@crediolabs/policy-synth 0.2.0 → 0.3.1

package/dist-cjs/record/freshness.js

@@ -44,17 +44,23 @@ function isBelowThreshold(c) {
  *  under-confidence recording.
  *
  *  The remediation text branches on which diagnostic bucket is non-empty:
- *    - unknownContracts only -> user MUST supply an ABI (or re-capture
- *      against a known protocol version). The contract is real, the
- *      recorder just cannot decode it.
- *    - opaqueScVals only -> the recorder encountered a value shape it
- *      should support but did not decode. The user cannot supply an ABI
- *      to fix a decoder bug; the guidance explicitly says so and points at
- *      re-running after a tool upgrade / reporting the path.
- *    - both -> list both diagnostics AND chain the right remediation for
- *      each (the user supplies an ABI AND reports the decoder gap).
- *    - neither (the "denom === 0" path) -> unchanged from the pre-fix
- *      text; the user did not actually hit a code-level barrier. */
+ *    - unknownContracts only -> the contract is not in the compiled-in
+ *      registry. NOT "the contract has no interface": most Soroban
+ *      contracts publish a typed spec on chain, this package just never
+ *      reads one. The reason code stays `no-abi` because it is a published
+ *      enum value, so the TEXT has to carry the correction.
+ *    - opaqueScVals only -> the recorder met a value shape it should
+ *      support but did not decode. That is a decoder bug, and the guidance
+ *      says so rather than implying the caller can fix it.
+ *    - both -> list both diagnostics and chain the right remediation.
+ *    - neither (the "denom === 0" path) -> the caller did not actually hit
+ *      a code-level barrier.
+ *
+ *  Do NOT tell the caller to supply an ABI. There is no input for one:
+ *  recognition runs off the compiled-in registry plus a known-contract set
+ *  that no public tool boundary exposes. The old text named an action
+ *  nobody could take and sent users looking for a file they do not have and
+ *  would not need. */
 function buildLowConfidenceQuestion(c) {
     const hasUnknown = c.unknownContracts.length > 0;
     const hasOpaque = c.opaqueScVals.length > 0;
@@ -67,16 +73,20 @@ function buildLowConfidenceQuestion(c) {
     }
     const why = reasons.length === 0 ? 'no diagnostic reason available' : reasons.join('; ');
     const header = `Recording refused: parseConfidence ${c.overall.toFixed(3)} is below the threshold ${c.thresholdUsed.toFixed(3)}. Diagnostic: ${why}.`;
-    // The two remediation branches are explicit so the user (or the agent)
-    // can dispatch on the verb. The "unknown contract" branch is the only
-    // one that asks for an ABI; the "opaque ScVal" branch asks the user to
-    // report the path and re-run after a tool upgrade.
+    // The remediation branches are explicit so the user (or the agent) can
+    // dispatch on the verb. Neither branch asks for an ABI: there is no input
+    // that accepts one, and for the unknown-contract branch the contract's
+    // own spec is usually on chain already - it is this package that does not
+    // read it.
+    const unknownAdvice = `The contract is not in this package's built-in registry - "no-abi" means unrecognised here, not that the contract lacks an interface. ` +
+        `You cannot supply one: the registry is compiled in. Either build the policy without deriving it from this transaction, or re-capture against a protocol the registry covers. ` +
+        `Passing confidenceOverride accepts the recording as it stands, including the arguments this tool could not attribute - do that only if you have checked them yourself.`;
     if (hasUnknown && hasOpaque) {
-        return (`${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version; ` +
-            `also file the opaque ScVal path against the recorder (decoder limitation) and re-run record_transaction after a tool upgrade.`);
+        return (`${header} ${unknownAdvice} Separately, file the opaque ScVal path against the recorder (a decoder limitation) ` +
+            `and re-run record_transaction after a tool upgrade.`);
     }
     if (hasUnknown) {
-        return `${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version, then re-run record_transaction.`;
+        return `${header} ${unknownAdvice}`;
     }
     if (hasOpaque) {
         return `${header} This is a recorder decoder limitation (the value shape is supported in principle but not yet decoded) - the agent cannot fix it by supplying an ABI. Report the opaque ScVal path above against the recorder and re-run record_transaction after a tool upgrade.`;

package/dist-cjs/review-card/builder.d.ts

@@ -1,5 +1,4 @@
-import type { ContextRuleDraft, PolicyRef, PredicateNode } from '../types.ts';
-import type { SimulationResult } from '../verify/envelope.ts';
+import type { ContextRuleDraft, PredicateNode } from '../types.ts';
 export interface ReviewCardSummary {
     ruleName: string;
     plainEnglish: string;
@@ -17,7 +16,9 @@ export interface ReviewCardSummary {
 }
 /** Build a deterministic review-card summary from a policy + context rule +
  *  simulation result. Pure: same inputs -> byte-identical output. */
-export declare function buildReviewCardSummary(predicate: PredicateNode | null, policyRefs: PolicyRef[], contextRule: ContextRuleDraft, simulation: SimulationResult): ReviewCardSummary;
+export declare function buildReviewCardSummary(predicate: PredicateNode | null, contextRule: ContextRuleDraft, 
+/** Evaluator identity folded into the content hash. */
+backend: 'interpreter-v1' | 'ts-model'): ReviewCardSummary;
 /** Walk every comparison / membership node of the predicate and invoke
  *  `visit` on each. The walk is depth-first, left-to-right, so the
  *  constraint list is stable across runs. Pure boolean nodes contribute no

package/dist-cjs/review-card/builder.js

@@ -7,23 +7,13 @@
 // summary being REPRODUCIBLE + TESTABLE + NON-HALLUCINABLE, so this module is
 // pure: same inputs -> byte-identical output, no clock, no randomness, no I/O.
 //
-// The builder walks two inputs and emits ONE constraint string per leaf or
-// primitive, in a fixed deterministic order:
-//
-//   1. The OZ built-in `PolicyRef`s. Each `spending_limit` primitive becomes a
-//      `spending_limit(token, limitAmount, windowSecs)` line; other OZ
-//      primitives (threshold) are skipped - the review card does not quote
-//      them (they are signer-config concerns, not transactional bounds).
-//
-//   2. The interpreter `PredicateNode`. One string per constraint leaf,
-//      rendered by enclosing-comparison kind. Templates (Task 7b):
-//        - invocation_count_in_window < N     -> At most N calls per <window> seconds
-//        - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
-//        - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
-//        - oracle_price(asset) OP price       -> Only when oracle_price(asset) OP price
-//        - call_fn == x                       -> Function must be x
-//        - call_contract == c                 -> Contract must be c
-//        - amount <= v                        -> Amount <= v
+// The builder walks the interpreter `PredicateNode` and emits ONE constraint
+// string per leaf, in a fixed deterministic order. Templates (Task 7b):
+//   - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
+//   - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
+//   - call_fn == x                       -> Function must be x
+//   - call_contract == c                 -> Contract must be c
+//   - amount <= v                        -> Amount <= v
 //
 // The content hash is a stable sha256 hex of a canonical JSON of
 // { ruleName, plainEnglish, constraints, expiry, backend } - identical
@@ -33,15 +23,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildReviewCardSummary = buildReviewCardSummary;
 exports.describePredicate = describePredicate;
 const node_crypto_1 = require("node:crypto");
+const render_leaf_ts_1 = require("./render-leaf.js");
 /** Build a deterministic review-card summary from a policy + context rule +
  *  simulation result. Pure: same inputs -> byte-identical output. */
-function buildReviewCardSummary(predicate, policyRefs, contextRule, simulation) {
+function buildReviewCardSummary(predicate, contextRule, 
+/** Evaluator identity folded into the content hash. */
+backend) {
     const constraints = [];
-    for (const ref of policyRefs) {
-        const line = renderOzPrimitive(ref);
-        if (line !== null)
-            constraints.push(line);
-    }
     if (predicate !== null) {
         walkPredicate(predicate, (node) => {
             const line = renderConstraint(node);
@@ -59,7 +47,6 @@ function buildReviewCardSummary(predicate, policyRefs, contextRule, simulation)
     const signerNote = contextRule.signers.length >= 2
         ? 'any ONE signer may authorise a permitted op under this rule (OZ any-of-N semantic)'
         : null;
-    const backend = simulation.backend;
     const contentHash = computeContentHash({
         ruleName,
         plainEnglish,
@@ -70,25 +57,6 @@ function buildReviewCardSummary(predicate, policyRefs, contextRule, simulation)
     });
     return { ruleName, plainEnglish, constraints, expiry, signerNote, backend, contentHash };
 }
-/** Render the OZ built-in primitive summary line. Only `spending_limit` is
- *  quoted by the review card (it is the only primitive that defines a
- *  transactional bound). Other primitives (threshold) are signer-config
- *  concerns handled by the OZ adapter's own `uncovered` machinery.
- *  Spending_limit takes `period_ledgers` on-chain (~5s/ledger); the card
- *  states the window in seconds so the user reads it consistently with the
- *  interpreter templates. */
-function renderOzPrimitive(ref) {
-    if (ref.kind !== 'oz_builtin')
-        return null;
-    const primitive = ref.primitive;
-    if (primitive.primitive !== 'spending_limit')
-        return null;
-    const params = primitive.params;
-    const limit = params.spending_limit ?? '0';
-    const periodLedgers = params.period_ledgers ?? 0;
-    const windowSecs = periodLedgers * 5;
-    return `spending_limit(${limit}, ${windowSecs})`;
-}
 /** Walk every comparison / membership node of the predicate and invoke
  *  `visit` on each. The walk is depth-first, left-to-right, so the
  *  constraint list is stable across runs. Pure boolean nodes contribute no
@@ -113,21 +81,14 @@ function describePredicate(predicate) {
 function walkPredicate(node, visit) {
     switch (node.op) {
         case 'and':
-        case 'or':
             for (const child of node.children)
                 walkPredicate(child, visit);
             return;
-        case 'not':
-            walkPredicate(node.child, visit);
-            return;
         case 'in':
             visit(node);
             return;
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             visit(node);
             return;
     }
@@ -135,18 +96,13 @@ function walkPredicate(node, visit) {
 /** Render ONE constraint sentence for ONE interpreter predicate node. The
  *  shape of the output is pinned by Task 7b so the test suite can assert
  *  byte-for-byte equality. Returns `null` when the node is a structural
- *  boolean (`and` / `or` / `not`) - those are not constraint leaves. */
+ *  boolean (`and`) - that is not a constraint leaf. */
 function renderConstraint(node) {
     switch (node.op) {
         case 'and':
-        case 'or':
-        case 'not':
             return null;
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             return renderComparison(node);
         case 'in':
             return renderMembership(node);
@@ -165,7 +121,7 @@ function renderComparison(node) {
     }
     // eq(call_arg[i], literal_vec) -> Path must be exactly [list]
     if (left.kind === 'call_arg' && node.op === 'eq' && right.kind === 'literal_vec') {
-        return `Path must be exactly [${right.elements.map(renderVecElement).join(', ')}]`;
+        return `Path must be exactly [${right.elements.map(render_leaf_ts_1.renderVecElement).join(', ')}]`;
     }
     // eq(call_arg_len[i], literal_u32) -> Length of arg[i] is K
     // Binds the OUTER vec length so a caller cannot append an element to
@@ -176,73 +132,41 @@ function renderComparison(node) {
     }
     // eq/lte(call_arg_field[i, el, field], <literal>) -> arg[i] element[el].field = <value>
     // The structured-argument bind pins a scalar field inside a vec element.
-    // For lt/gt/lte/gte the line reads "OP <value>" so the comparison kind
-    // is visible; eq reads "= <value>".
+    // For lte the line reads "OP <value>" so the comparison kind is visible;
+    // eq reads "= <value>".
     if (left.kind === 'call_arg_field') {
         const head = `arg[${left.index}] element[${left.element}].${left.field}`;
-        const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
+        const sep = node.op === 'eq' ? '=' : (0, render_leaf_ts_1.comparisonOpText)(node.op);
         if (right.kind === 'literal_address')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_symbol')
             return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_bytes')
-            return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_u64')
-            return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_i128')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_u32')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_vec') {
-            return `${head} ${sep} [${right.elements.map(renderVecElement).join(', ')}]`;
+            return `${head} ${sep} [${right.elements.map(render_leaf_ts_1.renderVecElement).join(', ')}]`;
         }
     }
-    // The bound is compared against the calls ALREADY made in the window, so
-    // `< N` permits N of them and `<= N` permits one more. Report how many
-    // calls the rule allows rather than restating the comparison.
-    if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        const allowed = node.op === 'lt' ? right.value : right.value + 1;
-        return `At most ${allowed} calls per ${left.windowSecs} seconds`;
-    }
-    // OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>
-    //
-    // The per-call cap. It has to be here because the `amount` template below
-    // is unreachable for an interpreter policy: `amount` is deliberately not in
-    // the contract's grammar (dsl.rs - the interpreter sees one authorized
-    // call, not the transaction's token movements), so a predicate using it is
-    // refused at install. A bound on the call's own amount ARGUMENT is how a
-    // cap is actually written, and it was rendering nothing at all - the card
-    // silently understated the policy.
+    // The per-call cap: OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>.
+    // The interpreter is passed one authorized call, not the transaction's token
+    // movements, so a bound on the call's own amount ARGUMENT is how a cap is
+    // written.
     //
     // Placed after the literal_vec case above so an exact-sequence `eq` still
     // reads as a path rather than as a comparison.
     if (left.kind === 'call_arg') {
         const head = `arg[${left.index}]`;
-        const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
+        const sep = node.op === 'eq' ? '=' : (0, render_leaf_ts_1.comparisonOpText)(node.op);
         if (right.kind === 'literal_i128')
             return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_u64')
-            return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_u32')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_address')
             return `${head} ${sep} ${right.value}`;
         if (right.kind === 'literal_symbol')
             return `${head} ${sep} ${right.value}`;
-        if (right.kind === 'literal_bytes')
-            return `${head} ${sep} ${right.value}`;
-        // call_arg_scaled is the slippage floor and reads as itself.
-        if (right.kind === 'call_arg_scaled') {
-            return `${head} >= arg[${right.index}] * ${right.num}/${right.den}`;
-        }
-    }
-    // amount <= v -> Amount <= v
-    if (left.kind === 'amount' && right.kind === 'literal_i128') {
-        return `Amount <= ${right.value}`;
-    }
-    // oracle_price(asset) OP price -> Only when oracle_price(asset) OP price
-    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
-        return `Only when oracle_price(${left.asset}) ${comparisonOpText(node.op)} ${right.value} (${right.decimals} dp)`;
     }
     // Any other comparison shape is a structural fail-closed: do not surface
     // a misleading line. Cross-check still requires every leaf produce a
@@ -254,79 +178,11 @@ function renderComparison(node) {
 function renderMembership(node) {
     // call_arg[i] in [list] -> Recipient/arg must be one of [list]
     if (node.needle.kind === 'call_arg') {
-        const list = node.haystack.map(renderHaystackElement).join(', ');
+        const list = node.haystack.map(render_leaf_ts_1.renderHaystackElement).join(', ');
         return `Recipient/arg must be one of [${list}]`;
     }
     return null;
 }
-function renderVecElement(leaf) {
-    switch (leaf.kind) {
-        case 'literal_address':
-            return leaf.value;
-        case 'literal_i128':
-            return leaf.value;
-        case 'literal_symbol':
-            return leaf.value;
-        case 'literal_u32':
-            return String(leaf.value);
-        case 'literal_u64':
-            return leaf.value;
-        case 'literal_bytes':
-            return leaf.value;
-        case 'literal_vec':
-            return `[${leaf.elements.map(renderVecElement).join(', ')}]`;
-        case 'call_contract':
-        case 'call_fn':
-        case 'call_arg':
-        case 'call_arg_len':
-        case 'call_arg_field':
-        case 'call_arg_scaled':
-        case 'amount':
-        case 'window_spent':
-        case 'now':
-        case 'valid_until':
-        case 'invocation_count_in_window':
-        case 'oracle_price':
-            return `<${leaf.kind}>`;
-        // Show the declared basis, not just the digits. A threshold on the wrong
-        // basis is the one policy error the contract cannot detect, so the review
-        // card is where a human has to be able to see it.
-        case 'oracle_threshold':
-            return `${leaf.value} (${leaf.decimals} dp)`;
-    }
-}
-function renderHaystackElement(leaf) {
-    if (leaf.kind === 'literal_address')
-        return leaf.value;
-    if (leaf.kind === 'literal_i128')
-        return leaf.value;
-    if (leaf.kind === 'literal_symbol')
-        return leaf.value;
-    if (leaf.kind === 'literal_u32')
-        return String(leaf.value);
-    if (leaf.kind === 'literal_u64')
-        return leaf.value;
-    if (leaf.kind === 'literal_bytes')
-        return leaf.value;
-    if (leaf.kind === 'literal_vec') {
-        return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`;
-    }
-    return `<${leaf.kind}>`;
-}
-function comparisonOpText(op) {
-    switch (op) {
-        case 'lt':
-            return '<';
-        case 'lte':
-            return '<=';
-        case 'gt':
-            return '>';
-        case 'gte':
-            return '>=';
-        case 'eq':
-            return '==';
-    }
-}
 /** Render the plain-English one-liner. Format: `<ruleName>: <constraints>`,
  *  joined by `; ` so the user reads one sentence per constraint. */
 function renderPlainEnglish(ruleName, constraints) {

package/dist-cjs/review-card/cross-check.js

@@ -15,6 +15,7 @@
 // guard.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.summaryCrossCheck = summaryCrossCheck;
+const render_leaf_ts_1 = require("./render-leaf.js");
 /** Assert every leaf in the predicate appears as a constraint string in
  *  `summary.constraints`. Returns the missing templates (without the leaf
  *  values filled in) when any leaf was dropped. */
@@ -38,18 +39,11 @@ function summaryCrossCheck(predicate, summary) {
 function collect(node, out) {
     switch (node.op) {
         case 'and':
-        case 'or':
             for (const child of node.children)
                 collect(child, out);
             return;
-        case 'not':
-            collect(node.child, out);
-            return;
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             pushComparison(node.left, node.right, node.op, out);
             return;
         case 'in':
@@ -67,7 +61,7 @@ function pushComparison(left, right, op, out) {
         return;
     }
     if (left.kind === 'call_arg' && op === 'eq' && right.kind === 'literal_vec') {
-        out.push(`Path must be exactly [${right.elements.map(renderVecElement).join(', ')}]`);
+        out.push(`Path must be exactly [${right.elements.map(render_leaf_ts_1.renderVecElement).join(', ')}]`);
         return;
     }
     if (left.kind === 'call_arg_len' && op === 'eq' && right.kind === 'literal_u32') {
@@ -78,7 +72,7 @@ function pushComparison(left, right, op, out) {
     // the cross-check can assert a faithful summary.
     if (left.kind === 'call_arg_field') {
         const head = `arg[${left.index}] element[${left.element}].${left.field}`;
-        const sep = op === 'eq' ? '=' : comparisonOpText(op);
+        const sep = op === 'eq' ? '=' : (0, render_leaf_ts_1.comparisonOpText)(op);
         if (right.kind === 'literal_address') {
             out.push(`${head} ${sep} ${right.value}`);
             return;
@@ -87,14 +81,6 @@ function pushComparison(left, right, op, out) {
             out.push(`${head} ${sep} ${right.value}`);
             return;
         }
-        if (right.kind === 'literal_bytes') {
-            out.push(`${head} ${sep} ${right.value}`);
-            return;
-        }
-        if (right.kind === 'literal_u64') {
-            out.push(`${head} ${sep} ${right.value}`);
-            return;
-        }
         if (right.kind === 'literal_i128') {
             out.push(`${head} ${sep} ${right.value}`);
             return;
@@ -104,117 +90,28 @@ function pushComparison(left, right, op, out) {
             return;
         }
         if (right.kind === 'literal_vec') {
-            out.push(`${head} ${sep} [${right.elements.map(renderVecElement).join(', ')}]`);
+            out.push(`${head} ${sep} [${right.elements.map(render_leaf_ts_1.renderVecElement).join(', ')}]`);
             return;
         }
     }
-    // Mirrors the builder's wording byte-for-byte: how many calls the rule
-    // permits, since the bound counts the calls already made.
-    if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        const allowed = op === 'lt' ? right.value : right.value + 1;
-        out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`);
-        return;
-    }
     // Mirrors the builder's per-call cap line. Both sides must render the same
     // string: cross-check compares the summary against the predicate, so a
     // shape only ONE of them renders would read as a dropped constraint.
     if (left.kind === 'call_arg') {
         const head = `arg[${left.index}]`;
-        const sep = op === 'eq' ? '=' : comparisonOpText(op);
+        const sep = op === 'eq' ? '=' : (0, render_leaf_ts_1.comparisonOpText)(op);
         if (right.kind === 'literal_i128' ||
-            right.kind === 'literal_u64' ||
             right.kind === 'literal_u32' ||
             right.kind === 'literal_address' ||
-            right.kind === 'literal_symbol' ||
-            right.kind === 'literal_bytes') {
+            right.kind === 'literal_symbol') {
             out.push(`${head} ${sep} ${right.value}`);
             return;
         }
-        if (right.kind === 'call_arg_scaled') {
-            out.push(`${head} >= arg[${right.index}] * ${right.num}/${right.den}`);
-            return;
-        }
-    }
-    if (left.kind === 'amount' && right.kind === 'literal_i128') {
-        out.push(`Amount <= ${right.value}`);
-        return;
-    }
-    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
-        out.push(`Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value} (${right.decimals} dp)`);
-        return;
     }
 }
 function pushMembership(needle, haystack, out) {
     if (needle.kind !== 'call_arg')
         return;
-    const list = haystack.map(renderHaystackElement).join(', ');
+    const list = haystack.map(render_leaf_ts_1.renderHaystackElement).join(', ');
     out.push(`Recipient/arg must be one of [${list}]`);
 }
-function renderVecElement(leaf) {
-    switch (leaf.kind) {
-        case 'literal_address':
-            return leaf.value;
-        case 'literal_i128':
-            return leaf.value;
-        case 'literal_symbol':
-            return leaf.value;
-        case 'literal_u32':
-            return String(leaf.value);
-        case 'literal_u64':
-            return leaf.value;
-        case 'literal_bytes':
-            return leaf.value;
-        case 'literal_vec':
-            return `[${leaf.elements.map(renderVecElement).join(', ')}]`;
-        case 'call_contract':
-        case 'call_fn':
-        case 'call_arg':
-        case 'call_arg_len':
-        case 'call_arg_field':
-        case 'call_arg_scaled':
-        case 'amount':
-        case 'window_spent':
-        case 'now':
-        case 'valid_until':
-        case 'invocation_count_in_window':
-        case 'oracle_price':
-            return `<${leaf.kind}>`;
-        // Show the declared basis, not just the digits. A threshold on the wrong
-        // basis is the one policy error the contract cannot detect, so the review
-        // card is where a human has to be able to see it.
-        case 'oracle_threshold':
-            return `${leaf.value} (${leaf.decimals} dp)`;
-    }
-}
-function renderHaystackElement(leaf) {
-    if (leaf.kind === 'literal_address')
-        return leaf.value;
-    if (leaf.kind === 'literal_i128')
-        return leaf.value;
-    if (leaf.kind === 'literal_symbol')
-        return leaf.value;
-    if (leaf.kind === 'literal_u32')
-        return String(leaf.value);
-    if (leaf.kind === 'literal_u64')
-        return leaf.value;
-    if (leaf.kind === 'literal_bytes')
-        return leaf.value;
-    if (leaf.kind === 'literal_vec') {
-        return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`;
-    }
-    return `<${leaf.kind}>`;
-}
-function comparisonOpText(op) {
-    switch (op) {
-        case 'lt':
-            return '<';
-        case 'lte':
-            return '<=';
-        case 'gt':
-            return '>';
-        case 'gte':
-            return '>=';
-        case 'eq':
-            return '==';
-    }
-}

package/dist-cjs/review-card/render-leaf.d.ts

@@ -0,0 +1,4 @@
+import type { PredicateLeaf } from '../types.ts';
+export declare function renderVecElement(leaf: PredicateLeaf): string;
+export declare function renderHaystackElement(leaf: PredicateLeaf): string;
+export declare function comparisonOpText(op: 'eq' | 'lte'): string;

package/dist-cjs/review-card/render-leaf.js

@@ -0,0 +1,52 @@
+"use strict";
+// Leaf and operator rendering shared by the review-card builder and the
+// summary cross-check. Both turn the SAME predicate into human-readable text -
+// the cross-check exists to confirm the builder's summary matches the predicate
+// - so rendering a leaf differently in the two would make the check compare a
+// string against itself under a different spelling and pass on a real mismatch.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderVecElement = renderVecElement;
+exports.renderHaystackElement = renderHaystackElement;
+exports.comparisonOpText = comparisonOpText;
+function renderVecElement(leaf) {
+    switch (leaf.kind) {
+        case 'literal_address':
+            return leaf.value;
+        case 'literal_i128':
+            return leaf.value;
+        case 'literal_symbol':
+            return leaf.value;
+        case 'literal_u32':
+            return String(leaf.value);
+        case 'literal_vec':
+            return `[${leaf.elements.map(renderVecElement).join(', ')}]`;
+        case 'call_contract':
+        case 'call_fn':
+        case 'call_arg':
+        case 'call_arg_len':
+        case 'call_arg_field':
+            return `<${leaf.kind}>`;
+    }
+}
+function renderHaystackElement(leaf) {
+    if (leaf.kind === 'literal_address')
+        return leaf.value;
+    if (leaf.kind === 'literal_i128')
+        return leaf.value;
+    if (leaf.kind === 'literal_symbol')
+        return leaf.value;
+    if (leaf.kind === 'literal_u32')
+        return String(leaf.value);
+    if (leaf.kind === 'literal_vec') {
+        return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`;
+    }
+    return `<${leaf.kind}>`;
+}
+function comparisonOpText(op) {
+    switch (op) {
+        case 'lte':
+            return '<=';
+        case 'eq':
+            return '==';
+    }
+}