@crediolabs/policy-synth 0.1.8 → 0.1.9

package/dist-cjs/synth/compose-from-recording.js

@@ -279,6 +279,95 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             }
         }
     }
+    // Blend `submit` ONLY (not `claim`, whose vec arg is a vec<u32> of
+    // reserve_token_ids - no map fields to bind). The `requests` vec
+    // (call_arg[3]) is a vec<Request{ address, amount, request_type }>. Each
+    // Request is the per-reserve action selector - 0 Supply, 1 Withdraw,
+    // 2 SupplyCollateral, 3 WithdrawCollateral, 4 Borrow, 5 Repay, 6-9
+    // liquidation/auction fills. Pinning only one element is unsafe: a caller
+    // can append a second element with a different action (WithdrawCollateral
+    // -> Borrow on a different asset, any amount, then auction fills). Length
+    // + per-element pinning is total; a quantifier over elements is not. If we
+    // cannot emit BOTH, we surface AMBIGUITY rather than emit a partial bind.
+    if (protocol.protocol === 'blend' && protocol.fn === 'submit' && interpreterEnabled) {
+        const requestsArg = topLevel.args[3];
+        if (requestsArg && requestsArg.type === 'vec') {
+            const elements = requestsArg.value;
+            interpreterConstraints.push({
+                op: 'compare',
+                compare: {
+                    selector: { kind: 'arg_len', argIndex: 3 },
+                    operator: 'eq',
+                    value: String(elements.length),
+                },
+            });
+            for (let i = 0; i < elements.length; i++) {
+                const element = elements[i];
+                if (!element || element.type !== 'map')
+                    continue;
+                const fields = element.value;
+                const fieldValue = (name, scalarType) => {
+                    const entry = fields.find((e) => e.key === name);
+                    if (!entry)
+                        return null;
+                    if (entry.val.type === 'address' && scalarType === 'address')
+                        return entry.val.value;
+                    if (entry.val.type === 'i128' && scalarType === 'i128')
+                        return entry.val.value;
+                    if (entry.val.type === 'u32' && scalarType === 'u32')
+                        return entry.val.value;
+                    return null;
+                };
+                const address = fieldValue('address', 'address');
+                const amount = fieldValue('amount', 'i128');
+                const requestType = fieldValue('request_type', 'u32');
+                if (address === null || amount === null || requestType === null)
+                    continue;
+                interpreterConstraints.push({
+                    op: 'compare',
+                    compare: {
+                        selector: {
+                            kind: 'arg_field',
+                            argIndex: 3,
+                            element: i,
+                            field: 'request_type',
+                            scalarType: 'u32',
+                        },
+                        operator: 'eq',
+                        value: requestType,
+                    },
+                });
+                interpreterConstraints.push({
+                    op: 'compare',
+                    compare: {
+                        selector: {
+                            kind: 'arg_field',
+                            argIndex: 3,
+                            element: i,
+                            field: 'address',
+                            scalarType: 'address',
+                        },
+                        operator: 'eq',
+                        value: address,
+                    },
+                });
+                interpreterConstraints.push({
+                    op: 'compare',
+                    compare: {
+                        selector: {
+                            kind: 'arg_field',
+                            argIndex: 3,
+                            element: i,
+                            field: 'amount',
+                            scalarType: 'i128',
+                        },
+                        operator: 'lte',
+                        value: amount,
+                    },
+                });
+            }
+        }
+    }
     // SoroSwap: the recorded hop path -> eq_seq on the path arg (call_arg[2]).
     // The interpreter adapter is the ONLY way to express an exact ordered
     // sequence (OZ built-ins cannot). Element order is preserved verbatim.

package/dist-cjs/synth/deny-cases.js

@@ -21,6 +21,15 @@ const ADJACENT_ASSETS = [
 const OVERPERMISSIVE_DIMENSIONS = ['argument_reorder'];
 exports.OVERPERMISSIVE_DIMENSIONS = OVERPERMISSIVE_DIMENSIONS;
 // The 15 dimensions the synth pipeline uses for self-verify and minimise.
+// Phase 1 grammar extension: `vec_append` and `map_field_flip` are listed below
+// alongside the existing dimensions so the per-element binds emitted for
+// Blend `submit` (call_arg_len + 3 call_arg_field per element) survive
+// minimise. Without these, no deny case exercises the new leaves and the
+// minimise pass drops them as "redundant" - reopening the element-append
+// hole they were added to close. Both dimensions are no-ops for any fixture
+// whose predicate has no `call_arg_len` / `call_arg_field` leaves (the
+// generator short-circuits on leaf-kind), so they cannot make production
+// synthesis refuse for fixtures that do not exercise the new grammar.
 const ORIGINAL_DIMENSIONS = [
     'amount',
     'asset',
@@ -37,6 +46,8 @@ const ORIGINAL_DIMENSIONS = [
     'oracle_deviation_exceeded',
     'oracle_paused',
     'soroswap_allowed_path',
+    'vec_append',
+    'map_field_flip',
 ];
 exports.ORIGINAL_DIMENSIONS = ORIGINAL_DIMENSIONS;
 /** Build deterministic model-evaluated alternatives without mutating the intended call.
@@ -196,7 +207,9 @@ function generateCases(predicate, permitCtx, dimensions) {
         hasConstrainedArg &&
         permitCtx.args.length >= 2 &&
         permitCtx.args[0]?.type === 'address' &&
-        permitCtx.args[1]?.type === 'address') {
+        permitCtx.args[1]?.type === 'address' &&
+        permitCtx.args[0].value !==
+            permitCtx.args[1].value) {
         const ctx = cloneContext(permitCtx);
         // Guard above guarantees args[0] and args[1] exist and are address-typed.
         const a0 = ctx.args[0];
@@ -205,6 +218,59 @@ function generateCases(predicate, permitCtx, dimensions) {
         ctx.args[1] = a0;
         denies.push({ dimension: 'argument_reorder', ctx });
     }
+    // --- map_field_flip: flip a bound map field to a different valid value of
+    // the same type. Mirrors argument_reorder: OPT-IN only, never ORIGINAL.
+    // Targets each `call_arg_field` leaf and produces a ctx whose vec element
+    // has a different value of the recorded field (different request_type,
+    // different amount, different address). The blend-submit case uses this
+    // to detect a missing request_type pin. ---
+    if (!dimensions || dimensions.includes('map_field_flip')) {
+        for (const comparison of facts.comparisons) {
+            const sel = comparison.left;
+            if (sel.kind !== 'call_arg_field')
+                continue;
+            const arg = permitCtx.args[sel.index];
+            if (!arg || arg.type !== 'vec')
+                continue;
+            const element = arg.value[sel.element];
+            if (!element || element.type !== 'map' || !Array.isArray(element.value))
+                continue;
+            const entry = element.value.find((e) => e.key === sel.field);
+            if (!entry)
+                continue;
+            const flipped = flipFieldValue(entry.val);
+            if (flipped === null)
+                continue;
+            const ctx = cloneContext(permitCtx);
+            const clonedVec = arg.value.map(cloneScVal);
+            const clonedElement = clonedVec[sel.element];
+            if (clonedElement?.type !== 'map' || !Array.isArray(clonedElement.value))
+                continue;
+            clonedElement.value = clonedElement.value.map((e) => e.key === sel.field ? { key: e.key, val: flipped } : e);
+            clonedVec[sel.element] = clonedElement;
+            ctx.args[sel.index] = { type: 'vec', value: clonedVec };
+            denies.push({ dimension: 'map_field_flip', ctx });
+        }
+    }
+    // --- vec_append: append a new element to a bound vec. Mirrors map_field_flip:
+    // OPT-IN only, never ORIGINAL. Targets every `call_arg_len` leaf; without the
+    // length pin a caller can append an extra element to defeat per-element binds. ---
+    if (!dimensions || dimensions.includes('vec_append')) {
+        for (const comparison of facts.comparisons) {
+            const sel = comparison.left;
+            if (sel.kind !== 'call_arg_len')
+                continue;
+            const arg = permitCtx.args[sel.index];
+            if (!arg || arg.type !== 'vec')
+                continue;
+            const ctx = cloneContext(permitCtx);
+            ctx.args[sel.index] = {
+                type: 'vec',
+                value: [...arg.value, { type: 'other', value: 'deny-case-vec-append' }],
+            };
+            denies.push({ dimension: 'vec_append', ctx });
+        }
+    }
     // Version mismatch, malformed predicates, master authorization, and nonce replay are install-time checks and are intentionally omitted from model-evaluated cases.
     return { permit: cloneContext(permitCtx), denies };
 }
@@ -436,3 +502,25 @@ function cloneDepthError(value) {
     err.depthContext = value.type;
     throw err;
 }
+/** Build a value of the SAME ScVal type that differs from the recorded one,
+ *  used by the `map_field_flip` mutation to defeat a per-element pin without
+ *  changing the wire type (a type/arity change is rejected by host dispatch
+ *  before Policy::enforce, so it is not the predicate's job). Returns null
+ *  when the ScVal type has no obvious different value (e.g. opaque/other). */
+function flipFieldValue(val) {
+    switch (val.type) {
+        case 'address': {
+            const a = 'GBFKRGJYZXLTDEI36ZCQEIM225NMOCR2VDBOIHJTXJ54FEFFVL2FKALE';
+            const b = 'GD6XSMQJ47EHHJOWXQOND5YDVZC37JWZJHYHBKE6QJFSLLJ5KQXM5QS5';
+            return { type: 'address', value: val.value === a ? b : a };
+        }
+        case 'i128':
+        case 'u64':
+        case 'u32':
+            return { type: val.type, value: String(BigInt(val.value) + 1n) };
+        case 'symbol':
+            return { type: 'symbol', value: `${val.value}x` };
+        default:
+            return null;
+    }
+}

package/dist-cjs/synth/evaluate.js

@@ -178,6 +178,38 @@ function evalCompare(op, left, right, ctx) {
             return evalArgOrderedCompare(op, actual, right);
         return evalArgEq(op, actual, right, ctx);
     }
+    // --- step 4c: call_arg_len: the length of a vec-typed argument as a u32.
+    // Fails closed on a non-vec arg, an absent arg, or a non-u32 literal.
+    if (left.kind === 'call_arg_len') {
+        const actual = ctx.args[left.index];
+        if (!actual || actual.type !== 'vec')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        if (right.kind !== 'literal_u32')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        return actual.value.length === right.value
+            ? { permit: true }
+            : { permit: false, reason: 'ARG_MISMATCH' };
+    }
+    // --- step 4d: call_arg_field: the value of a field in the map at element i
+    // of the vec at argument index. Fails closed on a non-vec arg, an
+    // out-of-range element, a missing field, a non-map element, or a type
+    // mismatch between the field ScVal and the literal leaf.
+    if (left.kind === 'call_arg_field') {
+        const actual = ctx.args[left.index];
+        if (!actual || actual.type !== 'vec')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        const element = actual.value[left.element];
+        if (!element || element.type !== 'map')
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        if (!Array.isArray(element.value))
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        const entry = element.value.find((e) => e.key === left.field);
+        if (!entry)
+            return { permit: false, reason: 'ARG_MISMATCH' };
+        if (op === 'eq')
+            return evalArgEq(op, entry.val, right, ctx);
+        return evalArgOrderedCompare(op, entry.val, right);
+    }
     // --- step 6: AMOUNT_BOUND ---
     if (left.kind === 'amount' && op !== 'eq') {
         return evalAmountCompare(op, left.token, right, ctx);
@@ -337,6 +369,23 @@ function resolveLeaf(leaf, ctx) {
             return { type: 'symbol', value: ctx.fn };
         case 'call_arg':
             return ctx.args[leaf.index];
+        case 'call_arg_len':
+            // No direct ScVal projection: the length is an integer the comparator
+            // resolves against the right-hand literal. Returning undefined keeps
+            // the `in` membership path structurally informed (no haystack match).
+            return undefined;
+        case 'call_arg_field': {
+            const actual = ctx.args[leaf.index];
+            if (!actual || actual.type !== 'vec')
+                return undefined;
+            const element = actual.value[leaf.element];
+            if (!element || element.type !== 'map')
+                return undefined;
+            if (!Array.isArray(element.value))
+                return undefined;
+            const entry = element.value.find((e) => e.key === leaf.field);
+            return entry ? entry.val : undefined;
+        }
         case 'amount':
         case 'window_spent':
         case 'oracle_price':

package/dist-cjs/types.d.ts

@@ -182,6 +182,14 @@ export type PredicateLeaf = {
 } | {
     kind: 'call_arg';
     index: number;
+} | {
+    kind: 'call_arg_len';
+    index: number;
+} | {
+    kind: 'call_arg_field';
+    index: number;
+    element: number;
+    field: string;
 } | {
     kind: 'amount';
     token: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/adapters/interpreter/adapter.ts

@@ -389,6 +389,10 @@ function lowerSelector(s: IRSelector): PredicateLeaf {
   switch (s.kind) {
     case 'arg':
       return { kind: 'call_arg', index: s.argIndex }
+    case 'arg_len':
+      return { kind: 'call_arg_len', index: s.argIndex }
+    case 'arg_field':
+      return { kind: 'call_arg_field', index: s.argIndex, element: s.element, field: s.field }
     case 'amount':
       return { kind: 'amount', token: s.token }
     case 'window_spent':
@@ -415,14 +419,15 @@ function lowerSelector(s: IRSelector): PredicateLeaf {
  *  selector kind to the matching `literal_*` kind. The IR compare value is a
  *  raw string (i128-safe); the selector kind fixes the canonical wire type:
  *    - arg       -> IR scalarType (set by the recorder/parser)
+ *    - arg_len   -> u32 (vec length is a small non-negative integer)
+ *    - arg_field -> IR scalarType (the field's recorded type)
  *    - amount    -> i128 (canonical Stellar token amount encoding)
  *    - window_spent -> i128 (canonical amount encoding)
  *    - oracle_price  -> i128 (canonical price encoding)
  *    - invocation_count -> u32 (counts are small non-negative integers)
  *    - now / valid_until -> u64 (unix timestamps in seconds) */
 function literalFromIRCompare(c: IRCompare): PredicateLeaf {
-  const scalarType: IRScalarType =
-    c.selector.kind === 'arg' ? c.selector.scalarType : literalScalarForSelector(c.selector.kind)
+  const scalarType: IRScalarType = selectorScalarType(c.selector)
   return literalFromScalar(c.value, scalarType)
 }
 
@@ -433,14 +438,16 @@ function literalScalarForSelector(kind: IRSelector['kind']): IRScalarType {
     case 'oracle_price':
       return 'i128'
     case 'invocation_count':
+    case 'arg_len':
       return 'u32'
     case 'now':
     case 'valid_until':
       return 'u64'
     case 'arg':
+    case 'arg_field':
     case 'calldata':
     case 'value':
-      // arg -> caller handles scalarType; calldata/value -> unreachable (Path-B).
+      // arg / arg_field -> caller handles scalarType; calldata/value -> unreachable (Path-B).
       return 'i128'
   }
 }
@@ -473,9 +480,10 @@ function literalFromScalar(value: string, scalarType: IRScalarType): PredicateLe
 /** Scalar type of an IRSelector for the purpose of building literal leaves
  *  (the right-hand side of `eq` / elements of an `in` haystack / elements of
  *  a `literal_vec`). Mirrors `literalScalarForSelector` for OZ extensions and
- *  uses the selector's own `scalarType` for `arg` selectors. */
+ *  uses the selector's own `scalarType` for `arg` and `arg_field` selectors. */
 function selectorScalarType(selector: IRSelector): IRScalarType {
   if (selector.kind === 'arg') return selector.scalarType
+  if (selector.kind === 'arg_field') return selector.scalarType
   return literalScalarForSelector(selector.kind)
 }
 
@@ -569,6 +577,10 @@ function describeCondition(cond: IRCondition): string {
           return `per-call amount comparison on ${s.token}`
         case 'arg':
           return `argument comparison on arg ${s.argIndex}`
+        case 'arg_len':
+          return `vec length comparison on arg ${s.argIndex}`
+        case 'arg_field':
+          return `map field comparison on arg ${s.argIndex}.${s.field}`
         case 'calldata':
           return 'EVM calldata comparison'
         case 'value':
@@ -585,6 +597,10 @@ function describeSelector(s: IRSelector): string {
   switch (s.kind) {
     case 'arg':
       return `arg ${s.argIndex}`
+    case 'arg_len':
+      return `arg_len(${s.argIndex})`
+    case 'arg_field':
+      return `arg_field(${s.argIndex}, ${s.element}, ${s.field})`
     case 'amount':
       return `amount(${s.token})`
     case 'window_spent':

package/src/adapters/oz/adapter.ts

@@ -307,6 +307,10 @@ function describeCondition(cond: IRCondition): string {
           return `per-call amount comparison on ${s.token} (predicate DSL)`
         case 'arg':
           return `argument comparison on arg ${s.argIndex} (predicate DSL)`
+        case 'arg_len':
+          return `vec length comparison on arg ${s.argIndex} (predicate DSL)`
+        case 'arg_field':
+          return `map field comparison on arg ${s.argIndex}.${s.field} (predicate DSL)`
         case 'calldata':
           return 'EVM calldata comparison (predicate DSL)'
         case 'value':
@@ -323,6 +327,10 @@ function describeSelector(s: IRSelector): string {
   switch (s.kind) {
     case 'arg':
       return `arg ${s.argIndex}`
+    case 'arg_len':
+      return `arg_len(${s.argIndex})`
+    case 'arg_field':
+      return `arg_field(${s.argIndex}, ${s.element}, ${s.field})`
     case 'amount':
       return `amount(${s.token})`
     case 'window_spent':

package/src/ir/types.ts

@@ -41,6 +41,14 @@ export type IRSelector =
       vecMode?: IRVecMode
       scalarType: IRScalarType
     } // Stellar StellarComp
+  | { kind: 'arg_len'; argIndex: number } // length of a vec-typed argument as u32
+  | {
+      kind: 'arg_field'
+      argIndex: number
+      element: number
+      field: string
+      scalarType: IRScalarType
+    } // field of a map element within a vec-typed argument
   | { kind: 'calldata'; offset: number; length: number } // EVM ByteComp
   | { kind: 'value' } // EVM tx.value
   // --- OZ extensions (not in NEAR-V2; lowered only by adapters that support them) ---

package/src/predicate/encode.ts

@@ -207,6 +207,15 @@ function encodeLeaf(leaf: PredicateLeaf): xdr.ScVal {
       return xdr.ScVal.scvVec([symbol('call_fn')])
     case 'call_arg':
       return xdr.ScVal.scvVec([symbol('call_arg'), xdr.ScVal.scvU32(leaf.index)])
+    case 'call_arg_len':
+      return xdr.ScVal.scvVec([symbol('call_arg_len'), xdr.ScVal.scvU32(leaf.index)])
+    case 'call_arg_field':
+      return xdr.ScVal.scvVec([
+        symbol('call_arg_field'),
+        xdr.ScVal.scvU32(leaf.index),
+        xdr.ScVal.scvU32(leaf.element),
+        xdr.ScVal.scvSymbol(leaf.field),
+      ])
     case 'amount':
       return xdr.ScVal.scvVec([symbol('amount'), scvAddressFromStrkey(leaf.token)])
     case 'window_spent':

package/src/review-card/builder.ts

@@ -222,6 +222,8 @@ function renderVecElement(leaf: PredicateLeaf): string {
     case 'call_contract':
     case 'call_fn':
     case 'call_arg':
+    case 'call_arg_len':
+    case 'call_arg_field':
     case 'amount':
     case 'window_spent':
     case 'now':

package/src/review-card/cross-check.ts

@@ -119,6 +119,8 @@ function renderVecElement(leaf: PredicateLeaf): string {
     case 'call_contract':
     case 'call_fn':
     case 'call_arg':
+    case 'call_arg_len':
+    case 'call_arg_field':
     case 'amount':
     case 'window_spent':
     case 'now':

package/src/synth/compose-from-recording.ts

@@ -381,6 +381,93 @@ function appendProtocolSpecificConstraints(
     }
   }
 
+  // Blend `submit` ONLY (not `claim`, whose vec arg is a vec<u32> of
+  // reserve_token_ids - no map fields to bind). The `requests` vec
+  // (call_arg[3]) is a vec<Request{ address, amount, request_type }>. Each
+  // Request is the per-reserve action selector - 0 Supply, 1 Withdraw,
+  // 2 SupplyCollateral, 3 WithdrawCollateral, 4 Borrow, 5 Repay, 6-9
+  // liquidation/auction fills. Pinning only one element is unsafe: a caller
+  // can append a second element with a different action (WithdrawCollateral
+  // -> Borrow on a different asset, any amount, then auction fills). Length
+  // + per-element pinning is total; a quantifier over elements is not. If we
+  // cannot emit BOTH, we surface AMBIGUITY rather than emit a partial bind.
+  if (protocol.protocol === 'blend' && protocol.fn === 'submit' && interpreterEnabled) {
+    const requestsArg = topLevel.args[3]
+    if (requestsArg && requestsArg.type === 'vec') {
+      const elements = requestsArg.value
+      interpreterConstraints.push({
+        op: 'compare',
+        compare: {
+          selector: { kind: 'arg_len', argIndex: 3 },
+          operator: 'eq',
+          value: String(elements.length),
+        },
+      })
+      for (let i = 0; i < elements.length; i++) {
+        const element = elements[i]
+        if (!element || element.type !== 'map') continue
+        const fields = element.value
+        const fieldValue = (
+          name: string,
+          scalarType: 'address' | 'i128' | 'u32'
+        ): string | null => {
+          const entry = fields.find((e) => e.key === name)
+          if (!entry) return null
+          if (entry.val.type === 'address' && scalarType === 'address') return entry.val.value
+          if (entry.val.type === 'i128' && scalarType === 'i128') return entry.val.value
+          if (entry.val.type === 'u32' && scalarType === 'u32') return entry.val.value
+          return null
+        }
+        const address = fieldValue('address', 'address')
+        const amount = fieldValue('amount', 'i128')
+        const requestType = fieldValue('request_type', 'u32')
+        if (address === null || amount === null || requestType === null) continue
+        interpreterConstraints.push({
+          op: 'compare',
+          compare: {
+            selector: {
+              kind: 'arg_field',
+              argIndex: 3,
+              element: i,
+              field: 'request_type',
+              scalarType: 'u32',
+            },
+            operator: 'eq',
+            value: requestType,
+          },
+        })
+        interpreterConstraints.push({
+          op: 'compare',
+          compare: {
+            selector: {
+              kind: 'arg_field',
+              argIndex: 3,
+              element: i,
+              field: 'address',
+              scalarType: 'address',
+            },
+            operator: 'eq',
+            value: address,
+          },
+        })
+        interpreterConstraints.push({
+          op: 'compare',
+          compare: {
+            selector: {
+              kind: 'arg_field',
+              argIndex: 3,
+              element: i,
+              field: 'amount',
+              scalarType: 'i128',
+            },
+            operator: 'lte',
+            value: amount,
+          },
+        })
+      }
+    }
+  }
+
   // SoroSwap: the recorded hop path -> eq_seq on the path arg (call_arg[2]).
   // The interpreter adapter is the ONLY way to express an exact ordered
   // sequence (OZ built-ins cannot). Element order is preserved verbatim.

package/src/synth/deny-cases.ts

@@ -51,6 +51,15 @@ const ADJACENT_ASSETS = [
 const OVERPERMISSIVE_DIMENSIONS = ['argument_reorder'] as const
 
 // The 15 dimensions the synth pipeline uses for self-verify and minimise.
+// Phase 1 grammar extension: `vec_append` and `map_field_flip` are listed below
+// alongside the existing dimensions so the per-element binds emitted for
+// Blend `submit` (call_arg_len + 3 call_arg_field per element) survive
+// minimise. Without these, no deny case exercises the new leaves and the
+// minimise pass drops them as "redundant" - reopening the element-append
+// hole they were added to close. Both dimensions are no-ops for any fixture
+// whose predicate has no `call_arg_len` / `call_arg_field` leaves (the
+// generator short-circuits on leaf-kind), so they cannot make production
+// synthesis refuse for fixtures that do not exercise the new grammar.
 const ORIGINAL_DIMENSIONS: string[] = [
   'amount',
   'asset',
@@ -67,6 +76,8 @@ const ORIGINAL_DIMENSIONS: string[] = [
   'oracle_deviation_exceeded',
   'oracle_paused',
   'soroswap_allowed_path',
+  'vec_append',
+  'map_field_flip',
 ]
 
 export { ORIGINAL_DIMENSIONS, OVERPERMISSIVE_DIMENSIONS }
@@ -263,7 +274,9 @@ export function generateCases(
     hasConstrainedArg &&
     permitCtx.args.length >= 2 &&
     permitCtx.args[0]?.type === 'address' &&
-    permitCtx.args[1]?.type === 'address'
+    permitCtx.args[1]?.type === 'address' &&
+    (permitCtx.args[0] as { type: 'address'; value: string }).value !==
+      (permitCtx.args[1] as { type: 'address'; value: string }).value
   ) {
     const ctx = cloneContext(permitCtx)
     // Guard above guarantees args[0] and args[1] exist and are address-typed.
@@ -274,6 +287,55 @@ export function generateCases(
     denies.push({ dimension: 'argument_reorder', ctx })
   }
 
+  // --- map_field_flip: flip a bound map field to a different valid value of
+  // the same type. Mirrors argument_reorder: OPT-IN only, never ORIGINAL.
+  // Targets each `call_arg_field` leaf and produces a ctx whose vec element
+  // has a different value of the recorded field (different request_type,
+  // different amount, different address). The blend-submit case uses this
+  // to detect a missing request_type pin. ---
+  if (!dimensions || dimensions.includes('map_field_flip')) {
+    for (const comparison of facts.comparisons) {
+      const sel = comparison.left
+      if (sel.kind !== 'call_arg_field') continue
+      const arg = permitCtx.args[sel.index]
+      if (!arg || arg.type !== 'vec') continue
+      const element = arg.value[sel.element]
+      if (!element || element.type !== 'map' || !Array.isArray(element.value)) continue
+      const entry = element.value.find((e) => e.key === sel.field)
+      if (!entry) continue
+      const flipped = flipFieldValue(entry.val)
+      if (flipped === null) continue
+      const ctx = cloneContext(permitCtx)
+      const clonedVec = arg.value.map(cloneScVal)
+      const clonedElement = clonedVec[sel.element]
+      if (clonedElement?.type !== 'map' || !Array.isArray(clonedElement.value)) continue
+      clonedElement.value = clonedElement.value.map((e) =>
+        e.key === sel.field ? { key: e.key, val: flipped } : e
+      )
+      clonedVec[sel.element] = clonedElement
+      ctx.args[sel.index] = { type: 'vec', value: clonedVec }
+      denies.push({ dimension: 'map_field_flip', ctx })
+    }
+  }
+
+  // --- vec_append: append a new element to a bound vec. Mirrors map_field_flip:
+  // OPT-IN only, never ORIGINAL. Targets every `call_arg_len` leaf; without the
+  // length pin a caller can append an extra element to defeat per-element binds. ---
+  if (!dimensions || dimensions.includes('vec_append')) {
+    for (const comparison of facts.comparisons) {
+      const sel = comparison.left
+      if (sel.kind !== 'call_arg_len') continue
+      const arg = permitCtx.args[sel.index]
+      if (!arg || arg.type !== 'vec') continue
+      const ctx = cloneContext(permitCtx)
+      ctx.args[sel.index] = {
+        type: 'vec',
+        value: [...arg.value, { type: 'other', value: 'deny-case-vec-append' }],
+      }
+      denies.push({ dimension: 'vec_append', ctx })
+    }
+  }
+
   // Version mismatch, malformed predicates, master authorization, and nonce replay are install-time checks and are intentionally omitted from model-evaluated cases.
   return { permit: cloneContext(permitCtx), denies }
 }
@@ -528,3 +590,26 @@ function cloneDepthError(value: ScVal): never {
   err.depthContext = value.type
   throw err
 }
+
+/** Build a value of the SAME ScVal type that differs from the recorded one,
+ *  used by the `map_field_flip` mutation to defeat a per-element pin without
+ *  changing the wire type (a type/arity change is rejected by host dispatch
+ *  before Policy::enforce, so it is not the predicate's job). Returns null
+ *  when the ScVal type has no obvious different value (e.g. opaque/other). */
+function flipFieldValue(val: ScVal): ScVal | null {
+  switch (val.type) {
+    case 'address': {
+      const a = 'GBFKRGJYZXLTDEI36ZCQEIM225NMOCR2VDBOIHJTXJ54FEFFVL2FKALE'
+      const b = 'GD6XSMQJ47EHHJOWXQOND5YDVZC37JWZJHYHBKE6QJFSLLJ5KQXM5QS5'
+      return { type: 'address', value: val.value === a ? b : a }
+    }
+    case 'i128':
+    case 'u64':
+    case 'u32':
+      return { type: val.type, value: String(BigInt(val.value) + 1n) }
+    case 'symbol':
+      return { type: 'symbol', value: `${val.value}x` }
+    default:
+      return null
+  }
+}