@crediolabs/policy-synth 0.1.11 → 0.1.12

package/dist/adapters/interpreter/adapter.js

@@ -218,6 +218,9 @@ function lowerRule(rule, config) {
  *  by `lowerRule` to populate `uncovered` before lowering. */
 function unsupportedConstruct(cond) {
     switch (cond.op) {
+        // Expressible: `call_arg_scaled` is exactly this construct.
+        case 'slippage_floor':
+            return null;
         case 'in':
             // The oracle position rule is a hard error and must be raised before a
             // construct can be written off as uncovered - otherwise a subtree that
@@ -281,6 +284,20 @@ function unsourceableSelector(s) {
  *  address -> SCOPE_SELF_CALL). */
 function lowerCondition(cond, config) {
     switch (cond.op) {
+        // `out >= in * num/den`. The contract refuses den == 0 or a non-positive
+        // ratio at install, so a malformed floor fails loudly rather than
+        // silently inverting the comparison.
+        case 'slippage_floor':
+            return {
+                op: 'gte',
+                left: { kind: 'call_arg', index: cond.outArgIndex },
+                right: {
+                    kind: 'call_arg_scaled',
+                    index: cond.inArgIndex,
+                    num: cond.num,
+                    den: cond.den,
+                },
+            };
         case 'and':
             return { op: 'and', children: cond.children.map((c) => lowerCondition(c, config)) };
         case 'or':
@@ -458,6 +475,8 @@ function assertNoOracleDescendants(node) {
 }
 function containsOracle(node) {
     switch (node.op) {
+        case 'slippage_floor':
+            return false;
         case 'compare':
             return node.compare.selector.kind === 'oracle_price';
         case 'in':
@@ -496,6 +515,8 @@ function assertOracleParamsTighten(params) {
  *  express. Mirrors the OZ adapter's `describeCondition` for parity. */
 function describeCondition(cond) {
     switch (cond.op) {
+        case 'slippage_floor':
+            return `slippage floor: arg[${cond.outArgIndex}] >= arg[${cond.inArgIndex}] * ${cond.num}/${cond.den}`;
         case 'in':
             return `value allowlist on ${describeSelector(cond.selector)} (predicate DSL)`;
         case 'eq_seq':

package/dist/adapters/oz/adapter.js

@@ -207,6 +207,10 @@ function matchSpendingLimit(c) {
  *  cannot express, used to populate `uncovered`. */
 function describeCondition(cond) {
     switch (cond.op) {
+        case 'slippage_floor':
+            // The OZ primitives bound a value against a constant; this bounds one
+            // call argument against another, which none of them can express.
+            return `slippage floor on arg[${cond.outArgIndex}] (OZ built-ins cannot bound one argument against another)`;
         case 'in':
             return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`;
         case 'eq_seq':

package/dist/ir/types.d.ts

@@ -85,6 +85,25 @@ export type IRCondition = {
     op: 'eq_seq';
     selector: IRSelector;
     values: string[];
+}
+/** A swap's output floor, expressed against its own input: the output arg
+ *  must be at least `inArgIndex * num / den`.
+ *
+ *  It is its own construct because `compare` bounds a selector against a
+ *  CONSTANT, and a slippage floor has no constant to bound against - the
+ *  acceptable output depends on the input of the same call. Encoding the
+ *  recorded output as a constant would pin a policy to one trade size.
+ *
+ *  `num/den` is the caller's minimum acceptable output per unit of input.
+ *  It is never derived from the recording: the recorded rate is a price at
+ *  one moment, and freezing it as policy would deny normal trades later.
+ *  Adapters that cannot express it (the OZ built-ins) flag it `uncovered`. */
+ | {
+    op: 'slippage_floor';
+    outArgIndex: number;
+    inArgIndex: number;
+    num: string;
+    den: string;
 };
 export interface IRPolicyRule {
     /** NEAR-V2 roles whitelist (empty = any; owner exempt). */

package/dist/predicate/index.d.ts

@@ -1,3 +1,3 @@
-export { type EncodedPredicate, encodePredicate } from './encode.ts';
 export { decodeLeaf, decodeNode, decodePredicate } from './decode.ts';
+export { type EncodedPredicate, encodePredicate } from './encode.ts';
 export { jsonToAst } from './from-json.ts';

package/dist/predicate/index.js

@@ -1,6 +1,6 @@
 // src/predicate/index.ts - re-export the canonical predicate encoder and the
 // untrusted-JSON parser that feeds it. A consumer accepting a hand-written
 // policy needs both halves.
-export { encodePredicate } from "./encode.js";
 export { decodeLeaf, decodeNode, decodePredicate } from "./decode.js";
+export { encodePredicate } from "./encode.js";
 export { jsonToAst } from "./from-json.js";

package/dist/review-card/builder.js

@@ -192,6 +192,38 @@ function renderComparison(node) {
         const allowed = node.op === 'lt' ? right.value : right.value + 1;
         return `At most ${allowed} calls per ${left.windowSecs} seconds`;
     }
+    // OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>
+    //
+    // The per-call cap. It has to be here because the `amount` template below
+    // is unreachable for an interpreter policy: `amount` is deliberately not in
+    // the contract's grammar (dsl.rs - the interpreter sees one authorized
+    // call, not the transaction's token movements), so a predicate using it is
+    // refused at install. A bound on the call's own amount ARGUMENT is how a
+    // cap is actually written, and it was rendering nothing at all - the card
+    // silently understated the policy.
+    //
+    // Placed after the literal_vec case above so an exact-sequence `eq` still
+    // reads as a path rather than as a comparison.
+    if (left.kind === 'call_arg') {
+        const head = `arg[${left.index}]`;
+        const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
+        if (right.kind === 'literal_i128')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u64')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u32')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_address')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_symbol')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_bytes')
+            return `${head} ${sep} ${right.value}`;
+        // call_arg_scaled is the slippage floor and reads as itself.
+        if (right.kind === 'call_arg_scaled') {
+            return `${head} >= arg[${right.index}] * ${right.num}/${right.den}`;
+        }
+    }
     // amount <= v -> Amount <= v
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         return `Amount <= ${right.value}`;

package/dist/review-card/cross-check.js

@@ -112,6 +112,26 @@ function pushComparison(left, right, op, out) {
         out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`);
         return;
     }
+    // Mirrors the builder's per-call cap line. Both sides must render the same
+    // string: cross-check compares the summary against the predicate, so a
+    // shape only ONE of them renders would read as a dropped constraint.
+    if (left.kind === 'call_arg') {
+        const head = `arg[${left.index}]`;
+        const sep = op === 'eq' ? '=' : comparisonOpText(op);
+        if (right.kind === 'literal_i128' ||
+            right.kind === 'literal_u64' ||
+            right.kind === 'literal_u32' ||
+            right.kind === 'literal_address' ||
+            right.kind === 'literal_symbol' ||
+            right.kind === 'literal_bytes') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'call_arg_scaled') {
+            out.push(`${head} >= arg[${right.index}] * ${right.num}/${right.den}`);
+            return;
+        }
+    }
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         out.push(`Amount <= ${right.value}`);
         return;

package/dist/synth/compose-from-recording.d.ts

@@ -31,6 +31,20 @@ export interface ComposeUserResponses {
      *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
      *  entries on the same asset emit multiple leaves. */
     oraclePriceBound?: OraclePriceBound[];
+    /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
+     *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
+     *  slippage floor bounding the output arg against the input arg of the same
+     *  call.
+     *
+     *  REQUIRED to be supplied by the caller: it is never derived from the
+     *  recording. The recorded in/out pair is a price at one moment, and
+     *  freezing it as policy would deny ordinary trades as soon as the rate
+     *  moves. Absent, no floor is emitted and the existing unbounded-output
+     *  warning stands. */
+    swapMinOutRatio?: {
+        num: string;
+        den: string;
+    };
     /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
      *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
      *  pin. Absent -> the recipient is pinned to the recorded value (mirroring

package/dist/synth/compose-from-recording.js

@@ -197,7 +197,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
         // the window_spent path above already consumed the limit, so the per-call
         // arg cap is skipped to avoid binding one limit to two different semantics.
         const swapInputAmountCap = spendTokens.length === 0 ? limitAmount : undefined;
-        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled);
+        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, opts.userResponses?.swapMinOutRatio, interpreterEnabled);
     }
     // `scope.method` is carried on BOTH IRs so each adapter produces a
     // self-consistent rule. The interpreter adapter lowers scope.method into a
@@ -239,7 +239,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
  *  SoroSwap's slippage / oracle / exact-path needs come from `userResponses`
  *  (oraclePriceBound + limitAmount) + the recorded path (eq_seq on
  *  call_arg[2]). */
-function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled) {
+function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, swapMinOutRatio, interpreterEnabled) {
     // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
     // a single-element allowlist; the interpreter adapter lowers it to `in`.
     // When interpreter is not enabled, route to OZ so the caller sees today's
@@ -447,6 +447,30 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
                 ozConstraints.push(cond);
             }
         }
+        // Slippage floor: `out >= in * num/den`. Only when the caller supplied the
+        // ratio - see `swapMinOutRatio`. Without it the output arg stays free,
+        // which is the case the unbounded-swap warning above describes.
+        const outMinArgIndex = soroswapMinOutArgIndex(protocol.fn);
+        const minOutRatio = swapMinOutRatio;
+        if (minOutRatio !== undefined &&
+            inputArgIndex !== undefined &&
+            outMinArgIndex !== undefined &&
+            inputAmountArg &&
+            inputAmountArg.type === 'i128') {
+            const floor = {
+                op: 'slippage_floor',
+                outArgIndex: outMinArgIndex,
+                inArgIndex: inputArgIndex,
+                num: minOutRatio.num,
+                den: minOutRatio.den,
+            };
+            if (interpreterEnabled) {
+                interpreterConstraints.push(floor);
+            }
+            else {
+                ozConstraints.push(floor);
+            }
+        }
         // Swap recipient (call_arg[3]): when the caller supplies
         // swapRecipientAllowlist, emit it as an `in` constraint on the recipient
         // arg. When absent, PIN the recipient to the recorded value - mirroring the
@@ -491,6 +515,21 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
  *  the exact input as arg[0]; `swap_tokens_for_exact_tokens` takes the maximum
  *  input (`amount_in_max`) as arg[1] - its arg[0] is the exact OUTPUT. Any other
  *  function has no positional input-amount argument -> undefined (no cap bound). */
+/** The argument carrying the swap's MINIMUM ACCEPTABLE OUTPUT.
+ *
+ *  Only the exact-input entrypoints have one: `swap_tokens_for_exact_tokens`
+ *  fixes the output and varies the input, so its output needs no floor (its
+ *  arg[1] is `amount_in_max`, already bounded by the input cap). Returning
+ *  undefined there keeps a floor from being pinned to the wrong argument. */
+function soroswapMinOutArgIndex(fn) {
+    switch (fn) {
+        case 'swap_exact_tokens_for_tokens':
+        case 'swap_exact_in_for_tokens':
+            return 1;
+        default:
+            return undefined;
+    }
+}
 function soroswapInputAmountArgIndex(fn) {
     switch (fn) {
         case 'swap_exact_tokens_for_tokens':

package/dist-cjs/adapters/interpreter/adapter.js

@@ -223,6 +223,9 @@ function lowerRule(rule, config) {
  *  by `lowerRule` to populate `uncovered` before lowering. */
 function unsupportedConstruct(cond) {
     switch (cond.op) {
+        // Expressible: `call_arg_scaled` is exactly this construct.
+        case 'slippage_floor':
+            return null;
         case 'in':
             // The oracle position rule is a hard error and must be raised before a
             // construct can be written off as uncovered - otherwise a subtree that
@@ -286,6 +289,20 @@ function unsourceableSelector(s) {
  *  address -> SCOPE_SELF_CALL). */
 function lowerCondition(cond, config) {
     switch (cond.op) {
+        // `out >= in * num/den`. The contract refuses den == 0 or a non-positive
+        // ratio at install, so a malformed floor fails loudly rather than
+        // silently inverting the comparison.
+        case 'slippage_floor':
+            return {
+                op: 'gte',
+                left: { kind: 'call_arg', index: cond.outArgIndex },
+                right: {
+                    kind: 'call_arg_scaled',
+                    index: cond.inArgIndex,
+                    num: cond.num,
+                    den: cond.den,
+                },
+            };
         case 'and':
             return { op: 'and', children: cond.children.map((c) => lowerCondition(c, config)) };
         case 'or':
@@ -463,6 +480,8 @@ function assertNoOracleDescendants(node) {
 }
 function containsOracle(node) {
     switch (node.op) {
+        case 'slippage_floor':
+            return false;
         case 'compare':
             return node.compare.selector.kind === 'oracle_price';
         case 'in':
@@ -501,6 +520,8 @@ function assertOracleParamsTighten(params) {
  *  express. Mirrors the OZ adapter's `describeCondition` for parity. */
 function describeCondition(cond) {
     switch (cond.op) {
+        case 'slippage_floor':
+            return `slippage floor: arg[${cond.outArgIndex}] >= arg[${cond.inArgIndex}] * ${cond.num}/${cond.den}`;
         case 'in':
             return `value allowlist on ${describeSelector(cond.selector)} (predicate DSL)`;
         case 'eq_seq':

package/dist-cjs/adapters/oz/adapter.js

@@ -212,6 +212,10 @@ function matchSpendingLimit(c) {
  *  cannot express, used to populate `uncovered`. */
 function describeCondition(cond) {
     switch (cond.op) {
+        case 'slippage_floor':
+            // The OZ primitives bound a value against a constant; this bounds one
+            // call argument against another, which none of them can express.
+            return `slippage floor on arg[${cond.outArgIndex}] (OZ built-ins cannot bound one argument against another)`;
         case 'in':
             return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`;
         case 'eq_seq':

package/dist-cjs/ir/types.d.ts

@@ -85,6 +85,25 @@ export type IRCondition = {
     op: 'eq_seq';
     selector: IRSelector;
     values: string[];
+}
+/** A swap's output floor, expressed against its own input: the output arg
+ *  must be at least `inArgIndex * num / den`.
+ *
+ *  It is its own construct because `compare` bounds a selector against a
+ *  CONSTANT, and a slippage floor has no constant to bound against - the
+ *  acceptable output depends on the input of the same call. Encoding the
+ *  recorded output as a constant would pin a policy to one trade size.
+ *
+ *  `num/den` is the caller's minimum acceptable output per unit of input.
+ *  It is never derived from the recording: the recorded rate is a price at
+ *  one moment, and freezing it as policy would deny normal trades later.
+ *  Adapters that cannot express it (the OZ built-ins) flag it `uncovered`. */
+ | {
+    op: 'slippage_floor';
+    outArgIndex: number;
+    inArgIndex: number;
+    num: string;
+    den: string;
 };
 export interface IRPolicyRule {
     /** NEAR-V2 roles whitelist (empty = any; owner exempt). */

package/dist-cjs/predicate/index.d.ts

@@ -1,3 +1,3 @@
-export { type EncodedPredicate, encodePredicate } from './encode.ts';
 export { decodeLeaf, decodeNode, decodePredicate } from './decode.ts';
+export { type EncodedPredicate, encodePredicate } from './encode.ts';
 export { jsonToAst } from './from-json.ts';

package/dist-cjs/predicate/index.js

@@ -3,12 +3,12 @@
 // untrusted-JSON parser that feeds it. A consumer accepting a hand-written
 // policy needs both halves.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.jsonToAst = exports.decodePredicate = exports.decodeNode = exports.decodeLeaf = exports.encodePredicate = void 0;
-var encode_ts_1 = require("./encode.js");
-Object.defineProperty(exports, "encodePredicate", { enumerable: true, get: function () { return encode_ts_1.encodePredicate; } });
+exports.jsonToAst = exports.encodePredicate = exports.decodePredicate = exports.decodeNode = exports.decodeLeaf = void 0;
 var decode_ts_1 = require("./decode.js");
 Object.defineProperty(exports, "decodeLeaf", { enumerable: true, get: function () { return decode_ts_1.decodeLeaf; } });
 Object.defineProperty(exports, "decodeNode", { enumerable: true, get: function () { return decode_ts_1.decodeNode; } });
 Object.defineProperty(exports, "decodePredicate", { enumerable: true, get: function () { return decode_ts_1.decodePredicate; } });
+var encode_ts_1 = require("./encode.js");
+Object.defineProperty(exports, "encodePredicate", { enumerable: true, get: function () { return encode_ts_1.encodePredicate; } });
 var from_json_ts_1 = require("./from-json.js");
 Object.defineProperty(exports, "jsonToAst", { enumerable: true, get: function () { return from_json_ts_1.jsonToAst; } });

package/dist-cjs/review-card/builder.js

@@ -196,6 +196,38 @@ function renderComparison(node) {
         const allowed = node.op === 'lt' ? right.value : right.value + 1;
         return `At most ${allowed} calls per ${left.windowSecs} seconds`;
     }
+    // OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>
+    //
+    // The per-call cap. It has to be here because the `amount` template below
+    // is unreachable for an interpreter policy: `amount` is deliberately not in
+    // the contract's grammar (dsl.rs - the interpreter sees one authorized
+    // call, not the transaction's token movements), so a predicate using it is
+    // refused at install. A bound on the call's own amount ARGUMENT is how a
+    // cap is actually written, and it was rendering nothing at all - the card
+    // silently understated the policy.
+    //
+    // Placed after the literal_vec case above so an exact-sequence `eq` still
+    // reads as a path rather than as a comparison.
+    if (left.kind === 'call_arg') {
+        const head = `arg[${left.index}]`;
+        const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
+        if (right.kind === 'literal_i128')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u64')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u32')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_address')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_symbol')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_bytes')
+            return `${head} ${sep} ${right.value}`;
+        // call_arg_scaled is the slippage floor and reads as itself.
+        if (right.kind === 'call_arg_scaled') {
+            return `${head} >= arg[${right.index}] * ${right.num}/${right.den}`;
+        }
+    }
     // amount <= v -> Amount <= v
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         return `Amount <= ${right.value}`;

package/dist-cjs/review-card/cross-check.js

@@ -115,6 +115,26 @@ function pushComparison(left, right, op, out) {
         out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`);
         return;
     }
+    // Mirrors the builder's per-call cap line. Both sides must render the same
+    // string: cross-check compares the summary against the predicate, so a
+    // shape only ONE of them renders would read as a dropped constraint.
+    if (left.kind === 'call_arg') {
+        const head = `arg[${left.index}]`;
+        const sep = op === 'eq' ? '=' : comparisonOpText(op);
+        if (right.kind === 'literal_i128' ||
+            right.kind === 'literal_u64' ||
+            right.kind === 'literal_u32' ||
+            right.kind === 'literal_address' ||
+            right.kind === 'literal_symbol' ||
+            right.kind === 'literal_bytes') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'call_arg_scaled') {
+            out.push(`${head} >= arg[${right.index}] * ${right.num}/${right.den}`);
+            return;
+        }
+    }
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         out.push(`Amount <= ${right.value}`);
         return;

package/dist-cjs/synth/compose-from-recording.d.ts

@@ -31,6 +31,20 @@ export interface ComposeUserResponses {
      *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
      *  entries on the same asset emit multiple leaves. */
     oraclePriceBound?: OraclePriceBound[];
+    /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
+     *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
+     *  slippage floor bounding the output arg against the input arg of the same
+     *  call.
+     *
+     *  REQUIRED to be supplied by the caller: it is never derived from the
+     *  recording. The recorded in/out pair is a price at one moment, and
+     *  freezing it as policy would deny ordinary trades as soon as the rate
+     *  moves. Absent, no floor is emitted and the existing unbounded-output
+     *  warning stands. */
+    swapMinOutRatio?: {
+        num: string;
+        den: string;
+    };
     /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
      *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
      *  pin. Absent -> the recipient is pinned to the recorded value (mirroring

package/dist-cjs/synth/compose-from-recording.js

@@ -200,7 +200,7 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
         // the window_spent path above already consumed the limit, so the per-call
         // arg cap is skipped to avoid binding one limit to two different semantics.
         const swapInputAmountCap = spendTokens.length === 0 ? limitAmount : undefined;
-        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled);
+        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, opts.userResponses?.swapMinOutRatio, interpreterEnabled);
     }
     // `scope.method` is carried on BOTH IRs so each adapter produces a
     // self-consistent rule. The interpreter adapter lowers scope.method into a
@@ -242,7 +242,7 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
  *  SoroSwap's slippage / oracle / exact-path needs come from `userResponses`
  *  (oraclePriceBound + limitAmount) + the recorded path (eq_seq on
  *  call_arg[2]). */
-function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled) {
+function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, swapMinOutRatio, interpreterEnabled) {
     // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
     // a single-element allowlist; the interpreter adapter lowers it to `in`.
     // When interpreter is not enabled, route to OZ so the caller sees today's
@@ -450,6 +450,30 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
                 ozConstraints.push(cond);
             }
         }
+        // Slippage floor: `out >= in * num/den`. Only when the caller supplied the
+        // ratio - see `swapMinOutRatio`. Without it the output arg stays free,
+        // which is the case the unbounded-swap warning above describes.
+        const outMinArgIndex = soroswapMinOutArgIndex(protocol.fn);
+        const minOutRatio = swapMinOutRatio;
+        if (minOutRatio !== undefined &&
+            inputArgIndex !== undefined &&
+            outMinArgIndex !== undefined &&
+            inputAmountArg &&
+            inputAmountArg.type === 'i128') {
+            const floor = {
+                op: 'slippage_floor',
+                outArgIndex: outMinArgIndex,
+                inArgIndex: inputArgIndex,
+                num: minOutRatio.num,
+                den: minOutRatio.den,
+            };
+            if (interpreterEnabled) {
+                interpreterConstraints.push(floor);
+            }
+            else {
+                ozConstraints.push(floor);
+            }
+        }
         // Swap recipient (call_arg[3]): when the caller supplies
         // swapRecipientAllowlist, emit it as an `in` constraint on the recipient
         // arg. When absent, PIN the recipient to the recorded value - mirroring the
@@ -494,6 +518,21 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
  *  the exact input as arg[0]; `swap_tokens_for_exact_tokens` takes the maximum
  *  input (`amount_in_max`) as arg[1] - its arg[0] is the exact OUTPUT. Any other
  *  function has no positional input-amount argument -> undefined (no cap bound). */
+/** The argument carrying the swap's MINIMUM ACCEPTABLE OUTPUT.
+ *
+ *  Only the exact-input entrypoints have one: `swap_tokens_for_exact_tokens`
+ *  fixes the output and varies the input, so its output needs no floor (its
+ *  arg[1] is `amount_in_max`, already bounded by the input cap). Returning
+ *  undefined there keeps a floor from being pinned to the wrong argument. */
+function soroswapMinOutArgIndex(fn) {
+    switch (fn) {
+        case 'swap_exact_tokens_for_tokens':
+        case 'swap_exact_in_for_tokens':
+            return 1;
+        default:
+            return undefined;
+    }
+}
 function soroswapInputAmountArgIndex(fn) {
     switch (fn) {
         case 'swap_exact_tokens_for_tokens':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/adapters/interpreter/adapter.ts

@@ -298,6 +298,9 @@ function lowerRule(rule: IRPolicyRule, config: InterpreterAdapterConfig): Lowere
  *  by `lowerRule` to populate `uncovered` before lowering. */
 function unsupportedConstruct(cond: IRCondition): string | null {
   switch (cond.op) {
+    // Expressible: `call_arg_scaled` is exactly this construct.
+    case 'slippage_floor':
+      return null
     case 'in':
       // The oracle position rule is a hard error and must be raised before a
       // construct can be written off as uncovered - otherwise a subtree that
@@ -365,6 +368,20 @@ function unsourceableSelector(s: IRSelector): string | null {
  *  address -> SCOPE_SELF_CALL). */
 function lowerCondition(cond: IRCondition, config: InterpreterAdapterConfig): PredicateNode {
   switch (cond.op) {
+    // `out >= in * num/den`. The contract refuses den == 0 or a non-positive
+    // ratio at install, so a malformed floor fails loudly rather than
+    // silently inverting the comparison.
+    case 'slippage_floor':
+      return {
+        op: 'gte',
+        left: { kind: 'call_arg', index: cond.outArgIndex },
+        right: {
+          kind: 'call_arg_scaled',
+          index: cond.inArgIndex,
+          num: cond.num,
+          den: cond.den,
+        },
+      }
     case 'and':
       return { op: 'and', children: cond.children.map((c) => lowerCondition(c, config)) }
     case 'or':
@@ -563,6 +580,8 @@ function assertNoOracleDescendants(node: IRCondition): void {
 
 function containsOracle(node: IRCondition): boolean {
   switch (node.op) {
+    case 'slippage_floor':
+      return false
     case 'compare':
       return node.compare.selector.kind === 'oracle_price'
     case 'in':
@@ -616,6 +635,8 @@ function assertOracleParamsTighten(params: InterpreterAdapterConfig['oracleParam
  *  express. Mirrors the OZ adapter's `describeCondition` for parity. */
 function describeCondition(cond: IRCondition): string {
   switch (cond.op) {
+    case 'slippage_floor':
+      return `slippage floor: arg[${cond.outArgIndex}] >= arg[${cond.inArgIndex}] * ${cond.num}/${cond.den}`
     case 'in':
       return `value allowlist on ${describeSelector(cond.selector)} (predicate DSL)`
     case 'eq_seq':

package/src/adapters/oz/adapter.ts

@@ -285,6 +285,10 @@ function matchSpendingLimit(c: IRCondition): SpendingLimitMatch | null {
  *  cannot express, used to populate `uncovered`. */
 function describeCondition(cond: IRCondition): string {
   switch (cond.op) {
+    case 'slippage_floor':
+      // The OZ primitives bound a value against a constant; this bounds one
+      // call argument against another, which none of them can express.
+      return `slippage floor on arg[${cond.outArgIndex}] (OZ built-ins cannot bound one argument against another)`
     case 'in':
       return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`
     case 'eq_seq':

package/src/ir/types.ts

@@ -86,6 +86,25 @@ export type IRCondition =
    *  does. Adapters that cannot express an exact ordered vector (OZ built-ins)
    *  flag this as `uncovered` rather than silently dropping it. */
   | { op: 'eq_seq'; selector: IRSelector; values: string[] }
+  /** A swap's output floor, expressed against its own input: the output arg
+   *  must be at least `inArgIndex * num / den`.
+   *
+   *  It is its own construct because `compare` bounds a selector against a
+   *  CONSTANT, and a slippage floor has no constant to bound against - the
+   *  acceptable output depends on the input of the same call. Encoding the
+   *  recorded output as a constant would pin a policy to one trade size.
+   *
+   *  `num/den` is the caller's minimum acceptable output per unit of input.
+   *  It is never derived from the recording: the recorded rate is a price at
+   *  one moment, and freezing it as policy would deny normal trades later.
+   *  Adapters that cannot express it (the OZ built-ins) flag it `uncovered`. */
+  | {
+      op: 'slippage_floor'
+      outArgIndex: number
+      inArgIndex: number
+      num: string
+      den: string
+    }
 
 export interface IRPolicyRule {
   /** NEAR-V2 roles whitelist (empty = any; owner exempt). */

package/src/predicate/index.ts

@@ -2,6 +2,6 @@
 // untrusted-JSON parser that feeds it. A consumer accepting a hand-written
 // policy needs both halves.
 
-export { type EncodedPredicate, encodePredicate } from './encode.ts'
 export { decodeLeaf, decodeNode, decodePredicate } from './decode.ts'
+export { type EncodedPredicate, encodePredicate } from './encode.ts'
 export { jsonToAst } from './from-json.ts'

package/src/review-card/builder.ts

@@ -222,6 +222,33 @@ function renderComparison(
     return `At most ${allowed} calls per ${left.windowSecs} seconds`
   }
 
+  // OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>
+  //
+  // The per-call cap. It has to be here because the `amount` template below
+  // is unreachable for an interpreter policy: `amount` is deliberately not in
+  // the contract's grammar (dsl.rs - the interpreter sees one authorized
+  // call, not the transaction's token movements), so a predicate using it is
+  // refused at install. A bound on the call's own amount ARGUMENT is how a
+  // cap is actually written, and it was rendering nothing at all - the card
+  // silently understated the policy.
+  //
+  // Placed after the literal_vec case above so an exact-sequence `eq` still
+  // reads as a path rather than as a comparison.
+  if (left.kind === 'call_arg') {
+    const head = `arg[${left.index}]`
+    const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op)
+    if (right.kind === 'literal_i128') return `${head} ${sep} ${right.value}`
+    if (right.kind === 'literal_u64') return `${head} ${sep} ${right.value}`
+    if (right.kind === 'literal_u32') return `${head} ${sep} ${right.value}`
+    if (right.kind === 'literal_address') return `${head} ${sep} ${right.value}`
+    if (right.kind === 'literal_symbol') return `${head} ${sep} ${right.value}`
+    if (right.kind === 'literal_bytes') return `${head} ${sep} ${right.value}`
+    // call_arg_scaled is the slippage floor and reads as itself.
+    if (right.kind === 'call_arg_scaled') {
+      return `${head} >= arg[${right.index}] * ${right.num}/${right.den}`
+    }
+  }
+
   // amount <= v -> Amount <= v
   if (left.kind === 'amount' && right.kind === 'literal_i128') {
     return `Amount <= ${right.value}`

package/src/review-card/cross-check.ts

@@ -125,12 +125,36 @@ function pushComparison(
     out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`)
     return
   }
+  // Mirrors the builder's per-call cap line. Both sides must render the same
+  // string: cross-check compares the summary against the predicate, so a
+  // shape only ONE of them renders would read as a dropped constraint.
+  if (left.kind === 'call_arg') {
+    const head = `arg[${left.index}]`
+    const sep = op === 'eq' ? '=' : comparisonOpText(op)
+    if (
+      right.kind === 'literal_i128' ||
+      right.kind === 'literal_u64' ||
+      right.kind === 'literal_u32' ||
+      right.kind === 'literal_address' ||
+      right.kind === 'literal_symbol' ||
+      right.kind === 'literal_bytes'
+    ) {
+      out.push(`${head} ${sep} ${right.value}`)
+      return
+    }
+    if (right.kind === 'call_arg_scaled') {
+      out.push(`${head} >= arg[${right.index}] * ${right.num}/${right.den}`)
+      return
+    }
+  }
   if (left.kind === 'amount' && right.kind === 'literal_i128') {
     out.push(`Amount <= ${right.value}`)
     return
   }
   if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
-    out.push(`Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value} (${right.decimals} dp)`)
+    out.push(
+      `Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value} (${right.decimals} dp)`
+    )
     return
   }
 }

package/src/synth/compose-from-recording.ts

@@ -84,6 +84,17 @@ export interface ComposeUserResponses {
    *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
    *  entries on the same asset emit multiple leaves. */
   oraclePriceBound?: OraclePriceBound[]
+  /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
+   *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
+   *  slippage floor bounding the output arg against the input arg of the same
+   *  call.
+   *
+   *  REQUIRED to be supplied by the caller: it is never derived from the
+   *  recording. The recorded in/out pair is a price at one moment, and
+   *  freezing it as policy would deny ordinary trades as soon as the rate
+   *  moves. Absent, no floor is emitted and the existing unbounded-output
+   *  warning stands. */
+  swapMinOutRatio?: { num: string; den: string }
   /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
    *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
    *  pin. Absent -> the recipient is pinned to the recorded value (mirroring
@@ -294,6 +305,7 @@ export function composeFromRecording(
       protocol,
       opts.userResponses?.swapRecipientAllowlist,
       swapInputAmountCap,
+      opts.userResponses?.swapMinOutRatio,
       interpreterEnabled
     )
   }
@@ -350,6 +362,7 @@ function appendProtocolSpecificConstraints(
   protocol: IdentifiedProtocol,
   swapRecipientAllowlist: string[] | undefined,
   swapInputAmountCap: string | undefined,
+  swapMinOutRatio: { num: string; den: string } | undefined,
   interpreterEnabled: boolean
 ): void {
   // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
@@ -567,6 +580,32 @@ function appendProtocolSpecificConstraints(
       }
     }
 
+    // Slippage floor: `out >= in * num/den`. Only when the caller supplied the
+    // ratio - see `swapMinOutRatio`. Without it the output arg stays free,
+    // which is the case the unbounded-swap warning above describes.
+    const outMinArgIndex = soroswapMinOutArgIndex(protocol.fn)
+    const minOutRatio = swapMinOutRatio
+    if (
+      minOutRatio !== undefined &&
+      inputArgIndex !== undefined &&
+      outMinArgIndex !== undefined &&
+      inputAmountArg &&
+      inputAmountArg.type === 'i128'
+    ) {
+      const floor: IRCondition = {
+        op: 'slippage_floor',
+        outArgIndex: outMinArgIndex,
+        inArgIndex: inputArgIndex,
+        num: minOutRatio.num,
+        den: minOutRatio.den,
+      }
+      if (interpreterEnabled) {
+        interpreterConstraints.push(floor)
+      } else {
+        ozConstraints.push(floor)
+      }
+    }
+
     // Swap recipient (call_arg[3]): when the caller supplies
     // swapRecipientAllowlist, emit it as an `in` constraint on the recipient
     // arg. When absent, PIN the recipient to the recorded value - mirroring the
@@ -610,6 +649,22 @@ function appendProtocolSpecificConstraints(
  *  the exact input as arg[0]; `swap_tokens_for_exact_tokens` takes the maximum
  *  input (`amount_in_max`) as arg[1] - its arg[0] is the exact OUTPUT. Any other
  *  function has no positional input-amount argument -> undefined (no cap bound). */
+/** The argument carrying the swap's MINIMUM ACCEPTABLE OUTPUT.
+ *
+ *  Only the exact-input entrypoints have one: `swap_tokens_for_exact_tokens`
+ *  fixes the output and varies the input, so its output needs no floor (its
+ *  arg[1] is `amount_in_max`, already bounded by the input cap). Returning
+ *  undefined there keeps a floor from being pinned to the wrong argument. */
+function soroswapMinOutArgIndex(fn: string): number | undefined {
+  switch (fn) {
+    case 'swap_exact_tokens_for_tokens':
+    case 'swap_exact_in_for_tokens':
+      return 1
+    default:
+      return undefined
+  }
+}
+
 function soroswapInputAmountArgIndex(fn: string): number | undefined {
   switch (fn) {
     case 'swap_exact_tokens_for_tokens':

package/src/synth/evaluate.ts

@@ -38,7 +38,6 @@ const NORMALISED_DECIMALS = 9
 /** Mirrors MAX_ORACLE_THRESHOLD_DECIMALS in dsl.rs. */
 const MAX_ORACLE_THRESHOLD_DECIMALS = 18
 
-
 export interface EvalContext {
   /** Contract the interpreter is asked to enforce against. */
   contract: string

package/src/synth/permit-context.ts

@@ -10,7 +10,6 @@
 import type { PredicateLeaf, PredicateNode, RecordedTransaction } from '../types.ts'
 import { cloneScVal } from './deny-cases.ts'
 import type { EvalContext } from './evaluate.ts'
-import { literalNumericBigInt } from './predicate-literals.ts'
 
 export interface PermitContextResponses {
   windowSeconds: number