@crediolabs/policy-synth 0.2.0 → 0.3.1

package/src/mandate/to-ir.ts

@@ -1,71 +0,0 @@
-// src/mandate/to-ir.ts - deterministic lowering of a MandateSpec to a PolicyIR.
-//
-// `mandateToPolicyIR` is pure and total: the same spec always lowers to a
-// byte-identical PolicyIR. No decoding, no inference, no clock. Each mandate
-// field maps to exactly one IR construct:
-//   contract/method  -> rule.scope
-//   spendingLimit    -> a `window_spent(token,window) <= limit` compare
-//   approvalThreshold-> rule.approval.threshold
-//   recipients       -> an `in` condition on the recipient arg (flagged as not
-//                       covered by the OZ adapter; that is expected)
-//   expiry           -> rule.expiry
-// The top-level default is `deny_all` (OZ context rules are deny-by-default).
-
-import type { IRCondition, IRPolicyRule, IRSelector, PolicyIR } from '../ir/types.ts'
-import type { MandateSpec } from './types.ts'
-
-/** Arg index the recipient allowlist constrains. Pinned to the SEP-41
- *  `transfer(from, to, amount)` convention where `to` is arg 1. This condition
- *  is flagged as not covered by the OZ adapter (no built-in primitive expresses
- *  an arg allowlist), so the index only needs to be deterministic in week-1. */
-const RECIPIENT_ARG_INDEX = 1
-
-export function mandateToPolicyIR(spec: MandateSpec): PolicyIR {
-  const scope: IRPolicyRule['scope'] = { contract: spec.contract }
-  if (spec.method !== undefined) scope.method = spec.method
-
-  const constraints: IRCondition[] = []
-
-  if (spec.spendingLimit) {
-    constraints.push({
-      op: 'compare',
-      compare: {
-        selector: {
-          kind: 'window_spent',
-          token: spec.spendingLimit.token,
-          windowSeconds: spec.spendingLimit.windowSeconds,
-        },
-        operator: 'lte',
-        value: spec.spendingLimit.limit,
-      },
-    })
-  }
-
-  if (spec.recipients && spec.recipients.length > 0) {
-    const selector: IRSelector = {
-      kind: 'arg',
-      argIndex: RECIPIENT_ARG_INDEX,
-      scalarType: 'address',
-    }
-    constraints.push({ op: 'in', selector, values: [...spec.recipients] })
-  }
-
-  const rule: IRPolicyRule = { roles: [], scope, constraints }
-
-  if (spec.approvalThreshold !== undefined) {
-    rule.approval = { kind: 'threshold', threshold: spec.approvalThreshold }
-  }
-
-  if (spec.expiry) {
-    const expiry: NonNullable<IRPolicyRule['expiry']> = {}
-    if (spec.expiry.validUntilLedger !== undefined) {
-      expiry.validUntilLedger = spec.expiry.validUntilLedger
-    }
-    if (spec.expiry.validUntilUnixSeconds !== undefined) {
-      expiry.validUntilUnixSeconds = spec.expiry.validUntilUnixSeconds
-    }
-    rule.expiry = expiry
-  }
-
-  return { chain: spec.chain, defaultBehavior: 'deny_all', rules: [rule] }
-}

package/src/mandate/types.ts

@@ -1,21 +0,0 @@
-// src/mandate/types.ts - the deterministic Mandate source.
-//
-// A MandateSpec is a declarative policy statement: "this account may call this
-// contract, spending at most L per window, requiring M approvals, to these
-// recipients, until this expiry". It carries NO transaction to decode, NO
-// parseConfidence, and NO inference - it lowers deterministically to a
-// PolicyIR. It is the clean end-to-end demo path, co-equal with the recorder.
-
-export interface MandateSpec {
-  chain: 'stellar'
-  contract: string
-  method?: string
-  /** -> OZ `spending_limit` primitive. `limit` is an i128 decimal string. */
-  spendingLimit?: { token: string; limit: string; windowSeconds: number }
-  /** -> OZ `simple_threshold` / `weighted_threshold` primitive. */
-  approvalThreshold?: number
-  /** Recipient allowlist -> an `in` arg condition (not covered by an OZ built-in). */
-  recipients?: string[]
-  /** -> OZ context-rule expiry. */
-  expiry?: { validUntilLedger?: number; validUntilUnixSeconds?: number }
-}

package/src/seams/index.ts

@@ -1,11 +0,0 @@
-// src/seams/index.ts - re-export the three custody-seam contracts.
-
-export type {
-  ChainDecoder,
-  CompileResult,
-  CustodyAdapter,
-  CustodyCapabilities,
-  CustodyMode,
-  PolicySource,
-  SimulationResult,
-} from './types.ts'

package/src/seams/types.ts

@@ -1,81 +0,0 @@
-// src/seams/types.ts - the three custody seams (contracts, not implementations).
-//
-// The synthesizer is decoupled from its edges by three seams:
-//   - PolicySource  (INPUT):  produces a normalized RecordedTransaction. The
-//                             recorder is the reference source; a MandateSpec
-//                             lowering is a second, deterministic source.
-//   - ChainDecoder  (DECODE): chain-specific call data -> normalized facts.
-//   - CustodyAdapter (OUTPUT): compile a PolicyIR to a backend-native policy +
-//                             verify/export it (OZ is the first adapter).
-// These are INTERFACES only. Implementations live in their own modules.
-
-import type { ToolResponse } from '../errors.ts'
-import type { PolicyIR } from '../ir/types.ts'
-import type { Network, ProposedPolicy, RecordedTransaction, ScVal } from '../types.ts'
-
-/** INPUT: something that produces a normalized RecordedTransaction. */
-export interface PolicySource {
-  readonly name: string
-  capture(input: {
-    hash?: string
-    xdr?: string
-    network: Network
-  }): Promise<ToolResponse<RecordedTransaction>>
-}
-
-/** DECODE: chain-specific call data -> the normalized facts the synth reasons
- *  over. */
-export interface ChainDecoder {
-  readonly chain: 'stellar' | 'evm'
-  decodeInvocation(tx: RecordedTransaction): { contract: string; method: string; args: ScVal[] }
-}
-
-/** OZ = enforce; `log_only` is reserved for shadow mode (out of scope). */
-export type CustodyMode = 'enforce' | 'log_only'
-
-/** What a backend can express. A construct needing a false flag is flagged
- *  `uncovered` by the adapter, never silently dropped. */
-export interface CustodyCapabilities {
-  supportsOraclePrice: boolean
-  supportsSpendWindow: boolean
-  supportsInvocationCount: boolean
-  supportsTimeExpiry: boolean
-  supportsThreshold: boolean
-  supportsGeneralPredicate: boolean
-}
-
-/** The result of compiling a PolicyIR for one backend. */
-export interface CompileResult {
-  /** false => some IR construct this backend cannot express (see `uncovered`). */
-  covered: boolean
-  /** Human-readable list of unsupported constructs. */
-  uncovered: string[]
-  /** The backend-native installable policy, assembled when a rule lowered. */
-  proposed?: ProposedPolicy
-}
-
-/** Result of a simulate() dry-run. `ts-model` is the off-chain TS evaluator.
- *  Real permit/deny semantics wiring is a later phase; week-1 returns a
- *  clearly-marked stub (empty `evaluations`, `permitted: null`). */
-export interface SimulationResult {
-  backend: 'ts-model'
-  /** Whether the permit tx would be allowed; null until real semantics land. */
-  permitted: boolean | null
-  /** Per-construct evaluation trace; empty placeholder in this slice. */
-  evaluations: unknown[]
-  /** Diagnostics; marks the stub explicitly. */
-  notes: string[]
-}
-
-/** OUTPUT: compile a PolicyIR to a backend-specific installable policy. */
-export interface CustodyAdapter {
-  readonly name: string
-  readonly mode: CustodyMode
-  capabilities(): CustodyCapabilities
-  compile(ir: PolicyIR): CompileResult
-  /** Phase-03 wiring; a clearly-marked stub in week-1. */
-  simulate(ir: PolicyIR, permitTx: RecordedTransaction): SimulationResult
-  /** Canonical JSON of the IR (portability / audit). */
-  export(ir: PolicyIR): string
-  // install(...) lands with a later phase; not part of this slice.
-}