@laceio/sdk 0.1.1 → 0.1.2-canary.0

package/dist/init-CuW7rHNA.js

@@ -0,0 +1,3584 @@
+import { _ as CardanoRewardAccount, d as utxoKey, g as CardanoPaymentAddress, l as outpointKey$1, t as createInputResolver } from "./util-Cp5cZkfK.js";
+import { t as BigNumber } from "./bignum.vo-CEXOIew0.js";
+import { t as Serializable } from "./serializable-BHdKIgk3.js";
+import "./retry-config-Dmgt28wM.js";
+import { t as isCardanoCustodyAccount } from "./account-BOQruszJ.js";
+import { a as CURRENT_CUSTODY_CONTRACT_VERSION, c as custodyReferenceScriptUtxos, d as fail, f as ok, l as findCustodyContractVersion, r as isHash28Hex, t as bytesToHex, u as findCustodyLogic } from "./hex-mkXcV3pN.js";
+import { A as isCustodyLovelaceAsset, E as findCustodyGrantViolations, F as encodeCustodyAccountState, I as encodeCustodyGrant, O as isCustodyGrantCurrent, R as custodyRecipientFromAddress, k as isCustodyGrantExpired, z as custodyRecipientToAddress } from "./outputs-Bd2yZVjx.js";
+import { n as custodyGrantAssetId, r as parseCustodyAccountTokenName, t as CUSTODY_SLOT_LIMIT } from "./tokens-Diw4MLRM.js";
+import { S as findCustodyScopeViolations, c as custodyGrantLiveness, d as serializeCustodyRequestedGrantScope, f as inspectCustodyTransaction, g as encodeCustodyStakeRedeemer, h as encodeCustodyMintRedeemer, i as classifyCardanoCustodyAccount, m as encodeCustodyLogicRedeemer, n as isCardanoCustodyGrantExhausted, o as deriveCustodyDeviceKey, p as encodeCustodyAccountRedeemer, r as CARDANO_CUSTODY_DEFAULT_GRANT_FEE_BOUND, u as parseCustodyRequestedGrantScope, x as custodyGrantAfterSpend, y as createCustodyAccountRecord } from "./grant-status-B2y49iIu.js";
+import { i as identityOfValidatedCreator, n as chainIdFromNetworkMagic, r as deriveCustodyAccountIdentity, t as verifyCardanoCustodyAccountIdentity } from "./identity-DII6f-h7.js";
+import { a as referenceScriptSize, c as getUniqueSignerKeyHashes, i as referenceScriptFee, n as TransactionBuilder, o as EvaluatedFeeShortfallError, r as LargeFirstCoinSelector, s as InputSelectionError, t as InsufficientCollateralError } from "./TransactionBuilder-CIzdw18M.js";
+import { t as isRetriableError } from "./is-retriable-error-BUiVJDwH.js";
+import { t as unwrapProviderResult } from "./unwrap-provider-result-BZSiwabU.js";
+import { Hash28ByteBase16, blake2b } from "@laceio/cardano/crypto";
+import { Cardano, Serialization } from "@laceio/cardano/core";
+import { HexBlob } from "@laceio/cardano/util";
+import { firstValueFrom, from, map, mergeMap } from "rxjs";
+import { minAdaRequired } from "@laceio/cardano/tx-construction";
+//#region ../../packages/lib/cardano-custody/src/analysis/sponsor-rules.ts
+/** The service's limit on the size of a transaction it inspects, in bytes. */
+const MAX_TRANSACTION_BYTES = 16 * 1024;
+/** The service's default limit on the fee a leased fee UTxO pays, in lovelace. */
+const MAX_FEE_LOVELACE = 2000000n;
+/**
+* The most devices a well formed state lists, which bounds the stake scripts
+* a creation has the service derive.
+*/
+const MAX_DEVICES = 8;
+const outpointKey = ({ txId, index }) => `${txId.toLowerCase()}#${index}`;
+const toTxIn = ({ txId, index }) => ({
+	txId,
+	index
+});
+const paymentCredentialOf = (address) => {
+	const parsed = Cardano.Address.fromString(address);
+	return (parsed?.asBase() ?? parsed?.asEnterprise() ?? parsed?.asPointer())?.getPaymentCredential();
+};
+const stakeCredentialOf = (address) => {
+	const parsed = Cardano.Address.fromString(address);
+	return parsed?.asBase()?.getStakeCredential() ?? parsed?.asReward()?.getPaymentCredential();
+};
+const keyHashOf = (credential) => credential?.type === Cardano.CredentialType.KeyHash ? credential.hash : void 0;
+const scriptHashOf$1 = (credential) => credential?.type === Cardano.CredentialType.ScriptHash ? credential.hash : void 0;
+const sponsorKeysOf = (address) => ({
+	paymentKeyHash: keyHashOf(paymentCredentialOf(address)),
+	stakeKeyHash: keyHashOf(stakeCredentialOf(address))
+});
+const namesSponsorKey = (credential, { paymentKeyHash, stakeKeyHash }) => credential.type === Cardano.CredentialType.KeyHash && (credential.hash === paymentKeyHash || credential.hash === stakeKeyHash);
+const isAccountOutput = (output, { contractVersion }) => scriptHashOf$1(paymentCredentialOf(output.address)) === contractVersion.accountValidatorHash;
+const policyIdOf = (assetId) => Cardano.AssetId.getPolicyId(assetId);
+/** The 28-byte hash a datum field holds, or undefined for a field of any other shape. */
+const hashFieldOf = (field) => Cardano.util.isPlutusBoundedBytes(field) && field.length === 28 ? Hash28ByteBase16(bytesToHex(field)) : void 0;
+/** The fields of an inline datum that is constructor 0, or undefined for any other datum. */
+const inlineFieldsOf = (output) => Cardano.util.isConstrPlutusData(output.datum) && output.datum.constructor === 0n ? output.datum.fields.items : void 0;
+/** The logic a control datum names: a 28-byte hash in its first field. */
+const logicHashOf = (output) => hashFieldOf(inlineFieldsOf(output)?.[0]);
+/** The devices a control datum lists: a list of 28-byte hashes in its second field. */
+const devicesOf = (output) => {
+	const list = inlineFieldsOf(output)?.[1];
+	if (!Cardano.util.isPlutusList(list)) return void 0;
+	const devices = list.items.map(hashFieldOf);
+	return devices.every((device) => device !== void 0) ? devices : void 0;
+};
+/**
+* The account token an input holds, when it is a control or a grant UTxO:
+* the output sits at an account address staked to a script and holds a
+* token under the account policy named after that very script, alone or
+* followed by a slot. The validator mints a token only into such an
+* output, so an output shaped otherwise is never read as an account's. The
+* control token wins when an output holds both kinds.
+*/
+const accountTokenOf = ({ input, output }, context) => {
+	if (output === void 0 || !isAccountOutput(output, context)) return;
+	const account = scriptHashOf$1(stakeCredentialOf(output.address));
+	if (account === void 0) return void 0;
+	const kinds = [...output.value.assets ?? /* @__PURE__ */ new Map()].flatMap(([assetId, quantity]) => {
+		if (policyIdOf(assetId) !== context.contractVersion.accountValidatorHash || quantity <= 0n) return [];
+		const name = parseCustodyAccountTokenName(Cardano.AssetId.getAssetName(assetId));
+		return name?.stakeScriptHash === account ? [name.kind] : [];
+	});
+	if (kinds.length === 0) return void 0;
+	return {
+		input,
+		output,
+		account,
+		kind: kinds.includes("state-nft") ? "control" : "grant"
+	};
+};
+/**
+* The account a control output belongs to: an output at an account address
+* staked to a script, holding exactly one state NFT named after that script.
+* The validator pins the state NFT to such an output, so its datum names
+* the logic the account runs once the transaction lands.
+*/
+const controlOutputAccount = (output, context) => {
+	if (!isAccountOutput(output, context)) return void 0;
+	const account = scriptHashOf$1(stakeCredentialOf(output.address));
+	if (account === void 0) return void 0;
+	const stateNft = Cardano.AssetId.fromParts(Cardano.PolicyId(context.contractVersion.accountValidatorHash), Cardano.AssetName(account));
+	return output.value.assets?.get(stateNft) === 1n ? account : void 0;
+};
+/**
+* Every logic the transaction names: the one each control UTxO it spends or
+* references names, then the one each control output it writes names. A
+* creation names its initial logic in its control output, and an upgrade
+* names the logic it leaves in the control UTxO and the one it arrives at in
+* the control output.
+*/
+const namedLogicsOf = ({ spent, referencedControls }, body, context) => [...[...spent.filter(({ kind }) => kind === "control"), ...referencedControls].map(({ input, output, account }) => ({
+	logic: logicHashOf(output),
+	control: {
+		kind: "control-utxo",
+		input
+	},
+	stakeScriptHash: account
+})), ...body.outputs.flatMap((output, outputIndex) => {
+	const account = controlOutputAccount(output, context);
+	return account === void 0 ? [] : [{
+		logic: logicHashOf(output),
+		control: {
+			kind: "control-output",
+			outputIndex
+		},
+		stakeScriptHash: account
+	}];
+})];
+/**
+* A sponsor UTxO is the leased fee UTxO, the shared collateral, or any
+* output locked by the sponsor payment key: the sponsor's signature
+* authorises every one of them.
+*/
+const isSponsorInput = ({ input, output }, context, sponsorKeys) => {
+	const key = outpointKey(input);
+	return context.mode.kind === "fee" && key === outpointKey(context.mode.feeUtxo[0]) || key === outpointKey(context.collateralUtxo[0]) || output !== void 0 && sponsorKeys.paymentKeyHash !== void 0 && keyHashOf(paymentCredentialOf(output.address)) === sponsorKeys.paymentKeyHash;
+};
+/** Every credential a certificate names, any of which may have to sign. */
+const certificateCredentials = (certificate) => {
+	const named = [];
+	if ("stakeCredential" in certificate) named.push(certificate.stakeCredential);
+	if ("dRep" in certificate && Cardano.isDRepCredential(certificate.dRep)) named.push(certificate.dRep);
+	if ("dRepCredential" in certificate) named.push(certificate.dRepCredential);
+	if ("coldCredential" in certificate) named.push(certificate.coldCredential);
+	if ("hotCredential" in certificate) named.push(certificate.hotCredential);
+	const poolIds = [];
+	if ("poolId" in certificate) poolIds.push(certificate.poolId);
+	if ("poolParameters" in certificate) {
+		const { id, rewardAccount, owners } = certificate.poolParameters;
+		poolIds.push(id);
+		named.push(stakeCredentialOf(rewardAccount), ...owners.map((owner) => stakeCredentialOf(owner)));
+	}
+	for (const poolId of poolIds) named.push({
+		type: Cardano.CredentialType.KeyHash,
+		hash: Cardano.PoolId.toKeyHash(poolId)
+	});
+	return named.filter((credential) => credential !== void 0);
+};
+const LOVELACE_KEY = "";
+/** Lovelace and every asset a list of values holds, keyed by asset id ('' for lovelace). */
+const balanceOf = (values) => {
+	const balance = /* @__PURE__ */ new Map();
+	const add = (key, quantity) => balance.set(key, (balance.get(key) ?? 0n) + quantity);
+	for (const value of values) {
+		add(LOVELACE_KEY, value.coins);
+		for (const [assetId, quantity] of value.assets ?? []) add(assetId, quantity);
+	}
+	return balance;
+};
+/** Reads each entry of the CBOR map the reader is at, definite or not. */
+const readMapEntries = (reader, readEntry) => {
+	const count = reader.readStartMap();
+	for (let read = 0; count === null ? reader.peekState() !== Serialization.CborReaderState.EndMap : read < count; read++) readEntry();
+};
+/** The fields of an encoded body or witness set by key, each as the bytes it is stated in. */
+const fieldsOf = (encoded) => {
+	const reader = new Serialization.CborReader(bytesToHex(encoded));
+	const fields = /* @__PURE__ */ new Map();
+	readMapEntries(reader, () => fields.set(reader.readUInt(), bytesToHex(reader.readEncodedValue())));
+	return fields;
+};
+const BODY_WITHDRAWALS = 5n;
+const WITNESS_DATUMS = 4n;
+const WITNESS_REDEEMERS = 5n;
+/**
+* The body withdrawals and the witness script data as the transaction's
+* bytes state them, which is what the service reads: the decoded body keeps
+* one withdrawal per reward account, and the script data hash is taken over
+* the bytes the witness set carries.
+*/
+const statedOf = (transaction) => {
+	const reader = new Serialization.CborReader(HexBlob(transaction.toCbor()));
+	reader.readStartArray();
+	const body = fieldsOf(reader.readEncodedValue());
+	const witnessSet = fieldsOf(reader.readEncodedValue());
+	const withdrawals = [];
+	const encodedWithdrawals = body.get(BODY_WITHDRAWALS);
+	if (encodedWithdrawals !== void 0) {
+		const withdrawalReader = new Serialization.CborReader(encodedWithdrawals);
+		readMapEntries(withdrawalReader, () => withdrawals.push({
+			stakeAddress: Cardano.RewardAccount(Cardano.Address.fromBytes(bytesToHex(withdrawalReader.readByteString())).toBech32()),
+			quantity: withdrawalReader.readUInt()
+		}));
+	}
+	return {
+		withdrawals,
+		witnessScriptData: {
+			redeemers: witnessSet.get(WITNESS_REDEEMERS),
+			datums: witnessSet.get(WITNESS_DATUMS)
+		}
+	};
+};
+/**
+* Reads an account creation, or the reason the transaction is none:
+* exactly one token minted under the account policy, named with the 28
+* bytes of a stake script hash, exactly one registration of a script stake
+* credential with its deposit, the token named after that credential and
+* held by exactly one output at an account address staked to it, and that
+* credential the version's stake script of a device the output's datum
+* lists. A datum listing more devices than a well formed state is refused
+* before any script is derived.
+*/
+const readCreation = (body, context) => {
+	const refuse = (reason) => ({
+		rule: "account_transaction",
+		reason
+	});
+	const { accountValidatorHash } = context.contractVersion;
+	const minted = [...body.mint ?? /* @__PURE__ */ new Map()].filter(([assetId]) => policyIdOf(assetId) === accountValidatorHash);
+	if (minted.length === 0) return refuse("not-account-transaction");
+	const [[assetId, quantity]] = minted;
+	if (minted.length !== 1 || quantity !== 1n) return refuse("mint-count");
+	if (parseCustodyAccountTokenName(Cardano.AssetId.getAssetName(assetId))?.kind !== "state-nft") return refuse("state-nft-name-length");
+	const registrations = (body.certificates ?? []).filter((certificate) => certificate.__typename === Cardano.CertificateType.Registration && certificate.stakeCredential.type === Cardano.CredentialType.ScriptHash);
+	if (registrations.length !== 1) return refuse("registration-count");
+	const [registration] = registrations;
+	const stakeScriptHash = registration.stakeCredential.hash;
+	if (Cardano.AssetId.getAssetName(assetId) !== stakeScriptHash) return refuse("state-nft-name");
+	const holders = body.outputs.filter((output) => output.value.assets?.get(assetId) === 1n);
+	if (holders.length !== 1 || !isAccountOutput(holders[0], context)) return refuse("control-output-placement");
+	const [controlOutput] = holders;
+	if (scriptHashOf$1(stakeCredentialOf(controlOutput.address)) !== stakeScriptHash) return refuse("control-output-stake");
+	const devices = devicesOf(controlOutput);
+	if (devices === void 0) return refuse("control-output-devices");
+	if (devices.length > MAX_DEVICES) return {
+		rule: "account_transaction",
+		reason: "device-count",
+		count: devices.length,
+		limit: MAX_DEVICES
+	};
+	const chainId = chainIdFromNetworkMagic(context.networkMagic);
+	if (!devices.some((device) => identityOfValidatedCreator({
+		contractVersion: context.contractVersion,
+		creatorKeyHash: device,
+		chainId
+	}).stakeScriptHash === stakeScriptHash)) return {
+		rule: "account_transaction",
+		reason: "underived-stake-credential",
+		stakeScriptHash
+	};
+	return {
+		deposit: registration.deposit,
+		controlLovelace: controlOutput.value.coins,
+		stakeScriptHash
+	};
+};
+/** The accounts whose control UTxO the transaction spends or references. */
+const controlledAccountsOf = ({ spent, referencedControls }) => new Set([...spent, ...referencedControls].filter(({ kind }) => kind === "control").map(({ account }) => account));
+/**
+* Reads what the transaction does to the account contract. A referenced
+* control UTxO serves only an account the transaction operates, so one of
+* any other account is refused first, even beside a creation. A
+* transaction spending no account token is a creation, or no account
+* transaction at all. One spending a token is an operation, and every
+* account it operates needs its control UTxO spent or referenced, as the
+* contract needs on the owner, the sweep and the agent path alike.
+*/
+const readAccountTransaction = (body, { spent, referencedControls }, context) => {
+	const refuse = (reason, { input, account }) => ({
+		kind: "refused",
+		violation: {
+			rule: "account_transaction",
+			reason,
+			input,
+			stakeScriptHash: account
+		}
+	});
+	const operated = new Set(spent.map(({ account }) => account));
+	const foreignControl = referencedControls.find(({ account }) => !operated.has(account));
+	if (foreignControl) return refuse("foreign-referenced-control", foreignControl);
+	if (spent.length === 0) {
+		const creation = readCreation(body, context);
+		return "rule" in creation ? {
+			kind: "refused",
+			violation: creation
+		} : {
+			kind: "creation",
+			creation
+		};
+	}
+	const controlled = controlledAccountsOf({
+		spent,
+		referencedControls
+	});
+	const orphan = spent.find(({ account }) => !controlled.has(account));
+	return orphan ? refuse("orphan-grant", orphan) : { kind: "operation" };
+};
+/**
+* The stake scripts of the accounts the transaction belongs to: those of
+* the control UTxOs it spends or references, which name them, and the one
+* it registers at creation. A grant UTxO alone names none: an agent spend
+* references the control UTxO of its account.
+*/
+const stakeScriptHashesOf = (tokens, reading) => {
+	const hashes = controlledAccountsOf(tokens);
+	if (reading.kind === "creation") hashes.add(reading.creation.stakeScriptHash);
+	return hashes;
+};
+const analyse = (transaction, resolvedInputs, context) => {
+	const body = transaction.body().toCore();
+	const sponsorKeys = sponsorKeysOf(context.sponsorAddress);
+	const resolutions = new Map(resolvedInputs.map(([input, output]) => [outpointKey(input), output]));
+	const resolve = (input) => ({
+		input: toTxIn(input),
+		output: resolutions.get(outpointKey(input))
+	});
+	const inputs = body.inputs.map(resolve);
+	const referenceInputs = (body.referenceInputs ?? []).map(resolve);
+	const sponsorInputs = inputs.filter((input) => isSponsorInput(input, context, sponsorKeys));
+	const tokens = {
+		spent: inputs.filter((input) => !sponsorInputs.includes(input)).flatMap((input) => accountTokenOf(input, context) ?? []),
+		referencedControls: referenceInputs.flatMap((input) => accountTokenOf(input, context) ?? []).filter(({ kind }) => kind === "control")
+	};
+	const reading = readAccountTransaction(body, tokens, context);
+	const namedLogics = namedLogicsOf(tokens, body, context);
+	const sponsorOutputs = body.outputs.flatMap((output, outputIndex) => output.address === context.sponsorAddress ? [{
+		output,
+		outputIndex
+	}] : []);
+	return {
+		transaction,
+		body,
+		witness: transaction.witnessSet().toCore(),
+		inputs,
+		referenceInputs,
+		sponsorInputs,
+		sponsorOutputs,
+		foreignOutputs: body.outputs.filter((output) => output.address !== context.sponsorAddress && !isAccountOutput(output, context)),
+		...statedOf(transaction),
+		reading,
+		stakeScriptHashes: stakeScriptHashesOf(tokens, reading),
+		namedLogics,
+		logicHashes: new Set(namedLogics.flatMap(({ logic }) => logic ?? [])),
+		sponsorKeys
+	};
+};
+const wellFormed = ({ transaction, body }) => {
+	const size = transaction.toCbor().length / 2;
+	if (size > MAX_TRANSACTION_BYTES) return {
+		rule: "well_formed",
+		reason: "too-large",
+		size,
+		limit: MAX_TRANSACTION_BYTES
+	};
+	if ((body.proposalProcedures ?? []).length > 0) return {
+		rule: "well_formed",
+		reason: "proposal-procedures"
+	};
+	return body.donation === void 0 ? void 0 : {
+		rule: "well_formed",
+		reason: "treasury-donation"
+	};
+};
+/**
+* Fee mode spends the leased fee UTxO and no other sponsor UTxO; collateral
+* mode spends none. An input whose payment credential cannot be read
+* cannot be told from the sponsor's.
+*/
+const sponsorInputsRule = ({ inputs, sponsorInputs }, { mode }) => {
+	const rule = mode.kind === "fee" ? "uses_leased_fee_input" : "no_sponsor_inputs";
+	const feeKey = mode.kind === "fee" ? outpointKey(mode.feeUtxo[0]) : void 0;
+	if (mode.kind === "fee" && !inputs.some(({ input }) => outpointKey(input) === feeKey)) return {
+		rule: "uses_leased_fee_input",
+		reason: "fee-input-missing",
+		input: toTxIn(mode.feeUtxo[0])
+	};
+	const unreadable = inputs.find(({ output }) => output !== void 0 && paymentCredentialOf(output.address) === void 0);
+	if (unreadable) return {
+		rule,
+		reason: "unreadable-input",
+		input: unreadable.input
+	};
+	const extra = sponsorInputs.find(({ input }) => outpointKey(input) !== feeKey);
+	return extra ? {
+		rule,
+		reason: "sponsor-input",
+		input: extra.input
+	} : void 0;
+};
+/**
+* The transaction is not flagged as failing phase two, and its collateral
+* is exactly the shared collateral UTxO, returned plainly to the sponsor,
+* with the total collateral set within what it holds. The ledger also
+* takes collateral of at least the collateral percentage of the fee, so a
+* fee above what the shared collateral covers is refused: the service
+* would refuse the total it needs, and the ledger any less.
+*/
+const sharedCollateral = ({ transaction, body }, context) => {
+	const refuse = (reason) => ({
+		rule: "uses_shared_collateral",
+		reason
+	});
+	if (!transaction.isValid()) return refuse("phase-two-invalid");
+	const collaterals = body.collaterals ?? [];
+	if (collaterals.length !== 1 || outpointKey(collaterals[0]) !== outpointKey(context.collateralUtxo[0])) return refuse("collateral-inputs");
+	const { collateralReturn, totalCollateral } = body;
+	if (!collateralReturn) return refuse("no-collateral-return");
+	if (collateralReturn.address !== context.sponsorAddress) return refuse("collateral-return-address");
+	if (collateralReturn.datum !== void 0 || collateralReturn.datumHash !== void 0) return refuse("collateral-return-datum");
+	if (collateralReturn.scriptReference !== void 0) return refuse("collateral-return-reference-script");
+	if (totalCollateral === void 0) return refuse("no-total-collateral");
+	const available = context.collateralUtxo[1].value.coins;
+	if (totalCollateral > available) return {
+		rule: "uses_shared_collateral",
+		reason: "total-collateral-exceeds",
+		totalCollateral,
+		available
+	};
+	const percentage = BigInt(context.collateralPercentage);
+	return body.fee * percentage > available * 100n ? {
+		rule: "uses_shared_collateral",
+		reason: "fee-exceeds-collateral",
+		fee: body.fee,
+		limit: available * 100n / percentage
+	} : void 0;
+};
+const boundedValidity = ({ body }, context) => {
+	const upperBound = body.validityInterval?.invalidHereafter;
+	if (upperBound === void 0) return {
+		rule: "bounded_validity",
+		reason: "no-upper-bound"
+	};
+	if (upperBound > context.latestValiditySlot) return {
+		rule: "bounded_validity",
+		reason: "upper-bound-too-late",
+		upperBound,
+		latest: context.latestValiditySlot
+	};
+	return upperBound <= context.currentSlot ? {
+		rule: "bounded_validity",
+		reason: "upper-bound-not-future",
+		upperBound,
+		current: context.currentSlot
+	} : void 0;
+};
+const accountTransaction = ({ reading }) => reading.kind === "refused" ? reading.violation : void 0;
+/**
+* Every logic the transaction names is one the service knows. The proxy
+* runs whatever registered script a control datum names, so the service
+* pays for and lends collateral to no account under rules it has not read,
+* and refuses a control datum that names no script hash at all.
+*/
+const knownLogic = ({ namedLogics }, { contractVersion }) => {
+	const known = new Set(contractVersion.logics.map(({ hash }) => hash));
+	for (const { logic, control, stakeScriptHash } of namedLogics) {
+		if (logic === void 0) return {
+			rule: "known_logic",
+			reason: "logic-missing",
+			control,
+			stakeScriptHash
+		};
+		if (!known.has(logic)) return {
+			rule: "known_logic",
+			reason: "unknown-logic",
+			control,
+			logic,
+			stakeScriptHash
+		};
+	}
+};
+/**
+* The leased fee UTxO pays for an account creation and nothing else: an
+* operation on an existing account pays its own fee and takes the
+* collateral route, whatever it draws. The fee stays within the service's
+* limit, and the fee UTxO is drawn down by exactly the fee, the
+* registration deposit and the control output, within the sponsored limit,
+* and returns as one plain change output the pool can spend.
+*/
+const sponsorOutflowBounded = ({ body, sponsorOutputs, reading }, mode) => {
+	const rule = "sponsor_outflow_bounded";
+	if (reading.kind !== "creation") return {
+		rule,
+		reason: "not-creation"
+	};
+	if (body.fee > MAX_FEE_LOVELACE) return {
+		rule,
+		reason: "fee-exceeds-limit",
+		fee: body.fee,
+		limit: MAX_FEE_LOVELACE
+	};
+	for (const { output, outputIndex } of sponsorOutputs) {
+		if (output.datum !== void 0 || output.datumHash !== void 0) return {
+			rule,
+			reason: "sponsor-output-datum",
+			outputIndex
+		};
+		if (output.scriptReference !== void 0) return {
+			rule,
+			reason: "sponsor-output-reference-script",
+			outputIndex
+		};
+	}
+	if (sponsorOutputs.length !== 1) return {
+		rule,
+		reason: "sponsor-output-count",
+		count: sponsorOutputs.length
+	};
+	const sponsored = mode.feeUtxo[1].value.coins - sponsorOutputs[0].output.value.coins;
+	const { deposit, controlLovelace } = reading.creation;
+	const expected = body.fee + deposit + controlLovelace;
+	if (sponsored !== expected) return {
+		rule,
+		reason: "draw-mismatch",
+		sponsored,
+		expected
+	};
+	return sponsored > mode.maxSponsoredLovelace ? {
+		rule,
+		reason: "draw-exceeds-limit",
+		sponsored,
+		limit: mode.maxSponsoredLovelace
+	} : void 0;
+};
+/** In collateral mode nothing pays the sponsor key and nothing draws from its reward account. */
+const sponsorOutflowZero = ({ body, withdrawals, sponsorKeys }) => {
+	const outputIndex = body.outputs.findIndex((output) => sponsorKeys.paymentKeyHash !== void 0 && keyHashOf(paymentCredentialOf(output.address)) === sponsorKeys.paymentKeyHash);
+	if (outputIndex >= 0) return {
+		rule: "sponsor_outflow_zero",
+		reason: "pays-sponsor",
+		outputIndex
+	};
+	const withdrawal = withdrawals.find(({ stakeAddress }) => sponsorKeys.stakeKeyHash !== void 0 && keyHashOf(stakeCredentialOf(stakeAddress)) === sponsorKeys.stakeKeyHash);
+	return withdrawal ? {
+		rule: "sponsor_outflow_zero",
+		reason: "sponsor-withdrawal",
+		rewardAccount: withdrawal.stakeAddress
+	} : void 0;
+};
+const sponsorOutflow = (analysis, { mode }) => mode.kind === "fee" ? sponsorOutflowBounded(analysis, mode) : sponsorOutflowZero(analysis);
+/** Outputs away from the sponsor and the account are covered by what non-sponsor inputs and withdrawals bring. */
+const noSponsorValueElsewhere = ({ withdrawals, inputs, sponsorInputs, foreignOutputs, sponsorKeys }) => {
+	const supply = balanceOf(inputs.filter((input) => !sponsorInputs.includes(input)).flatMap(({ output }) => output ? [output.value] : []));
+	for (const { stakeAddress, quantity } of withdrawals) if (!(sponsorKeys.stakeKeyHash !== void 0 && keyHashOf(stakeCredentialOf(stakeAddress)) === sponsorKeys.stakeKeyHash)) supply.set(LOVELACE_KEY, (supply.get(LOVELACE_KEY) ?? 0n) + quantity);
+	const demand = balanceOf(foreignOutputs.map((output) => output.value));
+	for (const [key, demanded] of demand) {
+		const supplied = supply.get(key) ?? 0n;
+		if (demanded > supplied) return {
+			rule: "no_sponsor_value_elsewhere",
+			reason: "uncovered-outflow",
+			demanded,
+			supplied,
+			...key === LOVELACE_KEY ? {} : { assetId: key }
+		};
+	}
+};
+/**
+* Lace's own rule on reference inputs: one carrying a script must be a
+* version's parked script UTxO on the network, carrying exactly the script
+* parked there, and a parked script's UTxO must carry its script.
+*/
+const foreignReferenceScriptOf = (referenceInputs, { contractVersion, networkMagic }) => {
+	const parked = new Map((contractVersion.referenceScripts[networkMagic] ?? []).map(({ txIn, scriptHash }) => [outpointKey(txIn), scriptHash]));
+	for (const { input, output } of referenceInputs) {
+		const script = output?.scriptReference;
+		const scriptHash = script && Serialization.Script.fromCore(script).hash();
+		const expected = parked.get(outpointKey(input));
+		if (expected === void 0 ? scriptHash !== void 0 : output !== void 0 && scriptHash !== expected) return {
+			rule: "no_foreign_scripts",
+			reason: "foreign-reference-script",
+			input,
+			...scriptHash && { scriptHash }
+		};
+	}
+};
+/**
+* Every script the transaction runs or attaches belongs to the account.
+* Inputs and mints use the account proxy alone. A certificate or a vote may
+* name the proxy or the stake script of an account the transaction belongs
+* to. A logic its control datums name may also run through a withdrawal,
+* of zero only, and be attached. No reward account is drawn from twice.
+*/
+const noForeignScripts = ({ body, witness, inputs, referenceInputs, withdrawals, stakeScriptHashes, logicHashes }, context) => {
+	const rule = "no_foreign_scripts";
+	const proxy = context.contractVersion.accountValidatorHash;
+	const accountScripts = new Set([proxy, ...stakeScriptHashes]);
+	const runnable = new Set([...accountScripts, ...logicHashes]);
+	for (const { input, output } of inputs) {
+		const scriptHash = output && scriptHashOf$1(paymentCredentialOf(output.address));
+		if (scriptHash !== void 0 && scriptHash !== proxy) return {
+			rule,
+			reason: "foreign-script-input",
+			input,
+			scriptHash
+		};
+	}
+	for (const assetId of body.mint?.keys() ?? []) {
+		const policyId = policyIdOf(assetId);
+		if (policyId !== proxy) return {
+			rule,
+			reason: "foreign-mint",
+			policyId
+		};
+	}
+	for (const [certificateIndex, certificate] of (body.certificates ?? []).entries()) {
+		const scriptHash = certificateCredentials(certificate).map(scriptHashOf$1).find((hash) => hash !== void 0 && !accountScripts.has(hash));
+		if (scriptHash) return {
+			rule,
+			reason: "foreign-certificate",
+			certificateIndex,
+			scriptHash
+		};
+	}
+	const drawn = /* @__PURE__ */ new Set();
+	for (const { stakeAddress: rewardAccount, quantity } of withdrawals) {
+		if (drawn.has(rewardAccount)) return {
+			rule,
+			reason: "duplicate-withdrawal",
+			rewardAccount
+		};
+		drawn.add(rewardAccount);
+		const scriptHash = scriptHashOf$1(stakeCredentialOf(rewardAccount));
+		if (scriptHash !== void 0 && !runnable.has(scriptHash)) return {
+			rule,
+			reason: "foreign-withdrawal",
+			rewardAccount
+		};
+		if (scriptHash !== void 0 && logicHashes.has(scriptHash) && quantity !== 0n) return {
+			rule,
+			reason: "logic-draw",
+			rewardAccount,
+			logic: scriptHash,
+			quantity
+		};
+	}
+	for (const { voter } of body.votingProcedures ?? []) {
+		const scriptHash = scriptHashOf$1(voter.credential);
+		if (scriptHash !== void 0 && !accountScripts.has(scriptHash)) return {
+			rule,
+			reason: "foreign-voter",
+			scriptHash
+		};
+	}
+	const scripts = witness.scripts ?? [];
+	if (scripts.some((script) => Cardano.isNativeScript(script))) return {
+		rule,
+		reason: "native-script"
+	};
+	for (const script of scripts) {
+		const scriptHash = Serialization.Script.fromCore(script).hash();
+		if (!runnable.has(scriptHash)) return {
+			rule,
+			reason: "foreign-attached-script",
+			scriptHash
+		};
+	}
+	return foreignReferenceScriptOf(referenceInputs, context);
+};
+/**
+* The Plutus languages of the scripts the transaction attaches, then of the
+* reference scripts its inputs and reference inputs carry: the service's
+* language view covers all of them, not only the scripts that run.
+*/
+const languagesOf = ({ witness, inputs, referenceInputs }) => [...(witness.scripts ?? []).flatMap((script) => Cardano.isPlutusScript(script) ? [script.version] : []), ...[...inputs, ...referenceInputs].flatMap(({ output }) => output?.scriptReference && Cardano.isPlutusScript(output.scriptReference) ? [output.scriptReference.version] : [])];
+/** The redeemers that stand in for a witness set carrying datums and no redeemers. */
+const EMPTY_REDEEMERS = "a0";
+/**
+* The script data hash the body commits to is the one the witness set's
+* redeemers and datums hash to, under the cost models, with the language
+* view of every attached and referenced script. Every script an account
+* runs is Plutus V3, so a transaction carrying any other language is
+* refused before a view is formed.
+*/
+const scriptDataHash = (analysis, { costModels }) => {
+	const rule = "script_data_hash";
+	const declared = analysis.body.scriptIntegrityHash;
+	const { redeemers, datums } = analysis.witnessScriptData;
+	if (redeemers === void 0 && datums === void 0) return declared === void 0 ? void 0 : {
+		rule,
+		reason: "unexpected-script-data-hash",
+		declared
+	};
+	if (declared === void 0) return {
+		rule,
+		reason: "missing-script-data-hash"
+	};
+	const languages = languagesOf(analysis);
+	const foreign = languages.find((language) => language !== Cardano.PlutusLanguageVersion.V3);
+	if (foreign !== void 0) return {
+		rule,
+		reason: "non-v3-script",
+		language: foreign
+	};
+	const views = new Serialization.Costmdls();
+	for (const language of new Set(languages)) {
+		const costs = costModels.get(language);
+		if (!costs) return {
+			rule,
+			reason: "missing-cost-model",
+			language
+		};
+		views.insert(new Serialization.CostModel(language, costs));
+	}
+	const computed = blake2b.hash(HexBlob(`${redeemers ?? EMPTY_REDEEMERS}${datums ?? ""}${views.languageViewsEncoding()}`), 32);
+	return computed === declared ? void 0 : {
+		rule,
+		reason: "script-data-hash-mismatch",
+		declared,
+		computed
+	};
+};
+/** Neither sponsor key signs for anything but the sponsor's own inputs. */
+const signers = ({ body, withdrawals, sponsorKeys }) => {
+	const keyHash = (body.requiredExtraSignatures ?? []).find((signer) => signer === sponsorKeys.paymentKeyHash || signer === sponsorKeys.stakeKeyHash);
+	if (keyHash) return {
+		rule: "signers",
+		reason: "sponsor-required-signer",
+		keyHash
+	};
+	const withdrawal = withdrawals.find(({ stakeAddress }) => {
+		const credential = stakeCredentialOf(stakeAddress);
+		return credential !== void 0 && namesSponsorKey(credential, sponsorKeys);
+	});
+	if (withdrawal) return {
+		rule: "signers",
+		reason: "sponsor-withdrawal",
+		rewardAccount: withdrawal.stakeAddress
+	};
+	const certificateIndex = (body.certificates ?? []).findIndex((certificate) => certificateCredentials(certificate).some((credential) => namesSponsorKey(credential, sponsorKeys)));
+	if (certificateIndex >= 0) return {
+		rule: "signers",
+		reason: "sponsor-certificate",
+		certificateIndex
+	};
+	return (body.votingProcedures ?? []).some(({ voter }) => namesSponsorKey(voter.credential, sponsorKeys)) ? {
+		rule: "signers",
+		reason: "sponsor-voter"
+	} : void 0;
+};
+/** The service's rules in its check order; it evaluates the scripts between the last two. */
+const RULES = [
+	wellFormed,
+	sponsorInputsRule,
+	sharedCollateral,
+	boundedValidity,
+	accountTransaction,
+	knownLogic,
+	sponsorOutflow,
+	noSponsorValueElsewhere,
+	noForeignScripts,
+	scriptDataHash,
+	signers
+];
+/**
+* Every rule of the fee sponsor service's policy that a transaction breaks,
+* at most one per rule and in the service's check order, so the first is
+* the one the service would answer with. Lace checks its custody builds
+* with it before asking the sponsor for a witness, so a refusal from the
+* service points at a real defect rather than a build Lace knew to be wrong.
+*
+* The script evaluation rule is not mirrored: it needs the chain. Of the
+* sponsor's UTxOs, only the leased fee UTxO, the shared collateral and
+* outputs locked by the sponsor payment key are recognised; the service
+* also knows the rest of its pool. The service knows the logics its
+* operator lists, which Lace takes to be the contract version's. Beyond the
+* service's rules, the shared collateral rule refuses a fee above what the
+* shared collateral covers, which the ledger would refuse after the service
+* signed, and the script rule refuses a reference script other than the
+* version's parked scripts on the network.
+*
+* @param resolvedInputs - the outputs the transaction's inputs spend and its
+*   reference inputs name; an input or a reference input without one is
+*   read as the service reads one the chain does not know, which is never
+*   an account's control or grant UTxO and carries no reference script
+*/
+const findCustodySponsorRuleViolations = (transaction, resolvedInputs, context) => {
+	const analysis = analyse(transaction, resolvedInputs, context);
+	return RULES.flatMap((rule) => {
+		const violation = rule(analysis, context);
+		return violation ? [violation] : [];
+	});
+};
+//#endregion
+//#region ../../packages/lib/cardano-custody/src/state/transitions.ts
+/**
+* The state Lace creates an account with: `logic` as its rules, the creator
+* as the only device, generation zero and zero counters. The logic accepts
+* any generation at creation; consent refuses every other initial state.
+*
+* @param logic - the applied hash of the logic the account runs, normally the
+*   contract version's `currentLogicHash`
+*/
+const createInitialCustodyAccountState = (creatorKeyHash, logic) => {
+	if (!isHash28Hex(logic)) return fail({
+		code: "invalid-logic-hash",
+		logic
+	});
+	return isHash28Hex(creatorKeyHash) ? ok({
+		logic,
+		devices: [creatorKeyHash],
+		grantGeneration: 0n,
+		nextSlot: 0n,
+		revoked: [],
+		outstanding: 0n
+	}) : fail({
+		code: "invalid-device-key-hash",
+		device: creatorKeyHash
+	});
+};
+/** Checks a grant Lace is about to write: authoring rules, expiry, separation. */
+const checkAuthoredGrant = (state, grant, now) => {
+	const violations = findCustodyGrantViolations(grant);
+	if (violations.length > 0) return {
+		code: "invalid-grant",
+		violations
+	};
+	if (!Number.isFinite(now)) return {
+		code: "invalid-now",
+		now
+	};
+	if (isCustodyGrantExpired(grant, now)) return {
+		code: "grant-expired",
+		slot: grant.slot,
+		expiresAt: grant.scope.expiresAt
+	};
+	if (state.devices.includes(grant.grantee)) return {
+		code: "grantee-is-device",
+		grantee: grant.grantee
+	};
+};
+/**
+* Refuses a grantee that still holds a grant it could spend. One grant per
+* agent key keeps each agent's authority in one place, so a revocation or a
+* replacement always covers all of it. A grant judged against an older
+* state than its own counts too: it is in flight and about to be current.
+*/
+const checkGranteeHoldsNoCurrentGrant = (state, grants, { grantee, now }) => {
+	const held = grants.find((grant) => {
+		if (grant.grantee !== grantee) return false;
+		const liveness = custodyGrantLiveness(grant, state, now);
+		return liveness === "current" || liveness === "future-generation";
+	});
+	return held ? {
+		code: "grantee-has-grant",
+		grantee,
+		slot: held.slot
+	} : void 0;
+};
+/**
+* Issues one grant in the state's next slot under its current generation:
+* the next slot and the outstanding count move by one, and the result
+* carries the datum of the new grant UTxO.
+*
+* @param grants - every grant of the account, from its grant UTxOs and from
+*   issues still in flight, to keep one current grant per agent key
+*/
+const issueCustodyGrant = (state, { grantee, scope, now }, grants) => {
+	if (state.nextSlot >= CUSTODY_SLOT_LIMIT) return fail({
+		code: "slot-space-exhausted",
+		nextSlot: state.nextSlot
+	});
+	const grant = {
+		slot: state.nextSlot,
+		grantee,
+		generation: state.grantGeneration,
+		scope
+	};
+	const error = checkAuthoredGrant(state, grant, now) ?? checkGranteeHoldsNoCurrentGrant(state, grants, {
+		grantee,
+		now
+	});
+	if (error) return fail(error);
+	if (state.outstanding >= BigInt(16)) return fail({
+		code: "grant-limit",
+		limit: 16
+	});
+	return ok({
+		state: {
+			...state,
+			nextSlot: state.nextSlot + 1n,
+			outstanding: state.outstanding + 1n
+		},
+		grant
+	});
+};
+/**
+* Revokes the current grant in `slot` by appending the slot to the revoked
+* list. The grant UTxO stays until a sweep burns its token.
+*
+* @param grants - every grant of the account; the one in `slot` must be current
+*/
+const revokeCustodyGrant = (state, slot, grants) => {
+	const grant = grants.find((candidate) => candidate.slot === slot);
+	if (!grant) return fail({
+		code: "grant-not-found",
+		slot
+	});
+	if (!isCustodyGrantCurrent(grant, state)) return fail({
+		code: "grant-not-current",
+		slot,
+		liveness: custodyGrantLiveness(grant, state, 0)
+	});
+	if (state.revoked.length >= 32) return fail({
+		code: "revoked-list-full",
+		limit: 32
+	});
+	return ok({
+		...state,
+		revoked: [...state.revoked, slot]
+	});
+};
+/**
+* Revokes the current grant in `request.slot` and issues its replacement in
+* the next slot, in one state. Both happen in one transaction; the old
+* grant UTxO stays until a later sweep.
+*
+* @param grants - every grant of the account, as for `issueCustodyGrant`
+*/
+const replaceCustodyGrant = (state, { slot, ...request }, grants) => {
+	const revoked = revokeCustodyGrant(state, slot, grants);
+	return revoked.ok ? issueCustodyGrant(revoked.value, request, grants) : revoked;
+};
+/** Kills every grant: the generation moves on and the revoked list clears. */
+const revokeAllCustodyGrants = (state) => ({
+	...state,
+	grantGeneration: state.grantGeneration + 1n,
+	revoked: []
+});
+/**
+* Sweeps dead grants: their tokens burn, the outstanding count drops, and
+* their slots leave the revoked list. Pruning is safe because slots are never
+* reissued, and it keeps the list from filling up. Each grant must be dead
+* against `state`, the state before the sweep.
+*
+* @param grants - the grants to sweep, at most `CUSTODY_MAX_GRANT_BATCH`
+* @param now - POSIX milliseconds; a grant dead by expiry alone must have
+*   expired strictly before it, so a validity interval can start after the
+*   expiry
+*/
+const sweepCustodyGrants = (state, grants, now) => {
+	if (!Number.isFinite(now)) return fail({
+		code: "invalid-now",
+		now
+	});
+	if (grants.length === 0) return fail({ code: "sweep-empty" });
+	if (grants.length > 8) return fail({
+		code: "sweep-batch-limit",
+		count: grants.length,
+		limit: 8
+	});
+	const slots = /* @__PURE__ */ new Set();
+	let startsAfter;
+	for (const grant of grants) {
+		if (slots.has(grant.slot)) return fail({
+			code: "duplicate-grant-slot",
+			slot: grant.slot
+		});
+		slots.add(grant.slot);
+		const liveness = custodyGrantLiveness(grant, state, now);
+		const { expiresAt } = grant.scope;
+		if (!(liveness === "superseded" || liveness === "revoked" || liveness === "expired" && expiresAt < BigInt(Math.floor(now)))) return fail({
+			code: "grant-not-dead",
+			slot: grant.slot,
+			liveness
+		});
+		if (liveness === "expired" && (startsAfter === void 0 || expiresAt > startsAfter)) startsAfter = expiresAt;
+	}
+	return ok({
+		state: {
+			...state,
+			revoked: state.revoked.filter((slot) => !slots.has(slot)),
+			outstanding: state.outstanding - BigInt(grants.length)
+		},
+		...startsAfter !== void 0 && { startsAfter }
+	});
+};
+/**
+* Lists a new device key. Every device has full owner authority, so a key
+* that holds a current grant is refused: removing the device later would
+* leave the grant in force.
+*
+* @param grants - every grant of the account
+*/
+const addCustodyDevice = (state, device, grants) => {
+	if (!isHash28Hex(device)) return fail({
+		code: "invalid-device-key-hash",
+		device
+	});
+	if (state.devices.includes(device)) return fail({
+		code: "device-already-listed",
+		device
+	});
+	if (state.devices.length >= 8) return fail({
+		code: "device-limit",
+		limit: 8
+	});
+	const slots = grants.filter((grant) => grant.grantee === device && isCustodyGrantCurrent(grant, state)).map((grant) => grant.slot);
+	if (slots.length > 0) return fail({
+		code: "device-is-grantee",
+		device,
+		slots
+	});
+	return ok({
+		...state,
+		devices: [...state.devices, device]
+	});
+};
+/**
+* Removes a device key. Refuses when no well-formed device key would remain,
+* because the account would then accept no owner operation ever again. Grants
+* held by the same key stay in force.
+*/
+const removeCustodyDevice = (state, device) => {
+	const listed = state.devices.find((existing) => existing === device);
+	if (listed === void 0) return fail({
+		code: "device-not-listed",
+		device
+	});
+	const devices = state.devices.filter((existing) => existing !== device);
+	if (!devices.some((remaining) => isHash28Hex(remaining))) return fail({
+		code: "last-device",
+		device: listed
+	});
+	return ok({
+		...state,
+		devices
+	});
+};
+//#endregion
+//#region ../../packages/contract/cardano-context/src/estimate-signed-tx-size.ts
+const DUMMY_SIGNATURE = "f".repeat(128);
+const dummyVkey = (index) => index.toString(16).padStart(64, "0");
+/**
+* Byte length of `tx` once signed. Estimated exactly by populating one dummy
+* vkey witness per unique signer and letting the serializer measure the result
+* (the cardano-sdk `getTxSize` technique), which counts the real Conway witness
+* set framing, unlike a hand-summed byte formula.
+*
+* `resolvedInputs` must resolve every input so the signer count (input payment
+* keys plus withdrawal / certificate stake keys) is complete: an incomplete set
+* would under-count witnesses and under-estimate the size, the dangerous
+* direction for a size guard.
+*/
+const estimateSignedTxSize = (tx, resolvedInputs) => {
+	const core = tx.toCore();
+	const signerCount = getUniqueSignerKeyHashes(core, resolvedInputs).size;
+	const signatures = /* @__PURE__ */ new Map();
+	for (let index = 0; index < signerCount; index++) signatures.set(dummyVkey(index), DUMMY_SIGNATURE);
+	return Serialization.Transaction.fromCore({
+		...core,
+		witness: {
+			...core.witness,
+			signatures
+		}
+	}).toCbor().length / 2;
+};
+//#endregion
+//#region ../../packages/contract/cardano-context/src/tx-builder/transaction-limits.ts
+/**
+* Conway's cap on the reference-script bytes one transaction reads, summed
+* over its spent and reference inputs. A ledger constant, not a protocol
+* parameter.
+*/
+const MAX_REFERENCE_SCRIPT_SIZE_PER_TX = 204800;
+/** A built transaction would be refused by the ledger for exceeding a limit. */
+var TransactionLimitsExceededError = class extends Error {
+	constructor(exceeded, usage, limits) {
+		super(`Transaction exceeds protocol limits (${exceeded.join(", ")}): execution units ${usage.executionUnits.memory}/${limits.maxExecutionUnitsPerTransaction.memory} memory, ${usage.executionUnits.steps}/${limits.maxExecutionUnitsPerTransaction.steps} steps; signed size ${usage.signedTxSize}/${limits.maxTxSize} bytes; reference scripts ${usage.referenceScriptSize}/${MAX_REFERENCE_SCRIPT_SIZE_PER_TX} bytes`);
+		this.exceeded = exceeded;
+		this.usage = usage;
+		this.limits = limits;
+		this.name = "TransactionLimitsExceededError";
+	}
+};
+/**
+* Checks a built transaction against the per-transaction execution-unit,
+* size and reference-script limits, which `TransactionBuilder` does not
+* enforce. Run it on the final (evaluated) transaction. The size is measured
+* with one vkey witness per required signer, so `resolvedInputs` must resolve
+* every input and collateral input, as for `estimateSignedTxSize`. It must
+* also resolve every reference input, whose scripts count toward the
+* reference-script limit.
+*
+* @returns The measured usage when every limit holds.
+* @throws `TransactionLimitsExceededError` When any limit is exceeded.
+*/
+const assertWithinTransactionLimits = (tx, resolvedInputs, limits) => {
+	const redeemers = tx.witnessSet().redeemers()?.toCore() ?? [];
+	const body = tx.body().toCore();
+	const usage = {
+		executionUnits: redeemers.reduce((total, { executionUnits }) => ({
+			memory: total.memory + executionUnits.memory,
+			steps: total.steps + executionUnits.steps
+		}), {
+			memory: 0,
+			steps: 0
+		}),
+		signedTxSize: estimateSignedTxSize(tx, resolvedInputs),
+		referenceScriptSize: referenceScriptSize([...body.inputs, ...body.referenceInputs ?? []], resolvedInputs)
+	};
+	const exceeded = [];
+	if (usage.executionUnits.memory > limits.maxExecutionUnitsPerTransaction.memory) exceeded.push("executionMemory");
+	if (usage.executionUnits.steps > limits.maxExecutionUnitsPerTransaction.steps) exceeded.push("executionSteps");
+	if (usage.signedTxSize > limits.maxTxSize) exceeded.push("txSize");
+	if (usage.referenceScriptSize > MAX_REFERENCE_SCRIPT_SIZE_PER_TX) exceeded.push("referenceScriptSize");
+	if (exceeded.length > 0) throw new TransactionLimitsExceededError(exceeded, usage, limits);
+	return usage;
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/build-failure.ts
+/**
+* Stops a custody build with a typed reason. The build side effect reports
+* it as the failure; any other error thrown during a build is a defect and
+* is reported as `build-failed`.
+*/
+var CustodyBuildFailure = class extends Error {
+	constructor(reason) {
+		super(`Custody transaction build failed: ${reason.code}`);
+		this.reason = reason;
+		this.name = "CustodyBuildFailure";
+	}
+};
+const failCustodyBuild = (reason) => {
+	throw new CustodyBuildFailure(reason);
+};
+/**
+* The build failure a state transition's refusal stands for. A full account
+* the owner can act on has its own code: sweep dead grants to free the
+* outstanding count or the revoked list, or wait for a grant to die.
+*/
+const transitionFailureOf = (error) => {
+	if (error.code === "grant-limit" || error.code === "revoked-list-full") return {
+		code: error.code,
+		limit: error.limit
+	};
+	if (error.code === "grant-not-dead") return {
+		code: "sweep-not-dead",
+		slot: error.slot,
+		liveness: error.liveness
+	};
+	return {
+		code: "invalid-operation",
+		reason: "state-transition",
+		error
+	};
+};
+/** What a library transition produced, or the build refused with its reason. */
+const transitioned = (result) => result.ok ? result.value : failCustodyBuild(transitionFailureOf(result.error));
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-execution-estimate.ts
+/**
+* Net memory units of one run of each handler: the largest figure the
+* budget table of contract b48545f's security review ("Resource
+* exhaustion": `aiken check -D` less each fixture's baseline, over the
+* largest state) gives for a transaction Lace builds, which issues one
+* grant, sweeps at most eight and spends at most twelve funds.
+*/
+const HANDLER_NET_MEMORY = {
+	device: 48e4,
+	spendWithGrant: 4e5,
+	sweepGrant: 43e4,
+	fund: 2e5,
+	issueGrants: 15e4,
+	burnGrants: 34e4,
+	createAccount: 15e4,
+	operate: 16e4
+};
+/**
+* Net memory units of the logic run per path, from the same table, and
+* what each issued grant, swept grant and fund input adds: the owner path
+* runs 1.11 M for a revoke, 1.99 M issuing one grant, 1.54 M sweeping one
+* and 1.21 M with a reserve beside the control; the agent path 1.96 M over
+* one deposit and 5.94 M over forty.
+*
+* Summed per transaction they reach at least the review's figures, given
+* in brackets: a creation 0.75 M (0.73 M), a revoke 1.59 M (1.33 M), an
+* issue 2.62 M (2.41 M), a sweep of eight 8.81 M (8.08 M) and an agent
+* spend over eight funds 4.76 M (4.17 M).
+*/
+const LOGIC_NET_MEMORY = {
+	path: {
+		agent: 196e4,
+		arrival: 44e4,
+		owner: 111e4
+	},
+	issuedGrant: 88e4,
+	sweptGrant: 43e4,
+	fund: 1e5
+};
+/**
+* What one run is expected to cost on chain, as a multiple of its net
+* figure. The runner leaves out decoding the script context, which every
+* run pays and which grows with the transaction. On upstream's devnet with
+* Preprod's parameters (docs/devnet-evidence.md, "Budget comparison") a
+* revoke over the largest state measured 1.74 M against 1.10 M net, a
+* sweep of eight 9.20 M against 8.26 M and an agent spend over twelve
+* deposits 4.28 M. A transaction that measures above the estimate is
+* reseeded once at the measurement.
+*/
+const CUSTODY_EXECUTION_ESTIMATE_FACTOR = 2;
+/**
+* CPU steps the estimate charges per memory unit. Every redeemer of the
+* devnet run measured between 290 and 460 steps per memory unit, the
+* smallest Fund runs at the top of that range; the large logic and proxy
+* runs, which dominate every total, stay below 370.
+*/
+const CUSTODY_ESTIMATE_STEPS_PER_MEMORY_UNIT = 400;
+/**
+* What a reseed adds to the measured execution units, in percent. The
+* measurement already holds the evaluation margin; this one covers the
+* reseeded transaction measuring differently, since a higher fee changes
+* its change output.
+*/
+const CUSTODY_RESEED_MARGIN_PERCENT = 10;
+const withReseedMargin = (units) => Math.ceil(units * (100 + CUSTODY_RESEED_MARGIN_PERCENT) / 100);
+const logicNetMemory = ({ logic, issueGrants = 0, sweepGrant = 0, fund = 0 }) => logic ? LOGIC_NET_MEMORY.path[logic] + LOGIC_NET_MEMORY.issuedGrant * issueGrants + LOGIC_NET_MEMORY.sweptGrant * sweepGrant + LOGIC_NET_MEMORY.fund * fund : 0;
+/**
+* The execution units a transaction that runs `runs` is expected to
+* measure: the handlers' and the logic's net memory units times the
+* estimate factor, and steps in proportion. It is not capped at the
+* per-transaction limit.
+*/
+const custodyExecutionEstimate = (runs) => {
+	const memory = Object.keys(HANDLER_NET_MEMORY).reduce((total, handler) => total + HANDLER_NET_MEMORY[handler] * (runs[handler] ?? 0), logicNetMemory(runs)) * CUSTODY_EXECUTION_ESTIMATE_FACTOR;
+	return {
+		memory,
+		steps: memory * CUSTODY_ESTIMATE_STEPS_PER_MEMORY_UNIT
+	};
+};
+/**
+* The plan's estimate within the per-transaction limit, which no valid
+* transaction exceeds: what balancing prices a plan's fee at until a
+* reseed.
+*/
+const estimateWithinLimit = (estimate, limit) => ({
+	memory: Math.min(estimate.memory, limit.memory),
+	steps: Math.min(estimate.steps, limit.steps)
+});
+/** What a build learned from redeemers that measured above `seeded`. */
+const custodyReseedOf = (evaluated, seeded) => {
+	const sum = evaluated.reduce((total, units) => ({
+		memory: total.memory + units.memory,
+		steps: total.steps + units.steps
+	}), {
+		memory: 0,
+		steps: 0
+	});
+	return {
+		measured: {
+			memory: Math.max(sum.memory, seeded.memory),
+			steps: Math.max(sum.steps, seeded.steps)
+		},
+		redeemers: evaluated.length,
+		dearest: {
+			memory: Math.max(0, ...evaluated.map(({ memory }) => memory)),
+			steps: Math.max(0, ...evaluated.map(({ steps }) => steps))
+		}
+	};
+};
+/**
+* What a reseed prices a plan of `redeemers` redeemers at: the measurement
+* plus the reseed margin, with each redeemer the plan has beyond the
+* measured transaction, such as a fund input the selection round added,
+* priced as the dearest one measured. It is not capped at the
+* per-transaction limit, so a transaction over the limit still builds and
+* its limit check reports the overrun.
+*/
+const reseededExecutionUnits = ({ measured, redeemers: measuredRedeemers, dearest }, redeemers) => {
+	const added = Math.max(0, redeemers - measuredRedeemers);
+	return {
+		memory: withReseedMargin(measured.memory + added * dearest.memory),
+		steps: withReseedMargin(measured.steps + added * dearest.steps)
+	};
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-assembly.ts
+/**
+* The account's control output: lovelace and the state NFT only, with the
+* state encoded afresh as an inline datum.
+*/
+const controlOutputOf = (identity, state, lovelace) => ({
+	address: identity.address,
+	value: {
+		coins: lovelace,
+		assets: new Map([[identity.stateNftAssetId, 1n]])
+	},
+	datum: encodeCustodyAccountState(state)
+});
+/**
+* A grant UTxO at the account: lovelace and the grant's token only, with
+* the grant as an inline datum and no reference script.
+*/
+const grantOutputOf = (identity, grant, lovelace) => ({
+	address: identity.address,
+	value: {
+		coins: lovelace,
+		assets: new Map([[custodyGrantAssetId({
+			accountValidatorHash: identity.contractVersion.accountValidatorHash,
+			stakeScriptHash: identity.stakeScriptHash
+		}, grant.slot), 1n]])
+	},
+	datum: encodeCustodyGrant(grant)
+});
+/**
+* The least lovelace an output holds at its own size, at least `floor`. The
+* coin's own width changes the size, so the minimum is taken until it
+* settles.
+*/
+const outputLovelaceFor = (outputWith, floor, coinsPerUtxoByte) => {
+	let lovelace = floor;
+	for (;;) {
+		const minimum = minAdaRequired(outputWith(lovelace), BigInt(coinsPerUtxoByte));
+		if (minimum <= lovelace) return lovelace;
+		lovelace = minimum;
+	}
+};
+/**
+* The lovelace a control output carrying `state` holds: at least `floor`
+* and at least the minimum for its size.
+*/
+const controlLovelaceFor = ({ identity, state, floor }, coinsPerUtxoByte) => outputLovelaceFor((lovelace) => controlOutputOf(identity, state, lovelace), floor, coinsPerUtxoByte);
+/** What `units` of execution cost at the protocol's prices. */
+const executionFeeOf = (units, { prices }) => BigInt(Math.ceil(prices.memory * units.memory + prices.steps * units.steps));
+/**
+* The most the builder prices a fee at before evaluation, when it seeds
+* `seed` execution units: the largest transaction's size fee plus the seed
+* at the protocol's prices. Balancing must fund that fee from the inputs
+* before evaluation lowers it.
+*/
+const preEvaluationFeeBound = (parameters, seed) => BigInt(parameters.minFeeConstant) + BigInt(parameters.minFeeCoefficient) * BigInt(parameters.maxTxSize) + executionFeeOf(seed, parameters);
+/**
+* The least fee a plan's transaction pays, whatever its body and its
+* scripts measure: the size fee of the scripts it attaches and the
+* reference-script fee of the scripts its reference inputs carry.
+*/
+const leastFeeOf = (plan, parameters) => {
+	const references = plan.referenceInputs ?? [];
+	return BigInt(parameters.minFeeConstant) + BigInt(parameters.minFeeCoefficient) * BigInt(plan.scripts.reduce((bytes, script) => bytes + script.bytes.length / 2, 0)) + referenceScriptFee(referenceScriptSize(references.map(([txIn]) => txIn), references), parameters);
+};
+/**
+* The fee a plan is expected to balance at before evaluation, less the
+* bytes of its body beyond its scripts: its least fee and its seed
+* execution units at the protocol's prices. Fund selection aims at it; a
+* selection that falls short gains the next fund UTxO when balancing
+* fails, before any evaluation.
+*/
+const plannedFeeOf = (plan, parameters) => leastFeeOf(plan, parameters) + executionFeeOf(estimateWithinLimit(plan.executionEstimate, parameters.maxExecutionUnitsPerTransaction), parameters);
+const quantityOf = (utxo, assetId) => utxo[1].value.assets?.get(assetId) ?? 0n;
+const byCoinsDescending = (a, b) => a[1].value.coins === b[1].value.coins ? 0 : a[1].value.coins > b[1].value.coins ? -1 : 1;
+/**
+* Large-First selection over fund UTxOs: first the UTxOs holding most of
+* each requested asset, then the largest by lovelace, with `reserves` after
+* every fund. When the UTxOs cannot cover the target, everything is
+* selected, `covers` is false and the build decides: the target holds only
+* an estimate of the fee.
+*/
+const selectFunds = (funds, target, reserves = []) => {
+	const remaining = [...[...funds].sort(byCoinsDescending), ...[...reserves].sort(byCoinsDescending)];
+	const selected = [];
+	const take = (utxo) => {
+		remaining.splice(remaining.indexOf(utxo), 1);
+		selected.push(utxo);
+	};
+	for (const [assetId, quantity] of target.assets ?? []) {
+		let covered = selected.reduce((sum, utxo) => sum + quantityOf(utxo, assetId), 0n);
+		while (covered < quantity) {
+			const richest = remaining.reduce((best, utxo) => !best || quantityOf(utxo, assetId) > quantityOf(best, assetId) ? utxo : best, void 0);
+			if (!richest || quantityOf(richest, assetId) === 0n) return {
+				selected: [...selected, ...remaining],
+				remaining: [],
+				covers: false
+			};
+			take(richest);
+			covered += quantityOf(richest, assetId);
+		}
+	}
+	let lovelace = selected.reduce((sum, [, output]) => sum + output.value.coins, 0n);
+	while (lovelace < target.coins && remaining.length > 0) {
+		const [next] = remaining;
+		take(next);
+		lovelace += next[1].value.coins;
+	}
+	return {
+		selected,
+		remaining,
+		covers: lovelace >= target.coins
+	};
+};
+/** The sum of outputs' values. */
+const totalValueOf = (outputs) => {
+	const assets = /* @__PURE__ */ new Map();
+	let coins = 0n;
+	for (const { value } of outputs) {
+		coins += value.coins;
+		for (const [assetId, quantity] of value.assets ?? []) assets.set(assetId, (assets.get(assetId) ?? 0n) + quantity);
+	}
+	return {
+		coins,
+		assets
+	};
+};
+/**
+* The funds can no longer pay for the transaction; one more fund UTxO may.
+* Once none is left, the build fails with `exhausted`, or with
+* `insufficient-funds` when it is absent.
+*/
+var FundShortfall = class extends Error {
+	constructor(message, exhausted) {
+		super(message);
+		this.exhausted = exhausted;
+		this.name = "FundShortfall";
+	}
+};
+/**
+* The evaluated transaction needs a larger fee than its plan balanced at:
+* the scripts measured above the execution estimate. Building again seeded
+* from `reseed` funds it.
+*/
+var ExecutionEstimateShortfall = class extends Error {
+	constructor(reseed) {
+		super("The scripts measure above the execution estimate");
+		this.reseed = reseed;
+		this.name = "ExecutionEstimateShortfall";
+	}
+};
+/**
+* The transaction needs a fee above the most it may be balanced at. `fee`
+* is the fee it needs, or, when even the fee of its body without execution
+* is above that most, that fee. `evaluatedRedeemers` holds the budgets the
+* fee was priced at when an evaluation priced it.
+*/
+var MaxBalancedFeeExceeded = class extends Error {
+	constructor(fee, evaluatedRedeemers = []) {
+		super(`The transaction needs a fee of ${fee} lovelace, above the most it may be balanced at`);
+		this.fee = fee;
+		this.evaluatedRedeemers = evaluatedRedeemers;
+		this.name = "MaxBalancedFeeExceeded";
+	}
+};
+/** The builder balanced a draft above the most fee allowed; nothing evaluated it. */
+var DraftFeeAboveMax = class extends Error {
+	constructor(fee) {
+		super(`The draft is balanced at ${fee} lovelace, above the most allowed`);
+		this.fee = fee;
+		this.name = "DraftFeeAboveMax";
+	}
+};
+/** Stops a draft balanced above `maxFee` before the provider evaluates it. */
+const withMaxDraftFee = (evaluator, maxFee) => ({ evaluate: async (tx, resolvedInputs) => {
+	if (tx.body.fee > maxFee) throw new DraftFeeAboveMax(tx.body.fee);
+	return evaluator.evaluate(tx, resolvedInputs);
+} });
+/**
+* `seed` scaled so that its execution costs at most `fee` at the protocol's
+* prices, which are linear in the units.
+*/
+const seedPricedAt = (seed, fee, parameters) => {
+	const seedFee = executionFeeOf(seed, parameters);
+	if (seedFee === 0n) return seed;
+	const scale = Number(fee) / Number(seedFee);
+	return {
+		memory: Math.floor(seed.memory * scale),
+		steps: Math.floor(seed.steps * scale)
+	};
+};
+/**
+* Seed changes that keep a draft within the most fee it may be balanced
+* at. A draft lands within a few bytes of the fee its seed aims at, so one
+* change usually suffices.
+*/
+const MAX_DRAFT_FEE_ROUNDS = 4;
+/**
+* The plain change output a collateral-mode build returns to the account:
+* the largest output at `address` after the planned ones, without a datum.
+* -1 when there is none.
+*/
+const changeIndexOf = (outputs, address, plannedCount) => {
+	let changeIndex = -1;
+	for (const [index, output] of outputs.entries()) if (index >= plannedCount && output.address === address && output.datum === void 0 && output.datumHash === void 0 && (changeIndex < 0 || output.value.coins > outputs[changeIndex].value.coins)) changeIndex = index;
+	return changeIndex;
+};
+const withBody = (transaction, fields) => {
+	const core = transaction.toCore();
+	return Serialization.Transaction.fromCore({
+		...core,
+		body: {
+			...core.body,
+			...fields
+		}
+	});
+};
+const hasGrown = (rewritten, transaction) => rewritten.body().toCbor().length > transaction.body().toCbor().length;
+const grewBody = () => failCustodyBuild({
+	code: "build-failed",
+	message: "Moving lovelace between outputs grew the body"
+});
+/**
+* The transaction with `outputs` in place of its own. The fee was priced
+* for the body's size, so the body must not grow, as it would when a coin
+* crosses a CBOR width boundary. A smaller body keeps a fee that also pays
+* for the bytes it dropped.
+*/
+const withOutputs = (transaction, outputs) => {
+	const rewritten = withBody(transaction, { outputs });
+	return hasGrown(rewritten, transaction) ? grewBody() : rewritten;
+};
+/** `output` holding `coins` lovelace. */
+const withCoins = (output, coins) => ({
+	...output,
+	value: {
+		...output.value,
+		coins
+	}
+});
+/**
+* The transaction with `outputs` in place of its own and its fee raised by
+* `excess`. The declared collateral rises with the fee, taken from the
+* collateral return, which must keep its minimum ADA.
+*/
+const withExcessInFee = (transaction, { outputs, excess }, { collateralPercentage, coinsPerUtxoByte }) => {
+	const { fee, totalCollateral, collateralReturn } = transaction.body().toCore();
+	const raised = fee + excess;
+	const required = (raised * BigInt(collateralPercentage) + 99n) / 100n;
+	let collateral = {};
+	if (totalCollateral !== void 0 && totalCollateral < required) {
+		const returned = collateralReturn && withCoins(collateralReturn, collateralReturn.value.coins - (required - totalCollateral));
+		if (!returned || returned.value.coins < minAdaRequired(returned, BigInt(coinsPerUtxoByte))) return failCustodyBuild({
+			code: "collateral-insufficient",
+			message: `The collateral cannot cover a fee of ${raised} lovelace`
+		});
+		collateral = {
+			totalCollateral: required,
+			collateralReturn: returned
+		};
+	}
+	const rewritten = withBody(transaction, {
+		outputs,
+		fee: raised,
+		...collateral
+	});
+	return hasGrown(rewritten, transaction) ? grewBody() : rewritten;
+};
+/**
+* Moves the lovelace the builder's fee correction credited to a planned
+* output back to the change. The correction refunds the largest output at
+* the change address, and in collateral mode the planned account outputs
+* share that address: a control output would lock the lovelace for the
+* account's life, and a grant output must hold what was planned.
+*
+* The change takes it unless that grows the body the fee was priced for,
+* which happens only when its lovelace crosses 2^32; the fee then keeps
+* the saving instead.
+*
+* @throws `FundShortfall` when no change output exists to take it
+*/
+const restorePlannedOutputs = (transaction, plan, parameters) => {
+	const outputs = [...transaction.body().toCore().outputs];
+	let excess = 0n;
+	for (const [index, planned] of plan.outputs.entries()) {
+		const credited = outputs[index].value.coins - planned.value.coins;
+		if (credited > 0n) {
+			excess += credited;
+			outputs[index] = withCoins(outputs[index], planned.value.coins);
+		}
+	}
+	if (excess === 0n) return transaction;
+	const changeIndex = changeIndexOf(outputs, plan.changeAddress, plan.outputs.length);
+	if (changeIndex < 0) throw new FundShortfall("No change output to return the fee saving to");
+	const credited = [...outputs];
+	credited[changeIndex] = withCoins(outputs[changeIndex], outputs[changeIndex].value.coins + excess);
+	const rewritten = withBody(transaction, { outputs: credited });
+	return hasGrown(rewritten, transaction) ? withExcessInFee(transaction, {
+		outputs,
+		excess
+	}, parameters) : rewritten;
+};
+/**
+* The lovelace the first output of a plan whose first output pays the fee
+* must hold to balance at the fee the builder settled on.
+*/
+var FirstOutputCoinsMissed = class extends Error {
+	constructor(coins) {
+		super(`The first output must hold ${coins} lovelace to balance`);
+		this.coins = coins;
+		this.name = "FirstOutputCoinsMissed";
+	}
+};
+/**
+* Coin selection for a plan whose first output pays the fee: it spends
+* exactly the preselected inputs and returns no change. The balancer prices
+* each target and asks again until the fee settles; when the settled target
+* still misses the inputs, the build stops with the first output's lovelace
+* that meets it.
+*/
+const firstOutputPaysSelector = (firstOutputCoins) => {
+	let previousTarget;
+	return { select: ({ preSelectedUtxo = [], targetValue }) => {
+		const surplus = preSelectedUtxo.reduce((total, [, output]) => total + output.value.coins, 0n) - targetValue.coins;
+		if (surplus !== 0n && previousTarget === targetValue.coins) throw new FirstOutputCoinsMissed(firstOutputCoins + surplus);
+		previousTarget = targetValue.coins;
+		return {
+			selection: [...preSelectedUtxo],
+			remaining: [],
+			changeOutputs: []
+		};
+	} };
+};
+/**
+* Builds and balances one plan with the shared `TransactionBuilder`. Every
+* input is preselected, so balancing never adds an input without its
+* redeemer; the collateral is the sponsor's shared UTxO, returned to the
+* sponsor with total collateral set.
+*
+* @throws `FundShortfall` when the inputs cannot pay for the transaction
+* @throws `EvaluatedFeeShortfallError` when the scripts measure above `seed`
+*   by more than the balanced fee covers
+*/
+const buildPlan = async (plan, chain, { evaluator, coinSelector, seed }) => {
+	const parameters = chain.protocolParameters;
+	const referenceInputs = plan.referenceInputs ?? [];
+	const builder = new TransactionBuilder(chain.chainId.networkMagic, parameters).setChangeAddress(plan.changeAddress).useCoinSelector(coinSelector).setCollateralUtxos([plan.collateral.utxo]).setCollateralChangeAddress(plan.collateral.returnAddress).setPlutusContext({
+		costModels: parameters.costModels,
+		txEvaluator: evaluator,
+		inputResolver: createInputResolver([...plan.inputs.map(({ utxo }) => utxo), plan.collateral.utxo]),
+		executionUnitsEstimate: seed
+	}).setValidityInterval({
+		...plan.invalidBefore !== void 0 && { invalidBefore: plan.invalidBefore },
+		invalidHereafter: plan.invalidHereafter
+	}).addRequiredSigner(plan.requiredSigner);
+	for (const { utxo, redeemer } of plan.inputs) builder.addInput(utxo, redeemer ? { redeemer } : void 0);
+	for (const utxo of referenceInputs) builder.addReferenceInput(utxo);
+	for (const output of plan.outputs) builder.addOutput(output);
+	for (const script of plan.scripts) builder.attachScript(script);
+	if (plan.mint) builder.mintAssets(plan.mint.assets, plan.mint.redeemer);
+	if (plan.registration) {
+		const { stakeCredential, deposit, redeemer } = plan.registration;
+		builder.addNewStakeAddressCertificate(stakeCredential, deposit, { redeemer });
+	}
+	if (plan.delegation) {
+		const { poolId, stakeCredential, redeemer } = plan.delegation;
+		builder.addStakeDelegationCertificate(poolId, stakeCredential, { redeemer });
+	}
+	for (const { rewardAccount, quantity, redeemer } of plan.withdrawals ?? []) builder.addScriptWithdrawal(rewardAccount, quantity, redeemer);
+	for (const [label, metadatum] of plan.metadata ?? []) builder.setMetadata(label, metadatum);
+	try {
+		return await builder.build();
+	} catch (error) {
+		if (error instanceof InputSelectionError) throw new FundShortfall(error.message);
+		if (error instanceof InsufficientCollateralError) return failCustodyBuild({
+			code: "collateral-insufficient",
+			message: error.message
+		});
+		throw error;
+	}
+};
+/**
+* Rounds of a plan whose first output pays the fee. The first round finds
+* the fee the builder settles on, the second lands on it; a third covers a
+* coin that crossed a CBOR width between them.
+*/
+const MAX_FIRST_OUTPUT_ROUNDS = 3;
+/**
+* Builds a plan whose first output pays the fee. The builder balances at a
+* fee priced for the seed execution units, so the first output is set to
+* what the inputs hold beyond that fee and the other outputs; once
+* evaluation lowers the fee, the builder refunds the saving to it, the
+* largest output at the change address.
+*
+* @throws `FundShortfall` when the inputs cannot pay the fee the builder
+*   balances at
+*/
+const buildFeePaidByFirstOutput = async (plan, chain, { evaluator, seed }) => {
+	const [first, ...rest] = plan.outputs;
+	let coins = first.value.coins;
+	for (let round = 1;; round++) try {
+		return await buildPlan({
+			...plan,
+			outputs: [withCoins(first, coins), ...rest]
+		}, chain, {
+			evaluator,
+			coinSelector: firstOutputPaysSelector(coins),
+			seed
+		});
+	} catch (error) {
+		if (!(error instanceof FirstOutputCoinsMissed) || round >= MAX_FIRST_OUTPUT_ROUNDS) throw error;
+		if (error.coins < 0n) throw new FundShortfall("The first output cannot pay the fee the builder balances at");
+		coins = error.coins;
+	}
+};
+/** How many redeemers a plan's transaction carries. */
+const redeemerCountOf = (plan) => plan.inputs.filter(({ redeemer }) => redeemer !== void 0).length + [
+	plan.mint,
+	plan.registration,
+	plan.delegation
+].filter((part) => part !== void 0).length + (plan.withdrawals?.length ?? 0);
+/**
+* Builds a plan, adding the next fund UTxO each time the selected ones
+* cannot pay for it. Once none is left, it refuses with the shortfall's
+* reason, `insufficient-funds` by default. Planned outputs keep their
+* lovelace unless the first output pays the fee.
+*
+* With `maxBalancedFee`, a draft balanced above it gets a seed priced at
+* that much less, and an evaluated transaction that needs more than its
+* draft's fee gets a seed priced at what it needs, while that fits.
+*
+* @throws `ExecutionEstimateShortfall` when the scripts measure above the
+*   seed by more than the balanced fee covers
+* @throws `MaxBalancedFeeExceeded` when the transaction needs a fee above
+*   `maxBalancedFee`
+*/
+const assembleWithFunds = async ({ chain, funds, plan, evaluator, reseed, checkFunds, settle, maxBalancedFee }) => {
+	const parameters = chain.protocolParameters;
+	let { selected, remaining } = funds;
+	let seedFeeLimit;
+	let draftFeeRounds = 0;
+	for (;;) {
+		checkFunds?.(selected);
+		const planned = plan(selected);
+		const fullSeed = reseed ? reseededExecutionUnits(reseed, redeemerCountOf(planned)) : estimateWithinLimit(planned.executionEstimate, parameters.maxExecutionUnitsPerTransaction);
+		const seed = seedFeeLimit === void 0 ? fullSeed : seedPricedAt(fullSeed, seedFeeLimit, parameters);
+		const planEvaluator = maxBalancedFee === void 0 ? evaluator(selected) : withMaxDraftFee(evaluator(selected), maxBalancedFee);
+		try {
+			const built = planned.isFeePaidByFirstOutput ? await buildFeePaidByFirstOutput(planned, chain, {
+				evaluator: planEvaluator,
+				seed
+			}) : restorePlannedOutputs(await buildPlan(planned, chain, {
+				evaluator: planEvaluator,
+				coinSelector: new LargeFirstCoinSelector(),
+				seed
+			}), planned, parameters);
+			return {
+				transaction: settle ? settle(built) : built,
+				funds: {
+					selected,
+					remaining
+				}
+			};
+		} catch (error) {
+			if (error instanceof DraftFeeAboveMax && maxBalancedFee !== void 0) {
+				const seedFee = executionFeeOf(seed, parameters);
+				const limit = seedFee - (error.fee - maxBalancedFee);
+				if (limit < 0n) throw new MaxBalancedFeeExceeded(error.fee - seedFee);
+				if (++draftFeeRounds > MAX_DRAFT_FEE_ROUNDS) throw new MaxBalancedFeeExceeded(error.fee);
+				seedFeeLimit = limit;
+				continue;
+			}
+			if (error instanceof EvaluatedFeeShortfallError) {
+				if (maxBalancedFee !== void 0 && error.requiredFee > maxBalancedFee) throw new MaxBalancedFeeExceeded(error.requiredFee, error.evaluatedRedeemers);
+				if (seedFeeLimit !== void 0 && ++draftFeeRounds <= MAX_DRAFT_FEE_ROUNDS) {
+					seedFeeLimit = executionFeeOf(seed, parameters) + error.requiredFee - error.balancedFee;
+					continue;
+				}
+				throw new ExecutionEstimateShortfall(custodyReseedOf(error.evaluatedRedeemers.map(({ executionUnits }) => executionUnits), seed));
+			}
+			if (!(error instanceof FundShortfall)) throw error;
+			if (remaining.length === 0) return failCustodyBuild(error.exhausted ?? {
+				code: "insufficient-funds",
+				message: error.message
+			});
+			selected = [...selected, remaining[0]];
+			remaining = remaining.slice(1);
+		}
+	}
+};
+const EVALUATION_MARGIN_PERCENT = 10n;
+/**
+* Pads a measured budget. The fee correction after evaluation changes the
+* body the scripts see, so the final transaction is not the one measured.
+*/
+const withEvaluationMargin = ({ memory, steps }) => ({
+	memory: Number((BigInt(memory) * (100n + EVALUATION_MARGIN_PERCENT) + 99n) / 100n),
+	steps: Number((BigInt(steps) * (100n + EVALUATION_MARGIN_PERCENT) + 99n) / 100n)
+});
+const atLeast = (budget, floor) => floor ? {
+	memory: Math.max(budget.memory, floor.memory),
+	steps: Math.max(budget.steps, floor.steps)
+} : budget;
+const redeemerKey = ({ purpose, index }) => `${purpose}:${index}`;
+/** A redeemer the provider did not evaluate fails, as it does for the sponsor service. */
+const unmeasured = ({ purpose, index }) => failCustodyBuild({
+	code: "script-evaluation-failed",
+	message: `The provider did not evaluate redeemer ${purpose}#${index}`
+});
+/**
+* Every redeemer whose declared budget is below what the provider measures,
+* with the measurement.
+*/
+const findUnderDeclaredBudgets = (transaction, measured) => {
+	return (transaction.witnessSet().redeemers()?.toCore() ?? []).flatMap(({ purpose, index, executionUnits }) => {
+		const measurement = measured.find((entry) => entry.purpose === purpose && entry.index === index) ?? unmeasured({
+			purpose,
+			index
+		});
+		return measurement.budget.memory > executionUnits.memory || measurement.budget.steps > executionUnits.steps ? [measurement] : [];
+	});
+};
+/**
+* The outputs a transaction's inputs, reference inputs and collateral
+* resolve to, in that order, from the UTxOs the build chose them from.
+*/
+const resolvedInputsOf = (transaction, candidates) => {
+	const body = transaction.body().toCore();
+	const byOutpoint = new Map(candidates.map((utxo) => [outpointKey$1(utxo[0]), utxo]));
+	return [
+		...body.inputs,
+		...body.referenceInputs ?? [],
+		...body.collaterals ?? []
+	].map((input) => byOutpoint.get(outpointKey$1(input))).filter((utxo) => utxo !== void 0);
+};
+/** A lovelace amount whose CBOR width every change output reaches. */
+const CHANGE_COIN_WIDTH_PROBE = 1000000n;
+/** The minimum ADA of a lovelace-only change output at an address. */
+const changeReserveAt = (address, coinsPerUtxoByte) => minAdaRequired({
+	address,
+	value: { coins: CHANGE_COIN_WIDTH_PROBE }
+}, BigInt(coinsPerUtxoByte));
+const scriptCredentialOf = (hash) => ({
+	type: Cardano.CredentialType.ScriptHash,
+	hash
+});
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-chain.ts
+/**
+* The slot clock of the era history. A time or slot before the first era
+* is read in the first era: custody transactions only name slots near the
+* present.
+*/
+const createSlotClock = (eraSummaries) => {
+	const eraOf = (isStarted) => eraSummaries.filter(isStarted).at(-1) ?? eraSummaries[0];
+	return {
+		slotAt: (posixMs) => {
+			const era = eraOf(({ start }) => start.time.getTime() <= posixMs);
+			return Cardano.Slot(era.start.slot + Math.floor((posixMs - era.start.time.getTime()) / era.parameters.slotLength));
+		},
+		slotStart: (slot) => {
+			const era = eraOf(({ start }) => start.slot <= slot);
+			return era.start.time.getTime() + (slot - era.start.slot) * era.parameters.slotLength;
+		}
+	};
+};
+/**
+* One provider read, retried while transient. A failure stops the build as
+* `unavailable`, since nothing about the custody account is known yet.
+*/
+const readFromProvider = async (what, request) => {
+	try {
+		return await firstValueFrom(unwrapProviderResult(request));
+	} catch (error) {
+		return failCustodyBuild({
+			code: "unavailable",
+			message: `${what}: ${messageOf(error)}`
+		});
+	}
+};
+const loadCustodyChain = async ({ chainId, eraSummaries, provider, now }) => {
+	if (!chainId) return failCustodyBuild({
+		code: "unavailable",
+		message: "Cardano chain id not available"
+	});
+	if (!eraSummaries || eraSummaries.length === 0) return failCustodyBuild({
+		code: "unavailable",
+		message: "Cardano era summaries not available"
+	});
+	return {
+		chainId,
+		protocolParameters: await readFromProvider("Cardano protocol parameters", () => provider.getProtocolParameters({ chainId })),
+		clock: createSlotClock(eraSummaries),
+		now,
+		provider
+	};
+};
+/**
+* What the provider measures every redeemer of a transaction at. There is
+* no fallback budget: a script that fails is a build that fails, with the
+* provider's message. A transient failure, such as a rate limit or a
+* dropped connection, is retried like every other read and then reported
+* as `unavailable`, since it says nothing about the scripts.
+*/
+const evaluateCustodyTransaction = async (transaction, { provider, chainId }) => {
+	const tx = transaction.toCbor();
+	try {
+		return await firstValueFrom(unwrapProviderResult(() => provider.evaluateTx({ tx }, { chainId })));
+	} catch (error) {
+		return failCustodyBuild(isRetriableError(error) ? {
+			code: "unavailable",
+			message: `Transaction evaluation: ${messageOf(error)}`
+		} : {
+			code: "script-evaluation-failed",
+			message: messageOf(error)
+		});
+	}
+};
+/**
+* The first slot that starts strictly after `posixMs`. A sweep of a grant
+* dead by expiry alone sets it as the lower validity bound, because the
+* validator needs the start of that bound to be after the expiry.
+*/
+const firstSlotStartingAfter = (posixMs, { clock }) => Cardano.Slot(clock.slotAt(Number(posixMs)) + 1);
+/**
+* The upper validity bound a funding window allows: the slot holding
+* `validUntil`, which starts no later than it. The window must leave a slot
+* after the current one.
+*/
+const validitySlotFor = (validUntil, { clock, now }) => {
+	const slot = Number.isFinite(validUntil) ? clock.slotAt(validUntil) : 0;
+	return slot > clock.slotAt(now) ? Cardano.Slot(slot) : failCustodyBuild({
+		code: "validity-window",
+		validUntil
+	});
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-creator-index.ts
+/**
+* Reads what the chain holds at one creator index of one contract version:
+* whether the stake credential of the creator key is registered and, when
+* it is, whether the account address holds the state NFT. A registered
+* credential without the NFT was registered by someone else first, which
+* blocks creation at that index forever.
+*/
+const readCustodyCreatorIndex = async ({ contractVersion, deviceAccountPublicKey, creatorIndex }, chain) => {
+	const key = await deriveCustodyDeviceKey(deviceAccountPublicKey, creatorIndex);
+	if (!key.ok) return failCustodyBuild({
+		code: "invalid-operation",
+		reason: "invalid-device-key",
+		message: `Cannot derive custody device key ${creatorIndex}: ${key.error.code}`
+	});
+	const identity = deriveCustodyAccountIdentity({
+		contractVersion,
+		creatorKeyHash: key.value.keyHash,
+		chainId: chain.chainId
+	});
+	if (!identity.ok) return failCustodyBuild({
+		code: "unavailable",
+		message: `Cannot derive a custody account on this chain: ${identity.error.code}`
+	});
+	const { rewardAccount, address, stateNftAssetId } = identity.value;
+	const { isRegistered } = await readFromProvider("Custody reward account", () => chain.provider.getRewardAccountInfo({ rewardAccount: CardanoRewardAccount(rewardAccount) }, { chainId: chain.chainId }));
+	if (!isRegistered) return {
+		status: "unregistered",
+		key: key.value,
+		identity: identity.value
+	};
+	return (await readFromProvider("Custody account UTxOs", () => chain.provider.getUtxosAtAddress({ address: CardanoPaymentAddress(address) }, { chainId: chain.chainId }))).some(([, output]) => output.value.assets?.has(stateNftAssetId)) ? {
+		status: "account",
+		record: createCustodyAccountRecord(identity.value)
+	} : { status: "pre-registered" };
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-evaluation.ts
+/** Rebuilds allowed after the final transaction measures above its budgets. */
+const MAX_EVALUATION_ROUNDS = 3;
+/**
+* Prices every redeemer at what the provider measures on the draft, with a
+* margin, and at least at a floor an earlier round measured on final bytes.
+*/
+const createProviderEvaluator = (chain, floors) => ({ evaluate: async (tx) => {
+	const measured = await evaluateCustodyTransaction(Serialization.Transaction.fromCore(tx), chain);
+	return (tx.witness.redeemers ?? []).map(({ purpose, index }) => {
+		const measurement = measured.find((entry) => entry.purpose === purpose && entry.index === index);
+		if (!measurement) return unmeasured({
+			purpose,
+			index
+		});
+		return {
+			purpose,
+			index,
+			budget: atLeast(withEvaluationMargin(measurement.budget), floors.get(redeemerKey({
+				purpose,
+				index
+			})))
+		};
+	});
+} });
+/**
+* Builds a transaction whose budgets come from provider evaluation, then
+* evaluates the final bytes. Every redeemer must declare at least what the
+* final transaction measures, which is what the sponsor service checks
+* before it signs; a shortfall raises the budget and rebuilds.
+*
+* Balancing prices the fee at the plan's execution estimate, so the funds,
+* or the control output that pays, need to cover little more than the real
+* fee. When the scripts measure above the estimate by more than the
+* balanced fee covers, the plan is built once more, seeded at the
+* measurement plus a margin: a second selection round, which may add fund
+* UTxOs.
+*
+* @throws `MaxBalancedFeeExceeded` when `maxBalancedFee` is set and the
+*   transaction needs a fee above it
+*/
+const buildWithEvaluatedBudgets = async (params) => {
+	let floors = /* @__PURE__ */ new Map();
+	let funds = params.funds;
+	let reseed;
+	for (let round = 1;;) {
+		let built;
+		try {
+			built = await assembleWithFunds({
+				...params,
+				funds,
+				reseed,
+				evaluator: () => createProviderEvaluator(params.chain, floors)
+			});
+		} catch (error) {
+			if (!(error instanceof ExecutionEstimateShortfall)) throw error;
+			if (reseed) return failCustodyBuild({
+				code: "script-evaluation-failed",
+				message: "The scripts measure above the execution estimate after a reseed"
+			});
+			reseed = error.reseed;
+			continue;
+		}
+		funds = built.funds;
+		const underDeclared = findUnderDeclaredBudgets(built.transaction, await evaluateCustodyTransaction(built.transaction, params.chain));
+		if (underDeclared.length === 0) return built.transaction;
+		if (round >= MAX_EVALUATION_ROUNDS) return failCustodyBuild({
+			code: "script-evaluation-failed",
+			message: `Declared budgets stay below the measured ones after ${round} rounds`
+		});
+		round++;
+		floors = new Map([...floors, ...underDeclared.map((entry) => [redeemerKey(entry), withEvaluationMargin(entry.budget)])]);
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-scripts.ts
+const scriptHashOf = (script) => Serialization.Script.fromCore(script).hash();
+/**
+* The catalogue pins each parked UTxO's address and lovelace with its
+* outref, so the builder prices its script without a chain lookup; the
+* provider's evaluation of every build resolves the outref on chain, so a
+* UTxO the chain no longer holds fails the build before anyone signs.
+*/
+const custodyScriptWitnesses = (version, { chainId }, scripts) => {
+	const parked = new Map(custodyReferenceScriptUtxos(version, chainId.networkMagic).map((utxo) => [scriptHashOf(utxo[1].scriptReference), utxo]));
+	const attached = [];
+	const referenced = [];
+	for (const script of scripts) {
+		const reference = parked.get(scriptHashOf(script));
+		if (reference) referenced.push(reference);
+		else attached.push(script);
+	}
+	return {
+		attached,
+		referenced
+	};
+};
+const LOGIC_RUN_REDEEMER = encodeCustodyLogicRedeemer();
+/**
+* Reads the logic's reward account once per transaction, so every build
+* round of it draws the same amount. A credential that is not registered
+* fails the build as `logic-not-registered`: the ledger would refuse the
+* withdrawal only at submission, after the sponsor and the device signed.
+* Registration is read, not delegation: the logic delegates to no pool.
+*/
+const readCustodyLogicRun = async (logic, { chainId, provider }) => {
+	const rewardAccount = Cardano.RewardAccount.fromCredential({
+		type: Cardano.CredentialType.ScriptHash,
+		hash: logic.hash
+	}, chainId.networkId);
+	const { isRegistered, withdrawableAmount } = await readFromProvider("Custody logic reward account", () => provider.getRewardAccountInfo({ rewardAccount: CardanoRewardAccount(rewardAccount) }, { chainId }));
+	if (!isRegistered) return failCustodyBuild({
+		code: "logic-not-registered",
+		rewardAccount
+	});
+	return {
+		logic,
+		withdrawal: {
+			rewardAccount,
+			quantity: BigNumber.valueOf(withdrawableAmount),
+			redeemer: LOGIC_RUN_REDEEMER
+		}
+	};
+};
+/**
+* The logic the account's control datum names. Lace operates no account
+* under a logic outside its contract version's catalogue, whose rules it
+* has not reviewed.
+*/
+const accountLogicOf = ({ identity, state }) => {
+	const logic = findCustodyLogic(identity.contractVersion, state.logic);
+	return logic.ok ? logic.value : failCustodyBuild({
+		code: "account-not-live",
+		status: "invalid"
+	});
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-validation.ts
+const cborOf$1 = (data) => Serialization.PlutusData.fromCore(data).toCbor();
+/**
+* What the sponsor service checks the transaction against, from the funding
+* it leased, the contract version of the account the transaction operates
+* and the chain.
+*/
+const sponsorRuleContextOf = (funding, contractVersion, { chainId, clock, now, protocolParameters }) => ({
+	mode: funding.mode === "fee" ? {
+		kind: "fee",
+		feeUtxo: funding.feeUtxo,
+		maxSponsoredLovelace: funding.maxSponsoredLovelace
+	} : { kind: "collateral" },
+	sponsorAddress: funding.sponsorAddress,
+	collateralUtxo: funding.collateralUtxo,
+	contractVersion,
+	networkMagic: chainId.networkMagic,
+	latestValiditySlot: clock.slotAt(funding.validUntil),
+	currentSlot: clock.slotAt(now),
+	collateralPercentage: protocolParameters.collateralPercentage,
+	costModels: protocolParameters.costModels
+});
+/**
+* The largest fee the sponsor's shared collateral UTxO covers, or undefined
+* without a collateral percentage. The ledger needs collateral of the fee
+* times the percentage, and the sponsor needs the rest of the UTxO back in
+* a return output that holds its minimum ADA. For the service's 5 ADA UTxO,
+* a percentage of 150 and a base return address on Preprod, that is
+* 2,686,833 lovelace, below the 3,333,333 the UTxO covers without a return.
+*/
+const collateralFeeCeilingOf = ({ collateralUtxo: [, collateral], sponsorAddress }, { collateralPercentage, coinsPerUtxoByte }) => {
+	if (collateralPercentage <= 0) return void 0;
+	const returned = minAdaRequired({
+		address: sponsorAddress,
+		value: { coins: collateral.value.coins }
+	}, BigInt(coinsPerUtxoByte));
+	const available = collateral.value.coins - returned;
+	return available > 0n ? available * 100n / BigInt(collateralPercentage) : 0n;
+};
+const unexpected = (what) => failCustodyBuild({
+	code: "build-failed",
+	message: `The built transaction ${what}`
+});
+const isSameGrant = (a, b) => cborOf$1(encodeCustodyGrant(a)) === cborOf$1(encodeCustodyGrant(b));
+/** Checks the control output and the grant UTxOs the transaction writes. */
+const checkAccountOutputs = ({ controlOutput, issuedGrants, sweptGrants, grantSpend }, expectation) => {
+	const { control } = expectation;
+	if (!control) {
+		if (controlOutput) unexpected("rewrites the control state");
+	} else if (!controlOutput || cborOf$1(encodeCustodyAccountState(controlOutput.state)) !== cborOf$1(encodeCustodyAccountState(control.state))) unexpected("does not carry the intended account state");
+	else if (controlOutput.lovelace !== control.lovelace) unexpected("does not lock the intended control lovelace");
+	const planned = expectation.issuedGrants ?? [];
+	if (!(issuedGrants.length === planned.length && issuedGrants.every(({ grant, lovelace }, index) => isSameGrant(grant, planned[index].grant) && lovelace === planned[index].lovelace))) unexpected("does not issue the intended grants");
+	const plannedSwept = new Set(expectation.sweptSlots ?? []);
+	if (!(sweptGrants.length === plannedSwept.size && sweptGrants.every(({ grant }) => plannedSwept.has(grant.slot)))) unexpected("does not sweep the intended grants");
+	const plannedSpend = expectation.grantSpend;
+	if (!(!plannedSpend || grantSpend?.grant.slot === plannedSpend.slot && isSameGrant(grantSpend.after, plannedSpend.after))) unexpected("does not spend the intended grant");
+};
+/** Checks the value leaving the account, its own tokens aside. */
+const checkOutflow = ({ netOutflow }, fee, expectation) => {
+	if (!expectation.outflow) return;
+	const { requested, withdrawal } = expectation.outflow;
+	const assets = requested.assets ?? /* @__PURE__ */ new Map();
+	const accountPolicy = expectation.record.accountValidatorHash;
+	const leaving = [...netOutflow.assets].filter(([assetId]) => Cardano.AssetId.getPolicyId(assetId) !== accountPolicy);
+	if (!(netOutflow.lovelace === requested.coins + fee - withdrawal && leaving.length === assets.size && [...assets].every(([assetId, quantity]) => netOutflow.assets.get(assetId.toLowerCase()) === quantity))) unexpected("pays out more than requested");
+};
+/**
+* Checks the final, balanced transaction before anyone is asked to sign it:
+* the shared custody inspection (the hosted signer's consent rules), the
+* intended control output, issued grants, sweeps and grant spend, the
+* account's net
+* outflow, the signer, the fee the sponsor's collateral covers, the fee
+* sponsor service's policy and the protocol limits. Any failure refuses
+* the build.
+*
+* `resolvedInputs` resolves every input, reference input and collateral
+* input.
+*/
+const finalizeCustodyBuild = ({ transaction, resolvedInputs }, chain, expectation) => {
+	const inspection = inspectCustodyTransaction(transaction, resolvedInputs, {
+		chainId: chain.chainId,
+		now: chain.now,
+		slotToPosixMs: chain.clock.slotStart,
+		accountRecord: expectation.record,
+		allowGrantSpend: expectation.grantSpend !== void 0,
+		...expectation.deviceKeyHash && { deviceKeyHash: expectation.deviceKeyHash }
+	});
+	if (!inspection.ok) return failCustodyBuild({
+		code: "inspection-refused",
+		refusals: [...inspection.error.refusals]
+	});
+	const { accounts, requiredSigners, fee, validity } = inspection.value;
+	const [account] = accounts;
+	checkAccountOutputs(account, expectation);
+	checkOutflow(account, fee, expectation);
+	if (requiredSigners.length !== 1 || requiredSigners[0] !== expectation.signer) return unexpected("does not name exactly the intended signer");
+	const { funding } = expectation;
+	const maxFee = funding.mode === "collateral" ? collateralFeeCeilingOf(funding, chain.protocolParameters) : void 0;
+	if (maxFee !== void 0 && fee > maxFee) return failCustodyBuild({
+		code: "collateral-fee-ceiling",
+		fee,
+		maxFee
+	});
+	const sponsorViolations = findCustodySponsorRuleViolations(transaction, resolvedInputs, sponsorRuleContextOf(funding, account.contractVersion, chain));
+	if (sponsorViolations.length > 0) return failCustodyBuild({
+		code: "sponsor-rules",
+		violations: sponsorViolations
+	});
+	try {
+		assertWithinTransactionLimits(transaction, resolvedInputs, chain.protocolParameters);
+	} catch (error) {
+		if (!(error instanceof TransactionLimitsExceededError)) throw error;
+		return failCustodyBuild({
+			code: "transaction-limits",
+			usage: error.usage,
+			exceeded: error.exceeded
+		});
+	}
+	return {
+		transaction: transaction.toCbor(),
+		bodyHash: transaction.getId(),
+		resolvedInputs,
+		accountRecord: expectation.record,
+		fee,
+		invalidHereafter: validity.invalidHereafter.slot
+	};
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/create-custody-account.ts
+/**
+* Lovelace a creation leaves unused below the sponsor's per-transaction
+* limit. It absorbs a fee that comes out slightly higher on the round that
+* settles the control lovelace, so that round still fits the limit.
+*/
+const CUSTODY_CREATION_SPONSOR_MARGIN = 100000n;
+/**
+* Builds of one creation before the control lovelace settles. The first
+* build prices the largest fee its execution estimate allows, so it fits
+* any fee within that estimate; the second claims the headroom the real fee
+* leaves; the third covers a fee that then moved by more than the margin.
+*/
+const MAX_HEADROOM_ROUNDS = 3;
+/**
+* The first creator index from `startIndex` whose stake credential is not
+* registered. A registered credential whose address holds the state NFT is
+* an existing account the caller should reopen; one without it was
+* registered by someone else first, which blocks creation there forever,
+* so the scan moves past it.
+*/
+const findCreatorIndex = async ({ deviceAccountPublicKey, startIndex = 0 }, chain) => {
+	for (let index = startIndex; index < startIndex + 100; index++) {
+		const found = await readCustodyCreatorIndex({
+			contractVersion: CURRENT_CUSTODY_CONTRACT_VERSION,
+			deviceAccountPublicKey,
+			creatorIndex: index
+		}, chain);
+		if (found.status === "unregistered") return {
+			index,
+			key: found.key,
+			identity: found.identity
+		};
+		if (found.status === "account") return failCustodyBuild({
+			code: "account-exists",
+			creatorIndex: index,
+			record: found.record
+		});
+	}
+	return failCustodyBuild({
+		code: "index-exhausted",
+		startIndex,
+		scanned: 100
+	});
+};
+const smaller = (a, b) => a < b ? a : b;
+/**
+* The control lovelace a creation aims for once its fee is known: what the
+* sponsor's limit leaves after the fee, the stake deposit and the margin,
+* within what the fee UTxO can fund, but never less than the initial
+* state's minimum.
+*/
+const headroomControlLovelace = ({ maxSponsoredLovelace, deposit, fundable, minimum }, fee) => {
+	const target = smaller(maxSponsoredLovelace - deposit - fee - CUSTODY_CREATION_SPONSOR_MARGIN, fundable);
+	return target > minimum ? target : minimum;
+};
+/**
+* Builds the creation of a custody account in the sponsor's fee mode: the
+* leased fee UTxO pays the fee, the stake deposit and the control output,
+* and its change returns to the sponsor in one output. The state NFT is
+* minted with `CreateAccount`, the stake credential is registered in the
+* same transaction with a Conway registration certificate, which carries
+* the `Operate` witness the mint looks for, and the logic the state names
+* runs through its withdrawal, which validates the new state. The creator
+* key is the only device and the only required signer, and the state
+* starts under the current logic at generation 0 with no slot issued, none
+* revoked and none outstanding.
+*
+* The proxy and the logic are read from their parked UTxOs on a network
+* that has them, and attached elsewhere; the stake script, applied to the
+* creator key, is always attached. Whatever the logic run draws joins the
+* control output, so the sponsor pays the same.
+*/
+const buildCustodyCreation = async (operation, funding, chain) => {
+	const startIndex = operation.startIndex ?? 0;
+	if (!Number.isSafeInteger(startIndex) || startIndex < 0 || startIndex + 100 > 2147483648) return failCustodyBuild({
+		code: "invalid-operation",
+		reason: "invalid-start-index",
+		message: `Invalid creator start index ${startIndex}`
+	});
+	const contractVersion = CURRENT_CUSTODY_CONTRACT_VERSION;
+	const currentLogic = findCustodyLogic(contractVersion, contractVersion.currentLogicHash);
+	if (!currentLogic.ok) throw new Error(`The contract version has no logic ${contractVersion.currentLogicHash}`);
+	const logicRun = await readCustodyLogicRun(currentLogic.value, chain);
+	const { index, key, identity } = await findCreatorIndex(operation, chain);
+	const { protocolParameters: parameters } = chain;
+	const state = transitioned(createInitialCustodyAccountState(key.keyHash, logicRun.logic.hash));
+	const witnesses = custodyScriptWitnesses(contractVersion, chain, [contractVersion.accountValidator, logicRun.logic.script]);
+	const drawn = logicRun.withdrawal.quantity;
+	const deposit = BigInt(parameters.stakeKeyDeposit);
+	const invalidHereafter = validitySlotFor(funding.validUntil, chain);
+	const executionEstimate = custodyExecutionEstimate({
+		createAccount: 1,
+		operate: 1,
+		logic: "arrival"
+	});
+	const largestFee = preEvaluationFeeBound(parameters, estimateWithinLimit(executionEstimate, parameters.maxExecutionUnitsPerTransaction));
+	const bounds = {
+		maxSponsoredLovelace: funding.maxSponsoredLovelace,
+		deposit,
+		fundable: funding.feeUtxo[1].value.coins - changeReserveAt(funding.sponsorAddress, parameters.coinsPerUtxoByte) - deposit - largestFee,
+		minimum: controlLovelaceFor({
+			identity,
+			state,
+			floor: 0n
+		}, parameters.coinsPerUtxoByte)
+	};
+	const buildWith = async (controlLovelace) => buildWithEvaluatedBudgets({
+		chain,
+		funds: {
+			selected: [],
+			remaining: []
+		},
+		plan: () => ({
+			inputs: [{ utxo: funding.feeUtxo }],
+			referenceInputs: witnesses.referenced,
+			outputs: [controlOutputOf(identity, state, controlLovelace + drawn)],
+			changeAddress: funding.sponsorAddress,
+			scripts: [...witnesses.attached, identity.stakeScript],
+			executionEstimate,
+			requiredSigner: key.keyHash,
+			invalidHereafter,
+			collateral: {
+				utxo: funding.collateralUtxo,
+				returnAddress: funding.sponsorAddress
+			},
+			mint: {
+				assets: new Map([[identity.stateNftAssetId, 1n]]),
+				redeemer: encodeCustodyMintRedeemer({ kind: "createAccount" })
+			},
+			registration: {
+				stakeCredential: scriptCredentialOf(identity.stakeScriptHash),
+				deposit,
+				redeemer: encodeCustodyStakeRedeemer()
+			},
+			withdrawals: [logicRun.withdrawal]
+		})
+	});
+	let controlLovelace = headroomControlLovelace(bounds, largestFee);
+	let transaction;
+	for (let round = 1;; round++) {
+		transaction = await buildWith(controlLovelace);
+		const fee = transaction.body().fee();
+		const sponsoredLovelace = fee + deposit + controlLovelace;
+		const isWithinLimit = sponsoredLovelace <= funding.maxSponsoredLovelace;
+		const settled = headroomControlLovelace(bounds, fee);
+		const isLastRound = round >= MAX_HEADROOM_ROUNDS || settled === controlLovelace;
+		if (isWithinLimit && (settled < controlLovelace || isLastRound)) break;
+		if (!isWithinLimit && isLastRound) return failCustodyBuild({
+			code: "sponsor-limit",
+			sponsoredLovelace,
+			maxSponsoredLovelace: funding.maxSponsoredLovelace
+		});
+		controlLovelace = settled;
+	}
+	const record = createCustodyAccountRecord(identity);
+	return {
+		...finalizeCustodyBuild({
+			transaction,
+			resolvedInputs: resolvedInputsOf(transaction, [
+				funding.feeUtxo,
+				...witnesses.referenced,
+				funding.collateralUtxo
+			])
+		}, chain, {
+			record,
+			control: {
+				state,
+				lovelace: controlLovelace + drawn
+			},
+			signer: key.keyHash,
+			deviceKeyHash: key.keyHash,
+			funding
+		}),
+		creation: {
+			creatorIndex: index,
+			identity: {
+				chainId: chain.chainId,
+				accountValidatorHash: contractVersion.accountValidatorHash,
+				creatorKeyHash: identity.creatorKeyHash,
+				stakeScriptHash: identity.stakeScriptHash,
+				address: identity.address,
+				rewardAccount: identity.rewardAccount
+			}
+		}
+	};
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-account.ts
+/** Every UTxO the classification of a live account holds. */
+const utxosOf = (state) => [
+	state.controlUtxo,
+	...state.funds,
+	...state.reserves.own,
+	...state.reserves.foreign,
+	...state.grants.map(({ utxo }) => utxo),
+	...state.stranded,
+	...state.anomalies.map(({ utxo }) => utxo)
+];
+/**
+* Resolves the account an operation runs on. The synced view must show it
+* live with a confirmed control UTxO, and the chain, read again now, must
+* hold that same control UTxO. Funds, reserves and grants come from that
+* fresh read, so a UTxO already spent on chain or still unconfirmed is never
+* selected; funds and reserves an unsettled transaction of this wallet
+* spends are left out too, so concurrent builds pick disjoint ones.
+*
+* Owner operations are never chained: while the synced control UTxO is the
+* output of a submitted transaction that has not settled, the build is
+* refused.
+*/
+const resolveCustodyAccount = async (accountId, snapshot, chain) => {
+	const { account, accountState, settledUtxos } = snapshot;
+	if (!account || account.blockchainSpecific.chainId.networkMagic !== chain.chainId.networkMagic) return failCustodyBuild({ code: "unknown-account" });
+	const identity = verifyCardanoCustodyAccountIdentity(account.blockchainSpecific);
+	if (!identity.ok) return failCustodyBuild({ code: "unknown-account" });
+	if (accountState?.status !== "live") return failCustodyBuild({
+		code: "account-not-live",
+		status: accountState?.status ?? "unsynced"
+	});
+	const controlKey = utxoKey(accountState.controlUtxo);
+	if (!settledUtxos.some((utxo) => utxoKey(utxo) === controlKey)) return failCustodyBuild({ code: "operation-in-progress" });
+	const onChain = classifyCardanoCustodyAccount({
+		account: account.blockchainSpecific,
+		utxos: await readFromProvider("Custody account UTxOs", () => chain.provider.getUtxosAtAddress({
+			address: CardanoPaymentAddress(identity.value.address),
+			withReferenceScripts: true
+		}, { chainId: chain.chainId })),
+		withdrawableRewards: 0n,
+		protocolParameters: chain.protocolParameters
+	});
+	if (onChain.status !== "live" || utxoKey(onChain.controlUtxo) !== controlKey) return failCustodyBuild({ code: "stale-control" });
+	const inFlight = new Set(utxosOf(accountState).map(utxoKey));
+	const spentInFlight = new Set(settledUtxos.map(utxoKey).filter((key) => !inFlight.has(key)));
+	const isUnspent = (utxo) => !spentInFlight.has(utxoKey(utxo));
+	return {
+		accountId,
+		identity: identity.value,
+		record: createCustodyAccountRecord(identity.value),
+		device: account.blockchainSpecific.device,
+		control: onChain.controlUtxo,
+		state: onChain.state,
+		funds: onChain.funds.filter(isUnspent),
+		reserves: onChain.reserves.own.filter(isUnspent),
+		grants: onChain.grants,
+		spentInFlight
+	};
+};
+/**
+* The device key that signs an owner operation: the bound device, listed in
+* the current state. An observer holds no device and no owner authority.
+*/
+const requireListedDevice = ({ device, state }) => {
+	if (!device) return failCustodyBuild({ code: "observer-account" });
+	const keyHash = device.keyHash.toLowerCase();
+	return state.devices.some((listed) => listed.toLowerCase() === keyHash) ? device.keyHash : failCustodyBuild({
+		code: "device-not-listed",
+		keyHash: device.keyHash
+	});
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-requests.ts
+const outputProblem = (output, identity, coinsPerUtxoByte) => {
+	const address = Cardano.Address.fromString(output.address);
+	if (address?.getNetworkId() !== identity.chainId.networkId) return "is not an address on the account network";
+	if (address.getType() === Cardano.AddressType.Byron) return "is a Byron address, which a Plutus transaction cannot pay";
+	if (address.toBech32() === identity.address) return "pays the account itself";
+	const accountPolicy = identity.contractVersion.accountValidatorHash;
+	if ([...output.value.assets?.keys() ?? []].some((assetId) => Cardano.AssetId.getPolicyId(assetId) === accountPolicy)) return "carries a custody account token";
+	return output.value.coins < minAdaRequired(output, BigInt(coinsPerUtxoByte)) ? "holds less than its minimum ADA" : void 0;
+};
+/**
+* Checks the outputs an owner or a grantee asks the account to pay. Each
+* goes to a Shelley address on the account's network other than the
+* account itself, carries no token of a custody account and holds its
+* minimum ADA: the build never tops a requested amount up from account
+* funds.
+*/
+const checkRequestedOutputs = (outputs, identity, coinsPerUtxoByte) => {
+	for (const [outputIndex, output] of outputs.entries()) {
+		const problem = outputProblem(output, identity, coinsPerUtxoByte);
+		if (problem) failCustodyBuild({
+			code: "invalid-operation",
+			reason: "invalid-output",
+			message: `Output ${outputIndex} ${problem}`
+		});
+	}
+};
+const invalidMetadata = (message) => failCustodyBuild({
+	code: "invalid-operation",
+	reason: "invalid-metadata",
+	message
+});
+/** The largest metadata label the ledger encodes: a 64-bit unsigned integer. */
+const MAX_METADATA_LABEL = 2n ** 64n - 1n;
+/**
+* The metadata an owner asks the transaction to carry: a map of labels to
+* metadata the ledger accepts, which its serialization checks: text and
+* bytes hold at most 64 bytes each. An empty map carries nothing.
+*/
+const checkRequestedMetadata = (metadata) => {
+	if (metadata === void 0) return void 0;
+	if (!(metadata instanceof Map)) return invalidMetadata("The metadata must be a map of labels to metadata");
+	if (metadata.size === 0) return void 0;
+	for (const label of metadata.keys()) if (typeof label !== "bigint" || label < 0n || label > MAX_METADATA_LABEL) return invalidMetadata(`Metadata label ${String(label)} is not a 64-bit unsigned integer`);
+	try {
+		Serialization.AuxiliaryData.fromCore({ blob: metadata });
+	} catch (error) {
+		return invalidMetadata(`The metadata cannot be encoded: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return metadata;
+};
+const invalidScope = (message) => failCustodyBuild({
+	code: "invalid-operation",
+	reason: "grant-scope",
+	message
+});
+/**
+* The grant a scope request asks to issue in `slot`. The request goes
+* through the library's strict requested-scope parser, the one the signer
+* applies to `requestedScopes`, so Lace refuses a scope the signer would
+* refuse as malformed; its recipients, which must be on the account's
+* network, become Plutus addresses.
+*/
+const grantRequestOf = ({ scope: request, slot }, { chainId }, now) => {
+	let serialized;
+	try {
+		serialized = serializeCustodyRequestedGrantScope({
+			...request,
+			slot
+		});
+	} catch {
+		return invalidScope("scope: not a grant scope");
+	}
+	const parsed = parseCustodyRequestedGrantScope(serialized);
+	if (!parsed.ok) return invalidScope([parsed.error.field, parsed.error.reason].filter(Boolean).join(": "));
+	const { grantee, recipients, ...scope } = parsed.value;
+	return {
+		grantee,
+		now,
+		scope: {
+			asset: scope.asset,
+			perCallCap: scope.perCallCap,
+			cap: scope.cap,
+			lovelacePerCallCap: scope.lovelacePerCallCap,
+			lovelaceCap: scope.lovelaceCap,
+			expiresAt: scope.expiresAt,
+			recipients: recipients.map((text) => {
+				const address = Cardano.Address.fromBech32(text);
+				const recipient = custodyRecipientFromAddress(address);
+				return recipient.ok && address.getNetworkId() === chainId.networkId ? recipient.value : invalidScope(`recipients: ${text} is not on the account network`);
+			})
+		}
+	};
+};
+/** A bech32 stake pool id, refused as an invalid operation when malformed. */
+const poolIdOf = (poolId) => {
+	try {
+		return Cardano.PoolId(poolId);
+	} catch {
+		return failCustodyBuild({
+			code: "invalid-operation",
+			reason: "invalid-pool-id",
+			message: `Invalid stake pool id ${poolId}`
+		});
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-grant-spend.ts
+/**
+* The most fund UTxOs one grant spend spends, upstream's `MAX_FUND_INPUTS`.
+* Every input adds a proxy run that decodes the whole transaction, and the
+* logic checks each one: a spend over twelve deposits measured 4.28M
+* memory units on upstream's devnet, a quarter of Preprod's limit.
+*/
+const MAX_GRANT_SPEND_FUND_INPUTS = 12;
+/**
+* What the second build adds to the first build's fee when it lowers the
+* caps: room for a fee that moves when the caps' encoding or the measured
+* budgets change between the two builds.
+*/
+const GRANT_CAP_FEE_MARGIN = 10000n;
+const SPEND_WITH_GRANT_REDEEMER = encodeCustodyAccountRedeemer({ kind: "spendWithGrant" });
+const FUND_REDEEMER$1 = encodeCustodyAccountRedeemer({ kind: "fund" });
+const cborOf = (data) => Serialization.PlutusData.fromCore(data).toCbor();
+const FUND_REDEEMER_CBOR = cborOf(FUND_REDEEMER$1);
+const SPEND_WITH_GRANT_REDEEMER_CBOR = cborOf(SPEND_WITH_GRANT_REDEEMER);
+const deltaOf = (value, fee = 0n) => ({
+	lovelace: value.coins + fee,
+	assets: new Map([...value.assets].map(([assetId, quantity]) => [assetId.toLowerCase(), quantity]))
+});
+/**
+* Metadata is an owner's to attach: the operation type leaves it out, and a
+* caller that names it anyway is refused rather than built without it.
+*/
+const refuseMetadata = (operation) => {
+	if (operation.metadata !== void 0) failCustodyBuild({
+		code: "invalid-operation",
+		reason: "invalid-metadata",
+		message: "A grant spend carries no metadata"
+	});
+};
+/** The fee bound the operation names, or the default when it names none. */
+const feeBoundOf = ({ feeBound }) => {
+	if (feeBound === void 0) return CARDANO_CUSTODY_DEFAULT_GRANT_FEE_BOUND;
+	return typeof feeBound === "bigint" && feeBound > 0n ? feeBound : failCustodyBuild({
+		code: "invalid-operation",
+		reason: "invalid-fee-bound",
+		message: "The fee bound must be a positive number of lovelace"
+	});
+};
+/**
+* The grant UTxO a grant spend spends: the grantee's grant in the named
+* slot, or its single current, unexpired grant. The grant must be current
+* against the control state, and no unsettled transaction of this wallet
+* may already spend its UTxO.
+*/
+const selectGrant = ({ grantee, slot }, { grants, state, spentInFlight }, { now }) => {
+	const granteeHex = grantee.toLowerCase();
+	const held = grants.filter(({ grant }) => grant.grantee.toLowerCase() === granteeHex);
+	const livenessOf = ({ grant }) => custodyGrantLiveness(grant, state, now);
+	let selected;
+	if (slot === void 0) {
+		const current = held.filter((found) => livenessOf(found) === "current");
+		if (current.length > 1) return failCustodyBuild({
+			code: "grant-spend",
+			reason: "ambiguous-grant",
+			grantee,
+			slots: current.map(({ grant }) => grant.slot)
+		});
+		selected = current[0] ?? held.at(-1);
+	} else selected = held.find(({ grant }) => grant.slot === slot);
+	if (!selected) return failCustodyBuild({
+		code: "grant-spend",
+		reason: "unknown-grant",
+		grantee,
+		...slot !== void 0 && { slot }
+	});
+	const liveness = livenessOf(selected);
+	if (liveness !== "current") return failCustodyBuild({
+		code: "grant-spend",
+		reason: "dead-grant",
+		slot: selected.grant.slot,
+		liveness
+	});
+	return spentInFlight.has(outpointKey$1(selected.utxo[0])) ? failCustodyBuild({ code: "operation-in-progress" }) : selected;
+};
+/** Refuses an output the grant's recipient list does not name, on the account's network. */
+const checkRecipients = (grant, outputs, networkId) => {
+	const { recipients } = grant.scope;
+	if (recipients.length === 0) return;
+	const allowed = new Set(recipients.flatMap((recipient) => {
+		const address = custodyRecipientToAddress(recipient, networkId);
+		return address.ok ? [address.value.toBech32()] : [];
+	}));
+	for (const [outputIndex, output] of outputs.entries()) {
+		const address = Cardano.Address.fromString(output.address).toBech32();
+		if (!allowed.has(address)) failCustodyBuild({
+			code: "grant-spend",
+			reason: "recipient-not-allowed",
+			outputIndex
+		});
+	}
+};
+/**
+* Refuses an outflow the grant's scope does not allow. `fee`, when known,
+* is the part of the lovelace outflow that pays the transaction fee; each
+* refusal reports it, so a caller can size a grant for the payment and the
+* fee.
+*/
+const refuseScope = (grant, leaving, fee) => {
+	const violations = findCustodyScopeViolations(grant.scope, leaving, fee);
+	if (violations.length > 0) failCustodyBuild({
+		code: "grant-spend",
+		reason: "scope",
+		violations
+	});
+};
+/**
+* The upper validity bound of a grant spend: the earlier of the funding
+* window and the slot holding the grant's expiry, whose start the contract
+* compares with the expiry. A grant that expires within the current slot
+* leaves no such slot.
+*/
+const grantSpendValiditySlot = (grant, funding, chain) => {
+	const windowSlot = validitySlotFor(funding.validUntil, chain);
+	const { expiresAt } = grant.scope;
+	if (expiresAt >= BigInt(chain.clock.slotStart(windowSlot))) return windowSlot;
+	const expirySlot = chain.clock.slotAt(Number(expiresAt));
+	return expirySlot > chain.clock.slotAt(chain.now) ? expirySlot : failCustodyBuild({
+		code: "grant-spend",
+		reason: "dead-grant",
+		slot: grant.slot,
+		liveness: "expired"
+	});
+};
+/**
+* Refuses a spend the fund UTxOs cannot pay however they are combined:
+* they hold less of a requested asset, or less lovelace, with whatever the
+* logic run draws, than the outputs and the least fee. It runs before the
+* fund input cap, because consolidation cannot help an account that is
+* short of funds.
+*/
+const refuseShortFunds = (candidates, requested, { leastFee, drawn }) => {
+	const available = totalValueOf(candidates.map(([, output]) => output));
+	if (available.coins + drawn < requested.coins + leastFee || [...requested.assets].some(([assetId, quantity]) => (available.assets.get(assetId) ?? 0n) < quantity)) failCustodyBuild({
+		code: "insufficient-funds",
+		message: "The fund UTxOs hold less than the requested outputs and the least fee"
+	});
+};
+const refuseFundInputCount = (funds) => {
+	if (funds.length > MAX_GRANT_SPEND_FUND_INPUTS) failCustodyBuild({
+		code: "grant-spend",
+		reason: "fund-input-cap",
+		maxFundInputs: MAX_GRANT_SPEND_FUND_INPUTS,
+		requiredFundInputs: funds.length
+	});
+};
+/**
+* Refuses a spend whose budgets exceed the per-transaction execution limit,
+* as a fund input count above what one spend fits: the grant's run is
+* fixed, so only fewer, larger fund UTxOs help. The count that fits follows
+* from the grant's and the logic's budgets and the dearest fund budget; the
+* logic's budget already counts every fund it checked, so the count errs
+* low.
+*/
+const refuseOverBudget = (redeemers, { maxExecutionUnitsPerTransaction: limit }) => {
+	const total = redeemers.reduce((sum, { executionUnits }) => ({
+		memory: sum.memory + executionUnits.memory,
+		steps: sum.steps + executionUnits.steps
+	}), {
+		memory: 0,
+		steps: 0
+	});
+	if (total.memory <= limit.memory && total.steps <= limit.steps) return;
+	const fixed = redeemers.filter(({ purpose, data }) => purpose === Cardano.RedeemerPurpose.withdrawal || cborOf(data) === SPEND_WITH_GRANT_REDEEMER_CBOR).reduce((sum, { executionUnits }) => ({
+		memory: sum.memory + executionUnits.memory,
+		steps: sum.steps + executionUnits.steps
+	}), {
+		memory: 0,
+		steps: 0
+	});
+	const fundBudgets = redeemers.filter(({ data }) => cborOf(data) === FUND_REDEEMER_CBOR).map(({ executionUnits }) => executionUnits);
+	const fundMemory = Math.max(1, ...fundBudgets.map(({ memory }) => memory));
+	const fundSteps = Math.max(1, ...fundBudgets.map(({ steps }) => steps));
+	const fitting = Math.floor(Math.min((limit.memory - fixed.memory) / fundMemory, (limit.steps - fixed.steps) / fundSteps));
+	failCustodyBuild({
+		code: "grant-spend",
+		reason: "fund-input-cap",
+		maxFundInputs: Math.max(0, Math.min(MAX_GRANT_SPEND_FUND_INPUTS, fitting)),
+		requiredFundInputs: fundBudgets.length
+	});
+};
+/**
+* The grant the recreated grant UTxO carries: the caps `grant_after_spend`
+* allows for the requested outputs and `fee`, and no lower than zero. The
+* logic accepts any cap from zero to the value for the fee of the
+* transaction it checks, so a `fee` no lower than that one writes valid
+* caps.
+*/
+const grantAfter = (grant, requested, fee) => {
+	const { scope } = custodyGrantAfterSpend(grant, deltaOf(requested, fee));
+	return {
+		...grant,
+		scope: {
+			...scope,
+			cap: scope.cap > 0n ? scope.cap : 0n,
+			lovelaceCap: scope.lovelaceCap > 0n ? scope.lovelaceCap : 0n
+		}
+	};
+};
+/**
+* The most fee the outflow carries before it breaks a lovelace cap of the
+* scope: the lower of a lovelace grant's caps, or of a token grant's
+* lovelace caps, less the requested lovelace.
+*/
+const feeRoomOf = ({ scope }, requested) => {
+	const [perCallCap, cap] = isCustodyLovelaceAsset(scope.asset) ? [scope.perCallCap, scope.cap] : [scope.lovelacePerCallCap, scope.lovelaceCap];
+	return (perCallCap < cap ? perCallCap : cap) - requested.coins;
+};
+/**
+* Builds a grant spend for the grantee to sign. It references the
+* account's control UTxO, spends the grant UTxO with `SpendWithGrant` and
+* plain fund UTxOs with `Fund`, largest first, never a reserve, one
+* carrying a reference script, or one in `excludedInputs`, and runs the
+* logic the control names through its withdrawal. The grant UTxO is
+* recreated with the same value and the caps lowered by the outflow, the
+* requested outputs are paid, and the change, with whatever the logic run
+* draws, returns to the account as a plain output. The account pays the
+* fee, which counts against the grant's caps; the sponsor contributes only
+* its collateral. The proxy and the logic are read from their parked UTxOs
+* on a network that has them, and attached elsewhere.
+*
+* The caps go into the datum before the fee is known, and the logic counts
+* the fee in the outflow it checks against them, both on the final
+* transaction and on the balanced draft the provider evaluates. So every
+* draft is balanced at no more than the fee the caps were lowered by, nor
+* the fee that keeps the outflow within the caps, and two builds run with
+* evaluated budgets. The first lowers the caps by the fee bound, and a fee
+* above the bound or the caps is refused. The second lowers them by the
+* first fee and a small margin, and stands when its fee fits that; the
+* first build stands whenever the second cannot be built.
+*/
+const buildCustodyGrantSpend = async ({ operation, funding }, context, chain) => {
+	const { identity, control } = context;
+	const { protocolParameters: parameters } = chain;
+	refuseMetadata(operation);
+	const feeBound = feeBoundOf(operation);
+	const spent = selectGrant(operation, context, chain);
+	const { grant } = spent;
+	checkRequestedOutputs(operation.outputs, identity, parameters.coinsPerUtxoByte);
+	checkRecipients(grant, operation.outputs, identity.chainId.networkId);
+	const requested = totalValueOf(operation.outputs);
+	refuseScope(grant, deltaOf(requested));
+	const invalidHereafter = grantSpendValiditySlot(grant, funding, chain);
+	const grantee = grant.grantee;
+	const logicRun = await readCustodyLogicRun(accountLogicOf(context), chain);
+	const drawn = logicRun.withdrawal.quantity;
+	const { contractVersion } = identity;
+	const witnesses = custodyScriptWitnesses(contractVersion, chain, [contractVersion.accountValidator, logicRun.logic.script]);
+	const excluded = new Set((operation.excludedInputs ?? []).map(outpointKey$1));
+	const candidates = context.funds.filter(([input, output]) => output.scriptReference === void 0 && !excluded.has(outpointKey$1(input)));
+	const planOf = (after) => (funds) => ({
+		inputs: [{
+			utxo: spent.utxo,
+			redeemer: SPEND_WITH_GRANT_REDEEMER
+		}, ...funds.map((utxo) => ({
+			utxo,
+			redeemer: FUND_REDEEMER$1
+		}))],
+		referenceInputs: [control, ...witnesses.referenced],
+		outputs: [grantOutputOf(identity, after, spent.utxo[1].value.coins), ...operation.outputs],
+		changeAddress: identity.address,
+		scripts: witnesses.attached,
+		executionEstimate: custodyExecutionEstimate({
+			spendWithGrant: 1,
+			fund: funds.length,
+			logic: "agent"
+		}),
+		requiredSigner: grantee,
+		invalidHereafter,
+		collateral: {
+			utxo: funding.collateralUtxo,
+			returnAddress: funding.sponsorAddress
+		},
+		withdrawals: [logicRun.withdrawal]
+	});
+	const needed = requested.coins + plannedFeeOf(planOf(grant)([]), parameters) + changeReserveAt(identity.address, parameters.coinsPerUtxoByte) - drawn;
+	const selection = selectFunds(candidates, {
+		coins: needed > 0n ? needed : 0n,
+		assets: requested.assets
+	});
+	if (!selection.covers) refuseShortFunds(candidates, requested, {
+		leastFee: leastFeeOf(planOf(grant)([]), parameters),
+		drawn
+	});
+	const feeRoom = feeRoomOf(grant, requested);
+	/** A build whose caps are lowered by `lowering` and whose drafts fit them. */
+	const build = async (lowering, funds) => {
+		const after = grantAfter(grant, requested, lowering);
+		const transaction = await buildWithEvaluatedBudgets({
+			chain,
+			funds,
+			checkFunds: refuseFundInputCount,
+			plan: planOf(after),
+			maxBalancedFee: lowering < feeRoom ? lowering : feeRoom
+		});
+		return {
+			transaction,
+			after,
+			fee: transaction.body().fee()
+		};
+	};
+	/** Refuses a fee above the bound, or one that takes the outflow over a cap. */
+	const refuseFee = (fee) => fee > feeBound ? failCustodyBuild({
+		code: "grant-spend",
+		reason: "fee-above-bound",
+		fee,
+		feeBound
+	}) : failCustodyBuild({
+		code: "grant-spend",
+		reason: "scope",
+		violations: findCustodyScopeViolations(grant.scope, deltaOf(requested, fee), fee)
+	});
+	const first = await build(feeBound, selection).catch((error) => {
+		if (!(error instanceof MaxBalancedFeeExceeded)) throw error;
+		refuseOverBudget(error.evaluatedRedeemers, parameters);
+		return refuseFee(error.fee);
+	});
+	refuseOverBudget(first.transaction.witnessSet().redeemers()?.toCore() ?? [], parameters);
+	const firstFunds = resolvedInputsOf(first.transaction, candidates);
+	let chosen = first;
+	const tightFee = first.fee + GRANT_CAP_FEE_MARGIN;
+	const { scope: tight } = grantAfter(grant, requested, tightFee);
+	if (tight.cap > first.after.scope.cap || tight.lovelaceCap > first.after.scope.lovelaceCap) {
+		const used = new Set(firstFunds.map(([input]) => outpointKey$1(input)));
+		try {
+			chosen = await build(tightFee, {
+				selected: firstFunds,
+				remaining: candidates.filter(([input]) => !used.has(outpointKey$1(input)))
+			});
+		} catch (error) {
+			if (!(error instanceof MaxBalancedFeeExceeded) && !(error instanceof CustodyBuildFailure)) throw error;
+		}
+	}
+	const { transaction, after } = chosen;
+	return finalizeCustodyBuild({
+		transaction,
+		resolvedInputs: resolvedInputsOf(transaction, [
+			spent.utxo,
+			control,
+			...witnesses.referenced,
+			...candidates,
+			funding.collateralUtxo
+		])
+	}, chain, {
+		record: context.record,
+		grantSpend: {
+			slot: grant.slot,
+			after
+		},
+		signer: grantee,
+		outflow: {
+			requested,
+			withdrawal: drawn
+		},
+		funding
+	});
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/custody-owner-operations.ts
+/**
+* The control output headroom, its lovelace above the state's minimum, that
+* an issue or a replace tops up to. The headroom is the owner's fee reserve:
+* an owner operation the plain funds cannot pay takes its fee from it, so an
+* owner can still revoke a grant after its agent drains the plain funds.
+* It pays two revokes. Where the proxy and the logic are attached, as on
+* Mainnet, a revoke carries about 12.7 KB, 11,871 bytes of them the two
+* scripts, at 44 lovelace per byte. At Preprod's prices and the 1.6M to 1.8M
+* memory units upstream's devnet measured over the largest state, the
+* control pays a fee of about 0.84 ADA. Before evaluation balancing prices
+* a revoke at its execution estimate, about 0.99 ADA, which the draft the
+* provider evaluates must find in the headroom. The first revoke's fee, the
+* second's draft, the state's growth and the growth margin come to about
+* 2.04 ADA. On Preprod, where the scripts are referenced at 15 lovelace per
+* byte, a revoke costs about 0.5 ADA and its draft about 0.64 ADA.
+*/
+const CUSTODY_OWNER_FEE_RESERVE_TARGET = 2100000n;
+/**
+* The control datum bytes the control output keeps lovelace for beyond its
+* minimum after paying a fee. The largest growth one owner operation makes
+* is a device key: 30 bytes, its 28 bytes and their header. A revoked slot
+* adds at most 6, and a counter crossing a CBOR width at most 2. The next
+* operation's growth is then covered, whoever pays its fee.
+*/
+const CUSTODY_CONTROL_GROWTH_MARGIN_BYTES = 32;
+const DEVICE_REDEEMER = encodeCustodyAccountRedeemer({ kind: "device" });
+const FUND_REDEEMER = encodeCustodyAccountRedeemer({ kind: "fund" });
+const SWEEP_REDEEMER = encodeCustodyAccountRedeemer({ kind: "sweepGrant" });
+const ISSUE_REDEEMER = encodeCustodyMintRedeemer({ kind: "issueGrants" });
+const BURN_REDEEMER = encodeCustodyMintRedeemer({ kind: "burnGrants" });
+/**
+* Refuses a grant whose per-call caps cannot pay the smallest spend: one
+* output at its minimum ADA and the default grant fee bound. Its agent could
+* never spend it.
+*/
+const spendableGrant = ({ grant }, { identity }, { protocolParameters }) => isCardanoCustodyGrantExhausted(grant.scope, {
+	protocolParameters,
+	networkId: identity.chainId.networkId
+}) ? failCustodyBuild({
+	code: "invalid-operation",
+	reason: "grant-scope",
+	message: "The caps cannot pay the smallest spend: one output at its minimum ADA and the grant fee bound"
+}) : grant;
+/** What an issue or a replace writes: the state and the grant it issues. */
+const issueEffectOf = (result, context, chain) => {
+	const issued = transitioned(result);
+	return {
+		state: issued.state,
+		outputs: [],
+		issued: spendableGrant(issued, context, chain)
+	};
+};
+/**
+* The sweep of the dead grants in `slots`. Each must be dead against the
+* state before the sweep. The validity interval starts no earlier than the
+* current slot, so a grant dead by expiry alone must expire before the
+* current slot starts; the interval then starts in the first slot after
+* the latest such expiry.
+*/
+const sweepEffectOf = (slots, { state, grants, spentInFlight }, chain) => {
+	const swept = slots.map((slot) => {
+		const found = grants.find(({ grant }) => grant.slot === slot);
+		if (!found) return failCustodyBuild({
+			code: "invalid-operation",
+			reason: "state-transition",
+			error: {
+				code: "grant-not-found",
+				slot
+			}
+		});
+		return spentInFlight.has(outpointKey$1(found.utxo[0])) ? failCustodyBuild({ code: "operation-in-progress" }) : found;
+	});
+	const currentSlotStart = chain.clock.slotStart(chain.clock.slotAt(chain.now));
+	const { state: next, startsAfter } = transitioned(sweepCustodyGrants(state, swept.map(({ grant }) => grant), currentSlotStart));
+	return {
+		state: next,
+		outputs: [],
+		swept: {
+			grants: swept,
+			...startsAfter !== void 0 && { invalidBefore: firstSlotStartingAfter(startsAfter, chain) }
+		}
+	};
+};
+/**
+* The metadata an operation carries. Only an owner spend carries any: the
+* other operation types leave it out, and a caller that names it on one
+* anyway is refused rather than built without it, as a grant spend is.
+*/
+const metadataOf = (operation) => {
+	const { metadata } = operation;
+	if (metadata !== void 0 && operation.type !== "owner-spend") return failCustodyBuild({
+		code: "invalid-operation",
+		reason: "invalid-metadata",
+		message: `A ${operation.type} carries no metadata`
+	});
+	return checkRequestedMetadata(metadata);
+};
+/**
+* The state an owner operation writes and what else it does. State changes
+* go through the library's transitions, which refuse what the account could
+* not use afterwards; withdrawal reads the reward balance now, because the
+* ledger accepts only the exact balance.
+*/
+const ownerEffectOf = async (operation, context, chain) => {
+	const { identity, state } = context;
+	const metadata = metadataOf(operation);
+	const grants = context.grants.map(({ grant }) => grant);
+	const requestOf = (scope) => grantRequestOf({
+		scope,
+		slot: state.nextSlot
+	}, identity, chain.now);
+	switch (operation.type) {
+		case "issue-grant": return issueEffectOf(issueCustodyGrant(state, requestOf(operation.scope), grants), context, chain);
+		case "replace-grant": return issueEffectOf(replaceCustodyGrant(state, {
+			...requestOf(operation.scope),
+			slot: operation.slot
+		}, grants), context, chain);
+		case "revoke-grant": return {
+			state: transitioned(revokeCustodyGrant(state, operation.slot, grants)),
+			outputs: []
+		};
+		case "revoke-all-grants": return {
+			state: revokeAllCustodyGrants(state),
+			outputs: []
+		};
+		case "sweep-grants": return sweepEffectOf(operation.slots, context, chain);
+		case "add-device": return {
+			state: transitioned(addCustodyDevice(state, operation.keyHash, grants)),
+			outputs: []
+		};
+		case "remove-device": return {
+			state: transitioned(removeCustodyDevice(state, operation.keyHash)),
+			outputs: []
+		};
+		case "owner-spend": return {
+			state,
+			outputs: operation.outputs,
+			...metadata && { metadata }
+		};
+		case "delegate": return {
+			state,
+			outputs: [],
+			poolId: poolIdOf(operation.poolId)
+		};
+		case "withdraw-rewards": {
+			const { withdrawableAmount } = await readFromProvider("Custody reward account", () => chain.provider.getRewardAccountInfo({ rewardAccount: CardanoRewardAccount(identity.rewardAccount) }, { chainId: chain.chainId }));
+			const withdrawal = BigNumber.valueOf(withdrawableAmount);
+			return withdrawal > 0n ? {
+				state,
+				outputs: [],
+				withdrawal
+			} : failCustodyBuild({
+				code: "invalid-operation",
+				reason: "no-rewards",
+				message: "The custody account has no rewards to withdraw"
+			});
+		}
+	}
+};
+const sweptGrantsOf = ({ effect }) => effect.swept?.grants ?? [];
+/**
+* The lovelace the withdrawals add to the transaction: the rewards an
+* operation withdraws and whatever the logic run draws. The change or the
+* control output keeps it at the account address.
+*/
+const withdrawnOf = ({ effect, logicRun }) => (effect.withdrawal ?? 0n) + logicRun.withdrawal.quantity;
+/** The transaction's plan with `funds` paying and the control output at `controlLovelace`. */
+const planOf = (build, funds, controlLovelace) => {
+	const { context, chain, effect, signer, funding, issued, witnesses } = build;
+	const { identity, control } = context;
+	const swept = sweptGrantsOf(build);
+	const isStakeOperation = effect.poolId !== void 0 || effect.withdrawal !== void 0;
+	const mint = issued ? {
+		assets: new Map([[custodyGrantAssetId(context.record, issued.grant.slot), 1n]]),
+		redeemer: ISSUE_REDEEMER
+	} : swept.length > 0 ? {
+		assets: new Map(swept.map(({ token }) => [token, -1n])),
+		redeemer: BURN_REDEEMER
+	} : void 0;
+	return {
+		inputs: [
+			{
+				utxo: control,
+				redeemer: DEVICE_REDEEMER
+			},
+			...swept.map(({ utxo }) => ({
+				utxo,
+				redeemer: SWEEP_REDEEMER
+			})),
+			...funds.map((utxo) => ({
+				utxo,
+				redeemer: FUND_REDEEMER
+			}))
+		],
+		outputs: [
+			controlOutputOf(identity, effect.state, controlLovelace),
+			...issued ? [issued.output] : [],
+			...effect.outputs
+		],
+		referenceInputs: witnesses.referenced,
+		changeAddress: identity.address,
+		scripts: [...witnesses.attached, ...isStakeOperation ? [identity.stakeScript] : []],
+		executionEstimate: custodyExecutionEstimate({
+			device: 1,
+			sweepGrant: swept.length,
+			fund: funds.length,
+			issueGrants: issued ? 1 : 0,
+			burnGrants: swept.length > 0 ? 1 : 0,
+			operate: isStakeOperation ? 1 : 0,
+			logic: "owner"
+		}),
+		requiredSigner: signer,
+		...effect.swept?.invalidBefore !== void 0 && { invalidBefore: effect.swept.invalidBefore },
+		invalidHereafter: validitySlotFor(funding.validUntil, chain),
+		collateral: {
+			utxo: funding.collateralUtxo,
+			returnAddress: funding.sponsorAddress
+		},
+		...mint && { mint },
+		...effect.poolId && { delegation: {
+			stakeCredential: scriptCredentialOf(identity.stakeScriptHash),
+			poolId: effect.poolId,
+			redeemer: encodeCustodyStakeRedeemer()
+		} },
+		withdrawals: [build.logicRun.withdrawal, ...effect.withdrawal ? [{
+			rewardAccount: identity.rewardAccount,
+			quantity: effect.withdrawal,
+			redeemer: encodeCustodyStakeRedeemer()
+		}] : []],
+		...effect.metadata && { metadata: effect.metadata }
+	};
+};
+/**
+* Moves `amount` lovelace from the change into the control output once the
+* fee is final. A change left below its minimum ADA joins the control
+* output whole, when it holds no token.
+*
+* @throws `FundShortfall` when the change cannot spare `amount`; once no
+*   fund is left the build fails with `owner-reserve-required`, or with
+*   `insufficient-funds` when there is no change at all
+*/
+const topUpControl = (transaction, { context, chain, effect, issued }, amount) => {
+	const outputs = [...transaction.body().toCore().outputs];
+	const [control] = outputs;
+	const changeIndex = changeIndexOf(outputs, context.identity.address, 1 + (issued ? 1 : 0) + effect.outputs.length);
+	if (changeIndex < 0) throw new FundShortfall("No change output to top the reserve up from");
+	const change = outputs[changeIndex];
+	const left = change.value.coins - amount;
+	const kept = minAdaRequired(change, BigInt(chain.protocolParameters.coinsPerUtxoByte));
+	const hasTokens = (change.value.assets?.size ?? 0) > 0;
+	if (left >= kept) {
+		outputs[0] = withCoins(control, control.value.coins + amount);
+		outputs[changeIndex] = withCoins(change, left);
+	} else if (!hasTokens && left >= 0n) {
+		outputs[0] = withCoins(control, control.value.coins + change.value.coins);
+		outputs.splice(changeIndex, 1);
+	} else throw new FundShortfall("The change cannot top the owner fee reserve up", {
+		code: "owner-reserve-required",
+		target: CUSTODY_OWNER_FEE_RESERVE_TARGET,
+		shortfall: amount - (hasTokens ? change.value.coins - kept : change.value.coins)
+	});
+	return {
+		transaction: withOutputs(transaction, outputs),
+		controlLovelace: outputs[0].value.coins
+	};
+};
+/**
+* Plain funds, then reserves, largest first, pay the requested outputs, the
+* issued grant's lovelace, any growth of the control output and the fee, and
+* the change, rewards included, returns to the account without a datum. A
+* reserve's remainder becomes plain change. Swept grant lovelace goes to the
+* control output, and an issue tops the control headroom up to the owner fee
+* reserve target from the change.
+*
+* A fund carrying a reference script is never spent. Anyone can send one to
+* the account. Where the proxy and the logic are attached, such a fund
+* holding one of them would make the ledger refuse every owner operation
+* for providing the script twice, instead of falling back to the control
+* headroom; anywhere, its script would add to the fee and, for the fee
+* sponsor, to the languages of the script data hash.
+*/
+const buildPaidByFunds = async (build) => {
+	const { context, chain, effect, issued, minimum } = build;
+	const { identity } = context;
+	const spendable = context.funds.filter(([, output]) => output.scriptReference === void 0);
+	const { protocolParameters: parameters } = chain;
+	const swept = sweptGrantsOf(build);
+	const controlLovelace = build.spentAccountLovelace > minimum ? build.spentAccountLovelace : minimum;
+	const reserveTarget = minimum + CUSTODY_OWNER_FEE_RESERVE_TARGET;
+	const topUp = issued && reserveTarget > controlLovelace ? reserveTarget - controlLovelace : 0n;
+	const requested = totalValueOf(effect.outputs);
+	const needed = requested.coins + (issued?.output.value.coins ?? 0n) + (controlLovelace - build.spentAccountLovelace) + topUp + plannedFeeOf(planOf(build, [], controlLovelace), parameters) + changeReserveAt(identity.address, parameters.coinsPerUtxoByte) - withdrawnOf(build);
+	let settledLovelace = controlLovelace;
+	return {
+		transaction: await buildWithEvaluatedBudgets({
+			chain,
+			funds: selectFunds(spendable, {
+				coins: needed > 0n ? needed : 0n,
+				assets: requested.assets
+			}, context.reserves),
+			plan: (funds) => planOf(build, funds, controlLovelace),
+			...topUp > 0n && { settle: (built) => {
+				const settled = topUpControl(built, build, topUp);
+				settledLovelace = settled.controlLovelace;
+				return settled.transaction;
+			} }
+		}),
+		controlLovelace: settledLovelace,
+		candidates: [
+			...spendable,
+			...context.reserves,
+			...swept.map(({ utxo }) => utxo)
+		]
+	};
+};
+const headroomShortfall = () => failCustodyBuild({
+	code: "insufficient-funds",
+	message: "The plain funds and reserves cannot pay the fee, and the control output headroom cannot either"
+});
+/**
+* The control output pays the fee from its headroom: the transaction spends
+* only the control UTxO and any swept grant UTxOs, and the control output
+* takes everything they hold and whatever the withdrawals add, less the
+* fee. It must keep the new state's minimum and the growth margin, which a
+* headroom below the least fee never keeps, so such a build is refused
+* before any evaluation.
+*/
+const buildPaidByControl = async (build) => {
+	const { chain, minimum, spentAccountLovelace } = build;
+	const held = spentAccountLovelace + withdrawnOf(build);
+	const plan = {
+		...planOf(build, [], held),
+		isFeePaidByFirstOutput: true
+	};
+	const floor = minimum + BigInt(CUSTODY_CONTROL_GROWTH_MARGIN_BYTES) * BigInt(chain.protocolParameters.coinsPerUtxoByte);
+	if (held - leastFeeOf(plan, chain.protocolParameters) < floor) return headroomShortfall();
+	const transaction = await buildWithEvaluatedBudgets({
+		chain,
+		funds: {
+			selected: [],
+			remaining: []
+		},
+		plan: () => plan
+	});
+	const controlLovelace = held - transaction.body().fee();
+	if (controlLovelace < floor) return headroomShortfall();
+	return {
+		transaction,
+		controlLovelace,
+		candidates: sweptGrantsOf(build).map(({ utxo }) => utxo)
+	};
+};
+const isInsufficientFunds = (error) => error instanceof CustodyBuildFailure && error.reason.code === "insufficient-funds";
+/**
+* Builds an owner operation in the sponsor's collateral mode: the account
+* pays and the sponsor contributes only its shared collateral. The control
+* UTxO is spent with `Device` and recreated from the resulting state, the
+* logic its state names runs through its withdrawal, and the bound device
+* key is the only required signer. The proxy and the logic are read from
+* their parked UTxOs on a network that has them, and attached elsewhere; a
+* stake operation attaches the stake script.
+*
+* Plain funds and reserves pay first. When they cannot, an operation that
+* pays nothing out and issues no grant takes its fee from the control
+* output's headroom instead.
+*/
+const buildCustodyOwnerOperation = async ({ operation, funding }, context, chain) => {
+	const signer = requireListedDevice(context);
+	const { identity, control } = context;
+	const { coinsPerUtxoByte } = chain.protocolParameters;
+	const effect = await ownerEffectOf(operation, context, chain);
+	checkRequestedOutputs(effect.outputs, identity, coinsPerUtxoByte);
+	const logicRun = await readCustodyLogicRun(accountLogicOf(context), chain);
+	const { contractVersion } = identity;
+	const swept = effect.swept?.grants ?? [];
+	const { issued: grant } = effect;
+	const issued = grant && {
+		grant,
+		output: grantOutputOf(identity, grant, outputLovelaceFor((lovelace) => grantOutputOf(identity, grant, lovelace), 0n, coinsPerUtxoByte))
+	};
+	const build = {
+		context,
+		chain,
+		effect,
+		signer,
+		funding,
+		...issued && { issued },
+		minimum: controlLovelaceFor({
+			identity,
+			state: effect.state,
+			floor: 0n
+		}, coinsPerUtxoByte),
+		spentAccountLovelace: swept.reduce((total, { utxo: [, output] }) => total + output.value.coins, control[1].value.coins),
+		logicRun,
+		witnesses: custodyScriptWitnesses(contractVersion, chain, [contractVersion.accountValidator, logicRun.logic.script])
+	};
+	const isControlPayable = effect.outputs.length === 0 && !issued;
+	let paid;
+	try {
+		paid = await buildPaidByFunds(build);
+	} catch (error) {
+		if (!isControlPayable || !isInsufficientFunds(error)) throw error;
+		paid = await buildPaidByControl(build);
+	}
+	const { transaction } = paid;
+	return finalizeCustodyBuild({
+		transaction,
+		resolvedInputs: resolvedInputsOf(transaction, [
+			control,
+			...paid.candidates,
+			...build.witnesses.referenced,
+			funding.collateralUtxo
+		])
+	}, chain, {
+		record: context.record,
+		control: {
+			state: effect.state,
+			lovelace: paid.controlLovelace
+		},
+		issuedGrants: issued ? [{
+			grant: issued.grant,
+			lovelace: issued.output.value.coins
+		}] : [],
+		sweptSlots: swept.map(({ grant }) => grant.slot),
+		signer,
+		deviceKeyHash: signer,
+		outflow: {
+			requested: totalValueOf(effect.outputs),
+			withdrawal: withdrawnOf(build)
+		},
+		funding
+	});
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/build-custody-transaction.ts
+const ACCOUNT_OPERATION_TYPES = new Set([
+	"add-device",
+	"delegate",
+	"grant-spend",
+	"issue-grant",
+	"owner-spend",
+	"remove-device",
+	"replace-grant",
+	"revoke-all-grants",
+	"revoke-grant",
+	"sweep-grants",
+	"withdraw-rewards"
+]);
+const refuseOperation = (type) => failCustodyBuild({
+	code: "invalid-operation",
+	reason: "unknown-operation",
+	message: `Unknown custody operation ${type} for this request`
+});
+const refuseFundingMode = (mode) => failCustodyBuild({
+	code: "invalid-operation",
+	reason: "funding-mode",
+	message: `Funding mode ${mode} does not fit the operation`
+});
+/**
+* Builds the custody transaction a request asks for. Creation runs in the
+* sponsor's fee mode on the current network. Every operation on an
+* existing account runs in collateral mode, with the account paying: the
+* sponsor's fee mode serves creation only.
+*/
+const buildCustodyTransaction = async (request, sources) => {
+	const chain = await loadCustodyChain(sources);
+	if (!("accountId" in request)) {
+		const { operation, funding } = request;
+		if (operation.type !== "create") return refuseOperation(operation.type);
+		if (funding.mode !== "fee") return refuseFundingMode(funding.mode);
+		return buildCustodyCreation(operation, funding, chain);
+	}
+	const { accountId, operation, funding } = request;
+	if (!ACCOUNT_OPERATION_TYPES.has(operation.type)) return refuseOperation(operation.type);
+	if (funding.mode !== "collateral") return refuseFundingMode(funding.mode);
+	const context = await resolveCustodyAccount(accountId, await sources.snapshot(accountId), chain);
+	return operation.type === "grant-spend" ? buildCustodyGrantSpend({
+		operation,
+		funding
+	}, context, chain) : buildCustodyOwnerOperation({
+		operation,
+		funding
+	}, context, chain);
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/creator-index-probe-side-effect.ts
+const isSoftIndex = (index) => Number.isSafeInteger(index) && index >= 0 && index < 2147483648;
+const probeErrorOf = (reason) => {
+	if (reason.code === "unavailable" || reason.code === "build-failed") return reason;
+	if (reason.code === "invalid-operation" && reason.reason === "invalid-device-key") return {
+		...reason,
+		reason: reason.reason
+	};
+	return {
+		code: "build-failed",
+		message: `Unexpected creator index probe failure: ${reason.code}`
+	};
+};
+const resultOf = ({ accountValidatorHash, creatorIndex }, state) => {
+	const probed = {
+		accountValidatorHash,
+		creatorIndex
+	};
+	return state.status === "account" ? {
+		...probed,
+		status: "account",
+		record: state.record
+	} : {
+		...probed,
+		status: state.status
+	};
+};
+const probe = async (request, { chainId, provider, logger }) => {
+	const contractVersion = findCustodyContractVersion(request.accountValidatorHash);
+	if (!contractVersion.ok) return {
+		ok: false,
+		error: contractVersion.error
+	};
+	if (!isSoftIndex(request.creatorIndex)) return {
+		ok: false,
+		error: {
+			code: "invalid-operation",
+			reason: "invalid-start-index",
+			message: `Invalid creator index ${request.creatorIndex}`
+		}
+	};
+	if (!chainId) return {
+		ok: false,
+		error: {
+			code: "unavailable",
+			message: "Cardano chain id not available"
+		}
+	};
+	try {
+		return {
+			ok: true,
+			result: resultOf(request, await readCustodyCreatorIndex({
+				contractVersion: contractVersion.value,
+				deviceAccountPublicKey: request.deviceAccountPublicKey,
+				creatorIndex: request.creatorIndex
+			}, {
+				chainId,
+				provider
+			}))
+		};
+	} catch (error) {
+		if (error instanceof CustodyBuildFailure) return {
+			ok: false,
+			error: probeErrorOf(error.reason)
+		};
+		logger.error("Custody creator index probe failed unexpectedly", error);
+		return {
+			ok: false,
+			error: {
+				code: "build-failed",
+				message: messageOf(error)
+			}
+		};
+	}
+};
+const makeCustodyCreatorIndexProbing = () => ({ cardanoCustody: { probeCustodyCreatorIndex$ } }, { cardanoContext }, { cardanoProvider, actions, logger }) => {
+	const answer = async (request) => probe(request, {
+		chainId: await firstValueFrom(cardanoContext.selectChainId$),
+		provider: cardanoProvider,
+		logger
+	});
+	return probeCustodyCreatorIndex$.pipe(mergeMap(({ payload: request }) => from(answer(request)).pipe(map((outcome) => outcome.ok ? actions.cardanoCustody.probeCustodyCreatorIndexCompleted({
+		requestId: request.requestId,
+		result: outcome.result
+	}) : actions.cardanoCustody.probeCustodyCreatorIndexFailed({
+		requestId: request.requestId,
+		error: outcome.error
+	})))));
+};
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/build-side-effect.ts
+const failureOf = (error, logger) => {
+	if (error instanceof CustodyBuildFailure) return error.reason;
+	logger.error("Custody transaction build failed unexpectedly", error);
+	return {
+		code: "build-failed",
+		message: messageOf(error)
+	};
+};
+const makeCustodyTransactionBuilding = () => ({ cardanoCustody: { buildCustodyTransaction$ } }, { cardanoContext, cardanoCustody, wallets }, { cardanoProvider, actions, logger }) => {
+	const snapshot = async (accountId) => {
+		const [allWallets, accountStateOf, settledUtxos] = await Promise.all([
+			firstValueFrom(wallets.selectAll$),
+			firstValueFrom(cardanoCustody.selectCardanoCustodyAccountState$),
+			firstValueFrom(cardanoContext.selectAccountUtxos$)
+		]);
+		return {
+			account: allWallets.flatMap((wallet) => wallet.accounts).filter(isCardanoCustodyAccount).find((account) => account.accountId === accountId),
+			accountState: accountStateOf(accountId),
+			settledUtxos: settledUtxos[accountId] ?? []
+		};
+	};
+	const build = async (request) => {
+		try {
+			const [chainId, eraSummaries] = await Promise.all([firstValueFrom(cardanoContext.selectChainId$), firstValueFrom(cardanoContext.selectEraSummaries$)]);
+			return {
+				ok: true,
+				result: await buildCustodyTransaction(Serializable.from(request), {
+					chainId,
+					eraSummaries,
+					snapshot,
+					provider: cardanoProvider,
+					now: Date.now()
+				})
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				error: failureOf(error, logger)
+			};
+		}
+	};
+	return buildCustodyTransaction$.pipe(mergeMap(({ payload: { requestId, request } }) => from(build(request)).pipe(map((outcome) => outcome.ok ? actions.cardanoCustody.buildCustodyTransactionCompleted({
+		requestId,
+		result: outcome.result
+	}) : actions.cardanoCustody.buildCustodyTransactionFailed({
+		requestId,
+		error: outcome.error
+	})))));
+};
+const custodyTransactionSideEffects = [makeCustodyTransactionBuilding(), makeCustodyCreatorIndexProbing()];
+//#endregion
+//#region ../../packages/module/blockchain-cardano/src/store/custody/init.ts
+const init = () => ({ sideEffects: custodyTransactionSideEffects });
+//#endregion
+export { init as default };