@crediolabs/policy-synth 0.3.1 → 0.5.0

package/dist-cjs/predicate/encode.js

@@ -83,7 +83,8 @@ function computeStats(node) {
 }
 function walk(node, inCounts, counters) {
     switch (node.op) {
-        case 'and': {
+        case 'and':
+        case 'or': {
             if (node.children.length === 0) {
                 throw capError('MALFORMED_PREDICATE', `\`${node.op}\` with no children: the contract refuses it at decode (MALFORMED_PREDICATE), so it can never be installed`);
             }
@@ -98,7 +99,10 @@ function walk(node, inCounts, counters) {
             return { depth: maxChildDepth + 1, leaves: totalLeaves };
         }
         case 'eq':
-        case 'lte': {
+        case 'lt':
+        case 'lte':
+        case 'gt':
+        case 'gte': {
             collectSelector(node.left, counters);
             collectSelector(node.right, counters);
             return { depth: 1, leaves: leafCount(node.left) + leafCount(node.right) };
@@ -146,14 +150,20 @@ function collectSelector(leaf, counters) {
 }
 function encodeNode(node) {
     switch (node.op) {
-        case 'and': {
+        case 'and':
+        case 'or': {
             const encoded = node.children.map(encodeNode);
-            // sort children by their canonical XDR bytes ascending.
+            // sort children by their canonical XDR bytes ascending. Both operators
+            // are commutative for the permit decision, so sorting costs no meaning
+            // and buys a stable hash for logically-identical predicates.
             const sorted = sortByCanonicalBytes(encoded);
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol(node.op), stellar_sdk_1.xdr.ScVal.scvVec(sorted)]);
         }
         case 'eq':
-        case 'lte': {
+        case 'lt':
+        case 'lte':
+        case 'gt':
+        case 'gte': {
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol(node.op), encodeLeaf(node.left), encodeLeaf(node.right)]);
         }
         case 'in': {
@@ -184,6 +194,15 @@ function encodeLeaf(leaf) {
                 stellar_sdk_1.xdr.ScVal.scvU32(leaf.element),
                 stellar_sdk_1.xdr.ScVal.scvSymbol(leaf.field),
             ]);
+        case 'call_arg_scaled':
+            // num/den are i128 on the wire. The Rust decoder type-checks both
+            // slots, so a u32 here would be refused rather than widened.
+            return stellar_sdk_1.xdr.ScVal.scvVec([
+                symbol('call_arg_scaled'),
+                stellar_sdk_1.xdr.ScVal.scvU32(leaf.index),
+                scvI128FromDecimal(leaf.num),
+                scvI128FromDecimal(leaf.den),
+            ]);
         case 'literal_address':
             return scvAddressFromStrkey(leaf.value);
         case 'literal_i128':
@@ -269,6 +288,30 @@ function validateLeafValues(node) {
                     throw malformed(`call_arg_field.element out of u32 range at ${path}`);
                 }
                 return;
+            case 'call_arg_scaled': {
+                if (!Number.isInteger(leaf.index) || leaf.index < 0 || leaf.index > U32_MAX) {
+                    throw malformed(`call_arg_scaled.index out of u32 range at ${path}`);
+                }
+                // Mirror of the contract's install gate (214). Without it the TS
+                // self-verify would green-light a ratio the chain refuses, which is
+                // exactly the divergence this validator exists to prevent.
+                let num;
+                let den;
+                try {
+                    num = BigInt(leaf.num);
+                    den = BigInt(leaf.den);
+                }
+                catch {
+                    throw malformed(`call_arg_scaled num/den must be i128 decimal strings at ${path}`);
+                }
+                if (den === 0n) {
+                    throw malformed(`call_arg_scaled.den is zero at ${path}: the contract refuses it at install (INVALID_SCALED_RATIO)`);
+                }
+                if (num <= 0n || den < 0n) {
+                    throw malformed(`call_arg_scaled ratio ${leaf.num}/${leaf.den} at ${path} is not positive: a negative ratio inverts the comparison, so the floor would permit what it was written to refuse. The contract refuses it at install (INVALID_SCALED_RATIO)`);
+                }
+                return;
+            }
             case 'call_contract':
             case 'call_fn':
             case 'literal_address':
@@ -279,12 +322,16 @@ function validateLeafValues(node) {
     function walkNode(n, path) {
         switch (n.op) {
             case 'and':
+            case 'or':
                 n.children.forEach((c, i) => {
                     walkNode(c, `${path}.children[${i}]`);
                 });
                 return;
             case 'eq':
+            case 'lt':
             case 'lte':
+            case 'gt':
+            case 'gte':
                 walkLeaf(n.left, `${path}.left`);
                 walkLeaf(n.right, `${path}.right`);
                 return;

package/dist-cjs/predicate/from-json.js

@@ -20,9 +20,13 @@ function jsonToAst(value) {
     const v = value;
     switch (v.op) {
         case 'and':
-            return { op: 'and', children: arrayOf(v.children, jsonToAst) };
+        case 'or':
+            return { op: v.op, children: arrayOf(v.children, jsonToAst) };
         case 'eq':
+        case 'lt':
         case 'lte':
+        case 'gt':
+        case 'gte':
             return { op: v.op, left: jsonToLeaf(v.left), right: jsonToLeaf(v.right) };
         case 'in':
             return { op: 'in', needle: jsonToLeaf(v.needle), haystack: arrayOf(v.haystack, jsonToLeaf) };
@@ -47,6 +51,15 @@ function jsonToLeaf(value) {
             return { kind: 'call_arg', index: numberField(v, 'index') };
         case 'call_arg_len':
             return { kind: 'call_arg_len', index: numberField(v, 'index') };
+        case 'call_arg_scaled':
+            // num/den stay decimal STRINGS: an i128 ratio does not survive a JS
+            // number, and silently rounding one would change the floor.
+            return {
+                kind: 'call_arg_scaled',
+                index: numberField(v, 'index'),
+                num: stringField(v, 'num'),
+                den: stringField(v, 'den'),
+            };
         case 'literal_address':
             return { kind: 'literal_address', value: stringField(v, 'value') };
         case 'literal_i128':

package/dist-cjs/record/index.d.ts

@@ -1,4 +1,5 @@
 import type { ToolResponse } from '../errors.ts';
+import { type SpecFetcher } from '../registry/on-chain-spec.ts';
 import type { Network, RecordedTransaction } from '../types.ts';
 import { type RpcFetcher } from './rpc.ts';
 /** Public input shape. The brief pins:
@@ -27,6 +28,15 @@ export interface RecordInput {
      *  automatically; tests can pass a deterministic stub. */
     crossNetworkFetcher?: RpcFetcher;
     confidenceOverride?: number;
+    /** Read a contract's own interface off chain when the compiled-in registry
+     *  does not recognise it. Default ON: the registry covers the protocols we
+     *  pinned by hand, and refusing everything else reported `no-abi` for
+     *  contracts that publish a full typed spec. Set false to record against
+     *  the registry alone (no extra RPC). */
+    resolveContractSpecs?: boolean;
+    /** Test seam for the spec lookup. Unset in production, where it is built
+     *  from the network's pinned RPC URL. */
+    specFetcher?: SpecFetcher;
 }
 export type RecordResult = ToolResponse<RecordedTransaction>;
 export declare function recordTransaction(input: RecordInput): Promise<RecordResult>;

package/dist-cjs/record/index.js

@@ -19,11 +19,40 @@
 // defined in src/errors.ts.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.recordTransaction = recordTransaction;
+const stellar_sdk_1 = require("@stellar/stellar-sdk");
+const on_chain_spec_ts_1 = require("../registry/on-chain-spec.js");
 const decode_ts_1 = require("./decode.js");
 const freshness_ts_1 = require("./freshness.js");
 const movements_ts_1 = require("./movements.js");
 const rpc_ts_1 = require("./rpc.js");
 const validate_ts_1 = require("./validate.js");
+/** Second pass over the contracts the compiled-in registry did not recognise.
+ *
+ *  Each candidate's own interface is read off chain and every call it received
+ *  is checked against it; the ones that verify are fed back through the decoder
+ *  as known. Re-decoding rather than patching the first result keeps ONE code
+ *  path computing parseConfidence - a hand-adjusted count here would be a
+ *  second implementation of the gate, free to drift from the real one.
+ *
+ *  Only ever ADDS recognition. A missing spec, an unreachable RPC or a call the
+ *  interface does not describe all leave the recording exactly as it was. */
+async function resolveByOnChainSpec(input, decoded, redecode) {
+    if (input.resolveContractSpecs === false)
+        return decoded;
+    if (decoded.unknownContracts.length === 0)
+        return decoded;
+    const fetcher = input.specFetcher ??
+        (0, on_chain_spec_ts_1.specFetcherFromRpc)(rpc_ts_1.PUBLIC_RPC_URLS[input.network], input.network === 'mainnet' ? stellar_sdk_1.Networks.PUBLIC : stellar_sdk_1.Networks.TESTNET);
+    let resolved;
+    try {
+        resolved = await (0, on_chain_spec_ts_1.resolveContractsByOnChainSpec)(decoded.invocations, decoded.unknownContracts.map((u) => u.contract), fetcher);
+    }
+    catch {
+        // A lookup failure must not fail the recording that already succeeded.
+        return decoded;
+    }
+    return resolved.size === 0 ? decoded : redecode(resolved);
+}
 async function recordTransaction(input) {
     if (!input.network) {
         return err('RECORDING_FAILED', 'network required', false);
@@ -79,6 +108,7 @@ async function recordTransaction(input) {
                 return err('RECORDING_FAILED', e.message, false);
             throw e;
         }
+        decoded = await resolveByOnChainSpec(input, decoded, (known) => (0, decode_ts_1.decodeEnvelope)(fetched.envelopeXdr, events, [], fetched.ledger, known, input.network));
         return finish(input.network, decoded, input.confidenceOverride);
     }
     // XDR mode has no raw on-chain events, so the events-based cross-check is
@@ -96,6 +126,7 @@ async function recordTransaction(input) {
             return err('RECORDING_FAILED', e.message, false);
         return err('RECORDING_FAILED', `failed to decode base64 envelope XDR: ${e.message}`, false);
     }
+    decoded = await resolveByOnChainSpec(input, decoded, (known) => (0, decode_ts_1.decodeEnvelopeXdr)(xdrStr, [], [], 0, known, input.network));
     return finish(input.network, decoded, input.confidenceOverride);
 }
 function combineEvents(raw) {

package/dist-cjs/record/rpc.d.ts

@@ -14,6 +14,10 @@ export interface SorobanTxResponse {
     events: rpc.Api.TransactionEvents;
 }
 export type RpcFetcher = (hash: string) => Promise<SorobanTxResponse | null>;
+/** Exported so the on-chain spec lookup reads from the SAME endpoint the
+ *  recorder fetched the transaction from. Two different endpoints could
+ *  disagree about what a contract is. */
+export declare const PUBLIC_RPC_URLS: Record<Network, string>;
 /** Build a fetcher backed by the public Soroban RPC for the given network.
  *  Injectable by tests via the `fetcher` parameter to `recordTransaction`. */
 export declare function createRpcServer(network: Network): RpcFetcher;

package/dist-cjs/record/rpc.js

@@ -5,10 +5,14 @@
 // Unit tests inject a fetcher so they never hit the network; the integration test
 // uses the real Soroban RPC through `createRpcServer`.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PUBLIC_RPC_URLS = void 0;
 exports.createRpcServer = createRpcServer;
 exports.probeNetwork = probeNetwork;
 const stellar_sdk_1 = require("@stellar/stellar-sdk");
-const PUBLIC_RPC_URLS = {
+/** Exported so the on-chain spec lookup reads from the SAME endpoint the
+ *  recorder fetched the transaction from. Two different endpoints could
+ *  disagree about what a contract is. */
+exports.PUBLIC_RPC_URLS = {
     testnet: 'https://soroban-testnet.stellar.org',
     // The brief pins testnet; mainnet is left to the caller via injection. We keep
     // a public default that matches the brief's note ("e.g. https://mainnet.sorobanrpc.com").
@@ -17,7 +21,7 @@ const PUBLIC_RPC_URLS = {
 /** Build a fetcher backed by the public Soroban RPC for the given network.
  *  Injectable by tests via the `fetcher` parameter to `recordTransaction`. */
 function createRpcServer(network) {
-    const server = new stellar_sdk_1.rpc.Server(PUBLIC_RPC_URLS[network], { allowHttp: false });
+    const server = new stellar_sdk_1.rpc.Server(exports.PUBLIC_RPC_URLS[network], { allowHttp: false });
     return async (hash) => {
         const resp = await server.getTransaction(hash);
         if (resp.status === stellar_sdk_1.rpc.Api.GetTransactionStatus.NOT_FOUND) {
@@ -50,7 +54,7 @@ function createRpcServer(network) {
 /** Lightweight reachability probe used by the integration test to decide whether
  *  to run or self-skip. Sends a JSON-RPC `getHealth` to the public endpoint. */
 async function probeNetwork(network, timeoutMs = 3000) {
-    const url = PUBLIC_RPC_URLS[network];
+    const url = exports.PUBLIC_RPC_URLS[network];
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {

package/dist-cjs/registry/identify.d.ts

@@ -1,5 +1,5 @@
 import type { ScVal } from '../types.ts';
-import type { ProtocolId } from './protocols.ts';
+import type { AbiArg, ProtocolId } from './protocols.ts';
 export interface IdentifiedProtocol {
     protocol: ProtocolId;
     fn: string;
@@ -9,3 +9,12 @@ export interface IdentifiedProtocol {
  *  off, or unknown method on a pinned address). The caller MUST keep the
  *  null path fail-closed. */
 export declare function identifyProtocol(contract: string, method: string, args: ScVal[], network?: 'mainnet' | 'testnet'): IdentifiedProtocol | null;
+/** Compare the decoded args against the ABI signature. Returns true only when
+ *  the arg count matches AND every arg's ScVal subset type matches the ABI's
+ *  declared type. `other` is intentionally NOT a valid ABI match - it means
+ *  the decoder couldn't classify the value, which is exactly the signal
+ *  fail-closed should refuse. */
+/** Exported so the on-chain-spec path checks a call the SAME way a pinned
+ *  protocol does. Reimplementing it there would let the two drift, and a
+ *  looser copy would be the fail-OPEN direction. */
+export declare function argsMatchAbi(expected: AbiArg[], actual: ScVal[]): boolean;

package/dist-cjs/registry/identify.js

@@ -31,6 +31,7 @@
 // ScVal subset type against the ABI signature; mismatch -> null.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.identifyProtocol = identifyProtocol;
+exports.argsMatchAbi = argsMatchAbi;
 const known_addresses_ts_1 = require("./known-addresses.js");
 const protocols_ts_1 = require("./protocols.js");
 /** Identify the protocol for a single (contract, method, args) invocation.
@@ -91,6 +92,9 @@ function identifyProtocol(contract, method, args, network) {
  *  declared type. `other` is intentionally NOT a valid ABI match - it means
  *  the decoder couldn't classify the value, which is exactly the signal
  *  fail-closed should refuse. */
+/** Exported so the on-chain-spec path checks a call the SAME way a pinned
+ *  protocol does. Reimplementing it there would let the two drift, and a
+ *  looser copy would be the fail-OPEN direction. */
 function argsMatchAbi(expected, actual) {
     if (expected.length !== actual.length)
         return false;

package/dist-cjs/registry/on-chain-spec.d.ts

@@ -0,0 +1,37 @@
+import { contract as sdkContract } from '@stellar/stellar-sdk';
+import type { ContractInvocation } from '../types.ts';
+import type { AbiArgType, ProtocolAbi } from './protocols.ts';
+/** Map an XDR spec type to the ScVal subset vocabulary the matcher uses.
+ *
+ *  Returns null for a type the recorder's ScVal subset cannot represent. That
+ *  is deliberate: an argument we cannot type is an argument we cannot check,
+ *  and claiming a match on it would be the fail-OPEN direction. A function
+ *  with any such argument is dropped from the derived ABI, so a call to it
+ *  stays unrecognised rather than being waved through. */
+export declare function abiTypeFromSpecType(specTypeName: string): AbiArgType | null;
+/** The RPC surface this module needs. Narrowed to one method so a test can
+ *  supply a stub without standing up a server, and so the recorder's existing
+ *  RPC client can be passed straight in. */
+export interface SpecFetcher {
+    contractSpec(contractId: string): Promise<sdkContract.Spec | null>;
+}
+/** Build a `SpecFetcher` over the SDK's contract client. */
+export declare function specFetcherFromRpc(rpcUrl: string, networkPassphrase: string): SpecFetcher;
+/** Convert a fetched spec into the ABI shape `identifyProtocol` already
+ *  matches against. Functions with an argument outside the ScVal subset are
+ *  OMITTED rather than partially typed. */
+export declare function abiFromSpec(spec: sdkContract.Spec): ProtocolAbi;
+/** Fetch and convert in one step. Returns null when no usable interface was
+ *  obtained, which the caller must treat as "unrecognised". */
+export declare function fetchContractAbi(contractId: string, fetcher: SpecFetcher): Promise<ProtocolAbi | null>;
+/** Contracts whose EVERY recorded call matches their own published interface.
+ *
+ *  All-or-nothing per contract, deliberately. A contract where one call
+ *  verifies and another does not is a contract we do not understand, and
+ *  marking it recognised would raise confidence on the strength of the call
+ *  we happened to check. The unverified call is the one that matters.
+ *
+ *  A contract with no fetchable spec, or a call naming a function absent from
+ *  it, simply stays unknown - this only ever ADDS recognition, so a failure
+ *  here degrades to today's behaviour rather than to a wrong answer. */
+export declare function resolveContractsByOnChainSpec(invocations: ReadonlyArray<ContractInvocation>, candidates: ReadonlyArray<string>, fetcher: SpecFetcher): Promise<Set<string>>;

package/dist-cjs/registry/on-chain-spec.js

@@ -0,0 +1,159 @@
+"use strict";
+// src/registry/on-chain-spec.ts - read a contract's own interface off chain.
+//
+// The compiled-in registry covers the protocols we pinned by hand. Everything
+// else was reported as `no-abi`, which read as "this contract does not
+// describe itself" when it almost always does: a Soroban contract embeds a
+// typed spec in its wasm, and the network will hand it over. The recorder was
+// refusing calls whose interface was one RPC round-trip away.
+//
+// What this buys is NARROW and deliberately so. A fetched spec says what the
+// contract's arguments ARE, not what they MEAN. So a call verified against it
+// is recognised - the decode is trustworthy, the confidence gate stops
+// refusing it - but the arguments carry the contract's own parameter NAMES
+// rather than a curated meaning, and nothing here infers which argument is a
+// spend or a recipient. A pinned protocol still outranks a fetched spec for
+// exactly that reason, and `identifyProtocol` is consulted first.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abiTypeFromSpecType = abiTypeFromSpecType;
+exports.specFetcherFromRpc = specFetcherFromRpc;
+exports.abiFromSpec = abiFromSpec;
+exports.fetchContractAbi = fetchContractAbi;
+exports.resolveContractsByOnChainSpec = resolveContractsByOnChainSpec;
+const stellar_sdk_1 = require("@stellar/stellar-sdk");
+const identify_ts_1 = require("./identify.js");
+/** Map an XDR spec type to the ScVal subset vocabulary the matcher uses.
+ *
+ *  Returns null for a type the recorder's ScVal subset cannot represent. That
+ *  is deliberate: an argument we cannot type is an argument we cannot check,
+ *  and claiming a match on it would be the fail-OPEN direction. A function
+ *  with any such argument is dropped from the derived ABI, so a call to it
+ *  stays unrecognised rather than being waved through. */
+function abiTypeFromSpecType(specTypeName) {
+    switch (specTypeName) {
+        case 'scSpecTypeAddress':
+            return 'address';
+        case 'scSpecTypeI128':
+            return 'i128';
+        case 'scSpecTypeU64':
+        case 'scSpecTypeI64':
+            return 'u64';
+        case 'scSpecTypeU32':
+        case 'scSpecTypeI32':
+            return 'u32';
+        case 'scSpecTypeSymbol':
+            return 'symbol';
+        case 'scSpecTypeVec':
+            return 'vec';
+        case 'scSpecTypeBytes':
+        case 'scSpecTypeBytesN':
+            return 'bytes';
+        case 'scSpecTypeMap':
+            return 'map';
+        default:
+            return null;
+    }
+}
+/** Build a `SpecFetcher` over the SDK's contract client. */
+function specFetcherFromRpc(rpcUrl, networkPassphrase) {
+    return {
+        async contractSpec(contractId) {
+            try {
+                const client = await stellar_sdk_1.contract.Client.from({ contractId, networkPassphrase, rpcUrl });
+                return client.spec ?? null;
+            }
+            catch {
+                // A contract with no spec, an unreachable RPC and a bad address all
+                // land here and all mean the same thing to the caller: no interface
+                // was obtained, so the contract stays unrecognised. Fail closed.
+                return null;
+            }
+        },
+    };
+}
+/** Convert a fetched spec into the ABI shape `identifyProtocol` already
+ *  matches against. Functions with an argument outside the ScVal subset are
+ *  OMITTED rather than partially typed. */
+function abiFromSpec(spec) {
+    const abi = {};
+    for (const fn of spec.funcs()) {
+        const name = fn.name().toString();
+        // The constructor is not callable after deployment, so a recorded
+        // invocation can never be one. Keeping it would only widen the surface.
+        if (name === '__constructor')
+            continue;
+        const args = [];
+        let usable = true;
+        for (const input of fn.inputs()) {
+            const type = abiTypeFromSpecType(input.type().switch().name);
+            if (type === null) {
+                usable = false;
+                break;
+            }
+            const argName = input.name().toString();
+            args.push({
+                name: argName,
+                type,
+                // The contract's own parameter name is the honest description. It is
+                // NOT a curated meaning - nothing here knows whether `value` is a
+                // spend - so downstream must not treat it as one.
+                meaning: `${argName} (from the contract's on-chain interface)`,
+            });
+        }
+        if (usable)
+            abi[name] = { args };
+    }
+    return abi;
+}
+/** Fetch and convert in one step. Returns null when no usable interface was
+ *  obtained, which the caller must treat as "unrecognised". */
+async function fetchContractAbi(contractId, fetcher) {
+    const spec = await fetcher.contractSpec(contractId);
+    if (spec === null)
+        return null;
+    const abi = abiFromSpec(spec);
+    return Object.keys(abi).length === 0 ? null : abi;
+}
+/** Every contract invoked anywhere in the tree, with the calls made on it. */
+function callsByContract(invocations) {
+    const out = new Map();
+    const walk = (inv) => {
+        const list = out.get(inv.contract) ?? [];
+        list.push({ fn: inv.fn, args: inv.args });
+        out.set(inv.contract, list);
+        for (const sub of inv.subInvocations)
+            walk(sub);
+    };
+    for (const inv of invocations)
+        walk(inv);
+    return out;
+}
+/** Contracts whose EVERY recorded call matches their own published interface.
+ *
+ *  All-or-nothing per contract, deliberately. A contract where one call
+ *  verifies and another does not is a contract we do not understand, and
+ *  marking it recognised would raise confidence on the strength of the call
+ *  we happened to check. The unverified call is the one that matters.
+ *
+ *  A contract with no fetchable spec, or a call naming a function absent from
+ *  it, simply stays unknown - this only ever ADDS recognition, so a failure
+ *  here degrades to today's behaviour rather than to a wrong answer. */
+async function resolveContractsByOnChainSpec(invocations, candidates, fetcher) {
+    const resolved = new Set();
+    const calls = callsByContract(invocations);
+    for (const contract of new Set(candidates)) {
+        const made = calls.get(contract);
+        if (!made || made.length === 0)
+            continue;
+        const abi = await fetchContractAbi(contract, fetcher);
+        if (abi === null)
+            continue;
+        const everyCallVerifies = made.every((c) => {
+            const entry = abi[c.fn];
+            return entry !== undefined && (0, identify_ts_1.argsMatchAbi)(entry.args, c.args);
+        });
+        if (everyCallVerifies)
+            resolved.add(contract);
+    }
+    return resolved;
+}

package/dist-cjs/review-card/builder.js

@@ -84,15 +84,31 @@ function walkPredicate(node, visit) {
             for (const child of node.children)
                 walkPredicate(child, visit);
             return;
+        // NOT descended into. Every line the card emits reads as a requirement,
+        // and `and` is what makes that true. Listing an `or`'s branches as
+        // separate lines would state the opposite of what the policy means, so
+        // the whole disjunction is rendered as ONE line instead.
+        case 'or':
+            visit(node);
+            return;
         case 'in':
             visit(node);
             return;
         case 'eq':
+        case 'lt':
         case 'lte':
+        case 'gt':
+        case 'gte':
             visit(node);
             return;
     }
 }
+/** Argument index of a `call_arg` leaf, for the scaled-comparison line. Any
+ *  other leaf renders as its kind so the line stays readable rather than
+ *  claiming an index that does not exist. */
+function leftArgLabel(leaf) {
+    return leaf.kind === 'call_arg' ? String(leaf.index) : `<${leaf.kind}>`;
+}
 /** Render ONE constraint sentence for ONE interpreter predicate node. The
  *  shape of the output is pinned by Task 7b so the test suite can assert
  *  byte-for-byte equality. Returns `null` when the node is a structural
@@ -101,14 +117,38 @@ function renderConstraint(node) {
     switch (node.op) {
         case 'and':
             return null;
+        case 'or': {
+            // One line for the whole disjunction. If any branch is a shape the
+            // card cannot render, the entire line is withheld rather than shown
+            // with a branch missing - a disjunction with a branch dropped reads
+            // as STRICTER than it is, which is the dangerous direction.
+            const parts = node.children.map(renderConstraint);
+            if (parts.some((p) => p === null))
+                return null;
+            return `Either: ${parts.join(' OR ')}`;
+        }
         case 'eq':
+        case 'lt':
         case 'lte':
+        case 'gt':
+        case 'gte':
             return renderComparison(node);
         case 'in':
             return renderMembership(node);
     }
 }
 function renderComparison(node) {
+    // The slippage floor: OP(call_arg[out], call_arg_scaled(in, num, den)).
+    // Rendered explicitly because the human approving the signature has to see
+    // that the bound is a RATIO of another argument, not a fixed amount.
+    if (node.right.kind === 'call_arg_scaled') {
+        const s = node.right;
+        return `arg[${leftArgLabel(node.left)}] ${(0, render_leaf_ts_1.comparisonOpText)(node.op)} arg[${s.index}] * ${s.num}/${s.den}`;
+    }
+    if (node.left.kind === 'call_arg_scaled') {
+        const s = node.left;
+        return `arg[${s.index}] * ${s.num}/${s.den} ${(0, render_leaf_ts_1.comparisonOpText)(node.op)} arg[${leftArgLabel(node.right)}]`;
+    }
     const left = node.left;
     const right = node.right;
     // eq(call_contract, literal_address) -> Contract must be <addr>

package/dist-cjs/review-card/cross-check.js

@@ -42,8 +42,30 @@ function collect(node, out) {
             for (const child of node.children)
                 collect(child, out);
             return;
+        // ONE line for the whole disjunction, mirroring the builder. Emitting a
+        // line per branch would claim every branch is required, which is the
+        // opposite of what `or` means. If any branch renders to nothing the whole
+        // line is withheld, again mirroring the builder - a disjunction missing a
+        // branch reads STRICTER than it is.
+        case 'or': {
+            const parts = [];
+            for (const child of node.children) {
+                const childOut = [];
+                collect(child, childOut);
+                if (childOut.length !== 1)
+                    return;
+                parts.push(childOut[0]);
+            }
+            if (parts.length === 0)
+                return;
+            out.push(`Either: ${parts.join(' OR ')}`);
+            return;
+        }
         case 'eq':
+        case 'lt':
         case 'lte':
+        case 'gt':
+        case 'gte':
             pushComparison(node.left, node.right, node.op, out);
             return;
         case 'in':
@@ -52,6 +74,18 @@ function collect(node, out) {
     }
 }
 function pushComparison(left, right, op, out) {
+    // Slippage floor, mirroring the builder. The human has to see that the
+    // bound is a RATIO of another argument, not a fixed amount.
+    if (right.kind === 'call_arg_scaled') {
+        const label = left.kind === 'call_arg' ? String(left.index) : `<${left.kind}>`;
+        out.push(`arg[${label}] ${(0, render_leaf_ts_1.comparisonOpText)(op)} arg[${right.index}] * ${right.num}/${right.den}`);
+        return;
+    }
+    if (left.kind === 'call_arg_scaled') {
+        const label = right.kind === 'call_arg' ? String(right.index) : `<${right.kind}>`;
+        out.push(`arg[${left.index}] * ${left.num}/${left.den} ${(0, render_leaf_ts_1.comparisonOpText)(op)} arg[${label}]`);
+        return;
+    }
     if (left.kind === 'call_contract' && op === 'eq' && right.kind === 'literal_address') {
         out.push(`Contract must be ${right.value}`);
         return;

package/dist-cjs/review-card/render-leaf.d.ts

@@ -1,4 +1,4 @@
 import type { PredicateLeaf } from '../types.ts';
 export declare function renderVecElement(leaf: PredicateLeaf): string;
 export declare function renderHaystackElement(leaf: PredicateLeaf): string;
-export declare function comparisonOpText(op: 'eq' | 'lte'): string;
+export declare function comparisonOpText(op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte'): string;

package/dist-cjs/review-card/render-leaf.js

@@ -25,6 +25,7 @@ function renderVecElement(leaf) {
         case 'call_arg':
         case 'call_arg_len':
         case 'call_arg_field':
+        case 'call_arg_scaled':
             return `<${leaf.kind}>`;
     }
 }
@@ -44,8 +45,14 @@ function renderHaystackElement(leaf) {
 }
 function comparisonOpText(op) {
     switch (op) {
+        case 'lt':
+            return '<';
         case 'lte':
             return '<=';
+        case 'gt':
+            return '>';
+        case 'gte':
+            return '>=';
         case 'eq':
             return '==';
     }