@crediolabs/policy-synth 0.1.10 → 0.1.12

package/dist-cjs/predicate/encode.js

@@ -19,6 +19,19 @@
 //
 // Caps from `PREDICATE_CAPS` are enforced BEFORE returning; a cap breach throws
 // a `ToolError` with the matching error code and `severity: 'error'`.
+//
+// The encoder is also the gate for the structures the contract refuses: an
+// empty `and`/`or` child list and an empty `in` haystack (MALFORMED_PREDICATE
+// at decode, dsl.rs), an `oracle_price` under a `not`/`or`, and an oracle bound
+// with no non-oracle constraint beside it (validate_oracle_placement at
+// install).
+//
+// One gap remains, deliberately: the `amount` / `window_spent` leaf branches
+// below are dead ABI - the contract's grammar no longer has those selector
+// symbols, so a predicate carrying one is MALFORMED at decode. The interpreter
+// adapter reports them as uncovered before lowering, so the product path
+// cannot emit one; removing the branches (and the leaf kinds) is a separate
+// change.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encodePredicate = encodePredicate;
 const node_crypto_1 = require("node:crypto");
@@ -48,6 +61,9 @@ function encodePredicate(node) {
     if (oracleReads > types_ts_1.PREDICATE_CAPS.MAX_ORACLE_READS) {
         throw capError('PREDICATE_ORACLE_OVER_LIMIT', `oracle reads ${oracleReads} exceed MAX_ORACLE_READS ${types_ts_1.PREDICATE_CAPS.MAX_ORACLE_READS}`);
     }
+    if (stats.oracleAssets.size > 0 && stats.nonOracleSelectorLeaves === 0) {
+        throw capError('MALFORMED_PREDICATE', 'predicate constrains nothing but an oracle price: the contract refuses it at install (dsl.rs MissingNonOracleEnvelope). Pin the call itself (contract / method / argument) alongside the price bound.');
+    }
     // --- pass 2: build + canonicalise the ScVal ---
     const root = encodeNode(node);
     const rawBytes = root.toXDR();
@@ -61,19 +77,30 @@ function encodePredicate(node) {
 function computeStats(node) {
     const inCounts = [];
     const oracleAssets = new Set();
-    const { depth, leaves } = walk(node, inCounts, oracleAssets);
-    return { depth, leaves, inCounts, oracleAssets };
+    const counters = { nonOracleSelectorLeaves: 0 };
+    const { depth, leaves } = walk(node, inCounts, oracleAssets, counters, false);
+    return {
+        depth,
+        leaves,
+        inCounts,
+        oracleAssets,
+        nonOracleSelectorLeaves: counters.nonOracleSelectorLeaves,
+    };
 }
-function walk(node, inCounts, oracleAssets) {
+function walk(node, inCounts, oracleAssets, counters, 
+/** True once the walk is under a `not` or an `or`, where an oracle read
+ *  becomes a condition the caller can satisfy by taking the other branch. */
+negatedOrDisjunctive) {
     switch (node.op) {
         case 'and':
         case 'or': {
-            if (node.children.length === 0)
-                return { depth: 1, leaves: 0 };
+            if (node.children.length === 0) {
+                throw capError('MALFORMED_PREDICATE', `\`${node.op}\` with no children: the contract refuses it at decode (MALFORMED_PREDICATE), so it can never be installed`);
+            }
             let maxChildDepth = 0;
             let totalLeaves = 0;
             for (const c of node.children) {
-                const child = walk(c, inCounts, oracleAssets);
+                const child = walk(c, inCounts, oracleAssets, counters, negatedOrDisjunctive || node.op === 'or');
                 if (child.depth > maxChildDepth)
                     maxChildDepth = child.depth;
                 totalLeaves += child.leaves;
@@ -81,7 +108,7 @@ function walk(node, inCounts, oracleAssets) {
             return { depth: maxChildDepth + 1, leaves: totalLeaves };
         }
         case 'not': {
-            const child = walk(node.child, inCounts, oracleAssets);
+            const child = walk(node.child, inCounts, oracleAssets, counters, true);
             return { depth: child.depth + 1, leaves: child.leaves };
         }
         case 'eq':
@@ -89,16 +116,19 @@ function walk(node, inCounts, oracleAssets) {
         case 'lte':
         case 'gt':
         case 'gte': {
-            collectOracle(node.left, oracleAssets);
-            collectOracle(node.right, oracleAssets);
+            collectOracle(node.left, oracleAssets, counters, negatedOrDisjunctive);
+            collectOracle(node.right, oracleAssets, counters, negatedOrDisjunctive);
             return { depth: 1, leaves: leafCount(node.left) + leafCount(node.right) };
         }
         case 'in': {
+            if (node.haystack.length === 0) {
+                throw capError('MALFORMED_PREDICATE', '`in` with an empty haystack: the contract refuses it at decode (MALFORMED_PREDICATE), so it can never be installed');
+            }
             inCounts.push({ count: node.haystack.length });
-            collectOracle(node.needle, oracleAssets);
+            collectOracle(node.needle, oracleAssets, counters, negatedOrDisjunctive);
             let haystackLeaves = 0;
             for (const h of node.haystack) {
-                collectOracle(h, oracleAssets);
+                collectOracle(h, oracleAssets, counters, negatedOrDisjunctive);
                 haystackLeaves += leafCount(h);
             }
             return {
@@ -120,16 +150,26 @@ function leafCount(leaf) {
     }
     return 1;
 }
-function collectOracle(leaf, oracleAssets) {
+function collectOracle(leaf, oracleAssets, counters, negatedOrDisjunctive) {
     // literal_vec is the only nested leaf; recurse so an oracle_price buried in a
     // vector literal (which the lowering would forbid, but the cap-walker must
     // still see) is counted toward the oracle-read budget.
     if (leaf.kind === 'oracle_price') {
+        if (negatedOrDisjunctive) {
+            throw capError('ORACLE_LEAF_INVALID_POSITION', `oracle_price(${leaf.asset}) sits under a \`not\`/\`or\`: the contract refuses that position at install (dsl.rs validate_oracle_placement). An oracle bound must be a conjunct the call has to satisfy.`);
+        }
         oracleAssets.add(leaf.asset);
     }
     else if (leaf.kind === 'literal_vec') {
         for (const el of leaf.elements)
-            collectOracle(el, oracleAssets);
+            collectOracle(el, oracleAssets, counters, negatedOrDisjunctive);
+    }
+    else if (!leaf.kind.startsWith('literal_') && leaf.kind !== 'oracle_threshold') {
+        // A threshold is the oracle compare's operand, not an independent
+        // constraint. Counting it would let an oracle-only predicate satisfy the
+        // non-oracle envelope with its own bound (mirrors collect_oracle_leaf in
+        // dsl.rs, where it sits with the literals).
+        counters.nonOracleSelectorLeaves += 1;
     }
 }
 function encodeNode(node) {
@@ -179,6 +219,17 @@ function encodeLeaf(leaf) {
                 stellar_sdk_1.xdr.ScVal.scvU32(leaf.element),
                 stellar_sdk_1.xdr.ScVal.scvSymbol(leaf.field),
             ]);
+        case 'call_arg_scaled':
+            // Wire shape `vec[symbol, u32, i128, i128]` mirrors the Rust decoder's
+            // expectation in dsl.rs SEL_CALL_ARG_SCALED. `scvI128FromDecimal` is
+            // the same range-checked helper used by `literal_i128`; an out-of-range
+            // num/den is refused at encode time (rather than at install on chain).
+            return stellar_sdk_1.xdr.ScVal.scvVec([
+                symbol('call_arg_scaled'),
+                stellar_sdk_1.xdr.ScVal.scvU32(leaf.index),
+                scvI128FromDecimal(leaf.num),
+                scvI128FromDecimal(leaf.den),
+            ]);
         case 'amount':
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol('amount'), scvAddressFromStrkey(leaf.token)]);
         case 'window_spent':
@@ -190,11 +241,25 @@ function encodeLeaf(leaf) {
         case 'now':
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol('now')]);
         case 'valid_until':
-            return stellar_sdk_1.xdr.ScVal.scvVec([symbol('valid_until')]);
+            // The interpreter refuses this leaf at install: it never sources
+            // valid_until_ledger, so a policy built on it would deny forever.
+            // Expiry belongs to the smart account, through the context rule's
+            // validUntilLedger. Refuse at synthesis so the author finds out here
+            // rather than from an install that always fails.
+            throw new Error('valid_until is not a usable predicate leaf: the interpreter never sources it and ' +
+                'refuses it at install. Put expiry on the context rule (validUntilLedger) instead.');
         case 'invocation_count_in_window':
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol('invocation_count'), scvU64FromValue(leaf.windowSecs)]);
         case 'oracle_price':
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol('oracle_price'), scvAddressFromStrkey(leaf.asset)]);
+        case 'oracle_threshold':
+            // Arity 3, matching SEL_ORACLE_THRESHOLD in dsl.rs. The declared basis
+            // travels with the value so the contract never has to assume one.
+            return stellar_sdk_1.xdr.ScVal.scvVec([
+                symbol('oracle_threshold'),
+                scvI128FromDecimal(leaf.value),
+                stellar_sdk_1.xdr.ScVal.scvU32(leaf.decimals),
+            ]);
         case 'literal_address':
             return scvAddressFromStrkey(leaf.value);
         case 'literal_i128':

package/dist-cjs/predicate/from-json.d.ts

@@ -0,0 +1,4 @@
+import type { PredicateNode } from '../types.ts';
+/** Parse a JSON object back into a `PredicateNode`. Throws on shape
+ *  mismatches. The encoder's structural caps are the real gate. */
+export declare function jsonToAst(value: unknown): PredicateNode;

package/dist-cjs/predicate/from-json.js

@@ -0,0 +1,116 @@
+"use strict";
+// src/predicate/from-json.ts - parse untrusted JSON into a `PredicateNode`.
+//
+// The counterpart to `encodePredicate`: that turns a typed node into the
+// canonical wire bytes, this turns arbitrary parsed JSON into a typed node,
+// or throws. Anything accepting a hand-written policy needs both, so both
+// belong in this package rather than in whichever app happened to grow the
+// paste box first.
+//
+// Deliberately shape-only. Structural caps (depth, node count, argument
+// count) stay in the encoder, which is the gate the contract's decoder
+// mirrors; duplicating them here would give two places to drift.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jsonToAst = jsonToAst;
+/** Parse a JSON object back into a `PredicateNode`. Throws on shape
+ *  mismatches. The encoder's structural caps are the real gate. */
+function jsonToAst(value) {
+    if (value === null || typeof value !== 'object')
+        throw new Error('predicate must be an object');
+    const v = value;
+    switch (v.op) {
+        case 'and':
+        case 'or':
+            return { op: v.op, children: arrayOf(v.children, jsonToAst) };
+        case 'not':
+            return { op: 'not', child: jsonToAst(v.child) };
+        case 'eq':
+        case 'lt':
+        case 'lte':
+        case 'gt':
+        case 'gte':
+            return { op: v.op, left: jsonToLeaf(v.left), right: jsonToLeaf(v.right) };
+        case 'in':
+            return { op: 'in', needle: jsonToLeaf(v.needle), haystack: arrayOf(v.haystack, jsonToLeaf) };
+        default:
+            throw new Error(`unknown predicate op: ${String(v.op)}`);
+    }
+}
+function arrayOf(v, f) {
+    if (!Array.isArray(v))
+        throw new Error('expected array');
+    return v.map(f);
+}
+function jsonToLeaf(value) {
+    if (value === null || typeof value !== 'object')
+        throw new Error('leaf must be an object');
+    const v = value;
+    switch (v.kind) {
+        case 'call_contract':
+        case 'call_fn':
+        case 'now':
+        case 'valid_until':
+            return { kind: v.kind };
+        case 'call_arg':
+            return { kind: 'call_arg', index: numberField(v, 'index') };
+        case 'call_arg_len':
+            return { kind: 'call_arg_len', index: numberField(v, 'index') };
+        // num/den are strings, not numbers: they are i128 on chain, and a JSON
+        // number would silently lose precision past 2^53 before the encoder
+        // ever saw the value.
+        case 'call_arg_scaled':
+            return {
+                kind: 'call_arg_scaled',
+                index: numberField(v, 'index'),
+                num: stringField(v, 'num'),
+                den: stringField(v, 'den'),
+            };
+        case 'call_arg_field':
+            return {
+                kind: 'call_arg_field',
+                index: numberField(v, 'index'),
+                element: numberField(v, 'element'),
+                field: stringField(v, 'field'),
+            };
+        case 'amount':
+            return { kind: 'amount', token: stringField(v, 'token') };
+        case 'window_spent':
+            return {
+                kind: 'window_spent',
+                token: stringField(v, 'token'),
+                windowSeconds: numberField(v, 'windowSeconds'),
+            };
+        case 'invocation_count_in_window':
+            return { kind: 'invocation_count_in_window', windowSecs: numberField(v, 'windowSecs') };
+        case 'oracle_price':
+            return { kind: 'oracle_price', asset: stringField(v, 'asset') };
+        case 'literal_address':
+            return { kind: 'literal_address', value: stringField(v, 'value') };
+        case 'literal_i128':
+            return { kind: 'literal_i128', value: stringField(v, 'value') };
+        case 'literal_symbol':
+            return { kind: 'literal_symbol', value: stringField(v, 'value') };
+        case 'literal_u32':
+            return { kind: 'literal_u32', value: numberField(v, 'value') };
+        case 'literal_u64':
+            return { kind: 'literal_u64', value: stringField(v, 'value') };
+        case 'literal_bytes':
+            return { kind: 'literal_bytes', value: stringField(v, 'value') };
+        case 'literal_vec':
+            return { kind: 'literal_vec', elements: arrayOf(v.elements, jsonToLeaf) };
+        default:
+            throw new Error(`unknown leaf kind: ${String(v.kind)}`);
+    }
+}
+function numberField(v, key) {
+    const x = v[key];
+    if (typeof x !== 'number' || !Number.isInteger(x))
+        throw new Error(`field ${key} must be an integer`);
+    return x;
+}
+function stringField(v, key) {
+    const x = v[key];
+    if (typeof x !== 'string')
+        throw new Error(`field ${key} must be a string`);
+    return x;
+}

package/dist-cjs/predicate/index.d.ts

@@ -1 +1,3 @@
+export { decodeLeaf, decodeNode, decodePredicate } from './decode.ts';
 export { type EncodedPredicate, encodePredicate } from './encode.ts';
+export { jsonToAst } from './from-json.ts';

package/dist-cjs/predicate/index.js

@@ -1,6 +1,14 @@
 "use strict";
-// src/predicate/index.ts - re-export the canonical predicate encoder.
+// src/predicate/index.ts - re-export the canonical predicate encoder and the
+// untrusted-JSON parser that feeds it. A consumer accepting a hand-written
+// policy needs both halves.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encodePredicate = void 0;
+exports.jsonToAst = exports.encodePredicate = exports.decodePredicate = exports.decodeNode = exports.decodeLeaf = void 0;
+var decode_ts_1 = require("./decode.js");
+Object.defineProperty(exports, "decodeLeaf", { enumerable: true, get: function () { return decode_ts_1.decodeLeaf; } });
+Object.defineProperty(exports, "decodeNode", { enumerable: true, get: function () { return decode_ts_1.decodeNode; } });
+Object.defineProperty(exports, "decodePredicate", { enumerable: true, get: function () { return decode_ts_1.decodePredicate; } });
 var encode_ts_1 = require("./encode.js");
 Object.defineProperty(exports, "encodePredicate", { enumerable: true, get: function () { return encode_ts_1.encodePredicate; } });
+var from_json_ts_1 = require("./from-json.js");
+Object.defineProperty(exports, "jsonToAst", { enumerable: true, get: function () { return from_json_ts_1.jsonToAst; } });

package/dist-cjs/registry/identify.js

@@ -17,6 +17,13 @@
 //   3. SoroSwap: recognised by ADDRESS only - the router is a single pinned
 //      contract. FIX 4: the method must ALSO be present in the protocol's
 //      ABI; an unknown method on a pinned router -> null (fail-closed).
+//   4. OZ smart-account: recognised by INTERFACE - the user-facing context
+//      rule entrypoints (`batch_add_signer` / `batch_remove_signer` /
+//      `add_context_rule` / `remove_context_rule`) have a fixed (fn, args)
+//      shape across every OZ multisig deployment. Pinned per-deployment
+//      addresses are impossible (every user deploys their own smart
+//      account), so interface recognition is the only viable path - same
+//      reasoning SEP-41 uses for any token address.
 //
 // Method lookup uses `Object.hasOwn` rather than `in` so prototype-chain
 // names like `constructor`, `toString`, `hasOwnProperty` do NOT register as
@@ -49,7 +56,19 @@ function identifyProtocol(contract, method, args, network) {
         }
         return null;
     }
-    // 3) Pinned-address recognition (Blend factory + SoroSwap router/factory).
+    // 3) OpenZeppelin smart-account by interface. The four context-rule
+    //    entrypoints have a fixed (fn, args) shape across every OZ
+    //    multisig deployment. `__check_auth` is private (host-invoked)
+    //    and is intentionally NOT in this ABI - the recogniser only
+    //    claims OZ for the public surface.
+    if (Object.hasOwn(protocols_ts_1.OZ_ACCOUNT_ABI, method)) {
+        const sig = protocols_ts_1.OZ_ACCOUNT_ABI[method];
+        if (sig && argsMatchAbi(sig.args, args)) {
+            return { protocol: 'oz_account', fn: method };
+        }
+        return null;
+    }
+    // 4) Pinned-address recognition (Blend factory + SoroSwap router/factory).
     //    FIX 4: the method must also be in the protocol's ABI; an unknown
     //    method on a pinned address -> null.
     if (network) {

package/dist-cjs/registry/protocols.d.ts

@@ -1,5 +1,5 @@
 import type { ScVal } from '../types.ts';
-export type ProtocolId = 'sep41' | 'blend' | 'soroswap';
+export type ProtocolId = 'sep41' | 'blend' | 'soroswap' | 'oz_account';
 /** ScVal subset type vocabulary the ABI uses. Mirrors `ScVal['type']` minus
  *  `other` (which by definition cannot be matched against an ABI arg). */
 export type AbiArgType = Exclude<ScVal['type'], 'other'>;
@@ -34,5 +34,54 @@ export declare const BLEND_ABI: ProtocolAbi;
  *  `vec<address>` - we record it as the outer `vec` subset and leave the
  *  per-element shape to the downstream reviewer. */
 export declare const SOROSWAP_ABI: ProtocolAbi;
+/** OpenZeppelin smart-account ABI subset.
+ *
+ *  Why this lives in the recogniser: every user's smart account has a
+ *  different C-address, so a per-deployment pin would never cover them.
+ *  What is the same across every OpenZeppelin multisig account is the
+ *  small set of public context-rule entrypoints. A recording that
+ *  invokes `batch_add_signer(u32, vec<signer>)` on an arbitrary contract
+ *  is overwhelmingly likely to be calling the user's own OpenZeppelin
+ *  smart account (the canonical reason this product exists); we
+ *  recognise that pattern by interface, the same way SEP-41 is
+ *  recognised by interface.
+ *
+ *  SECURITY PROPERTY (load-bearing):
+ *   - Recognition claims the call TARGETS a particular protocol. We
+ *     only claim `oz_account` when the (fn, args) shape uniquely matches
+ *     one of the three entrypoints below AND the call looks like a real
+ *     context-rule operation. The match is exact: off-by-one arg count,
+ *     off-by-one arg type, or a method name close-but-wrong returns null
+ *     (fail-closed). A contract that incidentally happens to expose a
+ *     single matching fn is not sufficient - the recorder requires ALL
+ *     invocations to individually match, so a hostile contract with
+ *     exactly one matching fn would still contribute to the unknown
+ *     bucket for any other calls.
+ *   - We do NOT claim `oz_account` for unknown calls, for arg-shape
+ *     mismatches, or for calls where the recorder could not pin down
+ *     the (fn, args) shape. The freshness gate then runs at the same
+ *     1.0 threshold - lowering the gate for unknown protocols remains
+ *     a separate, opt-in production override (see RecordInput below).
+ *
+ *  ABI source: packages/policy-interpreter/tests/fixtures/multisig_account_example.wasm,
+ *  pinned from the OpenZeppelin Reloaded `multisig_account_example`
+ *  contract (commit ef82b65, fetched 2026-07-28).
+ *
+ *  SCOPE NOTE: this ABI only covers the three entrypoints whose args
+ *  map cleanly onto the normalised `AbiArgType` vocabulary (u32, vec,
+ *  ...). `add_context_rule` - the install path - takes `(Symbol,
+ *  String, Option<u32>, Vec<SignerKey>, Map<Address, Val>)`. The
+ *  `String`, `Option<u32>` (`scvVoid`), and `Map<...>` arg types are
+ *  not in the AbiArgType set today (the recogniser's `argsMatchAbi`
+ *  helper rejects `other` deliberately so a close-but-wrong call does
+ *  not slip through). Excluding `add_context_rule` is the right
+ *  trade-off for now - it never blocks OZ smart-account recognition,
+ *  because the install tx always follows a recognised
+ *  `batch_add_signer` (the demo's first-pass tx), so the
+ *  contract still ends up in `knownContracts`. Updating the Arg type
+ *  vocabulary to cover these shapes is a separate concern (and would
+ *  also lift the SEP-41 / Blend recognition in the same change).
+ */
+export declare const OZ_ACCOUNT_ABI: ProtocolAbi;
 export declare const PROTOCOL_ABIS: Record<ProtocolId, ProtocolAbi>;
 export declare function getAbi(protocol: ProtocolId): ProtocolAbi;

package/dist-cjs/registry/protocols.js

@@ -18,7 +18,7 @@
 // fails closed: a method call whose decoded args do NOT match the ABI
 // signature is treated as unknown.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROTOCOL_ABIS = exports.SOROSWAP_ABI = exports.BLEND_ABI = exports.SEP41_ABI = void 0;
+exports.PROTOCOL_ABIS = exports.OZ_ACCOUNT_ABI = exports.SOROSWAP_ABI = exports.BLEND_ABI = exports.SEP41_ABI = void 0;
 exports.getAbi = getAbi;
 /** SEP-41 token interface - pinned from the SEP-41 spec (any token). */
 exports.SEP41_ABI = {
@@ -143,10 +143,98 @@ exports.SOROSWAP_ABI = {
         ],
     },
 };
+/** OpenZeppelin smart-account ABI subset.
+ *
+ *  Why this lives in the recogniser: every user's smart account has a
+ *  different C-address, so a per-deployment pin would never cover them.
+ *  What is the same across every OpenZeppelin multisig account is the
+ *  small set of public context-rule entrypoints. A recording that
+ *  invokes `batch_add_signer(u32, vec<signer>)` on an arbitrary contract
+ *  is overwhelmingly likely to be calling the user's own OpenZeppelin
+ *  smart account (the canonical reason this product exists); we
+ *  recognise that pattern by interface, the same way SEP-41 is
+ *  recognised by interface.
+ *
+ *  SECURITY PROPERTY (load-bearing):
+ *   - Recognition claims the call TARGETS a particular protocol. We
+ *     only claim `oz_account` when the (fn, args) shape uniquely matches
+ *     one of the three entrypoints below AND the call looks like a real
+ *     context-rule operation. The match is exact: off-by-one arg count,
+ *     off-by-one arg type, or a method name close-but-wrong returns null
+ *     (fail-closed). A contract that incidentally happens to expose a
+ *     single matching fn is not sufficient - the recorder requires ALL
+ *     invocations to individually match, so a hostile contract with
+ *     exactly one matching fn would still contribute to the unknown
+ *     bucket for any other calls.
+ *   - We do NOT claim `oz_account` for unknown calls, for arg-shape
+ *     mismatches, or for calls where the recorder could not pin down
+ *     the (fn, args) shape. The freshness gate then runs at the same
+ *     1.0 threshold - lowering the gate for unknown protocols remains
+ *     a separate, opt-in production override (see RecordInput below).
+ *
+ *  ABI source: packages/policy-interpreter/tests/fixtures/multisig_account_example.wasm,
+ *  pinned from the OpenZeppelin Reloaded `multisig_account_example`
+ *  contract (commit ef82b65, fetched 2026-07-28).
+ *
+ *  SCOPE NOTE: this ABI only covers the three entrypoints whose args
+ *  map cleanly onto the normalised `AbiArgType` vocabulary (u32, vec,
+ *  ...). `add_context_rule` - the install path - takes `(Symbol,
+ *  String, Option<u32>, Vec<SignerKey>, Map<Address, Val>)`. The
+ *  `String`, `Option<u32>` (`scvVoid`), and `Map<...>` arg types are
+ *  not in the AbiArgType set today (the recogniser's `argsMatchAbi`
+ *  helper rejects `other` deliberately so a close-but-wrong call does
+ *  not slip through). Excluding `add_context_rule` is the right
+ *  trade-off for now - it never blocks OZ smart-account recognition,
+ *  because the install tx always follows a recognised
+ *  `batch_add_signer` (the demo's first-pass tx), so the
+ *  contract still ends up in `knownContracts`. Updating the Arg type
+ *  vocabulary to cover these shapes is a separate concern (and would
+ *  also lift the SEP-41 / Blend recognition in the same change).
+ */
+exports.OZ_ACCOUNT_ABI = {
+    batch_add_signer: {
+        args: [
+            {
+                name: 'context_rule_id',
+                type: 'u32',
+                meaning: 'OZ context rule id this signer is added to',
+            },
+            {
+                name: 'signers',
+                type: 'vec',
+                meaning: 'vec<SignerKey> signers to add (Delegated G-address or Account C-address)',
+            },
+        ],
+    },
+    batch_remove_signer: {
+        args: [
+            {
+                name: 'context_rule_id',
+                type: 'u32',
+                meaning: 'OZ context rule id to remove signers from',
+            },
+            {
+                name: 'signers',
+                type: 'vec',
+                meaning: 'vec<SignerKey> signers to remove from the rule',
+            },
+        ],
+    },
+    remove_context_rule: {
+        args: [
+            {
+                name: 'context_rule_id',
+                type: 'u32',
+                meaning: 'OZ context rule id to delete',
+            },
+        ],
+    },
+};
 exports.PROTOCOL_ABIS = {
     sep41: exports.SEP41_ABI,
     blend: exports.BLEND_ABI,
     soroswap: exports.SOROSWAP_ABI,
+    oz_account: exports.OZ_ACCOUNT_ABI,
 };
 function getAbi(protocol) {
     return exports.PROTOCOL_ABIS[protocol];

package/dist-cjs/review-card/builder.d.ts

@@ -12,3 +12,16 @@ export interface ReviewCardSummary {
 /** Build a deterministic review-card summary from a policy + context rule +
  *  simulation result. Pure: same inputs -> byte-identical output. */
 export declare function buildReviewCardSummary(predicate: PredicateNode | null, policyRefs: PolicyRef[], contextRule: ContextRuleDraft, simulation: SimulationResult): ReviewCardSummary;
+/** Walk every comparison / membership node of the predicate and invoke
+ *  `visit` on each. The walk is depth-first, left-to-right, so the
+ *  constraint list is stable across runs. Pure boolean nodes contribute no
+ *  constraint lines themselves; their leaf children do, via the visitor. */
+/** Every constraint sentence for one predicate, in walk order.
+ *
+ *  `buildReviewCardSummary` renders a policy the synthesiser just PRODUCED,
+ *  and needs the refs / context rule / simulation to do it. This renders a
+ *  predicate on its own, which is what a caller holding a policy already
+ *  INSTALLED on chain has: it can read the document out of the interpreter's
+ *  storage and decode it, but there is no proposal around it. Same renderers,
+ *  so an installed rule reads exactly as it did on the review card. */
+export declare function describePredicate(predicate: PredicateNode): string[];

package/dist-cjs/review-card/builder.js

@@ -17,7 +17,7 @@
 //
 //   2. The interpreter `PredicateNode`. One string per constraint leaf,
 //      rendered by enclosing-comparison kind. Templates (Task 7b):
-//        - invocation_count_in_window <= N    -> Invocations <= N per <window> seconds
+//        - invocation_count_in_window < N     -> At most N calls per <window> seconds
 //        - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
 //        - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
 //        - oracle_price(asset) OP price       -> Only when oracle_price(asset) OP price
@@ -31,6 +31,7 @@
 // hash. There is no clock; the hash never includes a timestamp.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildReviewCardSummary = buildReviewCardSummary;
+exports.describePredicate = describePredicate;
 const node_crypto_1 = require("node:crypto");
 /** Build a deterministic review-card summary from a policy + context rule +
  *  simulation result. Pure: same inputs -> byte-identical output. */
@@ -84,6 +85,23 @@ function renderOzPrimitive(ref) {
  *  `visit` on each. The walk is depth-first, left-to-right, so the
  *  constraint list is stable across runs. Pure boolean nodes contribute no
  *  constraint lines themselves; their leaf children do, via the visitor. */
+/** Every constraint sentence for one predicate, in walk order.
+ *
+ *  `buildReviewCardSummary` renders a policy the synthesiser just PRODUCED,
+ *  and needs the refs / context rule / simulation to do it. This renders a
+ *  predicate on its own, which is what a caller holding a policy already
+ *  INSTALLED on chain has: it can read the document out of the interpreter's
+ *  storage and decode it, but there is no proposal around it. Same renderers,
+ *  so an installed rule reads exactly as it did on the review card. */
+function describePredicate(predicate) {
+    const constraints = [];
+    walkPredicate(predicate, (node) => {
+        const line = renderConstraint(node);
+        if (line !== null)
+            constraints.push(line);
+    });
+    return constraints;
+}
 function walkPredicate(node, visit) {
     switch (node.op) {
         case 'and':
@@ -171,17 +189,52 @@ function renderComparison(node) {
             return `${head} ${sep} [${right.elements.map(renderVecElement).join(', ')}]`;
         }
     }
-    // invocation_count_in_window <= N -> Invocations <= N per <window> seconds
+    // The bound is compared against the calls ALREADY made in the window, so
+    // `< N` permits N of them and `<= N` permits one more. Report how many
+    // calls the rule allows rather than restating the comparison.
     if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        return `Invocations <= ${right.value} per ${left.windowSecs} seconds`;
+        const allowed = node.op === 'lt' ? right.value : right.value + 1;
+        return `At most ${allowed} calls per ${left.windowSecs} seconds`;
+    }
+    // OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>
+    //
+    // The per-call cap. It has to be here because the `amount` template below
+    // is unreachable for an interpreter policy: `amount` is deliberately not in
+    // the contract's grammar (dsl.rs - the interpreter sees one authorized
+    // call, not the transaction's token movements), so a predicate using it is
+    // refused at install. A bound on the call's own amount ARGUMENT is how a
+    // cap is actually written, and it was rendering nothing at all - the card
+    // silently understated the policy.
+    //
+    // Placed after the literal_vec case above so an exact-sequence `eq` still
+    // reads as a path rather than as a comparison.
+    if (left.kind === 'call_arg') {
+        const head = `arg[${left.index}]`;
+        const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
+        if (right.kind === 'literal_i128')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u64')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u32')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_address')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_symbol')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_bytes')
+            return `${head} ${sep} ${right.value}`;
+        // call_arg_scaled is the slippage floor and reads as itself.
+        if (right.kind === 'call_arg_scaled') {
+            return `${head} >= arg[${right.index}] * ${right.num}/${right.den}`;
+        }
     }
     // amount <= v -> Amount <= v
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         return `Amount <= ${right.value}`;
     }
     // oracle_price(asset) OP price -> Only when oracle_price(asset) OP price
-    if (left.kind === 'oracle_price' && right.kind === 'literal_i128') {
-        return `Only when oracle_price(${left.asset}) ${comparisonOpText(node.op)} ${right.value}`;
+    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
+        return `Only when oracle_price(${left.asset}) ${comparisonOpText(node.op)} ${right.value} (${right.decimals} dp)`;
     }
     // Any other comparison shape is a structural fail-closed: do not surface
     // a misleading line. Cross-check still requires every leaf produce a
@@ -219,6 +272,7 @@ function renderVecElement(leaf) {
         case 'call_arg':
         case 'call_arg_len':
         case 'call_arg_field':
+        case 'call_arg_scaled':
         case 'amount':
         case 'window_spent':
         case 'now':
@@ -226,6 +280,11 @@ function renderVecElement(leaf) {
         case 'invocation_count_in_window':
         case 'oracle_price':
             return `<${leaf.kind}>`;
+        // Show the declared basis, not just the digits. A threshold on the wrong
+        // basis is the one policy error the contract cannot detect, so the review
+        // card is where a human has to be able to see it.
+        case 'oracle_threshold':
+            return `${leaf.value} (${leaf.decimals} dp)`;
     }
 }
 function renderHaystackElement(leaf) {