@crediolabs/policy-synth 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (184) hide show
  1. package/README.md +4 -4
  2. package/dist/adapters/interpreter/adapter.d.ts +19 -25
  3. package/dist/adapters/interpreter/adapter.js +54 -487
  4. package/dist/adapters/interpreter/index.d.ts +1 -1
  5. package/dist/adapters/interpreter/index.js +1 -1
  6. package/dist/adapters/oz/adapter.js +1 -15
  7. package/dist/errors.d.ts +1 -1
  8. package/dist/index.d.ts +1 -4
  9. package/dist/index.js +1 -4
  10. package/dist/install/build-add-context-rule.d.ts +3 -19
  11. package/dist/install/build-add-context-rule.js +3 -98
  12. package/dist/install/build-install-policy.d.ts +4 -53
  13. package/dist/install/build-install-policy.js +44 -123
  14. package/dist/install/index.d.ts +0 -2
  15. package/dist/install/index.js +0 -7
  16. package/dist/ir/index.d.ts +1 -1
  17. package/dist/ir/types.d.ts +7 -76
  18. package/dist/ir/types.js +0 -2
  19. package/dist/predicate/decode.d.ts +1 -1
  20. package/dist/predicate/decode.js +2 -70
  21. package/dist/predicate/encode.js +45 -229
  22. package/dist/predicate/from-json.js +1 -42
  23. package/dist/record/decode.js +3 -8
  24. package/dist/review-card/builder.d.ts +4 -3
  25. package/dist/review-card/builder.js +18 -162
  26. package/dist/review-card/cross-check.js +2 -105
  27. package/dist/review-card/render-leaf.d.ts +4 -0
  28. package/dist/review-card/render-leaf.js +47 -0
  29. package/dist/run/index.d.ts +36 -139
  30. package/dist/run/index.js +125 -437
  31. package/dist/run/schemas.d.ts +168 -1929
  32. package/dist/run/schemas.js +40 -269
  33. package/dist/seams/types.d.ts +0 -2
  34. package/dist/simulate/deny-cases.d.ts +26 -0
  35. package/dist/simulate/deny-cases.js +282 -0
  36. package/dist/simulate/evaluate.d.ts +18 -0
  37. package/dist/simulate/evaluate.js +271 -0
  38. package/dist/simulate/index.d.ts +4 -0
  39. package/dist/simulate/index.js +8 -0
  40. package/dist/synth/compose-from-recording.d.ts +24 -51
  41. package/dist/synth/compose-from-recording.js +120 -282
  42. package/dist/synth/deny-cases.d.ts +5 -7
  43. package/dist/synth/deny-cases.js +23 -373
  44. package/dist/synth/evaluate.d.ts +0 -21
  45. package/dist/synth/evaluate.js +56 -336
  46. package/dist/synth/index.d.ts +0 -5
  47. package/dist/synth/index.js +0 -5
  48. package/dist/synth/permit-context.d.ts +2 -9
  49. package/dist/synth/permit-context.js +1 -82
  50. package/dist/synth/synthesize-from-recording.d.ts +1 -29
  51. package/dist/synth/synthesize-from-recording.js +41 -356
  52. package/dist/types.d.ts +8 -60
  53. package/dist/types.js +5 -2
  54. package/dist/verify/simulate.d.ts +1 -14
  55. package/dist/verify/simulate.js +2 -88
  56. package/dist/verify/verify.d.ts +1 -7
  57. package/dist/verify/verify.js +0 -8
  58. package/dist-cjs/adapters/interpreter/adapter.d.ts +19 -25
  59. package/dist-cjs/adapters/interpreter/adapter.js +56 -489
  60. package/dist-cjs/adapters/interpreter/index.d.ts +1 -1
  61. package/dist-cjs/adapters/interpreter/index.js +1 -2
  62. package/dist-cjs/adapters/oz/adapter.js +1 -15
  63. package/dist-cjs/errors.d.ts +1 -1
  64. package/dist-cjs/index.d.ts +1 -4
  65. package/dist-cjs/index.js +1 -4
  66. package/dist-cjs/install/build-add-context-rule.d.ts +3 -19
  67. package/dist-cjs/install/build-add-context-rule.js +1 -97
  68. package/dist-cjs/install/build-install-policy.d.ts +4 -53
  69. package/dist-cjs/install/build-install-policy.js +44 -122
  70. package/dist-cjs/install/index.d.ts +0 -2
  71. package/dist-cjs/install/index.js +2 -23
  72. package/dist-cjs/ir/index.d.ts +1 -1
  73. package/dist-cjs/ir/types.d.ts +7 -76
  74. package/dist-cjs/ir/types.js +0 -2
  75. package/dist-cjs/predicate/decode.d.ts +1 -1
  76. package/dist-cjs/predicate/decode.js +2 -70
  77. package/dist-cjs/predicate/encode.js +45 -229
  78. package/dist-cjs/predicate/from-json.js +1 -42
  79. package/dist-cjs/record/decode.js +3 -8
  80. package/dist-cjs/review-card/builder.d.ts +4 -3
  81. package/dist-cjs/review-card/builder.js +23 -167
  82. package/dist-cjs/review-card/cross-check.js +7 -110
  83. package/dist-cjs/review-card/render-leaf.d.ts +4 -0
  84. package/dist-cjs/review-card/render-leaf.js +52 -0
  85. package/dist-cjs/run/index.d.ts +36 -139
  86. package/dist-cjs/run/index.js +125 -444
  87. package/dist-cjs/run/schemas.d.ts +168 -1929
  88. package/dist-cjs/run/schemas.js +41 -270
  89. package/dist-cjs/seams/types.d.ts +0 -2
  90. package/dist-cjs/simulate/deny-cases.d.ts +26 -0
  91. package/dist-cjs/simulate/deny-cases.js +286 -0
  92. package/dist-cjs/simulate/evaluate.d.ts +18 -0
  93. package/dist-cjs/simulate/evaluate.js +274 -0
  94. package/dist-cjs/simulate/index.d.ts +4 -0
  95. package/dist-cjs/simulate/index.js +13 -0
  96. package/dist-cjs/synth/compose-from-recording.d.ts +24 -51
  97. package/dist-cjs/synth/compose-from-recording.js +120 -282
  98. package/dist-cjs/synth/deny-cases.d.ts +5 -7
  99. package/dist-cjs/synth/deny-cases.js +23 -374
  100. package/dist-cjs/synth/evaluate.d.ts +0 -21
  101. package/dist-cjs/synth/evaluate.js +57 -337
  102. package/dist-cjs/synth/index.d.ts +0 -5
  103. package/dist-cjs/synth/index.js +1 -11
  104. package/dist-cjs/synth/permit-context.d.ts +2 -9
  105. package/dist-cjs/synth/permit-context.js +1 -82
  106. package/dist-cjs/synth/synthesize-from-recording.d.ts +1 -29
  107. package/dist-cjs/synth/synthesize-from-recording.js +39 -354
  108. package/dist-cjs/types.d.ts +8 -60
  109. package/dist-cjs/types.js +6 -3
  110. package/dist-cjs/verify/simulate.d.ts +1 -14
  111. package/dist-cjs/verify/simulate.js +2 -88
  112. package/dist-cjs/verify/verify.d.ts +1 -7
  113. package/dist-cjs/verify/verify.js +0 -8
  114. package/package.json +4 -4
  115. package/src/adapters/interpreter/adapter.ts +76 -572
  116. package/src/errors.ts +0 -19
  117. package/src/index.ts +1 -4
  118. package/src/install/build-add-context-rule.ts +5 -139
  119. package/src/install/build-install-policy.ts +93 -214
  120. package/src/install/index.ts +0 -34
  121. package/src/predicate/decode.ts +2 -70
  122. package/src/predicate/encode.ts +49 -261
  123. package/src/predicate/from-json.ts +1 -43
  124. package/src/record/decode.ts +3 -8
  125. package/src/review-card/builder.ts +19 -168
  126. package/src/review-card/cross-check.ts +3 -105
  127. package/src/review-card/render-leaf.ts +48 -0
  128. package/src/run/index.ts +144 -572
  129. package/src/run/schemas.ts +42 -291
  130. package/src/simulate/deny-cases.ts +334 -0
  131. package/src/simulate/evaluate.ts +284 -0
  132. package/src/simulate/index.ts +11 -0
  133. package/src/synth/compose-from-recording.ts +148 -347
  134. package/src/synth/index.ts +0 -13
  135. package/src/synth/synthesize-from-recording.ts +43 -456
  136. package/src/types.ts +13 -49
  137. package/dist/install/authority-overlap.d.ts +0 -134
  138. package/dist/install/authority-overlap.js +0 -0
  139. package/dist/install/build-install-predicate.d.ts +0 -96
  140. package/dist/install/build-install-predicate.js +0 -444
  141. package/dist/install/build-merge-policy.d.ts +0 -70
  142. package/dist/install/build-merge-policy.js +0 -130
  143. package/dist/install/plan-merge-policy.d.ts +0 -49
  144. package/dist/install/plan-merge-policy.js +0 -86
  145. package/dist/install/read-account-rules.d.ts +0 -100
  146. package/dist/install/read-account-rules.js +0 -283
  147. package/dist-cjs/install/authority-overlap.d.ts +0 -134
  148. package/dist-cjs/install/authority-overlap.js +0 -0
  149. package/dist-cjs/install/build-install-predicate.d.ts +0 -96
  150. package/dist-cjs/install/build-install-predicate.js +0 -479
  151. package/dist-cjs/install/build-merge-policy.d.ts +0 -70
  152. package/dist-cjs/install/build-merge-policy.js +0 -134
  153. package/dist-cjs/install/plan-merge-policy.d.ts +0 -49
  154. package/dist-cjs/install/plan-merge-policy.js +0 -90
  155. package/dist-cjs/install/read-account-rules.d.ts +0 -100
  156. package/dist-cjs/install/read-account-rules.js +0 -296
  157. package/src/adapters/interpreter/index.ts +0 -8
  158. package/src/adapters/oz/adapter.ts +0 -376
  159. package/src/adapters/oz/index.ts +0 -9
  160. package/src/codegen/compile-gate.ts +0 -167
  161. package/src/codegen/index.ts +0 -17
  162. package/src/codegen/template.ts +0 -165
  163. package/src/install/authority-overlap.ts +0 -0
  164. package/src/install/build-merge-policy.ts +0 -219
  165. package/src/install/plan-merge-policy.ts +0 -133
  166. package/src/install/read-account-rules.ts +0 -376
  167. package/src/ir/index.ts +0 -13
  168. package/src/ir/types.ts +0 -132
  169. package/src/mandate/index.ts +0 -4
  170. package/src/mandate/to-ir.ts +0 -71
  171. package/src/mandate/types.ts +0 -21
  172. package/src/seams/index.ts +0 -11
  173. package/src/seams/types.ts +0 -81
  174. package/src/synth/deny-cases.ts +0 -663
  175. package/src/synth/evaluate.ts +0 -613
  176. package/src/synth/harness.ts +0 -68
  177. package/src/synth/minimize.ts +0 -48
  178. package/src/synth/permit-context.ts +0 -136
  179. package/src/synth/predicate-literals.ts +0 -27
  180. package/src/synth/synthesize-from-mandate.ts +0 -82
  181. package/src/verify/envelope.ts +0 -28
  182. package/src/verify/index.ts +0 -5
  183. package/src/verify/simulate.ts +0 -311
  184. package/src/verify/verify.ts +0 -243
package/README.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # @crediolabs/policy-synth
2
2
 
3
- Off-chain synthesis core for the OctoGate policy layer on Stellar. It turns a
3
+ Off-chain synthesis core for the OZ Policy Builder on Stellar. It turns a
4
4
  transaction you recorded, or a mandate you can state in one sentence, into the
5
5
  minimal on-chain policy that permits exactly that flow, then verifies,
6
6
  simulates, and packages it for installation on an
@@ -8,7 +8,7 @@ simulates, and packages it for installation on an
8
8
 
9
9
  The on-chain half is the `policy-interpreter` Soroban contract, which lives in
10
10
  the same repository:
11
- [untangledfinance/octogate](https://github.com/untangledfinance/octogate).
11
+ [untangledfinance/oz-policy-builder](https://github.com/untangledfinance/oz-policy-builder).
12
12
 
13
13
  ## Install
14
14
 
@@ -55,10 +55,10 @@ Nothing in this package holds key material. Install and revoke return
55
55
  The synthesiser is the convenience layer; enforcement lives on chain in the
56
56
  policy interpreter, whose deployed addresses and wasm sha256 are pinned in
57
57
  `src/run/schemas.ts` and checked against the live network on install. The
58
- [architecture document](https://github.com/untangledfinance/octogate/blob/main/docs/architecture.md)
58
+ [architecture document](https://github.com/untangledfinance/oz-policy-builder/blob/main/docs/architecture.md)
59
59
  is specific about what is and is not enforced; the audit status of the
60
60
  contracts is stated in the
61
- [repository README](https://github.com/untangledfinance/octogate#readme).
61
+ [repository README](https://github.com/untangledfinance/oz-policy-builder#readme).
62
62
 
63
63
  ## Related packages
64
64
 
@@ -1,15 +1,8 @@
1
- import type { IRPolicyRule } from '../../ir/types.ts';
2
- import type { CustodyAdapter } from '../../seams/types.ts';
3
- import type { Network, PredicateNode } from '../../types.ts';
1
+ import type { ComposedRule } from '../../synth/compose-from-recording.ts';
2
+ import { type Network, type PredicateNode, type ProposedPolicy } from '../../types.ts';
4
3
  /** [VERIFY] NOT a real deployed address. The interpreter is a per-network
5
4
  * deploy artifact we do not have yet; install is a later phase. */
6
5
  export declare const PLACEHOLDER_INTERPRETER_ADDRESS = "VERIFY-interpreter-address";
7
- /** Wasm-level oracle defaults (mirrors the interpreter's `OracleParams`).
8
- * Per-policy overrides may TIGHTEN only - they may never exceed these. */
9
- export declare const ORACLE_DEFAULTS: {
10
- readonly maxStalenessSeconds: 600;
11
- readonly maxDeviationBps: 200;
12
- };
13
6
  export interface InterpreterAdapterConfig {
14
7
  network: Network;
15
8
  /** Per-rule install nonce (first install = 1; replay-protected). */
@@ -18,20 +11,21 @@ export interface InterpreterAdapterConfig {
18
11
  * by the self-call gate: any `in`-allowlist containing this address is
19
12
  * rejected as `SCOPE_SELF_CALL`. */
20
13
  smartAccountAddress: string;
21
- /** Optional per-policy oracle overrides. Must TIGHTEN vs ORACLE_DEFAULTS
22
- * (i.e. <= each default). A widening value throws ORACLE_PARAMS_OUT_OF_RANGE
23
- * at compile time. */
24
- oracleParams?: {
25
- maxStalenessSeconds?: number;
26
- maxDeviationBps?: number;
27
- };
28
14
  }
29
- export declare function createInterpreterAdapter(config: InterpreterAdapterConfig): CustodyAdapter;
30
- /** Lower a single IR rule to the canonical pre-encoding `PredicateNode`. The
31
- * orchestrator uses this to wire the self-verify + minimise pipeline: after
32
- * `compile(ir)` succeeds it re-derives the PredicateNode via this helper to
33
- * drive `minimize` and `runHarness` on the SAME shape the encoder saw. Pure
34
- * and deterministic: same `rule + config` -> byte-identical PredicateNode.
35
- * The `uncovered` list is NOT re-derived - callers needing it must use
36
- * `compile(ir)`. */
37
- export declare function lowerRuleToPredicate(rule: IRPolicyRule, config: InterpreterAdapterConfig): PredicateNode;
15
+ /** The result of compiling a PolicyIR for this backend. */
16
+ export interface CompileResult {
17
+ /** false => some IR construct this backend cannot express (see `uncovered`). */
18
+ covered: boolean;
19
+ /** Human-readable list of unsupported constructs. */
20
+ uncovered: string[];
21
+ /** The installable policy, assembled when a rule lowered. */
22
+ proposed?: ProposedPolicy;
23
+ }
24
+ /** Lower a single rule to the canonical pre-encoding `PredicateNode`. The
25
+ * orchestrator re-derives the PredicateNode through this helper so it holds the
26
+ * SAME shape the encoder saw. Pure and deterministic: same `rule + config` ->
27
+ * byte-identical PredicateNode. The `uncovered` list is NOT re-derived -
28
+ * callers needing it must use `compileInterpreterPolicy(rule, config)`. */
29
+ export declare function lowerRuleToPredicate(rule: ComposedRule, config: InterpreterAdapterConfig): PredicateNode;
30
+ /** Compile a composed rule to an installable interpreter policy. */
31
+ export declare function compileInterpreterPolicy(rule: ComposedRule, config: InterpreterAdapterConfig): CompileResult;