@crediolabs/policy-synth 0.2.0 → 0.3.0

package/src/synth/minimize.ts

@@ -1,48 +0,0 @@
-import type { PredicateNode } from '../types.ts'
-import { type DenyCase, generateCases } from './deny-cases.ts'
-import type { EvalContext } from './evaluate.ts'
-import { runHarness } from './harness.ts'
-
-/** Remove top-level conjuncts only when the current and regenerated batteries still deny. */
-export function minimize(
-  predicate: PredicateNode,
-  permitCtx: EvalContext,
-  dimensions?: string[]
-): PredicateNode {
-  if (predicate.op !== 'and') return predicate
-
-  let children = [...predicate.children]
-  let index = 0
-
-  while (index < children.length) {
-    const current: PredicateNode = { op: 'and', children }
-    const currentCases = generateCases(current, permitCtx, dimensions)
-    const candidateChildren = children.filter((_, childIndex) => childIndex !== index)
-    const candidate: PredicateNode = { op: 'and', children: candidateChildren }
-    const candidateCases = generateCases(candidate, permitCtx, dimensions)
-    const verificationCases = {
-      permit: candidateCases.permit,
-      denies: mergeDenyCases(currentCases.denies, candidateCases.denies),
-    }
-
-    if (runHarness(candidate, verificationCases).ok) {
-      children = candidateChildren
-      continue
-    }
-    index += 1
-  }
-
-  return { op: 'and', children }
-}
-
-function mergeDenyCases(current: DenyCase[], candidate: DenyCase[]): DenyCase[] {
-  const merged: DenyCase[] = []
-  const seen = new Set<string>()
-  for (const deny of [...current, ...candidate]) {
-    const key = `${deny.dimension}:${JSON.stringify(deny.ctx)}`
-    if (seen.has(key)) continue
-    seen.add(key)
-    merged.push(deny)
-  }
-  return merged
-}

package/src/synth/permit-context.ts

@@ -1,136 +0,0 @@
-// src/synth/permit-context.ts - build the EvalContext that represents the
-// recorded call being replayed.
-//
-// Extracted from the over-permissiveness harness so the same construction
-// feeds both the in-process battery and the on-chain replay
-// (scripts/verify-mutations-testnet.ts). Two callers building this
-// separately would be two chances to disagree about what "the recorded
-// call" means, which is the one thing both must share.
-
-import type { PredicateLeaf, PredicateNode, RecordedTransaction } from '../types.ts'
-import { cloneScVal } from './deny-cases.ts'
-import type { EvalContext } from './evaluate.ts'
-
-export interface PermitContextResponses {
-  windowSeconds: number
-  invocationLimit?: number
-  limitAmount?: string
-  validUntilLedger: number
-  oraclePriceBound?: Array<{ asset: string; operator: string; value: string; decimals: number }>
-}
-
-export function buildPermitContext(
-  tx: RecordedTransaction,
-  responses: PermitContextResponses,
-  predicate: PredicateNode
-): EvalContext {
-  const amountByToken: Record<string, string> = {}
-  const totals = new Map<string, bigint>()
-  for (const m of tx.tokenMovements) {
-    const current = totals.get(m.token) ?? 0n
-    totals.set(m.token, current + BigInt(m.amount))
-  }
-  for (const [token, total] of totals) {
-    amountByToken[token] = total.toString()
-  }
-
-  const topLevel = tx.invocations[0]
-  const scopeContract = topLevel?.contract ?? ''
-
-  const oraclePriceByAsset: EvalContext['oraclePriceByAsset'] = {}
-  visitOracleLeaves(predicate, (asset, op, bound) => {
-    let price: bigint
-    switch (op) {
-      case 'lt':
-        price = bound - 1n
-        break
-      case 'gt':
-        price = bound + 1n
-        break
-      default:
-        price = bound
-    }
-    if (price < 0n) price = 0n
-    oraclePriceByAsset[asset] = { price: price.toString(), timestampSeconds: tx.fetchedAt }
-  })
-
-  const ctx: EvalContext = {
-    contract: scopeContract,
-    fn: topLevel?.fn ?? '',
-    args: (topLevel?.args ?? []).map(cloneScVal),
-    atLedger: tx.ledgerSequence,
-    nowSeconds: tx.fetchedAt,
-    amountByToken,
-    windowSpentByToken: {},
-    invocationCountByWindow: {},
-    oraclePriceByAsset,
-  }
-  if (responses.validUntilLedger !== undefined) {
-    ctx.validUntilLedger = responses.validUntilLedger
-  }
-  return ctx
-}
-
-function visitOracleLeaves(
-  node: PredicateNode,
-  visit: (asset: string, op: string, bound: bigint) => void
-): void {
-  switch (node.op) {
-    case 'and':
-    case 'or':
-      for (const child of node.children) visitOracleLeaves(child, visit)
-      return
-    case 'not':
-      visitOracleLeaves(node.child, visit)
-      return
-    case 'eq':
-    case 'lt':
-    case 'lte':
-    case 'gt':
-    case 'gte': {
-      const leftIsOracle = node.left.kind === 'oracle_price'
-      const rightIsOracle = node.right.kind === 'oracle_price'
-      let asset: string | undefined
-      let literal: bigint | undefined
-      if (leftIsOracle) {
-        asset = node.left.kind === 'oracle_price' ? node.left.asset : undefined
-        literal = oracleThresholdNormalised(node.right)
-      } else if (rightIsOracle) {
-        asset = node.right.kind === 'oracle_price' ? node.right.asset : undefined
-        literal = oracleThresholdNormalised(node.left)
-      }
-      if (asset !== undefined && literal !== undefined) {
-        visit(asset, node.op, literal)
-      }
-      return
-    }
-    case 'in':
-      return
-  }
-}
-
-/** Oracle prices normalise to 9 decimals; mirrors NORMALISED_DECIMALS in
- *  oracle.rs. */
-const NORMALISED_DECIMALS = 9n
-
-/** A threshold restated on the normalised basis, so a derived permit price is
- *  comparable to it. Thresholds carry their own basis, so the conversion has
- *  to happen here - reading the digits raw would build a context off by a
- *  factor of 10^(decimals-9). Returns undefined for any other leaf. */
-function oracleThresholdNormalised(leaf: PredicateLeaf): bigint | undefined {
-  if (leaf.kind !== 'oracle_threshold') return undefined
-  let value: bigint
-  try {
-    value = BigInt(leaf.value)
-  } catch {
-    return undefined
-  }
-  const decimals = BigInt(leaf.decimals)
-  if (decimals <= NORMALISED_DECIMALS) {
-    return value * 10n ** (NORMALISED_DECIMALS - decimals)
-  }
-  // Floor: a finer-grained threshold has no exact 9-dp representation. The
-  // caller only needs a price that lands on the right side of the bound, and
-  // it offsets by one from here.
-  return value / 10n ** (decimals - NORMALISED_DECIMALS)
-}

package/src/synth/predicate-literals.ts

@@ -1,27 +0,0 @@
-// src/synth/predicate-literals.ts - read scalar values out of predicate literal leaves.
-//
-// Small shared helpers for interpreting a `PredicateLeaf` literal. Kept out of
-// `evaluate.ts` so the evaluator stays focused on the deny-order semantics; the
-// deny-case generator uses the same reader so both sides agree on what a numeric
-// literal means.
-
-import type { PredicateLeaf } from '../types.ts'
-
-/** BigInt value of a numeric-integer literal leaf (`literal_i128` / `literal_u64`
- *  / `literal_u32`), or null for a non-numeric literal (address / symbol / bytes
- *  / vec). Callers fail closed on null. */
-export function literalNumericBigInt(leaf: PredicateLeaf): bigint | null {
-  switch (leaf.kind) {
-    case 'literal_i128':
-    case 'literal_u64':
-      try {
-        return BigInt(leaf.value)
-      } catch {
-        return null
-      }
-    case 'literal_u32':
-      return BigInt(leaf.value)
-    default:
-      return null
-  }
-}

package/src/synth/synthesize-from-mandate.ts

@@ -1,82 +0,0 @@
-// src/synth/synthesize-from-mandate.ts - the deterministic Mandate front-end.
-//
-// synthesizeFromMandate is the clean end-to-end demo path: a declarative
-// MandateSpec is lowered deterministically to a PolicyIR and compiled by the OZ
-// adapter to a ProposedPolicy. No decoding, no inference, so parseConfidence is
-// the full/not-applicable value. Constructs the OZ built-in primitives cannot
-// express (compile's `uncovered`) are surfaced in `ProposedPolicy.warnings`
-// rather than failing the call - the covered primitives still install; the
-// uncovered ones are reported.
-
-import type { OzAdapterConfig } from '../adapters/oz/adapter.ts'
-import { createOzAdapter } from '../adapters/oz/adapter.ts'
-import type { ToolResponse } from '../errors.ts'
-import { mandateToPolicyIR } from '../mandate/to-ir.ts'
-import type { MandateSpec } from '../mandate/types.ts'
-import type { PredicateNode, ProposedPolicy } from '../types.ts'
-import type { SimulationResult } from '../verify/envelope.ts'
-
-const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: '
-
-export function synthesizeFromMandate(
-  spec: MandateSpec,
-  ozConfig: OzAdapterConfig,
-  /** --explain opt-in. When true, the success envelope carries the
-   *  in-memory predicate tree (always null for the mandate path - the
-   *  declarative MandateSpec lowers to OZ built-ins, not to an
-   *  interpreter predicate) + a minimal honest SimulationResult. The
-   *  flag is ADDITIVE: the existing ProposedPolicy fields are never
-   *  altered. */
-  opts?: { explain?: true }
-): ToolResponse<ProposedPolicy> & {
-  explain?: {
-    predicateTree: PredicateNode | null
-    simulation: SimulationResult
-  }
-} {
-  const ir = mandateToPolicyIR(spec)
-  const adapter = createOzAdapter(ozConfig)
-  const result = adapter.compile(ir)
-
-  if (!result.proposed) {
-    return {
-      ok: false,
-      error: {
-        code: 'SYNTHESIS_ERROR',
-        message: `mandate lowered to no installable OZ policy: ${result.uncovered.join('; ')}`,
-        severity: 'error',
-        retryable: false,
-        details: { uncovered: result.uncovered },
-      },
-    }
-  }
-
-  const proposed: ProposedPolicy = {
-    ...result.proposed,
-    warnings: result.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
-  }
-  // Same --explain envelope pattern as the recording path. The mandate path
-  // never produces an interpreter predicate, so predicateTree is null and
-  // the simulation is a minimal honest deny (no self-verify was performed).
-  const envelope: ToolResponse<ProposedPolicy> & {
-    explain?: {
-      predicateTree: PredicateNode | null
-      simulation: SimulationResult
-    }
-  } = { ok: true, data: proposed }
-  if (opts?.explain) {
-    envelope.explain = {
-      predicateTree: null,
-      simulation: {
-        permit: {
-          tx: 'deny',
-          reason: 'No self-verification was performed (mandate path is OZ-only)',
-        },
-        evaluatedCases: [],
-        backend: 'ts-model',
-        simulatorVersion: 'not-run',
-      },
-    }
-  }
-  return envelope
-}

package/src/verify/envelope.ts

@@ -1,28 +0,0 @@
-// src/verify/envelope.ts - the post-simulation result envelope used by
-// review-card rendering and verification.
-//
-// `SimulationResult` is the structured verdict a `simulate_policy` run
-// produces; the review-card builder reads it as one of its inputs (so the
-// rendered card can quote the backend that evaluated the policy) and the
-// verification pipeline reads `permit` + `evaluatedCases` to confirm every
-// generated deny case really did deny.
-//
-// This envelope is intentionally separate from the CustodyAdapter
-// `SimulationResult` in `src/seams/types.ts` (which is the dry-run stub
-// returned by `adapter.simulate(ir, permitTx)`); the seam result is the
-// adapter contract, this envelope is the post-simulation record consumed by
-// downstream rendering + verification.
-//
-// Fields:
-//   - `permit` is the single verdict for the candidate recorded tx.
-//   - `evaluatedCases` is the deny-case battery outcome (every dimension
-//     must report `deny` when the policy is minimal).
-//   - `backend` is the actual evaluator that produced the verdict.
-//   - `simulatorVersion` lets the reviewer / audit log distinguish runs.
-
-export type SimulationResult = {
-  permit: { tx: 'permit' } | { tx: 'deny'; reason: string }
-  evaluatedCases: Array<{ dimension: string; outcome: 'permit' | 'deny'; reason: string }>
-  backend: 'interpreter-v1' | 'ts-model'
-  simulatorVersion: string
-}

package/src/verify/index.ts

@@ -1,5 +0,0 @@
-// src/verify/index.ts - re-export the simulation / verification surface.
-
-export type { SimulationResult } from './envelope.ts'
-export { type SimulateOptions, simulatePolicy } from './simulate.ts'
-export { type VerifyOptions, verifyPolicy } from './verify.ts'

package/src/verify/simulate.ts

@@ -1,311 +0,0 @@
-// src/verify/simulate.ts - the post-simulation verdict for `simulate_policy`.
-//
-// `simulatePolicy` replays a recorded transaction against a proposed
-// `PredicateNode` and emits the `SimulationResult` envelope the review-card
-// builder + the verification pipeline consume.
-//
-// Boundary (pinned, must not drift):
-//   - `SIMULATION_ERROR`        = RUNTIME evaluation failed. Surfaced by
-//     `simulatePolicy`. Reasons: malformed `permitTx` input (no top-level
-//     invocation to build an EvalContext from), a referenced oracle asset
-//     without a satisfying price fixture, or a non-runtime propagation (a
-//     throw that is not an oracle error or a controlled deny). A
-//     runtime evaluation failure is NOT a policy-minimality problem; the
-//     policy may still be minimal. Re-running with a complete fixture MAY
-//     succeed.
-//   - `VERIFICATION_FAILED`     = STATIC minimality check failed. Surfaced
-//     by `verifyPolicy`. The minimiser identified a load-bearing-free
-//     constraint; the policy is structurally over-broad regardless of how
-//     any concrete call evaluates. Re-running with a different fixture
-//     will NOT fix it; the policy must be trimmed.
-//
-// Determinism: same `(predicate, permitTx, opts)` -> byte-identical
-// envelope, no clock, no randomness.
-//
-// The permit EvalContext is built locally (mirror of the helper used in
-// `synthesize-from-recording.ts`) so this module does not couple to the
-// orchestrator's private build helpers. The shape is pinned by the test
-// suite to stay in lockstep.
-
-import type { ToolError, ToolResponse } from '../errors.ts'
-import { generateCases } from '../synth/deny-cases.ts'
-import { type EvalContext, evaluate } from '../synth/evaluate.ts'
-import type {
-  ContractInvocation,
-  PredicateLeaf,
-  PredicateNode,
-  RecordedTransaction,
-  ScVal,
-} from '../types.ts'
-import { MAX_SCVAL_CLONE_DEPTH } from '../types.ts'
-import type { SimulationResult } from './envelope.ts'
-
-const SIMULATOR_VERSION = 'ts-model-1.0.0'
-
-/** Options for `simulatePolicy`. `validUntilLedger` is propagated onto the
- *  permit EvalContext so the simulator exercises the expiry gate; absent ->
- *  no expiry check (mirrors the orchestrator's "no `validUntilLedger`
- *  supplied" path). `oraclePricesByAsset` is the test fixture the simulator
- *  uses to satisfy `oracle_price` leaves so the permit call evaluates under
- *  the bound; absent -> derive satisfying prices from the predicate itself
- *  (the orchestrator's oracle-satisfying-price logic). */
-export interface SimulateOptions {
-  validUntilLedger?: number
-  /** Pre-populated oracle-price entries keyed by asset address. The fixture
-   *  must satisfy every `oracle_price` leaf in the predicate; absent or
-   *  unsatisfying entries cause `SIMULATION_ERROR`. */
-  oraclePricesByAsset?: Record<
-    string,
-    | { price: string; timestampSeconds: number }
-    | {
-        error: 'stale' | 'missing' | 'deviation' | 'paused' | 'decimals' | 'fingerprint'
-      }
-  >
-}
-
-/** Replay a recorded transaction against a proposed predicate and emit the
- *  `SimulationResult` envelope. The simulator returns the SAME permit
- *  verdict `runHarness` expects: the intended recorded call must permit; every
- *  generated deny dimension must deny. A runtime evaluation failure
- *  (malformed input, missing oracle fixture, etc.) returns a `SIMULATION_ERROR`
- *  `ToolError` - NOT a deny verdict, NOT `VERIFICATION_FAILED`. The boundary
- *  is pinned: minimality is a verify-time concern, runtime evaluation is a
- *  simulate-time concern. */
-export function simulatePolicy(
-  predicate: PredicateNode | null,
-  permitTx: RecordedTransaction,
-  opts: SimulateOptions = {}
-): ToolResponse<SimulationResult> {
-  // The permit EvalContext requires a top-level invocation. A recorded tx
-  // with no invocations is structurally malformed input - we surface a
-  // runtime `SIMULATION_ERROR` rather than fabricating a permit verdict.
-  const topLevel = permitTx.invocations[0]
-  if (!topLevel) {
-    return {
-      ok: false,
-      error: simulationError('recorded transaction has no top-level invocation to simulate'),
-    }
-  }
-
-  let permitCtx: EvalContext
-  try {
-    permitCtx = buildPermitContext(predicate, permitTx, topLevel, opts)
-  } catch (e) {
-    return {
-      ok: false,
-      error: simulationError(`could not build permit evaluation context: ${(e as Error).message}`),
-    }
-  }
-
-  // `predicate === null` means the policy is OZ-only (no interpreter
-  // predicate). We still emit the envelope so the review card + verifier
-  // can consume it: the permit verdict evaluates an always-permit empty
-  // tree, and the deny battery is empty (nothing to verify at the
-  // interpreter layer).
-  const evaluatePredicate: PredicateNode = predicate ?? { op: 'and', children: [] }
-
-  const evaluatedCases: SimulationResult['evaluatedCases'] = []
-
-  let permitVerdict: { permit: true } | { permit: false; reason: string }
-  try {
-    permitVerdict = evaluate(evaluatePredicate, permitCtx)
-  } catch (e) {
-    return {
-      ok: false,
-      error: simulationError(`permit evaluation threw at runtime: ${(e as Error).message}`, e),
-    }
-  }
-  evaluatedCases.push({
-    dimension: 'permit',
-    outcome: permitVerdict.permit ? 'permit' : 'deny',
-    reason: permitVerdict.permit ? 'matches recorded call' : permitVerdict.reason,
-  })
-
-  // The deny battery is generated against the SAME permit context. A
-  // runtime evaluation failure on ANY deny case is a `SIMULATION_ERROR` -
-  // not a deny verdict (an evaluate-throws is not a deny) and not a
-  // minimality problem.
-  const cases = generateCases(evaluatePredicate, permitCtx)
-  for (const deny of cases.denies) {
-    let result: { permit: true } | { permit: false; reason: string }
-    try {
-      result = evaluate(evaluatePredicate, deny.ctx)
-    } catch (e) {
-      return {
-        ok: false,
-        error: simulationError(
-          `deny case "${deny.dimension}" threw at runtime: ${(e as Error).message}`,
-          e
-        ),
-      }
-    }
-    evaluatedCases.push({
-      dimension: deny.dimension,
-      outcome: result.permit ? 'permit' : 'deny',
-      reason: result.permit ? 'no matching deny' : result.reason,
-    })
-  }
-
-  const envelope: SimulationResult = {
-    permit: permitVerdict.permit ? { tx: 'permit' } : { tx: 'deny', reason: permitVerdict.reason },
-    evaluatedCases,
-    backend: 'ts-model',
-    simulatorVersion: SIMULATOR_VERSION,
-  }
-  return { ok: true, data: envelope }
-}
-
-/** Build the permit `EvalContext` the simulator drives. Mirrors the
- *  helper in `synthesize-from-recording.ts` so the simulator sees the same
- *  shape the orchestrator's self-verify pipeline sees; we mirror here
- *  rather than import to keep `src/verify/` decoupled from the
- *  orchestrator's private helpers. The shape is pinned by tests so the
- *  two implementations stay in lockstep. */
-function buildPermitContext(
-  predicate: PredicateNode | null,
-  tx: RecordedTransaction,
-  topLevel: ContractInvocation,
-  opts: SimulateOptions
-): EvalContext {
-  const amountByToken: Record<string, string> = {}
-  const totals = new Map<string, bigint>()
-  for (const m of tx.tokenMovements) {
-    const current = totals.get(m.token) ?? 0n
-    totals.set(m.token, current + BigInt(m.amount))
-  }
-  for (const [token, total] of totals) {
-    amountByToken[token] = total.toString()
-  }
-
-  // Oracle prices: when the caller supplies a fixture, use it; otherwise
-  // derive a satisfying entry per `oracle_price` leaf in the predicate so
-  // the permit call permits. Negatives are clamped at 0 (Stellar oracle
-  // prices are non-negative).
-  const oraclePriceByAsset: EvalContext['oraclePriceByAsset'] = {}
-  if (opts.oraclePricesByAsset) {
-    for (const [asset, entry] of Object.entries(opts.oraclePricesByAsset)) {
-      oraclePriceByAsset[asset] = entry
-    }
-  }
-  if (predicate !== null) {
-    visitOracleLeaves(predicate, (asset, op, bound) => {
-      // A caller-supplied fixture entry always wins; we only fill gaps.
-      if (oraclePriceByAsset[asset] !== undefined) return
-      let price: bigint
-      switch (op) {
-        case 'lt':
-        case 'gt':
-          price = op === 'lt' ? bound - 1n : bound + 1n
-          break
-        case 'lte':
-        case 'gte':
-        case 'eq':
-          price = bound
-          break
-      }
-      if (price < 0n) price = 0n
-      oraclePriceByAsset[asset] = {
-        price: price.toString(),
-        timestampSeconds: tx.fetchedAt,
-      }
-    })
-  }
-
-  const ctx: EvalContext = {
-    contract: topLevel.contract,
-    fn: topLevel.fn,
-    args: topLevel.args.map(cloneScVal),
-    atLedger: tx.ledgerSequence,
-    nowSeconds: tx.fetchedAt,
-    amountByToken,
-    windowSpentByToken: {},
-    invocationCountByWindow: {},
-    oraclePriceByAsset,
-  }
-  if (opts.validUntilLedger !== undefined) {
-    ctx.validUntilLedger = opts.validUntilLedger
-  }
-  return ctx
-}
-
-function cloneScVal(value: ScVal, depth = 0): ScVal {
-  // Recursion is bounded by MAX_SCVAL_CLONE_DEPTH so a hand-crafted nested-vec
-  // payload cannot RangeError the JS stack during context building. Over-depth
-  // throws a ToolError-shaped error that the simulator's existing try/catch
-  // converts to a structured `{ok:false, error}` (not a thrown RangeError).
-  if (value.type === 'vec') {
-    if (depth >= MAX_SCVAL_CLONE_DEPTH) {
-      throw cloneDepthError(value)
-    }
-    return { type: 'vec', value: value.value.map((v) => cloneScVal(v, depth + 1)) }
-  }
-  return { ...value }
-}
-
-function cloneDepthError(value: ScVal): never {
-  const err = new Error(
-    `ScVal clone depth exceeds MAX_SCVAL_CLONE_DEPTH (${MAX_SCVAL_CLONE_DEPTH})`
-  ) as Error & { code: string; severity: string; retryable: boolean; depthContext: unknown }
-  err.code = 'SIMULATION_ERROR'
-  err.severity = 'error'
-  err.retryable = false
-  err.depthContext = value.type
-  throw err
-}
-
-function visitOracleLeaves(
-  node: PredicateNode,
-  visit: (asset: string, op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte', bound: bigint) => void
-): void {
-  switch (node.op) {
-    case 'and':
-    case 'or':
-      for (const child of node.children) visitOracleLeaves(child, visit)
-      return
-    case 'not':
-      visitOracleLeaves(node.child, visit)
-      return
-    case 'eq':
-    case 'lt':
-    case 'lte':
-    case 'gt':
-    case 'gte': {
-      const leftLeaf = node.left
-      const rightLeaf = node.right
-      let oracleAsset: string | undefined
-      let literal: bigint | undefined
-      if (leftLeaf.kind === 'oracle_price') {
-        oracleAsset = leftLeaf.asset
-        literal = oracleLiteralFromLeaf(rightLeaf)
-      } else if (rightLeaf.kind === 'oracle_price') {
-        oracleAsset = rightLeaf.asset
-        literal = oracleLiteralFromLeaf(leftLeaf)
-      }
-      if (oracleAsset === undefined || literal === undefined) return
-      visit(oracleAsset, node.op, literal)
-      return
-    }
-    case 'in':
-      return
-  }
-}
-
-function oracleLiteralFromLeaf(leaf: PredicateLeaf): bigint | undefined {
-  if (leaf.kind !== 'literal_i128') return undefined
-  try {
-    return BigInt(leaf.value)
-  } catch {
-    return undefined
-  }
-}
-
-function simulationError(message: string, cause?: unknown): ToolError {
-  const error: ToolError = {
-    code: 'SIMULATION_ERROR',
-    message,
-    severity: 'error',
-    retryable: false,
-  }
-  if (cause !== undefined) error.details = { cause: String(cause) }
-  return error
-}