@crediolabs/policy-synth 0.1.7 → 0.1.8

package/dist/synth/compose-from-recording.js

@@ -250,6 +250,32 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             }
         }
     }
+    // Blend submit / claim: the `to` arg is the beneficiary - it receives the
+    // resulting position shares on `submit` and the claimed tokens on `claim`.
+    // That is the same role as the SEP-41 recipient above and the SoroSwap swap
+    // recipient below, so it is pinned to the recorded address the same way:
+    // without it a policy scoped to a pool and method still lets an agent send
+    // the proceeds anywhere. `from` and `spender` are deliberately NOT pinned -
+    // the call already requires their authorisation, so binding them adds no
+    // restriction the chain is not already enforcing.
+    if (protocol.protocol === 'blend' && (protocol.fn === 'submit' || protocol.fn === 'claim')) {
+        // Index 2 in both signatures: submit(from, spender, to, requests) and
+        // claim(from, reserve_token_ids, to).
+        const toArg = topLevel.args[2];
+        if (toArg && toArg.type === 'address') {
+            const cond = {
+                op: 'in',
+                selector: { kind: 'arg', argIndex: 2, scalarType: 'address' },
+                values: [toArg.value],
+            };
+            if (interpreterEnabled) {
+                interpreterConstraints.push(cond);
+            }
+            else {
+                ozConstraints.push(cond);
+            }
+        }
+    }
     // SoroSwap: the recorded hop path -> eq_seq on the path arg (call_arg[2]).
     // The interpreter adapter is the ONLY way to express an exact ordered
     // sequence (OZ built-ins cannot). Element order is preserved verbatim.

package/dist-cjs/synth/compose-from-recording.js

@@ -253,6 +253,32 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             }
         }
     }
+    // Blend submit / claim: the `to` arg is the beneficiary - it receives the
+    // resulting position shares on `submit` and the claimed tokens on `claim`.
+    // That is the same role as the SEP-41 recipient above and the SoroSwap swap
+    // recipient below, so it is pinned to the recorded address the same way:
+    // without it a policy scoped to a pool and method still lets an agent send
+    // the proceeds anywhere. `from` and `spender` are deliberately NOT pinned -
+    // the call already requires their authorisation, so binding them adds no
+    // restriction the chain is not already enforcing.
+    if (protocol.protocol === 'blend' && (protocol.fn === 'submit' || protocol.fn === 'claim')) {
+        // Index 2 in both signatures: submit(from, spender, to, requests) and
+        // claim(from, reserve_token_ids, to).
+        const toArg = topLevel.args[2];
+        if (toArg && toArg.type === 'address') {
+            const cond = {
+                op: 'in',
+                selector: { kind: 'arg', argIndex: 2, scalarType: 'address' },
+                values: [toArg.value],
+            };
+            if (interpreterEnabled) {
+                interpreterConstraints.push(cond);
+            }
+            else {
+                ozConstraints.push(cond);
+            }
+        }
+    }
     // SoroSwap: the recorded hop path -> eq_seq on the path arg (call_arg[2]).
     // The interpreter adapter is the ONLY way to express an exact ordered
     // sequence (OZ built-ins cannot). Element order is preserved verbatim.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/synth/compose-from-recording.ts

@@ -355,6 +355,32 @@ function appendProtocolSpecificConstraints(
     }
   }
 
+  // Blend submit / claim: the `to` arg is the beneficiary - it receives the
+  // resulting position shares on `submit` and the claimed tokens on `claim`.
+  // That is the same role as the SEP-41 recipient above and the SoroSwap swap
+  // recipient below, so it is pinned to the recorded address the same way:
+  // without it a policy scoped to a pool and method still lets an agent send
+  // the proceeds anywhere. `from` and `spender` are deliberately NOT pinned -
+  // the call already requires their authorisation, so binding them adds no
+  // restriction the chain is not already enforcing.
+  if (protocol.protocol === 'blend' && (protocol.fn === 'submit' || protocol.fn === 'claim')) {
+    // Index 2 in both signatures: submit(from, spender, to, requests) and
+    // claim(from, reserve_token_ids, to).
+    const toArg = topLevel.args[2]
+    if (toArg && toArg.type === 'address') {
+      const cond: IRCondition = {
+        op: 'in',
+        selector: { kind: 'arg', argIndex: 2, scalarType: 'address' },
+        values: [toArg.value],
+      }
+      if (interpreterEnabled) {
+        interpreterConstraints.push(cond)
+      } else {
+        ozConstraints.push(cond)
+      }
+    }
+  }
+
   // SoroSwap: the recorded hop path -> eq_seq on the path arg (call_arg[2]).
   // The interpreter adapter is the ONLY way to express an exact ordered
   // sequence (OZ built-ins cannot). Element order is preserved verbatim.