@crediolabs/policy-synth 0.2.0 → 0.3.1

package/dist-cjs/ir/index.js

@@ -1,3 +0,0 @@
-"use strict";
-// src/ir/index.ts - re-export the PolicyIR ("Policy Tree") types.
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist-cjs/ir/types.d.ts

@@ -1,140 +0,0 @@
-/** Comparison operator. Mirrors NEAR-V2 `CompOp`. */
-export type IRCompOp = 'eq' | 'lt' | 'lte' | 'gt' | 'gte';
-/** Boolean combinator. Mirrors NEAR-V2 `LogicOp`. */
-export type IRLogic = 'and' | 'or';
-/** Vector match mode for a repeated arg. Mirrors NEAR-V2 `VecMode`. */
-export type IRVecMode = 'all' | 'any';
-/** Scalar value type. Mirrors NEAR-V2 `ScValType`, superset for OZ. */
-export type IRScalarType = 'address' | 'i128' | 'u128' | 'u32' | 'u64' | 'i64' | 'symbol' | 'bytes' | 'bool';
-/** WHERE in the authorized call a value is read. NEAR-V2 selectors first, OZ
- *  extensions after (an adapter that cannot express an extension flags it). */
-export type IRSelector = {
-    kind: 'arg';
-    argIndex: number;
-    fieldIndex?: number;
-    vecMode?: IRVecMode;
-    scalarType: IRScalarType;
-} | {
-    kind: 'arg_len';
-    argIndex: number;
-} | {
-    kind: 'arg_field';
-    argIndex: number;
-    element: number;
-    field: string;
-    scalarType: IRScalarType;
-} | {
-    kind: 'calldata';
-    offset: number;
-    length: number;
-} | {
-    kind: 'value';
-} | {
-    kind: 'amount';
-    token: string;
-} | {
-    kind: 'window_spent';
-    token: string;
-    windowSeconds: number;
-} | {
-    kind: 'invocation_count';
-    windowSeconds: number;
-} | {
-    kind: 'now';
-} | {
-    kind: 'valid_until';
-} | {
-    kind: 'oracle_price';
-    asset: string;
-};
-/** A single comparison leaf. `value` is a decimal/hex string (i128-safe;
- *  never a JS number). */
-export interface IRCompare {
-    selector: IRSelector;
-    operator: IRCompOp;
-    value: string;
-    /** Decimal basis of `value`, for selectors whose comparand is not on a basis
-     *  the contract can infer. Set for `oracle_price`, where prices normalise to
-     *  9 dp and an undeclared basis fails OPEN. */
-    valueDecimals?: number;
-}
-/** Condition tree. NEAR-V2 guard/constraint are flat And/Or; the IR allows
- *  nesting + `not` + `in` + `eq_seq` so the same IR can later lower to the OZ
- *  predicate DSL. Week-1 adapters only lower the flat supported subset and flag
- *  the rest. */
-export type IRCondition = {
-    op: 'and' | 'or';
-    children: IRCondition[];
-} | {
-    op: 'not';
-    child: IRCondition;
-} | {
-    op: 'compare';
-    compare: IRCompare;
-} | {
-    op: 'in';
-    selector: IRSelector;
-    values: string[];
-}
-/** Exact ordered sequence equality. The IR-level selector value MUST EQUAL
- *  `values` as an ORDERED sequence (e.g. a swap hop `path`). `in` is pure
- *  set membership and cannot express order; `eq_seq` is the construct that
- *  does. Adapters that cannot express an exact ordered vector (OZ built-ins)
- *  flag this as `uncovered` rather than silently dropping it. */
- | {
-    op: 'eq_seq';
-    selector: IRSelector;
-    values: string[];
-}
-/** A swap's output floor, expressed against its own input: the output arg
- *  must be at least `inArgIndex * num / den`.
- *
- *  It is its own construct because `compare` bounds a selector against a
- *  CONSTANT, and a slippage floor has no constant to bound against - the
- *  acceptable output depends on the input of the same call. Encoding the
- *  recorded output as a constant would pin a policy to one trade size.
- *
- *  `num/den` is the caller's minimum acceptable output per unit of input.
- *  It is never derived from the recording: the recorded rate is a price at
- *  one moment, and freezing it as policy would deny normal trades later.
- *  Adapters that cannot express it (the OZ built-ins) flag it `uncovered`. */
- | {
-    op: 'slippage_floor';
-    outArgIndex: number;
-    inArgIndex: number;
-    num: string;
-    den: string;
-};
-export interface IRPolicyRule {
-    /** NEAR-V2 roles whitelist (empty = any; owner exempt). */
-    roles: string[];
-    /** NEAR-V2 scope filter; each field optional (absent = wildcard). */
-    scope: {
-        chainId?: number;
-        contract?: string;
-        method?: string;
-    };
-    /** NEAR-V2 guard (applicability; skip the rule when it fails). */
-    guard?: IRCondition;
-    /** NEAR-V2 constraint (AND; reject the transaction when any fails). */
-    constraints: IRCondition[];
-    /** M-of-N approval (OZ threshold primitives). */
-    approval?: {
-        kind: 'threshold';
-        threshold: number;
-        weights?: Record<string, number>;
-    };
-    /** OZ context-rule expiry. */
-    expiry?: {
-        validUntilLedger?: number;
-        validUntilUnixSeconds?: number;
-    };
-}
-export interface PolicyIR {
-    /** NEAR-V2 PolicyChain. */
-    chain: 'stellar' | 'evm';
-    /** NEAR-V2 DefaultBehavior. OZ context rules are deny-by-default, so
-     *  `deny_all` is the OZ default fallback when no rule matches. */
-    defaultBehavior: 'allow_all' | 'deny_all';
-    rules: IRPolicyRule[];
-}

package/dist-cjs/ir/types.js

@@ -1,12 +0,0 @@
-"use strict";
-// src/ir/types.ts - the PolicyIR ("Policy Tree").
-//
-// `PolicyIR` is the custody-agnostic "Policy Tree" hub (the diagram's Policy
-// Tree) that every CustodyAdapter compiles FROM. It generalizes the NEAR-V2
-// policy schema (roles / scope filter / guard / constraint / comparison leaves /
-// default behaviour) into one chain-neutral shape and extends it with the
-// OZ-only selectors (spend window, oracle price, invocation count, time) so a
-// single IR can serve every backend. NEAR-V2 has no stateful spend window,
-// oracle, time/expiry, or invocation-count; those are marked as OZ extensions
-// below and are only lowered by adapters that declare support for them.
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist-cjs/mandate/index.d.ts

@@ -1,2 +0,0 @@
-export { mandateToPolicyIR } from './to-ir.ts';
-export type { MandateSpec } from './types.ts';

package/dist-cjs/mandate/index.js

@@ -1,6 +0,0 @@
-"use strict";
-// src/mandate/index.ts - re-export the Mandate source.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mandateToPolicyIR = void 0;
-var to_ir_ts_1 = require("./to-ir.js");
-Object.defineProperty(exports, "mandateToPolicyIR", { enumerable: true, get: function () { return to_ir_ts_1.mandateToPolicyIR; } });

package/dist-cjs/mandate/to-ir.d.ts

@@ -1,3 +0,0 @@
-import type { PolicyIR } from '../ir/types.ts';
-import type { MandateSpec } from './types.ts';
-export declare function mandateToPolicyIR(spec: MandateSpec): PolicyIR;

package/dist-cjs/mandate/to-ir.js

@@ -1,63 +0,0 @@
-"use strict";
-// src/mandate/to-ir.ts - deterministic lowering of a MandateSpec to a PolicyIR.
-//
-// `mandateToPolicyIR` is pure and total: the same spec always lowers to a
-// byte-identical PolicyIR. No decoding, no inference, no clock. Each mandate
-// field maps to exactly one IR construct:
-//   contract/method  -> rule.scope
-//   spendingLimit    -> a `window_spent(token,window) <= limit` compare
-//   approvalThreshold-> rule.approval.threshold
-//   recipients       -> an `in` condition on the recipient arg (flagged as not
-//                       covered by the OZ adapter; that is expected)
-//   expiry           -> rule.expiry
-// The top-level default is `deny_all` (OZ context rules are deny-by-default).
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mandateToPolicyIR = mandateToPolicyIR;
-/** Arg index the recipient allowlist constrains. Pinned to the SEP-41
- *  `transfer(from, to, amount)` convention where `to` is arg 1. This condition
- *  is flagged as not covered by the OZ adapter (no built-in primitive expresses
- *  an arg allowlist), so the index only needs to be deterministic in week-1. */
-const RECIPIENT_ARG_INDEX = 1;
-function mandateToPolicyIR(spec) {
-    const scope = { contract: spec.contract };
-    if (spec.method !== undefined)
-        scope.method = spec.method;
-    const constraints = [];
-    if (spec.spendingLimit) {
-        constraints.push({
-            op: 'compare',
-            compare: {
-                selector: {
-                    kind: 'window_spent',
-                    token: spec.spendingLimit.token,
-                    windowSeconds: spec.spendingLimit.windowSeconds,
-                },
-                operator: 'lte',
-                value: spec.spendingLimit.limit,
-            },
-        });
-    }
-    if (spec.recipients && spec.recipients.length > 0) {
-        const selector = {
-            kind: 'arg',
-            argIndex: RECIPIENT_ARG_INDEX,
-            scalarType: 'address',
-        };
-        constraints.push({ op: 'in', selector, values: [...spec.recipients] });
-    }
-    const rule = { roles: [], scope, constraints };
-    if (spec.approvalThreshold !== undefined) {
-        rule.approval = { kind: 'threshold', threshold: spec.approvalThreshold };
-    }
-    if (spec.expiry) {
-        const expiry = {};
-        if (spec.expiry.validUntilLedger !== undefined) {
-            expiry.validUntilLedger = spec.expiry.validUntilLedger;
-        }
-        if (spec.expiry.validUntilUnixSeconds !== undefined) {
-            expiry.validUntilUnixSeconds = spec.expiry.validUntilUnixSeconds;
-        }
-        rule.expiry = expiry;
-    }
-    return { chain: spec.chain, defaultBehavior: 'deny_all', rules: [rule] };
-}

package/dist-cjs/mandate/types.d.ts

@@ -1,20 +0,0 @@
-export interface MandateSpec {
-    chain: 'stellar';
-    contract: string;
-    method?: string;
-    /** -> OZ `spending_limit` primitive. `limit` is an i128 decimal string. */
-    spendingLimit?: {
-        token: string;
-        limit: string;
-        windowSeconds: number;
-    };
-    /** -> OZ `simple_threshold` / `weighted_threshold` primitive. */
-    approvalThreshold?: number;
-    /** Recipient allowlist -> an `in` arg condition (not covered by an OZ built-in). */
-    recipients?: string[];
-    /** -> OZ context-rule expiry. */
-    expiry?: {
-        validUntilLedger?: number;
-        validUntilUnixSeconds?: number;
-    };
-}

package/dist-cjs/mandate/types.js

@@ -1,9 +0,0 @@
-"use strict";
-// src/mandate/types.ts - the deterministic Mandate source.
-//
-// A MandateSpec is a declarative policy statement: "this account may call this
-// contract, spending at most L per window, requiring M approvals, to these
-// recipients, until this expiry". It carries NO transaction to decode, NO
-// parseConfidence, and NO inference - it lowers deterministically to a
-// PolicyIR. It is the clean end-to-end demo path, co-equal with the recorder.
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist-cjs/seams/index.d.ts

@@ -1 +0,0 @@
-export type { ChainDecoder, CompileResult, CustodyAdapter, CustodyCapabilities, CustodyMode, PolicySource, SimulationResult, } from './types.ts';

package/dist-cjs/seams/index.js

@@ -1,3 +0,0 @@
-"use strict";
-// src/seams/index.ts - re-export the three custody-seam contracts.
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist-cjs/seams/types.d.ts

@@ -1,66 +0,0 @@
-import type { ToolResponse } from '../errors.ts';
-import type { PolicyIR } from '../ir/types.ts';
-import type { Network, ProposedPolicy, RecordedTransaction, ScVal } from '../types.ts';
-/** INPUT: something that produces a normalized RecordedTransaction. */
-export interface PolicySource {
-    readonly name: string;
-    capture(input: {
-        hash?: string;
-        xdr?: string;
-        network: Network;
-    }): Promise<ToolResponse<RecordedTransaction>>;
-}
-/** DECODE: chain-specific call data -> the normalized facts the synth reasons
- *  over. */
-export interface ChainDecoder {
-    readonly chain: 'stellar' | 'evm';
-    decodeInvocation(tx: RecordedTransaction): {
-        contract: string;
-        method: string;
-        args: ScVal[];
-    };
-}
-/** OZ = enforce; `log_only` is reserved for shadow mode (out of scope). */
-export type CustodyMode = 'enforce' | 'log_only';
-/** What a backend can express. A construct needing a false flag is flagged
- *  `uncovered` by the adapter, never silently dropped. */
-export interface CustodyCapabilities {
-    supportsOraclePrice: boolean;
-    supportsSpendWindow: boolean;
-    supportsInvocationCount: boolean;
-    supportsTimeExpiry: boolean;
-    supportsThreshold: boolean;
-    supportsGeneralPredicate: boolean;
-}
-/** The result of compiling a PolicyIR for one backend. */
-export interface CompileResult {
-    /** false => some IR construct this backend cannot express (see `uncovered`). */
-    covered: boolean;
-    /** Human-readable list of unsupported constructs. */
-    uncovered: string[];
-    /** The backend-native installable policy, assembled when a rule lowered. */
-    proposed?: ProposedPolicy;
-}
-/** Result of a simulate() dry-run. `ts-model` is the off-chain TS evaluator.
- *  Real permit/deny semantics wiring is a later phase; week-1 returns a
- *  clearly-marked stub (empty `evaluations`, `permitted: null`). */
-export interface SimulationResult {
-    backend: 'ts-model';
-    /** Whether the permit tx would be allowed; null until real semantics land. */
-    permitted: boolean | null;
-    /** Per-construct evaluation trace; empty placeholder in this slice. */
-    evaluations: unknown[];
-    /** Diagnostics; marks the stub explicitly. */
-    notes: string[];
-}
-/** OUTPUT: compile a PolicyIR to a backend-specific installable policy. */
-export interface CustodyAdapter {
-    readonly name: string;
-    readonly mode: CustodyMode;
-    capabilities(): CustodyCapabilities;
-    compile(ir: PolicyIR): CompileResult;
-    /** Phase-03 wiring; a clearly-marked stub in week-1. */
-    simulate(ir: PolicyIR, permitTx: RecordedTransaction): SimulationResult;
-    /** Canonical JSON of the IR (portability / audit). */
-    export(ir: PolicyIR): string;
-}

package/dist-cjs/seams/types.js

@@ -1,12 +0,0 @@
-"use strict";
-// src/seams/types.ts - the three custody seams (contracts, not implementations).
-//
-// The synthesizer is decoupled from its edges by three seams:
-//   - PolicySource  (INPUT):  produces a normalized RecordedTransaction. The
-//                             recorder is the reference source; a MandateSpec
-//                             lowering is a second, deterministic source.
-//   - ChainDecoder  (DECODE): chain-specific call data -> normalized facts.
-//   - CustodyAdapter (OUTPUT): compile a PolicyIR to a backend-native policy +
-//                             verify/export it (OZ is the first adapter).
-// These are INTERFACES only. Implementations live in their own modules.
-Object.defineProperty(exports, "__esModule", { value: true });