@crediolabs/policy-synth 0.3.1 → 0.5.0

package/dist/run/schemas.d.ts

@@ -1494,25 +1494,123 @@ export declare const VerifyPolicyInputSchema: z.ZodObject<{
     predicate?: unknown;
 }>;
 export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>;
+/** A rule ALREADY on the account, as the caller observed it. Supplying these
+ *  turns on the cross-rule authority scan: a signer belonging to several rules
+ *  picks which one applies, so a predicate only constrains a key when the
+ *  policed rule is the only rule that key is on. */
+export declare const ObservedRuleSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    contextType: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"default">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "default";
+    }, {
+        kind: "default";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"call_contract">;
+        contract: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kind: "call_contract";
+        contract: string;
+    }, {
+        kind: "call_contract";
+        contract: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"create_contract">;
+        wasmHash: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kind: "create_contract";
+        wasmHash: string;
+    }, {
+        kind: "create_contract";
+        wasmHash: string;
+    }>]>;
+    signers: z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"delegated">;
+        address: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        address: string;
+        kind: "delegated";
+    }, {
+        address: string;
+        kind: "delegated";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"external">;
+        verifier: z.ZodString;
+        keyBytes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    }, {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    }>]>, "many">;
+    policyAddresses: z.ZodArray<z.ZodString, "many">;
+    predicate: z.ZodOptional<z.ZodType<unknown, z.ZodTypeDef, unknown>>;
+}, "strip", z.ZodTypeAny, {
+    signers: ({
+        address: string;
+        kind: "delegated";
+    } | {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    })[];
+    id: number;
+    policyAddresses: string[];
+    contextType: {
+        kind: "default";
+    } | {
+        kind: "call_contract";
+        contract: string;
+    } | {
+        kind: "create_contract";
+        wasmHash: string;
+    };
+    predicate?: unknown;
+}, {
+    signers: ({
+        address: string;
+        kind: "delegated";
+    } | {
+        kind: "external";
+        verifier: string;
+        keyBytes: string;
+    })[];
+    id: number;
+    policyAddresses: string[];
+    contextType: {
+        kind: "default";
+    } | {
+        kind: "call_contract";
+        contract: string;
+    } | {
+        kind: "create_contract";
+        wasmHash: string;
+    };
+    predicate?: unknown;
+}>;
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
-export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CCL336TCK2Y5OFNRCMN2M3HVPBCEX4PW5H6EQ5VW5NPMXOCP4ESB5XR4";
-/** Pinned interpreter address (mainnet), redeployed 2026-08-22 from a reproducible build. The mainnet
+export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CCBHVZ6HGGV7C4SNHCZ3S5665Z2WEMHTMBAEPO4XW6PKON464BEBANU5";
+/** Pinned interpreter address (mainnet), redeployed 2026-08-22 for grammar 4, from a reproducible build. The mainnet
  *  interpreter IS the binary exercised on testnet - both instances were created
  *  from the same uploaded wasm hash (see PINNED_INTERPRETER_WASM_SHA256), and
- *  both were read back with `grammar_version()` returning 3. The address differs
+ *  both were read back with `grammar_version()` returning 4. The address differs
  *  because instance ids are network-scoped. UNAUDITED at the time of writing.
  *
  *  These four constants move together or not at all. The grammar version and
  *  wasm hash are single values covering BOTH networks, so re-pinning one network
  *  alone would have the builder emit a version the other network refuses - with
  *  a green test run, since `grammar-version-parity.test.ts` would then pass. */
-export declare const PINNED_INTERPRETER_MAINNET_ADDRESS = "CBZXLSTQUITBFZHQH6XRXF3XIVRQR4RHRI64Q5WELS5KGY3ZKJPFWDPF";
+export declare const PINNED_INTERPRETER_MAINNET_ADDRESS = "CDN755TDYZM3ZQ5OXTJ6TIBUBWZV2KRI2BYJPBXD2MVWED4STT3VBN52";
 /** Pinned interpreter wasm sha256 (hex). */
-export declare const PINNED_INTERPRETER_WASM_SHA256 = "a2b36e8ac5a61caf3757af26aa79e83f2995b451099f44772383806a55fe3414";
+export declare const PINNED_INTERPRETER_WASM_SHA256 = "b5ba1e35ccf20cd8c13c3a2c3098bf337033a92bcaf475d63c03ddc0cba0fcae";
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
-export declare const PINNED_INTERPRETER_GRAMMAR_VERSION = 3;
+export declare const PINNED_INTERPRETER_GRAMMAR_VERSION = 4;
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
  *  than a Server; the two are deliberately different surfaces, so this is
@@ -1533,7 +1631,165 @@ export declare const RPC_URL_BY_NETWORK: Record<Network, string>;
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */
 export declare const NETWORK_PASSPHRASES: Record<Network, string>;
+export declare const DeclarePolicyInputSchema: z.ZodObject<{
+    fn: z.ZodString;
+    contract: z.ZodOptional<z.ZodString>;
+    /** Smallest unit, unsigned decimal STRING - an i128 is wider than
+     *  Number.MAX_SAFE_INTEGER, so a number here would silently round. */
+    maxAmount: z.ZodOptional<z.ZodString>;
+    amountArgIndex: z.ZodOptional<z.ZodNumber>;
+    recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    recipientArgIndex: z.ZodOptional<z.ZodNumber>;
+    allowZeroCap: z.ZodOptional<z.ZodBoolean>;
+    /** Minimum output as a ratio of the call's own input. num/den are decimal
+     *  STRINGS for the same reason maxAmount is: an i128 ratio does not
+     *  survive a JS number. */
+    minOutputRatio: z.ZodOptional<z.ZodObject<{
+        num: z.ZodString;
+        den: z.ZodString;
+        inputArgIndex: z.ZodNumber;
+        outputArgIndex: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    }, {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    fn: string;
+    contract?: string | undefined;
+    maxAmount?: string | undefined;
+    amountArgIndex?: number | undefined;
+    recipients?: string[] | undefined;
+    recipientArgIndex?: number | undefined;
+    allowZeroCap?: boolean | undefined;
+    minOutputRatio?: {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    } | undefined;
+}, {
+    fn: string;
+    contract?: string | undefined;
+    maxAmount?: string | undefined;
+    amountArgIndex?: number | undefined;
+    recipients?: string[] | undefined;
+    recipientArgIndex?: number | undefined;
+    allowZeroCap?: boolean | undefined;
+    minOutputRatio?: {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    } | undefined;
+}>;
+export type DeclarePolicyInput = z.infer<typeof DeclarePolicyInputSchema>;
 export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan, which reports every existing rule a signer of this
+     *  install could name INSTEAD - including an unpoliced one, against which
+     *  the predicate never runs. Absent means the scan is skipped, and the
+     *  result says so rather than reporting "no overlaps found". */
+    existingRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        contextType: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"default">;
+        }, "strip", z.ZodTypeAny, {
+            kind: "default";
+        }, {
+            kind: "default";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"call_contract">;
+            contract: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            kind: "call_contract";
+            contract: string;
+        }, {
+            kind: "call_contract";
+            contract: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"create_contract">;
+            wasmHash: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            kind: "create_contract";
+            wasmHash: string;
+        }, {
+            kind: "create_contract";
+            wasmHash: string;
+        }>]>;
+        signers: z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"delegated">;
+            address: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            kind: "delegated";
+        }, {
+            address: string;
+            kind: "delegated";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"external">;
+            verifier: z.ZodString;
+            keyBytes: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        }, {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        }>]>, "many">;
+        policyAddresses: z.ZodArray<z.ZodString, "many">;
+        predicate: z.ZodOptional<z.ZodType<unknown, z.ZodTypeDef, unknown>>;
+    }, "strip", z.ZodTypeAny, {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        policyAddresses: string[];
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        predicate?: unknown;
+    }, {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        policyAddresses: string[];
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        predicate?: unknown;
+    }>, "many">>;
     /** The smart account contract address (C...) that will receive the rule. */
     smartAccount: z.ZodString;
     /** The signer that authorises the install (G... wallet). Used only for
@@ -1918,6 +2174,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        policyAddresses: string[];
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
@@ -1955,6 +2233,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        policyAddresses: string[];
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
@@ -1992,6 +2292,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        policyAddresses: string[];
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
@@ -2029,6 +2351,28 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
         [k: string]: unknown;
     };
     network?: "mainnet" | "testnet" | undefined;
+    existingRules?: {
+        signers: ({
+            address: string;
+            kind: "delegated";
+        } | {
+            kind: "external";
+            verifier: string;
+            keyBytes: string;
+        })[];
+        id: number;
+        policyAddresses: string[];
+        contextType: {
+            kind: "default";
+        } | {
+            kind: "call_contract";
+            contract: string;
+        } | {
+            kind: "create_contract";
+            wasmHash: string;
+        };
+        predicate?: unknown;
+    }[] | undefined;
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;

package/dist/run/schemas.js

@@ -177,6 +177,15 @@ export const PredicateLeafSchema = z.lazy(() => z.union([
         element: z.number().int().nonnegative(),
         field: z.string(),
     }),
+    // num/den are i128 decimal strings, matching `literal_i128`. The regex
+    // is the boundary guard; the ratio's SIGN is checked at encode, where
+    // the message can explain that a negative ratio inverts the comparison.
+    z.object({
+        kind: z.literal('call_arg_scaled'),
+        index: z.number().int().nonnegative(),
+        num: z.string().regex(/^-?[0-9]+$/),
+        den: z.string().regex(/^-?[0-9]+$/),
+    }),
     z.object({ kind: z.literal('literal_address'), value: z.string() }),
     z.object({ kind: z.literal('literal_i128'), value: z.string().regex(/^-?[0-9]+$/) }),
     z.object({ kind: z.literal('literal_symbol'), value: z.string() }),
@@ -195,16 +204,32 @@ export const PredicateLeafSchema = z.lazy(() => z.union([
  *  `and`; the lazy + annotation pattern keeps the recursion type-safe. */
 export const PredicateNodeSchema = z.lazy(() => z.union([
     z.object({ op: z.literal('and'), children: z.array(PredicateNodeSchema) }),
+    z.object({ op: z.literal('or'), children: z.array(PredicateNodeSchema) }),
     z.object({
         op: z.literal('eq'),
         left: PredicateLeafSchema,
         right: PredicateLeafSchema,
     }),
+    z.object({
+        op: z.literal('lt'),
+        left: PredicateLeafSchema,
+        right: PredicateLeafSchema,
+    }),
     z.object({
         op: z.literal('lte'),
         left: PredicateLeafSchema,
         right: PredicateLeafSchema,
     }),
+    z.object({
+        op: z.literal('gt'),
+        left: PredicateLeafSchema,
+        right: PredicateLeafSchema,
+    }),
+    z.object({
+        op: z.literal('gte'),
+        left: PredicateLeafSchema,
+        right: PredicateLeafSchema,
+    }),
     z.object({
         op: z.literal('in'),
         needle: PredicateLeafSchema,
@@ -246,6 +271,26 @@ export const VerifyPolicyInputSchema = SimulatePolicyInputSchema;
  *  the temporal dead zone (no JS hoisting for `const`). */
 const MAX_SIGNERS_PER_RULE = 15;
 const MAX_POLICIES_PER_RULE = 5;
+const SignerDraftSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('delegated'), address: z.string() }),
+    z.object({ kind: z.literal('external'), verifier: z.string(), keyBytes: z.string() }),
+]);
+const ContextTypeSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('default') }),
+    z.object({ kind: z.literal('call_contract'), contract: z.string() }),
+    z.object({ kind: z.literal('create_contract'), wasmHash: z.string() }),
+]);
+/** A rule ALREADY on the account, as the caller observed it. Supplying these
+ *  turns on the cross-rule authority scan: a signer belonging to several rules
+ *  picks which one applies, so a predicate only constrains a key when the
+ *  policed rule is the only rule that key is on. */
+export const ObservedRuleSchema = z.object({
+    id: z.number().int().nonnegative(),
+    contextType: ContextTypeSchema,
+    signers: z.array(SignerDraftSchema),
+    policyAddresses: z.array(z.string()),
+    predicate: PredicateNodeSchema.optional(),
+});
 const ContextRuleDraftSchema = z
     .object({
     contextRuleType: z.discriminatedUnion('kind', [
@@ -280,23 +325,23 @@ const ContextRuleDraftSchema = z
 // existing four.
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
-export const PINNED_INTERPRETER_TESTNET_ADDRESS = 'CCL336TCK2Y5OFNRCMN2M3HVPBCEX4PW5H6EQ5VW5NPMXOCP4ESB5XR4';
-/** Pinned interpreter address (mainnet), redeployed 2026-08-22 from a reproducible build. The mainnet
+export const PINNED_INTERPRETER_TESTNET_ADDRESS = 'CCBHVZ6HGGV7C4SNHCZ3S5665Z2WEMHTMBAEPO4XW6PKON464BEBANU5';
+/** Pinned interpreter address (mainnet), redeployed 2026-08-22 for grammar 4, from a reproducible build. The mainnet
  *  interpreter IS the binary exercised on testnet - both instances were created
  *  from the same uploaded wasm hash (see PINNED_INTERPRETER_WASM_SHA256), and
- *  both were read back with `grammar_version()` returning 3. The address differs
+ *  both were read back with `grammar_version()` returning 4. The address differs
  *  because instance ids are network-scoped. UNAUDITED at the time of writing.
  *
  *  These four constants move together or not at all. The grammar version and
  *  wasm hash are single values covering BOTH networks, so re-pinning one network
  *  alone would have the builder emit a version the other network refuses - with
  *  a green test run, since `grammar-version-parity.test.ts` would then pass. */
-export const PINNED_INTERPRETER_MAINNET_ADDRESS = 'CBZXLSTQUITBFZHQH6XRXF3XIVRQR4RHRI64Q5WELS5KGY3ZKJPFWDPF';
+export const PINNED_INTERPRETER_MAINNET_ADDRESS = 'CDN755TDYZM3ZQ5OXTJ6TIBUBWZV2KRI2BYJPBXD2MVWED4STT3VBN52';
 /** Pinned interpreter wasm sha256 (hex). */
-export const PINNED_INTERPRETER_WASM_SHA256 = 'a2b36e8ac5a61caf3757af26aa79e83f2995b451099f44772383806a55fe3414';
+export const PINNED_INTERPRETER_WASM_SHA256 = 'b5ba1e35ccf20cd8c13c3a2c3098bf337033a92bcaf475d63c03ddc0cba0fcae';
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
-export const PINNED_INTERPRETER_GRAMMAR_VERSION = 3;
+export const PINNED_INTERPRETER_GRAMMAR_VERSION = 4;
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
  *  than a Server; the two are deliberately different surfaces, so this is
@@ -335,8 +380,52 @@ export const NETWORK_PASSPHRASES = {
 // `sourceAccount` is the signing wallet (G...).
 const STELLAR_CONTRACT_ADDRESS = /^C[2-7A-Z]{55}$/;
 const STELLAR_ACCOUNT_ADDRESS = /^G[2-7A-Z]{55}$/;
+// ===== declare_policy =====
+//
+// The declarative front-end: the constraint stated outright, with no
+// transaction to decode. Deliberately NOT a revival of the removed
+// `MandateSpec` - that carried a rolling `spendingLimit` the interpreter
+// cannot evaluate and an `approvalThreshold` needing OZ primitives nobody
+// deployed. Only fields grammar 3 can actually enforce appear here.
+export const DeclarePolicyInputSchema = z
+    .object({
+    fn: z.string().min(1, 'fn must name the method to pin'),
+    contract: z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'contract must be a Stellar contract address (C...)')
+        .optional(),
+    /** Smallest unit, unsigned decimal STRING - an i128 is wider than
+     *  Number.MAX_SAFE_INTEGER, so a number here would silently round. */
+    maxAmount: z
+        .string()
+        .regex(/^[0-9]+$/, 'maxAmount must be an unsigned integer in the smallest unit')
+        .optional(),
+    amountArgIndex: z.number().int().nonnegative().max(U32_MAX).optional(),
+    recipients: z.array(z.string()).min(1, 'recipients must not be empty').optional(),
+    recipientArgIndex: z.number().int().nonnegative().max(U32_MAX).optional(),
+    allowZeroCap: z.boolean().optional(),
+    /** Minimum output as a ratio of the call's own input. num/den are decimal
+     *  STRINGS for the same reason maxAmount is: an i128 ratio does not
+     *  survive a JS number. */
+    minOutputRatio: z
+        .object({
+        num: z.string().regex(/^[0-9]+$/, 'num must be an unsigned integer'),
+        den: z.string().regex(/^[0-9]+$/, 'den must be an unsigned integer'),
+        inputArgIndex: z.number().int().nonnegative().max(U32_MAX),
+        outputArgIndex: z.number().int().nonnegative().max(U32_MAX),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
 export const InstallPolicyInputSchema = z
     .object({
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan, which reports every existing rule a signer of this
+     *  install could name INSTEAD - including an unpoliced one, against which
+     *  the predicate never runs. Absent means the scan is skipped, and the
+     *  result says so rather than reporting "no overlaps found". */
+    existingRules: z.array(ObservedRuleSchema).optional(),
     /** The smart account contract address (C...) that will receive the rule. */
     smartAccount: z
         .string()

package/dist/simulate/deny-cases.js

@@ -201,11 +201,22 @@ function visit(node, facts) {
             for (const child of node.children)
                 visit(child, facts);
             return;
+        // NOT descended into. A deny case works by violating ONE constraint and
+        // asserting the predicate refuses the call. Violating one branch of an
+        // `or` proves nothing, because another branch can still permit, so the
+        // generated case would either fail or pass for the wrong reason. A sound
+        // deny case for a disjunction must violate EVERY branch at once, which
+        // this generator does not construct - so it emits none.
+        case 'or':
+            return;
         case 'in':
             facts.memberships.push(node);
             return;
         case 'eq':
+        case 'lt':
         case 'lte':
+        case 'gt':
+        case 'gte':
             facts.comparisons.push(node);
     }
 }