@crediolabs/policy-synth 0.1.11 → 0.1.13

package/dist-cjs/run/schemas.js

@@ -16,7 +16,7 @@
 // imports them here so its tool-shape bindings stay in step; the CLI imports
 // them here so it can build the same args envelope the MCP transport builds.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolErrorSchema = exports.SynthesizePolicyInputSchema = exports.SynthesizePolicyRecordingInputSchema = exports.InterpreterOptionsSchema = exports.SynthesizePolicyMandateInputSchema = exports.RecordTransactionInputSchema = exports.OzAdapterConfigSchema = exports.ComposeUserResponsesSchema = exports.MandateSpecSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
+exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.InstallPolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.DEFAULT_AUTH_VALID_UNTIL_LEDGERS = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.OraclePriceFixtureSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.SynthesizePolicyRecordingInputSchema = exports.InterpreterOptionsSchema = exports.SynthesizePolicyMandateInputSchema = exports.RecordTransactionInputSchema = exports.OzAdapterConfigSchema = exports.ComposeUserResponsesSchema = exports.MandateSpecSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
 const zod_1 = require("zod");
 const address_ts_1 = require("../synth/address.js");
 /** Soroban `valid_until` is a u32 ledger sequence; a value above this cannot be
@@ -222,6 +222,294 @@ exports.SynthesizePolicyInputSchema = zod_1.z.discriminatedUnion('source', [
     exports.SynthesizePolicyMandateInputSchema,
     exports.SynthesizePolicyRecordingInputSchema,
 ]);
+// ===== PredicateNode / PredicateLeaf =====
+//
+// Hand-written zod mirrors of the predicate grammar in types.ts:132-180.
+// Recursive (`and`/`or`/`not` nest), so the schemas use the same
+// `z.lazy` + explicit `z.ZodType<unknown>` annotation that ScValSchema
+// already uses - without the annotation TS's circular type inference
+// breaks the recursive reference. i128-shaped numerics (`num`, `den`)
+// are decimal STRINGS, never JS numbers, matching the on-chain i128
+// convention used everywhere else in this file. The grammar is the
+// single source of truth (types.ts); a drift test in this package
+// asserts the two stay in step.
+/** PredicateLeaf mirrors the core `PredicateLeaf` union. Every variant
+ *  is a `kind` discriminator; literals carry their primitive value inline.
+ *  `literal_vec.elements` is recursive (a vec may contain literals that
+ *  themselves nest) so the leaf schema is lazily self-referential. */
+exports.PredicateLeafSchema = zod_1.z.lazy(() => zod_1.z.union([
+    zod_1.z.object({ kind: zod_1.z.literal('call_contract') }),
+    zod_1.z.object({ kind: zod_1.z.literal('call_fn') }),
+    zod_1.z.object({ kind: zod_1.z.literal('call_arg'), index: zod_1.z.number().int().nonnegative() }),
+    zod_1.z.object({ kind: zod_1.z.literal('call_arg_len'), index: zod_1.z.number().int().nonnegative() }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('call_arg_field'),
+        index: zod_1.z.number().int().nonnegative(),
+        element: zod_1.z.number().int().nonnegative(),
+        field: zod_1.z.string(),
+    }),
+    // num/den are i128 on chain; JSON numbers lose precision past 2^53,
+    // so the wire is a decimal string. The contract refuses `den == 0` and
+    // `num <= 0` / `den <= 0` at install (types.ts:162-163 + the install
+    // gate); mirroring that bound here closes the gap where simulate /
+    // verify green-light a policy the install gate will reject. The
+    // positive-only regex is the cheapest unambiguous check.
+    zod_1.z.object({
+        kind: zod_1.z.literal('call_arg_scaled'),
+        index: zod_1.z.number().int().nonnegative(),
+        num: zod_1.z.string().regex(/^[1-9][0-9]*$/),
+        den: zod_1.z.string().regex(/^[1-9][0-9]*$/),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('amount'), token: zod_1.z.string() }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('window_spent'),
+        token: zod_1.z.string(),
+        windowSeconds: zod_1.z.number().int().positive(),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('now') }),
+    zod_1.z.object({ kind: zod_1.z.literal('valid_until') }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('invocation_count_in_window'),
+        windowSecs: zod_1.z.number().int().positive(),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('oracle_price'), asset: zod_1.z.string() }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('oracle_threshold'),
+        value: zod_1.z.string().regex(/^-?[0-9]+$/),
+        decimals: zod_1.z.number().int().nonnegative(),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_address'), value: zod_1.z.string() }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_i128'), value: zod_1.z.string().regex(/^-?[0-9]+$/) }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_symbol'), value: zod_1.z.string() }),
+    // `literal_u32` is u32 on chain. A negative value would wrap, and a
+    // value above U32_MAX would be refused at the encode boundary
+    // anyway. Bound at the schema so the wire cannot carry a value the
+    // contract will reject.
+    zod_1.z.object({
+        kind: zod_1.z.literal('literal_u32'),
+        value: zod_1.z.number().int().nonnegative().max(U32_MAX),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_u64'), value: zod_1.z.string().regex(/^[0-9]+$/) }),
+    // `literal_bytes` is hex on chain. `Buffer.from(value, 'hex')` silently
+    // drops non-hex chars AND yields an empty buffer when the whole input
+    // is non-hex - so a user passing 'zzzz' would get a predicate that
+    // compares against empty bytes instead of being rejected. The
+    // strict even-length hex regex closes that gap at the boundary.
+    zod_1.z.object({
+        kind: zod_1.z.literal('literal_bytes'),
+        value: zod_1.z
+            .string()
+            .regex(/^[0-9a-fA-F]*$/)
+            .refine((v) => v.length % 2 === 0, 'must be even-length hex'),
+    }),
+    // elements are themselves PredicateLeaf; lazy to break the cycle.
+    zod_1.z.object({ kind: zod_1.z.literal('literal_vec'), elements: zod_1.z.array(exports.PredicateLeafSchema) }),
+]));
+/** PredicateNode mirrors the core `PredicateNode` union. Recursive through
+ *  `and`/`or`/`not`; the lazy + annotation pattern keeps the recursion
+ *  type-safe. */
+exports.PredicateNodeSchema = zod_1.z.lazy(() => zod_1.z.union([
+    zod_1.z.object({ op: zod_1.z.literal('and'), children: zod_1.z.array(exports.PredicateNodeSchema) }),
+    zod_1.z.object({ op: zod_1.z.literal('or'), children: zod_1.z.array(exports.PredicateNodeSchema) }),
+    zod_1.z.object({ op: zod_1.z.literal('not'), child: exports.PredicateNodeSchema }),
+    zod_1.z.object({
+        op: zod_1.z.literal('eq'),
+        left: exports.PredicateLeafSchema,
+        right: exports.PredicateLeafSchema,
+    }),
+    zod_1.z.object({
+        op: zod_1.z.enum(['lt', 'lte', 'gt', 'gte']),
+        left: exports.PredicateLeafSchema,
+        right: exports.PredicateLeafSchema,
+    }),
+    zod_1.z.object({
+        op: zod_1.z.literal('in'),
+        needle: exports.PredicateLeafSchema,
+        haystack: zod_1.z.array(exports.PredicateLeafSchema),
+    }),
+]));
+// ===== simulate_policy / verify_policy =====
+//
+// The oracle fixture shape mirrors `SimulateOptions` / `VerifyOptions`
+// in packages/policy-synth/src/verify/{simulate,verify}.ts - the same
+// sorted set of error enum values is used by both engines. u32
+// `validUntilLedger` is bounded at the boundary so a hand-crafted
+// payload cannot leak a u32 overflow into the engine's permit context.
+/** Oracle price fixture - mirror of the entry type in `SimulateOptions` /
+ *  `VerifyOptions`. Discriminated by presence of `error` vs `price`. */
+exports.OraclePriceFixtureSchema = zod_1.z.union([
+    zod_1.z.object({
+        price: zod_1.z.string().regex(/^[0-9]+$/),
+        timestampSeconds: zod_1.z.number().int().nonnegative(),
+    }),
+    zod_1.z.object({
+        error: zod_1.z.enum(['stale', 'missing', 'deviation', 'paused', 'decimals', 'fingerprint']),
+    }),
+]);
+exports.SimulatePolicyInputSchema = zod_1.z.object({
+    // simulatePolicy accepts a null predicate (OZ-only policy); verifyPolicy
+    // does not. The asymmetry is mirrored at the schema boundary.
+    predicate: exports.PredicateNodeSchema.nullable(),
+    permitTx: exports.RecordedTransactionSchema,
+    validUntilLedger: zod_1.z.number().int().positive().max(U32_MAX).optional(),
+    oraclePricesByAsset: zod_1.z.record(zod_1.z.string(), exports.OraclePriceFixtureSchema).optional(),
+});
+exports.VerifyPolicyInputSchema = zod_1.z.object({
+    // verifyPolicy requires a non-null predicate; the engine refuses
+    // `null` outright. The schema mirrors that contract.
+    predicate: exports.PredicateNodeSchema,
+    permitTx: exports.RecordedTransactionSchema,
+    validUntilLedger: zod_1.z.number().int().positive().max(U32_MAX).optional(),
+    oraclePricesByAsset: zod_1.z.record(zod_1.z.string(), exports.OraclePriceFixtureSchema).optional(),
+});
+// ===== install_policy / revoke_policy / get_interpreter_info =====
+//
+// The install/revoke pair drives the OZ smart-account admin flow. Both surface
+// unsigned Soroban transaction XDRs (base64) and the tool body NEVER signs:
+// the wallet signature IS the user-confirmation step. See `run/index.ts` for
+// the rationale (no `action_id` two-call pair; the MCP server is stateless).
+//
+// `get_interpreter_info` is a read-only fingerprint lookup. It returns the
+// pinned address + grammar version + wasm hash AND, when requested, runs an
+// optional `grammar_version()` RPC call to check whether the deployed contract
+// matches the pin. A mismatch is worth MORE than a fabricated audit field.
+//
+// All three input schemas live BELOW the MandateSpecSchemaForRule declaration
+// so the const reference there is not in the temporal dead zone (no JS hoisting
+// for `const`).
+/** Minimal rule-draft schema for the install input. Mirrors ContextRuleDraft
+ *  from the core (`types.ts`); we keep this hand-rolled + flat rather than
+ *  importing the recursive discriminated union because the wire shape is
+ *  fixed (the user supplies one rule, not a nested AST). Declared BEFORE
+ *  InstallPolicyInputSchema below so the const reference there is not in
+ *  the temporal dead zone (no JS hoisting for `const`). */
+const MAX_SIGNERS_PER_RULE = 15;
+const MAX_POLICIES_PER_RULE = 5;
+const MandateSpecSchemaForRule = zod_1.z
+    .object({
+    contextRuleType: zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({ kind: zod_1.z.literal('default') }),
+        zod_1.z.object({ kind: zod_1.z.literal('call_contract'), contract: zod_1.z.string() }),
+        zod_1.z.object({ kind: zod_1.z.literal('create_contract'), wasmHash: zod_1.z.string() }),
+    ]),
+    name: zod_1.z.string().min(1),
+    validUntilLedger: zod_1.z.number().int().positive().max(U32_MAX).nullable(),
+    signers: zod_1.z
+        .array(zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({ kind: zod_1.z.literal('delegated'), address: zod_1.z.string() }),
+        zod_1.z.object({
+            kind: zod_1.z.literal('external'),
+            verifier: zod_1.z.string(),
+            keyBytes: zod_1.z.string(),
+        }),
+    ]))
+        .max(MAX_SIGNERS_PER_RULE),
+    policies: zod_1.z
+        .array(zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({
+            kind: zod_1.z.literal('interpreter'),
+            interpreterAddress: zod_1.z.string(),
+            predicateBlobBase64: zod_1.z.string().min(1),
+        }),
+        zod_1.z.object({
+            kind: zod_1.z.literal('oz_builtin'),
+            primitive: zod_1.z.object({
+                primitive: zod_1.z.enum(['spending_limit', 'simple_threshold', 'weighted_threshold']),
+                params: zod_1.z.record(zod_1.z.unknown()),
+            }),
+            instanceAddress: zod_1.z.string(),
+        }),
+    ]))
+        .max(MAX_POLICIES_PER_RULE),
+})
+    .passthrough()
+    .refine((v) => !(v.signers.length === 0 && v.policies.length === 0), 'a rule with no signers and no policies is refused at install (NoSignersAndPolicies)');
+// install/revoke/get_info schemas live HERE (after the helper) so the const
+// reference resolves at module init. They are the new tools on top of the
+// existing four.
+/** Pinned interpreter address (testnet). Mirrors DEPLOYMENTS.md:156-157.
+ *  Single source for the MCP layer; do not embed elsewhere. */
+exports.PINNED_INTERPRETER_TESTNET_ADDRESS = 'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP';
+/** Pinned interpreter wasm sha256 (hex). Mirrors DEPLOYMENTS.md:156-157. */
+exports.PINNED_INTERPRETER_WASM_SHA256 = '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443';
+/** The grammar version the interpreter enforces (matches SELF_VERSION in
+ *  packages/policy-interpreter/src/version.rs). */
+exports.PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
+/** Default Soroban RPC for the install / revoke / info tools. The recorder
+ *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
+ *  than a Server; the two are deliberately different surfaces, so this is
+ *  pinned beside the addresses it is used with rather than shared. */
+exports.TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org';
+/** Soroban `valid_until` window (ledgers) added to the latest ledger when
+ *  building the auth entry. ~25 minutes at 5s/ledger. */
+exports.DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300;
+/** Stellar network passphrases. Pinned here so the XDR envelope uses the
+ *  matching passphrase when the wallet signs (a mismatch yields invalid
+ *  hashes). */
+exports.NETWORK_PASSPHRASES = {
+    testnet: 'Test SDF Network ; September 2015',
+    mainnet: 'Public Global Stellar Network ; September 2015',
+};
+exports.InstallPolicyInputSchema = zod_1.z
+    .object({
+    /** The smart account contract address (C...) that will receive the rule. */
+    smartAccount: zod_1.z.string(),
+    /** The signer that authorises the install (G... wallet). Used only for
+     *  sequence number + auth nonce simulation; never persisted, never signed. */
+    sourceAccount: zod_1.z.string(),
+    /** The proposed rule draft. Mirrors the core `ContextRuleDraft` shape. */
+    rule: MandateSpecSchemaForRule,
+    /** Per-rule install nonce; 1 for a fresh install. */
+    installNonce: zod_1.z.number().int().positive(),
+    /** Optional RPC URL override. Defaults to the public testnet endpoint
+     *  (`TESTNET_RPC_URL`); the override is refused unless
+     *  `allowUnpinnedRpcUrl: true`, because the auth nonce and
+     *  rootInvocation in the response come from whichever RPC answered. */
+    rpcUrl: zod_1.z.string().url().optional(),
+    /** Opt-in to using a non-pinned RPC URL. Without this flag the tool
+     *  refuses any `rpcUrl` other than `TESTNET_RPC_URL` because the
+     *  caller's auth-digest binds to whatever the RPC returned. */
+    allowUnpinnedRpcUrl: zod_1.z.boolean().optional(),
+    /** Opt-in to pointing the rule's interpreter policy at any address
+     *  other than the pinned testnet interpreter. Default-deny: a caller
+     *  that controls the interpreter can permit everything. */
+    allowUnpinnedInterpreter: zod_1.z.boolean().optional(),
+    /** Base fee in stroops; defaults to BASE_FEE (100). */
+    baseFee: zod_1.z.number().int().positive().optional(),
+})
+    .refine((v) => Boolean(v.smartAccount) && Boolean(v.sourceAccount), {
+    message: 'smartAccount and sourceAccount are required',
+});
+exports.RevokePolicyInputSchema = zod_1.z
+    .object({
+    /** The smart account contract address (C...). */
+    smartAccount: zod_1.z.string(),
+    /** The wallet that will sign the removal. The ACCOUNT decides whether it
+     *  accepts that signer; this schema does not assert a rule it cannot
+     *  verify, since the account's source is not in this repo. Proven on
+     *  testnet: the account's deployer can revoke. */
+    sourceAccount: zod_1.z.string(),
+    /** The rule id to remove from the smart account + interpreter. */
+    ruleId: zod_1.z.number().int().nonnegative(),
+    /** Optional RPC URL override; same pin as install. */
+    rpcUrl: zod_1.z.string().url().optional(),
+    /** Opt-in to using a non-pinned RPC URL. Same semantics as install. */
+    allowUnpinnedRpcUrl: zod_1.z.boolean().optional(),
+    /** Base fee in stroops; defaults to BASE_FEE (100). */
+    baseFee: zod_1.z.number().int().positive().optional(),
+})
+    .refine((v) => Boolean(v.smartAccount) && Boolean(v.sourceAccount), {
+    message: 'smartAccount and sourceAccount are required',
+});
+exports.GetInterpreterInfoInputSchema = zod_1.z.object({
+    /** Network to query. The pin differs per network; defaults to testnet. */
+    network: exports.NetworkSchema.optional(),
+    /** When true, perform an optional live `grammar_version()` RPC call to
+     *  verify the deployed contract matches the pin. */
+    verifyLive: zod_1.z.boolean().optional(),
+    /** Optional RPC URL override. */
+    rpcUrl: zod_1.z.string().url().optional(),
+});
 // ===== Error envelope (canonical) =====
 //
 // Mirrors ToolError from packages/policy-synth/src/errors.ts. We use a

package/dist-cjs/synth/compose-from-recording.d.ts

@@ -31,6 +31,20 @@ export interface ComposeUserResponses {
      *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
      *  entries on the same asset emit multiple leaves. */
     oraclePriceBound?: OraclePriceBound[];
+    /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
+     *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
+     *  slippage floor bounding the output arg against the input arg of the same
+     *  call.
+     *
+     *  REQUIRED to be supplied by the caller: it is never derived from the
+     *  recording. The recorded in/out pair is a price at one moment, and
+     *  freezing it as policy would deny ordinary trades as soon as the rate
+     *  moves. Absent, no floor is emitted and the existing unbounded-output
+     *  warning stands. */
+    swapMinOutRatio?: {
+        num: string;
+        den: string;
+    };
     /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
      *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
      *  pin. Absent -> the recipient is pinned to the recorded value (mirroring

package/dist-cjs/synth/compose-from-recording.js

@@ -200,7 +200,7 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
         // the window_spent path above already consumed the limit, so the per-call
         // arg cap is skipped to avoid binding one limit to two different semantics.
         const swapInputAmountCap = spendTokens.length === 0 ? limitAmount : undefined;
-        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled);
+        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, opts.userResponses?.swapMinOutRatio, interpreterEnabled);
     }
     // `scope.method` is carried on BOTH IRs so each adapter produces a
     // self-consistent rule. The interpreter adapter lowers scope.method into a
@@ -242,7 +242,7 @@ function composeFromRecording(facts, scopeContract, topLevel, opts) {
  *  SoroSwap's slippage / oracle / exact-path needs come from `userResponses`
  *  (oraclePriceBound + limitAmount) + the recorded path (eq_seq on
  *  call_arg[2]). */
-function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, interpreterEnabled) {
+function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, swapMinOutRatio, interpreterEnabled) {
     // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
     // a single-element allowlist; the interpreter adapter lowers it to `in`.
     // When interpreter is not enabled, route to OZ so the caller sees today's
@@ -450,6 +450,30 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
                 ozConstraints.push(cond);
             }
         }
+        // Slippage floor: `out >= in * num/den`. Only when the caller supplied the
+        // ratio - see `swapMinOutRatio`. Without it the output arg stays free,
+        // which is the case the unbounded-swap warning above describes.
+        const outMinArgIndex = soroswapMinOutArgIndex(protocol.fn);
+        const minOutRatio = swapMinOutRatio;
+        if (minOutRatio !== undefined &&
+            inputArgIndex !== undefined &&
+            outMinArgIndex !== undefined &&
+            inputAmountArg &&
+            inputAmountArg.type === 'i128') {
+            const floor = {
+                op: 'slippage_floor',
+                outArgIndex: outMinArgIndex,
+                inArgIndex: inputArgIndex,
+                num: minOutRatio.num,
+                den: minOutRatio.den,
+            };
+            if (interpreterEnabled) {
+                interpreterConstraints.push(floor);
+            }
+            else {
+                ozConstraints.push(floor);
+            }
+        }
         // Swap recipient (call_arg[3]): when the caller supplies
         // swapRecipientAllowlist, emit it as an `in` constraint on the recipient
         // arg. When absent, PIN the recipient to the recorded value - mirroring the
@@ -494,6 +518,21 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
  *  the exact input as arg[0]; `swap_tokens_for_exact_tokens` takes the maximum
  *  input (`amount_in_max`) as arg[1] - its arg[0] is the exact OUTPUT. Any other
  *  function has no positional input-amount argument -> undefined (no cap bound). */
+/** The argument carrying the swap's MINIMUM ACCEPTABLE OUTPUT.
+ *
+ *  Only the exact-input entrypoints have one: `swap_tokens_for_exact_tokens`
+ *  fixes the output and varies the input, so its output needs no floor (its
+ *  arg[1] is `amount_in_max`, already bounded by the input cap). Returning
+ *  undefined there keeps a floor from being pinned to the wrong argument. */
+function soroswapMinOutArgIndex(fn) {
+    switch (fn) {
+        case 'swap_exact_tokens_for_tokens':
+        case 'swap_exact_in_for_tokens':
+            return 1;
+        default:
+            return undefined;
+    }
+}
 function soroswapInputAmountArgIndex(fn) {
     switch (fn) {
         case 'swap_exact_tokens_for_tokens':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/adapters/interpreter/adapter.ts

@@ -298,6 +298,9 @@ function lowerRule(rule: IRPolicyRule, config: InterpreterAdapterConfig): Lowere
  *  by `lowerRule` to populate `uncovered` before lowering. */
 function unsupportedConstruct(cond: IRCondition): string | null {
   switch (cond.op) {
+    // Expressible: `call_arg_scaled` is exactly this construct.
+    case 'slippage_floor':
+      return null
     case 'in':
       // The oracle position rule is a hard error and must be raised before a
       // construct can be written off as uncovered - otherwise a subtree that
@@ -365,6 +368,20 @@ function unsourceableSelector(s: IRSelector): string | null {
  *  address -> SCOPE_SELF_CALL). */
 function lowerCondition(cond: IRCondition, config: InterpreterAdapterConfig): PredicateNode {
   switch (cond.op) {
+    // `out >= in * num/den`. The contract refuses den == 0 or a non-positive
+    // ratio at install, so a malformed floor fails loudly rather than
+    // silently inverting the comparison.
+    case 'slippage_floor':
+      return {
+        op: 'gte',
+        left: { kind: 'call_arg', index: cond.outArgIndex },
+        right: {
+          kind: 'call_arg_scaled',
+          index: cond.inArgIndex,
+          num: cond.num,
+          den: cond.den,
+        },
+      }
     case 'and':
       return { op: 'and', children: cond.children.map((c) => lowerCondition(c, config)) }
     case 'or':
@@ -563,6 +580,8 @@ function assertNoOracleDescendants(node: IRCondition): void {
 
 function containsOracle(node: IRCondition): boolean {
   switch (node.op) {
+    case 'slippage_floor':
+      return false
     case 'compare':
       return node.compare.selector.kind === 'oracle_price'
     case 'in':
@@ -616,6 +635,8 @@ function assertOracleParamsTighten(params: InterpreterAdapterConfig['oracleParam
  *  express. Mirrors the OZ adapter's `describeCondition` for parity. */
 function describeCondition(cond: IRCondition): string {
   switch (cond.op) {
+    case 'slippage_floor':
+      return `slippage floor: arg[${cond.outArgIndex}] >= arg[${cond.inArgIndex}] * ${cond.num}/${cond.den}`
     case 'in':
       return `value allowlist on ${describeSelector(cond.selector)} (predicate DSL)`
     case 'eq_seq':

package/src/adapters/oz/adapter.ts

@@ -285,6 +285,10 @@ function matchSpendingLimit(c: IRCondition): SpendingLimitMatch | null {
  *  cannot express, used to populate `uncovered`. */
 function describeCondition(cond: IRCondition): string {
   switch (cond.op) {
+    case 'slippage_floor':
+      // The OZ primitives bound a value against a constant; this bounds one
+      // call argument against another, which none of them can express.
+      return `slippage floor on arg[${cond.outArgIndex}] (OZ built-ins cannot bound one argument against another)`
     case 'in':
       return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`
     case 'eq_seq':