@crediolabs/policy-synth 0.3.1 → 0.4.0

package/dist-cjs/run/schemas.d.ts

@@ -1494,6 +1494,104 @@ export declare const VerifyPolicyInputSchema: z.ZodObject<{
     predicate?: unknown;
 }>;
 export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>;
+/** A rule ALREADY on the account, as the caller observed it. Supplying these
+ *  turns on the cross-rule authority scan: a signer belonging to several rules
+ *  picks which one applies, so a predicate only constrains a key when the
+ *  policed rule is the only rule that key is on. */
+export declare const ObservedRuleSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    contextType: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"default">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "default";
+    }, {
+        kind: "default";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"call_contract">;
+        contract: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kind: "call_contract";
+        contract: string;
+    }, {
+        kind: "call_contract";
+        contract: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"create_contract">;
+        wasmHash: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kind: "create_contract";
+        wasmHash: string;
+    }, {
+        kind: "create_contract";
+        wasmHash: string;
+    }>]>;
+    signers: z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"delegated">;
+        address: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        address: string;
+        kind: "delegated";
+    }, {
+        address: string;
+        kind: "delegated";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"external">;
+        verifier: z.ZodString;
+        keyBytes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    }, {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    }>]>, "many">;
+    policyAddresses: z.ZodArray<z.ZodString, "many">;
+    predicate: z.ZodOptional<z.ZodType<unknown, z.ZodTypeDef, unknown>>;
+}, "strip", z.ZodTypeAny, {
+    signers: ({
+        address: string;
+        kind: "delegated";
+    } | {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    })[];
+    id: number;
+    contextType: {
+        kind: "default";
+    } | {
+        kind: "call_contract";
+        contract: string;
+    } | {
+        kind: "create_contract";
+        wasmHash: string;
+    };
+    policyAddresses: string[];
+    predicate?: unknown;
+}, {
+    signers: ({
+        address: string;
+        kind: "delegated";
+    } | {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    })[];
+    id: number;
+    contextType: {
+        kind: "default";
+    } | {
+        kind: "call_contract";
+        contract: string;
+    } | {
+        kind: "create_contract";
+        wasmHash: string;
+    };
+    policyAddresses: string[];
+    predicate?: unknown;
+}>;
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CCL336TCK2Y5OFNRCMN2M3HVPBCEX4PW5H6EQ5VW5NPMXOCP4ESB5XR4";
@@ -1533,7 +1631,134 @@ export declare const RPC_URL_BY_NETWORK: Record<Network, string>;
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */
 export declare const NETWORK_PASSPHRASES: Record<Network, string>;
+export declare const DeclarePolicyInputSchema: z.ZodObject<{
+    fn: z.ZodString;
+    contract: z.ZodOptional<z.ZodString>;
+    /** Smallest unit, unsigned decimal STRING - an i128 is wider than
+     *  Number.MAX_SAFE_INTEGER, so a number here would silently round. */
+    maxAmount: z.ZodOptional<z.ZodString>;
+    amountArgIndex: z.ZodOptional<z.ZodNumber>;
+    recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    recipientArgIndex: z.ZodOptional<z.ZodNumber>;
+    allowZeroCap: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    fn: string;
+    contract?: string | undefined;
+    maxAmount?: string | undefined;
+    amountArgIndex?: number | undefined;
+    recipients?: string[] | undefined;
+    recipientArgIndex?: number | undefined;
+    allowZeroCap?: boolean | undefined;
+}, {
+    fn: string;
+    contract?: string | undefined;
+    maxAmount?: string | undefined;
+    amountArgIndex?: number | undefined;
+    recipients?: string[] | undefined;
+    recipientArgIndex?: number | undefined;
+    allowZeroCap?: boolean | undefined;
+}>;
+export type DeclarePolicyInput = z.infer<typeof DeclarePolicyInputSchema>;
 export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan, which reports every existing rule a signer of this
+     *  install could name INSTEAD - including an unpoliced one, against which
+     *  the predicate never runs. Absent means the scan is skipped, and the
+     *  result says so rather than reporting "no overlaps found". */
+    existingRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        contextType: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"default">;
+        }, "strip", z.ZodTypeAny, {
+            kind: "default";
+        }, {
+            kind: "default";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"call_contract">;
+            contract: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            kind: "call_contract";
+            contract: string;
+        }, {
+            kind: "call_contract";
+            contract: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"create_contract">;
+            wasmHash: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            kind: "create_contract";
+            wasmHash: string;
+        }, {
+            kind: "create_contract";
+            wasmHash: string;
+        }>]>;
+        signers: z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"delegated">;
+            address: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            kind: "delegated";
+        }, {
+            address: string;
+            kind: "delegated";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"external">;
+            verifier: z.ZodString;
+            keyBytes: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        }, {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        }>]>, "many">;
+        policyAddresses: z.ZodArray<z.ZodString, "many">;
+        predicate: z.ZodOptional<z.ZodType<unknown, z.ZodTypeDef, unknown>>;
+    }, "strip", z.ZodTypeAny, {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        policyAddresses: string[];
+        predicate?: unknown;
+    }, {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        policyAddresses: string[];
+        predicate?: unknown;
+    }>, "many">>;
     /** The smart account contract address (C...) that will receive the rule. */
     smartAccount: z.ZodString;
     /** The signer that authorises the install (G... wallet). Used only for
@@ -1918,6 +2143,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        policyAddresses: string[];
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
@@ -1955,6 +2202,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        policyAddresses: string[];
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
@@ -1992,6 +2261,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        policyAddresses: string[];
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
@@ -2029,6 +2320,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        policyAddresses: string[];
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;

package/dist-cjs/run/schemas.js

@@ -16,7 +16,7 @@
 // imports them here so its tool-shape bindings stay in step; the CLI imports
 // them here so it can build the same args envelope the MCP transport builds.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.InstallPolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.RPC_URL_BY_NETWORK = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.MAINNET_RPC_URL = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.InterpreterOptionsSchema = exports.RecordTransactionInputSchema = exports.ComposeUserResponsesSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
+exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.InstallPolicyInputSchema = exports.DeclarePolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.RPC_URL_BY_NETWORK = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.MAINNET_RPC_URL = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.ObservedRuleSchema = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.InterpreterOptionsSchema = exports.RecordTransactionInputSchema = exports.ComposeUserResponsesSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
 const zod_1 = require("zod");
 const address_ts_1 = require("../synth/address.js");
 /** Soroban `valid_until` is a u32 ledger sequence; a value above this cannot be
@@ -249,6 +249,26 @@ exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema;
  *  the temporal dead zone (no JS hoisting for `const`). */
 const MAX_SIGNERS_PER_RULE = 15;
 const MAX_POLICIES_PER_RULE = 5;
+const SignerDraftSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal('delegated'), address: zod_1.z.string() }),
+    zod_1.z.object({ kind: zod_1.z.literal('external'), verifier: zod_1.z.string(), keyBytes: zod_1.z.string() }),
+]);
+const ContextTypeSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal('default') }),
+    zod_1.z.object({ kind: zod_1.z.literal('call_contract'), contract: zod_1.z.string() }),
+    zod_1.z.object({ kind: zod_1.z.literal('create_contract'), wasmHash: zod_1.z.string() }),
+]);
+/** A rule ALREADY on the account, as the caller observed it. Supplying these
+ *  turns on the cross-rule authority scan: a signer belonging to several rules
+ *  picks which one applies, so a predicate only constrains a key when the
+ *  policed rule is the only rule that key is on. */
+exports.ObservedRuleSchema = zod_1.z.object({
+    id: zod_1.z.number().int().nonnegative(),
+    contextType: ContextTypeSchema,
+    signers: zod_1.z.array(SignerDraftSchema),
+    policyAddresses: zod_1.z.array(zod_1.z.string()),
+    predicate: exports.PredicateNodeSchema.optional(),
+});
 const ContextRuleDraftSchema = zod_1.z
     .object({
     contextRuleType: zod_1.z.discriminatedUnion('kind', [
@@ -338,8 +358,40 @@ exports.NETWORK_PASSPHRASES = {
 // `sourceAccount` is the signing wallet (G...).
 const STELLAR_CONTRACT_ADDRESS = /^C[2-7A-Z]{55}$/;
 const STELLAR_ACCOUNT_ADDRESS = /^G[2-7A-Z]{55}$/;
+// ===== declare_policy =====
+//
+// The declarative front-end: the constraint stated outright, with no
+// transaction to decode. Deliberately NOT a revival of the removed
+// `MandateSpec` - that carried a rolling `spendingLimit` the interpreter
+// cannot evaluate and an `approvalThreshold` needing OZ primitives nobody
+// deployed. Only fields grammar 3 can actually enforce appear here.
+exports.DeclarePolicyInputSchema = zod_1.z
+    .object({
+    fn: zod_1.z.string().min(1, 'fn must name the method to pin'),
+    contract: zod_1.z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'contract must be a Stellar contract address (C...)')
+        .optional(),
+    /** Smallest unit, unsigned decimal STRING - an i128 is wider than
+     *  Number.MAX_SAFE_INTEGER, so a number here would silently round. */
+    maxAmount: zod_1.z
+        .string()
+        .regex(/^[0-9]+$/, 'maxAmount must be an unsigned integer in the smallest unit')
+        .optional(),
+    amountArgIndex: zod_1.z.number().int().nonnegative().max(U32_MAX).optional(),
+    recipients: zod_1.z.array(zod_1.z.string()).min(1, 'recipients must not be empty').optional(),
+    recipientArgIndex: zod_1.z.number().int().nonnegative().max(U32_MAX).optional(),
+    allowZeroCap: zod_1.z.boolean().optional(),
+})
+    .strict();
 exports.InstallPolicyInputSchema = zod_1.z
     .object({
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan, which reports every existing rule a signer of this
+     *  install could name INSTEAD - including an unpoliced one, against which
+     *  the predicate never runs. Absent means the scan is skipped, and the
+     *  result says so rather than reporting "no overlaps found". */
+    existingRules: zod_1.z.array(exports.ObservedRuleSchema).optional(),
     /** The smart account contract address (C...) that will receive the rule. */
     smartAccount: zod_1.z
         .string()

package/dist-cjs/synth/declare.d.ts

@@ -0,0 +1,30 @@
+import type { PredicateNode } from '../types.ts';
+export interface PolicyDeclaration {
+    /** Method to pin. Required: a predicate with no selector leaf constrains
+     *  nothing and the contract refuses it at install. */
+    fn: string;
+    /** Contract to pin, already resolved to a `C...` address. */
+    contract?: string;
+    /** Upper bound on the call's amount argument, in the token's SMALLEST
+     *  unit as an unsigned decimal string (25 XLM = "250000000"). */
+    maxAmount?: string;
+    /** Which argument carries the amount. Defaults to the SEP-41 position. */
+    amountArgIndex?: number;
+    /** Recipient allowlist. */
+    recipients?: string[];
+    /** Which argument carries the recipient. Defaults to the SEP-41 position. */
+    recipientArgIndex?: number;
+    /** A cap of "0" denies every call, so it is refused unless asked for
+     *  explicitly. A rule that permits nothing is a plausible thing to want and
+     *  an implausible thing to want by accident. */
+    allowZeroCap?: boolean;
+}
+export interface DeclaredPredicate {
+    predicate: PredicateNode;
+    /** Assumptions the caller should check. Never empty when an argument index
+     *  was defaulted rather than supplied. */
+    warnings: string[];
+}
+/** Lower a declared constraint to a grammar-3 predicate. Pure and total:
+ *  the same declaration always produces the same predicate. */
+export declare function declarePredicate(d: PolicyDeclaration): DeclaredPredicate;

package/dist-cjs/synth/declare.js

@@ -0,0 +1,101 @@
+"use strict";
+// src/synth/declare.ts - build a predicate from a DECLARED constraint.
+//
+// The second synthesis front-end, beside `synthesizeFromRecording`. That one
+// infers a predicate from a transaction that happened; this one takes the
+// constraint the user states outright. No transaction, no decoding, no
+// inference, no RPC: the same declaration always lowers to a byte-identical
+// predicate.
+//
+// This is the surviving half of the removed `MandateSpec`. Two of that type's
+// five fields lowered to things that do not exist - `spendingLimit` became a
+// `window_spent` compare the interpreter cannot evaluate (it is handed one
+// call and keeps no state), and `approvalThreshold` needed OZ built-in policy
+// contracts that were never deployed. Both are deliberately absent here, and
+// the per-call `maxAmount` bound below is the honest replacement for the
+// first: it constrains the amount in THIS call rather than implying a rolling
+// total nothing tracks.
+//
+// What a declaration can say maps one-to-one onto grammar 3:
+//   fn         -> eq(call_fn, literal_symbol)
+//   contract   -> eq(call_contract, literal_address)
+//   maxAmount  -> lte(call_arg(i), literal_i128)
+//   recipients -> in(call_arg(j), [literal_address, ...])
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.declarePredicate = declarePredicate;
+const address_ts_1 = require("./address.js");
+/** Argument positions of the SEP-41 `transfer(from, to, amount)` shape. A
+ *  declaration that names a different method almost certainly has different
+ *  positions, which is why using either default emits a warning naming the
+ *  index it assumed - a bound on the wrong argument constrains something the
+ *  user did not mean and fails silently. */
+const SEP41_RECIPIENT_ARG = 1;
+const SEP41_AMOUNT_ARG = 2;
+/** Lower a declared constraint to a grammar-3 predicate. Pure and total:
+ *  the same declaration always produces the same predicate. */
+function declarePredicate(d) {
+    if (!d.fn || d.fn.trim() === '') {
+        throw declareError('SYNTHESIS_ERROR', 'a declaration needs `fn`: the method to pin');
+    }
+    const warnings = [];
+    const children = [
+        { op: 'eq', left: { kind: 'call_fn' }, right: { kind: 'literal_symbol', value: d.fn } },
+    ];
+    if (d.contract !== undefined) {
+        if (!(0, address_ts_1.isStellarAddress)(d.contract) || !d.contract.startsWith('C')) {
+            throw declareError('SYNTHESIS_ERROR', `contract must be a Stellar contract address (C...), got ${d.contract}`);
+        }
+        children.push({
+            op: 'eq',
+            left: { kind: 'call_contract' },
+            right: { kind: 'literal_address', value: d.contract },
+        });
+    }
+    if (d.recipients !== undefined) {
+        if (d.recipients.length === 0) {
+            throw declareError('SYNTHESIS_ERROR', 'recipients was supplied but empty; an empty `in` haystack is refused at decode. Omit it to leave recipients unconstrained.');
+        }
+        for (const r of d.recipients) {
+            if (!(0, address_ts_1.isStellarAddress)(r)) {
+                throw declareError('SYNTHESIS_ERROR', `recipient is not a Stellar address: ${r}`);
+            }
+        }
+        const idx = d.recipientArgIndex ?? SEP41_RECIPIENT_ARG;
+        if (d.recipientArgIndex === undefined) {
+            warnings.push(`recipient allowlist bound to call_arg(${idx}), the SEP-41 \`transfer\` position. If \`${d.fn}\` carries the recipient elsewhere this constrains the wrong argument - pass recipientArgIndex.`);
+        }
+        children.push({
+            op: 'in',
+            needle: { kind: 'call_arg', index: idx },
+            haystack: d.recipients.map((value) => ({ kind: 'literal_address', value })),
+        });
+    }
+    if (d.maxAmount !== undefined) {
+        if (!/^[0-9]+$/.test(d.maxAmount)) {
+            throw declareError('SYNTHESIS_ERROR', `maxAmount must be an unsigned integer in the token's smallest unit, got "${d.maxAmount}" (25 XLM = "250000000")`);
+        }
+        if (d.maxAmount === '0' && d.allowZeroCap !== true) {
+            throw declareError('SYNTHESIS_ERROR', 'maxAmount "0" denies every call: no amount satisfies the bound. Set allowZeroCap to declare that deliberately.');
+        }
+        const idx = d.amountArgIndex ?? SEP41_AMOUNT_ARG;
+        if (d.amountArgIndex === undefined) {
+            warnings.push(`amount cap bound to call_arg(${idx}), the SEP-41 \`transfer\` position. If \`${d.fn}\` carries the amount elsewhere this caps the wrong argument - pass amountArgIndex.`);
+        }
+        children.push({
+            op: 'lte',
+            left: { kind: 'call_arg', index: idx },
+            right: { kind: 'literal_i128', value: d.maxAmount },
+        });
+    }
+    // A single conjunct is emitted bare. `and` with one child encodes to
+    // different bytes than the child alone, and the extra node buys nothing.
+    const predicate = children.length === 1 ? children[0] : { op: 'and', children };
+    return { predicate, warnings };
+}
+function declareError(code, message) {
+    const err = new Error(message);
+    err.code = code;
+    err.severity = 'error';
+    err.retryable = false;
+    throw err;
+}

package/dist-cjs/synth/index.d.ts

@@ -1,5 +1,6 @@
 export { isStellarAddress } from './address.ts';
 export { type ComposeOptions, type ComposeResult, composeFromRecording, } from './compose-from-recording.ts';
+export { type DeclaredPredicate, declarePredicate, type PolicyDeclaration, } from './declare.ts';
 export { type IntentFacts, lower } from './lower.ts';
 export { type DecideScopeOptions, decideScope, type ScopeDecision, scopeToContextRuleType, } from './scope.ts';
 export { type __TestInterpreterAdapterOptions, type SynthesizeFromRecordingOptions, synthesizeFromRecording, } from './synthesize-from-recording.ts';

package/dist-cjs/synth/index.js

@@ -1,7 +1,7 @@
 "use strict";
 // src/synth/index.ts - re-export the synthesizer front-ends.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.synthesizeFromRecording = exports.scopeToContextRuleType = exports.decideScope = exports.lower = exports.composeFromRecording = exports.isStellarAddress = void 0;
+exports.synthesizeFromRecording = exports.scopeToContextRuleType = exports.decideScope = exports.lower = exports.declarePredicate = exports.composeFromRecording = exports.isStellarAddress = void 0;
 // Exported because `swapRecipientAllowlist` is part of the public synthesis
 // input: a caller assembling one needs the same validator the schema applies,
 // and re-deriving it elsewhere means a second address check that can drift.
@@ -9,6 +9,8 @@ var address_ts_1 = require("./address.js");
 Object.defineProperty(exports, "isStellarAddress", { enumerable: true, get: function () { return address_ts_1.isStellarAddress; } });
 var compose_from_recording_ts_1 = require("./compose-from-recording.js");
 Object.defineProperty(exports, "composeFromRecording", { enumerable: true, get: function () { return compose_from_recording_ts_1.composeFromRecording; } });
+var declare_ts_1 = require("./declare.js");
+Object.defineProperty(exports, "declarePredicate", { enumerable: true, get: function () { return declare_ts_1.declarePredicate; } });
 var lower_ts_1 = require("./lower.js");
 Object.defineProperty(exports, "lower", { enumerable: true, get: function () { return lower_ts_1.lower; } });
 var scope_ts_1 = require("./scope.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",