@crediolabs/policy-synth 0.4.0 → 0.5.1

package/src/synth/declare.ts

@@ -15,11 +15,12 @@
 // first: it constrains the amount in THIS call rather than implying a rolling
 // total nothing tracks.
 //
-// What a declaration can say maps one-to-one onto grammar 3:
-//   fn         -> eq(call_fn, literal_symbol)
-//   contract   -> eq(call_contract, literal_address)
-//   maxAmount  -> lte(call_arg(i), literal_i128)
-//   recipients -> in(call_arg(j), [literal_address, ...])
+// What a declaration can say maps one-to-one onto grammar 4:
+//   fn            -> eq(call_fn, literal_symbol)
+//   contract      -> eq(call_contract, literal_address)
+//   maxAmount     -> lte(call_arg(i), literal_i128)
+//   recipients    -> in(call_arg(j), [literal_address, ...])
+//   minOutputRatio-> gte(call_arg(out), call_arg_scaled(in, num, den))
 
 import type { ToolError } from '../errors.ts'
 import type { PredicateLeaf, PredicateNode } from '../types.ts'
@@ -52,6 +53,14 @@ export interface PolicyDeclaration {
    *  explicitly. A rule that permits nothing is a plausible thing to want and
    *  an implausible thing to want by accident. */
   allowZeroCap?: boolean
+  /** Minimum output as a ratio of the call's own input: the output argument
+   *  must be at least `input * num / den`.
+   *
+   *  A swap's acceptable output depends on the size of the trade, so a fixed
+   *  floor would pin the policy to one trade size. The ratio is DECLARED, never
+   *  inferred from a recording: a recorded rate is a price at one moment, and
+   *  freezing it as policy would deny ordinary trades later. */
+  minOutputRatio?: { num: string; den: string; inputArgIndex: number; outputArgIndex: number }
 }
 
 export interface DeclaredPredicate {
@@ -137,6 +146,46 @@ export function declarePredicate(d: PolicyDeclaration): DeclaredPredicate {
     })
   }
 
+  if (d.minOutputRatio !== undefined) {
+    const { num, den, inputArgIndex, outputArgIndex } = d.minOutputRatio
+    if (!/^[0-9]+$/.test(num) || !/^[0-9]+$/.test(den)) {
+      throw declareError(
+        'SYNTHESIS_ERROR',
+        `minOutputRatio num/den must be unsigned integers, got "${num}"/"${den}" (a 1% slippage tolerance is num "99", den "100")`
+      )
+    }
+    // Both are refused on chain at install (INVALID_SCALED_RATIO). Refusing
+    // here too means the caller learns before a transaction is built.
+    if (den === '0') {
+      throw declareError('SYNTHESIS_ERROR', 'minOutputRatio.den is zero: the ratio has no value')
+    }
+    if (num === '0') {
+      throw declareError(
+        'SYNTHESIS_ERROR',
+        'minOutputRatio.num is zero: the floor would be zero, which constrains nothing. Omit it instead.'
+      )
+    }
+    if (inputArgIndex === outputArgIndex) {
+      throw declareError(
+        'SYNTHESIS_ERROR',
+        `minOutputRatio bounds arg[${inputArgIndex}] against itself, which is true for any ratio at or below 1 and false above it - never a slippage floor. Pass the distinct input and output positions.`
+      )
+    }
+    if (BigInt(num) > BigInt(den)) {
+      // Demanding MORE out than went in is not slippage protection; it is a
+      // rule that denies every honest trade. Loud beats a policy that never
+      // permits.
+      warnings.push(
+        `minOutputRatio ${num}/${den} is above 1: it requires the output to EXCEED the input, which no ordinary swap satisfies. Check the ratio is not inverted.`
+      )
+    }
+    children.push({
+      op: 'gte',
+      left: { kind: 'call_arg', index: outputArgIndex },
+      right: { kind: 'call_arg_scaled', index: inputArgIndex, num, den },
+    })
+  }
+
   // A single conjunct is emitted bare. `and` with one child encodes to
   // different bytes than the child alone, and the extra node buys nothing.
   const predicate: PredicateNode =

package/src/synth/synthesize-from-recording.ts

@@ -1,7 +1,7 @@
 // src/synth/synthesize-from-recording.ts - recording-path orchestrator.
 //
 // `synthesizeFromRecording` INFERS a bounded policy from a `RecordedTransaction`
-// via the `PolicyIR` + interpreter adapter pair.
+// via the composer + interpreter adapter pair.
 // Flow: validate -> parseConfidence gate -> lower -> decideScope -> composeFromRecording
 // -> interpreter compile + self-verify.
 // Same (tx, opts) -> byte-identical ProposedPolicy (no randomness, clock, globals).

package/src/types.ts

@@ -105,7 +105,7 @@ export type PolicyRef = {
  *  `contracts/policy-interpreter/src/version.rs`. Every value this package puts on
  *  the wire derives from here; `grammar-version-parity.test.ts` pins it to the
  *  contract so a skew cannot pass a green test run. */
-export const GRAMMAR_VERSION = 3 as const
+export const GRAMMAR_VERSION = 4 as const
 
 /** A serialised predicate document stored against a (smart_account, rule_id) pair. */
 export interface PolicyDocument {
@@ -128,8 +128,15 @@ export interface PolicyDocument {
 /** The versioned predicate AST (interpreter side). Tagged union. */
 export type PredicateNode =
   | { op: 'and'; children: PredicateNode[] }
+  // Permits when ANY child permits. Children are canonically sorted like
+  // `and`, so authoring order is NOT preserved; when every branch denies, the
+  // contract reports the first branch's reason in wire order.
+  | { op: 'or'; children: PredicateNode[] }
   | { op: 'eq'; left: PredicateLeaf; right: PredicateLeaf }
+  | { op: 'lt'; left: PredicateLeaf; right: PredicateLeaf }
   | { op: 'lte'; left: PredicateLeaf; right: PredicateLeaf }
+  | { op: 'gt'; left: PredicateLeaf; right: PredicateLeaf }
+  | { op: 'gte'; left: PredicateLeaf; right: PredicateLeaf }
   | {
       op: 'in'
       needle: PredicateLeaf
@@ -150,6 +157,14 @@ export type PredicateLeaf =
   // recorded ScVal type. A non-vec arg, missing element, missing field, or
   // type mismatch all DENY (fail-closed).
   | { kind: 'call_arg_field'; index: number; element: number; field: string }
+  // `args[index] * num / den`, truncating toward zero. The one leaf whose
+  // value is COMPUTED from the call rather than read from it, and the only
+  // selector allowed on the right of a comparison - which is what lets a swap
+  // bound its output against its own input instead of against a constant that
+  // would pin the policy to one trade size. `num`/`den` are i128 decimal
+  // strings. Install refuses a zero or non-positive ratio (214), because a
+  // negative ratio inverts the comparison.
+  | { kind: 'call_arg_scaled'; index: number; num: string; den: string }
   // Literal leaves: bare ScVal on the wire (no selector-tuple wrapper). Right-hand side of
   // comparisons, elements of `in` haystacks, and operands to future arithmetic nodes.
   | { kind: 'literal_address'; value: string }