@crediolabs/policy-synth 0.2.0 → 0.3.1

package/dist/synth/synthesize-from-recording.d.ts

@@ -1,7 +1,5 @@
-import type { OzAdapterConfig } from '../adapters/oz/adapter.ts';
 import type { ToolError, ToolResponse } from '../errors.ts';
 import { type Network, type PredicateNode, type ProposedPolicy, type RecordedTransaction } from '../types.ts';
-import type { SimulationResult } from '../verify/envelope.ts';
 import { type ComposeUserResponses } from './compose-from-recording.ts';
 /** Per-policy interpreter adapter config the caller opts into. Absent ->
  *  recording path runs in week-1 mode (OZ adapter only, warnings for the
@@ -13,13 +11,6 @@ export interface InterpreterAdapterOptions {
     smartAccountAddress: string;
     /** Per-rule install nonce (first install = 1). Defaults to 1. */
     installNonce?: number;
-    /** Per-policy oracle overrides. Tighten-only vs the wasm defaults
-     *  (maxStalenessSeconds <= 600, maxDeviationBps <= 200); widening is
-     *  rejected at the options boundary. */
-    oracleParams?: {
-        maxStalenessSeconds?: number;
-        maxDeviationBps?: number;
-    };
 }
 /** PRIVATE test-only extension of `InterpreterAdapterOptions` for the
  *  `__testPredicateNode` seam. Exported under a `__` prefix so production
@@ -43,7 +34,7 @@ export interface SynthesizeFromRecordingOptions {
      *  never altered by enabling explain. Absent -> success envelope is byte-identical. */
     explain?: true;
 }
-export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: SynthesizeFromRecordingOptions, ozConfig: OzAdapterConfig): ToolResponse<ProposedPolicy> & {
+export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: SynthesizeFromRecordingOptions): ToolResponse<ProposedPolicy> & {
     /** Present iff `opts.explain === true` and the synthesis succeeded. The
      *  `predicateTree` is the exact in-memory `PredicateNode` (canonical
      *  JSON shape) that was encoded into `proposed.policyDocuments[*].encodedPredicate`
@@ -56,28 +47,9 @@ export declare function synthesizeFromRecording(tx: RecordedTransaction, opts: S
      *  builds a minimal honest SimulationResult downstream. */
     explain?: {
         predicateTree: PredicateNode | null;
-        simulation: SimulationResult;
     };
 };
 /** ToolError-shaped error helper used by the body to surface a structured
  *  failure that the envelope converts to `{ok:false, error}`. */
 declare function throwToolError(code: ToolError['code'], message: string): never;
 export { throwToolError };
-/** Diagnostic reported by `visitOracleLeaves` when an oracle comparison
- *  cannot be normalised to oracle-on-left. Currently only "oracle-on-right
- *  with a non-literal LHS" - the other branches already produce a parseable
- *  threshold and are returned to the caller. */
-export interface OracleNormalisationWarning {
-    /** The dimension name (currently always "oracle_normalisation_dropped"). */
-    dimension: 'oracle_normalisation_dropped';
-    /** The operator as written. */
-    op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte';
-    /** The asset the oracle leaf is bound to. */
-    asset: string;
-    /** The non-literal RHS (oracle-on-left) or LHS (oracle-on-right) leaf
-     *  whose shape stopped the normalisation. Surfaced for diagnostics;
-     *  intentionally a partial view - the full leaf is the caller's job. */
-    otherKind: string;
-    /** Human-readable message (matches the warn-on-drop text). */
-    message: string;
-}

package/dist/synth/synthesize-from-recording.js

@@ -1,30 +1,25 @@
 // src/synth/synthesize-from-recording.ts - recording-path orchestrator.
 //
 // `synthesizeFromRecording` INFERS a bounded policy from a `RecordedTransaction`
-// via the same `PolicyIR` + adapter pair used by the deterministic Mandate path.
+// via the `PolicyIR` + interpreter adapter pair.
 // Flow: validate -> parseConfidence gate -> lower -> decideScope -> composeFromRecording
-// -> OZ compile -> (opt-in) interpreter compile + self-verify + minimise -> merge.
-// Same (tx, opts, ozConfig) -> byte-identical ProposedPolicy (no randomness, clock, globals).
-import { createInterpreterAdapter, lowerRuleToPredicate, PLACEHOLDER_INTERPRETER_ADDRESS, } from "../adapters/interpreter/adapter.js";
-import { createOzAdapter } from "../adapters/oz/adapter.js";
+// -> interpreter compile + self-verify.
+// Same (tx, opts) -> byte-identical ProposedPolicy (no randomness, clock, globals).
+import { compileInterpreterPolicy, lowerRuleToPredicate, PLACEHOLDER_INTERPRETER_ADDRESS, } from "../adapters/interpreter/adapter.js";
 import { encodePredicate } from "../predicate/encode.js";
-import { MAX_SCVAL_CLONE_DEPTH, OZ_LIMITS, SOROBAN_LIMITS, } from "../types.js";
+import { GRAMMAR_VERSION, OZ_LIMITS, SOROBAN_LIMITS, } from "../types.js";
 import { composeFromRecording, } from "./compose-from-recording.js";
-import { generateCases, ORIGINAL_DIMENSIONS } from "./deny-cases.js";
-import { evaluate } from "./evaluate.js";
-import { runHarness } from "./harness.js";
 import { lower } from "./lower.js";
-import { minimize } from "./minimize.js";
 import { decideScope } from "./scope.js";
-const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: ';
-export function synthesizeFromRecording(tx, opts, ozConfig) {
+const UNCOVERED_PREFIX = 'Not expressible as a predicate constraint: ';
+export function synthesizeFromRecording(tx, opts) {
     // Convert any ToolError-shaped throw (object with a string `.code`) to a
     // structured `{ok:false, error}`; anything else is rethrown so genuine bugs
     // crash instead of being silently swallowed. Wraps the entire body so
-    // cap errors (PREDICATE_TOO_DEEP, TOO_MANY_LEAVES) and cloneScVal depth
+    // cap errors (PREDICATE_TOO_DEEP, TOO_MANY_LEAVES) and encoder depth
     // throws surface as structured ToolErrors rather than RangeErrors.
     try {
-        return synthesizeFromRecordingInner(tx, opts, ozConfig);
+        return synthesizeFromRecordingInner(tx, opts);
     }
     catch (e) {
         if (isToolErrorShape(e)) {
@@ -60,7 +55,7 @@ function throwToolError(code, message) {
     err.retryable = false;
     throw err;
 }
-function synthesizeFromRecordingInner(tx, opts, ozConfig) {
+function synthesizeFromRecordingInner(tx, opts) {
     // 0. validate inputs (fail closed - never synthesize from garbage).
     const invalid = validateOptions(opts);
     if (invalid)
@@ -152,7 +147,6 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
     const topLevel = tx.invocations[0] ?? null;
     const composeOpts = {
         network: opts.network,
-        interpreterEnabled: opts.interpreter !== undefined,
         ...(opts.userResponses !== undefined ? { userResponses: opts.userResponses } : {}),
     };
     const composed = composeFromRecording(facts, scope.contract, topLevel, composeOpts);
@@ -160,37 +154,17 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
     // self-verify verdict (built from the SAME runHarness + evaluate that gated
     // the synthesis, not a parallel simulation).
     let explain = null;
-    let explainSim = null;
-    // 5. OZ compile (always runs).
-    const ozAdapter = createOzAdapter(ozConfig);
-    const compileRes = ozAdapter.compile(composed.ir);
-    if (!compileRes.proposed) {
-        return {
-            ok: false,
-            error: {
-                code: 'SYNTHESIS_ERROR',
-                message: `recording lowered to no installable OZ policy: ${compileRes.uncovered.join('; ')}`,
-                severity: 'error',
-                retryable: false,
-                details: { uncovered: compileRes.uncovered },
-            },
-        };
-    }
     // 6. Interpreter compile (opt-in; fail-closed when the user routed real
     //    restrictions to the interpreter).
     const interpreterOpts = opts.interpreter;
     let interpreterPolicyDocument = null;
     let interpreterPolicyRef = null;
-    // Cross-layer L3: declared OUTSIDE the `if (interpreterOpts)` block so the
-    // warnings folded into `proposed.warnings[]` (which lives after that block)
-    // can read it. The block assigns it; the default is empty.
-    let permitCtxWarnings = [];
+    let interpreterContextRule = null;
     if (interpreterOpts) {
         const interpreterConfig = {
             network: opts.network,
             installNonce: interpreterOpts.installNonce ?? 1,
             smartAccountAddress: interpreterOpts.smartAccountAddress,
-            ...(interpreterOpts.oracleParams ? { oracleParams: interpreterOpts.oracleParams } : {}),
         };
         let startingPredicate = null;
         // `__testPredicateNode` is a test-only seam. It is NOT in the public
@@ -207,23 +181,19 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
             startingPredicate = testSeam;
         }
         else {
-            const interpreterAdapter = createInterpreterAdapter(interpreterConfig);
             let interpreterRes;
             try {
-                interpreterRes = interpreterAdapter.compile(composed.interpreterIr);
+                interpreterRes = compileInterpreterPolicy(composed.interpreterRule, interpreterConfig);
             }
             catch (e) {
                 const code = e.code;
                 const allowedCodes = [
                     'SCOPE_SELF_CALL',
-                    'ORACLE_LEAF_INVALID_POSITION',
-                    'ORACLE_PARAMS_OUT_OF_RANGE',
                     'MALFORMED_PREDICATE',
                     'PREDICATE_TOO_LARGE',
                     'PREDICATE_TOO_DEEP',
                     'TOO_MANY_LEAVES',
                     'IN_OPERAND_LIMIT',
-                    'PREDICATE_ORACLE_OVER_LIMIT',
                 ];
                 const surfacedCode = code && allowedCodes.includes(code) ? code : 'SYNTHESIS_ERROR';
                 return {
@@ -261,6 +231,7 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
             }
             interpreterPolicyDocument = interpreterRes.proposed.policyDocuments[0] ?? null;
             interpreterPolicyRef = interpreterRes.proposed.policyRefs[0] ?? null;
+            interpreterContextRule = interpreterRes.proposed.contextRule;
             if (!interpreterPolicyDocument || !interpreterPolicyRef) {
                 return {
                     ok: false,
@@ -272,7 +243,7 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
                     },
                 };
             }
-            const firstInterpreterRule = composed.interpreterIr.rules[0];
+            const firstInterpreterRule = composed.interpreterRule;
             if (!firstInterpreterRule) {
                 return {
                     ok: false,
@@ -297,7 +268,9 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
                 },
             };
         }
-        // 6b. Self-verify + minimise.
+        // 6b. The predicate is used as compiled. There is no minimisation pass:
+        //     nothing strips a leaf and re-checks that the reduced predicate still
+        //     denies, so the result is NOT a proven-minimal policy.
         if (!topLevel) {
             return {
                 ok: false,
@@ -320,81 +293,21 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
                 },
             };
         }
-        // Cross-layer L3: warnings collected from `buildPermitContext` (currently
-        // only the oracle-on-right normaliser) and folded into the proposed
-        // policy's `warnings[]` so the caller sees them on the success envelope.
-        const permitCtxResult = buildPermitContext(tx, scope, topLevel, opts.userResponses, startingPredicate);
-        const permitCtx = permitCtxResult.ctx;
-        permitCtxWarnings = permitCtxResult.warnings;
-        const finalPredicate = startingPredicate.op === 'and'
-            ? minimize(startingPredicate, permitCtx, ORIGINAL_DIMENSIONS)
-            : startingPredicate;
-        const harnessCases = generateCases(finalPredicate, permitCtx, ORIGINAL_DIMENSIONS);
-        const harnessResult = runHarness(finalPredicate, harnessCases);
-        if (!harnessResult.ok) {
-            return {
-                ok: false,
-                error: {
-                    code: 'DENY_CASE_FAILURE',
-                    message: `self-verify harness failed for the interpreter predicate (${harnessResult.failures.length} failure(s))`,
-                    severity: 'error',
-                    retryable: false,
-                    details: { failures: harnessResult.failures },
-                },
-            };
-        }
-        const evalResult = evaluate(finalPredicate, permitCtx);
-        if (!evalResult.permit) {
-            return {
-                ok: false,
-                error: {
-                    code: 'DENY_CASE_FAILURE',
-                    message: `intended recorded call was denied by the interpreter predicate: ${evalResult.reason}`,
-                    severity: 'error',
-                    retryable: false,
-                    details: { reason: evalResult.reason },
-                },
-            };
-        }
-        // --explain capture: quote the SAME verdict that gated the synthesis.
-        // Re-evaluate each deny case to surface its concrete reason (the harness
-        // only records whether the got-matches-expected boundary held).
+        const finalPredicate = startingPredicate;
         if (opts.explain) {
             explain = finalPredicate;
-            const evaluatedCases = [
-                {
-                    dimension: 'permit',
-                    outcome: evalResult.permit ? 'permit' : 'deny',
-                    reason: 'matches recorded call',
-                },
-            ];
-            for (const deny of harnessCases.denies) {
-                const r = evaluate(finalPredicate, deny.ctx);
-                evaluatedCases.push({
-                    dimension: deny.dimension,
-                    outcome: r.permit ? 'permit' : 'deny',
-                    reason: r.permit ? 'no matching deny' : r.reason,
-                });
-            }
-            explainSim = {
-                permit: { tx: 'permit' },
-                evaluatedCases,
-                backend: 'ts-model',
-                simulatorVersion: 'ts-model-1.0.0',
-            };
         }
-        // 6c. Re-encode the (possibly minimised) PredicateNode and stamp the
-        //     canonical bytes back onto the PolicyDocument + PolicyRef. Cap breaches
+        // 6c. Encode the PredicateNode and stamp the canonical bytes back onto
+        //     the PolicyDocument + PolicyRef. Cap breaches
         //     (PREDICATE_TOO_DEEP, TOO_MANY_LEAVES) throw ToolError-shaped errors;
         //     the outer envelope converts them to structured `{ok:false, error}`.
         const { encodedPredicate, predicateHash } = encodePredicate(finalPredicate);
         if (testSeam !== undefined) {
             interpreterPolicyDocument = {
-                grammarVersion: 1,
+                grammarVersion: GRAMMAR_VERSION,
                 installNonce: interpreterOpts.installNonce ?? 1,
                 encodedPredicate,
                 predicateHash,
-                ...(interpreterOpts.oracleParams ? { oracleParams: interpreterOpts.oracleParams } : {}),
             };
             interpreterPolicyRef = {
                 kind: 'interpreter',
@@ -427,20 +340,23 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
             }
         }
     }
-    // When the interpreter succeeds, OZ-side `uncovered` warnings that the
-    // interpreter actually lowered are misleading: OZ really did not lower them,
-    // but the interpreter did. Drop those so the user-facing warnings reflect
-    // what is still UN-enforced, not what OZ alone could not do.
-    const ozUncovered = interpreterPolicyRef
-        ? compileRes.uncovered.filter((u) => !INTERPRETER_COVERED_OZ_PATTERN.test(u))
-        : compileRes.uncovered;
-    // 7. Merge into the OZ-shaped ProposedPolicy.
-    const ozRefs = compileRes.proposed.policyRefs;
-    const mergedRefs = [];
-    if (interpreterPolicyRef)
-        mergedRefs.push(interpreterPolicyRef);
-    for (const r of ozRefs)
-        mergedRefs.push(r);
+    // 7. Assemble the ProposedPolicy. The interpreter is the only backend, so
+    //    its context rule and policy ref are the whole policy. Without interpreter
+    //    options nothing installable was produced, which is an error rather than
+    //    an empty-but-successful policy.
+    if (!interpreterContextRule || !interpreterPolicyRef) {
+        return {
+            ok: false,
+            error: {
+                code: 'SYNTHESIS_ERROR',
+                message: 'no installable policy was synthesised: supply `interpreter` options (a smart account address) so the recording can be lowered to an interpreter predicate',
+                severity: 'error',
+                retryable: false,
+                details: { uncovered: composed.warnings },
+            },
+        };
+    }
+    const mergedRefs = [interpreterPolicyRef];
     if (mergedRefs.length > OZ_LIMITS.maxPoliciesPerRule) {
         return {
             ok: false,
@@ -453,7 +369,7 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
         };
     }
     const mergedContextRule = {
-        ...compileRes.proposed.contextRule,
+        ...interpreterContextRule,
         policies: mergedRefs,
     };
     // When nothing installable was synthesised (no interpreter doc AND no OZ
@@ -470,12 +386,7 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
         policyDocuments: interpreterPolicyDocument ? [interpreterPolicyDocument] : [],
         policyRefs: mergedRefs,
         parseConfidence: { ...tx.parseConfidence },
-        warnings: [
-            ...zeroPolicyWarning,
-            ...ozUncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
-            ...composed.warnings.map((w) => `${UNCOVERED_PREFIX}${w}`),
-            ...permitCtxWarnings,
-        ],
+        warnings: [...zeroPolicyWarning, ...composed.warnings.map((w) => `${UNCOVERED_PREFIX}${w}`)],
         ambiguities: mergeAmbiguities(composed.ambiguities, scope.ambiguities),
     };
     // --explain success envelope. When opts.explain is set and the OZ-only
@@ -484,41 +395,11 @@ function synthesizeFromRecordingInner(tx, opts, ozConfig) {
     // permit is deny with a truthful reason and evaluatedCases is empty.
     const envelope = { ok: true, data: proposed };
     if (opts.explain) {
-        if (explainSim) {
-            envelope.explain = { predicateTree: explain, simulation: explainSim };
-        }
-        else {
-            envelope.explain = {
-                predicateTree: null,
-                simulation: {
-                    permit: {
-                        tx: 'deny',
-                        reason: 'No self-verification was performed (interpreter adapter was not engaged)',
-                    },
-                    evaluatedCases: [],
-                    backend: 'ts-model',
-                    simulatorVersion: 'not-run',
-                },
-            };
-        }
+        envelope.explain = { predicateTree: explain };
     }
     return envelope;
 }
 export { throwToolError };
-/** OZ-side `uncovered` warning patterns the interpreter adapter actually lowers
- *  when wired in. When the interpreter adapter succeeds, matching entries are
- *  dropped from the OZ uncovered list so user-facing warnings reflect what is
- *  still UN-enforced rather than what OZ alone could not do. Matches the
- *  exact descriptor strings the OZ adapter emits (see `src/adapters/oz/adapter.ts`
- *  `describeCondition` / `describeSelector`). */
-const INTERPRETER_COVERED_OZ_PATTERN = /^per-method scoping to|^value allowlist on arg|^exact ordered sequence on arg|^oracle price condition on|^invocation-count window|^spending_limit on token .+ needs a CallContract context scoped to that token/;
-/** Reject non-sane inputs before any policy is synthesized. windowSeconds /
- *  validUntilLedger / invocationLimit must be positive integers; limitAmount a
- *  positive i128 decimal string; network mainnet|testnet. When the interpreter
- *  adapter is opted in, `smartAccountAddress` must be a C... contract address
- *  (the on-chain policy-bound account, NOT the G... source account),
- *  `installNonce` must fit u32 (default 1), and `oracleParams` must
- *  tighten-only vs the wasm defaults. */
 function validateOptions(opts) {
     if (opts.network !== 'mainnet' && opts.network !== 'testnet') {
         return synthesisError(`network must be 'mainnet' or 'testnet', got: ${String(opts.network)}`);
@@ -531,16 +412,10 @@ function validateOptions(opts) {
     }
     const ur = opts.userResponses;
     if (ur) {
-        if (ur.windowSeconds !== undefined && !isPositiveInt(ur.windowSeconds)) {
-            return synthesisError(`windowSeconds must be a positive integer, got: ${ur.windowSeconds}`);
-        }
         if (ur.validUntilLedger !== undefined &&
             (!isPositiveInt(ur.validUntilLedger) || ur.validUntilLedger > SOROBAN_LIMITS.u32Max)) {
             return synthesisError(`validUntilLedger must be a positive u32 ledger sequence (<= ${SOROBAN_LIMITS.u32Max}), got: ${ur.validUntilLedger}`);
         }
-        if (ur.invocationLimit !== undefined && !isPositiveInt(ur.invocationLimit)) {
-            return synthesisError(`invocationLimit must be a positive integer, got: ${ur.invocationLimit}`);
-        }
         if (ur.limitAmount !== undefined && !isPositiveI128(ur.limitAmount)) {
             return synthesisError(`limitAmount must be a positive i128 decimal string within [1, ${I128_MAX}] (2^127-1), got: ${ur.limitAmount}`);
         }
@@ -564,19 +439,6 @@ function validateOptions(opts) {
         if (nonce !== undefined && (!isPositiveInt(nonce) || nonce > SOROBAN_LIMITS.u32Max)) {
             return synthesisError(`interpreter.installNonce must be a positive u32 integer (<= ${SOROBAN_LIMITS.u32Max}), got: ${nonce}`);
         }
-        const op = opts.interpreter.oracleParams;
-        if (op) {
-            const MAX_STALE = 600;
-            const MAX_DEV = 200;
-            if (op.maxStalenessSeconds !== undefined &&
-                (!isPositiveInt(op.maxStalenessSeconds) || op.maxStalenessSeconds > MAX_STALE)) {
-                return synthesisError(`interpreter.oracleParams.maxStalenessSeconds must be a positive integer <= ${MAX_STALE} (tighten-only), got: ${op.maxStalenessSeconds}`);
-            }
-            if (op.maxDeviationBps !== undefined &&
-                (!isPositiveInt(op.maxDeviationBps) || op.maxDeviationBps > MAX_DEV)) {
-                return synthesisError(`interpreter.oracleParams.maxDeviationBps must be a positive integer <= ${MAX_DEV} (tighten-only), got: ${op.maxDeviationBps}`);
-            }
-        }
     }
     return null;
 }
@@ -630,180 +492,3 @@ function mergeAmbiguities(...lists) {
     }
     return out;
 }
-/** Build the permit `EvalContext` the self-verify harness drives. Shape
- *  mirrors the intended recorded call so:
- *    - `evaluate(predicate, ctx).permit === true` must hold (a failure
- *      surfaces as DENY_CASE_FAILURE).
- *    - `generateCases(predicate, ctx)` produces a deny battery that reflects
- *      the actual recorded move (real amount, args, window start).
- *  Amounts are summed per-token over all movements (BigInt, never lossy).
- *  `oraclePriceByAsset` contains a price+timestamp satisfying each
- *  `oracle_price` leaf so the intended call permits under every bound;
- *  the harness mutates those entries (stale / missing / deviation / paused)
- *  to exercise the ORACLE_* deny paths. */
-function buildPermitContext(tx, scope, topLevel, userResponses, predicate) {
-    const amountByToken = {};
-    const totals = new Map();
-    for (const m of tx.tokenMovements) {
-        const current = totals.get(m.token) ?? 0n;
-        totals.set(m.token, current + BigInt(m.amount));
-    }
-    for (const [token, total] of totals) {
-        amountByToken[token] = total.toString();
-    }
-    const warnings = [];
-    const oraclePriceByAsset = oracleSatisfyingPrices(predicate, tx.fetchedAt, warnings);
-    const ctx = {
-        contract: scope.contract,
-        fn: topLevel.fn,
-        args: topLevel.args.map(cloneScVal),
-        atLedger: tx.ledgerSequence,
-        nowSeconds: tx.fetchedAt,
-        amountByToken,
-        windowSpentByToken: {},
-        invocationCountByWindow: {},
-        oraclePriceByAsset,
-    };
-    if (userResponses?.validUntilLedger !== undefined) {
-        ctx.validUntilLedger = userResponses.validUntilLedger;
-    }
-    return { ctx, warnings };
-}
-function cloneScVal(value, depth = 0) {
-    // Clone top-level shells so the harness can mutate deny cases without
-    // aliasing the recorded call. Recursion bounded by MAX_SCVAL_CLONE_DEPTH so
-    // a hand-crafted nested-vec cannot RangeError the JS stack; the over-depth
-    // branch throws a ToolError-shaped error the envelope converts to
-    // `{ok:false, error}`.
-    if (value.type === 'vec') {
-        if (depth >= MAX_SCVAL_CLONE_DEPTH) {
-            throw cloneDepthError(value);
-        }
-        return {
-            type: 'vec',
-            value: value.value.map((v) => cloneScVal(v, depth + 1)),
-        };
-    }
-    return { ...value };
-}
-function cloneDepthError(value) {
-    const err = new Error(`ScVal clone depth exceeds MAX_SCVAL_CLONE_DEPTH (${MAX_SCVAL_CLONE_DEPTH})`);
-    err.code = 'SYNTHESIS_ERROR';
-    err.severity = 'error';
-    err.retryable = false;
-    err.depthContext = value.type;
-    throw err;
-}
-/** Walk every `oracle_price` leaf and return a price map whose entries satisfy
- *  the bound. Timestamp pinned to `nowSeconds` (the recorded `fetchedAt`) so
- *  the fresh-oracle deny case in `generateCases` is the only path that flips
- *  this map. Negatives clamped at 0 - oracle prices are non-negative on Stellar. */
-function oracleSatisfyingPrices(predicate, nowSeconds, warnings) {
-    const out = {};
-    visitOracleLeaves(predicate, (asset, op, bound) => {
-        let price;
-        switch (op) {
-            case 'lt':
-            case 'gt':
-                price = op === 'lt' ? bound - 1n : bound + 1n;
-                break;
-            case 'lte':
-            case 'gte':
-            case 'eq':
-                price = bound;
-                break;
-        }
-        if (price < 0n)
-            price = 0n;
-        out[asset] = { price: price.toString(), timestampSeconds: nowSeconds };
-    }, (warning) => {
-        // Cross-layer L3: oracle-on-right that cannot be normalised is
-        // surfaced as a warning, not silently dropped. The Rust interpreter
-        // would surface this as `UnsupportedNode`; the warning lets the
-        // caller decide whether to fix the predicate shape or accept the
-        // over-permissive hole.
-        warnings.push(warning.message);
-    });
-    return out;
-}
-function visitOracleLeaves(node, visit, onWarning) {
-    switch (node.op) {
-        case 'and':
-        case 'or':
-            for (const child of node.children)
-                visitOracleLeaves(child, visit, onWarning);
-            return;
-        case 'not':
-            visitOracleLeaves(node.child, visit, onWarning);
-            return;
-        case 'eq':
-        case 'lt':
-        case 'lte':
-        case 'gt':
-        case 'gte': {
-            const leftLeaf = node.left;
-            const rightLeaf = node.right;
-            const leftIsOracle = leftLeaf.kind === 'oracle_price';
-            const rightIsOracle = rightLeaf.kind === 'oracle_price';
-            let oracleAsset;
-            let literal;
-            if (leftIsOracle) {
-                oracleAsset = leftLeaf.asset;
-                literal = oracleLiteralFromLeaf(rightLeaf);
-            }
-            else if (rightIsOracle) {
-                oracleAsset = rightLeaf.asset;
-                literal = oracleLiteralFromLeaf(leftLeaf);
-            }
-            if (oracleAsset === undefined || literal === undefined) {
-                // Two reasons the case cannot be normalised:
-                //   - neither side is an oracle leaf (visitor has nothing to do)
-                //   - oracle-on-right with a non-literal LHS (Rust dispatch would
-                //     hit UnsupportedNode; the TS model cannot build a permit ctx
-                //     for it)
-                // Only the second is a meaningful warning; the first is a no-op
-                // (the visitor was called for a non-oracle comparison). Emit the
-                // warning when an oracle IS present on one side but the other
-                // side is not a parseable threshold literal.
-                if (rightIsOracle) {
-                    onWarning?.({
-                        dimension: 'oracle_normalisation_dropped',
-                        op: node.op,
-                        asset: rightLeaf.kind === 'oracle_price' ? rightLeaf.asset : '',
-                        otherKind: leftLeaf.kind,
-                        message: `oracle-on-right cannot be normalised: the LHS (kind=${leftLeaf.kind}) is not an oracle_threshold literal; the Rust interpreter would surface UnsupportedNode here`,
-                    });
-                }
-                return;
-            }
-            visit(oracleAsset, node.op, literal);
-            return;
-        }
-        case 'in':
-            // `in` is pure membership; oracle leaves inside haystacks are
-            // forbidden by the position rule, so there's nothing to set up here.
-            return;
-    }
-}
-/** Restate an oracle threshold on the normalised 9-dp basis prices use.
- *  Thresholds carry their own basis, so reading the digits raw would build
- *  a permit context off by 10^(decimals-9) and the intended call would not
- *  satisfy its own bound. Mirrors NORMALISED_DECIMALS in oracle.rs. */
-function oracleLiteralFromLeaf(leaf) {
-    if (leaf.kind !== 'oracle_threshold')
-        return undefined;
-    let value;
-    try {
-        value = BigInt(leaf.value);
-    }
-    catch {
-        return undefined;
-    }
-    const normalised = 9n;
-    const decimals = BigInt(leaf.decimals);
-    if (decimals <= normalised)
-        return value * 10n ** (normalised - decimals);
-    // Floor: a finer-grained threshold has no exact 9-dp representation; the
-    // caller offsets by one from here to land on the right side of the bound.
-    return value / 10n ** (decimals - normalised);
-}