@kaspacom/kcc20-tx-builder 0.5.0 → 0.6.0

package/dist/cjs/engine.js

@@ -2,7 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createKcc20PsktBuilderEngine = createKcc20PsktBuilderEngine;
 // @ts-nocheck
+const token_authorization_js_1 = require("./token-authorization.js");
 const sha256_1 = require("@noble/hashes/sha256");
+const token_profiles_js_1 = require("./token-profiles.js");
+const transfer_payload_js_1 = require("./transfer-payload.js");
+const token_profiles_generated_js_1 = require("./token-profiles.generated.js");
 const sale_common_js_1 = require("./sale-common.js");
 const abi_js_1 = require("./abi.js");
 const operations_js_1 = require("./operations.js");
@@ -105,6 +109,7 @@ function createKcc20PsktBuilderEngine(options) {
     const WRAPPED_ARTIFACT_PATH = "KCC20Orderbook.placeholder.json";
     const FEE_TICKET_ARTIFACT_PATH = "KCC20FeeTicket.placeholder.json";
     const staticArtifactCache = new Map();
+    const tokenProfiles = (0, token_profiles_js_1.validateTokenProfileRegistry)(options.tokenProfileRegistry?.manifest ?? token_profiles_generated_js_1.BUNDLED_TOKEN_PROFILES, options.tokenProfileRegistry?.sha256 ?? token_profiles_generated_js_1.BUNDLED_TOKEN_PROFILE_DIGEST);
     function readStaticArtifact(path) {
         let cached = staticArtifactCache.get(path);
         if (!cached) {
@@ -117,7 +122,16 @@ function createKcc20PsktBuilderEngine(options) {
                     ? (artifact.artifact ?? artifact)
                     : artifact;
                 const normalized = (0, abi_js_1.normalizeSilverScriptArtifact)(artifactValue);
-                (0, artifacts_js_1.assertKcc20ArtifactScriptHash)(path, normalized);
+                const profile = tokenProfiles.profiles.find((p) => p.artifactKey === path);
+                if (profile)
+                    (0, token_profiles_js_1.authenticateTokenArtifact)(profile, artifactValue);
+                else {
+                    const ownerProfile = tokenProfiles.profiles.find((p) => p.wrapper?.artifactKey === path);
+                    if (ownerProfile)
+                        (0, token_profiles_js_1.authenticateTokenWrapper)(ownerProfile, artifactValue);
+                    else
+                        (0, artifacts_js_1.assertKcc20ArtifactScriptHash)(path, normalized);
+                }
                 return normalized;
             })
                 .catch((error) => {
@@ -135,15 +149,20 @@ function createKcc20PsktBuilderEngine(options) {
         };
     }
     async function resolveKcc20ArtifactForState(state, address, network) {
-        const artifact = await readStaticArtifact(KCC20_ARTIFACT_PATH);
-        const script = (0, abi_js_1.buildKcc20ScriptForState)(artifact, state);
-        const candidateAddress = kaspaWasm
-            .addressFromScriptPublicKey(kaspaWasm.payToScriptHashScript(script), network)
-            .toString();
-        if (candidateAddress !== address) {
-            throw new Error("KCC20 UTXO address does not match the current artifact");
+        for (const profile of tokenProfiles.profiles) {
+            const artifact = await readStaticArtifact(profile.artifactKey);
+            const script = (0, abi_js_1.buildKcc20ScriptForState)(artifact, state);
+            const candidateAddress = kaspaWasm
+                .addressFromScriptPublicKey(kaspaWasm.payToScriptHashScript(script), network)
+                .toString();
+            if (candidateAddress !== address)
+                continue;
+            (0, token_profiles_js_1.requireTokenCapability)(profile, "transfer");
+            if (!profile.ownerSchemes.includes(Number(state.ownerScheme ?? state.identifierType)))
+                throw new Error("owner scheme is unsupported by this token profile");
+            return { version: profile.id, profile, artifact, script };
         }
-        return { version: "standard-native-v1", artifact, script };
+        throw new Error("KCC20 UTXO address does not match a bundled token profile");
     }
     function artifactEntrypointDispatchTag(artifact, entrypoint) {
         try {
@@ -178,13 +197,14 @@ function createKcc20PsktBuilderEngine(options) {
             },
         ];
     }
-    async function readWrapperArtifacts() {
-        return [
-            {
-                artifact: await readStaticArtifact(WRAPPER_ARTIFACT_PATH),
+    async function readWrapperArtifacts(profile) {
+        if (!profile.wrapper)
+            return [];
+        return [{
+                artifact: await readStaticArtifact(profile.wrapper.artifactKey),
                 version: "standard-native-v1",
-            },
-        ];
+                tokenProfileId: profile.id,
+            }];
     }
     function wrappedArtifactSupportsEntrypoint(info, name) {
         return Array.isArray(info?.artifact?.abi)
@@ -544,7 +564,7 @@ function createKcc20PsktBuilderEngine(options) {
         };
         const kw = kaspaWasm;
         const { CovenantBinding, Encoding, Hash, RpcClient, ScriptBuilder, Transaction, TransactionOutput, addressFromScriptPublicKey, payToAddressScript, payToScriptHashScript, } = kw;
-        const utilityScript = (0, sale_common_js_1.buildNativeKcc20ScriptForState)(kcc20Artifact.script, utilityState);
+        const utilityScript = (0, abi_js_1.buildKcc20ScriptForState)(kcc20Artifact, utilityState);
         const rootAddress = requireKaspaAddress(rootUtxo.address);
         const utilityAddress = requireKaspaAddress(utilityUtxo.address);
         const rootArtifactInfo = selectFeeTicketArtifactForState(feeTicketArtifacts, rootState, rootAddress, network, "active FeeTicket root UTXO address");
@@ -1662,10 +1682,7 @@ function createKcc20PsktBuilderEngine(options) {
         const feeTicketId = (0, sale_common_js_1.requireHex32)(params.feeTicketId || sale_common_js_1.ZERO_HASH, "fee ticket id");
         const deployerOwner = (0, sale_common_js_1.requireHex32)(params.deployerOwner || request.owner?.kcc20Owner, "deployer owner");
         const rootAmount = parseU64(params.wrappedRootAmount ?? "0", "wrappedRootAmount");
-        const priceScale = parsePositiveU64(params.priceScale ??
-            params.tokenDisplayScale ??
-            sale_common_js_1.DEFAULT_KCC20_PRICE_SCALE, "priceScale");
-        assertWrapperArtifactPriceScale(priceScale);
+        const requestedPriceScale = params.priceScale ?? params.tokenDisplayScale;
         const network = request.network || env.KASPA_NETWORK || "testnet-10";
         const walletAddress = requireKaspaAddress(request.owner?.walletAddress);
         const rpcUrl = env.KASPA_WRPC_URL || DEFAULT_WRPC_URL;
@@ -1674,7 +1691,19 @@ function createKcc20PsktBuilderEngine(options) {
             DEFAULT_DEPLOY_TKAS, "KCC20_WRAPPER_DEPLOY_OUTPUT_TKAS");
         const priorityFee = wrapperDeployPriorityFee(env.KCC20_WRAPPER_DEPLOY_PRIORITY_FEE_SOMPI);
         const computeBudget = parsePositiveNumber(env.KCC20_WRAPPER_DEPLOY_COMPUTE_BUDGET || 600, "computeBudget");
-        const wrapperArtifact = await readStaticArtifact(WRAPPER_ARTIFACT_PATH);
+        const evidence = params.tokenUtxo;
+        if (!evidence)
+            throw new Error("authenticated token output is required before wrapper deployment");
+        const sourceState = kcc20StateFromUtxo(evidence, request.owner);
+        const sourceProfile = await resolveKcc20ArtifactForState(sourceState, requireKaspaAddress(evidence.address), network);
+        (0, token_profiles_js_1.requireTokenCapability)(sourceProfile.profile, "wrap");
+        if (!sourceProfile.profile.wrapper)
+            throw new Error("token profile has no wrapper adapter");
+        const priceScale = (0, token_profiles_js_1.resolveTokenProfilePriceScale)(sourceProfile.profile, requestedPriceScale === undefined
+            ? undefined
+            : parsePositiveU64(requestedPriceScale, "priceScale"), sale_common_js_1.DEFAULT_KCC20_PRICE_SCALE);
+        assertWrapperArtifactPriceScale(priceScale);
+        const wrapperArtifact = await readStaticArtifact(sourceProfile.profile.wrapper.artifactKey);
         const wrappedArtifacts = await readWrappedArtifacts();
         const wrappedArtifact = wrappedArtifacts[0].artifact;
         const wrapperState = {
@@ -1707,6 +1736,18 @@ function createKcc20PsktBuilderEngine(options) {
         });
         await rpc.connect();
         try {
+            const evidenceUtxos = await getUtxosByAddresses(rpc, [evidence.address]);
+            const sourceEntry = findUtxoEntry(evidenceUtxos.entries, (0, sale_common_js_1.requireHex32)(evidence.txidHex, "token evidence txid"), parseVout(evidence.vout, "token evidence vout"));
+            if (!sourceEntry)
+                throw new Error("token evidence is spent or unavailable");
+            requireMatchingCovenantId(sourceEntry, contractCanonicalTokenId, "wrapper token evidence");
+            const sourceSpk = sourceEntry.scriptPublicKey ??
+                sourceEntry.entry?.scriptPublicKey ??
+                sourceEntry.utxoEntry?.scriptPublicKey;
+            if (!sourceSpk ||
+                kw.addressFromScriptPublicKey(sourceSpk, network)?.toString() !==
+                    evidence.address)
+                throw new Error("token evidence script does not match RPC");
             const utxos = await getUtxosByAddresses(rpc, [walletAddress]);
             const fundingEntry = (0, sale_common_js_1.selectFundingEntry)(utxos.entries, deploySompi * 2n + priorityFee + 10000000n);
             const fundingChangeOutputIndex = 2;
@@ -1787,6 +1828,9 @@ function createKcc20PsktBuilderEngine(options) {
                 submitTransactionSupported: true,
                 metadata: {
                     builderKey: "kcc20wrapper.deploy-market",
+                    tokenProfileId: sourceProfile.profile.id,
+                    tokenProfileRegistryHash: options.tokenProfileRegistry?.sha256 ??
+                        token_profiles_generated_js_1.BUNDLED_TOKEN_PROFILE_DIGEST,
                     contract: "KCC20Wrapper",
                     network,
                     walletAddress,
@@ -1866,10 +1910,7 @@ function createKcc20PsktBuilderEngine(options) {
             sale_common_js_1.DEFAULT_TOKEN_OUTPUT_SOMPI.toString(), "tokenOutputSompi");
         const priorityFee = parseU64(env.KCC20_WRAP_PRIORITY_FEE_SOMPI || DEFAULT_PRIORITY_FEE.toString(), "priorityFee");
         const computeBudget = parsePositiveNumber(env.KCC20_WRAP_COMPUTE_BUDGET || 700, "computeBudget");
-        const [wrapperArtifacts, wrappedArtifacts] = await Promise.all([
-            readWrapperArtifacts(),
-            readWrappedArtifacts(),
-        ]);
+        const wrappedArtifacts = await readWrappedArtifacts();
         const holderState = kcc20StateFromUtxo(holderUtxo, request.owner);
         if (holderState.identifierType !== 0) {
             throw new Error("wrap requires pubkey-owned KCC20 holder UTXO");
@@ -1884,6 +1925,8 @@ function createKcc20PsktBuilderEngine(options) {
         }
         const kcc20ArtifactInfo = await resolveKcc20ArtifactForState(holderState, requireKaspaAddress(holderUtxo.address), network);
         const kcc20Artifact = kcc20ArtifactInfo.artifact;
+        (0, token_profiles_js_1.requireTokenCapability)(kcc20ArtifactInfo.profile, "wrap");
+        const wrapperArtifacts = await readWrapperArtifacts(kcc20ArtifactInfo.profile);
         const remaining = holderState.amount - tokenAmount;
         const priceScale = parsePositiveU64(wrapperUtxo.state?.priceScale ??
             wrapperUtxo.state?.tokenDisplayScale ??
@@ -1910,7 +1953,7 @@ function createKcc20PsktBuilderEngine(options) {
         const { CovenantBinding, Encoding, Hash, RpcClient, ScriptBuilder, Transaction, TransactionOutput, payToAddressScript, payToScriptHashScript, } = kw;
         const wrapperArtifactInfo = selectWrapperArtifactForUtxo({
             kw,
-            artifacts: wrapperArtifacts,
+            artifacts: wrapperArtifacts.filter((info) => info.tokenProfileId === kcc20ArtifactInfo.profile.id),
             state: wrapperState,
             utxo: wrapperUtxo,
             network,
@@ -1923,7 +1966,7 @@ function createKcc20PsktBuilderEngine(options) {
         const wrapperArtifact = wrapperArtifactInfo.artifact;
         const wrappedArtifact = wrappedArtifactInfo.artifact;
         const wrapperScript = wrapperArtifactInfo.script;
-        const holderScript = (0, sale_common_js_1.buildNativeKcc20ScriptForState)(kcc20Artifact.script, holderState);
+        const holderScript = (0, abi_js_1.buildKcc20ScriptForState)(kcc20Artifact, holderState);
         const wrapperAddress = requireKaspaAddress(wrapperUtxo.address);
         const holderAddress = requireKaspaAddress(holderUtxo.address);
         assertScriptAddress(kw, holderScript, holderAddress, network, "KCC20 holder UTXO address");
@@ -2136,10 +2179,7 @@ function createKcc20PsktBuilderEngine(options) {
             sale_common_js_1.DEFAULT_TOKEN_OUTPUT_SOMPI.toString(), "tokenOutputSompi");
         const priorityFee = parseU64(env.KCC20_UNWRAP_PRIORITY_FEE_SOMPI || DEFAULT_PRIORITY_FEE.toString(), "priorityFee");
         const computeBudget = parsePositiveNumber(env.KCC20_UNWRAP_COMPUTE_BUDGET || 700, "computeBudget");
-        const [wrapperArtifacts, wrappedArtifacts] = await Promise.all([
-            readWrapperArtifacts(),
-            readWrappedArtifacts(),
-        ]);
+        const wrappedArtifacts = await readWrappedArtifacts();
         const reserveState = kcc20StateFromUtxo(reserveUtxo, request.owner);
         if (reserveState.ownerScheme !== 4 || reserveState.isMintAuthority) {
             throw new Error("KCC20 reserve UTXO must be covenant-owned holder state");
@@ -2149,6 +2189,8 @@ function createKcc20PsktBuilderEngine(options) {
         }
         const kcc20ArtifactInfo = await resolveKcc20ArtifactForState(reserveState, requireKaspaAddress(reserveUtxo.address), network);
         const kcc20Artifact = kcc20ArtifactInfo.artifact;
+        (0, token_profiles_js_1.requireTokenCapability)(kcc20ArtifactInfo.profile, "unwrap");
+        const wrapperArtifacts = await readWrapperArtifacts(kcc20ArtifactInfo.profile);
         const wrappedState = kcc20V3WrappedStateFromUtxo(wrappedUtxo, canonicalTokenId, request.owner);
         if ((0, sale_common_js_1.bytesToHex)(wrappedState.ownerIdentifier) !== recipientOwner) {
             throw new Error("KCC20 orderbook holder UTXO is not owned by authenticated wallet");
@@ -2192,7 +2234,7 @@ function createKcc20PsktBuilderEngine(options) {
         const { CovenantBinding, Encoding, Hash, RpcClient, ScriptBuilder, Transaction, TransactionOutput, payToAddressScript, payToScriptHashScript, } = kw;
         const wrapperArtifactInfo = selectWrapperArtifactForUtxo({
             kw,
-            artifacts: wrapperArtifacts,
+            artifacts: wrapperArtifacts.filter((info) => info.tokenProfileId === kcc20ArtifactInfo.profile.id),
             state: wrapperState,
             utxo: wrapperUtxo,
             network,
@@ -2214,7 +2256,7 @@ function createKcc20PsktBuilderEngine(options) {
         const wrapperScript = wrapperArtifactInfo.script;
         const wrappedScript = wrappedArtifactInfo.script;
         const refundAware = wrappedArtifactRefundsHolderDeposits(wrappedArtifactInfo);
-        const reserveScript = (0, sale_common_js_1.buildNativeKcc20ScriptForState)(kcc20Artifact.script, reserveState);
+        const reserveScript = (0, abi_js_1.buildKcc20ScriptForState)(kcc20Artifact, reserveState);
         const wrapperAddress = wrapperArtifactInfo.address;
         const wrappedAddress = wrappedArtifactInfo.address;
         const reserveAddress = requireKaspaAddress(reserveUtxo.address);
@@ -5668,6 +5710,7 @@ function createKcc20PsktBuilderEngine(options) {
             extensionCommitment: (0, abi_js_1.mintExtensionCommitment)(extension),
         };
         const resolvedArtifact = await resolveKcc20ArtifactForState(inputState, minterAddress, network);
+        (0, token_profiles_js_1.requireTokenCapability)(resolvedArtifact.profile, "mint");
         const artifact = resolvedArtifact.artifact;
         const recipientState = {
             amount: mintAmount,
@@ -5957,6 +6000,7 @@ function createKcc20PsktBuilderEngine(options) {
                 extensionCommitment: (0, abi_js_1.mintExtensionCommitment)(nextExtension),
             };
             const resolvedArtifact = await resolveKcc20ArtifactForState(inputState, minterAddress, network);
+            (0, token_profiles_js_1.requireTokenCapability)(resolvedArtifact.profile, "mint");
             (0, abi_js_1.dispatchTagFor)(resolvedArtifact.artifact, "set_public_mint_active");
             const minterTxid = (0, sale_common_js_1.requireHex32)(activeMinterUtxo.txidHex, "minter txid");
             const minterVout = parseVout(activeMinterUtxo.vout, "minter vout");
@@ -6180,6 +6224,10 @@ function createKcc20PsktBuilderEngine(options) {
         if (resolvedArtifacts.some((candidate) => candidate.version !== resolvedArtifacts[0].version)) {
             throw new Error("consolidation requires holder UTXOs from one artifact");
         }
+        const profile = resolvedArtifacts[0].profile;
+        if (holderUtxos.length > profile.maxTokenInputs) {
+            throw new Error("consolidation exceeds the token profile input bound");
+        }
         const artifact = resolvedArtifacts[0].artifact;
         for (const peerState of states.slice(1)) {
             assertKcc20MergeableStates(primaryState, peerState, owner);
@@ -6483,12 +6531,6 @@ function createKcc20PsktBuilderEngine(options) {
         if (inputState.isMintAuthority || inputState.amount <= 0n) {
             throw new Error("KCC20 transfer requires a holder UTXO");
         }
-        if (inputState.ownerScheme !== 0) {
-            throw new Error("KCC20 transfer requires a Schnorr P2PK holder UTXO");
-        }
-        if ((0, sale_common_js_1.bytesToHex)(inputState.ownerIdentifier) !== owner) {
-            throw new Error("KCC20 transfer requires wallet to own the active holder UTXO");
-        }
         if (transferAmount > inputState.amount) {
             throw new Error("tokenAmount exceeds active holder balance");
         }
@@ -6497,6 +6539,21 @@ function createKcc20PsktBuilderEngine(options) {
         const tokenAddress = requireKaspaAddress(activeHolderUtxo.address);
         const resolvedArtifact = await resolveKcc20ArtifactForState(inputState, tokenAddress, network);
         const artifact = resolvedArtifact.artifact;
+        if (params.mode && params.mode !== "owner")
+            throw new Error("borrowed receive requires the explicit borrow transaction builder");
+        const authorization = (0, token_authorization_js_1.planTokenOwnerWitness)({
+            profile: resolvedArtifact.profile,
+            owner: (0, sale_common_js_1.bytesToHex)(inputState.ownerIdentifier),
+            ownerScheme: inputState.ownerScheme,
+            publicKey: request.owner?.publicKey ?? request.owner?.kcc20Owner,
+            capabilities: options.walletSigningCapabilities ?? {
+                schnorr: true,
+                ecdsa: false,
+            },
+            role: "leader",
+        });
+        if (!resolvedArtifact.profile.ownerSchemes.includes(recipientOwnerScheme))
+            throw new Error("recipient owner scheme is unsupported by the token profile");
         const recipientState = {
             ...inputState,
             owner: (0, sale_common_js_1.hexToBytes)(recipientOwner),
@@ -6528,8 +6585,11 @@ function createKcc20PsktBuilderEngine(options) {
                 throw new Error(`active holder UTXO ${tokenTxid}:${tokenVout} not found`);
             }
             const rpcScript = tokenEntry.scriptPublicKey ??
-                tokenEntry.entry?.scriptPublicKey ?? tokenEntry.utxoEntry?.scriptPublicKey;
-            if (!rpcScript || kw.addressFromScriptPublicKey(rpcScript, network)?.toString() !== tokenAddress) {
+                tokenEntry.entry?.scriptPublicKey ??
+                tokenEntry.utxoEntry?.scriptPublicKey;
+            if (!rpcScript ||
+                kw.addressFromScriptPublicKey(rpcScript, network)?.toString() !==
+                    tokenAddress) {
                 throw new Error("active holder RPC script does not match rebuilt covenant state");
             }
             if (activeHolderUtxo.amountSompi != null &&
@@ -6538,7 +6598,7 @@ function createKcc20PsktBuilderEngine(options) {
             }
             const spendCovenantId = params.activeHolderNativeCovenantId
                 ? requireMatchingCovenantId(tokenEntry, covenantId, "active holder")
-                : covenantIdFromUtxoEntry(tokenEntry) ?? covenantId;
+                : (covenantIdFromUtxoEntry(tokenEntry) ?? covenantId);
             let outputSompi = 0n;
             const recipientOutputIndex = 0;
             const outputs = [
@@ -6590,9 +6650,9 @@ function createKcc20PsktBuilderEngine(options) {
                 outputs,
                 subnetworkId: sale_common_js_1.SUBNETWORK_ID_NATIVE,
                 gas: 0n,
-                payload: buildTransferPayload({
+                payload: (0, transfer_payload_js_1.buildAuthenticatedKcc20TransferPayload)({
                     covenantId: spendCovenantId,
-                    fromOwner: owner,
+                    fromOwnerIdentifier: (0, sale_common_js_1.bytesToHex)(inputState.ownerIdentifier),
                     recipientOwner,
                     recipientOwnerScheme,
                     tokenAmount: transferAmount,
@@ -6605,9 +6665,10 @@ function createKcc20PsktBuilderEngine(options) {
                     inputIndex: 0,
                     scriptHex: (0, sale_common_js_1.bytesToHex)(tokenScript),
                     signType: 1,
+                    signatureAlgorithm: authorization.signatureAlgorithm,
                     signatureScript: {
                         mode: "ordered-args",
-                        args: kcc20TransferOrderedArgs(artifact, changeState ? [recipientState, changeState] : [recipientState]),
+                        args: kcc20TransferOrderedArgs(artifact, changeState ? [recipientState, changeState] : [recipientState], authorization.argument),
                     },
                 },
             ];
@@ -6623,6 +6684,9 @@ function createKcc20PsktBuilderEngine(options) {
                 scripts,
                 submitTransactionSupported: true,
                 metadata: {
+                    tokenProfileId: resolvedArtifact.profile.id,
+                    tokenProfileRegistryHash: options.tokenProfileRegistry?.sha256 ??
+                        token_profiles_generated_js_1.BUNDLED_TOKEN_PROFILE_DIGEST,
                     builderKey: "kcc20.transfer",
                     operation: "transfer-token",
                     action: "transfer",
@@ -7617,34 +7681,6 @@ function createKcc20PsktBuilderEngine(options) {
             },
         }));
     }
-    function buildTransferPayload(fields) {
-        return new TextEncoder().encode(JSON.stringify({
-            tn12: {
-                v: 1,
-                tmpl: "KCC20",
-                op: "transfer",
-                args: [
-                    { name: "covenantId", type: "byte[32]", value: fields.covenantId },
-                    { name: "fromOwner", type: "byte[32]", value: fields.fromOwner },
-                    {
-                        name: "recipientOwner",
-                        type: "byte[32]",
-                        value: fields.recipientOwner,
-                    },
-                    {
-                        name: "recipientOwnerScheme",
-                        type: "u64",
-                        value: String(fields.recipientOwnerScheme),
-                    },
-                    {
-                        name: "tokenAmount",
-                        type: "u64",
-                        value: fields.tokenAmount.toString(),
-                    },
-                ],
-            },
-        }));
-    }
     function tokenOutput(kw, artifact, state, sompi, covenantId, authorizingInput) {
         return new kw.TransactionOutput(sompi, kw.payToScriptHashScript((0, abi_js_1.buildKcc20ScriptForState)(artifact, state)), new kw.CovenantBinding(authorizingInput, new kw.Hash(covenantId)));
     }
@@ -8940,18 +8976,29 @@ function createKcc20PsktBuilderEngine(options) {
         values.push({ type: "signature" }, i64TemplateArg(active ? 1 : 0), i64TemplateArg(minterOutputIndex), dataTemplateArg((0, abi_js_1.dispatchTagFor)(artifact, "set_public_mint_active")));
         return values;
     }
-    function kcc20TransferOrderedArgs(artifact, nextStates) {
+    function profileForArtifact(artifact) {
+        const parts = templateParts(artifact);
+        const hash = (0, sale_common_js_1.bytesToHex)((0, abi_js_1.templateHash)(parts.prefix, parts.suffix));
+        const profile = tokenProfiles.profiles.find((p) => p.templateHash === hash);
+        if (!profile)
+            throw new Error("token artifact has no bundled profile");
+        return profile;
+    }
+    function kcc20TransferOrderedArgs(artifact, nextStates, witness) {
+        const profile = profileForArtifact(artifact);
+        if (nextStates.length > profile.maxTokenOutputs)
+            throw new Error("transfer exceeds profile output bound");
         const fields = (0, abi_js_1.encodeKcc20StateRecordArrays)(nextStates).map(dataTemplateArg);
         return [
             ...fields,
-            { type: "signature", prefixHex: "00" },
-            dataTemplateArg((0, abi_js_1.dispatchTagFor)(artifact, "transfer")),
+            witness ?? { type: "signature", prefixHex: "00" },
+            dataTemplateArg((0, abi_js_1.dispatchTagFor)(artifact, profileForArtifact(artifact).transferEntrypoint)),
         ];
     }
     function kcc20TransferDelegatorOrderedArgs(artifact) {
         return [
             { type: "signature" },
-            dataTemplateArg((0, abi_js_1.dispatchTagFor)(artifact, "transfer_delegator")),
+            dataTemplateArg((0, abi_js_1.dispatchTagFor)(artifact, profileForArtifact(artifact).delegatorEntrypoint)),
         ];
     }
     function kcc20BurnOrderedArgs(artifact, nextStates, burnAmount) {