@crediolabs/policy-synth 0.1.8 → 0.1.10

package/dist-cjs/run/schemas.js

@@ -178,6 +178,11 @@ exports.SynthesizePolicyMandateInputSchema = zod_1.z.object({
     source: zod_1.z.literal('mandate'),
     mandate: exports.MandateSpecSchema,
     ozConfig: exports.OzAdapterConfigSchema.optional(),
+    // --explain opt-in. When true, the orchestrator attaches the
+    // in-memory predicate tree (null for the mandate path) + a minimal
+    // honest SimulationResult to the success envelope. Absent or false
+    // -> the success envelope is unchanged (byte-identical to today).
+    explain: zod_1.z.boolean().optional(),
 });
 /** Interpreter opt-in for the recording path. Present -> constraints OZ cannot
  *  express (per-method scoping, invocation-count windows, oracle bounds, exact
@@ -203,6 +208,15 @@ exports.SynthesizePolicyRecordingInputSchema = zod_1.z.object({
     confidenceOverride: zod_1.z.object({ threshold: zod_1.z.number().min(0).max(1) }).optional(),
     interpreter: exports.InterpreterOptionsSchema.optional(),
     ozConfig: exports.OzAdapterConfigSchema.optional(),
+    // --explain opt-in. When true, the orchestrator attaches the
+    // in-memory PredicateNode + the corresponding SimulationResult
+    // (real one from the self-verify pipeline when the interpreter is
+    // engaged, minimal honest value otherwise) to the success envelope.
+    // Absent or false -> the success envelope is unchanged (byte-identical
+    // to today). The flag is ADDITIVE: the existing ProposedPolicy fields
+    // (encodedPredicate, predicateHash, etc.) are never altered by enabling
+    // explain.
+    explain: zod_1.z.boolean().optional(),
 });
 exports.SynthesizePolicyInputSchema = zod_1.z.discriminatedUnion('source', [
     exports.SynthesizePolicyMandateInputSchema,

package/dist-cjs/synth/compose-from-recording.js

@@ -279,6 +279,95 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             }
         }
     }
+    // Blend `submit` ONLY (not `claim`, whose vec arg is a vec<u32> of
+    // reserve_token_ids - no map fields to bind). The `requests` vec
+    // (call_arg[3]) is a vec<Request{ address, amount, request_type }>. Each
+    // Request is the per-reserve action selector - 0 Supply, 1 Withdraw,
+    // 2 SupplyCollateral, 3 WithdrawCollateral, 4 Borrow, 5 Repay, 6-9
+    // liquidation/auction fills. Pinning only one element is unsafe: a caller
+    // can append a second element with a different action (WithdrawCollateral
+    // -> Borrow on a different asset, any amount, then auction fills). Length
+    // + per-element pinning is total; a quantifier over elements is not. If we
+    // cannot emit BOTH, we surface AMBIGUITY rather than emit a partial bind.
+    if (protocol.protocol === 'blend' && protocol.fn === 'submit' && interpreterEnabled) {
+        const requestsArg = topLevel.args[3];
+        if (requestsArg && requestsArg.type === 'vec') {
+            const elements = requestsArg.value;
+            interpreterConstraints.push({
+                op: 'compare',
+                compare: {
+                    selector: { kind: 'arg_len', argIndex: 3 },
+                    operator: 'eq',
+                    value: String(elements.length),
+                },
+            });
+            for (let i = 0; i < elements.length; i++) {
+                const element = elements[i];
+                if (!element || element.type !== 'map')
+                    continue;
+                const fields = element.value;
+                const fieldValue = (name, scalarType) => {
+                    const entry = fields.find((e) => e.key === name);
+                    if (!entry)
+                        return null;
+                    if (entry.val.type === 'address' && scalarType === 'address')
+                        return entry.val.value;
+                    if (entry.val.type === 'i128' && scalarType === 'i128')
+                        return entry.val.value;
+                    if (entry.val.type === 'u32' && scalarType === 'u32')
+                        return entry.val.value;
+                    return null;
+                };
+                const address = fieldValue('address', 'address');
+                const amount = fieldValue('amount', 'i128');
+                const requestType = fieldValue('request_type', 'u32');
+                if (address === null || amount === null || requestType === null)
+                    continue;
+                interpreterConstraints.push({
+                    op: 'compare',
+                    compare: {
+                        selector: {
+                            kind: 'arg_field',
+                            argIndex: 3,
+                            element: i,
+                            field: 'request_type',
+                            scalarType: 'u32',
+                        },
+                        operator: 'eq',
+                        value: requestType,
+                    },
+                });
+                interpreterConstraints.push({
+                    op: 'compare',
+                    compare: {
+                        selector: {
+                            kind: 'arg_field',
+                            argIndex: 3,
+                            element: i,
+                            field: 'address',
+                            scalarType: 'address',
+                        },
+                        operator: 'eq',
+                        value: address,
+                    },
+                });
+                interpreterConstraints.push({
+                    op: 'compare',
+                    compare: {
+                        selector: {
+                            kind: 'arg_field',
+                            argIndex: 3,
+                            element: i,
+                            field: 'amount',
+                            scalarType: 'i128',
+                        },
+                        operator: 'lte',
+                        value: amount,
+                    },
+                });
+            }
+        }
+    }
     // SoroSwap: the recorded hop path -> eq_seq on the path arg (call_arg[2]).
     // The interpreter adapter is the ONLY way to express an exact ordered
     // sequence (OZ built-ins cannot). Element order is preserved verbatim.

package/dist-cjs/synth/deny-cases.js

@@ -21,6 +21,15 @@ const ADJACENT_ASSETS = [
 const OVERPERMISSIVE_DIMENSIONS = ['argument_reorder'];
 exports.OVERPERMISSIVE_DIMENSIONS = OVERPERMISSIVE_DIMENSIONS;
 // The 15 dimensions the synth pipeline uses for self-verify and minimise.
+// Phase 1 grammar extension: `vec_append` and `map_field_flip` are listed below
+// alongside the existing dimensions so the per-element binds emitted for
+// Blend `submit` (call_arg_len + 3 call_arg_field per element) survive
+// minimise. Without these, no deny case exercises the new leaves and the
+// minimise pass drops them as "redundant" - reopening the element-append
+// hole they were added to close. Both dimensions are no-ops for any fixture
+// whose predicate has no `call_arg_len` / `call_arg_field` leaves (the
+// generator short-circuits on leaf-kind), so they cannot make production
+// synthesis refuse for fixtures that do not exercise the new grammar.
 const ORIGINAL_DIMENSIONS = [
     'amount',
     'asset',
@@ -37,6 +46,8 @@ const ORIGINAL_DIMENSIONS = [
     'oracle_deviation_exceeded',
     'oracle_paused',
     'soroswap_allowed_path',
+    'vec_append',
+    'map_field_flip',
 ];
 exports.ORIGINAL_DIMENSIONS = ORIGINAL_DIMENSIONS;
 /** Build deterministic model-evaluated alternatives without mutating the intended call.
@@ -196,7 +207,9 @@ function generateCases(predicate, permitCtx, dimensions) {
         hasConstrainedArg &&
         permitCtx.args.length >= 2 &&
         permitCtx.args[0]?.type === 'address' &&
-        permitCtx.args[1]?.type === 'address') {
+        permitCtx.args[1]?.type === 'address' &&
+        permitCtx.args[0].value !==
+            permitCtx.args[1].value) {
         const ctx = cloneContext(permitCtx);
         // Guard above guarantees args[0] and args[1] exist and are address-typed.
         const a0 = ctx.args[0];
@@ -205,6 +218,59 @@ function generateCases(predicate, permitCtx, dimensions) {
         ctx.args[1] = a0;
         denies.push({ dimension: 'argument_reorder', ctx });
     }
+    // --- map_field_flip: flip a bound map field to a different valid value of
+    // the same type. Mirrors argument_reorder: OPT-IN only, never ORIGINAL.
+    // Targets each `call_arg_field` leaf and produces a ctx whose vec element
+    // has a different value of the recorded field (different request_type,
+    // different amount, different address). The blend-submit case uses this
+    // to detect a missing request_type pin. ---
+    if (!dimensions || dimensions.includes('map_field_flip')) {
+        for (const comparison of facts.comparisons) {
+            const sel = comparison.left;
+            if (sel.kind !== 'call_arg_field')
+                continue;
+            const arg = permitCtx.args[sel.index];
+            if (!arg || arg.type !== 'vec')
+                continue;
+            const element = arg.value[sel.element];
+            if (!element || element.type !== 'map' || !Array.isArray(element.value))
+                continue;
+            const entry = element.value.find((e) => e.key === sel.field);
+            if (!entry)
+                continue;
+            const flipped = flipFieldValue(entry.val);
+            if (flipped === null)
+                continue;
+            const ctx = cloneContext(permitCtx);
+            const clonedVec = arg.value.map(cloneScVal);
+            const clonedElement = clonedVec[sel.element];
+            if (clonedElement?.type !== 'map' || !Array.isArray(clonedElement.value))
+                continue;
+            clonedElement.value = clonedElement.value.map((e) => e.key === sel.field ? { key: e.key, val: flipped } : e);
+            clonedVec[sel.element] = clonedElement;
+            ctx.args[sel.index] = { type: 'vec', value: clonedVec };
+            denies.push({ dimension: 'map_field_flip', ctx });
+        }
+    }
+    // --- vec_append: append a new element to a bound vec. Mirrors map_field_flip:
+    // OPT-IN only, never ORIGINAL. Targets every `call_arg_len` leaf; without the
+    // length pin a caller can append an extra element to defeat per-element binds. ---
+    if (!dimensions || dimensions.includes('vec_append')) {
+        for (const comparison of facts.comparisons) {
+            const sel = comparison.left;
+            if (sel.kind !== 'call_arg_len')
+                continue;
+            const arg = permitCtx.args[sel.index];
+            if (!arg || arg.type !== 'vec')
+                continue;
+            const ctx = cloneContext(permitCtx);
+            ctx.args[sel.index] = {
+                type: 'vec',
+                value: [...arg.value, { type: 'other', value: 'deny-case-vec-append' }],
+            };
+            denies.push({ dimension: 'vec_append', ctx });
+        }
+    }
     // Version mismatch, malformed predicates, master authorization, and nonce replay are install-time checks and are intentionally omitted from model-evaluated cases.
     return { permit: cloneContext(permitCtx), denies };
 }
@@ -436,3 +502,25 @@ function cloneDepthError(value) {
     err.depthContext = value.type;
     throw err;
 }
+/** Build a value of the SAME ScVal type that differs from the recorded one,
+ *  used by the `map_field_flip` mutation to defeat a per-element pin without
+ *  changing the wire type (a type/arity change is rejected by host dispatch
+ *  before Policy::enforce, so it is not the predicate's job). Returns null
+ *  when the ScVal type has no obvious different value (e.g. opaque/other). */
+function flipFieldValue(val) {
+    switch (val.type) {
+        case 'address': {
+            const a = 'GBFKRGJYZXLTDEI36ZCQEIM225NMOCR2VDBOIHJTXJ54FEFFVL2FKALE';
+            const b = 'GD6XSMQJ47EHHJOWXQOND5YDVZC37JWZJHYHBKE6QJFSLLJ5KQXM5QS5';
+            return { type: 'address', value: val.value === a ? b : a };
+        }
+        case 'i128':
+        case 'u64':
+        case 'u32':
+            return { type: val.type, value: String(BigInt(val.value) + 1n) };
+        case 'symbol':
+            return { type: 'symbol', value: `${val.value}x` };
+        default:
+            return null;
+    }
+}

package/dist-cjs/synth/evaluate.js

@@ -178,6 +178,38 @@ function evalCompare(op, left, right, ctx) {
             return evalArgOrderedCompare(op, actual, right);
         return evalArgEq(op, actual, right, ctx);
     }
+    // --- step 4c: call_arg_len: the length of a vec-typed argument as a u32.
+    // Fails closed on a non-vec arg, an absent arg, or a non-u32 literal.
+    if (left.kind === 'call_arg_len') {
+        const actual = ctx.args[left.index];
+        if (!actual || actual.type !== 'vec')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        if (right.kind !== 'literal_u32')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        return actual.value.length === right.value
+            ? { permit: true }
+            : { permit: false, reason: 'ARG_MISMATCH' };
+    }
+    // --- step 4d: call_arg_field: the value of a field in the map at element i
+    // of the vec at argument index. Fails closed on a non-vec arg, an
+    // out-of-range element, a missing field, a non-map element, or a type
+    // mismatch between the field ScVal and the literal leaf.
+    if (left.kind === 'call_arg_field') {
+        const actual = ctx.args[left.index];
+        if (!actual || actual.type !== 'vec')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        const element = actual.value[left.element];
+        if (!element || element.type !== 'map')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        if (!Array.isArray(element.value))
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        const entry = element.value.find((e) => e.key === left.field);
+        if (!entry)
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        if (op === 'eq')
+            return evalArgEq(op, entry.val, right, ctx);
+        return evalArgOrderedCompare(op, entry.val, right);
+    }
     // --- step 6: AMOUNT_BOUND ---
     if (left.kind === 'amount' && op !== 'eq') {
         return evalAmountCompare(op, left.token, right, ctx);
@@ -337,6 +369,23 @@ function resolveLeaf(leaf, ctx) {
             return { type: 'symbol', value: ctx.fn };
         case 'call_arg':
             return ctx.args[leaf.index];
+        case 'call_arg_len':
+            // No direct ScVal projection: the length is an integer the comparator
+            // resolves against the right-hand literal. Returning undefined keeps
+            // the `in` membership path structurally informed (no haystack match).
+            return undefined;
+        case 'call_arg_field': {
+            const actual = ctx.args[leaf.index];
+            if (!actual || actual.type !== 'vec')
+                return undefined;
+            const element = actual.value[leaf.element];
+            if (!element || element.type !== 'map')
+                return undefined;
+            if (!Array.isArray(element.value))
+                return undefined;
+            const entry = element.value.find((e) => e.key === leaf.field);
+            return entry ? entry.val : undefined;
+        }
         case 'amount':
         case 'window_spent':
         case 'oracle_price':

package/dist-cjs/synth/synthesize-from-mandate.d.ts

@@ -1,5 +1,20 @@
 import type { OzAdapterConfig } from '../adapters/oz/adapter.ts';
 import type { ToolResponse } from '../errors.ts';
 import type { MandateSpec } from '../mandate/types.ts';
-import type { ProposedPolicy } from '../types.ts';
-export declare function synthesizeFromMandate(spec: MandateSpec, ozConfig: OzAdapterConfig): ToolResponse<ProposedPolicy>;
+import type { PredicateNode, ProposedPolicy } from '../types.ts';
+import type { SimulationResult } from '../verify/envelope.ts';
+export declare function synthesizeFromMandate(spec: MandateSpec, ozConfig: OzAdapterConfig, 
+/** --explain opt-in. When true, the success envelope carries the
+ *  in-memory predicate tree (always null for the mandate path - the
+ *  declarative MandateSpec lowers to OZ built-ins, not to an
+ *  interpreter predicate) + a minimal honest SimulationResult. The
+ *  flag is ADDITIVE: the existing ProposedPolicy fields are never
+ *  altered. */
+opts?: {
+    explain?: true;
+}): ToolResponse<ProposedPolicy> & {
+    explain?: {
+        predicateTree: PredicateNode | null;
+        simulation: SimulationResult;
+    };
+};

package/dist-cjs/synth/synthesize-from-mandate.js

@@ -13,7 +13,14 @@ exports.synthesizeFromMandate = synthesizeFromMandate;
 const adapter_ts_1 = require("../adapters/oz/adapter.js");
 const to_ir_ts_1 = require("../mandate/to-ir.js");
 const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: ';
-function synthesizeFromMandate(spec, ozConfig) {
+function synthesizeFromMandate(spec, ozConfig, 
+/** --explain opt-in. When true, the success envelope carries the
+ *  in-memory predicate tree (always null for the mandate path - the
+ *  declarative MandateSpec lowers to OZ built-ins, not to an
+ *  interpreter predicate) + a minimal honest SimulationResult. The
+ *  flag is ADDITIVE: the existing ProposedPolicy fields are never
+ *  altered. */
+opts) {
     const ir = (0, to_ir_ts_1.mandateToPolicyIR)(spec);
     const adapter = (0, adapter_ts_1.createOzAdapter)(ozConfig);
     const result = adapter.compile(ir);
@@ -33,5 +40,23 @@ function synthesizeFromMandate(spec, ozConfig) {
         ...result.proposed,
         warnings: result.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
     };
-    return { ok: true, data: proposed };
+    // Same --explain envelope pattern as the recording path. The mandate path
+    // never produces an interpreter predicate, so predicateTree is null and
+    // the simulation is a minimal honest deny (no self-verify was performed).
+    const envelope = { ok: true, data: proposed };
+    if (opts?.explain) {
+        envelope.explain = {
+            predicateTree: null,
+            simulation: {
+                permit: {
+                    tx: 'deny',
+                    reason: 'No self-verification was performed (mandate path is OZ-only)',
+                },
+                evaluatedCases: [],
+                backend: 'ts-model',
+                simulatorVersion: 'not-run',
+            },
+        };
+    }
+    return envelope;
 }

package/dist-cjs/synth/synthesize-from-recording.d.ts

@@ -1,6 +1,7 @@
 import type { OzAdapterConfig } from '../adapters/oz/adapter.ts';
 import type { ToolError, ToolResponse } from '../errors.ts';
 import { type Network, type PredicateNode, type ProposedPolicy, type RecordedTransaction } from '../types.ts';
+import type { SimulationResult } from '../verify/envelope.ts';
 import { type ComposeUserResponses } from './compose-from-recording.ts';
 /** Per-policy interpreter adapter config the caller opts into. Absent ->
  *  recording path runs in week-1 mode (OZ adapter only, warnings for the
@@ -41,8 +42,31 @@ export interface SynthesizeFromRecordingOptions {
         threshold: number;
     };
     interpreter?: InterpreterAdapterOptions;
+    /** --explain opt-in. When true, the orchestrator attaches the
+     *  in-memory `PredicateNode` + the corresponding `SimulationResult`
+     *  to the success envelope so the CLI can render a human-readable
+     *  review card. Absent or false -> the success envelope is unchanged
+     *  (byte-identical to today). The flag is ADDITIVE: the existing
+     *  ProposedPolicy fields (encodedPredicate, predicateHash, etc.) are
+     *  never altered by enabling explain. */
+    explain?: true;
 }
-export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: SynthesizeFromRecordingOptions, ozConfig: OzAdapterConfig): ToolResponse<ProposedPolicy>;
+export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: SynthesizeFromRecordingOptions, ozConfig: OzAdapterConfig): ToolResponse<ProposedPolicy> & {
+    /** Present iff `opts.explain === true` and the synthesis succeeded. The
+     *  `predicateTree` is the exact in-memory `PredicateNode` (canonical
+     *  JSON shape) that was encoded into `proposed.policyDocuments[*].encodedPredicate`
+     *  - reading the predicate tree from the policy document is therefore
+     *  unnecessary; the orchestrator carries it through. The `simulation`
+     *  is the verdict produced by the same self-verify pipeline that already
+     *  runs in the recording path (runHarness + evaluate), so the value is
+     *  REAL not synthetic. Absent when the synthesis did not engage the
+     *  interpreter (no interpreter opts supplied) - in that case the CLI
+     *  builds a minimal honest SimulationResult downstream. */
+    explain?: {
+        predicateTree: PredicateNode | null;
+        simulation: SimulationResult;
+    };
+};
 /** ToolError-shaped error helper used by the body to surface a structured
  *  failure that the envelope converts to `{ok:false, error}`. */
 declare function throwToolError(code: ToolError['code'], message: string): never;

package/dist-cjs/synth/synthesize-from-recording.js

@@ -199,6 +199,14 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
         ...(opts.userResponses !== undefined ? { userResponses: opts.userResponses } : {}),
     };
     const composed = (0, compose_from_recording_ts_1.composeFromRecording)(facts, scope.contract, topLevel, composeOpts);
+    // --explain hook: capture the in-memory predicate tree + the real
+    // self-verify verdict so the CLI can render a faithful review card.
+    // The verdict below is built from the SAME runHarness + evaluate that
+    // already gates the synthesis (it is not a parallel simulation); the
+    // intermediate inputs (harnessCases, evalResult) are otherwise discarded
+    // after the gate, so the explain hook reuses them - no extra work.
+    let explain = null;
+    let explainSim = null;
     // 5. OZ compile (always runs).
     const ozAdapter = (0, adapter_ts_2.createOzAdapter)(ozConfig);
     const compileRes = ozAdapter.compile(composed.ir);
@@ -376,6 +384,36 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
                 },
             };
         }
+        // --explain capture: the interpreter path already produced the real
+        // self-verify verdict (runHarness passed, evalResult.permit is true).
+        // Build the SimulationResult from those outputs so the CLI card
+        // quotes the SAME verdict that gated the synthesis. We re-evaluate
+        // each deny case to surface its concrete reason; the harness only
+        // records whether the got-matches-expected boundary held.
+        if (opts.explain) {
+            explain = finalPredicate;
+            const evaluatedCases = [
+                {
+                    dimension: 'permit',
+                    outcome: evalResult.permit ? 'permit' : 'deny',
+                    reason: 'matches recorded call',
+                },
+            ];
+            for (const deny of harnessCases.denies) {
+                const r = (0, evaluate_ts_1.evaluate)(finalPredicate, deny.ctx);
+                evaluatedCases.push({
+                    dimension: deny.dimension,
+                    outcome: r.permit ? 'permit' : 'deny',
+                    reason: r.permit ? 'no matching deny' : r.reason,
+                });
+            }
+            explainSim = {
+                permit: { tx: 'permit' },
+                evaluatedCases,
+                backend: 'ts-model',
+                simulatorVersion: 'ts-model-1.0.0',
+            };
+        }
         // 6c. Re-encode the (possibly minimised) PredicateNode and stamp the
         //     canonical bytes back onto the PolicyDocument + PolicyRef. The
         //     `encodePredicate` helper throws ToolError-shaped errors on cap
@@ -473,7 +511,34 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
         ],
         ambiguities: mergeAmbiguities(composed.ambiguities, scope.ambiguities),
     };
-    return { ok: true, data: proposed };
+    // --explain success envelope. The interpreter path populated
+    // `explain` + `explainSim` from the real self-verify verdict above;
+    // the OZ-only path did not (no predicate tree exists). When opts.explain
+    // is set and the OZ-only path ran, construct the minimal honest
+    // SimulationResult: the verdict is NOT a passing simulation - the
+    // interpreter was never engaged, so permit is deny with a truthful
+    // reason and evaluatedCases is empty.
+    const envelope = { ok: true, data: proposed };
+    if (opts.explain) {
+        if (explainSim) {
+            envelope.explain = { predicateTree: explain, simulation: explainSim };
+        }
+        else {
+            envelope.explain = {
+                predicateTree: null,
+                simulation: {
+                    permit: {
+                        tx: 'deny',
+                        reason: 'No self-verification was performed (interpreter adapter was not engaged)',
+                    },
+                    evaluatedCases: [],
+                    backend: 'ts-model',
+                    simulatorVersion: 'not-run',
+                },
+            };
+        }
+    }
+    return envelope;
 }
 /** OZ-side `uncovered` warning patterns that the interpreter adapter
  *  actually lowers when wired in. When the interpreter adapter succeeds, we

package/dist-cjs/types.d.ts

@@ -182,6 +182,14 @@ export type PredicateLeaf = {
 } | {
     kind: 'call_arg';
     index: number;
+} | {
+    kind: 'call_arg_len';
+    index: number;
+} | {
+    kind: 'call_arg_field';
+    index: number;
+    element: number;
+    field: string;
 } | {
     kind: 'amount';
     token: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/adapters/interpreter/adapter.ts

@@ -389,6 +389,10 @@ function lowerSelector(s: IRSelector): PredicateLeaf {
   switch (s.kind) {
     case 'arg':
       return { kind: 'call_arg', index: s.argIndex }
+    case 'arg_len':
+      return { kind: 'call_arg_len', index: s.argIndex }
+    case 'arg_field':
+      return { kind: 'call_arg_field', index: s.argIndex, element: s.element, field: s.field }
     case 'amount':
       return { kind: 'amount', token: s.token }
     case 'window_spent':
@@ -415,14 +419,15 @@ function lowerSelector(s: IRSelector): PredicateLeaf {
  *  selector kind to the matching `literal_*` kind. The IR compare value is a
  *  raw string (i128-safe); the selector kind fixes the canonical wire type:
  *    - arg       -> IR scalarType (set by the recorder/parser)
+ *    - arg_len   -> u32 (vec length is a small non-negative integer)
+ *    - arg_field -> IR scalarType (the field's recorded type)
  *    - amount    -> i128 (canonical Stellar token amount encoding)
  *    - window_spent -> i128 (canonical amount encoding)
  *    - oracle_price  -> i128 (canonical price encoding)
  *    - invocation_count -> u32 (counts are small non-negative integers)
  *    - now / valid_until -> u64 (unix timestamps in seconds) */
 function literalFromIRCompare(c: IRCompare): PredicateLeaf {
-  const scalarType: IRScalarType =
-    c.selector.kind === 'arg' ? c.selector.scalarType : literalScalarForSelector(c.selector.kind)
+  const scalarType: IRScalarType = selectorScalarType(c.selector)
   return literalFromScalar(c.value, scalarType)
 }
 
@@ -433,14 +438,16 @@ function literalScalarForSelector(kind: IRSelector['kind']): IRScalarType {
     case 'oracle_price':
       return 'i128'
     case 'invocation_count':
+    case 'arg_len':
       return 'u32'
     case 'now':
     case 'valid_until':
       return 'u64'
     case 'arg':
+    case 'arg_field':
     case 'calldata':
     case 'value':
-      // arg -> caller handles scalarType; calldata/value -> unreachable (Path-B).
+      // arg / arg_field -> caller handles scalarType; calldata/value -> unreachable (Path-B).
       return 'i128'
   }
 }
@@ -473,9 +480,10 @@ function literalFromScalar(value: string, scalarType: IRScalarType): PredicateLe
 /** Scalar type of an IRSelector for the purpose of building literal leaves
  *  (the right-hand side of `eq` / elements of an `in` haystack / elements of
  *  a `literal_vec`). Mirrors `literalScalarForSelector` for OZ extensions and
- *  uses the selector's own `scalarType` for `arg` selectors. */
+ *  uses the selector's own `scalarType` for `arg` and `arg_field` selectors. */
 function selectorScalarType(selector: IRSelector): IRScalarType {
   if (selector.kind === 'arg') return selector.scalarType
+  if (selector.kind === 'arg_field') return selector.scalarType
   return literalScalarForSelector(selector.kind)
 }
 
@@ -569,6 +577,10 @@ function describeCondition(cond: IRCondition): string {
           return `per-call amount comparison on ${s.token}`
         case 'arg':
           return `argument comparison on arg ${s.argIndex}`
+        case 'arg_len':
+          return `vec length comparison on arg ${s.argIndex}`
+        case 'arg_field':
+          return `map field comparison on arg ${s.argIndex}.${s.field}`
         case 'calldata':
           return 'EVM calldata comparison'
         case 'value':
@@ -585,6 +597,10 @@ function describeSelector(s: IRSelector): string {
   switch (s.kind) {
     case 'arg':
       return `arg ${s.argIndex}`
+    case 'arg_len':
+      return `arg_len(${s.argIndex})`
+    case 'arg_field':
+      return `arg_field(${s.argIndex}, ${s.element}, ${s.field})`
     case 'amount':
       return `amount(${s.token})`
     case 'window_spent':

package/src/adapters/oz/adapter.ts

@@ -307,6 +307,10 @@ function describeCondition(cond: IRCondition): string {
           return `per-call amount comparison on ${s.token} (predicate DSL)`
         case 'arg':
           return `argument comparison on arg ${s.argIndex} (predicate DSL)`
+        case 'arg_len':
+          return `vec length comparison on arg ${s.argIndex} (predicate DSL)`
+        case 'arg_field':
+          return `map field comparison on arg ${s.argIndex}.${s.field} (predicate DSL)`
         case 'calldata':
           return 'EVM calldata comparison (predicate DSL)'
         case 'value':
@@ -323,6 +327,10 @@ function describeSelector(s: IRSelector): string {
   switch (s.kind) {
     case 'arg':
       return `arg ${s.argIndex}`
+    case 'arg_len':
+      return `arg_len(${s.argIndex})`
+    case 'arg_field':
+      return `arg_field(${s.argIndex}, ${s.element}, ${s.field})`
     case 'amount':
       return `amount(${s.token})`
     case 'window_spent':

package/src/ir/types.ts

@@ -41,6 +41,14 @@ export type IRSelector =
       vecMode?: IRVecMode
       scalarType: IRScalarType
     } // Stellar StellarComp
+  | { kind: 'arg_len'; argIndex: number } // length of a vec-typed argument as u32
+  | {
+      kind: 'arg_field'
+      argIndex: number
+      element: number
+      field: string
+      scalarType: IRScalarType
+    } // field of a map element within a vec-typed argument
   | { kind: 'calldata'; offset: number; length: number } // EVM ByteComp
   | { kind: 'value' } // EVM tx.value
   // --- OZ extensions (not in NEAR-V2; lowered only by adapters that support them) ---

package/src/predicate/encode.ts

@@ -207,6 +207,15 @@ function encodeLeaf(leaf: PredicateLeaf): xdr.ScVal {
       return xdr.ScVal.scvVec([symbol('call_fn')])
     case 'call_arg':
       return xdr.ScVal.scvVec([symbol('call_arg'), xdr.ScVal.scvU32(leaf.index)])
+    case 'call_arg_len':
+      return xdr.ScVal.scvVec([symbol('call_arg_len'), xdr.ScVal.scvU32(leaf.index)])
+    case 'call_arg_field':
+      return xdr.ScVal.scvVec([
+        symbol('call_arg_field'),
+        xdr.ScVal.scvU32(leaf.index),
+        xdr.ScVal.scvU32(leaf.element),
+        xdr.ScVal.scvSymbol(leaf.field),
+      ])
     case 'amount':
       return xdr.ScVal.scvVec([symbol('amount'), scvAddressFromStrkey(leaf.token)])
     case 'window_spent':