@crediolabs/policy-synth 0.4.0 → 0.5.1

package/dist/simulate/evaluate.js

@@ -1,4 +1,4 @@
-// src/simulate/evaluate.ts - TypeScript reference evaluator for grammar version 3.
+// src/simulate/evaluate.ts - TypeScript reference evaluator for grammar version 4.
 //
 // Pure function. Determinism: same `(predicate, ctx)` -> byte-identical result,
 // no clock, no randomness. Deny order (deny on FIRST violation, stable reason):
@@ -8,12 +8,13 @@
 //   3. `in` membership; empty haystack ALWAYS denies         -> 'NOT_IN_ALLOWLIST'
 //   4. otherwise permit.
 //
-// Grammar version 3 nodes: and, eq, lte
-// Grammar version 3 leaves: call_contract, call_fn, call_arg(i),
+// Grammar version 4 nodes: and, or, eq, lt, lte, gt, gte, in
+// Grammar version 4 leaves: call_contract, call_fn, call_arg(i),
 //   call_arg_len(i), call_arg_field(i, element, field),
+//   call_arg_scaled(i, num, den),
 //   literal_address, literal_i128, literal_symbol, literal_u32, literal_vec
-// Grammar version 3 deny reasons: ARG_MISMATCH, CONTRACT_SCOPE,
-//   UNSUPPORTED_NODE, NOT_IN_ALLOWLIST
+// Grammar version 4 deny reasons: ARG_MISMATCH, CONTRACT_SCOPE,
+//   ARITHMETIC_OVERFLOW, UNSUPPORTED_NODE, NOT_IN_ALLOWLIST, SLIPPAGE_FLOOR
 /** Evaluate a `PredicateNode` against the candidate call described by `ctx`.
  *  Pure function. Returns `{ permit: true }` or `{ permit: false; reason }`. */
 export function evaluate(predicate, ctx) {
@@ -33,8 +34,25 @@ function walk(node, ctx) {
             }
             return lastDeny ?? { permit: true };
         }
+        // Permits on the first branch that holds; when none does, reports the
+        // FIRST branch's reason. Mirrors `Node::Or` in the Rust evaluator, which
+        // the conformance suite pins.
+        case 'or': {
+            let firstDeny = null;
+            for (const child of node.children) {
+                const r = walk(child, ctx);
+                if (r.permit)
+                    return r;
+                if (firstDeny === null)
+                    firstDeny = r;
+            }
+            return firstDeny ?? { permit: false, reason: 'UNSUPPORTED_NODE' };
+        }
         case 'eq':
+        case 'lt':
         case 'lte':
+        case 'gt':
+        case 'gte':
             return evalCompare(node.op, node.left, node.right, ctx);
         case 'in':
             return evalIn(node.needle, node.haystack, ctx);
@@ -42,6 +60,16 @@ function walk(node, ctx) {
 }
 /** Comparison leaf evaluation. */
 function evalCompare(op, left, right, ctx) {
+    // Scaled operands first, so the dedicated reasons reach the caller instead
+    // of a generic mismatch. Right-hand dispatch leads because
+    // `out >= in * num / den` is the canonical swap form. Mirrors the order in
+    // `eval_compare` on the Rust side.
+    if (right.kind === 'call_arg_scaled') {
+        return evalScaledCompare(op, left, right, true, ctx);
+    }
+    if (left.kind === 'call_arg_scaled') {
+        return evalScaledCompare(op, right, left, false, ctx);
+    }
     // CONTRACT_SCOPE on call_contract eq
     if (left.kind === 'call_contract' && op === 'eq') {
         if (right.kind !== 'literal_address')
@@ -96,6 +124,53 @@ function evalCompare(op, left, right, ctx) {
     // Unknown leaf/op combination - structural fail-closed.
     return { permit: false, reason: 'UNSUPPORTED_NODE' };
 }
+/** i128 bounds. The contract computes in i128 and denies on overflow, so the
+ *  reference has to draw the same line or the two layers disagree on inputs
+ *  near the boundary. */
+const I128_MIN = -(2n ** 127n);
+const I128_MAX = 2n ** 127n - 1n;
+/** Comparison where one side is `call_arg_scaled`. Mirrors
+ *  `eval_scaled_arg_compare`: `args[index] * num / den` truncating toward
+ *  zero, ARITHMETIC_OVERFLOW on arithmetic that does not fit or a zero
+ *  denominator, SLIPPAGE_FLOOR on a comparison that simply fails. */
+function evalScaledCompare(op, other, scaled, scaledOnRight, ctx) {
+    // Chaining two computed operands has no meaning a review card could state.
+    if (other.kind === 'call_arg_scaled')
+        return { permit: false, reason: 'UNSUPPORTED_NODE' };
+    // Could not READ the operand is a different failure from read-and-missed.
+    const input = argNumericBigInt(ctx.args[scaled.index]);
+    if (input === null)
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    let num;
+    let den;
+    try {
+        num = BigInt(scaled.num);
+        den = BigInt(scaled.den);
+    }
+    catch {
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    }
+    if (den === 0n)
+        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
+    const product = input * num;
+    if (product < I128_MIN || product > I128_MAX) {
+        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
+    }
+    // BigInt division already truncates toward zero, matching i128 semantics.
+    const quotient = product / den;
+    if (quotient < I128_MIN || quotient > I128_MAX) {
+        return { permit: false, reason: 'ARITHMETIC_OVERFLOW' };
+    }
+    const otherVal = other.kind === 'call_arg'
+        ? argNumericBigInt(ctx.args[other.index])
+        : literalNumericBigInt(other);
+    if (otherVal === null)
+        return { permit: false, reason: 'ARG_MISMATCH' };
+    const [a, b] = scaledOnRight ? [otherVal, quotient] : [quotient, otherVal];
+    return bigintCmp(op, a.toString(), b.toString())
+        ? { permit: true }
+        : { permit: false, reason: 'SLIPPAGE_FLOOR' };
+}
 /** Per-ScVal equality. Handles literal_vec as an EXACT ordered sequence:
  *  compare element-by-element in order; deny if length or any element differs.
  *  Opaque args (`type: 'other'`) fail closed. */
@@ -265,7 +340,13 @@ function bigintCmp(op, aStr, bStr) {
     switch (op) {
         case 'eq':
             return a === b;
+        case 'lt':
+            return a < b;
         case 'lte':
             return a <= b;
+        case 'gt':
+            return a > b;
+        case 'gte':
+            return a >= b;
     }
 }

package/dist/synth/declare.d.ts

@@ -18,6 +18,19 @@ export interface PolicyDeclaration {
      *  explicitly. A rule that permits nothing is a plausible thing to want and
      *  an implausible thing to want by accident. */
     allowZeroCap?: boolean;
+    /** Minimum output as a ratio of the call's own input: the output argument
+     *  must be at least `input * num / den`.
+     *
+     *  A swap's acceptable output depends on the size of the trade, so a fixed
+     *  floor would pin the policy to one trade size. The ratio is DECLARED, never
+     *  inferred from a recording: a recorded rate is a price at one moment, and
+     *  freezing it as policy would deny ordinary trades later. */
+    minOutputRatio?: {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    };
 }
 export interface DeclaredPredicate {
     predicate: PredicateNode;

package/dist/synth/declare.js

@@ -15,11 +15,12 @@
 // first: it constrains the amount in THIS call rather than implying a rolling
 // total nothing tracks.
 //
-// What a declaration can say maps one-to-one onto grammar 3:
-//   fn         -> eq(call_fn, literal_symbol)
-//   contract   -> eq(call_contract, literal_address)
-//   maxAmount  -> lte(call_arg(i), literal_i128)
-//   recipients -> in(call_arg(j), [literal_address, ...])
+// What a declaration can say maps one-to-one onto grammar 4:
+//   fn            -> eq(call_fn, literal_symbol)
+//   contract      -> eq(call_contract, literal_address)
+//   maxAmount     -> lte(call_arg(i), literal_i128)
+//   recipients    -> in(call_arg(j), [literal_address, ...])
+//   minOutputRatio-> gte(call_arg(out), call_arg_scaled(in, num, den))
 import { isStellarAddress } from "./address.js";
 /** Argument positions of the SEP-41 `transfer(from, to, amount)` shape. A
  *  declaration that names a different method almost certainly has different
@@ -84,6 +85,34 @@ export function declarePredicate(d) {
             right: { kind: 'literal_i128', value: d.maxAmount },
         });
     }
+    if (d.minOutputRatio !== undefined) {
+        const { num, den, inputArgIndex, outputArgIndex } = d.minOutputRatio;
+        if (!/^[0-9]+$/.test(num) || !/^[0-9]+$/.test(den)) {
+            throw declareError('SYNTHESIS_ERROR', `minOutputRatio num/den must be unsigned integers, got "${num}"/"${den}" (a 1% slippage tolerance is num "99", den "100")`);
+        }
+        // Both are refused on chain at install (INVALID_SCALED_RATIO). Refusing
+        // here too means the caller learns before a transaction is built.
+        if (den === '0') {
+            throw declareError('SYNTHESIS_ERROR', 'minOutputRatio.den is zero: the ratio has no value');
+        }
+        if (num === '0') {
+            throw declareError('SYNTHESIS_ERROR', 'minOutputRatio.num is zero: the floor would be zero, which constrains nothing. Omit it instead.');
+        }
+        if (inputArgIndex === outputArgIndex) {
+            throw declareError('SYNTHESIS_ERROR', `minOutputRatio bounds arg[${inputArgIndex}] against itself, which is true for any ratio at or below 1 and false above it - never a slippage floor. Pass the distinct input and output positions.`);
+        }
+        if (BigInt(num) > BigInt(den)) {
+            // Demanding MORE out than went in is not slippage protection; it is a
+            // rule that denies every honest trade. Loud beats a policy that never
+            // permits.
+            warnings.push(`minOutputRatio ${num}/${den} is above 1: it requires the output to EXCEED the input, which no ordinary swap satisfies. Check the ratio is not inverted.`);
+        }
+        children.push({
+            op: 'gte',
+            left: { kind: 'call_arg', index: outputArgIndex },
+            right: { kind: 'call_arg_scaled', index: inputArgIndex, num, den },
+        });
+    }
     // A single conjunct is emitted bare. `and` with one child encodes to
     // different bytes than the child alone, and the extra node buys nothing.
     const predicate = children.length === 1 ? children[0] : { op: 'and', children };

package/dist/synth/synthesize-from-recording.js

@@ -1,7 +1,7 @@
 // src/synth/synthesize-from-recording.ts - recording-path orchestrator.
 //
 // `synthesizeFromRecording` INFERS a bounded policy from a `RecordedTransaction`
-// via the `PolicyIR` + interpreter adapter pair.
+// via the composer + interpreter adapter pair.
 // Flow: validate -> parseConfidence gate -> lower -> decideScope -> composeFromRecording
 // -> interpreter compile + self-verify.
 // Same (tx, opts) -> byte-identical ProposedPolicy (no randomness, clock, globals).

package/dist/types.d.ts

@@ -124,7 +124,7 @@ export type PolicyRef = {
  *  `contracts/policy-interpreter/src/version.rs`. Every value this package puts on
  *  the wire derives from here; `grammar-version-parity.test.ts` pins it to the
  *  contract so a skew cannot pass a green test run. */
-export declare const GRAMMAR_VERSION: 3;
+export declare const GRAMMAR_VERSION: 4;
 /** A serialised predicate document stored against a (smart_account, rule_id) pair. */
 export interface PolicyDocument {
     /** Grammar version baked into the interpreter wasm. Fail-closed strict match at install
@@ -146,14 +146,29 @@ export interface PolicyDocument {
 export type PredicateNode = {
     op: 'and';
     children: PredicateNode[];
+} | {
+    op: 'or';
+    children: PredicateNode[];
 } | {
     op: 'eq';
     left: PredicateLeaf;
     right: PredicateLeaf;
+} | {
+    op: 'lt';
+    left: PredicateLeaf;
+    right: PredicateLeaf;
 } | {
     op: 'lte';
     left: PredicateLeaf;
     right: PredicateLeaf;
+} | {
+    op: 'gt';
+    left: PredicateLeaf;
+    right: PredicateLeaf;
+} | {
+    op: 'gte';
+    left: PredicateLeaf;
+    right: PredicateLeaf;
 } | {
     op: 'in';
     needle: PredicateLeaf;
@@ -174,6 +189,11 @@ export type PredicateLeaf = {
     index: number;
     element: number;
     field: string;
+} | {
+    kind: 'call_arg_scaled';
+    index: number;
+    num: string;
+    den: string;
 } | {
     kind: 'literal_address';
     value: string;

package/dist/types.js

@@ -52,4 +52,4 @@ export const PREDICATE_CAPS = {
  *  `contracts/policy-interpreter/src/version.rs`. Every value this package puts on
  *  the wire derives from here; `grammar-version-parity.test.ts` pins it to the
  *  contract so a skew cannot pass a green test run. */
-export const GRAMMAR_VERSION = 3;
+export const GRAMMAR_VERSION = 4;

package/dist-cjs/adapters/interpreter/adapter.d.ts

@@ -12,9 +12,9 @@ export interface InterpreterAdapterConfig {
      *  rejected as `SCOPE_SELF_CALL`. */
     smartAccountAddress: string;
 }
-/** The result of compiling a PolicyIR for this backend. */
+/** The result of compiling a `ComposedRule` for this backend. */
 export interface CompileResult {
-    /** false => some IR construct this backend cannot express (see `uncovered`). */
+    /** false => some constraint this backend cannot express (see `uncovered`). */
     covered: boolean;
     /** Human-readable list of unsupported constructs. */
     uncovered: string[];

package/dist-cjs/adapters/interpreter/adapter.js

@@ -1,7 +1,7 @@
 "use strict";
-// src/adapters/interpreter/adapter.ts - the interpreter-policy CustodyAdapter.
+// src/adapters/interpreter/adapter.ts - the interpreter-policy adapter.
 //
-// Compiles a PolicyIR to a single interpreter `PolicyDocument` + `PolicyRef`
+// Compiles a `ComposedRule` to a single interpreter `PolicyDocument` + `PolicyRef`
 // carrying the canonical predicate encoding from `predicate/encode.ts`. This is
 // the only backend; the compose step lowers every constraint to it.
 //
@@ -138,7 +138,11 @@ function assertNoSelfCall(node, config) {
         }
     };
     switch (node.op) {
+        // Both boolean nodes recurse. `or` is listed explicitly rather than left
+        // to a default branch: this is a security check, and a new node kind must
+        // fail to compile here rather than silently skip it.
         case 'and':
+        case 'or':
             for (const c of node.children)
                 assertNoSelfCall(c, config);
             return;
@@ -147,7 +151,11 @@ function assertNoSelfCall(node, config) {
             for (const h of node.haystack)
                 checkLeaf(h);
             return;
-        default:
+        case 'eq':
+        case 'lt':
+        case 'lte':
+        case 'gt':
+        case 'gte':
             checkLeaf(node.left);
             checkLeaf(node.right);
     }

package/dist-cjs/errors.d.ts

@@ -1,4 +1,9 @@
-export type ErrorCode = 'RECORDING_FAILED' | 'RECORDING_VALIDATION_FAILED' | 'SCOPE_UNRESOLVED' | 'SYNTHESIS_ERROR' | 'MALFORMED_PREDICATE' | 'SIMULATION_ERROR' | 'VERIFICATION_FAILED' | 'DENY_CASE_FAILURE' | 'PERMIT_CASE_FAILED' | 'SUMMARY_DRIFT' | 'INSTALL_BUILD_FAILED' | 'INSTALL_CONFIRM_MISSING' | 'INSTALL_CONFIRM_EXPIRED' | 'REVOKE_BUILD_FAILED' | 'REVOKE_CONFIRM_MISSING' | 'USER_REJECTED_SIGN' | 'WALLET_TIMEOUT' | 'WALLET_UNAVAILABLE' | 'PREDICATE_TOO_LARGE' | 'PREDICATE_TOO_DEEP' | 'TOO_MANY_LEAVES' | 'IN_OPERAND_LIMIT' | 'POLICY_CAP_EXCEEDED' | 'WASM_TOO_LARGE' | 'MASTER_AUTH_REQUIRED' | 'NONCE_REPLAY' | 'VERSION_MISMATCH' | 'ARITHMETIC_OVERFLOW' | 'AMOUNT_OVERFLOW' | 'RULE_SIGNERS_CHANGED' | 'SCOPE_SELF_CALL' | 'ARG_MISMATCH' | 'CONTRACT_SCOPE' | 'UNSUPPORTED_NODE' | 'STATEFUL_BOUND' | 'NOT_IN_ALLOWLIST' | 'COMPILE_OK' | 'COMPILE_GATE_FAILED';
+export type ErrorCode = 'RECORDING_FAILED' | 'RECORDING_VALIDATION_FAILED' | 'SCOPE_UNRESOLVED' | 'SYNTHESIS_ERROR' | 'MALFORMED_PREDICATE' | 'SIMULATION_ERROR' | 'VERIFICATION_FAILED' | 'DENY_CASE_FAILURE' | 'PERMIT_CASE_FAILED' | 'SUMMARY_DRIFT' | 'INSTALL_BUILD_FAILED' | 'INSTALL_CONFIRM_MISSING' | 'INSTALL_CONFIRM_EXPIRED' | 'REVOKE_BUILD_FAILED' | 'REVOKE_CONFIRM_MISSING' | 'USER_REJECTED_SIGN' | 'WALLET_TIMEOUT' | 'WALLET_UNAVAILABLE' | 'PREDICATE_TOO_LARGE' | 'PREDICATE_TOO_DEEP' | 'TOO_MANY_LEAVES' | 'IN_OPERAND_LIMIT' | 'POLICY_CAP_EXCEEDED' | 'WASM_TOO_LARGE' | 'MASTER_AUTH_REQUIRED' | 'NONCE_REPLAY' | 'VERSION_MISMATCH' | 'ARITHMETIC_OVERFLOW' | 'AMOUNT_OVERFLOW' | 'RULE_SIGNERS_CHANGED' | 'SCOPE_SELF_CALL' | 'ARG_MISMATCH' | 'CONTRACT_SCOPE' | 'UNSUPPORTED_NODE' | 'STATEFUL_BOUND' | 'NOT_IN_ALLOWLIST'
+/** A comparison against a `call_arg_scaled` operand failed (contract 107). */
+ | 'SLIPPAGE_FLOOR'
+/** A `call_arg_scaled` ratio is zero or non-positive. Refused at install
+ *  (contract 214) and mirrored at encode. */
+ | 'INVALID_SCALED_RATIO' | 'COMPILE_OK' | 'COMPILE_GATE_FAILED';
 export interface ToolError {
     code: ErrorCode;
     message: string;

package/dist-cjs/install/authority-overlap.js

@@ -134,6 +134,18 @@ function permittedSelectors(node) {
                 acc = intersectSelectors(acc, permittedSelectors(child));
             return acc;
         }
+        case 'or': {
+            // Any branch may hold, so the permitted set is the UNION. A union of
+            // over-approximations is still an over-approximation, so this keeps the
+            // fail-safe direction while staying tighter than the wildcard the
+            // default branch would give. Precision matters here: `or` is how a
+            // policy says "pair A or pair B", and widening that to the wildcard
+            // would report an overlap against every rule on the account.
+            const acc = [];
+            for (const child of node.children)
+                acc.push(...permittedSelectors(child));
+            return dedupe(acc);
+        }
         case 'eq': {
             const sel = selectorFromEq(node.left, node.right);
             return sel === null ? [WILDCARD] : [sel];

package/dist-cjs/install/build-add-context-rule.d.ts

@@ -23,7 +23,7 @@ export interface BuildAddContextRuleArgs {
      *  before the chain does; the contract will refuse a mismatch again. */
     grammarVersion?: number;
 }
-export declare const DEFAULT_GRAMMAR_VERSION: 3;
+export declare const DEFAULT_GRAMMAR_VERSION: 4;
 /** The verb `add_context_rule` takes on the wire. */
 export declare const ADD_CONTEXT_RULE_SYMBOL: "add_context_rule";
 /** Tuple of `ScVal` arguments to pass to `Operation.invokeHostFunction` for

package/dist-cjs/install/read-account-rules.d.ts

@@ -0,0 +1,79 @@
+import { rpc, xdr } from '@stellar/stellar-sdk';
+import type { SignerDraft } from '../types.ts';
+import type { ContextType, ObservedRule } from './authority-overlap.ts';
+/** `storage.rs` - the third element of the persistent doc key tuple. */
+export declare const K_DOC = 1;
+/** Persistent-storage key for a rule's stored document:
+ *  `(account, rule_id, K_DOC)`. */
+export declare function docKeyScVal(smartAccount: string, ruleId: number): xdr.ScVal;
+/** Ledger key for the interpreter's persistent entry holding that document. */
+export declare function docLedgerKey(interpreter: string, smartAccount: string, ruleId: number): xdr.LedgerKey;
+/** OZ `ContextRuleType`. An unrecognised tag is reported as `default`, which
+ *  is the widest reading and therefore the safe one: it makes the rule look
+ *  like it could serve any call, so overlap is over-reported, never missed. */
+export declare function decodeContextType(v: xdr.ScVal | undefined): ContextType;
+/** OZ `Signer::Delegated(Address) | Signer::External(Address, Bytes)`. */
+export declare function decodeSigner(v: xdr.ScVal): SignerDraft | undefined;
+/** A full OZ `ContextRule` as returned by `get_context_rule(id)`.
+ *  `predicate` is filled in separately from the ledger entry. */
+export declare function decodeContextRule(v: xdr.ScVal): ObservedRule | undefined;
+/** The interpreter's `StoredDoc { predicate_bytes }`. */
+export declare function decodeStoredPredicateBytes(v: xdr.ScVal): Buffer | undefined;
+/** The three reads the scan needs. Kept as an interface so the collection
+ *  below is testable without a network. */
+export interface AccountRuleReader {
+    /** OZ `get_context_rules_count()`. */
+    getContextRuleCount(smartAccount: string): Promise<number>;
+    /** OZ `get_context_rule(id)`. Undefined when the id is absent. */
+    getContextRule(smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>;
+    /** The interpreter's persistent `StoredDoc` entry, read as a ledger entry.
+     *  Undefined when no document is stored for that rule. */
+    getStoredDoc(interpreter: string, smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>;
+}
+/** How far the id scan will probe before giving up. OZ imposes no per-account
+ *  rule cap, so there is no exact bound to derive; this one is far above any
+ *  realistic account and keeps a malformed `Count` from spinning forever. */
+export declare const MAX_RULE_ID_SCAN = 512;
+export interface CollectedRules {
+    rules: ObservedRule[];
+    /** Rule ids whose stored predicate could not be read even though the
+     *  interpreter is attached. Such a rule is reported without a predicate,
+     *  which classifies it as opaque rather than as safely narrow. */
+    unreadablePredicateRuleIds: number[];
+    /** True when the scan stopped before accounting for every live rule. The
+     *  result is then a SUBSET of the account's rules, so an empty overlap list
+     *  proves nothing and the caller must not present it as safety. */
+    incomplete: boolean;
+}
+/**
+ * Every context rule on the account, with predicates filled in for the rules
+ * our interpreter polices.
+ *
+ * Rule ids are NOT contiguous. OZ assigns them from a monotonic `NextId` and
+ * decrements `Count` on removal without ever reusing an id, so after any
+ * removal `Count < NextId` and the live ids have gaps. Iterating `0..Count-1`
+ * would silently skip live rules at higher ids, and a skipped rule is a missed
+ * overlap - the one error that reports safety which does not exist. Instead the
+ * scan walks ids upward until it has accounted for `Count` live rules.
+ *
+ * A rule whose predicate cannot be read is deliberately left without one. That
+ * demotes it to the `foreign` class, so the scan reports it as opaque instead
+ * of assuming it is narrow.
+ */
+export declare function collectObservedRules(args: {
+    reader: AccountRuleReader;
+    smartAccount: string;
+    interpreterAddress: string;
+    maxRuleIdScan?: number;
+}): Promise<CollectedRules>;
+/**
+ * An `AccountRuleReader` over a live RPC server.
+ *
+ * The two OZ getters are read-only simulations: the source account is
+ * constructed locally because a simulation never checks its sequence number,
+ * and asking the network for a random key would 404.
+ *
+ * The stored document is fetched as a ledger entry rather than a contract
+ * call, because the interpreter publishes no getter for it.
+ */
+export declare function accountRuleReaderFromServer(server: rpc.Server, networkPassphrase: string): AccountRuleReader;