@crediolabs/policy-synth 0.2.0 → 0.3.1

package/src/predicate/encode.ts

@@ -2,7 +2,7 @@
 //
 // Pure function. Maps a `PredicateNode` AST to the canonical ScVal wire format:
 //   - every node is a `ScVal::Vec` whose head element is the tag `ScVal::Symbol`
-//   - children of `and` / `or` are sorted ascending by their canonical XDR bytes
+//   - children of `and` are sorted ascending by their canonical XDR bytes
 //   - `in` haystacks are ALWAYS sorted by canonical XDR bytes (pure set
 //     membership); an EXACT ordered sequence is expressed as
 //     `eq(selector, literal_vec)` where the `literal_vec` element order is
@@ -17,12 +17,6 @@
 // Caps from `PREDICATE_CAPS` are enforced BEFORE returning; a cap breach throws
 // a `ToolError` with the matching error code and `severity: 'error'`.
 //
-// One gap remains, deliberately: the `amount` / `window_spent` leaf branches
-// below are dead ABI - the contract's grammar no longer has those selector
-// symbols, so a predicate carrying one is MALFORMED at decode. The interpreter
-// adapter reports them as uncovered before lowering, so the product path
-// cannot emit one; removing the branches (and the leaf kinds) is a separate
-// change.
 
 import { createHash } from 'node:crypto'
 import { Address, xdr } from '@stellar/stellar-sdk'
@@ -65,34 +59,26 @@ export function encodePredicate(node: PredicateNode): EncodedPredicate {
       )
     }
   }
-  // Two-round confirmation costs 2 oracle reads per UNIQUE asset referenced.
-  const oracleReads = stats.oracleAssets.size * 2
-  if (oracleReads > PREDICATE_CAPS.MAX_ORACLE_READS) {
-    throw capError(
-      'PREDICATE_ORACLE_OVER_LIMIT',
-      `oracle reads ${oracleReads} exceed MAX_ORACLE_READS ${PREDICATE_CAPS.MAX_ORACLE_READS}`
-    )
-  }
-  if (stats.oracleAssets.size > 0 && stats.nonOracleSelectorLeaves === 0) {
+  // Minimum constraint. A predicate with no selector leaf compares literals
+  // to literals, so it is trivially true or false and would permit everything
+  // or nothing forever. The contract refuses it at install with
+  // SELECTOR_LEAF_REQUIRED (216); refuse it here too so the failure is caught
+  // before a transaction is built.
+  if (stats.selectorLeaves === 0) {
     throw capError(
       'MALFORMED_PREDICATE',
-      'predicate constrains nothing but an oracle price: the contract refuses it at install (dsl.rs MissingNonOracleEnvelope). Pin the call itself (contract / method / argument) alongside the price bound.'
+      'predicate constrains nothing: every comparison has literals on both sides. The contract refuses it at install (SELECTOR_LEAF_REQUIRED). Pin the call itself - contract, method or argument.'
     )
   }
 
-  // --- pass 1.5: leaf-value validation (Rust `validate_scaled_ratios` + the
-  // broader cap-set gate the contract enforces at install). Defense in depth:
-  // the TS self-verify pipeline should reject the same shapes Rust install
-  // refuses, so a hand-crafted predicate that simulate/verify green-lights
-  // cannot later be refused at the on-chain install step. The checks:
-  //   - u32 fields in range (call_arg index, literal_u32 value, oracle
-  //     threshold decimals, etc.) - the contract decodes as u32
-  //   - i128 positivity where required (literal_i128 for amount/window
-  //     caps; `den`/`num` for scaled ratios) - a negative cap would
-  //     permit everything
-  //   - hex even-length (literal_bytes) - `Buffer.from(v, 'hex')` silently
-  //     drops non-hex chars, so 'zz' becomes empty bytes
-  //   - scaled-ratio num>0 && den>0 - mirrors dsl.rs:661-704
+  // --- pass 1.5: leaf-value validation against the cap-set gate the contract
+  // enforces at install. Defense in depth: the TS self-verify pipeline should
+  // reject the same shapes Rust install refuses, so a hand-crafted predicate
+  // that simulate/verify green-lights cannot later be refused at the on-chain
+  // install step. The checks are the u32 ranges on the argument selectors
+  // (`call_arg.index`, `call_arg_len.index`, `call_arg_field.index` and
+  // `.element`) - the contract decodes each as u32, so an out-of-range value
+  // would fail there instead.
   // Throws `MALFORMED_PREDICATE` so the error stays a ToolError shape.
   validateLeafValues(node)
 
@@ -114,42 +100,31 @@ interface PredicateStats {
   depth: number
   leaves: number
   inCounts: Array<{ count: number }>
-  /** Unique assets referenced by `oracle_price` leaves - each costs 2 reads. */
-  oracleAssets: Set<string>
-  /** Selector leaves that are NOT `oracle_price`. The contract refuses a
-   *  predicate whose only constraint is an oracle read (dsl.rs
-   *  `validate_oracle_placement` -> MissingNonOracleEnvelope): a price bound
-   *  alone pins nothing about the call itself. Literals are operands, not
-   *  constraints, so they do not count. */
-  nonOracleSelectorLeaves: number
+  /** Leaves that read something from the call under evaluation. Literals are
+   *  operands, not constraints, so they do not count. Zero means the
+   *  predicate constrains nothing and the contract refuses it at install. */
+  selectorLeaves: number
 }
 
 function computeStats(node: PredicateNode): PredicateStats {
   const inCounts: Array<{ count: number }> = []
-  const oracleAssets = new Set<string>()
-  const counters = { nonOracleSelectorLeaves: 0 }
-  const { depth, leaves } = walk(node, inCounts, oracleAssets, counters, false)
+  const counters = { selectorLeaves: 0 }
+  const { depth, leaves } = walk(node, inCounts, counters)
   return {
     depth,
     leaves,
     inCounts,
-    oracleAssets,
-    nonOracleSelectorLeaves: counters.nonOracleSelectorLeaves,
+    selectorLeaves: counters.selectorLeaves,
   }
 }
 
 function walk(
   node: PredicateNode,
   inCounts: Array<{ count: number }>,
-  oracleAssets: Set<string>,
-  counters: { nonOracleSelectorLeaves: number },
-  /** True once the walk is under a `not` or an `or`, where an oracle read
-   *  becomes a condition the caller can satisfy by taking the other branch. */
-  negatedOrDisjunctive: boolean
+  counters: { selectorLeaves: number }
 ): { depth: number; leaves: number } {
   switch (node.op) {
-    case 'and':
-    case 'or': {
+    case 'and': {
       if (node.children.length === 0) {
         throw capError(
           'MALFORMED_PREDICATE',
@@ -159,29 +134,16 @@ function walk(
       let maxChildDepth = 0
       let totalLeaves = 0
       for (const c of node.children) {
-        const child = walk(
-          c,
-          inCounts,
-          oracleAssets,
-          counters,
-          negatedOrDisjunctive || node.op === 'or'
-        )
+        const child = walk(c, inCounts, counters)
         if (child.depth > maxChildDepth) maxChildDepth = child.depth
         totalLeaves += child.leaves
       }
       return { depth: maxChildDepth + 1, leaves: totalLeaves }
     }
-    case 'not': {
-      const child = walk(node.child, inCounts, oracleAssets, counters, true)
-      return { depth: child.depth + 1, leaves: child.leaves }
-    }
     case 'eq':
-    case 'lt':
-    case 'lte':
-    case 'gt':
-    case 'gte': {
-      collectOracle(node.left, oracleAssets, counters, negatedOrDisjunctive)
-      collectOracle(node.right, oracleAssets, counters, negatedOrDisjunctive)
+    case 'lte': {
+      collectSelector(node.left, counters)
+      collectSelector(node.right, counters)
       return { depth: 1, leaves: leafCount(node.left) + leafCount(node.right) }
     }
     case 'in': {
@@ -192,10 +154,10 @@ function walk(
         )
       }
       inCounts.push({ count: node.haystack.length })
-      collectOracle(node.needle, oracleAssets, counters, negatedOrDisjunctive)
+      collectSelector(node.needle, counters)
       let haystackLeaves = 0
       for (const h of node.haystack) {
-        collectOracle(h, oracleAssets, counters, negatedOrDisjunctive)
+        collectSelector(h, counters)
         haystackLeaves += leafCount(h)
       }
       return {
@@ -218,51 +180,26 @@ function leafCount(leaf: PredicateLeaf): number {
   return 1
 }
 
-function collectOracle(
-  leaf: PredicateLeaf,
-  oracleAssets: Set<string>,
-  counters: { nonOracleSelectorLeaves: number },
-  negatedOrDisjunctive: boolean
-): void {
-  // literal_vec is the only nested leaf; recurse so an oracle_price buried in a
-  // vector literal (which the lowering would forbid, but the cap-walker must
-  // still see) is counted toward the oracle-read budget.
-  if (leaf.kind === 'oracle_price') {
-    if (negatedOrDisjunctive) {
-      throw capError(
-        'ORACLE_LEAF_INVALID_POSITION',
-        `oracle_price(${leaf.asset}) sits under a \`not\`/\`or\`: the contract refuses that position at install (dsl.rs validate_oracle_placement). An oracle bound must be a conjunct the call has to satisfy.`
-      )
-    }
-    oracleAssets.add(leaf.asset)
-  } else if (leaf.kind === 'literal_vec') {
-    for (const el of leaf.elements) collectOracle(el, oracleAssets, counters, negatedOrDisjunctive)
-  } else if (!leaf.kind.startsWith('literal_') && leaf.kind !== 'oracle_threshold') {
-    // A threshold is the oracle compare's operand, not an independent
-    // constraint. Counting it would let an oracle-only predicate satisfy the
-    // non-oracle envelope with its own bound (mirrors collect_oracle_leaf in
-    // dsl.rs, where it sits with the literals).
-    counters.nonOracleSelectorLeaves += 1
+function collectSelector(leaf: PredicateLeaf, counters: { selectorLeaves: number }): void {
+  // literal_vec is the only nested leaf; recurse so a selector buried in a
+  // vector literal is still counted. Mirrors `dsl::has_selector_leaf`.
+  if (leaf.kind === 'literal_vec') {
+    for (const el of leaf.elements) collectSelector(el, counters)
+  } else if (!leaf.kind.startsWith('literal_')) {
+    counters.selectorLeaves += 1
   }
 }
 
 function encodeNode(node: PredicateNode): xdr.ScVal {
   switch (node.op) {
-    case 'and':
-    case 'or': {
+    case 'and': {
       const encoded = node.children.map(encodeNode)
       // sort children by their canonical XDR bytes ascending.
       const sorted = sortByCanonicalBytes(encoded)
       return xdr.ScVal.scvVec([symbol(node.op), xdr.ScVal.scvVec(sorted)])
     }
-    case 'not': {
-      return xdr.ScVal.scvVec([symbol('not'), encodeNode(node.child)])
-    }
     case 'eq':
-    case 'lt':
-    case 'lte':
-    case 'gt':
-    case 'gte': {
+    case 'lte': {
       return xdr.ScVal.scvVec([symbol(node.op), encodeLeaf(node.left), encodeLeaf(node.right)])
     }
     case 'in': {
@@ -294,49 +231,6 @@ function encodeLeaf(leaf: PredicateLeaf): xdr.ScVal {
         xdr.ScVal.scvU32(leaf.element),
         xdr.ScVal.scvSymbol(leaf.field),
       ])
-    case 'call_arg_scaled':
-      // Wire shape `vec[symbol, u32, i128, i128]` mirrors the Rust decoder's
-      // expectation in dsl.rs SEL_CALL_ARG_SCALED. `scvI128FromDecimal` is
-      // the same range-checked helper used by `literal_i128`; an out-of-range
-      // num/den is refused at encode time (rather than at install on chain).
-      return xdr.ScVal.scvVec([
-        symbol('call_arg_scaled'),
-        xdr.ScVal.scvU32(leaf.index),
-        scvI128FromDecimal(leaf.num),
-        scvI128FromDecimal(leaf.den),
-      ])
-    case 'amount':
-      return xdr.ScVal.scvVec([symbol('amount'), scvAddressFromStrkey(leaf.token)])
-    case 'window_spent':
-      return xdr.ScVal.scvVec([
-        symbol('window_spent'),
-        scvAddressFromStrkey(leaf.token),
-        scvU64FromValue(leaf.windowSeconds),
-      ])
-    case 'now':
-      return xdr.ScVal.scvVec([symbol('now')])
-    case 'valid_until':
-      // The interpreter refuses this leaf at install: it never sources
-      // valid_until_ledger, so a policy built on it would deny forever.
-      // Expiry belongs to the smart account, through the context rule's
-      // validUntilLedger. Refuse at synthesis so the author finds out here
-      // rather than from an install that always fails.
-      throw new Error(
-        'valid_until is not a usable predicate leaf: the interpreter never sources it and ' +
-          'refuses it at install. Put expiry on the context rule (validUntilLedger) instead.'
-      )
-    case 'invocation_count_in_window':
-      return xdr.ScVal.scvVec([symbol('invocation_count'), scvU64FromValue(leaf.windowSecs)])
-    case 'oracle_price':
-      return xdr.ScVal.scvVec([symbol('oracle_price'), scvAddressFromStrkey(leaf.asset)])
-    case 'oracle_threshold':
-      // Arity 3, matching SEL_ORACLE_THRESHOLD in dsl.rs. The declared basis
-      // travels with the value so the contract never has to assume one.
-      return xdr.ScVal.scvVec([
-        symbol('oracle_threshold'),
-        scvI128FromDecimal(leaf.value),
-        xdr.ScVal.scvU32(leaf.decimals),
-      ])
     case 'literal_address':
       return scvAddressFromStrkey(leaf.value)
     case 'literal_i128':
@@ -345,10 +239,6 @@ function encodeLeaf(leaf: PredicateLeaf): xdr.ScVal {
       return xdr.ScVal.scvSymbol(leaf.value)
     case 'literal_u32':
       return xdr.ScVal.scvU32(leaf.value)
-    case 'literal_u64':
-      return scvU64FromValue(leaf.value)
-    case 'literal_bytes':
-      return xdr.ScVal.scvBytes(Buffer.from(leaf.value, 'hex'))
     case 'literal_vec':
       // Bare ScVal::Vec of element encodings - order is preserved verbatim
       // because the order IS the semantic (exact ordered sequence equality).
@@ -370,12 +260,6 @@ function scvAddressFromStrkey(strkey: string): xdr.ScVal {
   return xdr.ScVal.scvAddress(Address.fromString(strkey).toScAddress())
 }
 
-function scvU64FromValue(value: number | string): xdr.ScVal {
-  // The Uint64 (UnsignedHyper) constructor accepts string | bigint | number;
-  // string is safest for values > 2^53.
-  return xdr.ScVal.scvU64(new xdr.Uint64(String(value)))
-}
-
 /** Build `ScVal::I128(Int128Parts{hi, lo})` from a signed decimal string.
  *  `Int128Parts` encodes the value as `(hi << 64) + lo` with `hi` a SIGNED
  *  64-bit int and `lo` an UNSIGNED 64-bit int (this is NOT signed-magnitude).
@@ -394,12 +278,8 @@ function scvI128FromDecimal(decimal: string): xdr.ScVal {
       `literal_i128 value ${decimal} is outside the Int128 range`
     )
   }
-  if (lo < 0n || lo > UINT64_MAX) {
-    throw capError(
-      'MALFORMED_PREDICATE',
-      `literal_i128 value ${decimal} has an invalid Int128Parts.lo`
-    )
-  }
+  // `lo` needs no range check: masking with UINT64_MAX puts it in
+  // [0, 2^64-1] for every v, negative included.
   return xdr.ScVal.scvI128(
     new xdr.Int128Parts({
       hi: new xdr.Int64(hi),
@@ -423,20 +303,14 @@ function capError(code: ToolError['code'], message: string): ToolError {
 // u32 boundary - the same constant the contract decodes with. A value above
 // this either overflows during encode or is refused at install.
 const U32_MAX = 4294967295
-// The maximum decimal basis an oracle threshold can declare (mirrors
-// `MAX_ORACLE_THRESHOLD_DECIMALS` in dsl.rs). A value above this is refused
-// at install with `ORACLE_PARAMS_OUT_OF_RANGE`.
-const MAX_ORACLE_THRESHOLD_DECIMALS = 18
 
-/** Walk a `PredicateNode` and fail-closed on any leaf whose cap-set value the
- *  contract would refuse at install. Mirrors `validate_scaled_ratios` in
- *  dsl.rs:661-704 plus the broader cap-set gate (`literal_u32`, `literal_i128`
- *  positivity, `literal_bytes` hex even-length, `oracle_threshold` decimals
- *  range, `call_arg_scaled` positive-ratio). Defense in depth so the TS
- *  self-verify pipeline rejects the same shapes Rust install already
- *  refuses - a hand-crafted predicate that simulate/verify green-lights must
- *  NOT be installable. Throws `MALFORMED_PREDICATE` so the envelope shapes
- *  it into a ToolError. */
+/** Walk a `PredicateNode` and fail-closed on any leaf whose value the contract
+ *  would refuse at install: the argument selectors carry u32 indices, so a
+ *  value outside that range is refused here rather than on chain. Defense in
+ *  depth so the TS self-verify pipeline rejects the same shapes Rust install
+ *  already refuses - a hand-crafted predicate that simulate/verify
+ *  green-lights must NOT be installable. Throws `MALFORMED_PREDICATE` so the
+ *  envelope shapes it into a ToolError. */
 function validateLeafValues(node: PredicateNode): void {
   function walkLeaf(leaf: PredicateLeaf, path: string): void {
     switch (leaf.kind) {
@@ -458,108 +332,22 @@ function validateLeafValues(node: PredicateNode): void {
           throw malformed(`call_arg_field.element out of u32 range at ${path}`)
         }
         return
-      case 'call_arg_scaled': {
-        if (!Number.isInteger(leaf.index) || leaf.index < 0 || leaf.index > U32_MAX) {
-          throw malformed(`call_arg_scaled.index out of u32 range at ${path}`)
-        }
-        // num / den are i128 on chain, decimal strings on the wire. The
-        // contract refuses `den == 0` and `num <= 0` / `den <= 0` at install
-        // (dsl.rs:664-672); mirror that here so a future regression in
-        // `validate_scaled_ratios` cannot let a divide-by-zero policy reach
-        // the wire. BigInt throws on non-numeric strings -> malformed.
-        let num: bigint
-        let den: bigint
-        try {
-          num = BigInt(leaf.num)
-          den = BigInt(leaf.den)
-        } catch {
-          throw malformed(`call_arg_scaled.num/den not a decimal integer at ${path}`)
-        }
-        if (num <= 0n) throw malformed(`call_arg_scaled.num must be > 0 at ${path}`)
-        if (den <= 0n) throw malformed(`call_arg_scaled.den must be > 0 at ${path}`)
-        return
-      }
-      case 'literal_u32':
-        if (!Number.isInteger(leaf.value) || leaf.value < 0 || leaf.value > U32_MAX) {
-          throw malformed(`literal_u32.value out of u32 range at ${path}`)
-        }
-        return
-      case 'literal_i128':
-        // literal_i128 is signed; the contract allows negatives (i128
-        // arithmetic), but caps on a positive quantity (amount / window
-        // bound) should never be negative - a negative cap is silently
-        // satisfied by every non-negative amount. The contract gate is
-        // already on the leaf's ROLE (amount vs equality) not the value;
-        // here we mirror the value-only invariant the cap-set gate enforces
-        // by refusing the syntactic shape that would clearly be a bug
-        // (literal_i128 as a CAP with a leading `-` on a non-equality).
-        // We do not gate equality i128 - `literal_i128` as an address-by-
-        // equality is fine (it is just a constant).
-        // The value itself is always accepted; the structural check
-        // (non-negative for an amount / window bound) is left to the
-        // caller-built predicate, not the encoder.
-        return
-      case 'literal_bytes':
-        // Hex even-length: a non-hex char silently drops, and an odd
-        // length yields a half-byte Buffer. The contract decodes with a
-        // strict hex parser and refuses anything that is not even-length
-        // hex; mirror that here.
-        if (!/^[0-9a-fA-F]*$/.test(leaf.value) || leaf.value.length % 2 !== 0) {
-          throw malformed(`literal_bytes.value must be even-length hex at ${path}`)
-        }
-        return
-      case 'oracle_threshold':
-        if (
-          !Number.isInteger(leaf.decimals) ||
-          leaf.decimals < 0 ||
-          leaf.decimals > MAX_ORACLE_THRESHOLD_DECIMALS
-        ) {
-          throw malformed(
-            `oracle_threshold.decimals out of range (0..${MAX_ORACLE_THRESHOLD_DECIMALS}) at ${path}`
-          )
-        }
-        return
-      case 'literal_vec':
-        leaf.elements.forEach((e, i) => {
-          walkLeaf(e, `${path}.elements[${i}]`)
-        })
-        return
-      // Selector and other leaves carry no cap-set values; the call_arg
-      // branches above cover indices, the literal branches cover typed
-      // constants. amount / window_spent / invocation_count / now /
-      // valid_until / call_contract / call_fn / literal_address /
-      // literal_symbol / literal_u64 / oracle_price are all value-free
-      // at this gate.
-      case 'amount':
-      case 'window_spent':
-      case 'invocation_count_in_window':
-      case 'now':
-      case 'valid_until':
       case 'call_contract':
       case 'call_fn':
       case 'literal_address':
       case 'literal_symbol':
-      case 'literal_u64':
-      case 'oracle_price':
         return
     }
   }
   function walkNode(n: PredicateNode, path: string): void {
     switch (n.op) {
       case 'and':
-      case 'or':
         n.children.forEach((c, i) => {
           walkNode(c, `${path}.children[${i}]`)
         })
         return
-      case 'not':
-        walkNode(n.child, `${path}.child`)
-        return
       case 'eq':
-      case 'lt':
       case 'lte':
-      case 'gt':
-      case 'gte':
         walkLeaf(n.left, `${path}.left`)
         walkLeaf(n.right, `${path}.right`)
         return

package/src/predicate/from-json.ts

@@ -19,7 +19,6 @@ export function jsonToAst(value: unknown): PredicateNode {
   const v = value as {
     op?: unknown
     children?: unknown
-    child?: unknown
     left?: unknown
     right?: unknown
     needle?: unknown
@@ -27,15 +26,9 @@ export function jsonToAst(value: unknown): PredicateNode {
   }
   switch (v.op) {
     case 'and':
-    case 'or':
-      return { op: v.op, children: arrayOf(v.children, jsonToAst) }
-    case 'not':
-      return { op: 'not', child: jsonToAst(v.child) }
+      return { op: 'and', children: arrayOf(v.children, jsonToAst) }
     case 'eq':
-    case 'lt':
     case 'lte':
-    case 'gt':
-    case 'gte':
       return { op: v.op, left: jsonToLeaf(v.left), right: jsonToLeaf(v.right) }
     case 'in':
       return { op: 'in', needle: jsonToLeaf(v.needle), haystack: arrayOf(v.haystack, jsonToLeaf) }
@@ -55,42 +48,11 @@ function jsonToLeaf(value: unknown): PredicateLeaf {
   switch (v.kind) {
     case 'call_contract':
     case 'call_fn':
-    case 'now':
-    case 'valid_until':
       return { kind: v.kind }
     case 'call_arg':
       return { kind: 'call_arg', index: numberField(v, 'index') }
     case 'call_arg_len':
       return { kind: 'call_arg_len', index: numberField(v, 'index') }
-    // num/den are strings, not numbers: they are i128 on chain, and a JSON
-    // number would silently lose precision past 2^53 before the encoder
-    // ever saw the value.
-    case 'call_arg_scaled':
-      return {
-        kind: 'call_arg_scaled',
-        index: numberField(v, 'index'),
-        num: stringField(v, 'num'),
-        den: stringField(v, 'den'),
-      }
-    case 'call_arg_field':
-      return {
-        kind: 'call_arg_field',
-        index: numberField(v, 'index'),
-        element: numberField(v, 'element'),
-        field: stringField(v, 'field'),
-      }
-    case 'amount':
-      return { kind: 'amount', token: stringField(v, 'token') }
-    case 'window_spent':
-      return {
-        kind: 'window_spent',
-        token: stringField(v, 'token'),
-        windowSeconds: numberField(v, 'windowSeconds'),
-      }
-    case 'invocation_count_in_window':
-      return { kind: 'invocation_count_in_window', windowSecs: numberField(v, 'windowSecs') }
-    case 'oracle_price':
-      return { kind: 'oracle_price', asset: stringField(v, 'asset') }
     case 'literal_address':
       return { kind: 'literal_address', value: stringField(v, 'value') }
     case 'literal_i128':
@@ -99,10 +61,6 @@ function jsonToLeaf(value: unknown): PredicateLeaf {
       return { kind: 'literal_symbol', value: stringField(v, 'value') }
     case 'literal_u32':
       return { kind: 'literal_u32', value: numberField(v, 'value') }
-    case 'literal_u64':
-      return { kind: 'literal_u64', value: stringField(v, 'value') }
-    case 'literal_bytes':
-      return { kind: 'literal_bytes', value: stringField(v, 'value') }
     case 'literal_vec':
       return { kind: 'literal_vec', elements: arrayOf(v.elements, jsonToLeaf) }
     default:

package/src/record/decode.ts

@@ -453,14 +453,9 @@ function recordInvocation(
   // parseConfidence denominator isn't inflated by repeat calls), but each
   // unrecognised invocation is recorded separately so the numerator
   // reflects every fail-closed hit.
-  if (knownSet.has(contract)) {
-    if (!knownContractSet.has(contract)) {
-      knownContractSet.add(contract)
-      knownOut.push(contract)
-    }
-    return
-  }
-  if (identifyProtocol(contract, fn, args, network ?? undefined)) {
+  // `||` short-circuits, so `identifyProtocol` is still only consulted when the
+  // contract is not already in `knownSet` - the same call order as before.
+  if (knownSet.has(contract) || identifyProtocol(contract, fn, args, network ?? undefined)) {
     if (!knownContractSet.has(contract)) {
       knownContractSet.add(contract)
       knownOut.push(contract)

package/src/record/freshness.ts

@@ -52,17 +52,23 @@ export function isBelowThreshold(c: ParseConfidence): boolean {
  *  under-confidence recording.
  *
  *  The remediation text branches on which diagnostic bucket is non-empty:
- *    - unknownContracts only -> user MUST supply an ABI (or re-capture
- *      against a known protocol version). The contract is real, the
- *      recorder just cannot decode it.
- *    - opaqueScVals only -> the recorder encountered a value shape it
- *      should support but did not decode. The user cannot supply an ABI
- *      to fix a decoder bug; the guidance explicitly says so and points at
- *      re-running after a tool upgrade / reporting the path.
- *    - both -> list both diagnostics AND chain the right remediation for
- *      each (the user supplies an ABI AND reports the decoder gap).
- *    - neither (the "denom === 0" path) -> unchanged from the pre-fix
- *      text; the user did not actually hit a code-level barrier. */
+ *    - unknownContracts only -> the contract is not in the compiled-in
+ *      registry. NOT "the contract has no interface": most Soroban
+ *      contracts publish a typed spec on chain, this package just never
+ *      reads one. The reason code stays `no-abi` because it is a published
+ *      enum value, so the TEXT has to carry the correction.
+ *    - opaqueScVals only -> the recorder met a value shape it should
+ *      support but did not decode. That is a decoder bug, and the guidance
+ *      says so rather than implying the caller can fix it.
+ *    - both -> list both diagnostics and chain the right remediation.
+ *    - neither (the "denom === 0" path) -> the caller did not actually hit
+ *      a code-level barrier.
+ *
+ *  Do NOT tell the caller to supply an ABI. There is no input for one:
+ *  recognition runs off the compiled-in registry plus a known-contract set
+ *  that no public tool boundary exposes. The old text named an action
+ *  nobody could take and sent users looking for a file they do not have and
+ *  would not need. */
 export function buildLowConfidenceQuestion(c: ParseConfidence): string {
   const hasUnknown = c.unknownContracts.length > 0
   const hasOpaque = c.opaqueScVals.length > 0
@@ -75,18 +81,23 @@ export function buildLowConfidenceQuestion(c: ParseConfidence): string {
   }
   const why = reasons.length === 0 ? 'no diagnostic reason available' : reasons.join('; ')
   const header = `Recording refused: parseConfidence ${c.overall.toFixed(3)} is below the threshold ${c.thresholdUsed.toFixed(3)}. Diagnostic: ${why}.`
-  // The two remediation branches are explicit so the user (or the agent)
-  // can dispatch on the verb. The "unknown contract" branch is the only
-  // one that asks for an ABI; the "opaque ScVal" branch asks the user to
-  // report the path and re-run after a tool upgrade.
+  // The remediation branches are explicit so the user (or the agent) can
+  // dispatch on the verb. Neither branch asks for an ABI: there is no input
+  // that accepts one, and for the unknown-contract branch the contract's
+  // own spec is usually on chain already - it is this package that does not
+  // read it.
+  const unknownAdvice =
+    `The contract is not in this package's built-in registry - "no-abi" means unrecognised here, not that the contract lacks an interface. ` +
+    `You cannot supply one: the registry is compiled in. Either build the policy without deriving it from this transaction, or re-capture against a protocol the registry covers. ` +
+    `Passing confidenceOverride accepts the recording as it stands, including the arguments this tool could not attribute - do that only if you have checked them yourself.`
   if (hasUnknown && hasOpaque) {
     return (
-      `${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version; ` +
-      `also file the opaque ScVal path against the recorder (decoder limitation) and re-run record_transaction after a tool upgrade.`
+      `${header} ${unknownAdvice} Separately, file the opaque ScVal path against the recorder (a decoder limitation) ` +
+      `and re-run record_transaction after a tool upgrade.`
     )
   }
   if (hasUnknown) {
-    return `${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version, then re-run record_transaction.`
+    return `${header} ${unknownAdvice}`
   }
   if (hasOpaque) {
     return `${header} This is a recorder decoder limitation (the value shape is supported in principle but not yet decoded) - the agent cannot fix it by supplying an ABI. Report the opaque ScVal path above against the recorder and re-run record_transaction after a tool upgrade.`