@crediolabs/policy-synth 0.2.0 → 0.3.1

package/dist-cjs/synth/evaluate.js

@@ -1,554 +0,0 @@
-"use strict";
-// src/synth/evaluate.ts - the model evaluator (TS model of interpreter semantics).
-//
-// Pure function. Determinism: same `(predicate, ctx)` -> byte-identical result,
-// no clock, no randomness. Deny order (deny on FIRST violation, stable reason):
-//   1. ledger expiry                                         -> 'EXPIRED'
-//   2. `now` past valid_until                                 -> 'EXPIRED'
-//   3. contract mismatch                                     -> 'CONTRACT_SCOPE'
-//   4. per-ScVal equality on fn/args; EXACT ordered vector
-//      equality; fail-closed on opaque args                   -> 'ARG_MISMATCH' / 'FN_MISMATCH'
-//   5. `in` membership; empty haystack ALWAYS denies         -> 'NOT_IN_ALLOWLIST'
-//   6. amount / window_spent via BigInt                       -> 'AMOUNT_BOUND'
-//   7. invocation_count_in_window                            -> 'FREQUENCY'
-//   8. oracle_price: fatal -> throw OracleError, deny with
-//      underlying ORACLE_* reason                             -> 'ORACLE_*'
-//   9. boolean nodes (and/or/not)
-//  10. signer threshold gate                                  -> 'THRESHOLD_NOT_MET'
-//  11. otherwise permit.
-//
-// Amounts: BigInt on decimal strings. Oracle errors thrown (never
-// boolean-false `not`/`or` could mask).
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.evaluate = evaluate;
-const predicate_literals_ts_1 = require("./predicate-literals.js");
-/** Oracle prices normalise to this many decimals; mirrors NORMALISED_DECIMALS
- *  in oracle.rs. A threshold on any other basis must say so. */
-const NORMALISED_DECIMALS = 9;
-/** Mirrors MAX_ORACLE_THRESHOLD_DECIMALS in dsl.rs. */
-const MAX_ORACLE_THRESHOLD_DECIMALS = 18;
-/** Internal fatal thrown by the oracle path; caught at the top of `evaluate`
- *  and converted to the matching `ORACLE_*` deny reason. NOT a boolean-false
- *  that `not` / `or` could mask. */
-class OracleError extends Error {
-    code;
-    constructor(code) {
-        super(`oracle fatal: ${code}`);
-        this.code = code;
-    }
-}
-const ORACLE_ERROR_CODES = {
-    stale: 'ORACLE_STALE',
-    missing: 'ORACLE_MISSING',
-    deviation: 'ORACLE_DEVIATION_EXCEEDED',
-    paused: 'ORACLE_PAUSED',
-    decimals: 'ORACLE_DECIMALS_MISMATCH',
-    fingerprint: 'ORACLE_FINGERPRINT_DRIFT',
-};
-/** Evaluate a `PredicateNode` against the candidate call described by `ctx`.
- *  Pure function. Returns `{ permit: true }` or `{ permit: false; reason }`. */
-function evaluate(predicate, ctx) {
-    try {
-        // --- step 1: ledger-time expiry ---
-        if (ctx.validUntilLedger !== undefined && ctx.atLedger > ctx.validUntilLedger) {
-            return { permit: false, reason: 'EXPIRED' };
-        }
-        // --- step 2..9: predicate tree ---
-        const decision = walk(predicate, ctx);
-        // --- step 10: signer threshold gate (only when the predicate permitted) ---
-        if (decision.permit && ctx.signerWeights !== undefined) {
-            let totalWeight = 0n;
-            for (const w of Object.values(ctx.signerWeights)) {
-                // weights are non-negative integers; BigInt keeps the gate bounded
-                totalWeight += BigInt(w);
-            }
-            if (totalWeight === 0n)
-                return { permit: false, reason: 'THRESHOLD_NOT_MET' };
-        }
-        return decision;
-    }
-    catch (e) {
-        if (e instanceof OracleError) {
-            return { permit: false, reason: e.code };
-        }
-        throw e;
-    }
-}
-/** Walk the predicate tree. Returns the FIRST deny reason encountered on
- *  the active branch (so `and` fails-fast; `or` accepts the first permit). */
-function walk(node, ctx) {
-    switch (node.op) {
-        case 'and': {
-            let lastDeny = null;
-            for (const child of node.children) {
-                const r = walk(child, ctx);
-                if (!r.permit) {
-                    // deny-on-first: short-circuit on the failing child.
-                    return r;
-                }
-                lastDeny = r;
-            }
-            return lastDeny ?? { permit: true };
-        }
-        case 'or': {
-            let lastDeny = null;
-            for (const child of node.children) {
-                const r = walk(child, ctx);
-                if (r.permit)
-                    return r;
-                lastDeny = r;
-            }
-            return lastDeny ?? { permit: false, reason: 'NOT_IN_ALLOWLIST' };
-        }
-        case 'not': {
-            // `not` structurally inverts the child unless the child contains an
-            // oracle leaf (compile-time rule: no oracle leaf under not/or). A
-            // child `OracleError` is re-thrown to the catch at the top of `evaluate`.
-            const r = walk(node.child, ctx);
-            if (r.permit)
-                return { permit: false, reason: 'FN_MISMATCH' };
-            return { permit: true };
-        }
-        case 'eq':
-        case 'lt':
-        case 'lte':
-        case 'gt':
-        case 'gte':
-            return evalCompare(node.op, node.left, node.right, ctx);
-        case 'in':
-            return evalIn(node.needle, node.haystack, ctx);
-    }
-}
-/** Step 2..8: comparison leaf evaluation. */
-function evalCompare(op, left, right, ctx) {
-    // --- step 2: `now` vs `valid_until` semantics ---
-    if (left.kind === 'now' && right.kind === 'valid_until') {
-        const expired = op === 'gt' || op === 'gte' ? ctx.nowSeconds >= 0 : ctx.nowSeconds < 0;
-        // `valid_until` is modelled as a synthetic future timestamp far past
-        // `nowSeconds` so the only true-positive expired path is the `gt`/`gte`
-        // shapes callers actually write.
-        if (op === 'gt' || op === 'gte') {
-            if (ctx.nowSeconds > 0)
-                return { permit: false, reason: 'EXPIRED' };
-        }
-        else if (op === 'lt' || op === 'lte') {
-            return { permit: true };
-        }
-        return expired ? { permit: false, reason: 'EXPIRED' } : { permit: true };
-    }
-    if (right.kind === 'now' && left.kind === 'valid_until') {
-        return evalCompare(op, right, left, ctx);
-    }
-    // --- step 3: CONTRACT_SCOPE on call_contract eq ---
-    if (left.kind === 'call_contract' && op === 'eq') {
-        if (right.kind !== 'literal_address')
-            return { permit: false, reason: 'CONTRACT_SCOPE' };
-        return right.value === ctx.contract
-            ? { permit: true }
-            : { permit: false, reason: 'CONTRACT_SCOPE' };
-    }
-    // --- step 4a: call_fn equality ---
-    if (left.kind === 'call_fn' && op === 'eq') {
-        if (right.kind !== 'literal_symbol')
-            return { permit: false, reason: 'FN_MISMATCH' };
-        return right.value === ctx.fn ? { permit: true } : { permit: false, reason: 'FN_MISMATCH' };
-    }
-    // --- step 4b: call_arg comparison (eq / exact-vec, or an ordered numeric bound) ---
-    if (left.kind === 'call_arg') {
-        // The swap's canonical form is `call_arg[out] >= call_arg_scaled(in, num, den)`.
-        // Dispatched here so the floor's dedicated reason codes (ARITHMETIC_OVERFLOW
-        // -> SLIPPAGE_FLOOR) reach the user; routing the scaled RHS through the
-        // generic `evalArgOrderedCompare` would mask overflow as ARG_MISMATCH.
-        if (right.kind === 'call_arg_scaled') {
-            return evalScaledArgCompare(op, left, right, ctx);
-        }
-        const actual = ctx.args[left.index];
-        if (op !== 'eq')
-            return evalArgOrderedCompare(op, actual, right);
-        return evalArgEq(op, actual, right, ctx);
-    }
-    // --- step 4b': scaled leaf on the LEFT (`call_arg_scaled(in, num, den) <= call_arg[out]`).
-    // Symmetric form so a policy that phrases the floor either way works.
-    if (left.kind === 'call_arg_scaled') {
-        return evalScaledArgCompare(op, right, left, ctx);
-    }
-    // --- step 4c: call_arg_len: length of a vec-typed argument as u32.
-    // Fails closed on a non-vec / absent arg or a non-u32 literal.
-    if (left.kind === 'call_arg_len') {
-        const actual = ctx.args[left.index];
-        if (actual?.type !== 'vec')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (right.kind !== 'literal_u32')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.value.length === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    // --- step 4d: call_arg_field: value of a field in the map at element i of
-    // the vec at argument index. Fails closed on shape / type / range issues.
-    if (left.kind === 'call_arg_field') {
-        const actual = ctx.args[left.index];
-        if (actual?.type !== 'vec')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        const element = actual.value[left.element];
-        if (element?.type !== 'map')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (!Array.isArray(element.value))
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        const entry = element.value.find((e) => e.key === left.field);
-        if (!entry)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (op === 'eq')
-            return evalArgEq(op, entry.val, right, ctx);
-        return evalArgOrderedCompare(op, entry.val, right);
-    }
-    // --- step 6: AMOUNT_BOUND ---
-    if (left.kind === 'amount' && op !== 'eq') {
-        return evalAmountCompare(op, left.token, right, ctx, 'amountByToken');
-    }
-    if (left.kind === 'window_spent' && op !== 'eq') {
-        return evalWindowSpentCompare(op, left.token, right, ctx);
-    }
-    // `eq` on amount / window_spent not defined as a bound - fall through.
-    // --- step 7: FREQUENCY ---
-    if (left.kind === 'invocation_count_in_window') {
-        return evalFrequencyCompare(op, left.windowSecs, right, ctx);
-    }
-    // --- step 8: oracle_price (FATAL via throw) ---
-    if (left.kind === 'oracle_price') {
-        return evalOracleCompare(op, left.asset, right, ctx);
-    }
-    // Unknown leaf/op combination - structural fail-closed.
-    return { permit: false, reason: 'FN_MISMATCH' };
-}
-/** Step 4b: per-ScVal equality. Handles literal_vec as an EXACT ordered
- *  sequence: compare element-by-element in order; deny if length or any
- *  element differs. Opaque args (`type: 'other'`) fail closed. */
-function evalArgEq(op, actual, right, ctx) {
-    // eq(call_arg[i], literal_vec) -> EXACT ordered vector equality.
-    if (op === 'eq' && right.kind === 'literal_vec') {
-        if (actual?.type !== 'vec')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return compareVecExact(actual.value, right.elements, ctx)
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_address') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (actual.type === 'other')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'address' && actual.value === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_i128') {
-        if (actual?.type !== 'i128')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return BigInt(actual.value) === BigInt(right.value)
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_symbol') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'symbol' && actual.value === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_u32') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'u32' && actual.value === String(right.value)
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_u64') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'u64' && actual.value === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_bytes') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'bytes' && actual.value === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    // Anything else: fail closed on opacity (cannot decode the arg reliably).
-    if (!actual || actual.type === 'other')
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    return { permit: false, reason: 'ARG_MISMATCH' };
-}
-/** Step 4b': slippage-floor comparison. Mirrors the Rust `eval_scaled_arg_compare`:
- *  the scaled leaf is `args[index] * num / den` (truncating toward zero). On
- *  overflow or divide-by-zero deny with `ARITHMETIC_OVERFLOW`; a failed bound
- *  denies with `SLIPPAGE_FLOOR` (the dedicated reason) rather than the generic
- *  `ARG_MISMATCH`. A scaled-on-scaled compare denies `ARG_MISMATCH`
- *  (no definable semantics). The non-scaled operand must be numeric
- *  (`call_arg` carrying a number, or a numeric literal); else `ARG_MISMATCH`. */
-function evalScaledArgCompare(op, left, right, ctx) {
-    let scaled;
-    let other;
-    let scaledOnRight;
-    if (left.kind === 'call_arg_scaled') {
-        scaled = left;
-        other = right;
-        scaledOnRight = false;
-    }
-    else if (right.kind === 'call_arg_scaled') {
-        scaled = right;
-        other = left;
-        scaledOnRight = true;
-    }
-    else {
-        // Programming error in the dispatcher; fail closed.
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    // Out-of-bounds or non-numeric arg fails closed as ARG_MISMATCH (not
-    // SLIPPAGE_FLOOR) - a violated floor is the wrong code when the operand
-    // itself could not be read.
-    if (scaled.index >= ctx.args.length) {
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    const input = argNumericBigInt(ctx.args[scaled.index]);
-    if (input === null)
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    let num;
-    let den;
-    try {
-        num = BigInt(scaled.num);
-        den = BigInt(scaled.den);
-    }
-    catch {
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    // Install refuses `den == 0` and `num <= 0` / `den <= 0`. The runtime
-    // check is defensive belt-and-braces so a validator regression cannot
-    // panic the frame on a divide-by-zero.
-    if (den === 0n)
-        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
-    const product = input * num;
-    let scaledValue;
-    try {
-        // BigInt division truncates toward zero (matches Rust `i128::checked_div`).
-        scaledValue = product / den;
-    }
-    catch {
-        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
-    }
-    // i128 range check: the contract would have wrapped on i128 arithmetic;
-    // surface the same deny.
-    const I128_MAX = (1n << 127n) - 1n;
-    const I128_MIN = -(1n << 127n);
-    if (scaledValue > I128_MAX || scaledValue < I128_MIN) {
-        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
-    }
-    let otherVal;
-    if (other.kind === 'call_arg') {
-        otherVal = argNumericBigInt(ctx.args[other.index]);
-    }
-    else {
-        otherVal = (0, predicate_literals_ts_1.literalNumericBigInt)(other);
-    }
-    if (otherVal === null)
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    const pass = scaledOnRight
-        ? bigintCmp(op, otherVal.toString(), scaledValue.toString())
-        : bigintCmp(op, scaledValue.toString(), otherVal.toString());
-    return pass ? { permit: true } : { permit: false, reason: 'SLIPPAGE_FLOOR' };
-}
-/** Ordered numeric comparison (lt/lte/gt/gte) on a `call_arg`. The interpreter
- *  reads the arg as an integer (i128 / u64 / u32 on the recorder's ScVal
- *  surface) and compares it to a numeric literal via BigInt. A non-numeric arg
- *  or a non-numeric literal fails closed (ARG_MISMATCH) rather than permitting
- *  an undecidable bound. Backs the SoroSwap input-amount cap
- *  (`call_arg[0] <= limit`). */
-function evalArgOrderedCompare(op, actual, right) {
-    const actualInt = argNumericBigInt(actual);
-    const literalInt = (0, predicate_literals_ts_1.literalNumericBigInt)(right);
-    if (actualInt === null || literalInt === null) {
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    return bigintCmp(op, actualInt.toString(), literalInt.toString())
-        ? { permit: true }
-        : { permit: false, reason: 'ARG_MISMATCH' };
-}
-/** BigInt value of a numeric-integer ScVal arg (i128 / u64 / u32), or null when
- *  the arg is absent, opaque, or a non-numeric type. */
-function argNumericBigInt(actual) {
-    if (!actual)
-        return null;
-    if (actual.type === 'i128' || actual.type === 'u64' || actual.type === 'u32') {
-        try {
-            return BigInt(actual.value);
-        }
-        catch {
-            return null;
-        }
-    }
-    return null;
-}
-/** Element-by-element ordered comparison of an `ScVal[]` against a
- *  `PredicateLeaf[]`. Equal-length and equal at every index => permit.
- *  Length mismatch OR any element mismatch => deny ARG_MISMATCH. */
-function compareVecExact(actual, expected, ctx) {
-    if (actual.length !== expected.length)
-        return false;
-    for (let i = 0; i < expected.length; i++) {
-        const e = expected[i];
-        const a = actual[i];
-        if (!e || !a)
-            return false;
-        const r = evalArgEq('eq', a, e, ctx);
-        if (!r.permit)
-            return false;
-    }
-    return true;
-}
-/** Step 5: `in` membership. Empty haystack ALWAYS denies. Opaque needle
- *  fails closed. */
-function evalIn(needle, haystack, ctx) {
-    if (haystack.length === 0)
-        return { permit: false, reason: 'NOT_IN_ALLOWLIST' };
-    const actual = resolveLeaf(needle, ctx);
-    if (!actual || actual.type === 'other')
-        return { permit: false, reason: 'NOT_IN_ALLOWLIST' };
-    for (const h of haystack) {
-        const r = evalArgEq('eq', actual, h, ctx);
-        if (r.permit)
-            return { permit: true };
-    }
-    return { permit: false, reason: 'NOT_IN_ALLOWLIST' };
-}
-/** Resolve a selector leaf to its current ScVal against the candidate call. */
-function resolveLeaf(leaf, ctx) {
-    switch (leaf.kind) {
-        case 'call_contract':
-            return { type: 'address', value: ctx.contract };
-        case 'call_fn':
-            return { type: 'symbol', value: ctx.fn };
-        case 'call_arg':
-            return ctx.args[leaf.index];
-        case 'call_arg_len':
-            // No direct ScVal projection: the length is an integer the comparator
-            // resolves against the right-hand literal. Returning undefined keeps
-            // the `in` membership path structurally informed (no haystack match).
-            return undefined;
-        case 'call_arg_field': {
-            const actual = ctx.args[leaf.index];
-            if (actual?.type !== 'vec')
-                return undefined;
-            const element = actual.value[leaf.element];
-            if (element?.type !== 'map')
-                return undefined;
-            if (!Array.isArray(element.value))
-                return undefined;
-            const entry = element.value.find((e) => e.key === leaf.field);
-            return entry ? entry.val : undefined;
-        }
-        case 'amount':
-        case 'window_spent':
-        case 'oracle_price':
-        case 'invocation_count_in_window':
-        case 'now':
-        case 'valid_until':
-        case 'call_arg_scaled':
-            return undefined; // selector leaves with no ScVal projection
-        case 'literal_address':
-            return { type: 'address', value: leaf.value };
-        case 'literal_i128':
-            return { type: 'i128', value: leaf.value };
-        case 'literal_symbol':
-            return { type: 'symbol', value: leaf.value };
-        case 'literal_u32':
-            return { type: 'u32', value: String(leaf.value) };
-        case 'literal_u64':
-            return { type: 'u64', value: leaf.value };
-        case 'literal_bytes':
-            return { type: 'bytes', value: leaf.value };
-        case 'literal_vec':
-            return undefined;
-    }
-}
-/** Step 6: amount / window_spent compare on BigInt. Both leaves compare a
- *  per-token BigInt record (current vs. rolling) to an i128 literal; the
- *  compare + denial reason are identical, so a single helper handles both. */
-function evalAmountCompare(op, token, right, ctx, record) {
-    const literal = right.kind === 'literal_i128' ? right.value : null;
-    if (literal === null)
-        return { permit: false, reason: 'AMOUNT_BOUND' };
-    const actual = ctx[record][token] ?? '0';
-    return bigintCmp(op, actual, literal)
-        ? { permit: true }
-        : { permit: false, reason: 'AMOUNT_BOUND' };
-}
-/** Step 6: window_spent compare on BigInt. */
-function evalWindowSpentCompare(op, token, right, ctx) {
-    return evalAmountCompare(op, token, right, ctx, 'windowSpentByToken');
-}
-/** Step 7: invocation_count_in_window compare. */
-function evalFrequencyCompare(op, windowSecs, right, ctx) {
-    const literal = right.kind === 'literal_u32' ? String(right.value) : null;
-    if (literal === null)
-        return { permit: false, reason: 'FREQUENCY' };
-    const actual = String(ctx.invocationCountByWindow[windowSecs] ?? 0);
-    return bigintCmp(op, actual, literal) ? { permit: true } : { permit: false, reason: 'FREQUENCY' };
-}
-/** Step 8: oracle_price compare. Reads `ctx.oraclePriceByAsset[asset]`. Any
- *  error entry OR a missing key throws `OracleError` (FATAL). A satisfied
- *  compare permits. */
-function evalOracleCompare(op, asset, right, ctx) {
-    const entry = ctx.oraclePriceByAsset[asset];
-    if (!entry)
-        throw new OracleError('ORACLE_STALE');
-    if ('error' in entry) {
-        const mapped = ORACLE_ERROR_CODES[entry.error];
-        if (!mapped)
-            throw new OracleError('ORACLE_STALE');
-        throw new OracleError(mapped);
-    }
-    // Mirrors eval_oracle_compare in dsl.rs. The threshold MUST declare its
-    // decimal basis: prices are on the normalised 9-dp basis, and a bare literal
-    // is refused (not assumed) because a raw 14-dp threshold that assumed the
-    // 9-dp basis would permit everything.
-    if (right.kind !== 'oracle_threshold')
-        throw new OracleError('ORACLE_DECIMALS_MISMATCH');
-    if (right.decimals > MAX_ORACLE_THRESHOLD_DECIMALS) {
-        throw new OracleError('ORACLE_THRESHOLD_DECIMALS_OUT_OF_RANGE');
-    }
-    // Scale BOTH sides up to the wider basis; dividing the threshold down
-    // truncates and moves the permit boundary.
-    const decimals = BigInt(right.decimals);
-    const normalised = BigInt(NORMALISED_DECIMALS);
-    const common = decimals > normalised ? decimals : normalised;
-    const priceScaled = BigInt(entry.price) * 10n ** (common - normalised);
-    const literalScaled = BigInt(right.value) * 10n ** (common - decimals);
-    // A violated oracle threshold is a stateful bound (Rust dsl.rs:276 returns
-    // `DenyReason::StatefulBound`, deny code #104). The TS evaluator must mirror
-    // the same reason so a future TS/Rust reason divergence fails CI; the
-    // cross-layer harness in this file now asserts reason codes match.
-    return bigintCmp(op, String(priceScaled), String(literalScaled))
-        ? { permit: true }
-        : { permit: false, reason: 'STATEFUL_BOUND' };
-}
-/** BigInt compare helper. `eq` is also supported by callers (selector-vs-literal
- *  equal checks), but the dedicated arg path uses it via `BigInt(actual) === BigInt(right)`. */
-function bigintCmp(op, aStr, bStr) {
-    const a = BigInt(aStr);
-    const b = BigInt(bStr);
-    switch (op) {
-        case 'eq':
-            return a === b;
-        case 'lt':
-            return a < b;
-        case 'lte':
-            return a <= b;
-        case 'gt':
-            return a > b;
-        case 'gte':
-            return a >= b;
-    }
-}

package/dist-cjs/synth/harness.d.ts

@@ -1,28 +0,0 @@
-import type { PredicateNode } from '../types.ts';
-import type { GeneratedCases } from './deny-cases.ts';
-export interface HarnessFailure {
-    dimension: string;
-    expected: 'permit' | 'deny';
-    got: 'permit' | 'deny';
-    reason?: string;
-    /** When `expectedReason` is set on the deny case and the case actually
-     *  denies, this carries the canonical reason the TS evaluator MUST emit
-     *  to stay in lockstep with the Rust interpreter (the cross-layer
-     *  reason-code contract). A future TS/Rust reason divergence surfaces
-     *  here in CI. */
-    expectedReason?: string;
-    actualReason?: string;
-}
-export type HarnessResult = {
-    ok: true;
-} | {
-    ok: false;
-    failures: HarnessFailure[];
-};
-/** Evaluate the intended call and every generated denial without side effects.
- *  Asserts both the boolean decision AND, for deny cases that carry an
- *  `expectedReason`, the concrete reason the TS evaluator emits. The reason
- *  is what the Rust interpreter returns; the cross-layer conformance test in
- *  `contracts/policy-interpreter/tests/conformance` mirrors the same contract
- *  for the verifyLive path. */
-export declare function runHarness(predicate: PredicateNode, cases: GeneratedCases): HarnessResult;

package/dist-cjs/synth/harness.js

@@ -1,50 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runHarness = runHarness;
-const evaluate_ts_1 = require("./evaluate.js");
-/** Evaluate the intended call and every generated denial without side effects.
- *  Asserts both the boolean decision AND, for deny cases that carry an
- *  `expectedReason`, the concrete reason the TS evaluator emits. The reason
- *  is what the Rust interpreter returns; the cross-layer conformance test in
- *  `contracts/policy-interpreter/tests/conformance` mirrors the same contract
- *  for the verifyLive path. */
-function runHarness(predicate, cases) {
-    const failures = [];
-    const permitResult = (0, evaluate_ts_1.evaluate)(predicate, cases.permit);
-    if (!permitResult.permit) {
-        failures.push({
-            dimension: 'PERMIT_CASE_FAILED',
-            expected: 'permit',
-            got: 'deny',
-            reason: permitResult.reason,
-        });
-    }
-    for (const deny of cases.denies) {
-        const result = (0, evaluate_ts_1.evaluate)(predicate, deny.ctx);
-        if (result.permit) {
-            failures.push({
-                dimension: deny.dimension,
-                expected: 'deny',
-                got: 'permit',
-                reason: 'DENY_CASE_FAILURE',
-            });
-            continue;
-        }
-        // Reason-code assertion (cross-layer contract). When a deny case carries
-        // an expected reason, the TS evaluator MUST emit that exact string; a
-        // divergence means the TS model and the Rust interpreter disagree on
-        // what the user sees in CI - the harness fails so the diff is visible
-        // here, not at runtime in production.
-        if (deny.expectedReason !== undefined && result.reason !== deny.expectedReason) {
-            failures.push({
-                dimension: deny.dimension,
-                expected: 'deny',
-                got: 'deny',
-                reason: 'REASON_MISMATCH',
-                expectedReason: deny.expectedReason,
-                actualReason: result.reason,
-            });
-        }
-    }
-    return failures.length === 0 ? { ok: true } : { ok: false, failures };
-}

package/dist-cjs/synth/minimize.d.ts

@@ -1,4 +0,0 @@
-import type { PredicateNode } from '../types.ts';
-import type { EvalContext } from './evaluate.ts';
-/** Remove top-level conjuncts only when the current and regenerated batteries still deny. */
-export declare function minimize(predicate: PredicateNode, permitCtx: EvalContext, dimensions?: string[]): PredicateNode;

package/dist-cjs/synth/minimize.js

@@ -1,41 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.minimize = minimize;
-const deny_cases_ts_1 = require("./deny-cases.js");
-const harness_ts_1 = require("./harness.js");
-/** Remove top-level conjuncts only when the current and regenerated batteries still deny. */
-function minimize(predicate, permitCtx, dimensions) {
-    if (predicate.op !== 'and')
-        return predicate;
-    let children = [...predicate.children];
-    let index = 0;
-    while (index < children.length) {
-        const current = { op: 'and', children };
-        const currentCases = (0, deny_cases_ts_1.generateCases)(current, permitCtx, dimensions);
-        const candidateChildren = children.filter((_, childIndex) => childIndex !== index);
-        const candidate = { op: 'and', children: candidateChildren };
-        const candidateCases = (0, deny_cases_ts_1.generateCases)(candidate, permitCtx, dimensions);
-        const verificationCases = {
-            permit: candidateCases.permit,
-            denies: mergeDenyCases(currentCases.denies, candidateCases.denies),
-        };
-        if ((0, harness_ts_1.runHarness)(candidate, verificationCases).ok) {
-            children = candidateChildren;
-            continue;
-        }
-        index += 1;
-    }
-    return { op: 'and', children };
-}
-function mergeDenyCases(current, candidate) {
-    const merged = [];
-    const seen = new Set();
-    for (const deny of [...current, ...candidate]) {
-        const key = `${deny.dimension}:${JSON.stringify(deny.ctx)}`;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        merged.push(deny);
-    }
-    return merged;
-}