@crediolabs/policy-synth 0.1.5 → 0.1.7

package/src/synth/synthesize-from-recording.ts

@@ -57,7 +57,7 @@ import {
   type ComposeUserResponses,
   composeFromRecording,
 } from './compose-from-recording.ts'
-import { generateCases } from './deny-cases.ts'
+import { generateCases, ORIGINAL_DIMENSIONS } from './deny-cases.ts'
 import { type EvalContext, evaluate } from './evaluate.ts'
 import { runHarness } from './harness.ts'
 import { lower } from './lower.ts'
@@ -198,6 +198,33 @@ function synthesizeFromRecordingInner(
     }
   }
 
+  // 1a. Zero-invocation refusal (item 1). A recording with zero contract
+  //     invocations cleared the parseConfidence gate legitimately (the
+  //     `denom === 0` short-circuit pins overall to 1.0 for that case), but a
+  //     policy must scope to an authorized contract call. Refuse before any
+  //     lower/scope work so the failure is specific and actionable. The
+  //     recorder's silence is also made visible via `parseConfidence.noInvocations`
+  //     so consumers can pattern-match without inferring from `invocations: []`
+  //     next to `overall: 1.0`. The message does NOT ask for an ABI - the
+  //     failure mode is the recording shape, not decoding coverage.
+  const hasNoInvocations = tx.parseConfidence.noInvocations === true || tx.invocations.length === 0
+  if (hasNoInvocations) {
+    return {
+      ok: false,
+      error: {
+        code: 'SYNTHESIS_ERROR',
+        message:
+          'Recording contains no contract invocation to scope a policy to. Re-record a transaction that invokes a Soroban contract function (e.g. an SAC/SEP-41 transfer, a Blend yield-claim, or a SoroSwap swap).',
+        severity: 'error',
+        retryable: false,
+        details: {
+          invocations: tx.invocations.length,
+          noInvocationsMarker: tx.parseConfidence.noInvocations === true,
+        },
+      },
+    }
+  }
+
   // Bound the recording size fail-closed (defense-in-depth for direct callers;
   // the MCP schema caps this too).
   if (tx.invocations.length > SOROBAN_LIMITS.maxInvocations) {
@@ -404,9 +431,11 @@ function synthesizeFromRecordingInner(
     const permitCtx = buildPermitContext(tx, scope, topLevel, opts.userResponses, startingPredicate)
 
     const finalPredicate: PredicateNode =
-      startingPredicate.op === 'and' ? minimize(startingPredicate, permitCtx) : startingPredicate
+      startingPredicate.op === 'and'
+        ? minimize(startingPredicate, permitCtx, ORIGINAL_DIMENSIONS)
+        : startingPredicate
 
-    const harnessCases = generateCases(finalPredicate, permitCtx)
+    const harnessCases = generateCases(finalPredicate, permitCtx, ORIGINAL_DIMENSIONS)
     const harnessResult = runHarness(finalPredicate, harnessCases)
     if (!harnessResult.ok) {
       return {
@@ -512,12 +541,26 @@ function synthesizeFromRecordingInner(
     policies: mergedRefs,
   }
 
+  // When nothing installable was synthesised (no interpreter doc AND no OZ
+  // policy refs), an empty `policies` array reads as "no restrictions" rather
+  // than "I synthesised nothing". Surface that explicitly so the empty result
+  // is never mistaken for a permissive policy - the context rule still exists,
+  // but it constrains nothing. (Kept as `{ok:true}` so the documented
+  // Path-A/Path-B demo behaviour is preserved - see F3.)
+  const zeroPolicyWarning =
+    mergedRefs.length === 0 && !interpreterPolicyDocument
+      ? [
+          'No policy constraints were synthesised: the call to this contract is UNCONSTRAINED by this policy. Enable the interpreter (supply a smart account) to enforce the surfaced constraints.',
+        ]
+      : []
+
   const proposed: ProposedPolicy = {
     contextRule: mergedContextRule,
     policyDocuments: interpreterPolicyDocument ? [interpreterPolicyDocument] : [],
     policyRefs: mergedRefs,
     parseConfidence: { ...tx.parseConfidence },
     warnings: [
+      ...zeroPolicyWarning,
       ...ozUncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
       ...composed.warnings.map((w) => `${UNCOVERED_PREFIX}${w}`),
     ],
@@ -579,7 +622,7 @@ function validateOptions(opts: SynthesizeFromRecordingOptions): ToolError | null
     }
     if (ur.limitAmount !== undefined && !isPositiveI128(ur.limitAmount)) {
       return synthesisError(
-        `limitAmount must be a positive i128 decimal string, got: ${ur.limitAmount}`
+        `limitAmount must be a positive i128 decimal string within [1, ${I128_MAX}] (2^127-1), got: ${ur.limitAmount}`
       )
     }
   }
@@ -648,15 +691,25 @@ function validateOptions(opts: SynthesizeFromRecordingOptions): ToolError | null
  *  fixture/LLM-seam marker. */
 const PLACEHOLDER_SMART_ACCOUNT_PREFIX = /^(VERIFY-|PLACEHOLDER-|TODO-)/i
 
+/** Maximum value a signed i128 can hold (2^127-1). A limitAmount above this
+ *  cannot be represented on-chain, so reject it at the synthesis boundary
+ *  (fail-closed) instead of passing it through as an over-broad spending_limit.
+ *  Mirrors the SOROBAN_LIMITS.u32Max bound the ledger-sequence fields enforce. */
+const I128_MAX = 2n ** 127n - 1n
+
 function isPositiveInt(n: number): boolean {
   return Number.isInteger(n) && n > 0
 }
 
-/** True when `s` is a canonical positive decimal integer (i128-safe via BigInt). */
+/** True when `s` is a canonical positive decimal integer inside the signed-i128
+ *  range [1, 2^127-1]. A value above the i128 ceiling is rejected (fail-closed):
+ *  it cannot be installed on-chain, and accepting it would emit a spending_limit
+ *  with an effectively unbounded cap. */
 function isPositiveI128(s: string): boolean {
   if (!/^[0-9]+$/.test(s)) return false
   try {
-    return BigInt(s) > 0n
+    const v = BigInt(s)
+    return v > 0n && v <= I128_MAX
   } catch {
     return false
   }

package/src/types.ts

@@ -11,6 +11,11 @@ export type ScVal =
   | { type: 'symbol'; value: string }
   | { type: 'vec'; value: ScVal[] }
   | { type: 'bytes'; value: string }
+  /** Map<Symbol, ScVal> carried forward for SAC/SEP-41 transfer event data,
+   *  which uses a Map shape (key "amount" -> I128) on Stellar mainnet. The
+   *  entry key is captured as its symbol/form string so readAmount can route
+   *  to the conventional field name without re-decoding the full XDR. */
+  | { type: 'map'; value: Array<{ key: string; val: ScVal }> }
   | { type: 'other'; value: string }
 
 /** OZ Accounts framework hard limits (verified against canonical OZ source). */
@@ -241,7 +246,15 @@ export type AmbiguityCode =
 
 /** Structured recording freshness. `overall` is the gate threshold (default 1.0); the
  *  breakdown is the diagnostic the user / agent sees when the gate fires. The
- *  computation rule is pinned: `overall = 1 - (unknownContracts + opaqueScVals) / total`. */
+ *  computation rule is pinned: `overall = 1 - (unknownContracts + opaqueScVals) / total`.
+ *
+ *  `noInvocations` (item 1) is a recorder-side marker set ONLY when the envelope
+ *  contained zero `invokeContract` host functions (e.g. a `createContract` or
+ *  `uploadContractWasm` op). The math is unchanged: that case still scores 1.0
+ *  via the `denom === 0` guard. The marker exists so a consumer does not have
+ *  to infer the situation from `invocations.length === 0` next to `overall: 1.0`
+ *  — a downstream synth refuses such recordings with a specific, actionable
+ *  error rather than silently producing a useless empty scope. */
 export interface ParseConfidence {
   overall: number // 0..1
   knownContracts: string[]
@@ -251,4 +264,8 @@ export interface ParseConfidence {
   }>
   opaqueScVals: Array<{ path: string; type: string }>
   thresholdUsed: number // 1.0 by default; > 0 only via explicit confidence_override
+  /** True iff the recorder decoded zero contract invocations. Absent on
+   *  recordings that pre-date this field; consumers should treat `undefined`
+   *  as "no marker" and rely on `invocations.length` as the fallback. */
+  noInvocations?: true
 }