@laceio/sdk 0.1.1-canary.3 → 0.1.1

package/dist/grant-status-DOr3t_u8.cjs

@@ -1,2820 +0,0 @@
-const require_rolldown_runtime = require("./rolldown-runtime-Br2OG8yv.cjs");
-const require_hex = require("./hex-D9ITYbwt.cjs");
-const require_outputs = require("./outputs-CJoQBIA2.cjs");
-const require_tokens = require("./tokens-Cevp7rdU.cjs");
-const require_identity = require("./identity-BMLuufva.cjs");
-let _laceio_cardano_crypto = require("@laceio/cardano/crypto");
-_laceio_cardano_crypto = require_rolldown_runtime.__toESM(_laceio_cardano_crypto);
-let _laceio_cardano_core = require("@laceio/cardano/core");
-let _laceio_cardano_util = require("@laceio/cardano/util");
-let _laceio_cardano_tx_construction = require("@laceio/cardano/tx-construction");
-//#region ../../packages/lib/cardano-custody/src/analysis/transaction-facts.ts
-const outpointKey = ({ txId, index }) => `${txId.toLowerCase()}#${index}`;
-const toTxIn = ({ txId, index }) => ({
-	txId,
-	index
-});
-/** Byte order of lower-case hex, then index: how the ledger orders inputs. */
-const compareOutpoints = (a, b) => {
-	const aId = a.txId.toLowerCase();
-	const bId = b.txId.toLowerCase();
-	if (aId !== bId) return aId < bId ? -1 : 1;
-	return a.index - b.index;
-};
-/**
-* Pairs every input the body names with the caller's resolution. Every
-* input, reference input and collateral input must be resolved exactly once,
-* and no resolution may name an outpoint the body does not.
-*/
-const resolveBody = (body, resolvedInputs) => {
-	const refusals = [];
-	const resolutions = /* @__PURE__ */ new Map();
-	const sources = [
-		[body.inputs, "inputs"],
-		[body.referenceInputs ?? [], "referenceInputs"],
-		[body.collaterals ?? [], "collaterals"]
-	];
-	const named = new Set(sources.flatMap(([inputs]) => inputs.map(outpointKey)));
-	for (const [input, txOut] of resolvedInputs) {
-		const key = outpointKey(input);
-		const view = require_outputs.viewOfOutput(txOut);
-		if (!named.has(key)) refusals.push({
-			code: "custody-context-mismatch",
-			reason: "resolution-not-in-body",
-			input: toTxIn(input)
-		});
-		else if (resolutions.has(key)) refusals.push({
-			code: "custody-context-mismatch",
-			reason: "duplicate-resolution",
-			input: toTxIn(input)
-		});
-		else if (view.address === void 0) refusals.push({
-			code: "custody-context-mismatch",
-			reason: "invalid-resolution",
-			input: toTxIn(input)
-		});
-		resolutions.set(key, view);
-	}
-	const resolve = (inputs, source) => inputs.flatMap((input) => {
-		const output = resolutions.get(outpointKey(input));
-		if (output) return [{
-			input: toTxIn(input),
-			output
-		}];
-		refusals.push({
-			code: "custody-context-mismatch",
-			reason: "unresolved-input",
-			input: toTxIn(input),
-			source
-		});
-		return [];
-	});
-	const [inputs, referenceInputs, collaterals] = sources.map(([list, source]) => resolve(list, source));
-	return refusals.length > 0 ? require_hex.fail(refusals) : require_hex.ok({
-		inputs: inputs.sort((a, b) => compareOutpoints(a.input, b.input)),
-		referenceInputs,
-		collaterals
-	});
-};
-/** The key of the withdrawal map in a transaction body. */
-const WITHDRAWALS_KEY = 5n;
-/**
-* The reward accounts the withdrawal maps of a body name, read from its
-* bytes, repeats included: a repeated key, and a repeated map, are lost
-* once the body is decoded.
-*/
-const withdrawalAccountsOf = (bodyCbor) => {
-	const reader = new _laceio_cardano_core.Serialization.CborReader(bodyCbor);
-	const accounts = [];
-	reader.readStartMap();
-	while (reader.peekState() !== _laceio_cardano_core.Serialization.CborReaderState.EndMap) {
-		if (reader.readInt() !== WITHDRAWALS_KEY) {
-			reader.skipValue();
-			continue;
-		}
-		reader.readStartMap();
-		while (reader.peekState() !== _laceio_cardano_core.Serialization.CborReaderState.EndMap) {
-			accounts.push(_laceio_cardano_core.Cardano.Address.fromBytes(_laceio_cardano_util.HexBlob.fromBytes(reader.readByteString())).toBech32());
-			reader.skipValue();
-		}
-		reader.readEndMap();
-	}
-	return accounts;
-};
-const readTransaction = ({ body, bodyCbor, witness }, resolved, options) => {
-	const mint = new Map([...body.mint ?? /* @__PURE__ */ new Map()].map(([assetId, quantity]) => [assetId.toLowerCase(), quantity]));
-	const { invalidBefore, invalidHereafter } = body.validityInterval ?? {};
-	return {
-		body,
-		...resolved,
-		outputs: body.outputs.map(require_outputs.viewOfOutput),
-		collateralReturn: body.collateralReturn ? require_outputs.viewOfOutput(body.collateralReturn) : void 0,
-		redeemers: witness.redeemers ?? [],
-		requiredSigners: new Set((body.requiredExtraSignatures ?? []).map((signer) => signer.toLowerCase())),
-		mintPolicies: [...new Set([...mint.keys()].map(require_outputs.policyIdOf))].sort(),
-		mint,
-		lowerBoundMs: invalidBefore === void 0 ? void 0 : options.slotToPosixMs(invalidBefore),
-		upperBoundMs: invalidHereafter === void 0 ? void 0 : options.slotToPosixMs(invalidHereafter),
-		witnessScriptHashes: new Set((witness.scripts ?? []).map((script) => _laceio_cardano_core.Serialization.Script.fromCore(script).hash())),
-		withdrawalAccounts: withdrawalAccountsOf(bodyCbor)
-	};
-};
-const redeemerData = (facts, purpose, index) => facts.redeemers.find((redeemer) => redeemer.purpose === purpose && redeemer.index === index)?.data;
-const paymentCredentialOf = (view) => (view.address?.asBase() ?? view.address?.asEnterprise() ?? view.address?.asPointer())?.getPaymentCredential();
-const stakeCredentialOf = (certificate) => "stakeCredential" in certificate ? certificate.stakeCredential : void 0;
-const scriptHashOfRewardAccount = (rewardAccount) => {
-	const credential = _laceio_cardano_core.Cardano.Address.fromString(rewardAccount)?.asReward()?.getPaymentCredential();
-	return credential?.type === _laceio_cardano_core.Cardano.CredentialType.ScriptHash ? credential.hash : void 0;
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/grant-spend.ts
-const valueAt = (views, plutusAddressKey) => require_outputs.addValueDeltas(views.filter((view) => view.plutusAddressKey !== void 0 && view.plutusAddressKey === plutusAddressKey).map((view) => view.value));
-/** `leaving_value` over outputs that are already read. */
-const leavingValueAt = (inputs, outputs, plutusAddressKey) => require_outputs.addValueDeltas([valueAt(inputs, plutusAddressKey), require_outputs.negateValueDelta(valueAt(outputs, plutusAddressKey))]);
-/**
-* Every rule of `stays_within_scope` a net outflow breaks: the scoped asset
-* within its per call and remaining caps; for a token scope, lovelace within
-* both lovelace caps; and no other asset class leaving. A net inflow breaks
-* nothing.
-*
-* @param accountFee - the fee the account pays, which `leaving.lovelace`
-*   already includes; each violation whose outflow is lovelace reports it
-*   as `fee`
-*/
-const findCustodyScopeViolations = (scope, leaving, accountFee) => {
-	const violations = [];
-	const isLovelaceScope = require_outputs.isCustodyLovelaceAsset(scope.asset);
-	const lovelaceFee = accountFee === void 0 ? {} : { fee: accountFee };
-	const assetFee = isLovelaceScope ? lovelaceFee : {};
-	const assetOutflow = require_outputs.quantityOfAsset(leaving, scope.asset);
-	if (assetOutflow > scope.perCallCap) violations.push({
-		code: "per-call-cap-exceeded",
-		outflow: assetOutflow,
-		limit: scope.perCallCap,
-		...assetFee
-	});
-	if (assetOutflow > scope.cap) violations.push({
-		code: "cap-exceeded",
-		outflow: assetOutflow,
-		limit: scope.cap,
-		...assetFee
-	});
-	if (!isLovelaceScope) {
-		if (leaving.lovelace > scope.lovelacePerCallCap) violations.push({
-			code: "lovelace-per-call-cap-exceeded",
-			outflow: leaving.lovelace,
-			limit: scope.lovelacePerCallCap,
-			...lovelaceFee
-		});
-		if (leaving.lovelace > scope.lovelaceCap) violations.push({
-			code: "lovelace-cap-exceeded",
-			outflow: leaving.lovelace,
-			limit: scope.lovelaceCap,
-			...lovelaceFee
-		});
-	}
-	for (const [assetId, quantity] of leaving.assets) if (quantity > 0n && !require_outputs.isAssetIdOf(assetId, scope.asset)) violations.push({
-		code: "foreign-asset-outflow",
-		assetId,
-		outflow: quantity
-	});
-	return violations;
-};
-const clampedOutflow = (quantity) => quantity > 0n ? quantity : 0n;
-/**
-* `grant_after_spend`: the grant with `cap`, and for a token grant
-* `lovelaceCap`, lowered by the net outflow of its asset, never raised by a
-* net deposit. These are the most the recreated grant may keep: the
-* contract accepts any cap from zero to this value, so a builder may write
-* lower caps that already count a fee it has not yet computed.
-*/
-const custodyGrantAfterSpend = (grant, leaving) => {
-	const { scope } = grant;
-	return {
-		...grant,
-		scope: {
-			...scope,
-			cap: scope.cap - clampedOutflow(require_outputs.quantityOfAsset(leaving, scope.asset)),
-			lovelaceCap: require_outputs.isCustodyLovelaceAsset(scope.asset) ? scope.lovelaceCap : scope.lovelaceCap - clampedOutflow(leaving.lovelace)
-		}
-	};
-};
-/** `ends_before_expiry`: a finite upper bound no later than the expiry. */
-const findExpiryViolation = (upperBoundMs, expiresAt) => {
-	if (upperBoundMs === void 0) return { code: "no-upper-bound" };
-	return Number.isSafeInteger(upperBoundMs) && BigInt(upperBoundMs) <= expiresAt ? void 0 : {
-		code: "expired",
-		upperBoundMs,
-		expiresAt
-	};
-};
-const findMisplacedAccountTokens = (facts) => [["input", facts.inputs], ["output", facts.outputs]].flatMap(([kind, views]) => views.flatMap((view, index) => require_outputs.holdsMisplacedAccountToken(view, [facts.account.accountValidatorHash]) ? [{
-	code: "account-token-misplaced",
-	location: {
-		kind,
-		index
-	}
-}] : []));
-/** `pays_only_recipients` and `deposits_are_plain`, per output. */
-const findOutputViolations = (facts, grant) => {
-	const { recipients } = grant.scope;
-	const recipientKeys = new Set(recipients.map(require_outputs.recipientKey));
-	const { plutusAddressKey } = facts.grantInput;
-	return facts.outputs.flatMap((view, outputIndex) => {
-		const violations = [];
-		const isBack = view.plutusAddressKey !== void 0 && view.plutusAddressKey === plutusAddressKey;
-		if (recipients.length > 0 && !isBack && (view.plutusAddressKey === void 0 || !recipientKeys.has(view.plutusAddressKey))) violations.push({
-			code: "recipient-not-allowed",
-			outputIndex
-		});
-		if (isBack && !require_outputs.holdsAccountToken(view, facts.account) && (view.datumKind !== "none" || view.hasReferenceScript)) violations.push({
-			code: "deposit-not-plain",
-			outputIndex
-		});
-		return violations;
-	});
-};
-/** `referenced_control`: the account's control UTxO among the reference inputs, exactly once. */
-const findReferencedControl = (facts) => {
-	const controls = facts.referenceInputs.filter((view) => require_outputs.isControlOutput(view, facts.account));
-	if (controls.length !== 1) return { violations: [{
-		code: "referenced-control-count",
-		count: controls.length
-	}] };
-	const state = require_outputs.decodedInlineState(controls[0]);
-	return state ? {
-		state,
-		violations: []
-	} : { violations: [{ code: "referenced-control-datum" }] };
-};
-/** `is_current`, naming why a grant is not current against the referenced state. */
-const findCurrencyViolation = (grant, state) => {
-	if (grant.generation < state.grantGeneration) return {
-		code: "grant-not-current",
-		liveness: "superseded"
-	};
-	if (grant.generation > state.grantGeneration) return {
-		code: "grant-not-current",
-		liveness: "future-generation"
-	};
-	return state.revoked.includes(grant.slot) ? {
-		code: "grant-not-current",
-		liveness: "revoked"
-	} : void 0;
-};
-const isSameExceptCaps = (actual, expected) => {
-	const a = actual.scope;
-	const b = expected.scope;
-	return actual.slot === expected.slot && actual.grantee === expected.grantee && actual.generation === expected.generation && a.asset.policyId === b.asset.policyId && a.asset.assetName === b.asset.assetName && a.perCallCap === b.perCallCap && a.lovelacePerCallCap === b.lovelacePerCallCap && a.expiresAt === b.expiresAt && a.recipients.length === b.recipients.length && a.recipients.every((recipient, index) => require_outputs.recipientKey(recipient) === require_outputs.recipientKey(b.recipients[index]));
-};
-const isSameValue = (a, b) => a.lovelace === b.lovelace && a.assets.size === b.assets.size && [...a.assets].every(([assetId, quantity]) => b.assets.get(assetId) === quantity);
-/**
-* `find_grant_output` and the checks on it: one output holding the grant
-* token, at the spent UTxO's address with its exact value and no reference
-* script, carrying the grant with every field kept but caps lowered within
-* `carries_grant_within`.
-*/
-const findGrantOutputViolations = (facts, grant, expected) => {
-	const assetId = require_outputs.grantAssetIdOf(facts.account, grant.slot);
-	const holders = facts.outputs.flatMap((view, outputIndex) => assetId !== void 0 && view.value.assets.get(assetId) === 1n ? [{
-		view,
-		outputIndex
-	}] : []);
-	if (holders.length !== 1) return [{
-		code: "grant-output-count",
-		count: holders.length
-	}];
-	const [{ view, outputIndex }] = holders;
-	const violations = [];
-	if (view.plutusAddressKey === void 0 || view.plutusAddressKey !== facts.grantInput.plutusAddressKey) violations.push({
-		code: "grant-output-address",
-		outputIndex
-	});
-	if (!isSameValue(view.value, facts.grantInput.value)) violations.push({
-		code: "grant-output-value",
-		outputIndex
-	});
-	if (view.hasReferenceScript) violations.push({
-		code: "grant-output-reference-script",
-		outputIndex
-	});
-	if (view.inlineDatum === void 0) return [...violations, {
-		code: "grant-output-datum",
-		outputIndex,
-		reason: "not-inline"
-	}];
-	const actual = require_outputs.decodedInlineGrant(view);
-	if (!actual) return [...violations, {
-		code: "grant-output-datum",
-		outputIndex,
-		reason: "malformed"
-	}];
-	if (!isSameExceptCaps(actual, expected)) violations.push({
-		code: "grant-output-datum",
-		outputIndex,
-		reason: "field-changed"
-	});
-	for (const field of ["cap", "lovelaceCap"]) {
-		const capActual = actual.scope[field];
-		const capExpected = expected.scope[field];
-		if (capActual < 0n || capActual > capExpected) violations.push({
-			code: "grant-output-cap",
-			outputIndex,
-			field,
-			actual: capActual,
-			expected: capExpected
-		});
-	}
-	return violations;
-};
-/** Every violation of a grant spend whose views are already read. */
-const grantSpendViolationsOf = (facts) => {
-	const grant = require_outputs.decodedInlineGrant(facts.grantInput);
-	if (!grant) return [{ code: "grant-datum-invalid" }];
-	const violations = [];
-	if (!require_outputs.holdsOnlyLovelaceAndGrantToken(facts.grantInput.value, facts.account, grant.slot)) violations.push({ code: "grant-input-value" });
-	const tokenInputs = facts.inputs.filter((view) => require_outputs.holdsAccountToken(view, facts.account)).length;
-	if (tokenInputs !== 1) violations.push({
-		code: "account-token-inputs",
-		count: tokenInputs
-	});
-	const control = findReferencedControl(facts);
-	violations.push(...control.violations);
-	const currency = control.state && findCurrencyViolation(grant, control.state);
-	if (currency) violations.push(currency);
-	if (!facts.requiredSigners.has(grant.grantee)) violations.push({
-		code: "grantee-not-signer",
-		grantee: grant.grantee
-	});
-	const expiry = findExpiryViolation(facts.upperBoundMs, grant.scope.expiresAt);
-	if (expiry) violations.push(expiry);
-	const leaving = leavingValueAt(facts.inputs, facts.outputs, facts.grantInput.plutusAddressKey);
-	return [
-		...violations,
-		...findCustodyScopeViolations(grant.scope, leaving),
-		...findOutputViolations(facts, grant),
-		...findMisplacedAccountTokens(facts),
-		...findGrantOutputViolations(facts, grant, custodyGrantAfterSpend(grant, leaving)),
-		...[...facts.mint].filter(([assetId]) => require_outputs.policyIdOf(assetId) === facts.account.accountValidatorHash).map(([assetId, quantity]) => ({
-			code: "mint-under-policy",
-			assetId,
-			quantity
-		}))
-	];
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/record.ts
-const CUSTODY_ACCOUNT_RECORD_TYPE = "cardano-custody-account";
-const createCustodyAccountRecord = (identity) => canonicalCustodyAccountRecord({
-	type: CUSTODY_ACCOUNT_RECORD_TYPE,
-	version: 1,
-	networkMagic: identity.chainId.networkMagic,
-	accountValidatorHash: identity.contractVersion.accountValidatorHash,
-	creatorKeyHash: identity.creatorKeyHash,
-	stakeScriptHash: identity.stakeScriptHash,
-	address: identity.address
-});
-/** A copy holding exactly the record fields, in their canonical order. */
-const canonicalCustodyAccountRecord = (record) => ({
-	type: record.type,
-	version: record.version,
-	networkMagic: record.networkMagic,
-	accountValidatorHash: record.accountValidatorHash,
-	creatorKeyHash: record.creatorKeyHash,
-	stakeScriptHash: record.stakeScriptHash,
-	address: record.address
-});
-const RECORD_FIELDS = Object.keys(canonicalCustodyAccountRecord({}));
-const UPSTREAM_RECORD_FIELDS = [
-	"owner",
-	"stakeScriptHash",
-	"address"
-];
-const malformed$1 = (reason, field) => ({
-	step: 1,
-	code: "malformed-record",
-	reason,
-	...field === void 0 ? {} : { field }
-});
-const parseJson = (input) => {
-	if (typeof input !== "string") return input;
-	try {
-		return JSON.parse(input);
-	} catch {
-		return;
-	}
-};
-const isPlainObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const hasExactFields$1 = (value, fields) => {
-	const keys = Object.keys(value);
-	return keys.length === fields.length && fields.every((field) => keys.includes(field));
-};
-const parseAddress = (value) => typeof value === "string" && _laceio_cardano_core.Cardano.Address.isValidBech32(value) ? _laceio_cardano_core.Cardano.Address.fromBech32(value) : null;
-const HASH_FIELDS = [
-	"accountValidatorHash",
-	"creatorKeyHash",
-	"stakeScriptHash"
-];
-const readRecordClaims = (value) => {
-	if (!hasExactFields$1(value, RECORD_FIELDS)) return require_hex.fail(malformed$1(`expected exactly ${RECORD_FIELDS.join(", ")}`));
-	if (value.type !== "cardano-custody-account") return require_hex.fail(malformed$1("unknown record type", "type"));
-	if (value.version !== 1) return require_hex.fail(malformed$1("unsupported record version", "version"));
-	if (!require_identity.isNetworkMagic(value.networkMagic)) return require_hex.fail(malformed$1("expected a network magic", "networkMagic"));
-	const invalidHash = HASH_FIELDS.find((field) => !require_hex.isHash28Hex(value[field]));
-	if (invalidHash) return require_hex.fail(malformed$1("expected 28 bytes of lower-case hex", invalidHash));
-	const address = parseAddress(value.address);
-	if (!address) return require_hex.fail(malformed$1("expected an address", "address"));
-	return require_hex.ok({
-		networkMagic: value.networkMagic,
-		accountValidatorHash: value.accountValidatorHash,
-		creatorKeyHash: value.creatorKeyHash,
-		stakeScriptHash: value.stakeScriptHash,
-		address,
-		addressText: value.address
-	});
-};
-/**
-* Claims of the upstream `{ owner, stakeScriptHash, address }` record. It
-* names no network or contract version: the network is the selected one, and
-* the account validator is the address's payment script.
-*/
-const readUpstreamRecordClaims = (value, selectedNetworkMagic) => {
-	if (!hasExactFields$1(value, UPSTREAM_RECORD_FIELDS)) return require_hex.fail(malformed$1(`expected exactly ${UPSTREAM_RECORD_FIELDS.join(", ")}`));
-	const invalidHash = ["owner", "stakeScriptHash"].find((field) => !require_hex.isHash28Hex(value[field]));
-	if (invalidHash) return require_hex.fail(malformed$1("expected 28 bytes of lower-case hex", invalidHash));
-	const address = parseAddress(value.address);
-	const payment = address?.asBase()?.getPaymentCredential();
-	if (!address || payment?.type !== _laceio_cardano_core.Cardano.CredentialType.ScriptHash) return require_hex.fail(malformed$1("expected a script base address", "address"));
-	return require_hex.ok({
-		networkMagic: selectedNetworkMagic,
-		accountValidatorHash: payment.hash,
-		creatorKeyHash: value.owner,
-		stakeScriptHash: value.stakeScriptHash,
-		address,
-		addressText: value.address
-	});
-};
-const readClaims = (input, selectedNetworkMagic) => {
-	const value = parseJson(input);
-	if (!isPlainObject$1(value)) return require_hex.fail(malformed$1("expected a JSON object"));
-	return "owner" in value ? readUpstreamRecordClaims(value, selectedNetworkMagic) : readRecordClaims(value);
-};
-/**
-* Validates an imported record, in order: (1) known type, version and field
-* shapes; (2) a supported contract version; (3) the stake script hash
-* re-derived from the creator key hash; (4) the address re-derived for the
-* record's network, byte for byte; (5) the record's network is the selected
-* one. Step 3 is what proves the record names a genuine custody account: the
-* mint accepts any stake script.
-*
-* Also accepts the upstream `{ owner, stakeScriptHash, address }` record,
-* taking the network from `selectedNetworkMagic`.
-*
-* @param input - the record as JSON text or as an already parsed value
-*/
-const parseCustodyAccountRecord = (input, selectedNetworkMagic) => {
-	const claims = readClaims(input, selectedNetworkMagic);
-	if (!claims.ok) return claims;
-	const { networkMagic, accountValidatorHash, creatorKeyHash, stakeScriptHash, address, addressText } = claims.value;
-	const contractVersion = require_hex.findCustodyContractVersion(accountValidatorHash);
-	if (!contractVersion.ok) return require_hex.fail({
-		step: 2,
-		...contractVersion.error
-	});
-	const identity = require_identity.identityOfValidatedCreator({
-		contractVersion: contractVersion.value,
-		creatorKeyHash,
-		chainId: require_identity.chainIdFromNetworkMagic(networkMagic)
-	});
-	if (identity.stakeScriptHash !== stakeScriptHash) return require_hex.fail({
-		step: 3,
-		code: "stake-script-hash-mismatch",
-		expected: identity.stakeScriptHash,
-		actual: stakeScriptHash
-	});
-	const derivedAddress = identity.address;
-	if (_laceio_cardano_core.Cardano.Address.fromBech32(derivedAddress).toBytes() !== address.toBytes()) return require_hex.fail({
-		step: 4,
-		code: "address-mismatch",
-		expected: derivedAddress,
-		actual: addressText
-	});
-	if (networkMagic !== selectedNetworkMagic) return require_hex.fail({
-		step: 5,
-		code: "network-mismatch",
-		expected: selectedNetworkMagic,
-		actual: networkMagic
-	});
-	return require_hex.ok({
-		record: createCustodyAccountRecord(identity),
-		identity
-	});
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/codecs/redeemers.ts
-/** Constructor order of `AccountRedeemer`; no constructor has fields. */
-const ACCOUNT_REDEEMER_KINDS = [
-	"device",
-	"spendWithGrant",
-	"sweepGrant",
-	"fund"
-];
-/** Constructor order of `MintRedeemer`; no constructor has fields. */
-const MINT_REDEEMER_KINDS = [
-	"createAccount",
-	"issueGrants",
-	"burnGrants"
-];
-/** Decodes a union whose constructors all have no fields. */
-const decodeFieldless = (data, kinds, what) => require_outputs.decodeResult(() => {
-	const index = require_outputs.expectConstrIndex(data, "", what);
-	const kind = kinds[Number(index)];
-	if (kind === void 0) return require_outputs.unknownAlternative("", `${what} of ${kinds.join(", ")}`, index);
-	require_outputs.expectConstr(data, {
-		index: Number(index),
-		arity: 0
-	}, {
-		path: "",
-		what
-	});
-	return { kind };
-});
-/** `Device` is constructor 0, `SpendWithGrant` 1, `SweepGrant` 2 and `Fund` 3. */
-const encodeCustodyAccountRedeemer = ({ kind }) => require_outputs.constr(ACCOUNT_REDEEMER_KINDS.indexOf(kind));
-const decodeCustodyAccountRedeemer = (data) => decodeFieldless(data, ACCOUNT_REDEEMER_KINDS, "an account redeemer");
-/** `CreateAccount` is constructor 0, `IssueGrants` 1 and `BurnGrants` 2. */
-const encodeCustodyMintRedeemer = ({ kind }) => require_outputs.constr(MINT_REDEEMER_KINDS.indexOf(kind));
-const decodeCustodyMintRedeemer = (data) => decodeFieldless(data, MINT_REDEEMER_KINDS, "a mint redeemer");
-/** `Operate`: constructor 0 with no fields. */
-const encodeCustodyStakeRedeemer = () => require_outputs.constr(0);
-/**
-* `Run`, the redeemer of a logic script's withdraw and publish handlers:
-* constructor 0 with no fields.
-*/
-const encodeCustodyLogicRedeemer = () => require_outputs.constr(0);
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/codecs/reserve.ts
-/** The datum the upstream library writes on a reserve: constructor 0 with no fields. */
-const RESERVE_DATUM_CBOR = "d87980";
-/**
-* Whether an inline datum is, byte for byte, the reserve datum `d87980`.
-* Any datum makes a deposit an owner-only reserve; only this one has a known
-* size, so a builder can spend such a reserve without a surprise in fee or
-* minimum lovelace.
-*/
-const isCustodyReserveDatum = (datum) => _laceio_cardano_core.Serialization.PlutusData.fromCore(datum).toCbor() === RESERVE_DATUM_CBOR;
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/fee-shares.ts
-const lovelaceOf = (items) => items.reduce((total, { value }) => total + value.coins, 0n);
-const positivePart = (quantity) => quantity > 0n ? quantity : 0n;
-/** How the fee splits between the external inputs and the operated accounts. */
-const feeSharesOf = ({ externalInputs, externalOutputs, fee }) => {
-	const payers = new Set(externalInputs.map(({ address }) => address));
-	const beyondChange = lovelaceOf(externalInputs) - lovelaceOf(externalOutputs.filter(({ address }) => payers.has(address)));
-	const externalShare = beyondChange < fee ? positivePart(beyondChange) : fee;
-	return {
-		payers: [...payers],
-		externalShare,
-		accountShare: fee - externalShare
-	};
-};
-/**
-* The part of the accounts' fee share each operated account pays, from the
-* lovelace each gives up. Each pays only what the others cannot cover, so an
-* account is named as paying someone whenever some split of the fee has it
-* do so. A single account pays the whole share.
-*/
-const accountFeeSharesOf = (givenUp, accountShare) => {
-	const total = givenUp.reduce((sum, lovelace) => sum + positivePart(lovelace), 0n);
-	return givenUp.map((lovelace) => positivePart(accountShare - (total - positivePart(lovelace))));
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/state-change.ts
-const isSameOrder = (before, after) => {
-	const kept = before.filter((item) => after.includes(item));
-	const keptAfter = after.filter((item) => before.includes(item));
-	return kept.every((item, index) => item === keptAfter[index]);
-};
-const counterChange = (before, after) => before === after ? void 0 : {
-	before,
-	after
-};
-const diffCustodyStates = (before, after) => {
-	const generation = counterChange(before.grantGeneration, after.grantGeneration);
-	const nextSlot = counterChange(before.nextSlot, after.nextSlot);
-	const outstanding = counterChange(before.outstanding, after.outstanding);
-	return {
-		before,
-		after,
-		...before.logic === after.logic ? {} : { logic: {
-			before: before.logic,
-			after: after.logic
-		} },
-		devicesAdded: after.devices.filter((device) => !before.devices.includes(device)),
-		devicesRemoved: before.devices.filter((device) => !after.devices.includes(device)),
-		revokedAdded: after.revoked.filter((slot) => !before.revoked.includes(slot)),
-		revokedRemoved: before.revoked.filter((slot) => !after.revoked.includes(slot)),
-		...generation ? { grantGeneration: generation } : {},
-		...nextSlot ? { nextSlot } : {},
-		...outstanding ? { outstanding } : {},
-		isReordered: !isSameOrder(before.devices, after.devices) || !isSameOrder(before.revoked, after.revoked)
-	};
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/account-inspection.ts
-const accountKey = (account) => `${account.accountValidatorHash}${account.stakeScriptHash}`;
-const hashesOf = (account) => ({
-	accountValidatorHash: account.accountValidatorHash,
-	stakeScriptHash: account.stakeScriptHash
-});
-const versionOfPolicy = (policyId) => require_hex.SUPPORTED_CUSTODY_CONTRACT_VERSIONS.find((version) => version.accountValidatorHash === policyId);
-/**
-* Every custody account the transaction names: by an input, reference input
-* or output at its address, by a mint of one of its account tokens, or by
-* the record.
-*/
-const findCandidates = (facts, record) => {
-	const candidates = /* @__PURE__ */ new Map();
-	const add = (candidate) => candidates.set(accountKey(candidate), candidate);
-	const views = [
-		...facts.inputs.map(({ output }) => output),
-		...facts.referenceInputs.map(({ output }) => output),
-		...facts.outputs
-	];
-	for (const { addressClass } of views) if (addressClass.kind === "account") add({
-		contractVersion: addressClass.contractVersion,
-		accountValidatorHash: addressClass.contractVersion.accountValidatorHash,
-		stakeScriptHash: addressClass.stakeScriptHash
-	});
-	for (const assetId of facts.mint.keys()) {
-		const contractVersion = versionOfPolicy(require_outputs.policyIdOf(assetId));
-		const name = require_tokens.parseCustodyAccountTokenName(require_outputs.assetNameOf(assetId));
-		if (contractVersion && name) add({
-			contractVersion,
-			accountValidatorHash: contractVersion.accountValidatorHash,
-			stakeScriptHash: name.stakeScriptHash
-		});
-	}
-	if (record) add({
-		contractVersion: record.contractVersion,
-		accountValidatorHash: record.contractVersion.accountValidatorHash,
-		stakeScriptHash: record.stakeScriptHash
-	});
-	return [...candidates.values()];
-};
-const VOTE_DELEGATIONS = new Set([
-	_laceio_cardano_core.Cardano.CertificateType.StakeRegistrationDelegation,
-	_laceio_cardano_core.Cardano.CertificateType.StakeVoteDelegation,
-	_laceio_cardano_core.Cardano.CertificateType.StakeVoteRegistrationDelegation,
-	_laceio_cardano_core.Cardano.CertificateType.VoteDelegation,
-	_laceio_cardano_core.Cardano.CertificateType.VoteRegistrationDelegation
-]);
-/**
-* The certificates on the account's stake credential and the withdrawal
-* from its reward account, apart from the logic run, which withdraws from
-* the logic's credential. Registration with a deposit and pool delegation
-* are what Lace builds; vote and combined delegations are valid on chain
-* but unsupported, and every other certificate is refused.
-*/
-const readStakeEffects = (account, facts) => {
-	const refusals = [];
-	const certificates = [];
-	let isStaked = false;
-	for (const [certificateIndex, certificate] of (facts.body.certificates ?? []).entries()) {
-		const credential = stakeCredentialOf(certificate);
-		if (credential?.type !== _laceio_cardano_core.Cardano.CredentialType.ScriptHash || credential.hash !== account.stakeScriptHash) continue;
-		isStaked = true;
-		if (certificate.__typename === _laceio_cardano_core.Cardano.CertificateType.Registration) certificates.push({
-			certificateIndex,
-			kind: "registration",
-			deposit: certificate.deposit
-		});
-		else if (certificate.__typename === _laceio_cardano_core.Cardano.CertificateType.StakeDelegation) certificates.push({
-			certificateIndex,
-			kind: "pool-delegation",
-			poolId: certificate.poolId
-		});
-		else refusals.push({
-			code: "custody-unsupported-operation",
-			reason: VOTE_DELEGATIONS.has(certificate.__typename) ? "unsupported-certificate" : "refused-certificate",
-			certificateIndex,
-			certificateType: certificate.__typename
-		});
-	}
-	const withdrawal = (facts.body.withdrawals ?? []).find(({ stakeAddress }) => scriptHashOfRewardAccount(stakeAddress) === account.stakeScriptHash);
-	return {
-		certificates,
-		withdrawal: withdrawal?.quantity,
-		refusals,
-		isStaked: isStaked || withdrawal !== void 0
-	};
-};
-/**
-* The run of the logic the account operates under: the logic its spent
-* control UTxO names, the referenced one for a grant spend, or the control
-* output's at creation. The proxy requires a withdrawal from that logic's
-* stake credential, which makes the ledger run it. The decoded body keeps
-* one withdrawal per reward account; a repeat in the bytes is refused.
-*/
-const readLogicRun = (account, facts, logic) => {
-	if (logic === void 0) return { refusals: [] };
-	const withdrawal = (facts.body.withdrawals ?? []).find(({ stakeAddress }) => scriptHashOfRewardAccount(stakeAddress) === logic);
-	return withdrawal ? {
-		run: {
-			logic,
-			draw: withdrawal.quantity
-		},
-		refusals: []
-	} : { refusals: [{
-		code: "custody-unsupported-operation",
-		reason: "logic-withdrawal-missing",
-		account,
-		logic
-	}] };
-};
-/**
-* A device whose key hash is not 28 bytes can never sign, and the contract
-* does not check key lengths, so an on-chain state may keep one. Lace never
-* adds one, but a device can still remove it in a rewrite that keeps it
-* meanwhile.
-*/
-const isCarriedOver = (violation, before) => before !== void 0 && violation.code === "invalid-device-key-hash" && before.devices.includes(violation.device);
-/** The authoring checks a state written by a device or a creation must pass. */
-const checkWrittenState = ({ account, before, after }) => require_outputs.findCustodyStateViolations(after).filter((violation) => !isCarriedOver(violation, before)).map((violation) => ({
-	code: "custody-malformed-datum",
-	reason: "state-violation",
-	account,
-	violation
-}));
-const isSameAccount = (account, record) => record !== void 0 && record.contractVersion.accountValidatorHash === account.accountValidatorHash && record.stakeScriptHash === account.stakeScriptHash;
-/**
-* Lace creates only the creator-only state: the current logic of the
-* account's contract version, the creator as the single device, generation
-* zero and no grant issued, revoked or outstanding. The logic also accepts
-* any generation at creation.
-*/
-const isCreatorOnly = (state, creator, logic) => state.logic === logic && state.devices.length === 1 && state.devices[0] === creator && state.grantGeneration === 0n && state.nextSlot === 0n && state.revoked.length === 0 && state.outstanding === 0n;
-/**
-* At creation the stake validator needs the creator's signature, and Lace
-* creates only the creator-only state; otherwise a device listed in the
-* spent state must sign.
-*/
-const checkSigner = ({ account, before, after }, facts, scope) => {
-	const { deviceKeyHash } = scope;
-	const refusals = [];
-	const notSigning = (keyHash) => facts.requiredSigners.has(keyHash) ? [] : [{
-		code: "custody-device-not-listed",
-		reason: "not-required-signer",
-		account,
-		keyHash
-	}];
-	if (!before) {
-		if (!isSameAccount(account, scope.record)) return scope.record ? [] : [{
-			code: "custody-context-mismatch",
-			reason: "creation-without-record",
-			account
-		}];
-		const creator = scope.record.creatorKeyHash;
-		if (deviceKeyHash !== void 0 && deviceKeyHash !== creator) refusals.push({
-			code: "custody-device-not-listed",
-			reason: "not-creator",
-			account,
-			keyHash: deviceKeyHash
-		});
-		refusals.push(...notSigning(creator));
-		if (!isCreatorOnly(after, creator, scope.record.contractVersion.currentLogicHash)) refusals.push({
-			code: "custody-context-mismatch",
-			reason: "initial-state",
-			account
-		});
-		return refusals;
-	}
-	if (deviceKeyHash === void 0) return before.devices.some((device) => facts.requiredSigners.has(device)) ? [] : [{
-		code: "custody-device-not-listed",
-		reason: "no-device-signer",
-		account
-	}];
-	if (!before.devices.includes(deviceKeyHash)) refusals.push({
-		code: "custody-device-not-listed",
-		reason: "not-listed",
-		account,
-		keyHash: deviceKeyHash
-	});
-	return [...refusals, ...notSigning(deviceKeyHash)];
-};
-/** The redeemers the contract lets spend each kind of account UTxO. */
-const REDEEMERS_OF = {
-	control: ["device"],
-	grant: ["spendWithGrant", "sweepGrant"],
-	reserve: ["fund"],
-	fund: ["fund"]
-};
-/**
-* The account inputs by kind, each with its spend redeemer, which must fit
-* the UTxO it spends. A plain deposit rides on any account token spent
-* beside it; a reserve needs the control UTxO, so only a device spends it.
-*/
-const readAccountInputs = (account, facts) => {
-	const refusals = [];
-	const spent = facts.inputs.flatMap((view, redeemerIndex) => {
-		if (!require_outputs.isAtAccount(view.output, account)) return [];
-		const kind = require_outputs.accountUtxoKindOf(view.output, account);
-		const data = redeemerData(facts, _laceio_cardano_core.Cardano.RedeemerPurpose.spend, redeemerIndex);
-		const decoded = data === void 0 ? void 0 : decodeCustodyAccountRedeemer(data);
-		if (!decoded?.ok) {
-			refusals.push({
-				code: "custody-unsupported-operation",
-				reason: decoded ? "unknown-redeemer" : "missing-redeemer",
-				purpose: "spend",
-				index: redeemerIndex
-			});
-			return [{
-				...view,
-				kind,
-				redeemer: void 0
-			}];
-		}
-		if (!REDEEMERS_OF[kind].includes(decoded.value.kind)) refusals.push({
-			code: "custody-context-mismatch",
-			reason: "redeemer-mismatch",
-			input: view.input,
-			redeemer: decoded.value.kind
-		});
-		return [{
-			...view,
-			kind,
-			redeemer: decoded.value
-		}];
-	});
-	const ofKind = (kind) => spent.filter((input) => input.kind === kind);
-	const controls = ofKind("control");
-	const grants = ofKind("grant");
-	const reserves = ofKind("reserve");
-	const funds = ofKind("fund");
-	if (controls.length === 0) refusals.push(...reserves.map(({ input }) => ({
-		code: "custody-unsupported-operation",
-		reason: "reserve-without-control",
-		input
-	})));
-	if (funds.length > 0 && controls.length + grants.length === 0) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "fund-without-account-token",
-		account
-	});
-	return {
-		controls,
-		spends: grants.filter(({ redeemer }) => redeemer?.kind === "spendWithGrant"),
-		sweeps: grants.filter(({ redeemer }) => redeemer?.kind === "sweepGrant"),
-		reserves,
-		funds,
-		isSpent: spent.length > 0,
-		refusals
-	};
-};
-const bySlot$1 = (a, b) => a.slot < b.slot ? -1 : a.slot > b.slot ? 1 : 0;
-const mintShapeOf = (entries) => {
-	const names = entries.map(([assetId, quantity]) => ({
-		name: require_tokens.parseCustodyAccountTokenName(require_outputs.assetNameOf(assetId)),
-		quantity
-	}));
-	const [first] = names;
-	if (names.length === 1 && first.name?.kind === "state-nft") return {
-		kind: "creation",
-		stakeScriptHash: first.name.stakeScriptHash
-	};
-	const stakeScriptHash = first?.name?.stakeScriptHash;
-	if (!(stakeScriptHash !== void 0 && names.every(({ name, quantity }) => name?.kind === "grant" && name.stakeScriptHash === stakeScriptHash && (quantity === 1n || quantity === -1n)))) return { kind: "invalid" };
-	const issues = names.filter(({ quantity }) => quantity === 1n).length;
-	return {
-		kind: issues === names.length ? "issue" : issues === 0 ? "burn" : "mixed",
-		stakeScriptHash
-	};
-};
-/**
-* The account's mint: its state NFT at creation, grant tokens issued at +1
-* or burned at -1, under the one mint redeemer of the policy. A device
-* spend of the control UTxO counts only the account's own grant tokens, so
-* any other name under the policy beside it is refused. A mint of no valid
-* shape is the transaction checks' to refuse.
-*/
-const readMint = (account, facts, hasControlInput) => {
-	const refusals = [];
-	const policy = account.accountValidatorHash;
-	const nftAssetId = require_outputs.stateNftAssetIdOf(account);
-	const entries = [...facts.mint].filter(([assetId]) => require_outputs.policyIdOf(assetId) === policy);
-	const shape = mintShapeOf(entries);
-	const isOwnGrantMint = shape.kind !== "invalid" && shape.kind !== "creation" && shape.stakeScriptHash === account.stakeScriptHash;
-	const issued = [];
-	const burned = [];
-	for (const [assetId, quantity] of entries) {
-		const name = require_tokens.parseCustodyAccountTokenName(require_outputs.assetNameOf(assetId));
-		if (isOwnGrantMint && name?.kind === "grant") (quantity === 1n ? issued : burned).push({
-			slot: name.slot,
-			assetId
-		});
-		else if (shape.kind !== "invalid" && shape.kind !== "mixed" && (hasControlInput || assetId === nftAssetId && quantity !== 1n)) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "unsupported-mint",
-			assetId,
-			quantity
-		});
-	}
-	issued.sort(bySlot$1);
-	burned.sort(bySlot$1);
-	const isCreation = facts.mint.has(nftAssetId);
-	if (isCreation || isOwnGrantMint) {
-		const index = facts.mintPolicies.indexOf(policy);
-		const data = redeemerData(facts, _laceio_cardano_core.Cardano.RedeemerPurpose.mint, index);
-		const decoded = data === void 0 ? void 0 : decodeCustodyMintRedeemer(data);
-		const expected = {
-			creation: "createAccount",
-			issue: "issueGrants",
-			burn: "burnGrants"
-		};
-		if (!decoded?.ok) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: decoded ? "unknown-redeemer" : "missing-redeemer",
-			purpose: "mint",
-			index
-		});
-		else if (expected[shape.kind] !== void 0 && decoded.value.kind !== expected[shape.kind]) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "mint-redeemer-mismatch",
-			account,
-			redeemer: decoded.value.kind
-		});
-	}
-	if (isOwnGrantMint && !hasControlInput) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "grant-mint-without-control",
-		account
-	});
-	for (const count of [issued.length, burned.length]) if (count > 8) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "grant-batch-limit",
-		account,
-		count,
-		limit: 8
-	});
-	return {
-		isCreation,
-		issued,
-		burned,
-		refusals
-	};
-};
-/** The control input's checks: one control UTxO whose resolution holds a state. */
-const readControlInput = (account, inputs) => {
-	const refusals = [];
-	const [control] = inputs.controls;
-	if (inputs.controls.length > 1) refusals.push({
-		code: "custody-context-mismatch",
-		reason: "multiple-control-inputs",
-		account
-	});
-	const before = control && require_outputs.decodedInlineState(control.output);
-	if (control) {
-		if (!before) refusals.push({
-			code: "custody-malformed-datum",
-			reason: "control-input-datum",
-			input: control.input
-		});
-		if (!require_outputs.holdsOnlyLovelaceAndStateNft(control.output.value, account)) refusals.push({
-			code: "custody-malformed-datum",
-			reason: "control-input-value",
-			input: control.input
-		});
-	}
-	return {
-		control,
-		before,
-		refusals
-	};
-};
-/**
-* The account's control UTxO among the reference inputs. Only a grant spend
-* reads the control UTxO without spending it: Lace spends it for every
-* owner operation, delegation and withdrawal included.
-*/
-const readReferencedControls = (account, facts, isGrantSpend) => {
-	const references = facts.referenceInputs.filter(({ output }) => require_outputs.isControlOutput(output, account));
-	return {
-		references,
-		refusals: isGrantSpend ? [] : references.map(({ input }) => ({
-			code: "custody-unsupported-operation",
-			reason: "reference-control",
-			input
-		}))
-	};
-};
-/**
-* Registration belongs to creation and creation needs it; delegation and
-* withdrawal need the control UTxO spent, since Lace never references it
-* for them.
-*/
-const checkStakeOperations = (account, { certificates, withdrawal }, { isCreation, hasControlInput }) => {
-	const refusals = [];
-	const isRegistered = certificates.some(({ kind }) => kind === "registration");
-	if (isRegistered && !isCreation) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "registration-without-creation",
-		account
-	});
-	if (isCreation && !isRegistered) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "creation-without-registration",
-		account
-	});
-	if ((withdrawal !== void 0 || certificates.some(({ kind }) => kind === "pool-delegation")) && !hasControlInput) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "stake-operation-without-control",
-		account
-	});
-	return refusals;
-};
-/**
-* The control output's checks. With a control input or a creation there is
-* exactly one, holding only lovelace and the NFT and an account state, with
-* no reference script, which the proxy refuses there; without either there
-* is none.
-*/
-const readControlOutput = (account, facts, hasStateSource) => {
-	const refusals = [];
-	const controls = facts.outputs.flatMap((view, outputIndex) => require_outputs.isControlOutput(view, account) ? [{
-		view,
-		outputIndex
-	}] : []);
-	if (!hasStateSource && controls.length > 0) refusals.push({
-		code: "custody-context-mismatch",
-		reason: "control-output-without-control-input",
-		account
-	});
-	if (hasStateSource && controls.length !== 1) refusals.push({
-		code: "custody-malformed-datum",
-		reason: "control-output-count",
-		account,
-		count: controls.length
-	});
-	const control = controls.length === 1 ? controls[0] : void 0;
-	const after = control && require_outputs.decodedInlineState(control.view);
-	if (hasStateSource && control) {
-		if (!require_outputs.holdsOnlyLovelaceAndStateNft(control.view.value, account)) refusals.push({
-			code: "custody-malformed-datum",
-			reason: "control-output-value",
-			outputIndex: control.outputIndex
-		});
-		if (!after) refusals.push({
-			code: "custody-malformed-datum",
-			reason: "control-output-datum",
-			outputIndex: control.outputIndex
-		});
-		if (control.view.hasReferenceScript) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "control-output-reference-script",
-			outputIndex: control.outputIndex
-		});
-	}
-	return {
-		count: controls.length,
-		control,
-		after,
-		refusals
-	};
-};
-/** What one issued grant breaks of `issues_grant`, or its output and grant. */
-const readIssuedGrant = (account, facts, { assetId }) => {
-	const holders = facts.outputs.flatMap((view, outputIndex) => view.value.assets.get(assetId) === 1n ? [{
-		view,
-		outputIndex
-	}] : []);
-	if (holders.length !== 1) return { problem: {
-		code: "output-count",
-		count: holders.length
-	} };
-	const [{ view, outputIndex }] = holders;
-	if (!require_outputs.isAtAccount(view, account)) return { problem: {
-		code: "address",
-		outputIndex
-	} };
-	if (view.value.assets.size !== 1) return { problem: {
-		code: "value",
-		outputIndex
-	} };
-	if (view.hasReferenceScript) return { problem: {
-		code: "reference-script",
-		outputIndex
-	} };
-	if (view.inlineDatum === void 0) return { problem: {
-		code: "datum-not-inline",
-		outputIndex
-	} };
-	const decoded = require_outputs.decodeCustodyGrant(view.inlineDatum);
-	return decoded.ok ? {
-		view,
-		outputIndex,
-		grant: decoded.value
-	} : { problem: {
-		code: "datum-malformed",
-		outputIndex
-	} };
-};
-/**
-* The grants a device rewrite issues: `issues_grant` for each minted token,
-* in slot order from the spent state's next slot, each under the generation
-* of the control output, plus the rules Lace applies to every grant it
-* authors and an expiry after `now`.
-*/
-const readIssuedGrants = (account, facts, { issued, before, after, now }) => {
-	const refusals = [];
-	const reports = [];
-	const refuse = (slot, problem) => refusals.push({
-		code: "custody-malformed-datum",
-		reason: "grant-output-invalid",
-		account,
-		slot,
-		problem
-	});
-	for (const [index, mint] of issued.entries()) {
-		const { slot } = mint;
-		if (before) {
-			const expected = before.nextSlot + BigInt(index);
-			if (slot !== expected) refuse(slot, {
-				code: "not-next-slot",
-				expected
-			});
-		}
-		const read = readIssuedGrant(account, facts, mint);
-		if ("problem" in read) {
-			refuse(slot, read.problem);
-			continue;
-		}
-		const { view, outputIndex, grant } = read;
-		if (grant.slot !== slot) refuse(slot, {
-			code: "slot-mismatch",
-			outputIndex,
-			datumSlot: grant.slot
-		});
-		if (after && grant.generation !== after.grantGeneration) refuse(slot, {
-			code: "generation-mismatch",
-			outputIndex,
-			generation: grant.generation,
-			expected: after.grantGeneration
-		});
-		refusals.push(...require_outputs.findCustodyGrantViolations(grant).map((violation) => ({
-			code: "custody-malformed-datum",
-			reason: "grant-violation",
-			account,
-			slot,
-			violation
-		})));
-		if (require_outputs.isCustodyGrantExpired(grant, now)) refusals.push({
-			code: "custody-malformed-datum",
-			reason: "expired-grant",
-			account,
-			slot,
-			expiresAt: grant.scope.expiresAt
-		});
-		reports.push({
-			outputIndex,
-			assetId: mint.assetId,
-			grant,
-			lovelace: view.value.lovelace
-		});
-	}
-	return {
-		reports,
-		refusals
-	};
-};
-/**
-* `is_dead` against the spent state: issued under an older generation, its
-* slot revoked, or the validity interval starting strictly after its expiry.
-*/
-const deathOf = (grant, state, lowerBoundMs) => {
-	if (grant.generation < state.grantGeneration) return "superseded";
-	if (state.revoked.includes(grant.slot)) return "revoked";
-	return lowerBoundMs !== void 0 && Number.isSafeInteger(lowerBoundMs) && BigInt(lowerBoundMs) > grant.scope.expiresAt ? "expired" : void 0;
-};
-/**
-* The grants a device rewrite sweeps: each grant UTxO spent with
-* `SweepGrant` carries its grant inline beside only its token, is dead
-* against the spent state, and has its token burned; every burned token is
-* a swept grant's.
-*/
-const readSweptGrants = (account, facts, { sweeps, burned, before, hasControlInput }) => {
-	const refusals = [];
-	const reports = [];
-	if (sweeps.length > 0 && !hasControlInput) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "sweep-without-control",
-		account
-	});
-	for (const { input, output } of sweeps) {
-		const grant = require_outputs.decodedInlineGrant(output);
-		if (!grant) {
-			refusals.push({
-				code: "custody-malformed-datum",
-				reason: "grant-input-datum",
-				input
-			});
-			continue;
-		}
-		const assetId = require_outputs.grantAssetIdOf(account, grant.slot);
-		if (!assetId || !require_outputs.holdsOnlyLovelaceAndGrantToken(output.value, account, grant.slot)) {
-			refusals.push({
-				code: "custody-malformed-datum",
-				reason: "grant-input-value",
-				input
-			});
-			continue;
-		}
-		if (facts.mint.get(assetId) !== -1n) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "sweep-burn-mismatch",
-			account,
-			slot: grant.slot
-		});
-		if (!before) continue;
-		const death = deathOf(grant, before, facts.lowerBoundMs);
-		if (!death) {
-			refusals.push({
-				code: "custody-unsupported-operation",
-				reason: "sweep-not-dead",
-				account,
-				input,
-				slot: grant.slot
-			});
-			continue;
-		}
-		reports.push({
-			input,
-			assetId,
-			grant,
-			lovelace: output.value.lovelace,
-			death
-		});
-	}
-	const sweptSlots = sweeps.flatMap(({ output }) => {
-		const grant = require_outputs.decodedInlineGrant(output);
-		return grant ? [grant.slot] : [];
-	});
-	for (const { slot } of burned) if (!sweptSlots.includes(slot)) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "sweep-burn-mismatch",
-		account,
-		slot
-	});
-	return {
-		reports,
-		refusals
-	};
-};
-/**
-* Every control state the transaction spends, references or writes for the
-* account names a logic of its contract version's catalogue: the logic is
-* the account's rule set, and any registered script may be named there, so
-* an unknown one runs rules Lace has not reviewed. Each unknown logic is
-* refused once.
-*/
-const checkKnownLogics = (account, version, states) => {
-	const unknown = /* @__PURE__ */ new Set();
-	for (const state of states) if (state && !require_hex.findCustodyLogic(version, state.logic).ok) unknown.add(state.logic);
-	return [...unknown].map((logic) => ({
-		code: "custody-unsupported-version",
-		reason: "unknown-logic",
-		account,
-		logic
-	}));
-};
-/**
-* The counter rules of `recreates_control_output`, and the rules Lace adds:
-* the logic stays, since Lace does not sign an upgrade; a slot leaves the
-* revoked list only with its grant token burned in the same rewrite, or
-* with a generation step that supersedes every grant; a slot joins it only
-* once, and only after it was issued.
-*/
-const checkStateChange = (account, change, { issued, burned }) => {
-	const { before, after } = change;
-	const refusals = [];
-	if (change.logic) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "logic-changed",
-		account,
-		before: change.logic.before,
-		after: change.logic.after
-	});
-	if (after.grantGeneration < before.grantGeneration) refusals.push({
-		code: "custody-malformed-datum",
-		reason: "generation-decreased",
-		account,
-		before: before.grantGeneration,
-		after: after.grantGeneration
-	});
-	const minted = BigInt(issued.length);
-	const counters = [[
-		"nextSlot",
-		before.nextSlot + minted,
-		after.nextSlot
-	], [
-		"outstanding",
-		before.outstanding + minted - BigInt(burned.length),
-		after.outstanding
-	]];
-	for (const [counter, expected, actual] of counters) if (actual !== expected) refusals.push({
-		code: "custody-malformed-datum",
-		reason: "counter-mismatch",
-		account,
-		counter,
-		expected,
-		actual
-	});
-	if (after.grantGeneration === before.grantGeneration) {
-		for (const slot of change.revokedRemoved) if (!burned.some((mint) => mint.slot === slot)) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "revoked-slot-restored",
-			account,
-			slot
-		});
-	}
-	const invalid = change.revokedAdded.filter((slot, index) => slot < 0n || slot >= before.nextSlot || change.revokedAdded.indexOf(slot) !== index);
-	for (const slot of new Set(after.revoked)) {
-		const previousCount = before.revoked.filter((value) => value === slot).length;
-		if (after.revoked.filter((value) => value === slot).length > Math.max(1, previousCount)) invalid.push(slot);
-	}
-	for (const slot of new Set(invalid)) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "revoked-slot-invalid",
-		account,
-		slot
-	});
-	return refusals;
-};
-/**
-* Grant spends are refused unless the caller allows them. An allowed one is
-* refused for every rule of the logic's grant spend rule it breaks, so an
-* accepted grant spend is one the contract accepts, and for any input
-* outside the account address: an agent spends from the account alone.
-*/
-const checkGrantSpends = ({ account, spends }, facts, scope) => [...spends.flatMap(({ input, output }) => scope.options.allowGrantSpend ? grantSpendViolationsOf({
-	grantInput: output,
-	inputs: facts.inputs.map((view) => view.output),
-	referenceInputs: facts.referenceInputs.map((view) => view.output),
-	outputs: facts.outputs,
-	mint: facts.mint,
-	requiredSigners: facts.requiredSigners,
-	upperBoundMs: facts.upperBoundMs,
-	account
-}).map((violation) => ({
-	code: "custody-unsupported-operation",
-	reason: "grant-spend-violation",
-	account,
-	input,
-	violation
-})) : [{
-	code: "custody-unsupported-operation",
-	reason: "grant-spend",
-	account,
-	input
-}]), ...scope.options.allowGrantSpend && spends.length > 0 ? facts.inputs.filter(({ output }) => !require_outputs.isAtAccount(output, account)).map(({ input }) => ({
-	code: "custody-unsupported-operation",
-	reason: "grant-spend-foreign-input",
-	account,
-	input
-})) : []];
-/** The grant a single grant spend uses and the output that recreates it. */
-const grantSpendReportOf = (account, spends, facts) => {
-	if (spends.length !== 1) return void 0;
-	const [{ input, output }] = spends;
-	const grant = require_outputs.decodedInlineGrant(output);
-	const assetId = grant && require_outputs.grantAssetIdOf(account, grant.slot);
-	const outputIndex = facts.outputs.findIndex((view) => assetId !== void 0 && view.value.assets.get(assetId) === 1n);
-	const after = outputIndex === -1 ? void 0 : require_outputs.decodedInlineGrant(facts.outputs[outputIndex]);
-	return grant && after ? {
-		input,
-		grant,
-		outputIndex,
-		after
-	} : void 0;
-};
-/**
-* The operations a device rewrite performs, from its state change and the
-* grants it issues and sweeps. One revoked slot beside one issued grant is a
-* replacement; a generation step of one that empties the revoked list
-* under the same logic revokes every grant, where an upgrade has the same
-* counters.
-*/
-const stateOperationsOf = (change, issuedSlots, sweptSlots) => {
-	const { before, after, revokedAdded } = change;
-	const isRevokeAll = !change.logic && after.grantGeneration === before.grantGeneration + 1n && after.revoked.length === 0;
-	const isReplace = !change.grantGeneration && revokedAdded.length === 1 && issuedSlots.length === 1;
-	return [
-		...isReplace ? [{
-			kind: "replace-grant",
-			slot: revokedAdded[0],
-			issuedSlot: issuedSlots[0]
-		}] : issuedSlots.map((slot) => ({
-			kind: "issue-grant",
-			slot
-		})),
-		...isRevokeAll ? [{ kind: "revoke-all-grants" }] : [...isReplace ? [] : revokedAdded.map((slot) => ({
-			kind: "revoke-grant",
-			slot
-		})), ...change.grantGeneration ? [{ kind: "change-grant-generation" }] : []],
-		...sweptSlots.length > 0 ? [{
-			kind: "sweep-grants",
-			slots: sweptSlots
-		}] : [],
-		...change.devicesAdded.map((device) => ({
-			kind: "add-device",
-			device
-		})),
-		...change.devicesRemoved.map((device) => ({
-			kind: "remove-device",
-			device
-		})),
-		...change.isReordered ? [{ kind: "reorder-state" }] : []
-	];
-};
-/**
-* Lovelace leaving the account's address, its reward account and its logic
-* run's draw; negative is a net inflow. Lovelace is fungible, so what the
-* logic run draws is credited to the account: any of it that leaves counts
-* as the account's.
-*/
-const lovelaceGivenUp = ({ netOutflow, stake, logicRun }) => netOutflow.lovelace + (stake.withdrawal ?? 0n) + (logicRun?.draw ?? 0n);
-/**
-* Whether an owner operation pays value out of the account: any asset that
-* leaves it, or lovelace given up beyond its share of the fee. An account
-* that pays only its own fee spends nothing. Account tokens are minted and
-* burned, never paid out: placement keeps them at their accounts.
-*/
-const isOwnerSpend = (facts, feeShare) => [...facts.netOutflow.assets].some(([assetId, quantity]) => quantity > 0n && require_outputs.policyIdOf(assetId) !== facts.account.accountValidatorHash) || lovelaceGivenUp(facts) > feeShare;
-const operationsOf = (facts, feeShare) => {
-	const { isCreation, grantSpend, stateChange, stake } = facts;
-	return [
-		...isCreation ? [{ kind: "create" }] : [],
-		...grantSpend ? [{
-			kind: "grant-spend",
-			slot: grantSpend.grant.slot
-		}] : [],
-		...stateChange ? stateOperationsOf(stateChange, facts.issued.map(({ grant }) => grant.slot), facts.swept.map(({ grant }) => grant.slot)) : [],
-		...!facts.isGrantSpend && isOwnerSpend(facts, feeShare) ? [{ kind: "owner-spend" }] : [],
-		...stake.certificates.flatMap((certificate) => certificate.kind === "pool-delegation" ? [{
-			kind: "delegate",
-			poolId: certificate.poolId
-		}] : []),
-		...stake.withdrawal === void 0 ? [] : [{
-			kind: "withdraw-rewards",
-			quantity: stake.withdrawal
-		}]
-	];
-};
-/** Each operated account's part of the accounts' fee share, in order. */
-const feeSharesOfAccounts = (operated, { accountShare }) => accountFeeSharesOf(operated.map(({ operationFacts }) => lovelaceGivenUp(operationFacts)), accountShare);
-/** The reports of the operated accounts, each with its operations named. */
-const withOperations = (operated, feeShares) => {
-	const shares = feeSharesOfAccounts(operated, feeShares);
-	return operated.map(({ report, operationFacts }, index) => ({
-		...report,
-		operations: operationsOf(operationFacts, shares[index])
-	}));
-};
-/**
-* A logic run that draws lovelace must leave it at the account. Lovelace
-* is fungible, so the draw is credited to the account, and it stays there
-* when the account gives up no more lovelace than its part of the fee. A
-* fee payer that takes change back could have paid the whole fee, so the
-* accounts' part is then nothing: otherwise the payer's change could hold
-* the draw. A grant spend pays out of the account by definition, so it may
-* draw nothing.
-*/
-const checkLogicDraws = (operated, feeShares, isChangeToPayers) => {
-	const shares = isChangeToPayers ? operated.map(() => 0n) : feeSharesOfAccounts(operated, feeShares);
-	return operated.flatMap(({ operationFacts }, index) => {
-		const { account, logicRun, isGrantSpend } = operationFacts;
-		if (!logicRun || logicRun.draw === 0n) return [];
-		return isGrantSpend || lovelaceGivenUp(operationFacts) > shares[index] ? [{
-			code: "custody-unsupported-operation",
-			reason: "logic-draw-leaves-account",
-			account,
-			logic: logicRun.logic,
-			quantity: logicRun.draw
-		}] : [];
-	});
-};
-const isOwnReserve = (view) => view.inlineDatum !== void 0 && !view.hasReferenceScript && isCustodyReserveDatum(view.inlineDatum);
-const inspectAccount = (candidate, facts, scope) => {
-	const account = hashesOf(candidate);
-	const { networkId } = scope.options.chainId;
-	const inputs = readAccountInputs(account, facts);
-	const { control, before, ...controlInput } = readControlInput(account, inputs);
-	const hasControlInput = control !== void 0;
-	const isGrantSpend = inputs.spends.length > 0;
-	const mint = readMint(account, facts, hasControlInput);
-	const stake = readStakeEffects(candidate, facts);
-	const controlOutput = readControlOutput(account, facts, hasControlInput || mint.isCreation);
-	const { after } = controlOutput;
-	const referenced = readReferencedControls(account, facts, isGrantSpend);
-	const referencedStates = referenced.references.map(({ output }) => require_outputs.decodedInlineState(output));
-	const states = [
-		before,
-		after,
-		...referencedStates
-	];
-	const logicRun = readLogicRun(account, facts, before?.logic ?? (isGrantSpend ? referencedStates[0]?.logic : void 0) ?? (mint.isCreation ? after?.logic : void 0));
-	const issued = readIssuedGrants(account, facts, {
-		issued: mint.issued,
-		before,
-		after,
-		now: scope.options.now
-	});
-	const swept = readSweptGrants(account, facts, {
-		sweeps: inputs.sweeps,
-		burned: mint.burned,
-		before,
-		hasControlInput
-	});
-	const refusals = [
-		...inputs.refusals,
-		...controlInput.refusals,
-		...mint.refusals,
-		...referenced.refusals,
-		...checkKnownLogics(account, candidate.contractVersion, states),
-		...logicRun.refusals,
-		...stake.refusals,
-		...checkStakeOperations(account, stake, {
-			isCreation: mint.isCreation,
-			hasControlInput
-		}),
-		...controlOutput.refusals,
-		...issued.refusals,
-		...swept.refusals,
-		...checkGrantSpends({
-			account,
-			spends: inputs.spends
-		}, facts, scope)
-	];
-	const netOutflow = leavingValueAt(facts.inputs.map(({ output }) => output), facts.outputs, require_outputs.accountPlutusAddressKey(account));
-	let stateChange;
-	if (after && (before || mint.isCreation)) {
-		const written = {
-			account,
-			before,
-			after
-		};
-		refusals.push(...checkWrittenState(written), ...checkSigner(written, facts, scope));
-		if (before) {
-			stateChange = diffCustodyStates(before, after);
-			refusals.push(...checkStateChange(account, stateChange, mint));
-		}
-	}
-	const [reference] = referenced.references;
-	const [referencedState] = referencedStates;
-	const grantSpend = grantSpendReportOf(account, inputs.spends, facts);
-	return {
-		isOperated: inputs.isSpent || mint.isCreation || mint.issued.length + mint.burned.length > 0 || stake.isStaked || controlOutput.count > 0,
-		refusals,
-		logics: states.flatMap((state) => state ? [state.logic] : []),
-		report: {
-			contractVersion: candidate.contractVersion,
-			...account,
-			address: require_outputs.accountAddressOf(account, networkId),
-			rewardAccount: require_outputs.accountRewardAccountOf(account, networkId),
-			...control && before ? { controlInput: {
-				input: control.input,
-				state: before,
-				lovelace: control.output.value.lovelace
-			} } : {},
-			...controlOutput.control && after ? { controlOutput: {
-				outputIndex: controlOutput.control.outputIndex,
-				state: after,
-				lovelace: controlOutput.control.view.value.lovelace
-			} } : {},
-			...isGrantSpend && reference && referencedState ? { referencedControl: {
-				input: reference.input,
-				state: referencedState,
-				lovelace: reference.output.value.lovelace
-			} } : {},
-			fundInputs: inputs.funds.map(({ input, output }) => ({
-				input,
-				value: output.txOut.value,
-				hasReferenceScript: output.hasReferenceScript
-			})),
-			reserveInputs: inputs.reserves.map(({ input, output }) => ({
-				input,
-				value: output.txOut.value,
-				datum: output.datumKind === "hash" ? "hash" : "inline",
-				isOwnFormat: isOwnReserve(output),
-				hasReferenceScript: output.hasReferenceScript
-			})),
-			accountOutputs: facts.outputs.flatMap((view, outputIndex) => require_outputs.isAtAccount(view, account) ? [{
-				outputIndex,
-				value: view.txOut.value,
-				datum: view.datumKind,
-				kind: require_outputs.accountUtxoKindOf(view, account)
-			}] : []),
-			issuedGrants: issued.reports,
-			sweptGrants: swept.reports,
-			...grantSpend ? { grantSpend } : {},
-			netOutflow,
-			certificates: stake.certificates,
-			...stake.withdrawal === void 0 ? {} : { withdrawal: stake.withdrawal },
-			...logicRun.run && logicRun.run.draw > 0n ? { logicDraw: logicRun.run.draw } : {},
-			...stateChange ? { stateChange } : {}
-		},
-		operationFacts: {
-			account,
-			isCreation: mint.isCreation,
-			isGrantSpend,
-			grantSpend,
-			stateChange,
-			issued: issued.reports,
-			swept: swept.reports,
-			netOutflow,
-			stake,
-			logicRun: logicRun.run
-		}
-	};
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/auxiliary-data.ts
-/**
-* The metadata a transaction carries, read from its auxiliary data and
-* bound to the signed body by the auxiliary data hash. Undefined without
-* any. A body that commits to auxiliary data the transaction does not
-* carry, or auxiliary data the body does not commit to by that hash, is
-* refused: a signature over the body would then authorise metadata consent
-* never saw. So is auxiliary data holding anything but metadata.
-*/
-const readCustodyMetadata = (transaction, body) => {
-	let auxiliaryData;
-	let carried;
-	try {
-		const serialized = transaction.auxiliaryData();
-		auxiliaryData = serialized?.toCore();
-		carried = serialized ? _laceio_cardano_crypto.blake2b.hash(serialized.toCbor(), 32) : void 0;
-	} catch {
-		return require_hex.fail({
-			code: "custody-unsupported-operation",
-			reason: "auxiliary-data-unreadable"
-		});
-	}
-	if (body.auxiliaryDataHash?.toLowerCase() !== carried) return require_hex.fail({
-		code: "custody-unsupported-operation",
-		reason: "auxiliary-data-hash-mismatch"
-	});
-	if ((auxiliaryData?.scripts?.length ?? 0) > 0) return require_hex.fail({
-		code: "custody-unsupported-operation",
-		reason: "auxiliary-data-scripts"
-	});
-	const metadata = auxiliaryData?.blob;
-	return require_hex.ok(metadata && metadata.size > 0 ? metadata : void 0);
-};
-/**
-* A grant spend carrying metadata. An agent spends only what its grant
-* allows, and attaching data to the account's transactions is not among it.
-*/
-const checkGrantSpendMetadata = (operated, metadata) => metadata === void 0 ? [] : operated.flatMap(({ report }) => report.grantSpend ? [{
-	code: "custody-unsupported-operation",
-	reason: "grant-spend-metadata",
-	account: hashesOf(report),
-	input: report.grantSpend.input
-}] : []);
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/refusals.ts
-/**
-* The order checks run in: the record, the caller's context, the account
-* UTxOs it resolves, a grant spend, unsupported shapes, the written datums,
-* the signing device, the initial state at creation and locked outputs.
-*/
-const STAGE = {
-	"unsupported-contract-version": 0,
-	"invalid-record": 0,
-	"unresolved-input": 1,
-	"resolution-not-in-body": 1,
-	"duplicate-resolution": 1,
-	"invalid-resolution": 1,
-	"network-mismatch": 1,
-	"redeemer-mismatch": 1,
-	"redeemer-on-key-input": 1,
-	"reference-script-mismatch": 1,
-	"unused-account-validator": 1,
-	"unused-logic": 1,
-	"multiple-control-inputs": 1,
-	"foreign-account": 1,
-	"account-not-operated": 1,
-	"creation-without-record": 1,
-	"control-output-without-control-input": 1,
-	"control-input-datum": 2,
-	"unknown-logic": 2,
-	"control-input-value": 2,
-	"grant-input-datum": 2,
-	"grant-input-value": 2,
-	"grant-spend": 3,
-	"grant-spend-violation": 3,
-	"grant-spend-foreign-input": 3,
-	"grant-spend-metadata": 3,
-	"unsupported-body-field": 4,
-	"auxiliary-data-hash-mismatch": 4,
-	"auxiliary-data-scripts": 4,
-	"auxiliary-data-unreadable": 4,
-	"missing-redeemer": 4,
-	"unknown-redeemer": 4,
-	"duplicate-redeemer": 4,
-	"mint-redeemer-mismatch": 4,
-	"foreign-certificate": 4,
-	"refused-certificate": 4,
-	"unsupported-certificate": 4,
-	"foreign-withdrawal": 4,
-	"duplicate-withdrawal": 4,
-	"logic-draw-leaves-account": 4,
-	"logic-withdrawal-missing": 4,
-	"foreign-mint": 4,
-	"unsupported-mint": 4,
-	"issue-sweep-mixed": 4,
-	"grant-batch-limit": 4,
-	"grant-mint-without-control": 4,
-	"reference-control": 4,
-	"foreign-reference-script": 4,
-	"creation-without-registration": 4,
-	"fund-without-account-token": 4,
-	"reserve-without-control": 4,
-	"sweep-without-control": 4,
-	"sweep-burn-mismatch": 4,
-	"registration-without-creation": 4,
-	"stake-operation-without-control": 4,
-	"account-token-misplaced": 4,
-	"foreign-reserve": 4,
-	"deposit-reference-script": 4,
-	"control-output-count": 5,
-	"control-output-datum": 5,
-	"control-output-value": 5,
-	"control-output-reference-script": 5,
-	"state-violation": 5,
-	"counter-mismatch": 5,
-	"generation-decreased": 5,
-	"logic-changed": 5,
-	"revoked-slot-restored": 5,
-	"revoked-slot-invalid": 5,
-	"grant-output-invalid": 5,
-	"grant-violation": 5,
-	"expired-grant": 5,
-	"sweep-not-dead": 5,
-	"no-device-signer": 6,
-	"not-creator": 6,
-	"not-listed": 6,
-	"not-required-signer": 6,
-	"initial-state": 7,
-	"datum-hash": 8,
-	"unspendable-address": 8
-};
-/** Refusals in check order; refusals of one stage keep the order found. */
-const inCheckOrder = (refusals) => refusals.map((refusal, position) => ({
-	refusal,
-	position
-})).sort((a, b) => STAGE[a.refusal.reason] - STAGE[b.refusal.reason] || a.position - b.position).map(({ refusal }) => refusal);
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/transaction-checks.ts
-const UNSUPPORTED_BODY_FIELDS = [
-	"accountBalanceIntervals",
-	"directDeposits",
-	"guards",
-	"proposalProcedures",
-	"subTransactions",
-	"update",
-	"votingProcedures"
-];
-/**
-* A redeemer pointer named twice has no single reading, so the redeemer a
-* check reads might not be the one a script runs with.
-*/
-const checkRedeemerPointers = (facts) => {
-	const seen = /* @__PURE__ */ new Set();
-	const refusals = [];
-	for (const { purpose, index } of facts.redeemers) {
-		const pointer = `${purpose}:${index}`;
-		if (seen.has(pointer)) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "duplicate-redeemer",
-			purpose,
-			index
-		});
-		seen.add(pointer);
-	}
-	return refusals;
-};
-/**
-* Consistency checks that catch resolutions hiding a custody spend. The
-* ledger refuses a spend redeemer for an input no script locks, and an
-* account validator witness that no input or mint needs, so either means a
-* resolution misstates what the transaction spends.
-*/
-const checkSpendWitnesses = (facts) => {
-	const refusals = [];
-	for (const [index, { input, output }] of facts.inputs.entries()) if (redeemerData(facts, _laceio_cardano_core.Cardano.RedeemerPurpose.spend, index) !== void 0 && paymentCredentialOf(output)?.type !== _laceio_cardano_core.Cardano.CredentialType.ScriptHash) refusals.push({
-		code: "custody-context-mismatch",
-		reason: "redeemer-on-key-input",
-		input
-	});
-	for (const version of require_hex.SUPPORTED_CUSTODY_CONTRACT_VERSIONS) {
-		const { accountValidatorHash } = version;
-		const isNeeded = facts.inputs.some(({ output: { addressClass } }) => addressClass.kind === "account" && addressClass.contractVersion === version) || facts.mintPolicies.includes(accountValidatorHash);
-		if (facts.witnessScriptHashes.has(accountValidatorHash) && !isNeeded) refusals.push({
-			code: "custody-context-mismatch",
-			reason: "unused-account-validator",
-			accountValidatorHash
-		});
-	}
-	return refusals;
-};
-/**
-* Consistency checks on the known logics a transaction attaches or runs: a
-* logic runs through a withdrawal from its stake credential, and only over
-* a control UTxO that names it, spent, referenced or written. The ledger
-* refuses a witness nothing needs, and a run with no such control UTxO
-* fails, so a logic attached without a run, or run with no control UTxO
-* naming it among `logics`, means a resolution hides that control UTxO or
-* the transaction cannot succeed.
-*/
-const checkLogicUse = (facts, logics) => {
-	const named = new Set(logics);
-	const withdrawn = new Set((facts.body.withdrawals ?? []).flatMap(({ stakeAddress }) => {
-		const scriptHash = scriptHashOfRewardAccount(stakeAddress);
-		return scriptHash === void 0 ? [] : [scriptHash];
-	}));
-	return [...new Set([...withdrawn, ...facts.witnessScriptHashes].filter(require_outputs.isKnownCustodyLogic))].filter((logic) => !withdrawn.has(logic) || !named.has(logic)).map((logic) => ({
-		code: "custody-context-mismatch",
-		reason: "unused-logic",
-		logic
-	}));
-};
-/**
-* A reward account the body's withdrawal map names more than once. The
-* decoded body keeps one of its withdrawals, so what inspection reads might
-* not be what the bytes say.
-*/
-const checkWithdrawalAccounts = (facts) => {
-	const seen = /* @__PURE__ */ new Set();
-	const repeated = /* @__PURE__ */ new Set();
-	for (const rewardAccount of facts.withdrawalAccounts) {
-		if (seen.has(rewardAccount)) repeated.add(rewardAccount);
-		seen.add(rewardAccount);
-	}
-	return [...repeated].map((rewardAccount) => ({
-		code: "custody-unsupported-operation",
-		reason: "duplicate-withdrawal",
-		rewardAccount
-	}));
-};
-const isSameOutpoint = (a, b) => a.txId.toLowerCase() === b.txId.toLowerCase() && a.index === b.index;
-/**
-* Reference inputs that carry a reference script must be the contract's
-* parked scripts on the inspected network: the output reference a supported
-* version pins, resolved with exactly the script it pins there. Any other
-* reference script is code Lace has not pinned.
-*/
-const checkReferenceScripts = (facts, networkMagic) => {
-	const parked = require_hex.SUPPORTED_CUSTODY_CONTRACT_VERSIONS.flatMap((version) => version.referenceScripts[networkMagic] ?? []);
-	return facts.referenceInputs.flatMap(({ input, output }) => {
-		const pinned = parked.find(({ txIn }) => isSameOutpoint(txIn, input));
-		if (pinned) return output.referenceScriptHash === pinned.scriptHash ? [] : [{
-			code: "custody-context-mismatch",
-			reason: "reference-script-mismatch",
-			input
-		}];
-		return output.hasReferenceScript ? [{
-			code: "custody-unsupported-operation",
-			reason: "foreign-reference-script",
-			input
-		}] : [];
-	});
-};
-/**
-* Certificates and withdrawals on credentials of no custody account the
-* transaction names. A withdrawal may also run a known logic, which
-* `checkLogicUse` ties to the control UTxOs naming it.
-*/
-const checkForeignStakeEffects = (facts, candidates, networkId) => {
-	const refusals = [];
-	const stakeScriptHashes = new Set(candidates.map(({ stakeScriptHash }) => stakeScriptHash));
-	for (const [certificateIndex, certificate] of (facts.body.certificates ?? []).entries()) {
-		const credential = stakeCredentialOf(certificate);
-		if (credential?.type !== _laceio_cardano_core.Cardano.CredentialType.ScriptHash || !stakeScriptHashes.has(credential.hash)) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "foreign-certificate",
-			certificateIndex,
-			certificateType: certificate.__typename
-		});
-	}
-	for (const { stakeAddress } of facts.body.withdrawals ?? []) {
-		const scriptHash = scriptHashOfRewardAccount(stakeAddress);
-		if (scriptHash === void 0 || !(stakeScriptHashes.has(scriptHash) || require_outputs.isKnownCustodyLogic(scriptHash))) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "foreign-withdrawal",
-			rewardAccount: stakeAddress
-		});
-		else if (_laceio_cardano_core.Cardano.Address.fromString(stakeAddress)?.getNetworkId() !== networkId) refusals.push({
-			code: "custody-context-mismatch",
-			reason: "network-mismatch",
-			address: stakeAddress
-		});
-	}
-	return refusals;
-};
-/**
-* Mints of other policies, and custody mints of a shape no mint redeemer
-* accepts: one state NFT name, or grant names of one account that all issue
-* or all burn.
-*/
-const checkMint = (facts) => {
-	const byPolicy = /* @__PURE__ */ new Map();
-	for (const entry of facts.mint) {
-		const policyId = require_outputs.policyIdOf(entry[0]);
-		byPolicy.set(policyId, [...byPolicy.get(policyId) ?? [], entry]);
-	}
-	return [...byPolicy].flatMap(([policyId, entries]) => {
-		const refuseEach = (reason) => entries.map(([assetId, quantity]) => ({
-			code: "custody-unsupported-operation",
-			reason,
-			assetId,
-			quantity
-		}));
-		if (!versionOfPolicy(policyId)) return refuseEach("foreign-mint");
-		const shape = mintShapeOf(entries);
-		if (shape.kind === "invalid") return refuseEach("unsupported-mint");
-		return shape.kind === "mixed" ? [{
-			code: "custody-unsupported-operation",
-			reason: "issue-sweep-mixed",
-			account: {
-				accountValidatorHash: policyId,
-				stakeScriptHash: shape.stakeScriptHash
-			}
-		}] : [];
-	});
-};
-/**
-* What an output at a custody account that holds no account token must be:
-* a plain deposit, or a reserve in the format Lace writes, `d87980` with no
-* reference script. A datum hash locks value behind a preimage no account
-* builder holds; another datum or a reference script raises the fee and
-* minimum of every later spend.
-*/
-const findAccountOutputRefusal = (view, location) => {
-	if (view.datumKind === "hash") return {
-		code: "custody-locked-output",
-		reason: "datum-hash",
-		location
-	};
-	if (view.inlineDatum !== void 0) return view.hasReferenceScript || !isCustodyReserveDatum(view.inlineDatum) ? {
-		code: "custody-unsupported-operation",
-		reason: "foreign-reserve",
-		location
-	} : void 0;
-	return view.hasReferenceScript ? {
-		code: "custody-unsupported-operation",
-		reason: "deposit-reference-script",
-		location
-	} : void 0;
-};
-/**
-* Rules over every output and resolution: custody addresses on the named
-* network, account tokens at their own account addresses, no value locked
-* where no redeemer can reach it, and account outputs without an account
-* token in a shape Lace writes. Outputs holding an account token are the
-* control and grant outputs, which their account's checks read.
-*/
-const checkOutputs = (facts, networkId) => {
-	const refusals = [];
-	const custodyViews = [
-		...[
-			...facts.inputs,
-			...facts.referenceInputs,
-			...facts.collaterals
-		].map(({ output }) => output),
-		...facts.outputs,
-		...facts.collateralReturn ? [facts.collateralReturn] : []
-	].filter(({ addressClass }) => addressClass.kind !== "other");
-	for (const view of custodyViews) if (view.address?.getNetworkId() !== networkId) refusals.push({
-		code: "custody-context-mismatch",
-		reason: "network-mismatch",
-		address: view.txOut.address
-	});
-	const accountValidatorHashes = require_hex.SUPPORTED_CUSTODY_CONTRACT_VERSIONS.map((version) => version.accountValidatorHash);
-	for (const { input, output } of facts.inputs) if (require_outputs.holdsMisplacedAccountToken(output, accountValidatorHashes)) refusals.push({
-		code: "custody-unsupported-operation",
-		reason: "account-token-misplaced",
-		location: {
-			kind: "input",
-			input
-		}
-	});
-	const locatedOutputs = [...facts.outputs.map((view, index) => ({
-		view,
-		location: {
-			kind: "output",
-			index
-		}
-	})), ...facts.collateralReturn ? [{
-		view: facts.collateralReturn,
-		location: { kind: "collateral-return" }
-	}] : []];
-	for (const { view, location } of locatedOutputs) {
-		if (location.kind === "output" && require_outputs.holdsMisplacedAccountToken(view, accountValidatorHashes)) refusals.push({
-			code: "custody-unsupported-operation",
-			reason: "account-token-misplaced",
-			location
-		});
-		const { addressClass } = view;
-		if (addressClass.kind === "unspendable") refusals.push({
-			code: "custody-locked-output",
-			reason: "unspendable-address",
-			location
-		});
-		else if (addressClass.kind === "account" && require_outputs.holdsNoAccountToken(view.value, addressClass.contractVersion.accountValidatorHash)) {
-			const refusal = findAccountOutputRefusal(view, location);
-			if (refusal) refusals.push(refusal);
-		}
-	}
-	return refusals;
-};
-const checkBodyFields = (facts) => {
-	const body = facts.body;
-	return UNSUPPORTED_BODY_FIELDS.filter((field) => body[field] !== void 0).map((field) => ({
-		code: "custody-unsupported-operation",
-		reason: "unsupported-body-field",
-		field
-	}));
-};
-/** With a record, the transaction operates that account and no other. */
-const checkRecordAccount = (operated, record) => {
-	if (!record) return [];
-	const refusals = operated.filter((account) => !isSameAccount(account, record)).map((account) => ({
-		code: "custody-context-mismatch",
-		reason: "foreign-account",
-		account: hashesOf(account)
-	}));
-	if (!operated.some((account) => isSameAccount(account, record))) refusals.push({
-		code: "custody-context-mismatch",
-		reason: "account-not-operated",
-		account: {
-			accountValidatorHash: record.contractVersion.accountValidatorHash,
-			stakeScriptHash: record.stakeScriptHash
-		}
-	});
-	return refusals;
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/inspect.ts
-const readRecord = (options) => {
-	if (options.accountRecord === void 0) return require_hex.ok(void 0);
-	const parsed = parseCustodyAccountRecord(options.accountRecord, options.chainId.networkMagic);
-	if (parsed.ok) return require_hex.ok(parsed.value.identity);
-	return require_hex.fail(parsed.error.code === "unsupported-contract-version" ? {
-		code: "custody-unsupported-version",
-		reason: "unsupported-contract-version",
-		accountValidatorHash: parsed.error.accountValidatorHash
-	} : {
-		code: "custody-context-mismatch",
-		reason: "invalid-record",
-		recordError: parsed.error
-	});
-};
-const paymentKeyHashOf = (view) => {
-	const credential = paymentCredentialOf(view);
-	return credential?.type === _laceio_cardano_core.Cardano.CredentialType.KeyHash ? credential.hash : void 0;
-};
-const externalInputOf = ({ input, output }, deviceKeyHash) => ({
-	input,
-	address: output.txOut.address,
-	value: output.txOut.value,
-	isDeviceKey: deviceKeyHash !== void 0 && paymentKeyHashOf(output) === deviceKeyHash
-});
-const validityOf = ({ validityInterval }, slotToPosixMs) => {
-	const bounds = {};
-	if (validityInterval?.invalidBefore !== void 0) {
-		const slot = validityInterval.invalidBefore;
-		bounds.invalidBefore = {
-			slot,
-			posixMs: slotToPosixMs(slot)
-		};
-	}
-	if (validityInterval?.invalidHereafter !== void 0) {
-		const slot = validityInterval.invalidHereafter;
-		bounds.invalidHereafter = {
-			slot,
-			posixMs: slotToPosixMs(slot)
-		};
-	}
-	return bounds;
-};
-/**
-* Reads every custody effect of a transaction from its bytes and the
-* caller's resolutions of its inputs, and refuses what Lace never signs.
-* The SDK checks its own builds with it before asking for a signature, and
-* the hosted signer derives its consent and its refusals from it, so both
-* apply one set of rules.
-*
-* It takes the `Serialization.Transaction` whose body hash is signed, so
-* what it reads is what a signature commits to. Resolutions come from the
-* caller and are not checked against the chain; an inline datum in a
-* resolution wins over a datum hash reported beside it. A custody account
-* is any address whose payment credential is a supported account validator
-* and whose stake credential is an inline script.
-*
-* Every operation on an account runs the logic its control datum names,
-* through a withdrawal from the logic's stake credential, and that logic
-* must be one of the contract version's catalogue. A reference input may
-* carry a reference script only as a contract script parked at the output
-* reference the version pins on the inspected network.
-*
-* Witness-set redeemers are bound to the signed body only through its
-* script data hash, which inspection does not recompute. A spend redeemer
-* must fit the UTxO it spends: `Device` the control UTxO, `SpendWithGrant`
-* or `SweepGrant` a grant UTxO, `Fund` a deposit. `SpendWithGrant` is
-* refused unless `allowGrantSpend` is set, and the mint redeemer must fit
-* the mint: `CreateAccount` a state NFT, `IssueGrants` grant tokens minted,
-* `BurnGrants` grant tokens burned. Another redeemer set under the same body
-* cannot change what the body does: it can only run a contract branch that
-* the device's signature does not authorise.
-*/
-const inspectCustodyTransaction = (transaction, resolvedInputs, options) => {
-	const record = readRecord(options);
-	if (!record.ok) return require_hex.fail({ refusals: [record.error] });
-	const serializedBody = transaction.body();
-	const body = serializedBody.toCore();
-	const resolved = resolveBody(body, resolvedInputs);
-	if (!resolved.ok) return require_hex.fail({ refusals: resolved.error });
-	const metadata = readCustodyMetadata(transaction, body);
-	if (!metadata.ok) return require_hex.fail({ refusals: [metadata.error] });
-	const facts = readTransaction({
-		body,
-		bodyCbor: serializedBody.toCbor(),
-		witness: transaction.witnessSet().toCore()
-	}, resolved.value, options);
-	const { networkId } = options.chainId;
-	const scope = {
-		options,
-		record: record.value,
-		deviceKeyHash: options.deviceKeyHash?.toLowerCase()
-	};
-	const candidates = findCandidates(facts, record.value);
-	const outcomes = candidates.map((candidate) => inspectAccount(candidate, facts, scope));
-	const operated = outcomes.filter(({ isOperated }) => isOperated);
-	const isOperatedAccount = (view) => operated.some(({ report }) => require_outputs.isAtAccount(view, report));
-	const externalInputs = facts.inputs.filter(({ output }) => !isOperatedAccount(output)).map((view) => externalInputOf(view, scope.deviceKeyHash));
-	const externalOutputs = facts.outputs.flatMap((view, outputIndex) => view.addressClass.kind === "other" ? [{
-		outputIndex,
-		address: view.txOut.address,
-		value: view.txOut.value
-	}] : []);
-	const feeShares = feeSharesOf({
-		externalInputs,
-		externalOutputs,
-		fee: body.fee
-	});
-	const refusals = inCheckOrder([
-		...checkBodyFields(facts),
-		...checkWithdrawalAccounts(facts),
-		...checkForeignStakeEffects(facts, candidates, networkId),
-		...checkMint(facts),
-		...checkRedeemerPointers(facts),
-		...checkSpendWitnesses(facts),
-		...checkLogicUse(facts, outcomes.flatMap(({ logics }) => logics)),
-		...checkReferenceScripts(facts, options.chainId.networkMagic),
-		...checkOutputs(facts, networkId),
-		...checkRecordAccount(operated.map(({ report }) => report), record.value),
-		...outcomes.flatMap((outcome) => outcome.refusals),
-		...checkGrantSpendMetadata(operated, metadata.value),
-		...checkLogicDraws(operated, feeShares, externalOutputs.some(({ address }) => feeShares.payers.includes(address)))
-	]);
-	if (refusals.length > 0) return require_hex.fail({ refusals });
-	return require_hex.ok({
-		accounts: withOperations(operated, feeShares),
-		deposits: facts.outputs.flatMap((view, outputIndex) => view.addressClass.kind === "account" && view.datumKind !== "hash" && !isOperatedAccount(view) ? [{
-			outputIndex,
-			address: view.txOut.address,
-			value: view.txOut.value,
-			accountValidatorHash: view.addressClass.contractVersion.accountValidatorHash,
-			stakeScriptHash: view.addressClass.stakeScriptHash,
-			datum: view.datumKind
-		}] : []),
-		externalOutputs,
-		externalInputs,
-		collateralInputs: facts.collaterals.map((view) => externalInputOf(view, scope.deviceKeyHash)),
-		...body.collateralReturn ? { collateralReturn: {
-			address: body.collateralReturn.address,
-			value: body.collateralReturn.value
-		} } : {},
-		requiredSigners: [...facts.requiredSigners],
-		validity: validityOf(body, options.slotToPosixMs),
-		fee: body.fee,
-		feeShares,
-		...body.donation === void 0 ? {} : { donation: body.donation },
-		...metadata.value === void 0 ? {} : { metadata: metadata.value }
-	});
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/analysis/requested-scope.ts
-/**
-* The recipient a bech32 Shelley payment address names, when the text is
-* spelled exactly as `toBech32` writes it: lower case, with the prefix of the
-* network its header names. Bech32 also decodes an upper-case spelling and
-* ignores the prefix, so a mainnet-looking address could otherwise stand for
-* a testnet recipient.
-*/
-const canonicalRecipientOf = (value) => {
-	if (typeof value !== "string" || !_laceio_cardano_core.Cardano.Address.isValidBech32(value)) return;
-	const address = _laceio_cardano_core.Cardano.Address.fromBech32(value);
-	const recipient = require_outputs.custodyRecipientFromAddress(address);
-	return recipient.ok && address.toBech32() === value ? {
-		address,
-		recipient: recipient.value
-	} : void 0;
-};
-const recipientKeysOn = (recipients, networkId) => {
-	const keys = [];
-	for (const text of recipients) {
-		const canonical = canonicalRecipientOf(text);
-		if (canonical?.address.getNetworkId() !== networkId) return void 0;
-		keys.push(require_outputs.recipientKey(canonical.recipient));
-	}
-	return keys;
-};
-const hasSameRecipients = (requested, actual, networkId) => {
-	const requestedKeys = recipientKeysOn(requested, networkId);
-	const { recipients } = actual.scope;
-	return requestedKeys !== void 0 && requestedKeys.length === recipients.length && requestedKeys.every((key, index) => key === require_outputs.recipientKey(recipients[index]));
-};
-/**
-* The fields where a requested scope differs from a grant a transaction
-* issues, in declaration order; empty when they match. Every field must be
-* equal exactly. Recipients must be the same Plutus addresses in the same
-* order, and every requested recipient must be on the account network,
-* because the datum carries no network and the grant would otherwise send
-* to another network's address with the same credentials.
-*/
-const compareRequestedGrantScope = (requested, actual, chainId) => {
-	const { scope } = actual;
-	const isEqual = {
-		slot: requested.slot === actual.slot,
-		grantee: requested.grantee === actual.grantee,
-		asset: requested.asset.policyId === scope.asset.policyId && requested.asset.assetName === scope.asset.assetName,
-		perCallCap: requested.perCallCap === scope.perCallCap,
-		cap: requested.cap === scope.cap,
-		lovelacePerCallCap: requested.lovelacePerCallCap === scope.lovelacePerCallCap,
-		lovelaceCap: requested.lovelaceCap === scope.lovelaceCap,
-		expiresAt: requested.expiresAt === scope.expiresAt,
-		recipients: hasSameRecipients(requested.recipients, actual, chainId.networkId)
-	};
-	return Object.keys(isEqual).filter((field) => !isEqual[field]);
-};
-const serializeCustodyRequestedGrantScope = (scope) => ({
-	slot: scope.slot.toString(),
-	grantee: scope.grantee,
-	asset: {
-		policyId: scope.asset.policyId,
-		assetName: scope.asset.assetName
-	},
-	perCallCap: scope.perCallCap.toString(),
-	cap: scope.cap.toString(),
-	lovelacePerCallCap: scope.lovelacePerCallCap.toString(),
-	lovelaceCap: scope.lovelaceCap.toString(),
-	expiresAt: scope.expiresAt.toString(),
-	recipients: [...scope.recipients]
-});
-const SCOPE_FIELDS = [
-	"slot",
-	"grantee",
-	"asset",
-	"perCallCap",
-	"cap",
-	"lovelacePerCallCap",
-	"lovelaceCap",
-	"expiresAt",
-	"recipients"
-];
-const ASSET_FIELDS = ["policyId", "assetName"];
-const INTEGER_FIELDS = [
-	"slot",
-	"perCallCap",
-	"cap",
-	"lovelacePerCallCap",
-	"lovelaceCap",
-	"expiresAt"
-];
-const MAX_ASSET_NAME_BYTES = 32;
-/** Canonical decimal: no sign, no leading zero, no exponent. */
-const NON_NEGATIVE_DECIMAL = /^(?:0|[1-9]\d*)$/;
-const isNonNegativeDecimal = (value) => typeof value === "string" && NON_NEGATIVE_DECIMAL.test(value);
-const malformed = (reason, field) => require_hex.fail({
-	code: "malformed-requested-scope",
-	reason,
-	...field === void 0 ? {} : { field }
-});
-const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const hasExactFields = (value, fields) => {
-	const keys = Object.keys(value);
-	return keys.length === fields.length && fields.every((field) => keys.includes(field));
-};
-const isShelleyPaymentAddress = (value) => canonicalRecipientOf(value) !== void 0;
-const isWellFormedAsset = (asset) => {
-	const { policyId, assetName } = asset;
-	if (policyId === "") return assetName === "";
-	return require_hex.isHash28Hex(policyId) && require_hex.isLowerCaseHex(assetName) && assetName.length <= MAX_ASSET_NAME_BYTES * 2;
-};
-/**
-* Reads a requested scope from protocol JSON, refusing anything but the
-* exact shape `serializeCustodyRequestedGrantScope` writes: no missing or
-* extra field, canonical non-negative decimal integers, a positive expiry,
-* a 28-byte grantee, a lovelace or 28-byte policy asset with a name of at
-* most 32 bytes, and at most 8 Shelley payment addresses in canonical
-* bech32. Network membership of the recipients is checked when comparing.
-*
-* @param input - the scope as JSON text or as an already parsed value
-*/
-const parseCustodyRequestedGrantScope = (input) => {
-	let value = input;
-	if (typeof input === "string") try {
-		value = JSON.parse(input);
-	} catch {
-		return malformed("expected JSON");
-	}
-	if (!isPlainObject(value) || !hasExactFields(value, SCOPE_FIELDS)) return malformed(`expected exactly ${SCOPE_FIELDS.join(", ")}`);
-	const integerField = INTEGER_FIELDS.find((field) => !isNonNegativeDecimal(value[field]));
-	if (integerField) return malformed("expected a non-negative decimal string", integerField);
-	if (value.expiresAt === "0") return malformed("expected a positive expiry", "expiresAt");
-	if (!require_hex.isHash28Hex(value.grantee)) return malformed("expected 28 bytes of lower-case hex", "grantee");
-	const { asset, recipients } = value;
-	if (!isPlainObject(asset) || !hasExactFields(asset, ASSET_FIELDS) || !isWellFormedAsset(asset)) return malformed("expected lovelace or a policy id and asset name", "asset");
-	if (!Array.isArray(recipients) || recipients.length > 8 || !recipients.every(isShelleyPaymentAddress)) return malformed(`expected at most 8 bech32 payment addresses`, "recipients");
-	const integers = value;
-	return require_hex.ok({
-		slot: BigInt(integers.slot),
-		grantee: value.grantee,
-		asset: {
-			policyId: asset.policyId,
-			assetName: asset.assetName
-		},
-		perCallCap: BigInt(integers.perCallCap),
-		cap: BigInt(integers.cap),
-		lovelacePerCallCap: BigInt(integers.lovelacePerCallCap),
-		lovelaceCap: BigInt(integers.lovelaceCap),
-		expiresAt: BigInt(integers.expiresAt),
-		recipients
-	});
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/classify.ts
-/** The tokens of a value under a policy. */
-const tokensUnder = (value, policyId) => [...value.assets?.entries() ?? []].filter(([assetId, quantity]) => quantity !== 0n && _laceio_cardano_core.Cardano.AssetId.getPolicyId(assetId) === policyId).map(([assetId]) => assetId);
-/** Reads a UTxO that holds exactly one grant token of the account, in quantity one. */
-const classifyGrant = (utxo, token, slot) => {
-	const [, output] = utxo;
-	if (output.value.assets?.size !== 1) return { anomaly: {
-		code: "grant-value-not-strict",
-		utxo,
-		slot
-	} };
-	if (output.datum === void 0) return { anomaly: {
-		code: "grant-datum-not-inline",
-		utxo,
-		slot
-	} };
-	const decoded = require_outputs.decodeCustodyGrant(output.datum);
-	if (!decoded.ok) return { anomaly: {
-		code: "grant-datum-malformed",
-		utxo,
-		slot,
-		error: decoded.error
-	} };
-	if (decoded.value.slot !== slot) return { anomaly: {
-		code: "grant-slot-mismatch",
-		utxo,
-		slot,
-		datumSlot: decoded.value.slot
-	} };
-	return { grant: {
-		utxo,
-		grant: decoded.value,
-		token
-	} };
-};
-/** The grant token and its slot, when the tokens are exactly one own grant token held once. */
-const ownGrantToken = (account, value, tokens) => {
-	const [token] = tokens;
-	if (tokens.length !== 1 || value.assets?.get(token) !== 1n) return void 0;
-	const name = require_tokens.parseCustodyAccountTokenName(_laceio_cardano_core.Cardano.AssetId.getAssetName(token));
-	return name?.kind === "grant" && name.stakeScriptHash === account.stakeScriptHash ? {
-		token,
-		slot: name.slot
-	} : void 0;
-};
-/**
-* Sorts an account's UTxOs by kind. UTxOs not at the exact account address
-* are ignored. It never throws: a UTxO that holds an account token in a
-* shape the contract rules out is listed in `anomalies`.
-*/
-const classifyCustodyAccountUtxos = (account, utxos) => {
-	const policyId = _laceio_cardano_core.Cardano.PolicyId(account.accountValidatorHash);
-	const stateNft = _laceio_cardano_core.Cardano.AssetId.fromParts(policyId, _laceio_cardano_core.Cardano.AssetName(account.stakeScriptHash));
-	const controls = [];
-	const grants = [];
-	const own = [];
-	const foreign = [];
-	const funds = [];
-	const stranded = [];
-	const anomalies = [];
-	for (const utxo of utxos) {
-		const [, output] = utxo;
-		if (output.address !== account.address) continue;
-		const tokens = tokensUnder(output.value, policyId);
-		if (tokens.includes(stateNft)) controls.push(utxo);
-		else if (tokens.length > 0) {
-			const grantToken = ownGrantToken(account, output.value, tokens);
-			if (!grantToken) {
-				anomalies.push({
-					code: "unexpected-account-tokens",
-					utxo,
-					assetIds: tokens
-				});
-				continue;
-			}
-			const classified = classifyGrant(utxo, grantToken.token, grantToken.slot);
-			if ("grant" in classified) grants.push(classified.grant);
-			else anomalies.push(classified.anomaly);
-		} else if (output.datum !== void 0) (output.scriptReference === void 0 && isCustodyReserveDatum(output.datum) ? own : foreign).push(utxo);
-		else if (output.datumHash === void 0) funds.push(utxo);
-		else stranded.push(utxo);
-	}
-	grants.sort((a, b) => a.grant.slot < b.grant.slot ? -1 : a.grant.slot > b.grant.slot ? 1 : 0);
-	return {
-		controls,
-		grants,
-		reserves: {
-			own,
-			foreign
-		},
-		funds,
-		stranded,
-		anomalies
-	};
-};
-/**
-* The liveness of a grant against a control state at `now`. A grant dead for
-* several reasons takes the first of superseded, revoked and expired, so
-* `expired` alone means a sweep needs a validity interval that starts after
-* the expiry.
-*
-* @param now - POSIX milliseconds; a non-finite value counts as past every expiry
-*/
-const custodyGrantLiveness = (grant, state, now) => {
-	if (grant.generation < state.grantGeneration) return "superseded";
-	if (grant.generation > state.grantGeneration) return "future-generation";
-	if (!require_outputs.isCustodyGrantCurrent(grant, state)) return "revoked";
-	return require_outputs.isCustodyGrantExpired(grant, now) ? "expired" : "current";
-};
-//#endregion
-//#region ../../packages/lib/cardano-custody/src/device-key.ts
-/**
-* The CIP-1854 path `m/1854'/1815'/a'/0/i` of custody device and creator
-* keys. The account index `a` belongs to the contract version and network:
-* `custodyDeviceAccountIndex` gives it.
-*/
-const CUSTODY_DEVICE_KEY_PATH = {
-	purpose: 1854,
-	coinType: 1815,
-	role: 0
-};
-/** First index that is a hardened derivation; device keys use soft ones only. */
-const HARDENED_INDEX = 2147483648;
-/**
-* The device key at `m/1854'/1815'/a'/0/index`, derived from the CIP-1854
-* account extended public key of account `a` by soft derivation, so no
-* secret is needed.
-*/
-const deriveCustodyDeviceKey = async (accountPublicKey, index) => {
-	if (!Number.isInteger(index) || index < 0 || index >= HARDENED_INDEX) return require_hex.fail({
-		code: "invalid-device-index",
-		index
-	});
-	await _laceio_cardano_crypto.ready();
-	try {
-		const publicKey = _laceio_cardano_crypto.Bip32PublicKey.fromHex(accountPublicKey).derive([CUSTODY_DEVICE_KEY_PATH.role, index]).toRawKey();
-		return require_hex.ok({
-			index,
-			publicKey: publicKey.hex(),
-			keyHash: publicKey.hash().hex()
-		});
-	} catch {
-		return require_hex.fail({ code: "invalid-account-public-key" });
-	}
-};
-/**
-* A short form of a device key hash for people to compare across devices:
-* its first and last 8 hex characters.
-*/
-const custodyDeviceFingerprint = (keyHash) => `${keyHash.slice(0, 8)}…${keyHash.slice(-8)}`;
-//#endregion
-//#region ../../packages/contract/cardano-context/src/custody/account-state.ts
-/** Whether the account's contract version lists the logic in its catalogue. */
-const isKnownLogic = (accountValidatorHash, logic) => {
-	const version = require_hex.findCustodyContractVersion(accountValidatorHash);
-	return version.ok && require_hex.findCustodyLogic(version.value, logic).ok;
-};
-/**
-* Classifies a custody account's UTxOs by the rules of the custody contract
-* and reads the control state.
-*/
-const classifyCardanoCustodyAccount = ({ account, utxos, withdrawableRewards, protocolParameters }) => {
-	const { controls, grants, reserves, funds, stranded, anomalies } = classifyCustodyAccountUtxos(account, utxos);
-	const holdings = {
-		funds,
-		reserves,
-		grants,
-		grantLockedLovelace: grants.reduce((total, { utxo: [, output] }) => total + output.value.coins, 0n),
-		stranded,
-		anomalies,
-		withdrawableRewards
-	};
-	if (controls.length === 0) return {
-		...holdings,
-		status: "notCreated"
-	};
-	const invalid = (reason) => ({
-		...holdings,
-		status: "invalid",
-		reason,
-		controlUtxos: controls
-	});
-	if (controls.length > 1) return invalid({ code: "multiple-control-utxos" });
-	const [controlUtxo] = controls;
-	const [, controlOutput] = controlUtxo;
-	if (controlOutput.datum === void 0) return invalid({ code: "missing-inline-datum" });
-	const logic = require_outputs.decodeCustodyStateLogic(controlOutput.datum);
-	if (!logic.ok) return invalid({
-		code: "undecodable-state",
-		error: logic.error
-	});
-	if (!isKnownLogic(account.accountValidatorHash, logic.value)) return invalid({
-		code: "unknown-logic",
-		logic: logic.value
-	});
-	const decoded = require_outputs.decodeCustodyAccountState(controlOutput.datum);
-	if (!decoded.ok) return invalid({
-		code: "undecodable-state",
-		error: decoded.error
-	});
-	const controlMinimumLovelace = (0, _laceio_cardano_tx_construction.minAdaRequired)(controlOutput, BigInt(protocolParameters.coinsPerUtxoByte));
-	const controlLovelace = controlOutput.value.coins;
-	const deviceKeyHash = account.device?.keyHash;
-	return {
-		...holdings,
-		status: "live",
-		controlUtxo,
-		state: decoded.value,
-		controlMinimumLovelace,
-		controlHeadroomLovelace: controlLovelace > controlMinimumLovelace ? controlLovelace - controlMinimumLovelace : 0n,
-		...deviceKeyHash !== void 0 && { currentDeviceListed: decoded.value.devices.some((device) => device.toLowerCase() === deviceKeyHash.toLowerCase()) }
-	};
-};
-//#endregion
-//#region ../../packages/contract/cardano-context/src/custody/build-transaction.ts
-/**
-* The most lovelace a grant spend's fee may take when the operation names
-* no `feeBound`: 1,500,000 lovelace. The spend lowers the grant's remaining caps by its outputs
-* and fee before the fee is final, so the bound is what the caps must leave
-* room for.
-*/
-const CARDANO_CUSTODY_DEFAULT_GRANT_FEE_BOUND = 1500000n;
-//#endregion
-//#region ../../packages/contract/cardano-context/src/custody/grant-status.ts
-/**
-* Any key hash: an unrestricted grant pays out to any address, and an
-* enterprise key address makes the smallest output.
-*/
-const ANY_KEY_HASH = (0, _laceio_cardano_crypto.Hash28ByteBase16)("00".repeat(28));
-/** The addresses a grant may pay out to, or one standing for any address. */
-const payoutAddressesOf = ({ recipients }, networkId) => {
-	if (recipients.length === 0) return [_laceio_cardano_core.Cardano.EnterpriseAddress.fromCredentials(networkId, {
-		type: _laceio_cardano_core.Cardano.CredentialType.KeyHash,
-		hash: ANY_KEY_HASH
-	}).toAddress().toBech32()];
-	return recipients.flatMap((recipient) => {
-		const address = require_outputs.custodyRecipientToAddress(recipient, networkId);
-		return address.ok ? [address.value.toBech32()] : [];
-	});
-};
-/** The scope's token, or undefined when its policy id or name is malformed. */
-const tokenOf = ({ asset }) => {
-	try {
-		return _laceio_cardano_core.Cardano.AssetId.fromParts(_laceio_cardano_core.Cardano.PolicyId(asset.policyId), _laceio_cardano_core.Cardano.AssetName(asset.assetName));
-	} catch {
-		return;
-	}
-};
-const smallerOf = (a, b) => a < b ? a : b;
-/**
-* Whether a grant scope can no longer pay the smallest spend. That spend
-* is one output to the cheapest address the grant allows, holding the
-* ledger minimum lovelace, plus the fee bound. A lovelace grant draws both
-* from its lovelace caps (`cap`, `perCallCap`). A token grant draws one
-* token from its token caps and the lovelace from `lovelaceCap` and
-* `lovelacePerCallCap`. A grant with no address it can pay is exhausted.
-*/
-const isCardanoCustodyGrantExhausted = (scope, { protocolParameters, networkId, feeBound = CARDANO_CUSTODY_DEFAULT_GRANT_FEE_BOUND }) => {
-	const isLovelace = require_outputs.isCustodyLovelaceAsset(scope.asset);
-	const token = isLovelace ? void 0 : tokenOf(scope);
-	if (!isLovelace && !token) return true;
-	const addresses = payoutAddressesOf(scope, networkId);
-	if (addresses.length === 0) return true;
-	const coinsPerUtxoByte = BigInt(protocolParameters.coinsPerUtxoByte);
-	const smallestLovelaceSpend = addresses.map((address) => (0, _laceio_cardano_tx_construction.minAdaRequired)({
-		address,
-		value: {
-			coins: 0n,
-			...token && { assets: new Map([[token, 1n]]) }
-		}
-	}, coinsPerUtxoByte)).reduce(smallerOf) + feeBound;
-	if (isLovelace) return smallerOf(scope.cap, scope.perCallCap) < smallestLovelaceSpend;
-	return smallerOf(scope.cap, scope.perCallCap) < 1n || smallerOf(scope.lovelaceCap, scope.lovelacePerCallCap) < smallestLovelaceSpend;
-};
-const bySlot = ({ grant: a }, { grant: b }) => a.slot < b.slot ? -1 : a.slot > b.slot ? 1 : 0;
-/**
-* The status of a grant the confirmed view holds and the in-flight view
-* keeps. `grant` is its in-flight version: an unsettled grant spend lowers
-* its caps and changes nothing else.
-*/
-const confirmedGrantStatus = (grant, { confirmed, inFlight, now, ...pricing }) => {
-	const liveness = custodyGrantLiveness(grant, confirmed, now);
-	if (liveness === "revoked" || liveness === "superseded") return liveness;
-	if (liveness === "future-generation") return "pending";
-	const next = custodyGrantLiveness(grant, inFlight, now);
-	if (next === "revoked" || next === "superseded") return "revoking";
-	if (liveness === "expired") return "expired";
-	return isCardanoCustodyGrantExhausted(grant.scope, pricing) ? "exhausted" : "live";
-};
-/**
-* The status of every grant UTxO of a custody account, in slot order.
-* `inFlight` is the account after the submitted operations that have not
-* settled; `confirmed` is the account on chain, absent while it has no
-* confirmed control state. A grant is known by its slot, which no grant
-* ever reuses. `now` is POSIX milliseconds: the time of the chain tip.
-*
-* A grant only the in-flight view holds is `pending`, and one only the
-* confirmed view holds is `sweeping`. A grant both hold is judged against
-* the confirmed state, and is `revoking` when the in-flight state kills it.
-* Its listed version is the in-flight one, so an unsettled grant spend
-* shows its lowered caps at once.
-*/
-const classifyCardanoCustodyGrants = ({ confirmed, inFlight, now, protocolParameters, networkId }) => {
-	const confirmedSlots = new Set(confirmed?.grants.map(({ grant }) => grant.slot));
-	const inFlightSlots = new Set(inFlight.grants.map(({ grant }) => grant.slot));
-	const kept = inFlight.grants.map((grantUtxo) => ({
-		...grantUtxo,
-		status: confirmed && confirmedSlots.has(grantUtxo.grant.slot) ? confirmedGrantStatus(grantUtxo.grant, {
-			confirmed: confirmed.state,
-			inFlight: inFlight.state,
-			now,
-			protocolParameters,
-			networkId
-		}) : "pending"
-	}));
-	const swept = (confirmed?.grants ?? []).filter(({ grant }) => !inFlightSlots.has(grant.slot)).map((grantUtxo) => ({
-		...grantUtxo,
-		status: "sweeping"
-	}));
-	return [...kept, ...swept].sort(bySlot);
-};
-//#endregion
-Object.defineProperty(exports, "CARDANO_CUSTODY_DEFAULT_GRANT_FEE_BOUND", {
-	enumerable: true,
-	get: function() {
-		return CARDANO_CUSTODY_DEFAULT_GRANT_FEE_BOUND;
-	}
-});
-Object.defineProperty(exports, "CUSTODY_ACCOUNT_RECORD_TYPE", {
-	enumerable: true,
-	get: function() {
-		return CUSTODY_ACCOUNT_RECORD_TYPE;
-	}
-});
-Object.defineProperty(exports, "canonicalCustodyAccountRecord", {
-	enumerable: true,
-	get: function() {
-		return canonicalCustodyAccountRecord;
-	}
-});
-Object.defineProperty(exports, "classifyCardanoCustodyAccount", {
-	enumerable: true,
-	get: function() {
-		return classifyCardanoCustodyAccount;
-	}
-});
-Object.defineProperty(exports, "classifyCardanoCustodyGrants", {
-	enumerable: true,
-	get: function() {
-		return classifyCardanoCustodyGrants;
-	}
-});
-Object.defineProperty(exports, "classifyCustodyAccountUtxos", {
-	enumerable: true,
-	get: function() {
-		return classifyCustodyAccountUtxos;
-	}
-});
-Object.defineProperty(exports, "compareRequestedGrantScope", {
-	enumerable: true,
-	get: function() {
-		return compareRequestedGrantScope;
-	}
-});
-Object.defineProperty(exports, "createCustodyAccountRecord", {
-	enumerable: true,
-	get: function() {
-		return createCustodyAccountRecord;
-	}
-});
-Object.defineProperty(exports, "custodyDeviceFingerprint", {
-	enumerable: true,
-	get: function() {
-		return custodyDeviceFingerprint;
-	}
-});
-Object.defineProperty(exports, "custodyGrantAfterSpend", {
-	enumerable: true,
-	get: function() {
-		return custodyGrantAfterSpend;
-	}
-});
-Object.defineProperty(exports, "custodyGrantLiveness", {
-	enumerable: true,
-	get: function() {
-		return custodyGrantLiveness;
-	}
-});
-Object.defineProperty(exports, "deriveCustodyDeviceKey", {
-	enumerable: true,
-	get: function() {
-		return deriveCustodyDeviceKey;
-	}
-});
-Object.defineProperty(exports, "encodeCustodyAccountRedeemer", {
-	enumerable: true,
-	get: function() {
-		return encodeCustodyAccountRedeemer;
-	}
-});
-Object.defineProperty(exports, "encodeCustodyLogicRedeemer", {
-	enumerable: true,
-	get: function() {
-		return encodeCustodyLogicRedeemer;
-	}
-});
-Object.defineProperty(exports, "encodeCustodyMintRedeemer", {
-	enumerable: true,
-	get: function() {
-		return encodeCustodyMintRedeemer;
-	}
-});
-Object.defineProperty(exports, "encodeCustodyStakeRedeemer", {
-	enumerable: true,
-	get: function() {
-		return encodeCustodyStakeRedeemer;
-	}
-});
-Object.defineProperty(exports, "findCustodyScopeViolations", {
-	enumerable: true,
-	get: function() {
-		return findCustodyScopeViolations;
-	}
-});
-Object.defineProperty(exports, "inspectCustodyTransaction", {
-	enumerable: true,
-	get: function() {
-		return inspectCustodyTransaction;
-	}
-});
-Object.defineProperty(exports, "isCardanoCustodyGrantExhausted", {
-	enumerable: true,
-	get: function() {
-		return isCardanoCustodyGrantExhausted;
-	}
-});
-Object.defineProperty(exports, "parseCustodyAccountRecord", {
-	enumerable: true,
-	get: function() {
-		return parseCustodyAccountRecord;
-	}
-});
-Object.defineProperty(exports, "parseCustodyRequestedGrantScope", {
-	enumerable: true,
-	get: function() {
-		return parseCustodyRequestedGrantScope;
-	}
-});
-Object.defineProperty(exports, "serializeCustodyRequestedGrantScope", {
-	enumerable: true,
-	get: function() {
-		return serializeCustodyRequestedGrantScope;
-	}
-});