@crediolabs/policy-synth 0.3.0 → 0.3.1

package/dist-cjs/synth/evaluate.js

@@ -1,274 +0,0 @@
-"use strict";
-// src/synth/evaluate.ts - TypeScript reference evaluator for grammar version 3.
-//
-// Pure function. Determinism: same `(predicate, ctx)` -> byte-identical result,
-// no clock, no randomness. Deny order (deny on FIRST violation, stable reason):
-//   1. contract mismatch                                     -> 'CONTRACT_SCOPE'
-//   2. per-ScVal equality on fn/args; EXACT ordered vector
-//      equality; fail-closed on opaque args                   -> 'ARG_MISMATCH'
-//   3. `in` membership; empty haystack ALWAYS denies         -> 'NOT_IN_ALLOWLIST'
-//   4. otherwise permit.
-//
-// Grammar version 3 nodes: and, eq, lte
-// Grammar version 3 leaves: call_contract, call_fn, call_arg(i),
-//   call_arg_len(i), call_arg_field(i, element, field),
-//   literal_address, literal_i128, literal_symbol, literal_u32, literal_vec
-// Grammar version 3 deny reasons: ARG_MISMATCH, CONTRACT_SCOPE,
-//   UNSUPPORTED_NODE, NOT_IN_ALLOWLIST
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.evaluate = evaluate;
-/** Evaluate a `PredicateNode` against the candidate call described by `ctx`.
- *  Pure function. Returns `{ permit: true }` or `{ permit: false; reason }`. */
-function evaluate(predicate, ctx) {
-    return walk(predicate, ctx);
-}
-/** Walk the predicate tree. Returns the FIRST deny reason encountered on
- *  the active branch (so `and` fails-fast). */
-function walk(node, ctx) {
-    switch (node.op) {
-        case 'and': {
-            let lastDeny = null;
-            for (const child of node.children) {
-                const r = walk(child, ctx);
-                if (!r.permit)
-                    return r;
-                lastDeny = r;
-            }
-            return lastDeny ?? { permit: true };
-        }
-        case 'eq':
-        case 'lte':
-            return evalCompare(node.op, node.left, node.right, ctx);
-        case 'in':
-            return evalIn(node.needle, node.haystack, ctx);
-    }
-}
-/** Comparison leaf evaluation. */
-function evalCompare(op, left, right, ctx) {
-    // CONTRACT_SCOPE on call_contract eq
-    if (left.kind === 'call_contract' && op === 'eq') {
-        if (right.kind !== 'literal_address')
-            return { permit: false, reason: 'CONTRACT_SCOPE' };
-        return right.value === ctx.contract
-            ? { permit: true }
-            : { permit: false, reason: 'CONTRACT_SCOPE' };
-    }
-    // call_fn equality
-    if (left.kind === 'call_fn' && op === 'eq') {
-        if (right.kind !== 'literal_symbol')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return right.value === ctx.fn ? { permit: true } : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    // call_arg comparison (eq / exact-vec, or lte ordered numeric bound)
-    if (left.kind === 'call_arg') {
-        const actual = ctx.args[left.index];
-        if (op !== 'eq')
-            return evalArgOrderedCompare(op, actual, right);
-        return evalArgEq(op, actual, right, ctx);
-    }
-    // call_arg_len: length of a vec-typed argument as u32.
-    // Fails closed on a non-vec / absent arg or a non-u32 literal.
-    if (left.kind === 'call_arg_len') {
-        const actual = ctx.args[left.index];
-        if (actual?.type !== 'vec')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (right.kind !== 'literal_u32')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.value.length === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    // call_arg_field: value of a field in the map at element i of
-    // the vec at argument index. Fails closed on shape / type / range issues.
-    if (left.kind === 'call_arg_field') {
-        const actual = ctx.args[left.index];
-        if (actual?.type !== 'vec')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        const element = actual.value[left.element];
-        if (element?.type !== 'map')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (!Array.isArray(element.value))
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        const entry = element.value.find((e) => e.key === left.field);
-        if (!entry)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (op === 'eq')
-            return evalArgEq(op, entry.val, right, ctx);
-        return evalArgOrderedCompare(op, entry.val, right);
-    }
-    // Unknown leaf/op combination - structural fail-closed.
-    return { permit: false, reason: 'UNSUPPORTED_NODE' };
-}
-/** Per-ScVal equality. Handles literal_vec as an EXACT ordered sequence:
- *  compare element-by-element in order; deny if length or any element differs.
- *  Opaque args (`type: 'other'`) fail closed. */
-function evalArgEq(op, actual, right, _ctx) {
-    // eq(call_arg[i], literal_vec) -> EXACT ordered vector equality.
-    if (op === 'eq' && right.kind === 'literal_vec') {
-        if (actual?.type !== 'vec')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return compareVecExact(actual.value, right.elements)
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_address') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        if (actual.type === 'other')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'address' && actual.value === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_i128') {
-        if (actual?.type !== 'i128')
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return BigInt(actual.value) === BigInt(right.value)
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_symbol') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'symbol' && actual.value === right.value
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    if (op === 'eq' && right.kind === 'literal_u32') {
-        if (!actual)
-            return { permit: false, reason: 'ARG_MISMATCH' };
-        return actual.type === 'u32' && actual.value === String(right.value)
-            ? { permit: true }
-            : { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    // Anything else: fail closed on opacity (cannot decode the arg reliably).
-    if (!actual || actual.type === 'other')
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    return { permit: false, reason: 'ARG_MISMATCH' };
-}
-/** Ordered numeric comparison (lte) on a `call_arg`. The interpreter reads the
- *  arg as an integer (i128 on the recorder's ScVal surface) and compares it
- *  to a numeric literal via BigInt. A non-numeric arg or a non-numeric literal
- *  fails closed (ARG_MISMATCH) rather than permitting an undecidable bound. */
-function evalArgOrderedCompare(op, actual, right) {
-    const actualInt = argNumericBigInt(actual);
-    const literalInt = literalNumericBigInt(right);
-    if (actualInt === null || literalInt === null) {
-        return { permit: false, reason: 'ARG_MISMATCH' };
-    }
-    return bigintCmp(op, actualInt.toString(), literalInt.toString())
-        ? { permit: true }
-        : { permit: false, reason: 'ARG_MISMATCH' };
-}
-/** BigInt value of a numeric-integer ScVal arg (i128 / u32), or null when
- *  the arg is absent, opaque, or a non-numeric type. */
-function argNumericBigInt(actual) {
-    if (!actual)
-        return null;
-    if (actual.type === 'i128' || actual.type === 'u32') {
-        try {
-            return BigInt(actual.value);
-        }
-        catch {
-            return null;
-        }
-    }
-    return null;
-}
-/** BigInt value of a numeric-integer literal leaf (`literal_i128` / `literal_u32`),
- *  or null for a non-numeric literal. Callers fail closed on null. */
-function literalNumericBigInt(leaf) {
-    switch (leaf.kind) {
-        case 'literal_i128':
-            try {
-                return BigInt(leaf.value);
-            }
-            catch {
-                return null;
-            }
-        case 'literal_u32':
-            return BigInt(leaf.value);
-        default:
-            return null;
-    }
-}
-/** Element-by-element ordered comparison of an `ScVal[]` against a
- *  `PredicateLeaf[]`. Equal-length and equal at every index => permit.
- *  Length mismatch OR any element mismatch => deny ARG_MISMATCH. */
-function compareVecExact(actual, expected) {
-    if (actual.length !== expected.length)
-        return false;
-    for (let i = 0; i < expected.length; i++) {
-        const e = expected[i];
-        const a = actual[i];
-        if (!e || !a)
-            return false;
-        const r = evalArgEq('eq', a, e, {});
-        if (!r.permit)
-            return false;
-    }
-    return true;
-}
-/** `in` membership. Empty haystack ALWAYS denies. Opaque needle fails closed. */
-function evalIn(needle, haystack, ctx) {
-    if (haystack.length === 0)
-        return { permit: false, reason: 'NOT_IN_ALLOWLIST' };
-    const actual = resolveLeaf(needle, ctx);
-    if (!actual || actual.type === 'other')
-        return { permit: false, reason: 'NOT_IN_ALLOWLIST' };
-    for (const h of haystack) {
-        const r = evalArgEq('eq', actual, h, ctx);
-        if (r.permit)
-            return { permit: true };
-    }
-    return { permit: false, reason: 'NOT_IN_ALLOWLIST' };
-}
-/** Resolve a selector leaf to its current ScVal against the candidate call. */
-function resolveLeaf(leaf, ctx) {
-    switch (leaf.kind) {
-        case 'call_contract':
-            return { type: 'address', value: ctx.contract };
-        case 'call_fn':
-            return { type: 'symbol', value: ctx.fn };
-        case 'call_arg':
-            return ctx.args[leaf.index];
-        case 'call_arg_len':
-            // No direct ScVal projection: the length is an integer the comparator
-            // resolves against the right-hand literal. Returning undefined keeps
-            // the `in` membership path structurally informed (no haystack match).
-            return undefined;
-        case 'call_arg_field': {
-            const actual = ctx.args[leaf.index];
-            if (actual?.type !== 'vec')
-                return undefined;
-            const element = actual.value[leaf.element];
-            if (element?.type !== 'map')
-                return undefined;
-            if (!Array.isArray(element.value))
-                return undefined;
-            const entry = element.value.find((e) => e.key === leaf.field);
-            return entry ? entry.val : undefined;
-        }
-        case 'literal_address':
-            return { type: 'address', value: leaf.value };
-        case 'literal_i128':
-            return { type: 'i128', value: leaf.value };
-        case 'literal_symbol':
-            return { type: 'symbol', value: leaf.value };
-        case 'literal_u32':
-            return { type: 'u32', value: String(leaf.value) };
-        case 'literal_vec':
-            return undefined;
-    }
-}
-/** BigInt compare helper. */
-function bigintCmp(op, aStr, bStr) {
-    const a = BigInt(aStr);
-    const b = BigInt(bStr);
-    switch (op) {
-        case 'eq':
-            return a === b;
-        case 'lte':
-            return a <= b;
-    }
-}

package/dist-cjs/synth/harness.d.ts

@@ -1,28 +0,0 @@
-import type { PredicateNode } from '../types.ts';
-import type { GeneratedCases } from './deny-cases.ts';
-export interface HarnessFailure {
-    dimension: string;
-    expected: 'permit' | 'deny';
-    got: 'permit' | 'deny';
-    reason?: string;
-    /** When `expectedReason` is set on the deny case and the case actually
-     *  denies, this carries the canonical reason the TS evaluator MUST emit
-     *  to stay in lockstep with the Rust interpreter (the cross-layer
-     *  reason-code contract). A future TS/Rust reason divergence surfaces
-     *  here in CI. */
-    expectedReason?: string;
-    actualReason?: string;
-}
-export type HarnessResult = {
-    ok: true;
-} | {
-    ok: false;
-    failures: HarnessFailure[];
-};
-/** Evaluate the intended call and every generated denial without side effects.
- *  Asserts both the boolean decision AND, for deny cases that carry an
- *  `expectedReason`, the concrete reason the TS evaluator emits. The reason
- *  is what the Rust interpreter returns; the cross-layer conformance test in
- *  `contracts/policy-interpreter/tests/conformance` mirrors the same contract
- *  for the verifyLive path. */
-export declare function runHarness(predicate: PredicateNode, cases: GeneratedCases): HarnessResult;

package/dist-cjs/synth/harness.js

@@ -1,50 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runHarness = runHarness;
-const evaluate_ts_1 = require("./evaluate.js");
-/** Evaluate the intended call and every generated denial without side effects.
- *  Asserts both the boolean decision AND, for deny cases that carry an
- *  `expectedReason`, the concrete reason the TS evaluator emits. The reason
- *  is what the Rust interpreter returns; the cross-layer conformance test in
- *  `contracts/policy-interpreter/tests/conformance` mirrors the same contract
- *  for the verifyLive path. */
-function runHarness(predicate, cases) {
-    const failures = [];
-    const permitResult = (0, evaluate_ts_1.evaluate)(predicate, cases.permit);
-    if (!permitResult.permit) {
-        failures.push({
-            dimension: 'PERMIT_CASE_FAILED',
-            expected: 'permit',
-            got: 'deny',
-            reason: permitResult.reason,
-        });
-    }
-    for (const deny of cases.denies) {
-        const result = (0, evaluate_ts_1.evaluate)(predicate, deny.ctx);
-        if (result.permit) {
-            failures.push({
-                dimension: deny.dimension,
-                expected: 'deny',
-                got: 'permit',
-                reason: 'DENY_CASE_FAILURE',
-            });
-            continue;
-        }
-        // Reason-code assertion (cross-layer contract). When a deny case carries
-        // an expected reason, the TS evaluator MUST emit that exact string; a
-        // divergence means the TS model and the Rust interpreter disagree on
-        // what the user sees in CI - the harness fails so the diff is visible
-        // here, not at runtime in production.
-        if (deny.expectedReason !== undefined && result.reason !== deny.expectedReason) {
-            failures.push({
-                dimension: deny.dimension,
-                expected: 'deny',
-                got: 'deny',
-                reason: 'REASON_MISMATCH',
-                expectedReason: deny.expectedReason,
-                actualReason: result.reason,
-            });
-        }
-    }
-    return failures.length === 0 ? { ok: true } : { ok: false, failures };
-}

package/dist-cjs/synth/minimize.d.ts

@@ -1,4 +0,0 @@
-import type { PredicateNode } from '../types.ts';
-import type { EvalContext } from './evaluate.ts';
-/** Remove top-level conjuncts only when the current and regenerated batteries still deny. */
-export declare function minimize(predicate: PredicateNode, permitCtx: EvalContext, dimensions?: string[]): PredicateNode;

package/dist-cjs/synth/minimize.js

@@ -1,41 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.minimize = minimize;
-const deny_cases_ts_1 = require("./deny-cases.js");
-const harness_ts_1 = require("./harness.js");
-/** Remove top-level conjuncts only when the current and regenerated batteries still deny. */
-function minimize(predicate, permitCtx, dimensions) {
-    if (predicate.op !== 'and')
-        return predicate;
-    let children = [...predicate.children];
-    let index = 0;
-    while (index < children.length) {
-        const current = { op: 'and', children };
-        const currentCases = (0, deny_cases_ts_1.generateCases)(current, permitCtx, dimensions);
-        const candidateChildren = children.filter((_, childIndex) => childIndex !== index);
-        const candidate = { op: 'and', children: candidateChildren };
-        const candidateCases = (0, deny_cases_ts_1.generateCases)(candidate, permitCtx, dimensions);
-        const verificationCases = {
-            permit: candidateCases.permit,
-            denies: mergeDenyCases(currentCases.denies, candidateCases.denies),
-        };
-        if ((0, harness_ts_1.runHarness)(candidate, verificationCases).ok) {
-            children = candidateChildren;
-            continue;
-        }
-        index += 1;
-    }
-    return { op: 'and', children };
-}
-function mergeDenyCases(current, candidate) {
-    const merged = [];
-    const seen = new Set();
-    for (const deny of [...current, ...candidate]) {
-        const key = `${deny.dimension}:${JSON.stringify(deny.ctx)}`;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        merged.push(deny);
-    }
-    return merged;
-}

package/dist-cjs/synth/permit-context.d.ts

@@ -1,8 +0,0 @@
-import type { RecordedTransaction } from '../types.ts';
-import type { EvalContext } from './evaluate.ts';
-export interface PermitContextResponses {
-    windowSeconds: number;
-    limitAmount?: string;
-    validUntilLedger: number;
-}
-export declare function buildPermitContext(tx: RecordedTransaction, responses: PermitContextResponses): EvalContext;

package/dist-cjs/synth/permit-context.js

@@ -1,38 +0,0 @@
-"use strict";
-// src/synth/permit-context.ts - build the EvalContext that represents the
-// recorded call being replayed.
-//
-// Extracted from the over-permissiveness harness so the same construction
-// feeds both the in-process battery and the on-chain replay
-// (scripts/verify-mutations-testnet.ts). Two callers building this
-// separately would be two chances to disagree about what "the recorded
-// call" means, which is the one thing both must share.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildPermitContext = buildPermitContext;
-const deny_cases_ts_1 = require("./deny-cases.js");
-function buildPermitContext(tx, responses) {
-    const amountByToken = {};
-    const totals = new Map();
-    for (const m of tx.tokenMovements) {
-        const current = totals.get(m.token) ?? 0n;
-        totals.set(m.token, current + BigInt(m.amount));
-    }
-    for (const [token, total] of totals) {
-        amountByToken[token] = total.toString();
-    }
-    const topLevel = tx.invocations[0];
-    const scopeContract = topLevel?.contract ?? '';
-    const ctx = {
-        contract: scopeContract,
-        fn: topLevel?.fn ?? '',
-        args: (topLevel?.args ?? []).map(deny_cases_ts_1.cloneScVal),
-        atLedger: tx.ledgerSequence,
-        nowSeconds: tx.fetchedAt,
-        amountByToken,
-        windowSpentByToken: {},
-    };
-    if (responses.validUntilLedger !== undefined) {
-        ctx.validUntilLedger = responses.validUntilLedger;
-    }
-    return ctx;
-}

package/dist-cjs/synth/predicate-literals.d.ts

@@ -1,5 +0,0 @@
-import type { PredicateLeaf } from '../types.ts';
-/** BigInt value of a numeric-integer literal leaf (`literal_i128` / `literal_u64`
- *  / `literal_u32`), or null for a non-numeric literal (address / symbol / bytes
- *  / vec). Callers fail closed on null. */
-export declare function literalNumericBigInt(leaf: PredicateLeaf): bigint | null;

package/dist-cjs/synth/predicate-literals.js

@@ -1,28 +0,0 @@
-"use strict";
-// src/synth/predicate-literals.ts - read scalar values out of predicate literal leaves.
-//
-// Small shared helpers for interpreting a `PredicateLeaf` literal. Kept out of
-// `evaluate.ts` so the evaluator stays focused on the deny-order semantics; the
-// deny-case generator uses the same reader so both sides agree on what a numeric
-// literal means.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.literalNumericBigInt = literalNumericBigInt;
-/** BigInt value of a numeric-integer literal leaf (`literal_i128` / `literal_u64`
- *  / `literal_u32`), or null for a non-numeric literal (address / symbol / bytes
- *  / vec). Callers fail closed on null. */
-function literalNumericBigInt(leaf) {
-    switch (leaf.kind) {
-        case 'literal_i128':
-        case 'literal_u64':
-            try {
-                return BigInt(leaf.value);
-            }
-            catch {
-                return null;
-            }
-        case 'literal_u32':
-            return BigInt(leaf.value);
-        default:
-            return null;
-    }
-}

package/dist-cjs/synth/synthesize-from-mandate.d.ts

@@ -1,20 +0,0 @@
-import type { OzAdapterConfig } from '../adapters/oz/adapter.ts';
-import type { ToolResponse } from '../errors.ts';
-import type { MandateSpec } from '../mandate/types.ts';
-import type { PredicateNode, ProposedPolicy } from '../types.ts';
-import type { SimulationResult } from '../verify/envelope.ts';
-export declare function synthesizeFromMandate(spec: MandateSpec, ozConfig: OzAdapterConfig, 
-/** --explain opt-in. When true, the success envelope carries the
- *  in-memory predicate tree (always null for the mandate path - the
- *  declarative MandateSpec lowers to OZ built-ins, not to an
- *  interpreter predicate) + a minimal honest SimulationResult. The
- *  flag is ADDITIVE: the existing ProposedPolicy fields are never
- *  altered. */
-opts?: {
-    explain?: true;
-}): ToolResponse<ProposedPolicy> & {
-    explain?: {
-        predicateTree: PredicateNode | null;
-        simulation: SimulationResult;
-    };
-};

package/dist-cjs/synth/synthesize-from-mandate.js

@@ -1,62 +0,0 @@
-"use strict";
-// src/synth/synthesize-from-mandate.ts - the deterministic Mandate front-end.
-//
-// synthesizeFromMandate is the clean end-to-end demo path: a declarative
-// MandateSpec is lowered deterministically to a PolicyIR and compiled by the OZ
-// adapter to a ProposedPolicy. No decoding, no inference, so parseConfidence is
-// the full/not-applicable value. Constructs the OZ built-in primitives cannot
-// express (compile's `uncovered`) are surfaced in `ProposedPolicy.warnings`
-// rather than failing the call - the covered primitives still install; the
-// uncovered ones are reported.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.synthesizeFromMandate = synthesizeFromMandate;
-const adapter_ts_1 = require("../adapters/oz/adapter.js");
-const to_ir_ts_1 = require("../mandate/to-ir.js");
-const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: ';
-function synthesizeFromMandate(spec, ozConfig, 
-/** --explain opt-in. When true, the success envelope carries the
- *  in-memory predicate tree (always null for the mandate path - the
- *  declarative MandateSpec lowers to OZ built-ins, not to an
- *  interpreter predicate) + a minimal honest SimulationResult. The
- *  flag is ADDITIVE: the existing ProposedPolicy fields are never
- *  altered. */
-opts) {
-    const ir = (0, to_ir_ts_1.mandateToPolicyIR)(spec);
-    const adapter = (0, adapter_ts_1.createOzAdapter)(ozConfig);
-    const result = adapter.compile(ir);
-    if (!result.proposed) {
-        return {
-            ok: false,
-            error: {
-                code: 'SYNTHESIS_ERROR',
-                message: `mandate lowered to no installable OZ policy: ${result.uncovered.join('; ')}`,
-                severity: 'error',
-                retryable: false,
-                details: { uncovered: result.uncovered },
-            },
-        };
-    }
-    const proposed = {
-        ...result.proposed,
-        warnings: result.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
-    };
-    // Same --explain envelope pattern as the recording path. The mandate path
-    // never produces an interpreter predicate, so predicateTree is null and
-    // the simulation is a minimal honest deny (no self-verify was performed).
-    const envelope = { ok: true, data: proposed };
-    if (opts?.explain) {
-        envelope.explain = {
-            predicateTree: null,
-            simulation: {
-                permit: {
-                    tx: 'deny',
-                    reason: 'No self-verification was performed (mandate path is OZ-only)',
-                },
-                evaluatedCases: [],
-                backend: 'ts-model',
-                simulatorVersion: 'not-run',
-            },
-        };
-    }
-    return envelope;
-}

package/dist-cjs/verify/envelope.d.ts

@@ -1,15 +0,0 @@
-export type SimulationResult = {
-    permit: {
-        tx: 'permit';
-    } | {
-        tx: 'deny';
-        reason: string;
-    };
-    evaluatedCases: Array<{
-        dimension: string;
-        outcome: 'permit' | 'deny';
-        reason: string;
-    }>;
-    backend: 'interpreter-v1' | 'ts-model';
-    simulatorVersion: string;
-};

package/dist-cjs/verify/envelope.js

@@ -1,23 +0,0 @@
-"use strict";
-// src/verify/envelope.ts - the post-simulation result envelope used by
-// review-card rendering and verification.
-//
-// `SimulationResult` is the structured verdict a `simulate_policy` run
-// produces; the review-card builder reads it as one of its inputs (so the
-// rendered card can quote the backend that evaluated the policy) and the
-// verification pipeline reads `permit` + `evaluatedCases` to confirm every
-// generated deny case really did deny.
-//
-// This envelope is intentionally separate from the CustodyAdapter
-// `SimulationResult` in `src/seams/types.ts` (which is the dry-run stub
-// returned by `adapter.simulate(ir, permitTx)`); the seam result is the
-// adapter contract, this envelope is the post-simulation record consumed by
-// downstream rendering + verification.
-//
-// Fields:
-//   - `permit` is the single verdict for the candidate recorded tx.
-//   - `evaluatedCases` is the deny-case battery outcome (every dimension
-//     must report `deny` when the policy is minimal).
-//   - `backend` is the actual evaluator that produced the verdict.
-//   - `simulatorVersion` lets the reviewer / audit log distinguish runs.
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist-cjs/verify/index.d.ts

@@ -1,3 +0,0 @@
-export type { SimulationResult } from './envelope.ts';
-export { type SimulateOptions, simulatePolicy } from './simulate.ts';
-export { type VerifyOptions, verifyPolicy } from './verify.ts';

package/dist-cjs/verify/index.js

@@ -1,8 +0,0 @@
-"use strict";
-// src/verify/index.ts - re-export the simulation / verification surface.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyPolicy = exports.simulatePolicy = void 0;
-var simulate_ts_1 = require("./simulate.js");
-Object.defineProperty(exports, "simulatePolicy", { enumerable: true, get: function () { return simulate_ts_1.simulatePolicy; } });
-var verify_ts_1 = require("./verify.js");
-Object.defineProperty(exports, "verifyPolicy", { enumerable: true, get: function () { return verify_ts_1.verifyPolicy; } });

package/dist-cjs/verify/simulate.d.ts

@@ -1,18 +0,0 @@
-import type { ToolResponse } from '../errors.ts';
-import type { PredicateNode, RecordedTransaction } from '../types.ts';
-import type { SimulationResult } from './envelope.ts';
-/** Options for `simulatePolicy`. `validUntilLedger` is propagated onto the
- *  permit EvalContext so the simulator exercises the expiry gate; absent ->
- *  no expiry check (mirrors the orchestrator's "no `validUntilLedger`
- *  supplied" path). */
-export interface SimulateOptions {
-    validUntilLedger?: number;
-}
-/** Replay a recorded transaction against a proposed predicate and emit the
- *  `SimulationResult` envelope. The simulator returns the SAME permit
- *  verdict `runHarness` expects: the intended recorded call must permit; every
- *  generated deny dimension must deny. A runtime evaluation failure
- *  `ToolError` - NOT a deny verdict, NOT `VERIFICATION_FAILED`. The boundary
- *  is pinned: minimality is a verify-time concern, runtime evaluation is a
- *  simulate-time concern. */
-export declare function simulatePolicy(predicate: PredicateNode | null, permitTx: RecordedTransaction, opts?: SimulateOptions): ToolResponse<SimulationResult>;