@crediolabs/policy-synth 0.2.0 → 0.3.0

package/dist/review-card/builder.js

@@ -6,38 +6,26 @@
 // summary being REPRODUCIBLE + TESTABLE + NON-HALLUCINABLE, so this module is
 // pure: same inputs -> byte-identical output, no clock, no randomness, no I/O.
 //
-// The builder walks two inputs and emits ONE constraint string per leaf or
-// primitive, in a fixed deterministic order:
-//
-//   1. The OZ built-in `PolicyRef`s. Each `spending_limit` primitive becomes a
-//      `spending_limit(token, limitAmount, windowSecs)` line; other OZ
-//      primitives (threshold) are skipped - the review card does not quote
-//      them (they are signer-config concerns, not transactional bounds).
-//
-//   2. The interpreter `PredicateNode`. One string per constraint leaf,
-//      rendered by enclosing-comparison kind. Templates (Task 7b):
-//        - invocation_count_in_window < N     -> At most N calls per <window> seconds
-//        - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
-//        - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
-//        - oracle_price(asset) OP price       -> Only when oracle_price(asset) OP price
-//        - call_fn == x                       -> Function must be x
-//        - call_contract == c                 -> Contract must be c
-//        - amount <= v                        -> Amount <= v
+// The builder walks the interpreter `PredicateNode` and emits ONE constraint
+// string per leaf, in a fixed deterministic order. Templates (Task 7b):
+//   - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
+//   - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
+//   - call_fn == x                       -> Function must be x
+//   - call_contract == c                 -> Contract must be c
+//   - amount <= v                        -> Amount <= v
 //
 // The content hash is a stable sha256 hex of a canonical JSON of
 // { ruleName, plainEnglish, constraints, expiry, backend } - identical
 // inputs (incl. the context-rule expiry and simulation backend) -> identical
 // hash. There is no clock; the hash never includes a timestamp.
 import { createHash } from 'node:crypto';
+import { comparisonOpText, renderHaystackElement, renderVecElement } from "./render-leaf.js";
 /** Build a deterministic review-card summary from a policy + context rule +
  *  simulation result. Pure: same inputs -> byte-identical output. */
-export function buildReviewCardSummary(predicate, policyRefs, contextRule, simulation) {
+export function buildReviewCardSummary(predicate, contextRule, 
+/** Evaluator identity folded into the content hash. */
+backend) {
     const constraints = [];
-    for (const ref of policyRefs) {
-        const line = renderOzPrimitive(ref);
-        if (line !== null)
-            constraints.push(line);
-    }
     if (predicate !== null) {
         walkPredicate(predicate, (node) => {
             const line = renderConstraint(node);
@@ -55,7 +43,6 @@ export function buildReviewCardSummary(predicate, policyRefs, contextRule, simul
     const signerNote = contextRule.signers.length >= 2
         ? 'any ONE signer may authorise a permitted op under this rule (OZ any-of-N semantic)'
         : null;
-    const backend = simulation.backend;
     const contentHash = computeContentHash({
         ruleName,
         plainEnglish,
@@ -66,25 +53,6 @@ export function buildReviewCardSummary(predicate, policyRefs, contextRule, simul
     });
     return { ruleName, plainEnglish, constraints, expiry, signerNote, backend, contentHash };
 }
-/** Render the OZ built-in primitive summary line. Only `spending_limit` is
- *  quoted by the review card (it is the only primitive that defines a
- *  transactional bound). Other primitives (threshold) are signer-config
- *  concerns handled by the OZ adapter's own `uncovered` machinery.
- *  Spending_limit takes `period_ledgers` on-chain (~5s/ledger); the card
- *  states the window in seconds so the user reads it consistently with the
- *  interpreter templates. */
-function renderOzPrimitive(ref) {
-    if (ref.kind !== 'oz_builtin')
-        return null;
-    const primitive = ref.primitive;
-    if (primitive.primitive !== 'spending_limit')
-        return null;
-    const params = primitive.params;
-    const limit = params.spending_limit ?? '0';
-    const periodLedgers = params.period_ledgers ?? 0;
-    const windowSecs = periodLedgers * 5;
-    return `spending_limit(${limit}, ${windowSecs})`;
-}
 /** Walk every comparison / membership node of the predicate and invoke
  *  `visit` on each. The walk is depth-first, left-to-right, so the
  *  constraint list is stable across runs. Pure boolean nodes contribute no
@@ -109,21 +77,14 @@ export function describePredicate(predicate) {
 function walkPredicate(node, visit) {
     switch (node.op) {
         case 'and':
-        case 'or':
             for (const child of node.children)
                 walkPredicate(child, visit);
             return;
-        case 'not':
-            walkPredicate(node.child, visit);
-            return;
         case 'in':
             visit(node);
             return;
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             visit(node);
             return;
     }
@@ -131,18 +92,13 @@ function walkPredicate(node, visit) {
 /** Render ONE constraint sentence for ONE interpreter predicate node. The
  *  shape of the output is pinned by Task 7b so the test suite can assert
  *  byte-for-byte equality. Returns `null` when the node is a structural
- *  boolean (`and` / `or` / `not`) - those are not constraint leaves. */
+ *  boolean (`and`) - that is not a constraint leaf. */
 function renderConstraint(node) {
     switch (node.op) {
         case 'and':
-        case 'or':
-        case 'not':
             return null;
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             return renderComparison(node);
         case 'in':
             return renderMembership(node);
@@ -172,8 +128,8 @@ function renderComparison(node) {
     }
     // eq/lte(call_arg_field[i, el, field], <literal>) -> arg[i] element[el].field = <value>
     // The structured-argument bind pins a scalar field inside a vec element.
-    // For lt/gt/lte/gte the line reads "OP <value>" so the comparison kind
-    // is visible; eq reads "= <value>".
+    // For lte the line reads "OP <value>" so the comparison kind is visible;
+    // eq reads "= <value>".
     if (left.kind === 'call_arg_field') {
         const head = `arg[${left.index}] element[${left.element}].${left.field}`;
         const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
@@ -181,10 +137,6 @@ function renderComparison(node) {
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_symbol')
             return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_bytes')
-            return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_u64')
-            return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_i128')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_u32')
@@ -193,22 +145,10 @@ function renderComparison(node) {
             return `${head} ${sep} [${right.elements.map(renderVecElement).join(', ')}]`;
         }
     }
-    // The bound is compared against the calls ALREADY made in the window, so
-    // `< N` permits N of them and `<= N` permits one more. Report how many
-    // calls the rule allows rather than restating the comparison.
-    if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        const allowed = node.op === 'lt' ? right.value : right.value + 1;
-        return `At most ${allowed} calls per ${left.windowSecs} seconds`;
-    }
-    // OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>
-    //
-    // The per-call cap. It has to be here because the `amount` template below
-    // is unreachable for an interpreter policy: `amount` is deliberately not in
-    // the contract's grammar (dsl.rs - the interpreter sees one authorized
-    // call, not the transaction's token movements), so a predicate using it is
-    // refused at install. A bound on the call's own amount ARGUMENT is how a
-    // cap is actually written, and it was rendering nothing at all - the card
-    // silently understated the policy.
+    // The per-call cap: OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>.
+    // The interpreter is passed one authorized call, not the transaction's token
+    // movements, so a bound on the call's own amount ARGUMENT is how a cap is
+    // written.
     //
     // Placed after the literal_vec case above so an exact-sequence `eq` still
     // reads as a path rather than as a comparison.
@@ -217,28 +157,12 @@ function renderComparison(node) {
         const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
         if (right.kind === 'literal_i128')
             return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_u64')
-            return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_u32')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_address')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_symbol')
             return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_bytes')
-            return `${head} ${sep} ${right.value}`;
-        // call_arg_scaled is the slippage floor and reads as itself.
-        if (right.kind === 'call_arg_scaled') {
-            return `${head} >= arg[${right.index}] * ${right.num}/${right.den}`;
-        }
-    }
-    // amount <= v -> Amount <= v
-    if (left.kind === 'amount' && right.kind === 'literal_i128') {
-        return `Amount <= ${right.value}`;
-    }
-    // oracle_price(asset) OP price -> Only when oracle_price(asset) OP price
-    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
-        return `Only when oracle_price(${left.asset}) ${comparisonOpText(node.op)} ${right.value} (${right.decimals} dp)`;
     }
     // Any other comparison shape is a structural fail-closed: do not surface
     // a misleading line. Cross-check still requires every leaf produce a
@@ -255,74 +179,6 @@ function renderMembership(node) {
     }
     return null;
 }
-function renderVecElement(leaf) {
-    switch (leaf.kind) {
-        case 'literal_address':
-            return leaf.value;
-        case 'literal_i128':
-            return leaf.value;
-        case 'literal_symbol':
-            return leaf.value;
-        case 'literal_u32':
-            return String(leaf.value);
-        case 'literal_u64':
-            return leaf.value;
-        case 'literal_bytes':
-            return leaf.value;
-        case 'literal_vec':
-            return `[${leaf.elements.map(renderVecElement).join(', ')}]`;
-        case 'call_contract':
-        case 'call_fn':
-        case 'call_arg':
-        case 'call_arg_len':
-        case 'call_arg_field':
-        case 'call_arg_scaled':
-        case 'amount':
-        case 'window_spent':
-        case 'now':
-        case 'valid_until':
-        case 'invocation_count_in_window':
-        case 'oracle_price':
-            return `<${leaf.kind}>`;
-        // Show the declared basis, not just the digits. A threshold on the wrong
-        // basis is the one policy error the contract cannot detect, so the review
-        // card is where a human has to be able to see it.
-        case 'oracle_threshold':
-            return `${leaf.value} (${leaf.decimals} dp)`;
-    }
-}
-function renderHaystackElement(leaf) {
-    if (leaf.kind === 'literal_address')
-        return leaf.value;
-    if (leaf.kind === 'literal_i128')
-        return leaf.value;
-    if (leaf.kind === 'literal_symbol')
-        return leaf.value;
-    if (leaf.kind === 'literal_u32')
-        return String(leaf.value);
-    if (leaf.kind === 'literal_u64')
-        return leaf.value;
-    if (leaf.kind === 'literal_bytes')
-        return leaf.value;
-    if (leaf.kind === 'literal_vec') {
-        return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`;
-    }
-    return `<${leaf.kind}>`;
-}
-function comparisonOpText(op) {
-    switch (op) {
-        case 'lt':
-            return '<';
-        case 'lte':
-            return '<=';
-        case 'gt':
-            return '>';
-        case 'gte':
-            return '>=';
-        case 'eq':
-            return '==';
-    }
-}
 /** Render the plain-English one-liner. Format: `<ruleName>: <constraints>`,
  *  joined by `; ` so the user reads one sentence per constraint. */
 function renderPlainEnglish(ruleName, constraints) {

package/dist/review-card/cross-check.js

@@ -12,6 +12,7 @@
 // demands the summary carries the corresponding string. A naive summary
 // that drops a leaf (or fabricates a string not in the predicate) trips the
 // guard.
+import { comparisonOpText, renderHaystackElement, renderVecElement } from "./render-leaf.js";
 /** Assert every leaf in the predicate appears as a constraint string in
  *  `summary.constraints`. Returns the missing templates (without the leaf
  *  values filled in) when any leaf was dropped. */
@@ -35,18 +36,11 @@ export function summaryCrossCheck(predicate, summary) {
 function collect(node, out) {
     switch (node.op) {
         case 'and':
-        case 'or':
             for (const child of node.children)
                 collect(child, out);
             return;
-        case 'not':
-            collect(node.child, out);
-            return;
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             pushComparison(node.left, node.right, node.op, out);
             return;
         case 'in':
@@ -84,14 +78,6 @@ function pushComparison(left, right, op, out) {
             out.push(`${head} ${sep} ${right.value}`);
             return;
         }
-        if (right.kind === 'literal_bytes') {
-            out.push(`${head} ${sep} ${right.value}`);
-            return;
-        }
-        if (right.kind === 'literal_u64') {
-            out.push(`${head} ${sep} ${right.value}`);
-            return;
-        }
         if (right.kind === 'literal_i128') {
             out.push(`${head} ${sep} ${right.value}`);
             return;
@@ -105,13 +91,6 @@ function pushComparison(left, right, op, out) {
             return;
         }
     }
-    // Mirrors the builder's wording byte-for-byte: how many calls the rule
-    // permits, since the bound counts the calls already made.
-    if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        const allowed = op === 'lt' ? right.value : right.value + 1;
-        out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`);
-        return;
-    }
     // Mirrors the builder's per-call cap line. Both sides must render the same
     // string: cross-check compares the summary against the predicate, so a
     // shape only ONE of them renders would read as a dropped constraint.
@@ -119,26 +98,12 @@ function pushComparison(left, right, op, out) {
         const head = `arg[${left.index}]`;
         const sep = op === 'eq' ? '=' : comparisonOpText(op);
         if (right.kind === 'literal_i128' ||
-            right.kind === 'literal_u64' ||
             right.kind === 'literal_u32' ||
             right.kind === 'literal_address' ||
-            right.kind === 'literal_symbol' ||
-            right.kind === 'literal_bytes') {
+            right.kind === 'literal_symbol') {
             out.push(`${head} ${sep} ${right.value}`);
             return;
         }
-        if (right.kind === 'call_arg_scaled') {
-            out.push(`${head} >= arg[${right.index}] * ${right.num}/${right.den}`);
-            return;
-        }
-    }
-    if (left.kind === 'amount' && right.kind === 'literal_i128') {
-        out.push(`Amount <= ${right.value}`);
-        return;
-    }
-    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
-        out.push(`Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value} (${right.decimals} dp)`);
-        return;
     }
 }
 function pushMembership(needle, haystack, out) {
@@ -147,71 +112,3 @@ function pushMembership(needle, haystack, out) {
     const list = haystack.map(renderHaystackElement).join(', ');
     out.push(`Recipient/arg must be one of [${list}]`);
 }
-function renderVecElement(leaf) {
-    switch (leaf.kind) {
-        case 'literal_address':
-            return leaf.value;
-        case 'literal_i128':
-            return leaf.value;
-        case 'literal_symbol':
-            return leaf.value;
-        case 'literal_u32':
-            return String(leaf.value);
-        case 'literal_u64':
-            return leaf.value;
-        case 'literal_bytes':
-            return leaf.value;
-        case 'literal_vec':
-            return `[${leaf.elements.map(renderVecElement).join(', ')}]`;
-        case 'call_contract':
-        case 'call_fn':
-        case 'call_arg':
-        case 'call_arg_len':
-        case 'call_arg_field':
-        case 'call_arg_scaled':
-        case 'amount':
-        case 'window_spent':
-        case 'now':
-        case 'valid_until':
-        case 'invocation_count_in_window':
-        case 'oracle_price':
-            return `<${leaf.kind}>`;
-        // Show the declared basis, not just the digits. A threshold on the wrong
-        // basis is the one policy error the contract cannot detect, so the review
-        // card is where a human has to be able to see it.
-        case 'oracle_threshold':
-            return `${leaf.value} (${leaf.decimals} dp)`;
-    }
-}
-function renderHaystackElement(leaf) {
-    if (leaf.kind === 'literal_address')
-        return leaf.value;
-    if (leaf.kind === 'literal_i128')
-        return leaf.value;
-    if (leaf.kind === 'literal_symbol')
-        return leaf.value;
-    if (leaf.kind === 'literal_u32')
-        return String(leaf.value);
-    if (leaf.kind === 'literal_u64')
-        return leaf.value;
-    if (leaf.kind === 'literal_bytes')
-        return leaf.value;
-    if (leaf.kind === 'literal_vec') {
-        return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`;
-    }
-    return `<${leaf.kind}>`;
-}
-function comparisonOpText(op) {
-    switch (op) {
-        case 'lt':
-            return '<';
-        case 'lte':
-            return '<=';
-        case 'gt':
-            return '>';
-        case 'gte':
-            return '>=';
-        case 'eq':
-            return '==';
-    }
-}

package/dist/review-card/render-leaf.d.ts

@@ -0,0 +1,4 @@
+import type { PredicateLeaf } from '../types.ts';
+export declare function renderVecElement(leaf: PredicateLeaf): string;
+export declare function renderHaystackElement(leaf: PredicateLeaf): string;
+export declare function comparisonOpText(op: 'eq' | 'lte'): string;

package/dist/review-card/render-leaf.js

@@ -0,0 +1,47 @@
+// Leaf and operator rendering shared by the review-card builder and the
+// summary cross-check. Both turn the SAME predicate into human-readable text -
+// the cross-check exists to confirm the builder's summary matches the predicate
+// - so rendering a leaf differently in the two would make the check compare a
+// string against itself under a different spelling and pass on a real mismatch.
+export function renderVecElement(leaf) {
+    switch (leaf.kind) {
+        case 'literal_address':
+            return leaf.value;
+        case 'literal_i128':
+            return leaf.value;
+        case 'literal_symbol':
+            return leaf.value;
+        case 'literal_u32':
+            return String(leaf.value);
+        case 'literal_vec':
+            return `[${leaf.elements.map(renderVecElement).join(', ')}]`;
+        case 'call_contract':
+        case 'call_fn':
+        case 'call_arg':
+        case 'call_arg_len':
+        case 'call_arg_field':
+            return `<${leaf.kind}>`;
+    }
+}
+export function renderHaystackElement(leaf) {
+    if (leaf.kind === 'literal_address')
+        return leaf.value;
+    if (leaf.kind === 'literal_i128')
+        return leaf.value;
+    if (leaf.kind === 'literal_symbol')
+        return leaf.value;
+    if (leaf.kind === 'literal_u32')
+        return String(leaf.value);
+    if (leaf.kind === 'literal_vec') {
+        return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`;
+    }
+    return `<${leaf.kind}>`;
+}
+export function comparisonOpText(op) {
+    switch (op) {
+        case 'lte':
+            return '<=';
+        case 'eq':
+            return '==';
+    }
+}