@crediolabs/policy-synth 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -4
- package/dist/adapters/interpreter/adapter.d.ts +19 -25
- package/dist/adapters/interpreter/adapter.js +54 -487
- package/dist/adapters/interpreter/index.d.ts +1 -1
- package/dist/adapters/interpreter/index.js +1 -1
- package/dist/adapters/oz/adapter.js +1 -15
- package/dist/errors.d.ts +1 -1
- package/dist/index.d.ts +1 -4
- package/dist/index.js +1 -4
- package/dist/install/build-add-context-rule.d.ts +3 -19
- package/dist/install/build-add-context-rule.js +3 -98
- package/dist/install/build-install-policy.d.ts +4 -53
- package/dist/install/build-install-policy.js +44 -123
- package/dist/install/index.d.ts +0 -2
- package/dist/install/index.js +0 -7
- package/dist/ir/index.d.ts +1 -1
- package/dist/ir/types.d.ts +7 -76
- package/dist/ir/types.js +0 -2
- package/dist/predicate/decode.d.ts +1 -1
- package/dist/predicate/decode.js +2 -70
- package/dist/predicate/encode.js +45 -229
- package/dist/predicate/from-json.js +1 -42
- package/dist/record/decode.js +3 -8
- package/dist/review-card/builder.d.ts +4 -3
- package/dist/review-card/builder.js +18 -162
- package/dist/review-card/cross-check.js +2 -105
- package/dist/review-card/render-leaf.d.ts +4 -0
- package/dist/review-card/render-leaf.js +47 -0
- package/dist/run/index.d.ts +36 -139
- package/dist/run/index.js +125 -437
- package/dist/run/schemas.d.ts +168 -1929
- package/dist/run/schemas.js +40 -269
- package/dist/seams/types.d.ts +0 -2
- package/dist/simulate/deny-cases.d.ts +26 -0
- package/dist/simulate/deny-cases.js +282 -0
- package/dist/simulate/evaluate.d.ts +18 -0
- package/dist/simulate/evaluate.js +271 -0
- package/dist/simulate/index.d.ts +4 -0
- package/dist/simulate/index.js +8 -0
- package/dist/synth/compose-from-recording.d.ts +24 -51
- package/dist/synth/compose-from-recording.js +120 -282
- package/dist/synth/deny-cases.d.ts +5 -7
- package/dist/synth/deny-cases.js +23 -373
- package/dist/synth/evaluate.d.ts +0 -21
- package/dist/synth/evaluate.js +56 -336
- package/dist/synth/index.d.ts +0 -5
- package/dist/synth/index.js +0 -5
- package/dist/synth/permit-context.d.ts +2 -9
- package/dist/synth/permit-context.js +1 -82
- package/dist/synth/synthesize-from-recording.d.ts +1 -29
- package/dist/synth/synthesize-from-recording.js +41 -356
- package/dist/types.d.ts +8 -60
- package/dist/types.js +5 -2
- package/dist/verify/simulate.d.ts +1 -14
- package/dist/verify/simulate.js +2 -88
- package/dist/verify/verify.d.ts +1 -7
- package/dist/verify/verify.js +0 -8
- package/dist-cjs/adapters/interpreter/adapter.d.ts +19 -25
- package/dist-cjs/adapters/interpreter/adapter.js +56 -489
- package/dist-cjs/adapters/interpreter/index.d.ts +1 -1
- package/dist-cjs/adapters/interpreter/index.js +1 -2
- package/dist-cjs/adapters/oz/adapter.js +1 -15
- package/dist-cjs/errors.d.ts +1 -1
- package/dist-cjs/index.d.ts +1 -4
- package/dist-cjs/index.js +1 -4
- package/dist-cjs/install/build-add-context-rule.d.ts +3 -19
- package/dist-cjs/install/build-add-context-rule.js +1 -97
- package/dist-cjs/install/build-install-policy.d.ts +4 -53
- package/dist-cjs/install/build-install-policy.js +44 -122
- package/dist-cjs/install/index.d.ts +0 -2
- package/dist-cjs/install/index.js +2 -23
- package/dist-cjs/ir/index.d.ts +1 -1
- package/dist-cjs/ir/types.d.ts +7 -76
- package/dist-cjs/ir/types.js +0 -2
- package/dist-cjs/predicate/decode.d.ts +1 -1
- package/dist-cjs/predicate/decode.js +2 -70
- package/dist-cjs/predicate/encode.js +45 -229
- package/dist-cjs/predicate/from-json.js +1 -42
- package/dist-cjs/record/decode.js +3 -8
- package/dist-cjs/review-card/builder.d.ts +4 -3
- package/dist-cjs/review-card/builder.js +23 -167
- package/dist-cjs/review-card/cross-check.js +7 -110
- package/dist-cjs/review-card/render-leaf.d.ts +4 -0
- package/dist-cjs/review-card/render-leaf.js +52 -0
- package/dist-cjs/run/index.d.ts +36 -139
- package/dist-cjs/run/index.js +125 -444
- package/dist-cjs/run/schemas.d.ts +168 -1929
- package/dist-cjs/run/schemas.js +41 -270
- package/dist-cjs/seams/types.d.ts +0 -2
- package/dist-cjs/simulate/deny-cases.d.ts +26 -0
- package/dist-cjs/simulate/deny-cases.js +286 -0
- package/dist-cjs/simulate/evaluate.d.ts +18 -0
- package/dist-cjs/simulate/evaluate.js +274 -0
- package/dist-cjs/simulate/index.d.ts +4 -0
- package/dist-cjs/simulate/index.js +13 -0
- package/dist-cjs/synth/compose-from-recording.d.ts +24 -51
- package/dist-cjs/synth/compose-from-recording.js +120 -282
- package/dist-cjs/synth/deny-cases.d.ts +5 -7
- package/dist-cjs/synth/deny-cases.js +23 -374
- package/dist-cjs/synth/evaluate.d.ts +0 -21
- package/dist-cjs/synth/evaluate.js +57 -337
- package/dist-cjs/synth/index.d.ts +0 -5
- package/dist-cjs/synth/index.js +1 -11
- package/dist-cjs/synth/permit-context.d.ts +2 -9
- package/dist-cjs/synth/permit-context.js +1 -82
- package/dist-cjs/synth/synthesize-from-recording.d.ts +1 -29
- package/dist-cjs/synth/synthesize-from-recording.js +39 -354
- package/dist-cjs/types.d.ts +8 -60
- package/dist-cjs/types.js +6 -3
- package/dist-cjs/verify/simulate.d.ts +1 -14
- package/dist-cjs/verify/simulate.js +2 -88
- package/dist-cjs/verify/verify.d.ts +1 -7
- package/dist-cjs/verify/verify.js +0 -8
- package/package.json +4 -4
- package/src/adapters/interpreter/adapter.ts +76 -572
- package/src/errors.ts +0 -19
- package/src/index.ts +1 -4
- package/src/install/build-add-context-rule.ts +5 -139
- package/src/install/build-install-policy.ts +93 -214
- package/src/install/index.ts +0 -34
- package/src/predicate/decode.ts +2 -70
- package/src/predicate/encode.ts +49 -261
- package/src/predicate/from-json.ts +1 -43
- package/src/record/decode.ts +3 -8
- package/src/review-card/builder.ts +19 -168
- package/src/review-card/cross-check.ts +3 -105
- package/src/review-card/render-leaf.ts +48 -0
- package/src/run/index.ts +144 -572
- package/src/run/schemas.ts +42 -291
- package/src/simulate/deny-cases.ts +334 -0
- package/src/simulate/evaluate.ts +284 -0
- package/src/simulate/index.ts +11 -0
- package/src/synth/compose-from-recording.ts +148 -347
- package/src/synth/index.ts +0 -13
- package/src/synth/synthesize-from-recording.ts +43 -456
- package/src/types.ts +13 -49
- package/dist/install/authority-overlap.d.ts +0 -134
- package/dist/install/authority-overlap.js +0 -0
- package/dist/install/build-install-predicate.d.ts +0 -96
- package/dist/install/build-install-predicate.js +0 -444
- package/dist/install/build-merge-policy.d.ts +0 -70
- package/dist/install/build-merge-policy.js +0 -130
- package/dist/install/plan-merge-policy.d.ts +0 -49
- package/dist/install/plan-merge-policy.js +0 -86
- package/dist/install/read-account-rules.d.ts +0 -100
- package/dist/install/read-account-rules.js +0 -283
- package/dist-cjs/install/authority-overlap.d.ts +0 -134
- package/dist-cjs/install/authority-overlap.js +0 -0
- package/dist-cjs/install/build-install-predicate.d.ts +0 -96
- package/dist-cjs/install/build-install-predicate.js +0 -479
- package/dist-cjs/install/build-merge-policy.d.ts +0 -70
- package/dist-cjs/install/build-merge-policy.js +0 -134
- package/dist-cjs/install/plan-merge-policy.d.ts +0 -49
- package/dist-cjs/install/plan-merge-policy.js +0 -90
- package/dist-cjs/install/read-account-rules.d.ts +0 -100
- package/dist-cjs/install/read-account-rules.js +0 -296
- package/src/adapters/interpreter/index.ts +0 -8
- package/src/adapters/oz/adapter.ts +0 -376
- package/src/adapters/oz/index.ts +0 -9
- package/src/codegen/compile-gate.ts +0 -167
- package/src/codegen/index.ts +0 -17
- package/src/codegen/template.ts +0 -165
- package/src/install/authority-overlap.ts +0 -0
- package/src/install/build-merge-policy.ts +0 -219
- package/src/install/plan-merge-policy.ts +0 -133
- package/src/install/read-account-rules.ts +0 -376
- package/src/ir/index.ts +0 -13
- package/src/ir/types.ts +0 -132
- package/src/mandate/index.ts +0 -4
- package/src/mandate/to-ir.ts +0 -71
- package/src/mandate/types.ts +0 -21
- package/src/seams/index.ts +0 -11
- package/src/seams/types.ts +0 -81
- package/src/synth/deny-cases.ts +0 -663
- package/src/synth/evaluate.ts +0 -613
- package/src/synth/harness.ts +0 -68
- package/src/synth/minimize.ts +0 -48
- package/src/synth/permit-context.ts +0 -136
- package/src/synth/predicate-literals.ts +0 -27
- package/src/synth/synthesize-from-mandate.ts +0 -82
- package/src/verify/envelope.ts +0 -28
- package/src/verify/index.ts +0 -5
- package/src/verify/simulate.ts +0 -311
- package/src/verify/verify.ts +0 -243
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
// separately would be two chances to disagree about what "the recorded
|
|
8
8
|
// call" means, which is the one thing both must share.
|
|
9
9
|
import { cloneScVal } from "./deny-cases.js";
|
|
10
|
-
export function buildPermitContext(tx, responses
|
|
10
|
+
export function buildPermitContext(tx, responses) {
|
|
11
11
|
const amountByToken = {};
|
|
12
12
|
const totals = new Map();
|
|
13
13
|
for (const m of tx.tokenMovements) {
|
|
@@ -19,23 +19,6 @@ export function buildPermitContext(tx, responses, predicate) {
|
|
|
19
19
|
}
|
|
20
20
|
const topLevel = tx.invocations[0];
|
|
21
21
|
const scopeContract = topLevel?.contract ?? '';
|
|
22
|
-
const oraclePriceByAsset = {};
|
|
23
|
-
visitOracleLeaves(predicate, (asset, op, bound) => {
|
|
24
|
-
let price;
|
|
25
|
-
switch (op) {
|
|
26
|
-
case 'lt':
|
|
27
|
-
price = bound - 1n;
|
|
28
|
-
break;
|
|
29
|
-
case 'gt':
|
|
30
|
-
price = bound + 1n;
|
|
31
|
-
break;
|
|
32
|
-
default:
|
|
33
|
-
price = bound;
|
|
34
|
-
}
|
|
35
|
-
if (price < 0n)
|
|
36
|
-
price = 0n;
|
|
37
|
-
oraclePriceByAsset[asset] = { price: price.toString(), timestampSeconds: tx.fetchedAt };
|
|
38
|
-
});
|
|
39
22
|
const ctx = {
|
|
40
23
|
contract: scopeContract,
|
|
41
24
|
fn: topLevel?.fn ?? '',
|
|
@@ -44,73 +27,9 @@ export function buildPermitContext(tx, responses, predicate) {
|
|
|
44
27
|
nowSeconds: tx.fetchedAt,
|
|
45
28
|
amountByToken,
|
|
46
29
|
windowSpentByToken: {},
|
|
47
|
-
invocationCountByWindow: {},
|
|
48
|
-
oraclePriceByAsset,
|
|
49
30
|
};
|
|
50
31
|
if (responses.validUntilLedger !== undefined) {
|
|
51
32
|
ctx.validUntilLedger = responses.validUntilLedger;
|
|
52
33
|
}
|
|
53
34
|
return ctx;
|
|
54
35
|
}
|
|
55
|
-
function visitOracleLeaves(node, visit) {
|
|
56
|
-
switch (node.op) {
|
|
57
|
-
case 'and':
|
|
58
|
-
case 'or':
|
|
59
|
-
for (const child of node.children)
|
|
60
|
-
visitOracleLeaves(child, visit);
|
|
61
|
-
return;
|
|
62
|
-
case 'not':
|
|
63
|
-
visitOracleLeaves(node.child, visit);
|
|
64
|
-
return;
|
|
65
|
-
case 'eq':
|
|
66
|
-
case 'lt':
|
|
67
|
-
case 'lte':
|
|
68
|
-
case 'gt':
|
|
69
|
-
case 'gte': {
|
|
70
|
-
const leftIsOracle = node.left.kind === 'oracle_price';
|
|
71
|
-
const rightIsOracle = node.right.kind === 'oracle_price';
|
|
72
|
-
let asset;
|
|
73
|
-
let literal;
|
|
74
|
-
if (leftIsOracle) {
|
|
75
|
-
asset = node.left.kind === 'oracle_price' ? node.left.asset : undefined;
|
|
76
|
-
literal = oracleThresholdNormalised(node.right);
|
|
77
|
-
}
|
|
78
|
-
else if (rightIsOracle) {
|
|
79
|
-
asset = node.right.kind === 'oracle_price' ? node.right.asset : undefined;
|
|
80
|
-
literal = oracleThresholdNormalised(node.left);
|
|
81
|
-
}
|
|
82
|
-
if (asset !== undefined && literal !== undefined) {
|
|
83
|
-
visit(asset, node.op, literal);
|
|
84
|
-
}
|
|
85
|
-
return;
|
|
86
|
-
}
|
|
87
|
-
case 'in':
|
|
88
|
-
return;
|
|
89
|
-
}
|
|
90
|
-
}
|
|
91
|
-
/** Oracle prices normalise to 9 decimals; mirrors NORMALISED_DECIMALS in
|
|
92
|
-
* oracle.rs. */
|
|
93
|
-
const NORMALISED_DECIMALS = 9n;
|
|
94
|
-
/** A threshold restated on the normalised basis, so a derived permit price is
|
|
95
|
-
* comparable to it. Thresholds carry their own basis, so the conversion has
|
|
96
|
-
* to happen here - reading the digits raw would build a context off by a
|
|
97
|
-
* factor of 10^(decimals-9). Returns undefined for any other leaf. */
|
|
98
|
-
function oracleThresholdNormalised(leaf) {
|
|
99
|
-
if (leaf.kind !== 'oracle_threshold')
|
|
100
|
-
return undefined;
|
|
101
|
-
let value;
|
|
102
|
-
try {
|
|
103
|
-
value = BigInt(leaf.value);
|
|
104
|
-
}
|
|
105
|
-
catch {
|
|
106
|
-
return undefined;
|
|
107
|
-
}
|
|
108
|
-
const decimals = BigInt(leaf.decimals);
|
|
109
|
-
if (decimals <= NORMALISED_DECIMALS) {
|
|
110
|
-
return value * 10n ** (NORMALISED_DECIMALS - decimals);
|
|
111
|
-
}
|
|
112
|
-
// Floor: a finer-grained threshold has no exact 9-dp representation. The
|
|
113
|
-
// caller only needs a price that lands on the right side of the bound, and
|
|
114
|
-
// it offsets by one from here.
|
|
115
|
-
return value / 10n ** (decimals - NORMALISED_DECIMALS);
|
|
116
|
-
}
|
|
@@ -1,7 +1,5 @@
|
|
|
1
|
-
import type { OzAdapterConfig } from '../adapters/oz/adapter.ts';
|
|
2
1
|
import type { ToolError, ToolResponse } from '../errors.ts';
|
|
3
2
|
import { type Network, type PredicateNode, type ProposedPolicy, type RecordedTransaction } from '../types.ts';
|
|
4
|
-
import type { SimulationResult } from '../verify/envelope.ts';
|
|
5
3
|
import { type ComposeUserResponses } from './compose-from-recording.ts';
|
|
6
4
|
/** Per-policy interpreter adapter config the caller opts into. Absent ->
|
|
7
5
|
* recording path runs in week-1 mode (OZ adapter only, warnings for the
|
|
@@ -13,13 +11,6 @@ export interface InterpreterAdapterOptions {
|
|
|
13
11
|
smartAccountAddress: string;
|
|
14
12
|
/** Per-rule install nonce (first install = 1). Defaults to 1. */
|
|
15
13
|
installNonce?: number;
|
|
16
|
-
/** Per-policy oracle overrides. Tighten-only vs the wasm defaults
|
|
17
|
-
* (maxStalenessSeconds <= 600, maxDeviationBps <= 200); widening is
|
|
18
|
-
* rejected at the options boundary. */
|
|
19
|
-
oracleParams?: {
|
|
20
|
-
maxStalenessSeconds?: number;
|
|
21
|
-
maxDeviationBps?: number;
|
|
22
|
-
};
|
|
23
14
|
}
|
|
24
15
|
/** PRIVATE test-only extension of `InterpreterAdapterOptions` for the
|
|
25
16
|
* `__testPredicateNode` seam. Exported under a `__` prefix so production
|
|
@@ -43,7 +34,7 @@ export interface SynthesizeFromRecordingOptions {
|
|
|
43
34
|
* never altered by enabling explain. Absent -> success envelope is byte-identical. */
|
|
44
35
|
explain?: true;
|
|
45
36
|
}
|
|
46
|
-
export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: SynthesizeFromRecordingOptions
|
|
37
|
+
export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: SynthesizeFromRecordingOptions): ToolResponse<ProposedPolicy> & {
|
|
47
38
|
/** Present iff `opts.explain === true` and the synthesis succeeded. The
|
|
48
39
|
* `predicateTree` is the exact in-memory `PredicateNode` (canonical
|
|
49
40
|
* JSON shape) that was encoded into `proposed.policyDocuments[*].encodedPredicate`
|
|
@@ -56,28 +47,9 @@ export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: S
|
|
|
56
47
|
* builds a minimal honest SimulationResult downstream. */
|
|
57
48
|
explain?: {
|
|
58
49
|
predicateTree: PredicateNode | null;
|
|
59
|
-
simulation: SimulationResult;
|
|
60
50
|
};
|
|
61
51
|
};
|
|
62
52
|
/** ToolError-shaped error helper used by the body to surface a structured
|
|
63
53
|
* failure that the envelope converts to `{ok:false, error}`. */
|
|
64
54
|
declare function throwToolError(code: ToolError['code'], message: string): never;
|
|
65
55
|
export { throwToolError };
|
|
66
|
-
/** Diagnostic reported by `visitOracleLeaves` when an oracle comparison
|
|
67
|
-
* cannot be normalised to oracle-on-left. Currently only "oracle-on-right
|
|
68
|
-
* with a non-literal LHS" - the other branches already produce a parseable
|
|
69
|
-
* threshold and are returned to the caller. */
|
|
70
|
-
export interface OracleNormalisationWarning {
|
|
71
|
-
/** The dimension name (currently always "oracle_normalisation_dropped"). */
|
|
72
|
-
dimension: 'oracle_normalisation_dropped';
|
|
73
|
-
/** The operator as written. */
|
|
74
|
-
op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte';
|
|
75
|
-
/** The asset the oracle leaf is bound to. */
|
|
76
|
-
asset: string;
|
|
77
|
-
/** The non-literal RHS (oracle-on-left) or LHS (oracle-on-right) leaf
|
|
78
|
-
* whose shape stopped the normalisation. Surfaced for diagnostics;
|
|
79
|
-
* intentionally a partial view - the full leaf is the caller's job. */
|
|
80
|
-
otherKind: string;
|
|
81
|
-
/** Human-readable message (matches the warn-on-drop text). */
|
|
82
|
-
message: string;
|
|
83
|
-
}
|