@crediolabs/policy-synth 0.1.10 → 0.1.12

package/dist-cjs/review-card/cross-check.js

@@ -108,16 +108,39 @@ function pushComparison(left, right, op, out) {
             return;
         }
     }
+    // Mirrors the builder's wording byte-for-byte: how many calls the rule
+    // permits, since the bound counts the calls already made.
     if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        out.push(`Invocations <= ${right.value} per ${left.windowSecs} seconds`);
+        const allowed = op === 'lt' ? right.value : right.value + 1;
+        out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`);
         return;
     }
+    // Mirrors the builder's per-call cap line. Both sides must render the same
+    // string: cross-check compares the summary against the predicate, so a
+    // shape only ONE of them renders would read as a dropped constraint.
+    if (left.kind === 'call_arg') {
+        const head = `arg[${left.index}]`;
+        const sep = op === 'eq' ? '=' : comparisonOpText(op);
+        if (right.kind === 'literal_i128' ||
+            right.kind === 'literal_u64' ||
+            right.kind === 'literal_u32' ||
+            right.kind === 'literal_address' ||
+            right.kind === 'literal_symbol' ||
+            right.kind === 'literal_bytes') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'call_arg_scaled') {
+            out.push(`${head} >= arg[${right.index}] * ${right.num}/${right.den}`);
+            return;
+        }
+    }
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         out.push(`Amount <= ${right.value}`);
         return;
     }
-    if (left.kind === 'oracle_price' && right.kind === 'literal_i128') {
-        out.push(`Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value}`);
+    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
+        out.push(`Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value} (${right.decimals} dp)`);
         return;
     }
 }
@@ -148,6 +171,7 @@ function renderVecElement(leaf) {
         case 'call_arg':
         case 'call_arg_len':
         case 'call_arg_field':
+        case 'call_arg_scaled':
         case 'amount':
         case 'window_spent':
         case 'now':
@@ -155,6 +179,11 @@ function renderVecElement(leaf) {
         case 'invocation_count_in_window':
         case 'oracle_price':
             return `<${leaf.kind}>`;
+        // Show the declared basis, not just the digits. A threshold on the wrong
+        // basis is the one policy error the contract cannot detect, so the review
+        // card is where a human has to be able to see it.
+        case 'oracle_threshold':
+            return `${leaf.value} (${leaf.decimals} dp)`;
     }
 }
 function renderHaystackElement(leaf) {

package/dist-cjs/review-card/index.d.ts

@@ -1,3 +1,3 @@
-export { buildReviewCardSummary, type ReviewCardSummary, } from './builder.ts';
+export { buildReviewCardSummary, describePredicate, type ReviewCardSummary, } from './builder.ts';
 export { type ConflictAnnotation, classifyConflict, type RuleRef, } from './conflict.ts';
 export { summaryCrossCheck } from './cross-check.ts';

package/dist-cjs/review-card/index.js

@@ -1,9 +1,10 @@
 "use strict";
 // src/review-card/index.ts - re-export the deterministic review-card surface.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.summaryCrossCheck = exports.classifyConflict = exports.buildReviewCardSummary = void 0;
+exports.summaryCrossCheck = exports.classifyConflict = exports.describePredicate = exports.buildReviewCardSummary = void 0;
 var builder_ts_1 = require("./builder.js");
 Object.defineProperty(exports, "buildReviewCardSummary", { enumerable: true, get: function () { return builder_ts_1.buildReviewCardSummary; } });
+Object.defineProperty(exports, "describePredicate", { enumerable: true, get: function () { return builder_ts_1.describePredicate; } });
 var conflict_ts_1 = require("./conflict.js");
 Object.defineProperty(exports, "classifyConflict", { enumerable: true, get: function () { return conflict_ts_1.classifyConflict; } });
 var cross_check_ts_1 = require("./cross-check.js");

package/dist-cjs/run/schemas.d.ts

@@ -1093,13 +1093,13 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;
@@ -1158,13 +1158,13 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;
@@ -1750,13 +1750,13 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;
@@ -1815,13 +1815,13 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;

package/dist-cjs/synth/compose-from-recording.d.ts

@@ -8,6 +8,10 @@ export interface OraclePriceBound {
     asset: string;
     operator: IRCompOp;
     value: string;
+    /** Decimal basis `value` is written on. REQUIRED: oracle prices normalise to
+     *  9 dp, and a threshold silently assumed to share that basis is what let a
+     *  raw 14-dp bound permit everything. The author states it; we convert. */
+    decimals: number;
 }
 /** Caller-supplied answers to the ambiguity prompts. Every numeric bound the
  *  synth might apply must come from here - the recording supplies observed
@@ -27,6 +31,20 @@ export interface ComposeUserResponses {
      *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
      *  entries on the same asset emit multiple leaves. */
     oraclePriceBound?: OraclePriceBound[];
+    /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
+     *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
+     *  slippage floor bounding the output arg against the input arg of the same
+     *  call.
+     *
+     *  REQUIRED to be supplied by the caller: it is never derived from the
+     *  recording. The recorded in/out pair is a price at one moment, and
+     *  freezing it as policy would deny ordinary trades as soon as the rate
+     *  moves. Absent, no floor is emitted and the existing unbounded-output
+     *  warning stands. */
+    swapMinOutRatio?: {
+        num: string;
+        den: string;
+    };
     /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
      *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
      *  pin. Absent -> the recipient is pinned to the recorded value (mirroring

package/dist-cjs/synth/compose-from-recording.js

@@ -108,11 +108,17 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
                         value: limit,
                     },
                 };
-                if (!interpreterEnabled || token === scopeContract) {
-                    ozConstraints.push(spendCond);
-                }
-                else {
-                    interpreterConstraints.push(spendCond);
+                // A rolling spend cap always goes to OZ, whose `spending_limit` is the
+                // audited implementation. The interpreter is NOT a fallback for the
+                // token != scopeContract case: on chain it sees one authorized call,
+                // not the transaction's token movements, so it has no per-call amount
+                // to accumulate and the counter would never move. OZ reports the case
+                // it cannot cover (it pins the limit to the context contract), which
+                // is the honest outcome - the old fallback produced an interpreter
+                // predicate that silently never bound.
+                ozConstraints.push(spendCond);
+                if (interpreterEnabled && token !== scopeContract) {
+                    warnings.push(`rolling spend cap on ${token} cannot be enforced on chain: OZ spending_limit pins the limit to the context contract, and the interpreter cannot observe token movements. Bound the per-call value with an argument cap plus an invocation-count limit instead.`);
                 }
             }
         }
@@ -137,7 +143,10 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
                 op: 'compare',
                 compare: {
                     selector: { kind: 'invocation_count', windowSeconds },
-                    operator: 'lte',
+                    // `lt`, not `lte`: the leaf reports the calls ALREADY made in the
+                    // window, so `< N` is what permits N of them. With `lte` a limit
+                    // of N let an N+1th call through.
+                    operator: 'lt',
                     value: String(invocationLimit),
                 },
             };
@@ -168,6 +177,7 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
                     selector: { kind: 'oracle_price', asset: b.asset },
                     operator: b.operator,
                     value: b.value,
+                    valueDecimals: b.decimals,
                 },
             };
             if (interpreterEnabled) {
@@ -190,7 +200,7 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
         // the window_spent path above already consumed the limit, so the per-call
         // arg cap is skipped to avoid binding one limit to two different semantics.
         const swapInputAmountCap = spendTokens.length === 0 ? limitAmount : undefined;
-        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled);
+        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, opts.userResponses?.swapMinOutRatio, interpreterEnabled);
     }
     // `scope.method` is carried on BOTH IRs so each adapter produces a
     // self-consistent rule. The interpreter adapter lowers scope.method into a
@@ -232,7 +242,7 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
  *  SoroSwap's slippage / oracle / exact-path needs come from `userResponses`
  *  (oraclePriceBound + limitAmount) + the recorded path (eq_seq on
  *  call_arg[2]). */
-function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled) {
+function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, swapMinOutRatio, interpreterEnabled) {
     // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
     // a single-element allowlist; the interpreter adapter lowers it to `in`.
     // When interpreter is not enabled, route to OZ so the caller sees today's
@@ -303,8 +313,15 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             });
             for (let i = 0; i < elements.length; i++) {
                 const element = elements[i];
-                if (!element || element.type !== 'map')
+                // An element we cannot bind leaves that request's action, asset and
+                // amount free while the length pin makes the policy LOOK total. The
+                // length pin still stays (it is a real restriction, and dropping it
+                // would only widen the policy) - what must not happen is dropping the
+                // element quietly.
+                if (element?.type !== 'map') {
+                    warnings.push(`Blend submit requests element ${i} is not a Request map (recorded as ${element?.type ?? 'nothing'}): its request_type, address and amount are NOT pinned, so any action on any asset for any amount is permitted in that position`);
                     continue;
+                }
                 const fields = element.value;
                 const fieldValue = (name, scalarType) => {
                     const entry = fields.find((e) => e.key === name);
@@ -321,8 +338,17 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
                 const address = fieldValue('address', 'address');
                 const amount = fieldValue('amount', 'i128');
                 const requestType = fieldValue('request_type', 'u32');
-                if (address === null || amount === null || requestType === null)
+                if (address === null || amount === null || requestType === null) {
+                    const missing = [
+                        requestType === null ? 'request_type (u32)' : null,
+                        address === null ? 'address' : null,
+                        amount === null ? 'amount (i128)' : null,
+                    ].filter((f) => f !== null);
+                    // Partial pins are deliberately NOT emitted (see the note above): a
+                    // half-pinned request reads as a bound one on the review card.
+                    warnings.push(`Blend submit requests element ${i} could not be bound: ${missing.join(', ')} missing or of an unexpected type. That request's request_type, address and amount are NOT pinned, so any action on any asset for any amount is permitted in that position`);
                     continue;
+                }
                 interpreterConstraints.push({
                     op: 'compare',
                     compare: {
@@ -424,6 +450,30 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
                 ozConstraints.push(cond);
             }
         }
+        // Slippage floor: `out >= in * num/den`. Only when the caller supplied the
+        // ratio - see `swapMinOutRatio`. Without it the output arg stays free,
+        // which is the case the unbounded-swap warning above describes.
+        const outMinArgIndex = soroswapMinOutArgIndex(protocol.fn);
+        const minOutRatio = swapMinOutRatio;
+        if (minOutRatio !== undefined &&
+            inputArgIndex !== undefined &&
+            outMinArgIndex !== undefined &&
+            inputAmountArg &&
+            inputAmountArg.type === 'i128') {
+            const floor = {
+                op: 'slippage_floor',
+                outArgIndex: outMinArgIndex,
+                inArgIndex: inputArgIndex,
+                num: minOutRatio.num,
+                den: minOutRatio.den,
+            };
+            if (interpreterEnabled) {
+                interpreterConstraints.push(floor);
+            }
+            else {
+                ozConstraints.push(floor);
+            }
+        }
         // Swap recipient (call_arg[3]): when the caller supplies
         // swapRecipientAllowlist, emit it as an `in` constraint on the recipient
         // arg. When absent, PIN the recipient to the recorded value - mirroring the
@@ -468,6 +518,21 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
  *  the exact input as arg[0]; `swap_tokens_for_exact_tokens` takes the maximum
  *  input (`amount_in_max`) as arg[1] - its arg[0] is the exact OUTPUT. Any other
  *  function has no positional input-amount argument -> undefined (no cap bound). */
+/** The argument carrying the swap's MINIMUM ACCEPTABLE OUTPUT.
+ *
+ *  Only the exact-input entrypoints have one: `swap_tokens_for_exact_tokens`
+ *  fixes the output and varies the input, so its output needs no floor (its
+ *  arg[1] is `amount_in_max`, already bounded by the input cap). Returning
+ *  undefined there keeps a floor from being pinned to the wrong argument. */
+function soroswapMinOutArgIndex(fn) {
+    switch (fn) {
+        case 'swap_exact_tokens_for_tokens':
+        case 'swap_exact_in_for_tokens':
+            return 1;
+        default:
+            return undefined;
+    }
+}
 function soroswapInputAmountArgIndex(fn) {
     switch (fn) {
         case 'swap_exact_tokens_for_tokens':

package/dist-cjs/synth/deny-cases.d.ts

@@ -1,4 +1,4 @@
-import type { PredicateNode } from '../types.ts';
+import type { PredicateNode, ScVal } from '../types.ts';
 import type { EvalContext } from './evaluate.ts';
 export interface DenyCase {
     dimension: string;
@@ -20,3 +20,6 @@ export { ORIGINAL_DIMENSIONS, OVERPERMISSIVE_DIMENSIONS };
  *                     are emitted. The synth pipeline passes ORIGINAL_DIMENSIONS so
  *                     existing fixtures do not regress. */
 export declare function generateCases(predicate: PredicateNode, permitCtx: EvalContext, dimensions?: string[]): GeneratedCases;
+/** Deep-copy an ScVal so a mutation cannot alias the recorded call.
+ *  Exported so the permit-context builder shares this one implementation. */
+export declare function cloneScVal(value: ScVal, depth?: number): ScVal;

package/dist-cjs/synth/deny-cases.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OVERPERMISSIVE_DIMENSIONS = exports.ORIGINAL_DIMENSIONS = void 0;
 exports.generateCases = generateCases;
+exports.cloneScVal = cloneScVal;
 const types_ts_1 = require("../types.js");
 const predicate_literals_ts_1 = require("./predicate-literals.js");
 const ORACLE_CASES = [
@@ -481,6 +482,8 @@ function cloneContext(ctx) {
         cloned.signerWeights = { ...ctx.signerWeights };
     return cloned;
 }
+/** Deep-copy an ScVal so a mutation cannot alias the recorded call.
+ *  Exported so the permit-context builder shares this one implementation. */
 function cloneScVal(value, depth = 0) {
     // Recursion is bounded by MAX_SCVAL_CLONE_DEPTH so a hand-crafted nested-vec
     // payload cannot RangeError the JS stack during deny-case mutation. Over-depth

package/dist-cjs/synth/evaluate.js

@@ -32,6 +32,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluate = evaluate;
 const predicate_literals_ts_1 = require("./predicate-literals.js");
+/** Oracle prices normalise to this many decimals; mirrors NORMALISED_DECIMALS
+ *  in oracle.rs. A threshold on any other basis must say so. */
+const NORMALISED_DECIMALS = 9;
+/** Mirrors MAX_ORACLE_THRESHOLD_DECIMALS in dsl.rs. */
+const MAX_ORACLE_THRESHOLD_DECIMALS = 18;
 /** Internal fatal thrown by the oracle path; caught at the top of `evaluate`
  *  and converted to the matching `ORACLE_*` deny reason. NOT a
  *  boolean-false that `not` / `or` could mask. */
@@ -168,6 +173,13 @@ function evalCompare(op, left, right, ctx) {
     }
     // --- step 4b: call_arg comparison (eq / exact-vec, or an ordered numeric bound) ---
     if (left.kind === 'call_arg') {
+        // The swap's canonical form is `call_arg[out] >= call_arg_scaled(in, num, den)`.
+        // Dispatched here so the floor's dedicated reason codes (ARITHMETIC_OVERFLOW
+        // -> SLIPPAGE_FLOOR) reach the user; routing the scaled RHS through the
+        // generic `evalArgOrderedCompare` would mask overflow as ARG_MISMATCH.
+        if (right.kind === 'call_arg_scaled') {
+            return evalScaledArgCompare(op, left, right, ctx);
+        }
         const actual = ctx.args[left.index];
         // An ordered comparison (lt/lte/gt/gte) reads the arg as an integer and
         // compares it to a numeric literal via BigInt (e.g. a SoroSwap input-amount
@@ -178,6 +190,11 @@ function evalCompare(op, left, right, ctx) {
             return evalArgOrderedCompare(op, actual, right);
         return evalArgEq(op, actual, right, ctx);
     }
+    // --- step 4b': scaled leaf on the LEFT (`call_arg_scaled(in, num, den) <= call_arg[out]`).
+    // Symmetric form so a policy that phrases the floor either way works.
+    if (left.kind === 'call_arg_scaled') {
+        return evalScaledArgCompare(op, right, left, ctx);
+    }
     // --- step 4c: call_arg_len: the length of a vec-typed argument as a u32.
     // Fails closed on a non-vec arg, an absent arg, or a non-u32 literal.
     if (left.kind === 'call_arg_len') {
@@ -296,6 +313,102 @@ function evalArgEq(op, actual, right, ctx) {
         return { permit: false, reason: 'ARG_MISMATCH' };
     return { permit: false, reason: 'ARG_MISMATCH' };
 }
+/** Step 4b': slippage-floor comparison. Mirrors the Rust `eval_scaled_arg_compare`
+ *  path: the scaled leaf is `args[index] * num / den` (truncating toward
+ *  zero). On `checked_mul` / `checked_div` failure (overflow or
+ *  divide-by-zero) the comparison denies with `ARITHMETIC_OVERFLOW`. A
+ *  failed comparison denies with `SLIPPAGE_FLOOR` (the dedicated reason)
+ *  rather than the generic `ARG_MISMATCH`.
+ *
+ *  `left` is whichever side of the compare is NOT the scaled leaf. A
+ *  scaled-on-scaled compare denies `ARG_MISMATCH` (pipelining two scaled
+ *  leaves has no definable semantics). The other operand must be a
+ *  numeric shape (`call_arg` carrying a number, or a numeric literal);
+ *  anything else is `ARG_MISMATCH`. */
+function evalScaledArgCompare(op, left, right, ctx) {
+    // Identify which side is scaled, and pull the other side as a number.
+    let scaled;
+    let other;
+    let scaledOnRight;
+    if (left.kind === 'call_arg_scaled') {
+        scaled = left;
+        other = right;
+        scaledOnRight = false;
+    }
+    else if (right.kind === 'call_arg_scaled') {
+        scaled = right;
+        other = left;
+        scaledOnRight = true;
+    }
+    else {
+        // Neither side is scaled - this is a programming error in the
+        // dispatcher; the contract returns ARG_MISMATCH to fail closed.
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    }
+    // Source `args[index]` -> BigInt. An out-of-bounds index or a
+    // non-numeric arg fails closed as ARG_MISMATCH (not SLIPPAGE_FLOOR) -
+    // a violated floor is the wrong code when the operand itself could
+    // not be read.
+    if (scaled.index >= ctx.args.length) {
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    }
+    const input = argNumericBigInt(ctx.args[scaled.index]);
+    if (input === null)
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    let num;
+    let den;
+    try {
+        num = BigInt(scaled.num);
+        den = BigInt(scaled.den);
+    }
+    catch {
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    }
+    // Install refuses `den == 0` and `num <= 0` / `den <= 0`. The runtime
+    // check is a defensive belt-and-braces - a future validator
+    // regression cannot panic the frame on a divide-by-zero.
+    if (den === 0n)
+        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
+    const product = input * num;
+    // BigInt overflow is silent in JS (it does not throw on multiplication).
+    // We can detect over-range by dividing and checking the result against
+    // i128 bounds, but the more practical check is whether the result
+    // divides cleanly. We rely on BigInt's arbitrary precision and then
+    // surface ARITHMETIC_OVERFLOW if the result is outside i128.
+    let scaledValue;
+    try {
+        // BigInt division truncates toward zero (matches Rust `i128::checked_div`).
+        scaledValue = product / den;
+    }
+    catch {
+        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
+    }
+    // i128 range check: if the scaled value is outside i128, the contract
+    // would have wrapped on i128 arithmetic; surface the same deny.
+    const I128_MAX = (1n << 127n) - 1n;
+    const I128_MIN = -(1n << 127n);
+    if (scaledValue > I128_MAX || scaledValue < I128_MIN) {
+        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
+    }
+    // Resolving the operand when the scaled side is on the right: the
+    // operand is `left`; the scaled value is the RHS. The AST order is
+    // `left <op> scaled`, so the comparator applies to `other <op> scaled`.
+    // When the scaled side is on the left, the order is `scaled <op> other`,
+    // i.e. `scaled <op> other_val`.
+    let otherVal;
+    if (other.kind === 'call_arg') {
+        otherVal = argNumericBigInt(ctx.args[other.index]);
+    }
+    else {
+        otherVal = (0, predicate_literals_ts_1.literalNumericBigInt)(other);
+    }
+    if (otherVal === null)
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    const pass = scaledOnRight
+        ? bigintCmp(op, otherVal.toString(), scaledValue.toString())
+        : bigintCmp(op, scaledValue.toString(), otherVal.toString());
+    return pass ? { permit: true } : { permit: false, reason: 'SLIPPAGE_FLOOR' };
+}
 /** Ordered numeric comparison (lt/lte/gt/gte) on a `call_arg`. The interpreter
  *  reads the arg as an integer (i128 / u64 / u32 on the recorder's ScVal
  *  surface) and compares it to a numeric literal via BigInt. A non-numeric arg
@@ -392,6 +505,7 @@ function resolveLeaf(leaf, ctx) {
         case 'invocation_count_in_window':
         case 'now':
         case 'valid_until':
+        case 'call_arg_scaled':
             return undefined; // selector leaves with no ScVal projection
         case 'literal_address':
             return { type: 'address', value: leaf.value };
@@ -450,10 +564,23 @@ function evalOracleCompare(op, asset, right, ctx) {
             throw new OracleError('ORACLE_STALE');
         throw new OracleError(mapped);
     }
-    const literal = right.kind === 'literal_i128' ? right.value : null;
-    if (literal === null)
+    // Mirrors eval_oracle_compare in dsl.rs. The threshold MUST declare its
+    // decimal basis: prices are on the normalised 9-dp basis, and assuming a
+    // bare literal shares it is what let a raw 14-dp threshold permit
+    // everything. A bare literal is refused rather than assumed.
+    if (right.kind !== 'oracle_threshold')
         throw new OracleError('ORACLE_DECIMALS_MISMATCH');
-    return bigintCmp(op, entry.price, literal)
+    if (right.decimals > MAX_ORACLE_THRESHOLD_DECIMALS) {
+        throw new OracleError('ORACLE_THRESHOLD_DECIMALS_OUT_OF_RANGE');
+    }
+    // Scale BOTH sides up to the wider basis rather than dividing the threshold
+    // down: dividing truncates, and a truncated bound moves the permit boundary.
+    const decimals = BigInt(right.decimals);
+    const normalised = BigInt(NORMALISED_DECIMALS);
+    const common = decimals > normalised ? decimals : normalised;
+    const priceScaled = BigInt(entry.price) * 10n ** (common - normalised);
+    const literalScaled = BigInt(right.value) * 10n ** (common - decimals);
+    return bigintCmp(op, String(priceScaled), String(literalScaled))
         ? { permit: true }
         : { permit: false, reason: 'FN_MISMATCH' };
 }

package/dist-cjs/synth/permit-context.d.ts

@@ -0,0 +1,15 @@
+import type { PredicateNode, RecordedTransaction } from '../types.ts';
+import type { EvalContext } from './evaluate.ts';
+export interface PermitContextResponses {
+    windowSeconds: number;
+    invocationLimit?: number;
+    limitAmount?: string;
+    validUntilLedger: number;
+    oraclePriceBound?: Array<{
+        asset: string;
+        operator: string;
+        value: string;
+        decimals: number;
+    }>;
+}
+export declare function buildPermitContext(tx: RecordedTransaction, responses: PermitContextResponses, predicate: PredicateNode): EvalContext;

package/dist-cjs/synth/permit-context.js

@@ -0,0 +1,119 @@
+"use strict";
+// src/synth/permit-context.ts - build the EvalContext that represents the
+// recorded call being replayed.
+//
+// Extracted from the over-permissiveness harness so the same construction
+// feeds both the in-process battery and the on-chain replay
+// (scripts/verify-mutations-testnet.ts). Two callers building this
+// separately would be two chances to disagree about what "the recorded
+// call" means, which is the one thing both must share.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPermitContext = buildPermitContext;
+const deny_cases_ts_1 = require("./deny-cases.js");
+function buildPermitContext(tx, responses, predicate) {
+    const amountByToken = {};
+    const totals = new Map();
+    for (const m of tx.tokenMovements) {
+        const current = totals.get(m.token) ?? 0n;
+        totals.set(m.token, current + BigInt(m.amount));
+    }
+    for (const [token, total] of totals) {
+        amountByToken[token] = total.toString();
+    }
+    const topLevel = tx.invocations[0];
+    const scopeContract = topLevel?.contract ?? '';
+    const oraclePriceByAsset = {};
+    visitOracleLeaves(predicate, (asset, op, bound) => {
+        let price;
+        switch (op) {
+            case 'lt':
+                price = bound - 1n;
+                break;
+            case 'gt':
+                price = bound + 1n;
+                break;
+            default:
+                price = bound;
+        }
+        if (price < 0n)
+            price = 0n;
+        oraclePriceByAsset[asset] = { price: price.toString(), timestampSeconds: tx.fetchedAt };
+    });
+    const ctx = {
+        contract: scopeContract,
+        fn: topLevel?.fn ?? '',
+        args: (topLevel?.args ?? []).map(deny_cases_ts_1.cloneScVal),
+        atLedger: tx.ledgerSequence,
+        nowSeconds: tx.fetchedAt,
+        amountByToken,
+        windowSpentByToken: {},
+        invocationCountByWindow: {},
+        oraclePriceByAsset,
+    };
+    if (responses.validUntilLedger !== undefined) {
+        ctx.validUntilLedger = responses.validUntilLedger;
+    }
+    return ctx;
+}
+function visitOracleLeaves(node, visit) {
+    switch (node.op) {
+        case 'and':
+        case 'or':
+            for (const child of node.children)
+                visitOracleLeaves(child, visit);
+            return;
+        case 'not':
+            visitOracleLeaves(node.child, visit);
+            return;
+        case 'eq':
+        case 'lt':
+        case 'lte':
+        case 'gt':
+        case 'gte': {
+            const leftIsOracle = node.left.kind === 'oracle_price';
+            const rightIsOracle = node.right.kind === 'oracle_price';
+            let asset;
+            let literal;
+            if (leftIsOracle) {
+                asset = node.left.kind === 'oracle_price' ? node.left.asset : undefined;
+                literal = oracleThresholdNormalised(node.right);
+            }
+            else if (rightIsOracle) {
+                asset = node.right.kind === 'oracle_price' ? node.right.asset : undefined;
+                literal = oracleThresholdNormalised(node.left);
+            }
+            if (asset !== undefined && literal !== undefined) {
+                visit(asset, node.op, literal);
+            }
+            return;
+        }
+        case 'in':
+            return;
+    }
+}
+/** Oracle prices normalise to 9 decimals; mirrors NORMALISED_DECIMALS in
+ *  oracle.rs. */
+const NORMALISED_DECIMALS = 9n;
+/** A threshold restated on the normalised basis, so a derived permit price is
+ *  comparable to it. Thresholds carry their own basis, so the conversion has
+ *  to happen here - reading the digits raw would build a context off by a
+ *  factor of 10^(decimals-9). Returns undefined for any other leaf. */
+function oracleThresholdNormalised(leaf) {
+    if (leaf.kind !== 'oracle_threshold')
+        return undefined;
+    let value;
+    try {
+        value = BigInt(leaf.value);
+    }
+    catch {
+        return undefined;
+    }
+    const decimals = BigInt(leaf.decimals);
+    if (decimals <= NORMALISED_DECIMALS) {
+        return value * 10n ** (NORMALISED_DECIMALS - decimals);
+    }
+    // Floor: a finer-grained threshold has no exact 9-dp representation. The
+    // caller only needs a price that lands on the right side of the bound, and
+    // it offsets by one from here.
+    return value / 10n ** (decimals - NORMALISED_DECIMALS);
+}