@crediolabs/policy-synth 0.2.0 → 0.3.1

package/dist/synth/permit-context.d.ts

@@ -1,15 +0,0 @@
-import type { PredicateNode, RecordedTransaction } from '../types.ts';
-import type { EvalContext } from './evaluate.ts';
-export interface PermitContextResponses {
-    windowSeconds: number;
-    invocationLimit?: number;
-    limitAmount?: string;
-    validUntilLedger: number;
-    oraclePriceBound?: Array<{
-        asset: string;
-        operator: string;
-        value: string;
-        decimals: number;
-    }>;
-}
-export declare function buildPermitContext(tx: RecordedTransaction, responses: PermitContextResponses, predicate: PredicateNode): EvalContext;

package/dist/synth/permit-context.js

@@ -1,116 +0,0 @@
-// src/synth/permit-context.ts - build the EvalContext that represents the
-// recorded call being replayed.
-//
-// Extracted from the over-permissiveness harness so the same construction
-// feeds both the in-process battery and the on-chain replay
-// (scripts/verify-mutations-testnet.ts). Two callers building this
-// separately would be two chances to disagree about what "the recorded
-// call" means, which is the one thing both must share.
-import { cloneScVal } from "./deny-cases.js";
-export function buildPermitContext(tx, responses, predicate) {
-    const amountByToken = {};
-    const totals = new Map();
-    for (const m of tx.tokenMovements) {
-        const current = totals.get(m.token) ?? 0n;
-        totals.set(m.token, current + BigInt(m.amount));
-    }
-    for (const [token, total] of totals) {
-        amountByToken[token] = total.toString();
-    }
-    const topLevel = tx.invocations[0];
-    const scopeContract = topLevel?.contract ?? '';
-    const oraclePriceByAsset = {};
-    visitOracleLeaves(predicate, (asset, op, bound) => {
-        let price;
-        switch (op) {
-            case 'lt':
-                price = bound - 1n;
-                break;
-            case 'gt':
-                price = bound + 1n;
-                break;
-            default:
-                price = bound;
-        }
-        if (price < 0n)
-            price = 0n;
-        oraclePriceByAsset[asset] = { price: price.toString(), timestampSeconds: tx.fetchedAt };
-    });
-    const ctx = {
-        contract: scopeContract,
-        fn: topLevel?.fn ?? '',
-        args: (topLevel?.args ?? []).map(cloneScVal),
-        atLedger: tx.ledgerSequence,
-        nowSeconds: tx.fetchedAt,
-        amountByToken,
-        windowSpentByToken: {},
-        invocationCountByWindow: {},
-        oraclePriceByAsset,
-    };
-    if (responses.validUntilLedger !== undefined) {
-        ctx.validUntilLedger = responses.validUntilLedger;
-    }
-    return ctx;
-}
-function visitOracleLeaves(node, visit) {
-    switch (node.op) {
-        case 'and':
-        case 'or':
-            for (const child of node.children)
-                visitOracleLeaves(child, visit);
-            return;
-        case 'not':
-            visitOracleLeaves(node.child, visit);
-            return;
-        case 'eq':
-        case 'lt':
-        case 'lte':
-        case 'gt':
-        case 'gte': {
-            const leftIsOracle = node.left.kind === 'oracle_price';
-            const rightIsOracle = node.right.kind === 'oracle_price';
-            let asset;
-            let literal;
-            if (leftIsOracle) {
-                asset = node.left.kind === 'oracle_price' ? node.left.asset : undefined;
-                literal = oracleThresholdNormalised(node.right);
-            }
-            else if (rightIsOracle) {
-                asset = node.right.kind === 'oracle_price' ? node.right.asset : undefined;
-                literal = oracleThresholdNormalised(node.left);
-            }
-            if (asset !== undefined && literal !== undefined) {
-                visit(asset, node.op, literal);
-            }
-            return;
-        }
-        case 'in':
-            return;
-    }
-}
-/** Oracle prices normalise to 9 decimals; mirrors NORMALISED_DECIMALS in
- *  oracle.rs. */
-const NORMALISED_DECIMALS = 9n;
-/** A threshold restated on the normalised basis, so a derived permit price is
- *  comparable to it. Thresholds carry their own basis, so the conversion has
- *  to happen here - reading the digits raw would build a context off by a
- *  factor of 10^(decimals-9). Returns undefined for any other leaf. */
-function oracleThresholdNormalised(leaf) {
-    if (leaf.kind !== 'oracle_threshold')
-        return undefined;
-    let value;
-    try {
-        value = BigInt(leaf.value);
-    }
-    catch {
-        return undefined;
-    }
-    const decimals = BigInt(leaf.decimals);
-    if (decimals <= NORMALISED_DECIMALS) {
-        return value * 10n ** (NORMALISED_DECIMALS - decimals);
-    }
-    // Floor: a finer-grained threshold has no exact 9-dp representation. The
-    // caller only needs a price that lands on the right side of the bound, and
-    // it offsets by one from here.
-    return value / 10n ** (decimals - NORMALISED_DECIMALS);
-}

package/dist/synth/predicate-literals.d.ts

@@ -1,5 +0,0 @@
-import type { PredicateLeaf } from '../types.ts';
-/** BigInt value of a numeric-integer literal leaf (`literal_i128` / `literal_u64`
- *  / `literal_u32`), or null for a non-numeric literal (address / symbol / bytes
- *  / vec). Callers fail closed on null. */
-export declare function literalNumericBigInt(leaf: PredicateLeaf): bigint | null;

package/dist/synth/predicate-literals.js

@@ -1,25 +0,0 @@
-// src/synth/predicate-literals.ts - read scalar values out of predicate literal leaves.
-//
-// Small shared helpers for interpreting a `PredicateLeaf` literal. Kept out of
-// `evaluate.ts` so the evaluator stays focused on the deny-order semantics; the
-// deny-case generator uses the same reader so both sides agree on what a numeric
-// literal means.
-/** BigInt value of a numeric-integer literal leaf (`literal_i128` / `literal_u64`
- *  / `literal_u32`), or null for a non-numeric literal (address / symbol / bytes
- *  / vec). Callers fail closed on null. */
-export function literalNumericBigInt(leaf) {
-    switch (leaf.kind) {
-        case 'literal_i128':
-        case 'literal_u64':
-            try {
-                return BigInt(leaf.value);
-            }
-            catch {
-                return null;
-            }
-        case 'literal_u32':
-            return BigInt(leaf.value);
-        default:
-            return null;
-    }
-}

package/dist/synth/synthesize-from-mandate.d.ts

@@ -1,20 +0,0 @@
-import type { OzAdapterConfig } from '../adapters/oz/adapter.ts';
-import type { ToolResponse } from '../errors.ts';
-import type { MandateSpec } from '../mandate/types.ts';
-import type { PredicateNode, ProposedPolicy } from '../types.ts';
-import type { SimulationResult } from '../verify/envelope.ts';
-export declare function synthesizeFromMandate(spec: MandateSpec, ozConfig: OzAdapterConfig, 
-/** --explain opt-in. When true, the success envelope carries the
- *  in-memory predicate tree (always null for the mandate path - the
- *  declarative MandateSpec lowers to OZ built-ins, not to an
- *  interpreter predicate) + a minimal honest SimulationResult. The
- *  flag is ADDITIVE: the existing ProposedPolicy fields are never
- *  altered. */
-opts?: {
-    explain?: true;
-}): ToolResponse<ProposedPolicy> & {
-    explain?: {
-        predicateTree: PredicateNode | null;
-        simulation: SimulationResult;
-    };
-};

package/dist/synth/synthesize-from-mandate.js

@@ -1,59 +0,0 @@
-// src/synth/synthesize-from-mandate.ts - the deterministic Mandate front-end.
-//
-// synthesizeFromMandate is the clean end-to-end demo path: a declarative
-// MandateSpec is lowered deterministically to a PolicyIR and compiled by the OZ
-// adapter to a ProposedPolicy. No decoding, no inference, so parseConfidence is
-// the full/not-applicable value. Constructs the OZ built-in primitives cannot
-// express (compile's `uncovered`) are surfaced in `ProposedPolicy.warnings`
-// rather than failing the call - the covered primitives still install; the
-// uncovered ones are reported.
-import { createOzAdapter } from "../adapters/oz/adapter.js";
-import { mandateToPolicyIR } from "../mandate/to-ir.js";
-const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: ';
-export function synthesizeFromMandate(spec, ozConfig, 
-/** --explain opt-in. When true, the success envelope carries the
- *  in-memory predicate tree (always null for the mandate path - the
- *  declarative MandateSpec lowers to OZ built-ins, not to an
- *  interpreter predicate) + a minimal honest SimulationResult. The
- *  flag is ADDITIVE: the existing ProposedPolicy fields are never
- *  altered. */
-opts) {
-    const ir = mandateToPolicyIR(spec);
-    const adapter = createOzAdapter(ozConfig);
-    const result = adapter.compile(ir);
-    if (!result.proposed) {
-        return {
-            ok: false,
-            error: {
-                code: 'SYNTHESIS_ERROR',
-                message: `mandate lowered to no installable OZ policy: ${result.uncovered.join('; ')}`,
-                severity: 'error',
-                retryable: false,
-                details: { uncovered: result.uncovered },
-            },
-        };
-    }
-    const proposed = {
-        ...result.proposed,
-        warnings: result.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
-    };
-    // Same --explain envelope pattern as the recording path. The mandate path
-    // never produces an interpreter predicate, so predicateTree is null and
-    // the simulation is a minimal honest deny (no self-verify was performed).
-    const envelope = { ok: true, data: proposed };
-    if (opts?.explain) {
-        envelope.explain = {
-            predicateTree: null,
-            simulation: {
-                permit: {
-                    tx: 'deny',
-                    reason: 'No self-verification was performed (mandate path is OZ-only)',
-                },
-                evaluatedCases: [],
-                backend: 'ts-model',
-                simulatorVersion: 'not-run',
-            },
-        };
-    }
-    return envelope;
-}

package/dist/verify/envelope.d.ts

@@ -1,15 +0,0 @@
-export type SimulationResult = {
-    permit: {
-        tx: 'permit';
-    } | {
-        tx: 'deny';
-        reason: string;
-    };
-    evaluatedCases: Array<{
-        dimension: string;
-        outcome: 'permit' | 'deny';
-        reason: string;
-    }>;
-    backend: 'interpreter-v1' | 'ts-model';
-    simulatorVersion: string;
-};

package/dist/verify/envelope.js

@@ -1,22 +0,0 @@
-// src/verify/envelope.ts - the post-simulation result envelope used by
-// review-card rendering and verification.
-//
-// `SimulationResult` is the structured verdict a `simulate_policy` run
-// produces; the review-card builder reads it as one of its inputs (so the
-// rendered card can quote the backend that evaluated the policy) and the
-// verification pipeline reads `permit` + `evaluatedCases` to confirm every
-// generated deny case really did deny.
-//
-// This envelope is intentionally separate from the CustodyAdapter
-// `SimulationResult` in `src/seams/types.ts` (which is the dry-run stub
-// returned by `adapter.simulate(ir, permitTx)`); the seam result is the
-// adapter contract, this envelope is the post-simulation record consumed by
-// downstream rendering + verification.
-//
-// Fields:
-//   - `permit` is the single verdict for the candidate recorded tx.
-//   - `evaluatedCases` is the deny-case battery outcome (every dimension
-//     must report `deny` when the policy is minimal).
-//   - `backend` is the actual evaluator that produced the verdict.
-//   - `simulatorVersion` lets the reviewer / audit log distinguish runs.
-export {};

package/dist/verify/index.d.ts

@@ -1,3 +0,0 @@
-export type { SimulationResult } from './envelope.ts';
-export { type SimulateOptions, simulatePolicy } from './simulate.ts';
-export { type VerifyOptions, verifyPolicy } from './verify.ts';

package/dist/verify/index.js

@@ -1,3 +0,0 @@
-// src/verify/index.ts - re-export the simulation / verification surface.
-export { simulatePolicy } from "./simulate.js";
-export { verifyPolicy } from "./verify.js";

package/dist/verify/simulate.d.ts

@@ -1,31 +0,0 @@
-import type { ToolResponse } from '../errors.ts';
-import type { PredicateNode, RecordedTransaction } from '../types.ts';
-import type { SimulationResult } from './envelope.ts';
-/** Options for `simulatePolicy`. `validUntilLedger` is propagated onto the
- *  permit EvalContext so the simulator exercises the expiry gate; absent ->
- *  no expiry check (mirrors the orchestrator's "no `validUntilLedger`
- *  supplied" path). `oraclePricesByAsset` is the test fixture the simulator
- *  uses to satisfy `oracle_price` leaves so the permit call evaluates under
- *  the bound; absent -> derive satisfying prices from the predicate itself
- *  (the orchestrator's oracle-satisfying-price logic). */
-export interface SimulateOptions {
-    validUntilLedger?: number;
-    /** Pre-populated oracle-price entries keyed by asset address. The fixture
-     *  must satisfy every `oracle_price` leaf in the predicate; absent or
-     *  unsatisfying entries cause `SIMULATION_ERROR`. */
-    oraclePricesByAsset?: Record<string, {
-        price: string;
-        timestampSeconds: number;
-    } | {
-        error: 'stale' | 'missing' | 'deviation' | 'paused' | 'decimals' | 'fingerprint';
-    }>;
-}
-/** Replay a recorded transaction against a proposed predicate and emit the
- *  `SimulationResult` envelope. The simulator returns the SAME permit
- *  verdict `runHarness` expects: the intended recorded call must permit; every
- *  generated deny dimension must deny. A runtime evaluation failure
- *  (malformed input, missing oracle fixture, etc.) returns a `SIMULATION_ERROR`
- *  `ToolError` - NOT a deny verdict, NOT `VERIFICATION_FAILED`. The boundary
- *  is pinned: minimality is a verify-time concern, runtime evaluation is a
- *  simulate-time concern. */
-export declare function simulatePolicy(predicate: PredicateNode | null, permitTx: RecordedTransaction, opts?: SimulateOptions): ToolResponse<SimulationResult>;

package/dist/verify/simulate.js

@@ -1,258 +0,0 @@
-// src/verify/simulate.ts - the post-simulation verdict for `simulate_policy`.
-//
-// `simulatePolicy` replays a recorded transaction against a proposed
-// `PredicateNode` and emits the `SimulationResult` envelope the review-card
-// builder + the verification pipeline consume.
-//
-// Boundary (pinned, must not drift):
-//   - `SIMULATION_ERROR`        = RUNTIME evaluation failed. Surfaced by
-//     `simulatePolicy`. Reasons: malformed `permitTx` input (no top-level
-//     invocation to build an EvalContext from), a referenced oracle asset
-//     without a satisfying price fixture, or a non-runtime propagation (a
-//     throw that is not an oracle error or a controlled deny). A
-//     runtime evaluation failure is NOT a policy-minimality problem; the
-//     policy may still be minimal. Re-running with a complete fixture MAY
-//     succeed.
-//   - `VERIFICATION_FAILED`     = STATIC minimality check failed. Surfaced
-//     by `verifyPolicy`. The minimiser identified a load-bearing-free
-//     constraint; the policy is structurally over-broad regardless of how
-//     any concrete call evaluates. Re-running with a different fixture
-//     will NOT fix it; the policy must be trimmed.
-//
-// Determinism: same `(predicate, permitTx, opts)` -> byte-identical
-// envelope, no clock, no randomness.
-//
-// The permit EvalContext is built locally (mirror of the helper used in
-// `synthesize-from-recording.ts`) so this module does not couple to the
-// orchestrator's private build helpers. The shape is pinned by the test
-// suite to stay in lockstep.
-import { generateCases } from "../synth/deny-cases.js";
-import { evaluate } from "../synth/evaluate.js";
-import { MAX_SCVAL_CLONE_DEPTH } from "../types.js";
-const SIMULATOR_VERSION = 'ts-model-1.0.0';
-/** Replay a recorded transaction against a proposed predicate and emit the
- *  `SimulationResult` envelope. The simulator returns the SAME permit
- *  verdict `runHarness` expects: the intended recorded call must permit; every
- *  generated deny dimension must deny. A runtime evaluation failure
- *  (malformed input, missing oracle fixture, etc.) returns a `SIMULATION_ERROR`
- *  `ToolError` - NOT a deny verdict, NOT `VERIFICATION_FAILED`. The boundary
- *  is pinned: minimality is a verify-time concern, runtime evaluation is a
- *  simulate-time concern. */
-export function simulatePolicy(predicate, permitTx, opts = {}) {
-    // The permit EvalContext requires a top-level invocation. A recorded tx
-    // with no invocations is structurally malformed input - we surface a
-    // runtime `SIMULATION_ERROR` rather than fabricating a permit verdict.
-    const topLevel = permitTx.invocations[0];
-    if (!topLevel) {
-        return {
-            ok: false,
-            error: simulationError('recorded transaction has no top-level invocation to simulate'),
-        };
-    }
-    let permitCtx;
-    try {
-        permitCtx = buildPermitContext(predicate, permitTx, topLevel, opts);
-    }
-    catch (e) {
-        return {
-            ok: false,
-            error: simulationError(`could not build permit evaluation context: ${e.message}`),
-        };
-    }
-    // `predicate === null` means the policy is OZ-only (no interpreter
-    // predicate). We still emit the envelope so the review card + verifier
-    // can consume it: the permit verdict evaluates an always-permit empty
-    // tree, and the deny battery is empty (nothing to verify at the
-    // interpreter layer).
-    const evaluatePredicate = predicate ?? { op: 'and', children: [] };
-    const evaluatedCases = [];
-    let permitVerdict;
-    try {
-        permitVerdict = evaluate(evaluatePredicate, permitCtx);
-    }
-    catch (e) {
-        return {
-            ok: false,
-            error: simulationError(`permit evaluation threw at runtime: ${e.message}`, e),
-        };
-    }
-    evaluatedCases.push({
-        dimension: 'permit',
-        outcome: permitVerdict.permit ? 'permit' : 'deny',
-        reason: permitVerdict.permit ? 'matches recorded call' : permitVerdict.reason,
-    });
-    // The deny battery is generated against the SAME permit context. A
-    // runtime evaluation failure on ANY deny case is a `SIMULATION_ERROR` -
-    // not a deny verdict (an evaluate-throws is not a deny) and not a
-    // minimality problem.
-    const cases = generateCases(evaluatePredicate, permitCtx);
-    for (const deny of cases.denies) {
-        let result;
-        try {
-            result = evaluate(evaluatePredicate, deny.ctx);
-        }
-        catch (e) {
-            return {
-                ok: false,
-                error: simulationError(`deny case "${deny.dimension}" threw at runtime: ${e.message}`, e),
-            };
-        }
-        evaluatedCases.push({
-            dimension: deny.dimension,
-            outcome: result.permit ? 'permit' : 'deny',
-            reason: result.permit ? 'no matching deny' : result.reason,
-        });
-    }
-    const envelope = {
-        permit: permitVerdict.permit ? { tx: 'permit' } : { tx: 'deny', reason: permitVerdict.reason },
-        evaluatedCases,
-        backend: 'ts-model',
-        simulatorVersion: SIMULATOR_VERSION,
-    };
-    return { ok: true, data: envelope };
-}
-/** Build the permit `EvalContext` the simulator drives. Mirrors the
- *  helper in `synthesize-from-recording.ts` so the simulator sees the same
- *  shape the orchestrator's self-verify pipeline sees; we mirror here
- *  rather than import to keep `src/verify/` decoupled from the
- *  orchestrator's private helpers. The shape is pinned by tests so the
- *  two implementations stay in lockstep. */
-function buildPermitContext(predicate, tx, topLevel, opts) {
-    const amountByToken = {};
-    const totals = new Map();
-    for (const m of tx.tokenMovements) {
-        const current = totals.get(m.token) ?? 0n;
-        totals.set(m.token, current + BigInt(m.amount));
-    }
-    for (const [token, total] of totals) {
-        amountByToken[token] = total.toString();
-    }
-    // Oracle prices: when the caller supplies a fixture, use it; otherwise
-    // derive a satisfying entry per `oracle_price` leaf in the predicate so
-    // the permit call permits. Negatives are clamped at 0 (Stellar oracle
-    // prices are non-negative).
-    const oraclePriceByAsset = {};
-    if (opts.oraclePricesByAsset) {
-        for (const [asset, entry] of Object.entries(opts.oraclePricesByAsset)) {
-            oraclePriceByAsset[asset] = entry;
-        }
-    }
-    if (predicate !== null) {
-        visitOracleLeaves(predicate, (asset, op, bound) => {
-            // A caller-supplied fixture entry always wins; we only fill gaps.
-            if (oraclePriceByAsset[asset] !== undefined)
-                return;
-            let price;
-            switch (op) {
-                case 'lt':
-                case 'gt':
-                    price = op === 'lt' ? bound - 1n : bound + 1n;
-                    break;
-                case 'lte':
-                case 'gte':
-                case 'eq':
-                    price = bound;
-                    break;
-            }
-            if (price < 0n)
-                price = 0n;
-            oraclePriceByAsset[asset] = {
-                price: price.toString(),
-                timestampSeconds: tx.fetchedAt,
-            };
-        });
-    }
-    const ctx = {
-        contract: topLevel.contract,
-        fn: topLevel.fn,
-        args: topLevel.args.map(cloneScVal),
-        atLedger: tx.ledgerSequence,
-        nowSeconds: tx.fetchedAt,
-        amountByToken,
-        windowSpentByToken: {},
-        invocationCountByWindow: {},
-        oraclePriceByAsset,
-    };
-    if (opts.validUntilLedger !== undefined) {
-        ctx.validUntilLedger = opts.validUntilLedger;
-    }
-    return ctx;
-}
-function cloneScVal(value, depth = 0) {
-    // Recursion is bounded by MAX_SCVAL_CLONE_DEPTH so a hand-crafted nested-vec
-    // payload cannot RangeError the JS stack during context building. Over-depth
-    // throws a ToolError-shaped error that the simulator's existing try/catch
-    // converts to a structured `{ok:false, error}` (not a thrown RangeError).
-    if (value.type === 'vec') {
-        if (depth >= MAX_SCVAL_CLONE_DEPTH) {
-            throw cloneDepthError(value);
-        }
-        return { type: 'vec', value: value.value.map((v) => cloneScVal(v, depth + 1)) };
-    }
-    return { ...value };
-}
-function cloneDepthError(value) {
-    const err = new Error(`ScVal clone depth exceeds MAX_SCVAL_CLONE_DEPTH (${MAX_SCVAL_CLONE_DEPTH})`);
-    err.code = 'SIMULATION_ERROR';
-    err.severity = 'error';
-    err.retryable = false;
-    err.depthContext = value.type;
-    throw err;
-}
-function visitOracleLeaves(node, visit) {
-    switch (node.op) {
-        case 'and':
-        case 'or':
-            for (const child of node.children)
-                visitOracleLeaves(child, visit);
-            return;
-        case 'not':
-            visitOracleLeaves(node.child, visit);
-            return;
-        case 'eq':
-        case 'lt':
-        case 'lte':
-        case 'gt':
-        case 'gte': {
-            const leftLeaf = node.left;
-            const rightLeaf = node.right;
-            let oracleAsset;
-            let literal;
-            if (leftLeaf.kind === 'oracle_price') {
-                oracleAsset = leftLeaf.asset;
-                literal = oracleLiteralFromLeaf(rightLeaf);
-            }
-            else if (rightLeaf.kind === 'oracle_price') {
-                oracleAsset = rightLeaf.asset;
-                literal = oracleLiteralFromLeaf(leftLeaf);
-            }
-            if (oracleAsset === undefined || literal === undefined)
-                return;
-            visit(oracleAsset, node.op, literal);
-            return;
-        }
-        case 'in':
-            return;
-    }
-}
-function oracleLiteralFromLeaf(leaf) {
-    if (leaf.kind !== 'literal_i128')
-        return undefined;
-    try {
-        return BigInt(leaf.value);
-    }
-    catch {
-        return undefined;
-    }
-}
-function simulationError(message, cause) {
-    const error = {
-        code: 'SIMULATION_ERROR',
-        message,
-        severity: 'error',
-        retryable: false,
-    };
-    if (cause !== undefined)
-        error.details = { cause: String(cause) };
-    return error;
-}

package/dist/verify/verify.d.ts

@@ -1,21 +0,0 @@
-import type { ToolResponse } from '../errors.ts';
-import type { PredicateNode, RecordedTransaction } from '../types.ts';
-/** Options for `verifyPolicy`. Mirrors the orchestrator's permit-context
- *  knobs (expiry; oracle fixture) so verify sees the same shape
- *  `simulatePolicy` sees. */
-export interface VerifyOptions {
-    validUntilLedger?: number;
-    oraclePricesByAsset?: Record<string, {
-        price: string;
-        timestampSeconds: number;
-    } | {
-        error: 'stale' | 'missing' | 'deviation' | 'paused' | 'decimals' | 'fingerprint';
-    }>;
-}
-/** Run the static minimality check on a proposed predicate + recorded tx.
- *  Returns `{ ok: true }` when the predicate is minimal (every top-level
- *  conjunct carries load) and `VERIFICATION_FAILED` when a conjunct could
- *  be dropped without losing a deny-case. The dropped conjuncts are
- *  reported in `details.droppedConstraints` so the caller can render a
- *  review-card warning. */
-export declare function verifyPolicy(predicate: PredicateNode, permitTx: RecordedTransaction, opts?: VerifyOptions): ToolResponse<true>;