@crediolabs/policy-synth 0.1.16 → 0.1.18

package/dist-cjs/run/schemas.d.ts

@@ -352,7 +352,7 @@ export declare const RecordedTransactionSchema: z.ZodObject<{
 /** MandateSpec mirrors the core MandateSpec. The deterministic Mandate
  *  front-end needs no parseConfidence; the tool adapter injects the full
  *  confidence after synthesis so the orchestrator can compare. */
-export declare const MandateSpecSchema: z.ZodObject<{
+export declare const MandateSpecSchema: z.ZodEffects<z.ZodObject<{
     chain: z.ZodLiteral<"stellar">;
     contract: z.ZodString;
     method: z.ZodOptional<z.ZodString>;
@@ -439,6 +439,64 @@ export declare const MandateSpecSchema: z.ZodObject<{
         validUntilLedger?: number | undefined;
         validUntilUnixSeconds?: number | undefined;
     }>>;
+}, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+    chain: z.ZodLiteral<"stellar">;
+    contract: z.ZodString;
+    method: z.ZodOptional<z.ZodString>;
+    spendingLimit: z.ZodOptional<z.ZodObject<{
+        token: z.ZodString;
+        limit: z.ZodString;
+        windowSeconds: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        token: string;
+        limit: string;
+        windowSeconds: number;
+    }, {
+        token: string;
+        limit: string;
+        windowSeconds: number;
+    }>>;
+    approvalThreshold: z.ZodOptional<z.ZodNumber>;
+    recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    expiry: z.ZodOptional<z.ZodObject<{
+        validUntilLedger: z.ZodOptional<z.ZodNumber>;
+        validUntilUnixSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        validUntilLedger?: number | undefined;
+        validUntilUnixSeconds?: number | undefined;
+    }, {
+        validUntilLedger?: number | undefined;
+        validUntilUnixSeconds?: number | undefined;
+    }>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    chain: z.ZodLiteral<"stellar">;
+    contract: z.ZodString;
+    method: z.ZodOptional<z.ZodString>;
+    spendingLimit: z.ZodOptional<z.ZodObject<{
+        token: z.ZodString;
+        limit: z.ZodString;
+        windowSeconds: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        token: string;
+        limit: string;
+        windowSeconds: number;
+    }, {
+        token: string;
+        limit: string;
+        windowSeconds: number;
+    }>>;
+    approvalThreshold: z.ZodOptional<z.ZodNumber>;
+    recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    expiry: z.ZodOptional<z.ZodObject<{
+        validUntilLedger: z.ZodOptional<z.ZodNumber>;
+        validUntilUnixSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        validUntilLedger?: number | undefined;
+        validUntilUnixSeconds?: number | undefined;
+    }, {
+        validUntilLedger?: number | undefined;
+        validUntilUnixSeconds?: number | undefined;
+    }>>;
 }, z.ZodTypeAny, "passthrough">>;
 /** ComposeUserResponses mirrors the core. */
 export declare const ComposeUserResponsesSchema: z.ZodObject<{
@@ -530,7 +588,7 @@ export declare const RecordTransactionInputSchema: z.ZodEffects<z.ZodEffects<z.Z
 export type RecordTransactionInput = z.infer<typeof RecordTransactionInputSchema>;
 export declare const SynthesizePolicyMandateInputSchema: z.ZodObject<{
     source: z.ZodLiteral<"mandate">;
-    mandate: z.ZodObject<{
+    mandate: z.ZodEffects<z.ZodObject<{
         chain: z.ZodLiteral<"stellar">;
         contract: z.ZodString;
         method: z.ZodOptional<z.ZodString>;
@@ -617,6 +675,64 @@ export declare const SynthesizePolicyMandateInputSchema: z.ZodObject<{
             validUntilLedger?: number | undefined;
             validUntilUnixSeconds?: number | undefined;
         }>>;
+    }, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+        chain: z.ZodLiteral<"stellar">;
+        contract: z.ZodString;
+        method: z.ZodOptional<z.ZodString>;
+        spendingLimit: z.ZodOptional<z.ZodObject<{
+            token: z.ZodString;
+            limit: z.ZodString;
+            windowSeconds: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }>>;
+        approvalThreshold: z.ZodOptional<z.ZodNumber>;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        expiry: z.ZodOptional<z.ZodObject<{
+            validUntilLedger: z.ZodOptional<z.ZodNumber>;
+            validUntilUnixSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        chain: z.ZodLiteral<"stellar">;
+        contract: z.ZodString;
+        method: z.ZodOptional<z.ZodString>;
+        spendingLimit: z.ZodOptional<z.ZodObject<{
+            token: z.ZodString;
+            limit: z.ZodString;
+            windowSeconds: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }>>;
+        approvalThreshold: z.ZodOptional<z.ZodNumber>;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        expiry: z.ZodOptional<z.ZodObject<{
+            validUntilLedger: z.ZodOptional<z.ZodNumber>;
+            validUntilUnixSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }>>;
     }, z.ZodTypeAny, "passthrough">>;
     ozConfig: z.ZodOptional<z.ZodObject<{
         network: z.ZodEnum<["mainnet", "testnet"]>;
@@ -1222,7 +1338,7 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
 }>;
 export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"source", [z.ZodObject<{
     source: z.ZodLiteral<"mandate">;
-    mandate: z.ZodObject<{
+    mandate: z.ZodEffects<z.ZodObject<{
         chain: z.ZodLiteral<"stellar">;
         contract: z.ZodString;
         method: z.ZodOptional<z.ZodString>;
@@ -1309,6 +1425,64 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
             validUntilLedger?: number | undefined;
             validUntilUnixSeconds?: number | undefined;
         }>>;
+    }, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+        chain: z.ZodLiteral<"stellar">;
+        contract: z.ZodString;
+        method: z.ZodOptional<z.ZodString>;
+        spendingLimit: z.ZodOptional<z.ZodObject<{
+            token: z.ZodString;
+            limit: z.ZodString;
+            windowSeconds: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }>>;
+        approvalThreshold: z.ZodOptional<z.ZodNumber>;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        expiry: z.ZodOptional<z.ZodObject<{
+            validUntilLedger: z.ZodOptional<z.ZodNumber>;
+            validUntilUnixSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        chain: z.ZodLiteral<"stellar">;
+        contract: z.ZodString;
+        method: z.ZodOptional<z.ZodString>;
+        spendingLimit: z.ZodOptional<z.ZodObject<{
+            token: z.ZodString;
+            limit: z.ZodString;
+            windowSeconds: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }, {
+            token: string;
+            limit: string;
+            windowSeconds: number;
+        }>>;
+        approvalThreshold: z.ZodOptional<z.ZodNumber>;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        expiry: z.ZodOptional<z.ZodObject<{
+            validUntilLedger: z.ZodOptional<z.ZodNumber>;
+            validUntilUnixSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }, {
+            validUntilLedger?: number | undefined;
+            validUntilUnixSeconds?: number | undefined;
+        }>>;
     }, z.ZodTypeAny, "passthrough">>;
     ozConfig: z.ZodOptional<z.ZodObject<{
         network: z.ZodEnum<["mainnet", "testnet"]>;
@@ -2641,20 +2815,19 @@ export declare const VerifyPolicyInputSchema: z.ZodObject<{
     }> | undefined;
 }>;
 export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>;
-/** Pinned interpreter address (testnet). Mirrors DEPLOYMENTS.md:128.
+/** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP";
-/** Pinned interpreter address (mainnet). Mirrors DEPLOYMENTS.md:18. Mainnet
+/** Pinned interpreter address (mainnet). Mainnet
  *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
  *  that was exercised on testnet (same wasm sha256, see
  *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing - see
- *  DEPLOYMENTS.md:29-32 for the recorded decision and what is still pending. */
+ *  ids are network-scoped. UNAUDITED at the time of writing. */
 export declare const PINNED_INTERPRETER_MAINNET_ADDRESS = "CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2";
-/** Pinned interpreter wasm sha256 (hex). Mirrors DEPLOYMENTS.md:156-157. */
+/** Pinned interpreter wasm sha256 (hex). */
 export declare const PINNED_INTERPRETER_WASM_SHA256 = "6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443";
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
- *  packages/policy-interpreter/src/version.rs). */
+ *  contracts/policy-interpreter/src/version.rs). */
 export declare const PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
@@ -2668,7 +2841,7 @@ export declare const TESTNET_RPC_URL = "https://soroban-testnet.stellar.org";
 export declare const MAINNET_RPC_URL = "https://mainnet.sorobanrpc.com";
 /** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
  *  is identical across both networks (the same binary was uploaded both
- *  places; DEPLOYMENTS.md:25-27), so `PINNED_INTERPRETER_WASM_SHA256` stays
+ *  places), so `PINNED_INTERPRETER_WASM_SHA256` stays
  *  a single constant - only the addresses and RPCs are network-scoped. */
 export declare const PINNED_INTERPRETER_ADDRESS_BY_NETWORK: Record<Network, string>;
 export declare const RPC_URL_BY_NETWORK: Record<Network, string>;
@@ -3403,15 +3576,24 @@ export declare const GetInterpreterInfoInputSchema: z.ZodObject<{
     /** When true, perform an optional live `grammar_version()` RPC call to
      *  verify the deployed contract matches the pin. */
     verifyLive: z.ZodOptional<z.ZodBoolean>;
-    /** Optional RPC URL override. */
+    /** Optional RPC URL override. When `verifyLive` is true, the URL must
+     *  equal the pinned RPC for the selected network unless
+     *  `allowUnpinnedRpcUrl: true` is also set (same opt-in shape as
+     *  install/revoke - the live grammar_version() answer binds to whichever
+     *  RPC returned it). */
     rpcUrl: z.ZodOptional<z.ZodString>;
+    /** Opt-in to using a non-pinned RPC URL when `verifyLive` is true. Same
+     *  semantics as install/revoke: the caller accepts the trust shift. */
+    allowUnpinnedRpcUrl: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     network?: "mainnet" | "testnet" | undefined;
     rpcUrl?: string | undefined;
+    allowUnpinnedRpcUrl?: boolean | undefined;
     verifyLive?: boolean | undefined;
 }, {
     network?: "mainnet" | "testnet" | undefined;
     rpcUrl?: string | undefined;
+    allowUnpinnedRpcUrl?: boolean | undefined;
     verifyLive?: boolean | undefined;
 }>;
 export type GetInterpreterInfoInput = z.infer<typeof GetInterpreterInfoInputSchema>;

package/dist-cjs/run/schemas.js

@@ -8,9 +8,9 @@
 // step with the TS source of truth.
 //
 // i128 amounts and other large integers are carried as base-10 decimal strings
-// end-to-end (no JS number coercion). Networks are pinned to the same closed
-// set the core defines. The discriminated union on `source` exposes BOTH
-// synthesize_policy front-ends through a single tool input.
+// end-to-end. Networks are pinned to the same closed set the core defines.
+// The discriminated union on `source` exposes BOTH synthesize_policy
+// front-ends through a single tool input.
 //
 // This module is the SINGLE source of truth for these shapes. The MCP package
 // imports them here so its tool-shape bindings stay in step; the CLI imports
@@ -126,7 +126,21 @@ exports.MandateSpecSchema = zod_1.z
     })
         .optional(),
 })
-    .passthrough();
+    .passthrough()
+    // TS-F4/F6: a `recipients` allowlist is only meaningful against a SEP-41
+    // method whose arg 1 IS the recipient (SAC/SEP-41 `transfer(from, to,
+    // amount)` and SEP-41 `mint(to, amount)`). Without this gate the
+    // `to-ir.ts` lowering pins the allowlist to `RECIPIENT_ARG_INDEX = 1`
+    // for any contract+method, which would let a non-SEP-41 method's
+    // arg[1] (e.g. an amount, an op type, an arbitrary address payload)
+    // be silently constrained as if it were a recipient. Refusing
+    // non-SEP-41 methods at the boundary is the fail-closed shape.
+    .refine((v) => v.recipients === undefined ||
+    v.recipients.length === 0 ||
+    v.method === 'transfer' ||
+    v.method === 'mint', {
+    message: 'recipients is only valid when method is a SEP-41 method (transfer or mint); other methods do not have a recipient at arg[1]',
+});
 /** ComposeUserResponses mirrors the core. */
 exports.ComposeUserResponsesSchema = zod_1.z
     .object({
@@ -267,7 +281,12 @@ exports.PredicateLeafSchema = zod_1.z.lazy(() => zod_1.z.union([
         windowSeconds: zod_1.z.number().int().positive(),
     }),
     zod_1.z.object({ kind: zod_1.z.literal('now') }),
-    zod_1.z.object({ kind: zod_1.z.literal('valid_until') }),
+    // `valid_until` is NOT in the public predicate grammar: the encoder +
+    // decoder already throw on it, so accepting it here would let a
+    // hand-crafted payload through the schema and only surface a 200+
+    // character internal-commentary error at encode time. Drop it - the
+    // policy's expiry is carried at the install layer (MandateSpec +
+    // validUntilLedger) instead.
     zod_1.z.object({
         kind: zod_1.z.literal('invocation_count_in_window'),
         windowSecs: zod_1.z.number().int().positive(),
@@ -427,20 +446,19 @@ const MandateSpecSchemaForRule = zod_1.z
 // install/revoke/get_info schemas live HERE (after the helper) so the const
 // reference resolves at module init. They are the new tools on top of the
 // existing four.
-/** Pinned interpreter address (testnet). Mirrors DEPLOYMENTS.md:128.
+/** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 exports.PINNED_INTERPRETER_TESTNET_ADDRESS = 'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP';
-/** Pinned interpreter address (mainnet). Mirrors DEPLOYMENTS.md:18. Mainnet
+/** Pinned interpreter address (mainnet). Mainnet
  *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
  *  that was exercised on testnet (same wasm sha256, see
  *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing - see
- *  DEPLOYMENTS.md:29-32 for the recorded decision and what is still pending. */
+ *  ids are network-scoped. UNAUDITED at the time of writing. */
 exports.PINNED_INTERPRETER_MAINNET_ADDRESS = 'CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2';
-/** Pinned interpreter wasm sha256 (hex). Mirrors DEPLOYMENTS.md:156-157. */
+/** Pinned interpreter wasm sha256 (hex). */
 exports.PINNED_INTERPRETER_WASM_SHA256 = '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443';
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
- *  packages/policy-interpreter/src/version.rs). */
+ *  contracts/policy-interpreter/src/version.rs). */
 exports.PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
@@ -454,7 +472,7 @@ exports.TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org';
 exports.MAINNET_RPC_URL = 'https://mainnet.sorobanrpc.com';
 /** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
  *  is identical across both networks (the same binary was uploaded both
- *  places; DEPLOYMENTS.md:25-27), so `PINNED_INTERPRETER_WASM_SHA256` stays
+ *  places), so `PINNED_INTERPRETER_WASM_SHA256` stays
  *  a single constant - only the addresses and RPCs are network-scoped. */
 exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = {
     testnet: exports.PINNED_INTERPRETER_TESTNET_ADDRESS,
@@ -474,13 +492,26 @@ exports.NETWORK_PASSPHRASES = {
     testnet: 'Test SDF Network ; September 2015',
     mainnet: 'Public Global Stellar Network ; September 2015',
 };
+// Stellar strkey shapes (StrKey base32, no checksum byte, version byte
+// 0x30/0x40 prefixed by the decoder, then 32 base32 chars giving a 56-char
+// total). The shared `isStellarAddress` helper accepts BOTH wallet (G...) and
+// contract (C...) addresses; the install schema has to distinguish them
+// because the smart account is a contract (C...) - a wallet address would
+// mean the rule is being installed against the WRONG account kind entirely.
+// `sourceAccount` is the signing wallet (G...).
+const STELLAR_CONTRACT_ADDRESS = /^C[2-7A-Z]{55}$/;
+const STELLAR_ACCOUNT_ADDRESS = /^G[2-7A-Z]{55}$/;
 exports.InstallPolicyInputSchema = zod_1.z
     .object({
     /** The smart account contract address (C...) that will receive the rule. */
-    smartAccount: zod_1.z.string(),
+    smartAccount: zod_1.z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
     /** The signer that authorises the install (G... wallet). Used only for
      *  sequence number + auth nonce simulation; never persisted, never signed. */
-    sourceAccount: zod_1.z.string(),
+    sourceAccount: zod_1.z
+        .string()
+        .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
     /** Target network for the install. Selects which interpreter pin and
      *  which RPC URL are valid by default. Defaults to `testnet` so the
      *  pre-mainnet callers keep working: they were always pointing at
@@ -519,12 +550,16 @@ exports.InstallPolicyInputSchema = zod_1.z
 exports.RevokePolicyInputSchema = zod_1.z
     .object({
     /** The smart account contract address (C...). */
-    smartAccount: zod_1.z.string(),
+    smartAccount: zod_1.z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
     /** The wallet that will sign the removal. The ACCOUNT decides whether it
      *  accepts that signer; this schema does not assert a rule it cannot
      *  verify, since the account's source is not in this repo. Proven on
      *  testnet: the account's deployer can revoke. */
-    sourceAccount: zod_1.z.string(),
+    sourceAccount: zod_1.z
+        .string()
+        .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
     /** Target network for the revoke. Same `testnet`-default as install,
      *  so pre-mainnet callers keep working without an explicit flag. */
     network: exports.NetworkSchema.optional(),
@@ -546,8 +581,15 @@ exports.GetInterpreterInfoInputSchema = zod_1.z.object({
     /** When true, perform an optional live `grammar_version()` RPC call to
      *  verify the deployed contract matches the pin. */
     verifyLive: zod_1.z.boolean().optional(),
-    /** Optional RPC URL override. */
+    /** Optional RPC URL override. When `verifyLive` is true, the URL must
+     *  equal the pinned RPC for the selected network unless
+     *  `allowUnpinnedRpcUrl: true` is also set (same opt-in shape as
+     *  install/revoke - the live grammar_version() answer binds to whichever
+     *  RPC returned it). */
     rpcUrl: zod_1.z.string().url().optional(),
+    /** Opt-in to using a non-pinned RPC URL when `verifyLive` is true. Same
+     *  semantics as install/revoke: the caller accepts the trust shift. */
+    allowUnpinnedRpcUrl: zod_1.z.boolean().optional(),
 });
 // ===== Error envelope (canonical) =====
 //

package/dist-cjs/synth/compose-from-recording.d.ts

@@ -28,28 +28,23 @@ export interface ComposeUserResponses {
      *  invocation_count bound; absent -> FREQUENCY_BOUND_MISSING. */
     invocationLimit?: number;
     /** Per-asset oracle-price bound(s). Each entry lowers to a single
-     *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
-     *  entries on the same asset emit multiple leaves. */
+     *  `oracle_price(asset) OP value` compare in the interpreter IR. */
     oraclePriceBound?: OraclePriceBound[];
     /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
-     *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
-     *  slippage floor bounding the output arg against the input arg of the same
-     *  call.
-     *
-     *  REQUIRED to be supplied by the caller: it is never derived from the
-     *  recording. The recorded in/out pair is a price at one moment, and
-     *  freezing it as policy would deny ordinary trades as soon as the rate
-     *  moves. Absent, no floor is emitted and the existing unbounded-output
-     *  warning stands. */
+     *  `{num:'95',den:'100'}` = accept losing at most 5%). REQUIRED to be
+     *  supplied by the caller: never derived from the recording (the recorded
+     *  in/out pair is a price at one moment, and freezing it as policy would
+     *  deny ordinary trades as soon as the rate moves). Absent, no floor is
+     *  emitted and the existing unbounded-output warning stands. */
     swapMinOutRatio?: {
         num: string;
         den: string;
     };
     /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
-     *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
-     *  pin. Absent -> the recipient is pinned to the recorded value (mirroring
-     *  SEP-41) and RECIPIENT_ALLOWLIST_EMPTY is surfaced as informational, never
-     *  a silent free pass. */
+     *  swap_exact_tokens_for_tokens). When supplied, REPLACES the default pin.
+     *  Absent -> recipient is pinned to the recorded value (mirroring SEP-41)
+     *  and RECIPIENT_ALLOWLIST_EMPTY surfaces as informational, never a silent
+     *  free pass. */
     swapRecipientAllowlist?: string[];
 }
 /** Composition options. */