@crediolabs/policy-synth 0.2.0 → 0.3.0

package/dist/synth/deny-cases.js

@@ -1,155 +1,23 @@
 import { MAX_SCVAL_CLONE_DEPTH } from "../types.js";
-import { literalNumericBigInt } from "./predicate-literals.js";
-const ORACLE_CASES = [
-    ['oracle_stale', 'stale'],
-    ['oracle_missing', 'missing'],
-    ['oracle_deviation_exceeded', 'deviation'],
-    ['oracle_paused', 'paused'],
-];
-// Cross-layer reason contract: the TS evaluator's deny reason for each
-// oracle error category must match the Rust interpreter's `DenyReason` code
-// string (the same strings surface in the conformance fixture). The harness
-// asserts them via the per-case `expectedReason`; a future divergence
-// surfaces as a REASON_MISMATCH failure.
-const ORACLE_ERROR_REASON = {
-    stale: 'ORACLE_STALE',
-    missing: 'ORACLE_MISSING',
-    deviation: 'ORACLE_DEVIATION_EXCEEDED',
-    paused: 'ORACLE_PAUSED',
-};
 // Deterministic XLM/USDC adjacency fixture; the shared registry can replace this boundary later.
-const ADJACENT_ASSETS = [
-    'CAS3J7GYLGXMF6TDJ5WQ2PEN4GRVNXJUIQ2TZU3ZB3OQ2V4DRCWI7WPF',
-    'CCWCLTASNDT57N3BCHOSVB5QWMV5URK4BXLDDF6ZZQYMBQ4OKZA3ZB2N',
-];
-// Property-harness mutation dimensions excluded from the synth pipeline's
-// self-verify call so existing fixtures still emit policies. The harness tests
-// them as FINDINGS against the already-emitted policy.
 const OVERPERMISSIVE_DIMENSIONS = ['argument_reorder'];
-// The dimensions the synth pipeline uses for self-verify and minimise. No count
-// is written here on purpose: this comment said 15 while the array held 17, and
-// anyone checking the number should read the array rather than the prose.
-// Phase 1 grammar extension: `vec_append` and `map_field_flip` are listed below
-// alongside the existing dimensions so the per-element binds emitted for
-// Blend `submit` (call_arg_len + 3 call_arg_field per element) survive
-// minimise. Without these, no deny case exercises the new leaves and the
-// minimise pass drops them as "redundant" - reopening the element-append
-// hole they were added to close. Both dimensions are no-ops for any fixture
-// whose predicate has no `call_arg_len` / `call_arg_field` leaves (the
-// generator short-circuits on leaf-kind), so they cannot make production
-// synthesis refuse for fixtures that do not exercise the new grammar.
-const ORIGINAL_DIMENSIONS = [
-    'amount',
-    'asset',
-    'contract',
-    'function',
-    'timing',
-    'time_window',
-    'invocation_count',
-    'arg_amount_bound',
-    'arg_bound',
-    'scope_contract_fn_arg',
-    'oracle_stale',
-    'oracle_missing',
-    'oracle_deviation_exceeded',
-    'oracle_paused',
-    'soroswap_allowed_path',
-    'vec_append',
-    'map_field_flip',
-];
-export { ORIGINAL_DIMENSIONS, OVERPERMISSIVE_DIMENSIONS };
+export { OVERPERMISSIVE_DIMENSIONS };
 /** Build deterministic model-evaluated alternatives without mutating the intended call.
  *
  * @param predicate   - the synthesized predicate
- * @param permitCtx   - EvalContext for the intended (permitted) call
- * @param dimensions  - optional whitelist of dimension names to emit; when omitted
- *                     all known dimensions (including over-permissiveness mutations)
- *                     are emitted. The synth pipeline passes ORIGINAL_DIMENSIONS so
- *                     existing fixtures do not regress. */
+ * @param permitCtx  - EvalContext for the intended (permitted) call
+ * @param dimensions - optional whitelist of dimension names to emit; when omitted
+ *                    all known dimensions (including over-permissiveness mutations)
+ *                    are emitted. */
 export function generateCases(predicate, permitCtx, dimensions) {
     const facts = inspectPredicate(predicate);
     const denies = [];
-    for (const comparison of facts.comparisons) {
-        if (comparison.left.kind !== 'amount')
-            continue;
-        const mutated = mutateBigIntRecord(permitCtx, 'amountByToken', comparison.left.token, comparison);
-        if (mutated)
-            denies.push({ dimension: 'amount', ctx: mutated, expectedReason: 'AMOUNT_BOUND' });
-    }
-    const movedTokens = new Set();
-    for (const comparison of facts.comparisons) {
-        if (comparison.left.kind === 'amount' || comparison.left.kind === 'window_spent') {
-            movedTokens.add(comparison.left.token);
-        }
-    }
-    for (const token of movedTokens) {
-        // The `asset` deny case mutates BOTH the amount record AND the contract
-        // binding (token's value moved to an adjacent asset; the same swap applied
-        // to any address-typed `call_arg` / `call_contract` literal). The actual
-        // deny reason is therefore predicate-dependent - the order of evaluation
-        // is CONTRACT_SCOPE (step 3) before AMOUNT_BOUND (step 6), so a policy
-        // that has both bindings denies with CONTRACT_SCOPE, while a policy with
-        // only an amount binding denies with AMOUNT_BOUND. The reason assertion
-        // would be brittle here; the boolean decision is what we strictly need
-        // to pin. Leave `expectedReason` unset for this dimension.
-        denies.push({ dimension: 'asset', ctx: mutateAsset(predicate, permitCtx, token) });
-    }
-    const contractConstraints = [
-        ...facts.comparisons.filter((node) => node.op === 'eq' &&
-            node.left.kind === 'call_contract' &&
-            node.right.kind === 'literal_address'),
-        ...facts.memberships.filter((node) => node.needle.kind === 'call_contract'),
-    ];
-    for (const _constraint of contractConstraints) {
-        const ctx = cloneContext(permitCtx);
-        ctx.contract = distinctText(permitCtx.contract, 'contract');
-        denies.push({ dimension: 'contract', ctx, expectedReason: 'CONTRACT_SCOPE' });
-    }
-    const functionConstraints = [
-        ...facts.comparisons.filter((node) => node.op === 'eq' && node.left.kind === 'call_fn' && node.right.kind === 'literal_symbol'),
-        ...facts.memberships.filter((node) => node.needle.kind === 'call_fn'),
-    ];
-    for (const _constraint of functionConstraints) {
-        const ctx = cloneContext(permitCtx);
-        ctx.fn = distinctText(permitCtx.fn, 'function');
-        denies.push({ dimension: 'function', ctx, expectedReason: 'FN_MISMATCH' });
-    }
-    if (permitCtx.validUntilLedger !== undefined) {
-        const ctx = cloneContext(permitCtx);
-        ctx.atLedger = permitCtx.validUntilLedger + 1;
-        denies.push({ dimension: 'timing', ctx, expectedReason: 'EXPIRED' });
-    }
-    for (const comparison of facts.comparisons) {
-        if (comparison.left.kind !== 'window_spent')
-            continue;
-        const mutated = mutateBigIntRecord(permitCtx, 'windowSpentByToken', comparison.left.token, comparison, false);
-        if (mutated)
-            denies.push({ dimension: 'time_window', ctx: mutated, expectedReason: 'AMOUNT_BOUND' });
-    }
-    for (const comparison of facts.comparisons) {
-        if (comparison.left.kind !== 'invocation_count_in_window')
-            continue;
-        if (comparison.right.kind !== 'literal_u32')
-            continue;
-        const ctx = cloneContext(permitCtx);
-        ctx.invocationCountByWindow[comparison.left.windowSecs] = violatingNumber(comparison.op, comparison.right.value);
-        denies.push({ dimension: 'invocation_count', ctx, expectedReason: 'FREQUENCY' });
-    }
-    // Ordered numeric bound on a call_arg (e.g. a SoroSwap input-amount cap
-    // `call_arg[0] <= limit`). A violating deny case pushes the arg past the
-    // bound so the leaf is exercised - and, critically, so `minimize` keeps it:
-    // a conjunct that no deny case needs is pruned as redundant, which would
-    // silently drop a caller-requested restriction.
-    for (const comparison of facts.comparisons) {
-        if (comparison.op === 'eq' || comparison.left.kind !== 'call_arg')
-            continue;
-        const violating = violatingArgScVal(comparison.op, comparison.right);
-        if (!violating)
-            continue;
-        const ctx = cloneContext(permitCtx);
-        ctx.args[comparison.left.index] = violating;
-        denies.push({ dimension: 'arg_amount_bound', ctx, expectedReason: 'ARG_MISMATCH' });
-    }
+    // arg_bound: set a constrained arg to an opaque ScVal.
+    // The reason depends on the predicate shape:
+    //   - an `eq(call_arg[i], literal)` denies with ARG_MISMATCH
+    //   - an `in(call_arg[i], [literals])` denies with NOT_IN_ALLOWLIST
+    // Both are correct in the TS evaluator; the reason is predicate-dependent
+    // so we cannot pin a single canonical reason here.
     const argumentConstraints = [];
     for (const comparison of facts.comparisons) {
         if (comparison.op === 'eq' &&
@@ -166,54 +34,10 @@ export function generateCases(predicate, permitCtx, dimensions) {
     for (const constraint of argumentConstraints) {
         const ctx = cloneContext(permitCtx);
         ctx.args[constraint.index] = { type: 'other', value: 'deny-case-opaque-argument' };
-        // The `arg_bound` case sets the arg to an opaque ScVal. The deny reason
-        // depends on the predicate shape:
-        //   - an `eq(call_arg[i], literal)` denies with ARG_MISMATCH
-        //   - an `in(call_arg[i], [literals])` denies with NOT_IN_ALLOWLIST
-        //     (opaque needles fail-closed at the `in` membership gate, step 5)
-        // Both are correct in the TS evaluator; the reason is predicate-dependent
-        // so we cannot pin a single canonical reason here. The boolean decision
-        // is what we strictly need to assert; the reason is recorded (not asserted)
-        // when the harness runs this case.
         denies.push({ dimension: 'arg_bound', ctx });
     }
-    const scopedArgumentIndices = new Set(argumentConstraints.map(({ index }) => index));
-    for (const comparison of facts.comparisons) {
-        if (comparison.op === 'eq' &&
-            comparison.left.kind === 'call_arg' &&
-            comparison.right.kind === 'literal_vec') {
-            scopedArgumentIndices.add(comparison.left.index);
-        }
-    }
-    if (contractConstraints.length > 0 &&
-        functionConstraints.length > 0 &&
-        scopedArgumentIndices.size > 0) {
-        const ctx = cloneContext(permitCtx);
-        ctx.contract = distinctText(permitCtx.contract, 'authorized-call-contract');
-        ctx.fn = distinctText(permitCtx.fn, 'authorized-call-function');
-        for (const index of scopedArgumentIndices) {
-            ctx.args[index] = { type: 'other', value: 'deny-case-authorized-call-argument' };
-        }
-        // `scope_contract_fn_arg` changes contract, fn, AND args simultaneously.
-        // The first failing child of the AND decides the reason, and the contract
-        // check (step 3) does fire first in the evaluator. The reason is therefore
-        // CONTRACT_SCOPE for the canonical case, but a predicate that lists the
-        // call_fn leaf first (or that has a `call_arg_field` for that arg index)
-        // can flip the order. Pin the assertion here only when no `in` /
-        // call_arg_field binds the same arg index exist - the canonical blend
-        // case does have those binds, so the assertion would fire there.
-        denies.push({ dimension: 'scope_contract_fn_arg', ctx });
-    }
-    const oracleComparisons = facts.comparisons.filter((node) => node.left.kind === 'oracle_price');
-    for (const [dimension, error] of ORACLE_CASES) {
-        for (const comparison of oracleComparisons) {
-            if (comparison.left.kind !== 'oracle_price')
-                continue;
-            const ctx = cloneContext(permitCtx);
-            ctx.oraclePriceByAsset[comparison.left.asset] = { error };
-            denies.push({ dimension, ctx, expectedReason: ORACLE_ERROR_REASON[error] });
-        }
-    }
+    // soroswap_allowed_path: replace a bound vec arg with a different vector.
+    // Still valid for eq comparisons on literal_vec leaves.
     for (const comparison of facts.comparisons) {
         if (comparison.op !== 'eq' ||
             comparison.left.kind !== 'call_arg' ||
@@ -224,7 +48,7 @@ export function generateCases(predicate, permitCtx, dimensions) {
         ctx.args[comparison.left.index] = differentVector(ctx.args[comparison.left.index]);
         denies.push({ dimension: 'soroswap_allowed_path', ctx });
     }
-    // --- argument_reorder: swap first two address args ---
+    // argument_reorder: swap first two address args.
     // Skipped when dimensions filter is active so the synth pipeline can emit a policy;
     // the over-permissiveness harness then tests this mutation as a FINDING.
     const constrainedArgIndices = new Set();
@@ -252,12 +76,10 @@ export function generateCases(predicate, permitCtx, dimensions) {
         ctx.args[1] = a0;
         denies.push({ dimension: 'argument_reorder', ctx });
     }
-    // --- map_field_flip: flip a bound map field to a different valid value of
-    // the same type. Mirrors argument_reorder: OPT-IN only, never ORIGINAL.
+    // map_field_flip: flip a bound map field to a different valid value of
+    // the same type. OPT-IN only, never ORIGINAL.
     // Targets each `call_arg_field` leaf and produces a ctx whose vec element
-    // has a different value of the recorded field (different request_type,
-    // different amount, different address). The blend-submit case uses this
-    // to detect a missing request_type pin. ---
+    // has a different value of the recorded field. ---
     if (!dimensions || dimensions.includes('map_field_flip')) {
         for (const comparison of facts.comparisons) {
             const sel = comparison.left;
@@ -286,9 +108,9 @@ export function generateCases(predicate, permitCtx, dimensions) {
             denies.push({ dimension: 'map_field_flip', ctx });
         }
     }
-    // --- vec_append: append a new element to a bound vec. Mirrors map_field_flip:
-    // OPT-IN only, never ORIGINAL. Targets every `call_arg_len` leaf; without the
-    // length pin a caller can append an extra element to defeat per-element binds. ---
+    // vec_append: append a new element to a bound vec. OPT-IN only, never ORIGINAL.
+    // Targets every `call_arg_len` leaf; without the length pin a caller can
+    // append an extra element to defeat per-element binds. ---
     if (!dimensions || dimensions.includes('vec_append')) {
         for (const comparison of facts.comparisons) {
             const sel = comparison.left;
@@ -305,7 +127,6 @@ export function generateCases(predicate, permitCtx, dimensions) {
             denies.push({ dimension: 'vec_append', ctx });
         }
     }
-    // Version mismatch, malformed predicates, master authorization, and nonce replay are install-time checks and are intentionally omitted from model-evaluated cases.
     return { permit: cloneContext(permitCtx), denies };
 }
 function inspectPredicate(predicate) {
@@ -316,162 +137,17 @@ function inspectPredicate(predicate) {
 function visit(node, facts) {
     switch (node.op) {
         case 'and':
-        case 'or':
             for (const child of node.children)
                 visit(child, facts);
             return;
-        case 'not':
-            visit(node.child, facts);
-            return;
         case 'in':
             facts.memberships.push(node);
             return;
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             facts.comparisons.push(node);
     }
 }
-function mutateBigIntRecord(permitCtx, recordKey, token, comparison, preferScaledAmount = true) {
-    if (comparison.right.kind !== 'literal_i128')
-        return null;
-    try {
-        const current = BigInt(permitCtx[recordKey][token] ?? '0');
-        const bound = BigInt(comparison.right.value);
-        const value = violatingBigInt(comparison.op, current, bound, preferScaledAmount);
-        const ctx = cloneContext(permitCtx);
-        ctx[recordKey][token] = value.toString();
-        return ctx;
-    }
-    catch {
-        return null;
-    }
-}
-function violatingBigInt(op, current, bound, preferScaledAmount) {
-    if (preferScaledAmount) {
-        const scaledCandidates = [(current * 101n) / 100n, current * 10n];
-        for (const candidate of scaledCandidates) {
-            if (!bigIntComparison(op, candidate, bound))
-                return candidate;
-        }
-    }
-    return boundaryViolatingBigInt(op, bound);
-}
-/** The single value at the boundary that violates `<selector> op bound`:
- *  bound+1 for `lte`/`eq`, bound-1 for `gte`, and bound itself for the strict
- *  `lt`/`gt`. */
-function boundaryViolatingBigInt(op, bound) {
-    switch (op) {
-        case 'lt':
-        case 'gt':
-            return bound;
-        case 'lte':
-        case 'eq':
-            return bound + 1n;
-        case 'gte':
-            return bound - 1n;
-    }
-}
-function violatingNumber(op, bound) {
-    switch (op) {
-        case 'lt':
-        case 'gt':
-            return bound;
-        case 'lte':
-        case 'eq':
-            return bound + 1;
-        case 'gte':
-            return bound - 1;
-    }
-}
-/** Build an ScVal that VIOLATES an ordered numeric bound on a call_arg, given
- *  the comparison op and its numeric-literal right-hand side. Returns null when
- *  the literal is not an integer (the bound is not a numeric compare). The arg
- *  is emitted as an i128 - the recorder's numeric args are read via BigInt, so
- *  the wire type only needs to be a numeric ScVal to exercise the bound. */
-function violatingArgScVal(op, right) {
-    const bound = literalNumericBigInt(right);
-    if (bound === null)
-        return null;
-    return { type: 'i128', value: boundaryViolatingBigInt(op, bound).toString() };
-}
-function bigIntComparison(op, value, bound) {
-    switch (op) {
-        case 'eq':
-            return value === bound;
-        case 'lt':
-            return value < bound;
-        case 'lte':
-            return value <= bound;
-        case 'gt':
-            return value > bound;
-        case 'gte':
-            return value >= bound;
-    }
-}
-function mutateAsset(predicate, permitCtx, token) {
-    const binding = findAddressBinding(predicate, token);
-    const adjacent = adjacentAsset(token);
-    const ctx = cloneContext(permitCtx);
-    moveRecordEntry(ctx.amountByToken, token, adjacent);
-    moveRecordEntry(ctx.windowSpentByToken, token, adjacent);
-    if (binding.contract && ctx.contract === token)
-        ctx.contract = adjacent;
-    for (const index of binding.argumentIndices) {
-        const value = ctx.args[index];
-        if (value)
-            ctx.args[index] = replaceAddress(value, token, adjacent);
-    }
-    return ctx;
-}
-function findAddressBinding(predicate, address) {
-    const facts = inspectPredicate(predicate);
-    let contract = false;
-    const argumentIndices = new Set();
-    for (const comparison of facts.comparisons) {
-        if (comparison.op !== 'eq' || !leafContainsAddress(comparison.right, address))
-            continue;
-        if (comparison.left.kind === 'call_contract')
-            contract = true;
-        if (comparison.left.kind === 'call_arg')
-            argumentIndices.add(comparison.left.index);
-    }
-    for (const membership of facts.memberships) {
-        if (!membership.haystack.some((leaf) => leafContainsAddress(leaf, address)))
-            continue;
-        if (membership.needle.kind === 'call_contract')
-            contract = true;
-        if (membership.needle.kind === 'call_arg')
-            argumentIndices.add(membership.needle.index);
-    }
-    return { contract, argumentIndices };
-}
-function leafContainsAddress(leaf, address) {
-    if (leaf.kind === 'literal_address')
-        return leaf.value === address;
-    if (leaf.kind === 'literal_vec') {
-        return leaf.elements.some((element) => leafContainsAddress(element, address));
-    }
-    return false;
-}
-function moveRecordEntry(record, from, to) {
-    const value = record[from];
-    if (value === undefined)
-        return;
-    delete record[from];
-    record[to] = value;
-}
-function replaceAddress(value, from, to) {
-    if (value.type === 'address') {
-        return value.value === from ? { type: 'address', value: to } : { ...value };
-    }
-    if (value.type === 'vec') {
-        return { type: 'vec', value: value.value.map((item) => replaceAddress(item, from, to)) };
-    }
-    return { ...value };
-}
 function differentVector(actual) {
     if (actual?.type !== 'vec')
         return { type: 'vec', value: [] };
@@ -488,40 +164,16 @@ function differentVector(actual) {
     value[0] = { type: 'other', value: 'deny-case-different-hop' };
     return { type: 'vec', value };
 }
-function adjacentAsset(asset) {
-    return asset === ADJACENT_ASSETS[0] ? ADJACENT_ASSETS[1] : ADJACENT_ASSETS[0];
-}
-function distinctText(value, label) {
-    return `${value}#${label}`;
-}
 function cloneContext(ctx) {
-    const cloned = {
+    return {
         contract: ctx.contract,
         fn: ctx.fn,
         args: ctx.args.map(cloneScVal),
-        atLedger: ctx.atLedger,
-        nowSeconds: ctx.nowSeconds,
-        amountByToken: { ...ctx.amountByToken },
-        windowSpentByToken: { ...ctx.windowSpentByToken },
-        invocationCountByWindow: { ...ctx.invocationCountByWindow },
-        oraclePriceByAsset: Object.fromEntries(Object.entries(ctx.oraclePriceByAsset).map(([asset, entry]) => [
-            asset,
-            'error' in entry ? { error: entry.error } : { ...entry },
-        ])),
     };
-    if (ctx.validUntilLedger !== undefined)
-        cloned.validUntilLedger = ctx.validUntilLedger;
-    if (ctx.signerWeights !== undefined)
-        cloned.signerWeights = { ...ctx.signerWeights };
-    return cloned;
 }
 /** Deep-copy an ScVal so a mutation cannot alias the recorded call.
  *  Exported so the permit-context builder shares this one implementation. */
 export function cloneScVal(value, depth = 0) {
-    // Recursion is bounded by MAX_SCVAL_CLONE_DEPTH so a hand-crafted nested-vec
-    // payload cannot RangeError the JS stack during deny-case mutation. Over-depth
-    // throws a ToolError-shaped error that the `synthesizeFromRecording` envelope
-    // (item 3) converts to a structured `{ok:false, error}`.
     if (value.type === 'vec') {
         if (depth >= MAX_SCVAL_CLONE_DEPTH) {
             throw cloneDepthError(value);
@@ -540,9 +192,8 @@ function cloneDepthError(value) {
 }
 /** Build a value of the SAME ScVal type that differs from the recorded one,
  *  used by the `map_field_flip` mutation to defeat a per-element pin without
- *  changing the wire type (a type/arity change is rejected by host dispatch
- *  before Policy::enforce, so it is not the predicate's job). Returns null
- *  when the ScVal type has no obvious different value (e.g. opaque/other). */
+ *  changing the wire type. Returns null when the ScVal type has no obvious
+ *  different value (e.g. opaque/other). */
 function flipFieldValue(val) {
     switch (val.type) {
         case 'address': {
@@ -551,7 +202,6 @@ function flipFieldValue(val) {
             return { type: 'address', value: val.value === a ? b : a };
         }
         case 'i128':
-        case 'u64':
         case 'u32':
             return { type: val.type, value: String(BigInt(val.value) + 1n) };
         case 'symbol':

package/dist/synth/evaluate.d.ts

@@ -6,27 +6,6 @@ export interface EvalContext {
     fn: string;
     /** Decoded `ScVal[]` of the top-level authorized call. */
     args: ScVal[];
-    /** Ledger sequence at which the interpreter is invoked. */
-    atLedger: number;
-    /** Optional policy expiry; absent -> step 1 is skipped. */
-    validUntilLedger?: number;
-    /** Unix seconds; used by `now` / `valid_until` leaves. */
-    nowSeconds: number;
-    /** Per-token amount moved by the current call (i128 decimal string). */
-    amountByToken: Record<string, string>;
-    /** Per-token window-rolling spend prior to this call (i128 decimal string). */
-    windowSpentByToken: Record<string, string>;
-    /** Recorded invocation counts keyed by window seconds. */
-    invocationCountByWindow: Record<number, number>;
-    /** Optional signer-weight map for the threshold gate. Absent -> skip. */
-    signerWeights?: Record<string, number>;
-    /** Per-asset oracle snapshot. Missing keys default to ORACLE_STALE. */
-    oraclePriceByAsset: Record<string, {
-        price: string;
-        timestampSeconds: number;
-    } | {
-        error: 'stale' | 'missing' | 'deviation' | 'paused' | 'decimals' | 'fingerprint';
-    }>;
 }
 export type EvalResult = {
     permit: true;