    return canonicalAccountPath(instrument, binding.path);
-}
-function canonicalAccountPath(instrument, path) {
-    const [root, key, extra] = path.split(".");
-    if (!key || extra !== undefined)
-        return undefined;
-    if (root === "fields")
-        return `field:${key}`;
-    if (root === "refs")
-        return `ref:${key}`;
-    if (root === "party") {
-        const field = instrument.parties?.[key];
-        return field ? `field:${field}` : undefined;
-    }
-    return undefined;
-}
-function accountsMayAlias(instrument, left, right) {
-    if (left === right)
-        return true;
-    if (left.startsWith("field:") && right.startsWith("field:")) {
-        const leftField = left.slice("field:".length);
-        const rightField = right.slice("field:".length);
-        if (leftField === rightField)
-            return true;
-        if (instrument.parties) {
-            const leftParty = Object.entries(instrument.parties).find(([, field]) => field === leftField)?.[0];
-            const rightParty = Object.entries(instrument.parties).find(([, field]) => field === rightField)?.[0];
-            if (leftParty !== undefined &&
-                rightParty !== undefined &&
-                leftParty !== rightParty) {
-                return false;
-            }
+        if (Object.keys(action.set ?? {}).some((key) => instrument.fields.some((f) => f.name === key && f.type === "money"))) {
+            for (const account of owned)
+                state.balances.set(account, null);
         }
-        return true;
-    }
-    return false;
-}
-function amountIdentity(binding) {
-    if (binding?.from === "instance")
-        return binding.path;
-    return binding?.from === "const" ? `const:${binding.value}` : "dynamic";
-}
-function transferRefKey(step) {
-    return Object.entries(step.capture ?? {}).find(([, result]) => result === "transferId")?.[0];
-}
-function boundTransferRefKey(step) {
-    const binding = step.bind.transferId;
-    return binding?.from === "instance" && binding.path.startsWith("refs.")
-        ? binding.path.slice("refs.".length)
-        : undefined;
-}
-function stateCanReach(instrument, start, target) {
-    if (!target)
-        return false;
-    const seen = new Set([start]);
-    const pending = [start];
-    while (pending.length > 0) {
-        const state = pending.shift();
-        if (state === target)
-            return true;
-        for (const transition of Object.values(instrument.lifecycle.transitions)) {
-            if (!transition.from.includes(state) || seen.has(transition.to))
+    };
+    const initial = {
+        status: instrument.lifecycle.initial,
+        balances: new Map([...owned].map((key) => [key, new Map()])),
+        holds: new Map(),
+    };
+    if (instrument.actions.create)
+        apply(initial, instrument.actions.create, "create");
+    const pending = [initial];
+    const reached = new Map();
+    const copy = (state) => ({
+        status: state.status,
+        balances: new Map(state.balances),
+        holds: new Map([...state.holds].map(([key, hold]) => [key, { ...hold }])),
+    });
+    let work = 0;
+    while (pending.length && !problems.length) {
+        if (++work > 4096) {
+            report("owned proof exceeds its finite work budget");
+            break;
+        }
+        let state = pending.pop();
+        const key = JSON.stringify([state.status, [...state.holds.keys()].sort()]);
+        const previous = reached.get(key);
+        if (previous) {
+            const joined = copy(previous);
+            let changed = false;
+            for (const account of owned) {
+                const before = previous.balances.has(account)
+                    ? previous.balances.get(account)
+                    : new Map();
+                const after = state.balances.has(account)
+                    ? state.balances.get(account)
+                    : new Map();
+                if (before !== null && !same(before, after)) {
+                    joined.balances.set(account, null);
+                    changed = true;
+                }
+            }
+            for (const [name, hold] of joined.holds) {
+                const next = state.holds.get(name);
+                if (hold.from !== next.from || hold.to !== next.to) {
+                    report(`${name} changes reservation endpoints across paths`);
+                    break;
+                }
+                if (hold.amount !== null && !same(hold.amount, next.amount)) {
+                    hold.amount = null;
+                    changed = true;
+                }
+            }
+            if (!changed)
                 continue;
-            seen.add(transition.to);
-            pending.push(transition.to);
+            state = joined;
+        }
+        if (reached.size >= 256 && !previous) {
+            report("owned proof exceeds 256 state and reservation combinations");
+            break;
+        }
+        reached.set(key, copy(state));
+        const edges = Object.entries(instrument.lifecycle.transitions).filter(([, edge]) => edge.from.includes(state.status));
+        if (!edges.length &&
+            ([...state.balances].some(([account, balance]) => !shared.has(account) && (balance === null || balance.size > 0)) ||
+                state.holds.size))
+            report(`terminal state ${state.status} may strand owned money or an open reservation`);
+        for (const [name, edge] of edges) {
+            const action = instrument.actions[name];
+            if (!action)
+                continue;
+            const next = copy(state);
+            next.status = edge.to;
+            apply(next, action, name);
+            pending.push(next);
         }
     }
-    return false;
-}
-function stateKey(state) {
-    return JSON.stringify({
-        balance: state.balance,
-        holds: Object.fromEntries(Object.entries(state.holds).sort(([a], [b]) => a.localeCompare(b))),
-        exchanged: state.exchanged ?? false,
-    });
-}
-function formatAccount(account) {
-    const [kind, key] = account.split(":");
-    return `${kind === "field" ? "fields" : "refs"}.${key}`;
+    return problems;
 }
 //# sourceMappingURL=finance.js.map