@crediolabs/policy-synth 0.2.0 → 0.3.0

package/dist-cjs/types.d.ts

@@ -77,13 +77,11 @@ export declare const MAX_SCVAL_CLONE_DEPTH: 30;
  *    - MAX_DEPTH = 5:             3 walkthroughs need depth 2; budget = 2x growth + 1 for `not` chain.
  *    - MAX_LEAVES = 200:         allowlists (recipients, paths) typically < 100; budget = 2x + 1 nested allowlist.
  *    - MAX_PREDICATE_BYTES = 32 KB: well under the per-ledger-entry 64 KB persistent-storage limit.
- *    - MAX_ORACLE_READS = 6:     two-round confirmation per asset consumes 2 reads; cap accommodates a predicate that references up to 3 unique oracle assets (3 * 2 = 6 reads). Stays a fail-closed install-time cap.
  *    - MAX_IN_OPERAND_COUNT = 32: allowlist < 32 is a UX-natural bound. */
 export declare const PREDICATE_CAPS: {
     readonly MAX_DEPTH: 5;
     readonly MAX_LEAVES: 200;
     readonly MAX_PREDICATE_BYTES: number;
-    readonly MAX_ORACLE_READS: 6;
     readonly MAX_IN_OPERAND_COUNT: 32;
 };
 /** OZ context-rule draft - the unit the install builder builds add_context_rule from. */
@@ -118,19 +116,20 @@ export type SignerDraft = {
 };
 /** Reference to one policy attached to a context rule. */
 export type PolicyRef = {
-    kind: 'oz_builtin';
-    primitive: OZPrimitiveConfig;
-    instanceAddress: string;
-} | {
     kind: 'interpreter';
     interpreterAddress: string;
     predicateBlobBase64: string;
 };
+/** Grammar version baked into the interpreter wasm, mirroring `SELF_VERSION` in
+ *  `contracts/policy-interpreter/src/version.rs`. Every value this package puts on
+ *  the wire derives from here; `grammar-version-parity.test.ts` pins it to the
+ *  contract so a skew cannot pass a green test run. */
+export declare const GRAMMAR_VERSION: 3;
 /** A serialised predicate document stored against a (smart_account, rule_id) pair. */
 export interface PolicyDocument {
     /** Grammar version baked into the interpreter wasm. Fail-closed strict match at install
      *  AND at evaluate (defence in depth). NOT the per-edit revision. */
-    grammarVersion: 1;
+    grammarVersion: typeof GRAMMAR_VERSION;
     /** Per-rule install nonce. Must equal the interpreter's stored nonce + 1 at install.
      *  First install accepts nonce = 1 with stored nonce = 0. Re-install is structurally
      *  possible by incrementing the nonce; uninstall removes the nonce with state so a
@@ -142,32 +141,17 @@ export interface PolicyDocument {
     /** Hash of the post-canonicalisation bytes of encodedPredicate. Stored alongside the
      *  doc and re-verified at evaluate. */
     predicateHash: string;
-    /** Per-policy overrides of oracle thresholds; absent = use defaults.
-     *  Overrides may TIGHTEN only (never widen) - the interpreter rejects any per-policy
-     *  value looser than the wasm-level defaults at install. */
-    oracleParams?: {
-        /** Seconds; must be <= MAX_ORACLE_STALENESS_SECONDS (600). */
-        maxStalenessSeconds?: number;
-        /** Basis points; must be <= MAX_ORACLE_DEVIATION_BPS (200). */
-        maxDeviationBps?: number;
-    };
 }
 /** The versioned predicate AST (interpreter side). Tagged union. */
 export type PredicateNode = {
     op: 'and';
     children: PredicateNode[];
-} | {
-    op: 'or';
-    children: PredicateNode[];
-} | {
-    op: 'not';
-    child: PredicateNode;
 } | {
     op: 'eq';
     left: PredicateLeaf;
     right: PredicateLeaf;
 } | {
-    op: 'lt' | 'lte' | 'gt' | 'gte';
+    op: 'lte';
     left: PredicateLeaf;
     right: PredicateLeaf;
 } | {
@@ -190,32 +174,6 @@ export type PredicateLeaf = {
     index: number;
     element: number;
     field: string;
-} | {
-    kind: 'call_arg_scaled';
-    index: number;
-    num: string;
-    den: string;
-} | {
-    kind: 'amount';
-    token: string;
-} | {
-    kind: 'window_spent';
-    token: string;
-    windowSeconds: number;
-} | {
-    kind: 'now';
-} | {
-    kind: 'valid_until';
-} | {
-    kind: 'invocation_count_in_window';
-    windowSecs: number;
-} | {
-    kind: 'oracle_price';
-    asset: string;
-} | {
-    kind: 'oracle_threshold';
-    value: string;
-    decimals: number;
 } | {
     kind: 'literal_address';
     value: string;
@@ -228,20 +186,10 @@ export type PredicateLeaf = {
 } | {
     kind: 'literal_u32';
     value: number;
-} | {
-    kind: 'literal_u64';
-    value: string;
-} | {
-    kind: 'literal_bytes';
-    value: string;
 } | {
     kind: 'literal_vec';
     elements: PredicateLeaf[];
 };
-export interface OZPrimitiveConfig {
-    primitive: 'spending_limit' | 'simple_threshold' | 'weighted_threshold';
-    params: Record<string, unknown>;
-}
 export interface ContractInvocation {
     contract: string;
     fn: string;
@@ -297,7 +245,7 @@ export interface AmbiguityPrompt {
 /** Catalogue of named ambiguity codes (the skill's prompt files are one-per-code).
  *  Adding a code is a synthesizer decision; the prompt authoring must not
  *  invent codes outside this union. */
-export type AmbiguityCode = 'DURATION_UNSPECIFIED' | 'AMOUNT_BOUND_MISSING' | 'RECIPIENT_ALLOWLIST_EMPTY' | 'FREQUENCY_BOUND_MISSING' | 'ORACLE_ASSET_UNKNOWN' | 'MULTIPLE_UNRELATED_TARGETS';
+export type AmbiguityCode = 'DURATION_UNSPECIFIED' | 'AMOUNT_BOUND_MISSING' | 'RECIPIENT_ALLOWLIST_EMPTY' | 'FREQUENCY_BOUND_MISSING' | 'MULTIPLE_UNRELATED_TARGETS';
 /** Structured recording freshness. `overall` is the gate threshold (default 1.0); the
  *  breakdown is the diagnostic the user / agent sees when the gate fires. The
  *  computation rule is pinned: `overall = 1 - (unknownContracts + opaqueScVals) / total`.

package/dist-cjs/types.js

@@ -1,7 +1,7 @@
 "use strict";
 // src/types.ts - shared domain types (single source of truth)
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PREDICATE_CAPS = exports.MAX_SCVAL_CLONE_DEPTH = exports.MAX_SCVAL_DEPTH = exports.SOROBAN_LIMITS = exports.OZ_LIMITS = void 0;
+exports.GRAMMAR_VERSION = exports.PREDICATE_CAPS = exports.MAX_SCVAL_CLONE_DEPTH = exports.MAX_SCVAL_DEPTH = exports.SOROBAN_LIMITS = exports.OZ_LIMITS = void 0;
 /** OZ Accounts framework hard limits (verified against canonical OZ source). */
 exports.OZ_LIMITS = {
     maxPoliciesPerRule: 5,
@@ -44,12 +44,15 @@ exports.MAX_SCVAL_CLONE_DEPTH = 30;
  *    - MAX_DEPTH = 5:             3 walkthroughs need depth 2; budget = 2x growth + 1 for `not` chain.
  *    - MAX_LEAVES = 200:         allowlists (recipients, paths) typically < 100; budget = 2x + 1 nested allowlist.
  *    - MAX_PREDICATE_BYTES = 32 KB: well under the per-ledger-entry 64 KB persistent-storage limit.
- *    - MAX_ORACLE_READS = 6:     two-round confirmation per asset consumes 2 reads; cap accommodates a predicate that references up to 3 unique oracle assets (3 * 2 = 6 reads). Stays a fail-closed install-time cap.
  *    - MAX_IN_OPERAND_COUNT = 32: allowlist < 32 is a UX-natural bound. */
 exports.PREDICATE_CAPS = {
     MAX_DEPTH: 5,
     MAX_LEAVES: 200,
     MAX_PREDICATE_BYTES: 32 * 1024,
-    MAX_ORACLE_READS: 6,
     MAX_IN_OPERAND_COUNT: 32,
 };
+/** Grammar version baked into the interpreter wasm, mirroring `SELF_VERSION` in
+ *  `contracts/policy-interpreter/src/version.rs`. Every value this package puts on
+ *  the wire derives from here; `grammar-version-parity.test.ts` pins it to the
+ *  contract so a skew cannot pass a green test run. */
+exports.GRAMMAR_VERSION = 3;

package/dist-cjs/verify/simulate.d.ts

@@ -4,27 +4,14 @@ import type { SimulationResult } from './envelope.ts';
 /** Options for `simulatePolicy`. `validUntilLedger` is propagated onto the
  *  permit EvalContext so the simulator exercises the expiry gate; absent ->
  *  no expiry check (mirrors the orchestrator's "no `validUntilLedger`
- *  supplied" path). `oraclePricesByAsset` is the test fixture the simulator
- *  uses to satisfy `oracle_price` leaves so the permit call evaluates under
- *  the bound; absent -> derive satisfying prices from the predicate itself
- *  (the orchestrator's oracle-satisfying-price logic). */
+ *  supplied" path). */
 export interface SimulateOptions {
     validUntilLedger?: number;
-    /** Pre-populated oracle-price entries keyed by asset address. The fixture
-     *  must satisfy every `oracle_price` leaf in the predicate; absent or
-     *  unsatisfying entries cause `SIMULATION_ERROR`. */
-    oraclePricesByAsset?: Record<string, {
-        price: string;
-        timestampSeconds: number;
-    } | {
-        error: 'stale' | 'missing' | 'deviation' | 'paused' | 'decimals' | 'fingerprint';
-    }>;
 }
 /** Replay a recorded transaction against a proposed predicate and emit the
  *  `SimulationResult` envelope. The simulator returns the SAME permit
  *  verdict `runHarness` expects: the intended recorded call must permit; every
  *  generated deny dimension must deny. A runtime evaluation failure
- *  (malformed input, missing oracle fixture, etc.) returns a `SIMULATION_ERROR`
  *  `ToolError` - NOT a deny verdict, NOT `VERIFICATION_FAILED`. The boundary
  *  is pinned: minimality is a verify-time concern, runtime evaluation is a
  *  simulate-time concern. */

package/dist-cjs/verify/simulate.js

@@ -8,9 +8,7 @@
 // Boundary (pinned, must not drift):
 //   - `SIMULATION_ERROR`        = RUNTIME evaluation failed. Surfaced by
 //     `simulatePolicy`. Reasons: malformed `permitTx` input (no top-level
-//     invocation to build an EvalContext from), a referenced oracle asset
 //     without a satisfying price fixture, or a non-runtime propagation (a
-//     throw that is not an oracle error or a controlled deny). A
 //     runtime evaluation failure is NOT a policy-minimality problem; the
 //     policy may still be minimal. Re-running with a complete fixture MAY
 //     succeed.
@@ -37,7 +35,6 @@ const SIMULATOR_VERSION = 'ts-model-1.0.0';
  *  `SimulationResult` envelope. The simulator returns the SAME permit
  *  verdict `runHarness` expects: the intended recorded call must permit; every
  *  generated deny dimension must deny. A runtime evaluation failure
- *  (malformed input, missing oracle fixture, etc.) returns a `SIMULATION_ERROR`
  *  `ToolError` - NOT a deny verdict, NOT `VERIFICATION_FAILED`. The boundary
  *  is pinned: minimality is a verify-time concern, runtime evaluation is a
  *  simulate-time concern. */
@@ -54,7 +51,7 @@ function simulatePolicy(predicate, permitTx, opts = {}) {
     }
     let permitCtx;
     try {
-        permitCtx = buildPermitContext(predicate, permitTx, topLevel, opts);
+        permitCtx = buildPermitContext(permitTx, topLevel, opts);
     }
     catch (e) {
         return {
@@ -120,7 +117,7 @@ function simulatePolicy(predicate, permitTx, opts = {}) {
  *  rather than import to keep `src/verify/` decoupled from the
  *  orchestrator's private helpers. The shape is pinned by tests so the
  *  two implementations stay in lockstep. */
-function buildPermitContext(predicate, tx, topLevel, opts) {
+function buildPermitContext(tx, topLevel, opts) {
     const amountByToken = {};
     const totals = new Map();
     for (const m of tx.tokenMovements) {
@@ -130,41 +127,6 @@ function buildPermitContext(predicate, tx, topLevel, opts) {
     for (const [token, total] of totals) {
         amountByToken[token] = total.toString();
     }
-    // Oracle prices: when the caller supplies a fixture, use it; otherwise
-    // derive a satisfying entry per `oracle_price` leaf in the predicate so
-    // the permit call permits. Negatives are clamped at 0 (Stellar oracle
-    // prices are non-negative).
-    const oraclePriceByAsset = {};
-    if (opts.oraclePricesByAsset) {
-        for (const [asset, entry] of Object.entries(opts.oraclePricesByAsset)) {
-            oraclePriceByAsset[asset] = entry;
-        }
-    }
-    if (predicate !== null) {
-        visitOracleLeaves(predicate, (asset, op, bound) => {
-            // A caller-supplied fixture entry always wins; we only fill gaps.
-            if (oraclePriceByAsset[asset] !== undefined)
-                return;
-            let price;
-            switch (op) {
-                case 'lt':
-                case 'gt':
-                    price = op === 'lt' ? bound - 1n : bound + 1n;
-                    break;
-                case 'lte':
-                case 'gte':
-                case 'eq':
-                    price = bound;
-                    break;
-            }
-            if (price < 0n)
-                price = 0n;
-            oraclePriceByAsset[asset] = {
-                price: price.toString(),
-                timestampSeconds: tx.fetchedAt,
-            };
-        });
-    }
     const ctx = {
         contract: topLevel.contract,
         fn: topLevel.fn,
@@ -173,8 +135,6 @@ function buildPermitContext(predicate, tx, topLevel, opts) {
         nowSeconds: tx.fetchedAt,
         amountByToken,
         windowSpentByToken: {},
-        invocationCountByWindow: {},
-        oraclePriceByAsset,
     };
     if (opts.validUntilLedger !== undefined) {
         ctx.validUntilLedger = opts.validUntilLedger;
@@ -202,52 +162,6 @@ function cloneDepthError(value) {
     err.depthContext = value.type;
     throw err;
 }
-function visitOracleLeaves(node, visit) {
-    switch (node.op) {
-        case 'and':
-        case 'or':
-            for (const child of node.children)
-                visitOracleLeaves(child, visit);
-            return;
-        case 'not':
-            visitOracleLeaves(node.child, visit);
-            return;
-        case 'eq':
-        case 'lt':
-        case 'lte':
-        case 'gt':
-        case 'gte': {
-            const leftLeaf = node.left;
-            const rightLeaf = node.right;
-            let oracleAsset;
-            let literal;
-            if (leftLeaf.kind === 'oracle_price') {
-                oracleAsset = leftLeaf.asset;
-                literal = oracleLiteralFromLeaf(rightLeaf);
-            }
-            else if (rightLeaf.kind === 'oracle_price') {
-                oracleAsset = rightLeaf.asset;
-                literal = oracleLiteralFromLeaf(leftLeaf);
-            }
-            if (oracleAsset === undefined || literal === undefined)
-                return;
-            visit(oracleAsset, node.op, literal);
-            return;
-        }
-        case 'in':
-            return;
-    }
-}
-function oracleLiteralFromLeaf(leaf) {
-    if (leaf.kind !== 'literal_i128')
-        return undefined;
-    try {
-        return BigInt(leaf.value);
-    }
-    catch {
-        return undefined;
-    }
-}
 function simulationError(message, cause) {
     const error = {
         code: 'SIMULATION_ERROR',

package/dist-cjs/verify/verify.d.ts

@@ -1,16 +1,10 @@
 import type { ToolResponse } from '../errors.ts';
 import type { PredicateNode, RecordedTransaction } from '../types.ts';
 /** Options for `verifyPolicy`. Mirrors the orchestrator's permit-context
- *  knobs (expiry; oracle fixture) so verify sees the same shape
+ *  knobs (expiry) so verify sees the same shape
  *  `simulatePolicy` sees. */
 export interface VerifyOptions {
     validUntilLedger?: number;
-    oraclePricesByAsset?: Record<string, {
-        price: string;
-        timestampSeconds: number;
-    } | {
-        error: 'stale' | 'missing' | 'deviation' | 'paused' | 'decimals' | 'fingerprint';
-    }>;
 }
 /** Run the static minimality check on a proposed predicate + recorded tx.
  *  Returns `{ ok: true }` when the predicate is minimal (every top-level

package/dist-cjs/verify/verify.js

@@ -107,12 +107,6 @@ function buildPermitContextForVerify(tx, topLevel, opts) {
     for (const [token, total] of totals) {
         amountByToken[token] = total.toString();
     }
-    const oraclePriceByAsset = {};
-    if (opts.oraclePricesByAsset) {
-        for (const [asset, entry] of Object.entries(opts.oraclePricesByAsset)) {
-            oraclePriceByAsset[asset] = entry;
-        }
-    }
     const ctx = {
         contract: topLevel.contract,
         fn: topLevel.fn,
@@ -121,8 +115,6 @@ function buildPermitContextForVerify(tx, topLevel, opts) {
         nowSeconds: tx.fetchedAt,
         amountByToken,
         windowSpentByToken: {},
-        invocationCountByWindow: {},
-        oraclePriceByAsset,
     };
     if (opts.validUntilLedger !== undefined) {
         ctx.validUntilLedger = opts.validUntilLedger;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",
@@ -12,12 +12,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/untangledfinance/octogate.git",
+    "url": "https://github.com/untangledfinance/oz-policy-builder.git",
     "directory": "packages/policy-synth"
   },
-  "homepage": "https://github.com/untangledfinance/octogate#readme",
+  "homepage": "https://github.com/untangledfinance/oz-policy-builder#readme",
   "bugs": {
-    "url": "https://github.com/untangledfinance/octogate/issues"
+    "url": "https://github.com/untangledfinance/oz-policy-builder/issues"
   },
   "keywords": [
     "stellar",