@crediolabs/policy-synth 0.2.0 → 0.3.1

package/dist/types.d.ts

@@ -77,13 +77,11 @@ export declare const MAX_SCVAL_CLONE_DEPTH: 30;
  *    - MAX_DEPTH = 5:             3 walkthroughs need depth 2; budget = 2x growth + 1 for `not` chain.
  *    - MAX_LEAVES = 200:         allowlists (recipients, paths) typically < 100; budget = 2x + 1 nested allowlist.
  *    - MAX_PREDICATE_BYTES = 32 KB: well under the per-ledger-entry 64 KB persistent-storage limit.
- *    - MAX_ORACLE_READS = 6:     two-round confirmation per asset consumes 2 reads; cap accommodates a predicate that references up to 3 unique oracle assets (3 * 2 = 6 reads). Stays a fail-closed install-time cap.
  *    - MAX_IN_OPERAND_COUNT = 32: allowlist < 32 is a UX-natural bound. */
 export declare const PREDICATE_CAPS: {
     readonly MAX_DEPTH: 5;
     readonly MAX_LEAVES: 200;
     readonly MAX_PREDICATE_BYTES: number;
-    readonly MAX_ORACLE_READS: 6;
     readonly MAX_IN_OPERAND_COUNT: 32;
 };
 /** OZ context-rule draft - the unit the install builder builds add_context_rule from. */
@@ -118,19 +116,20 @@ export type SignerDraft = {
 };
 /** Reference to one policy attached to a context rule. */
 export type PolicyRef = {
-    kind: 'oz_builtin';
-    primitive: OZPrimitiveConfig;
-    instanceAddress: string;
-} | {
     kind: 'interpreter';
     interpreterAddress: string;
     predicateBlobBase64: string;
 };
+/** Grammar version baked into the interpreter wasm, mirroring `SELF_VERSION` in
+ *  `contracts/policy-interpreter/src/version.rs`. Every value this package puts on
+ *  the wire derives from here; `grammar-version-parity.test.ts` pins it to the
+ *  contract so a skew cannot pass a green test run. */
+export declare const GRAMMAR_VERSION: 3;
 /** A serialised predicate document stored against a (smart_account, rule_id) pair. */
 export interface PolicyDocument {
     /** Grammar version baked into the interpreter wasm. Fail-closed strict match at install
      *  AND at evaluate (defence in depth). NOT the per-edit revision. */
-    grammarVersion: 1;
+    grammarVersion: typeof GRAMMAR_VERSION;
     /** Per-rule install nonce. Must equal the interpreter's stored nonce + 1 at install.
      *  First install accepts nonce = 1 with stored nonce = 0. Re-install is structurally
      *  possible by incrementing the nonce; uninstall removes the nonce with state so a
@@ -142,32 +141,17 @@ export interface PolicyDocument {
     /** Hash of the post-canonicalisation bytes of encodedPredicate. Stored alongside the
      *  doc and re-verified at evaluate. */
     predicateHash: string;
-    /** Per-policy overrides of oracle thresholds; absent = use defaults.
-     *  Overrides may TIGHTEN only (never widen) - the interpreter rejects any per-policy
-     *  value looser than the wasm-level defaults at install. */
-    oracleParams?: {
-        /** Seconds; must be <= MAX_ORACLE_STALENESS_SECONDS (600). */
-        maxStalenessSeconds?: number;
-        /** Basis points; must be <= MAX_ORACLE_DEVIATION_BPS (200). */
-        maxDeviationBps?: number;
-    };
 }
 /** The versioned predicate AST (interpreter side). Tagged union. */
 export type PredicateNode = {
     op: 'and';
     children: PredicateNode[];
-} | {
-    op: 'or';
-    children: PredicateNode[];
-} | {
-    op: 'not';
-    child: PredicateNode;
 } | {
     op: 'eq';
     left: PredicateLeaf;
     right: PredicateLeaf;
 } | {
-    op: 'lt' | 'lte' | 'gt' | 'gte';
+    op: 'lte';
     left: PredicateLeaf;
     right: PredicateLeaf;
 } | {
@@ -190,32 +174,6 @@ export type PredicateLeaf = {
     index: number;
     element: number;
     field: string;
-} | {
-    kind: 'call_arg_scaled';
-    index: number;
-    num: string;
-    den: string;
-} | {
-    kind: 'amount';
-    token: string;
-} | {
-    kind: 'window_spent';
-    token: string;
-    windowSeconds: number;
-} | {
-    kind: 'now';
-} | {
-    kind: 'valid_until';
-} | {
-    kind: 'invocation_count_in_window';
-    windowSecs: number;
-} | {
-    kind: 'oracle_price';
-    asset: string;
-} | {
-    kind: 'oracle_threshold';
-    value: string;
-    decimals: number;
 } | {
     kind: 'literal_address';
     value: string;
@@ -228,20 +186,10 @@ export type PredicateLeaf = {
 } | {
     kind: 'literal_u32';
     value: number;
-} | {
-    kind: 'literal_u64';
-    value: string;
-} | {
-    kind: 'literal_bytes';
-    value: string;
 } | {
     kind: 'literal_vec';
     elements: PredicateLeaf[];
 };
-export interface OZPrimitiveConfig {
-    primitive: 'spending_limit' | 'simple_threshold' | 'weighted_threshold';
-    params: Record<string, unknown>;
-}
 export interface ContractInvocation {
     contract: string;
     fn: string;
@@ -297,7 +245,7 @@ export interface AmbiguityPrompt {
 /** Catalogue of named ambiguity codes (the skill's prompt files are one-per-code).
  *  Adding a code is a synthesizer decision; the prompt authoring must not
  *  invent codes outside this union. */
-export type AmbiguityCode = 'DURATION_UNSPECIFIED' | 'AMOUNT_BOUND_MISSING' | 'RECIPIENT_ALLOWLIST_EMPTY' | 'FREQUENCY_BOUND_MISSING' | 'ORACLE_ASSET_UNKNOWN' | 'MULTIPLE_UNRELATED_TARGETS';
+export type AmbiguityCode = 'DURATION_UNSPECIFIED' | 'AMOUNT_BOUND_MISSING' | 'RECIPIENT_ALLOWLIST_EMPTY' | 'FREQUENCY_BOUND_MISSING' | 'MULTIPLE_UNRELATED_TARGETS';
 /** Structured recording freshness. `overall` is the gate threshold (default 1.0); the
  *  breakdown is the diagnostic the user / agent sees when the gate fires. The
  *  computation rule is pinned: `overall = 1 - (unknownContracts + opaqueScVals) / total`.

package/dist/types.js

@@ -41,12 +41,15 @@ export const MAX_SCVAL_CLONE_DEPTH = 30;
  *    - MAX_DEPTH = 5:             3 walkthroughs need depth 2; budget = 2x growth + 1 for `not` chain.
  *    - MAX_LEAVES = 200:         allowlists (recipients, paths) typically < 100; budget = 2x + 1 nested allowlist.
  *    - MAX_PREDICATE_BYTES = 32 KB: well under the per-ledger-entry 64 KB persistent-storage limit.
- *    - MAX_ORACLE_READS = 6:     two-round confirmation per asset consumes 2 reads; cap accommodates a predicate that references up to 3 unique oracle assets (3 * 2 = 6 reads). Stays a fail-closed install-time cap.
  *    - MAX_IN_OPERAND_COUNT = 32: allowlist < 32 is a UX-natural bound. */
 export const PREDICATE_CAPS = {
     MAX_DEPTH: 5,
     MAX_LEAVES: 200,
     MAX_PREDICATE_BYTES: 32 * 1024,
-    MAX_ORACLE_READS: 6,
     MAX_IN_OPERAND_COUNT: 32,
 };
+/** Grammar version baked into the interpreter wasm, mirroring `SELF_VERSION` in
+ *  `contracts/policy-interpreter/src/version.rs`. Every value this package puts on
+ *  the wire derives from here; `grammar-version-parity.test.ts` pins it to the
+ *  contract so a skew cannot pass a green test run. */
+export const GRAMMAR_VERSION = 3;

package/dist-cjs/adapters/interpreter/adapter.d.ts

@@ -1,15 +1,8 @@
-import type { IRPolicyRule } from '../../ir/types.ts';
-import type { CustodyAdapter } from '../../seams/types.ts';
-import type { Network, PredicateNode } from '../../types.ts';
+import type { ComposedRule } from '../../synth/compose-from-recording.ts';
+import { type Network, type PredicateNode, type ProposedPolicy } from '../../types.ts';
 /** [VERIFY] NOT a real deployed address. The interpreter is a per-network
  *  deploy artifact we do not have yet; install is a later phase. */
 export declare const PLACEHOLDER_INTERPRETER_ADDRESS = "VERIFY-interpreter-address";
-/** Wasm-level oracle defaults (mirrors the interpreter's `OracleParams`).
- *  Per-policy overrides may TIGHTEN only - they may never exceed these. */
-export declare const ORACLE_DEFAULTS: {
-    readonly maxStalenessSeconds: 600;
-    readonly maxDeviationBps: 200;
-};
 export interface InterpreterAdapterConfig {
     network: Network;
     /** Per-rule install nonce (first install = 1; replay-protected). */
@@ -18,20 +11,21 @@ export interface InterpreterAdapterConfig {
      *  by the self-call gate: any `in`-allowlist containing this address is
      *  rejected as `SCOPE_SELF_CALL`. */
     smartAccountAddress: string;
-    /** Optional per-policy oracle overrides. Must TIGHTEN vs ORACLE_DEFAULTS
-     *  (i.e. <= each default). A widening value throws ORACLE_PARAMS_OUT_OF_RANGE
-     *  at compile time. */
-    oracleParams?: {
-        maxStalenessSeconds?: number;
-        maxDeviationBps?: number;
-    };
 }
-export declare function createInterpreterAdapter(config: InterpreterAdapterConfig): CustodyAdapter;
-/** Lower a single IR rule to the canonical pre-encoding `PredicateNode`. The
- *  orchestrator uses this to wire the self-verify + minimise pipeline: after
- *  `compile(ir)` succeeds it re-derives the PredicateNode via this helper to
- *  drive `minimize` and `runHarness` on the SAME shape the encoder saw. Pure
- *  and deterministic: same `rule + config` -> byte-identical PredicateNode.
- *  The `uncovered` list is NOT re-derived - callers needing it must use
- *  `compile(ir)`. */
-export declare function lowerRuleToPredicate(rule: IRPolicyRule, config: InterpreterAdapterConfig): PredicateNode;
+/** The result of compiling a PolicyIR for this backend. */
+export interface CompileResult {
+    /** false => some IR construct this backend cannot express (see `uncovered`). */
+    covered: boolean;
+    /** Human-readable list of unsupported constructs. */
+    uncovered: string[];
+    /** The installable policy, assembled when a rule lowered. */
+    proposed?: ProposedPolicy;
+}
+/** Lower a single rule to the canonical pre-encoding `PredicateNode`. The
+ *  orchestrator re-derives the PredicateNode through this helper so it holds the
+ *  SAME shape the encoder saw. Pure and deterministic: same `rule + config` ->
+ *  byte-identical PredicateNode. The `uncovered` list is NOT re-derived -
+ *  callers needing it must use `compileInterpreterPolicy(rule, config)`. */
+export declare function lowerRuleToPredicate(rule: ComposedRule, config: InterpreterAdapterConfig): PredicateNode;
+/** Compile a composed rule to an installable interpreter policy. */
+export declare function compileInterpreterPolicy(rule: ComposedRule, config: InterpreterAdapterConfig): CompileResult;