@crediolabs/policy-builder-cli 0.1.17 → 0.2.0

package/dist-cjs/src/commands/synthesize.js

@@ -1,5 +1,5 @@
 "use strict";
-// apps/policy-builder-cli/src/commands/synthesize.ts
+// packages/policy-builder-cli/src/commands/synthesize.ts
 //
 // `policy-builder synthesize` subcommand. Dispatches to ONE of the two
 // front-ends (mandate / recording) based on which file flag is supplied:
@@ -51,14 +51,7 @@ async function runSynthesizeCommand(argv, flags) {
     if (hasMandate) {
         const mandate = (0, output_ts_1.readJsonFile)(pairs.mandate);
         const args = { source: 'mandate', mandate };
-        if (pairs['oz-config'] !== undefined) {
-            args.ozConfig = readOzConfigFile(pairs['oz-config']);
-        }
-        if (pairs.confidence !== undefined) {
-            args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
-        }
-        if (explain)
-            args.explain = true;
+        applySharedFlags(args, pairs, explain);
         const res = await (0, run_1.runSynthesizePolicy)(args);
         if (explain)
             emitExplainBlock(res, flags);
@@ -87,10 +80,7 @@ async function runSynthesizeCommand(argv, flags) {
     const userResponses = {};
     if (pairs.responses) {
         const file = (0, output_ts_1.readJsonFile)(pairs.responses);
-        if (file !== null && typeof file === 'object' && !Array.isArray(file)) {
-            Object.assign(userResponses, file);
-        }
-        else {
+        if (file === null || typeof file !== 'object' || Array.isArray(file)) {
             throw new output_ts_1.CliError({
                 code: 'CLI_INVALID_JSON',
                 message: `synthesize: --responses ${pairs.responses} must be a JSON object`,
@@ -98,48 +88,43 @@ async function runSynthesizeCommand(argv, flags) {
                 retryable: false,
             });
         }
+        Object.assign(userResponses, file);
     }
-    if (pairs['window-seconds'] !== undefined) {
-        userResponses.windowSeconds = parsePositiveInt(pairs['window-seconds'], '--window-seconds');
-    }
-    if (pairs['valid-until'] !== undefined) {
-        userResponses.validUntilLedger = parsePositiveInt(pairs['valid-until'], '--valid-until');
-    }
-    if (pairs['limit-amount'] !== undefined) {
-        userResponses.limitAmount = parseI128String(pairs['limit-amount'], '--limit-amount');
-    }
-    if (pairs['invocation-limit'] !== undefined) {
-        userResponses.invocationLimit = parsePositiveInt(pairs['invocation-limit'], '--invocation-limit');
+    // Per-field overrides. Each entry: argv flag name, userResponses key,
+    // and a parser that validates the raw string.
+    const userResponseFlags = [
+        ['window-seconds', 'windowSeconds', parsePositiveInt],
+        ['valid-until', 'validUntilLedger', parsePositiveInt],
+        ['limit-amount', 'limitAmount', parseI128String],
+        ['invocation-limit', 'invocationLimit', parsePositiveInt],
+    ];
+    for (const [flag, key, parse] of userResponseFlags) {
+        if (pairs[flag] !== undefined) {
+            userResponses[key] = parse(pairs[flag], `--${flag}`);
+        }
     }
     // --recipient <C...|G...> is REPEATABLE (parsePairs collapses duplicate keys,
     // so it is collected straight from argv). Each value builds the swap-recipient
     // allowlist; supplying it REPLACES the default pin to the recorded recipient.
     const recipients = collectRepeated(argv, 'recipient');
-    if (recipients.length > 0) {
-        for (const r of recipients) {
-            // Same validator the run-layer schema applies (SDK StrKey underneath) - a
-            // swap recipient may be a G... wallet or a C... contract. Shared rather
-            // than re-inlined so the CLI and the schema cannot drift apart.
-            if (!(0, policy_synth_1.isStellarAddress)(r)) {
-                throw new output_ts_1.CliError({
-                    code: 'CLI_MISSING_ARG',
-                    message: `synthesize: --recipient "${r}" is not a valid Stellar address (expected a G... wallet or C... contract)`,
-                    severity: 'error',
-                    retryable: false,
-                });
-            }
+    for (const r of recipients) {
+        // Same validator the run-layer schema applies (SDK StrKey underneath) - a
+        // swap recipient may be a G... wallet or a C... contract. Shared rather
+        // than re-inlined so the CLI and the schema cannot drift apart.
+        if (!(0, policy_synth_1.isStellarAddress)(r)) {
+            throw new output_ts_1.CliError({
+                code: 'CLI_MISSING_ARG',
+                message: `synthesize: --recipient "${r}" is not a valid Stellar address (expected a G... wallet or C... contract)`,
+                severity: 'error',
+                retryable: false,
+            });
         }
-        userResponses.swapRecipientAllowlist = recipients;
     }
-    if (Object.keys(userResponses).length > 0) {
+    if (recipients.length > 0)
+        userResponses.swapRecipientAllowlist = recipients;
+    if (Object.keys(userResponses).length > 0)
         args.userResponses = userResponses;
-    }
-    if (pairs['oz-config'] !== undefined) {
-        args.ozConfig = readOzConfigFile(pairs['oz-config']);
-    }
-    if (pairs.confidence !== undefined) {
-        args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
-    }
+    applySharedFlags(args, pairs, explain);
     // --smart-account <C...> opts into the interpreter adapter, so constraints OZ
     // cannot express (per-method scoping, invocation-count windows, oracle bounds,
     // exact hop paths) lower to a real predicate document instead of just warnings.
@@ -149,31 +134,32 @@ async function runSynthesizeCommand(argv, flags) {
     // without `--smart-account` are rejected up front instead of being silently
     // dropped. The foot-gun: an empty value previously produced an "ok" envelope
     // with 0 policyDocuments, so callers thought the constraint had been enforced
-    // when in fact it had been silently skipped.
+    // when it had been silently skipped.
     const smartAccountRaw = pairs['smart-account'];
     const installNonceRaw = pairs['install-nonce'];
     const oracleStalenessRaw = pairs['oracle-max-staleness'];
     const oracleDeviationRaw = pairs['oracle-max-deviation'];
-    if (installNonceRaw !== undefined && smartAccountRaw === undefined) {
-        throw new output_ts_1.CliError({
-            code: 'CLI_MISSING_ARG',
-            message: 'synthesize: --install-nonce requires --smart-account <C...> (interpreter opt-in)',
-            severity: 'error',
-            retryable: false,
-        });
-    }
-    // Oracle params are an interpreter-only knob; reject up front so they cannot
-    // be silently dropped when --smart-account is absent.
-    if ((oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) &&
-        smartAccountRaw === undefined) {
-        throw new output_ts_1.CliError({
-            code: 'CLI_MISSING_ARG',
-            message: 'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
-            severity: 'error',
-            retryable: false,
-        });
+    // --install-nonce and the oracle knobs are interpreter-only. Reject up
+    // front so they cannot be silently dropped when --smart-account is absent.
+    if (smartAccountRaw === undefined) {
+        if (installNonceRaw !== undefined) {
+            throw new output_ts_1.CliError({
+                code: 'CLI_MISSING_ARG',
+                message: 'synthesize: --install-nonce requires --smart-account <C...> (interpreter opt-in)',
+                severity: 'error',
+                retryable: false,
+            });
+        }
+        if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
+            throw new output_ts_1.CliError({
+                code: 'CLI_MISSING_ARG',
+                message: 'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
+                severity: 'error',
+                retryable: false,
+            });
+        }
     }
-    if (smartAccountRaw !== undefined) {
+    else {
         const smartAccount = smartAccountRaw.trim();
         if (smartAccount.length === 0) {
             throw new output_ts_1.CliError({
@@ -230,6 +216,19 @@ async function runSynthesizeCommand(argv, flags) {
         emitExplainBlock(res, flags);
     return (0, output_ts_1.formatToolResponse)(res, flags, 'synthesize(recording)');
 }
+/** Apply flags shared between the mandate and recording synthesize paths:
+ *  --oz-config, --confidence, --explain. Pulled out so adding a shared flag
+ *  adds one branch here rather than two copies in the command body. */
+function applySharedFlags(args, pairs, explain) {
+    if (pairs['oz-config'] !== undefined) {
+        args.ozConfig = readOzConfigFile(pairs['oz-config']);
+    }
+    if (pairs.confidence !== undefined) {
+        args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
+    }
+    if (explain)
+        args.explain = true;
+}
 /** Augment the tool response envelope with the --explain fields and
  *  (in non-JSON mode) print the review card readably. The CLI is the
  *  single seam that places `review` + `predicateTree` on the wire
@@ -304,9 +303,11 @@ function parseConfidence(raw) {
 }
 /** Parse a strictly positive integer (windowSeconds, validUntilLedger,
  *  invocationLimit, oracleParams bounds). The core re-validates these with
- *  field-specific caps; the CLI just enforces "looks like an integer > 0". */
+ *  field-specific caps; the CLI just enforces "looks like an integer > 0".
+ *  The `^[0-9]+$` regex already pins the shape to a non-negative integer, so
+ *  the only thing left to check is "not zero". */
 function parsePositiveInt(raw, flagName) {
-    if (!POSITIVE_INT_RE.test(raw)) {
+    if (!POSITIVE_INT_RE.test(raw) || raw === '0') {
         throw new output_ts_1.CliError({
             code: 'CLI_MISSING_ARG',
             message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
@@ -314,16 +315,7 @@ function parsePositiveInt(raw, flagName) {
             retryable: false,
         });
     }
-    const n = Number(raw);
-    if (!Number.isInteger(n) || n <= 0) {
-        throw new output_ts_1.CliError({
-            code: 'CLI_MISSING_ARG',
-            message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
-            severity: 'error',
-            retryable: false,
-        });
-    }
-    return n;
+    return Number(raw);
 }
 /** Collect ALL values for a repeatable `--<name> <value>` / `--<name>=<value>`
  *  flag from argv, in order. Unlike `parsePairs` (which keeps only the last

package/dist-cjs/src/index.d.ts

@@ -1,3 +1,4 @@
+export { runMergeCommand } from './commands/merge.ts';
 export { runRecordCommand } from './commands/record.ts';
 export { runSynthesizeCommand } from './commands/synthesize.ts';
 export { formatToolResponse, readJsonFile, writeJsonFile } from './output.ts';

package/dist-cjs/src/index.js

@@ -1,7 +1,9 @@
 "use strict";
-// apps/policy-builder-cli/src/index.ts - public re-exports for the CLI package.
+// packages/policy-builder-cli/src/index.ts - public re-exports for the CLI package.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeJsonFile = exports.readJsonFile = exports.formatToolResponse = exports.runSynthesizeCommand = exports.runRecordCommand = void 0;
+exports.writeJsonFile = exports.readJsonFile = exports.formatToolResponse = exports.runSynthesizeCommand = exports.runRecordCommand = exports.runMergeCommand = void 0;
+var merge_ts_1 = require("./commands/merge.js");
+Object.defineProperty(exports, "runMergeCommand", { enumerable: true, get: function () { return merge_ts_1.runMergeCommand; } });
 var record_ts_1 = require("./commands/record.js");
 Object.defineProperty(exports, "runRecordCommand", { enumerable: true, get: function () { return record_ts_1.runRecordCommand; } });
 var synthesize_ts_1 = require("./commands/synthesize.js");

package/dist-cjs/src/output.js

@@ -1,5 +1,5 @@
 "use strict";
-// apps/policy-builder-cli/src/output.ts
+// packages/policy-builder-cli/src/output.ts
 //
 // Output helpers for the CLI: formatToolResponse for the `--json` flag and
 // file I/O for `--out`. The CLI is intentionally tiny - no commander / yargs
@@ -119,20 +119,19 @@ function writeJsonFile(path, value) {
  *  Throws CliError so the router can map it to a process exit code + a
  *  structured JSON envelope under --json. */
 function formatToolResponse(res, flags, outLabel = 'result') {
-    if (res.ok) {
-        const envelope = { ok: true, data: res.data };
-        if (flags.out)
-            writeJsonFile(flags.out, envelope);
-        if (flags.json) {
-            // newline-terminated JSON so it pipes cleanly
-            process.stdout.write(`${JSON.stringify(envelope)}\n`);
-        }
-        else if (!flags.quiet) {
-            process.stdout.write(`${outLabel}: ok\n`);
-        }
-        return res.data;
+    if (!res.ok)
+        throw new CliError(res.error);
+    const envelope = { ok: true, data: res.data };
+    if (flags.out)
+        writeJsonFile(flags.out, envelope);
+    if (flags.json) {
+        // newline-terminated JSON so it pipes cleanly
+        process.stdout.write(`${JSON.stringify(envelope)}\n`);
+    }
+    else if (!flags.quiet) {
+        process.stdout.write(`${outLabel}: ok\n`);
     }
-    throw new CliError(res.error);
+    return res.data;
 }
 /** CLI-local error class wrapping a (core or CLI) ToolError so the router can
  *  map it to a non-zero exit. The error is preserved verbatim for --json. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-builder-cli",
-  "version": "0.1.17",
+  "version": "0.2.0",
   "license": "MIT",
   "description": "CLI wrapper around the OZ policy-synth core (record + synthesize) for solo-dev and CI workflows.",
   "type": "module",
@@ -12,12 +12,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/untangledfinance/oz-policy-builder.git",
-    "directory": "apps/policy-builder-cli"
+    "url": "https://github.com/untangledfinance/octogate.git",
+    "directory": "packages/policy-builder-cli"
   },
-  "homepage": "https://github.com/untangledfinance/oz-policy-builder#readme",
+  "homepage": "https://github.com/untangledfinance/octogate#readme",
   "bugs": {
-    "url": "https://github.com/untangledfinance/oz-policy-builder/issues"
+    "url": "https://github.com/untangledfinance/octogate/issues"
   },
   "keywords": [
     "stellar",
@@ -63,7 +63,7 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-synth": "0.1.16",
+    "@crediolabs/policy-synth": "0.2.0",
     "@stellar/stellar-sdk": "14.4.0",
     "zod": "3.25.76"
   },

package/src/commands/merge.ts

@@ -0,0 +1,65 @@
+// packages/policy-builder-cli/src/commands/merge.ts
+//
+// `policy-builder merge` subcommand. The tightening remedy for a cross-rule
+// authority overlap.
+//
+// OpenZeppelin enforces only the policies of the context rule a signer NAMES,
+// so a signer in several rules picks which one applies and their authority is
+// the maximum over the matching rules. Adding a second, tighter rule therefore
+// restricts nothing. To actually tighten, the restriction has to become ONE
+// predicate: the conjunction of the installed one and the new one.
+//
+// Two transactions, in order, because `add_policy` refuses a policy already
+// attached to the rule:
+//
+//   policy-builder merge --step detach    ...  sign and submit, wait
+//   policy-builder merge --step reinstall ...  sign and submit
+//
+// The detach uninstalls the policy, which resets every counter on the rule and
+// leaves it unpoliced until the reinstall confirms. Both are reported as
+// warnings rather than left for the operator to discover afterwards.
+
+import { runMergePolicy } from '@crediolabs/policy-synth/run'
+import { CliError, type CliFlags, formatToolResponse, parsePairs } from '../output.ts'
+
+function missing(message: string): CliError {
+  return new CliError({
+    code: 'CLI_MISSING_ARG',
+    message,
+    severity: 'error',
+    retryable: false,
+  })
+}
+
+function required(pairs: Record<string, string>, name: string): string {
+  const value = pairs[name]
+  if (!value) throw missing(`merge: --${name} is required`)
+  return value
+}
+
+export async function runMergeCommand(argv: ReadonlyArray<string>, flags: CliFlags) {
+  const pairs = parsePairs(argv)
+
+  const step = required(pairs, 'step')
+  if (step !== 'detach' && step !== 'reinstall') {
+    throw missing("merge: --step must be 'detach' or 'reinstall'")
+  }
+
+  const ruleId = Number(required(pairs, 'rule-id'))
+  if (!Number.isInteger(ruleId) || ruleId < 0) {
+    throw missing('merge: --rule-id must be a non-negative integer')
+  }
+
+  const res = await runMergePolicy({
+    smartAccount: required(pairs, 'smart-account'),
+    sourceAccount: required(pairs, 'source-account'),
+    ruleId,
+    incomingPredicateBlobBase64: required(pairs, 'predicate'),
+    step,
+    ...(pairs.network ? { network: pairs.network } : {}),
+    ...(pairs['rpc-url'] ? { rpcUrl: pairs['rpc-url'] } : {}),
+    ...(pairs['allow-unpinned-rpc-url'] === 'true' ? { allowUnpinnedRpcUrl: true } : {}),
+  })
+
+  return formatToolResponse(res, flags)
+}

package/src/commands/record.ts

@@ -1,4 +1,4 @@
-// apps/policy-builder-cli/src/commands/record.ts
+// packages/policy-builder-cli/src/commands/record.ts
 //
 // `policy-builder record` subcommand. Thin wrapper around the core
 // `recordTransaction` - no business logic, just argv -> RecordInput + the

package/src/commands/synthesize.ts

@@ -1,4 +1,4 @@
-// apps/policy-builder-cli/src/commands/synthesize.ts
+// packages/policy-builder-cli/src/commands/synthesize.ts
 //
 // `policy-builder synthesize` subcommand. Dispatches to ONE of the two
 // front-ends (mandate / recording) based on which file flag is supplied:
@@ -72,13 +72,7 @@ export async function runSynthesizeCommand(
   if (hasMandate) {
     const mandate = readJsonFile(pairs.mandate as string) as Record<string, unknown>
     const args: Record<string, unknown> = { source: 'mandate', mandate }
-    if (pairs['oz-config'] !== undefined) {
-      args.ozConfig = readOzConfigFile(pairs['oz-config'] as string)
-    }
-    if (pairs.confidence !== undefined) {
-      args.confidenceOverride = { threshold: parseConfidence(pairs.confidence as string) }
-    }
-    if (explain) args.explain = true
+    applySharedFlags(args, pairs, explain)
     const res = await runSynthesizePolicy(args)
     if (explain) emitExplainBlock(res, flags)
     return formatToolResponse(res, flags, 'synthesize(mandate)')
@@ -109,9 +103,7 @@ export async function runSynthesizeCommand(
   const userResponses: Record<string, unknown> = {}
   if (pairs.responses) {
     const file = readJsonFile(pairs.responses)
-    if (file !== null && typeof file === 'object' && !Array.isArray(file)) {
-      Object.assign(userResponses, file as Record<string, unknown>)
-    } else {
+    if (file === null || typeof file !== 'object' || Array.isArray(file)) {
       throw new CliError({
         code: 'CLI_INVALID_JSON',
         message: `synthesize: --responses ${pairs.responses} must be a JSON object`,
@@ -119,58 +111,42 @@ export async function runSynthesizeCommand(
         retryable: false,
       })
     }
+    Object.assign(userResponses, file as Record<string, unknown>)
   }
-  if (pairs['window-seconds'] !== undefined) {
-    userResponses.windowSeconds = parsePositiveInt(
-      pairs['window-seconds'] as string,
-      '--window-seconds'
-    )
-  }
-  if (pairs['valid-until'] !== undefined) {
-    userResponses.validUntilLedger = parsePositiveInt(
-      pairs['valid-until'] as string,
-      '--valid-until'
-    )
-  }
-  if (pairs['limit-amount'] !== undefined) {
-    userResponses.limitAmount = parseI128String(pairs['limit-amount'] as string, '--limit-amount')
-  }
-  if (pairs['invocation-limit'] !== undefined) {
-    userResponses.invocationLimit = parsePositiveInt(
-      pairs['invocation-limit'] as string,
-      '--invocation-limit'
-    )
+  // Per-field overrides. Each entry: argv flag name, userResponses key,
+  // and a parser that validates the raw string.
+  const userResponseFlags: Array<[string, string, (raw: string, flag: string) => unknown]> = [
+    ['window-seconds', 'windowSeconds', parsePositiveInt],
+    ['valid-until', 'validUntilLedger', parsePositiveInt],
+    ['limit-amount', 'limitAmount', parseI128String],
+    ['invocation-limit', 'invocationLimit', parsePositiveInt],
+  ]
+  for (const [flag, key, parse] of userResponseFlags) {
+    if (pairs[flag] !== undefined) {
+      userResponses[key] = parse(pairs[flag] as string, `--${flag}`)
+    }
   }
   // --recipient <C...|G...> is REPEATABLE (parsePairs collapses duplicate keys,
   // so it is collected straight from argv). Each value builds the swap-recipient
   // allowlist; supplying it REPLACES the default pin to the recorded recipient.
   const recipients = collectRepeated(argv, 'recipient')
-  if (recipients.length > 0) {
-    for (const r of recipients) {
-      // Same validator the run-layer schema applies (SDK StrKey underneath) - a
-      // swap recipient may be a G... wallet or a C... contract. Shared rather
-      // than re-inlined so the CLI and the schema cannot drift apart.
-      if (!isStellarAddress(r)) {
-        throw new CliError({
-          code: 'CLI_MISSING_ARG',
-          message: `synthesize: --recipient "${r}" is not a valid Stellar address (expected a G... wallet or C... contract)`,
-          severity: 'error',
-          retryable: false,
-        })
-      }
+  for (const r of recipients) {
+    // Same validator the run-layer schema applies (SDK StrKey underneath) - a
+    // swap recipient may be a G... wallet or a C... contract. Shared rather
+    // than re-inlined so the CLI and the schema cannot drift apart.
+    if (!isStellarAddress(r)) {
+      throw new CliError({
+        code: 'CLI_MISSING_ARG',
+        message: `synthesize: --recipient "${r}" is not a valid Stellar address (expected a G... wallet or C... contract)`,
+        severity: 'error',
+        retryable: false,
+      })
     }
-    userResponses.swapRecipientAllowlist = recipients
-  }
-  if (Object.keys(userResponses).length > 0) {
-    args.userResponses = userResponses
   }
+  if (recipients.length > 0) userResponses.swapRecipientAllowlist = recipients
+  if (Object.keys(userResponses).length > 0) args.userResponses = userResponses
 
-  if (pairs['oz-config'] !== undefined) {
-    args.ozConfig = readOzConfigFile(pairs['oz-config'] as string)
-  }
-  if (pairs.confidence !== undefined) {
-    args.confidenceOverride = { threshold: parseConfidence(pairs.confidence as string) }
-  }
+  applySharedFlags(args, pairs, explain)
 
   // --smart-account <C...> opts into the interpreter adapter, so constraints OZ
   // cannot express (per-method scoping, invocation-count windows, oracle bounds,
@@ -181,34 +157,32 @@ export async function runSynthesizeCommand(
   // without `--smart-account` are rejected up front instead of being silently
   // dropped. The foot-gun: an empty value previously produced an "ok" envelope
   // with 0 policyDocuments, so callers thought the constraint had been enforced
-  // when in fact it had been silently skipped.
+  // when it had been silently skipped.
   const smartAccountRaw = pairs['smart-account']
   const installNonceRaw = pairs['install-nonce']
   const oracleStalenessRaw = pairs['oracle-max-staleness']
   const oracleDeviationRaw = pairs['oracle-max-deviation']
-  if (installNonceRaw !== undefined && smartAccountRaw === undefined) {
-    throw new CliError({
-      code: 'CLI_MISSING_ARG',
-      message: 'synthesize: --install-nonce requires --smart-account <C...> (interpreter opt-in)',
-      severity: 'error',
-      retryable: false,
-    })
-  }
-  // Oracle params are an interpreter-only knob; reject up front so they cannot
-  // be silently dropped when --smart-account is absent.
-  if (
-    (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) &&
-    smartAccountRaw === undefined
-  ) {
-    throw new CliError({
-      code: 'CLI_MISSING_ARG',
-      message:
-        'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
-      severity: 'error',
-      retryable: false,
-    })
-  }
-  if (smartAccountRaw !== undefined) {
+  // --install-nonce and the oracle knobs are interpreter-only. Reject up
+  // front so they cannot be silently dropped when --smart-account is absent.
+  if (smartAccountRaw === undefined) {
+    if (installNonceRaw !== undefined) {
+      throw new CliError({
+        code: 'CLI_MISSING_ARG',
+        message: 'synthesize: --install-nonce requires --smart-account <C...> (interpreter opt-in)',
+        severity: 'error',
+        retryable: false,
+      })
+    }
+    if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
+      throw new CliError({
+        code: 'CLI_MISSING_ARG',
+        message:
+          'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
+        severity: 'error',
+        retryable: false,
+      })
+    }
+  } else {
     const smartAccount = smartAccountRaw.trim()
     if (smartAccount.length === 0) {
       throw new CliError({
@@ -271,6 +245,23 @@ export async function runSynthesizeCommand(
   return formatToolResponse(res, flags, 'synthesize(recording)')
 }
 
+/** Apply flags shared between the mandate and recording synthesize paths:
+ *  --oz-config, --confidence, --explain. Pulled out so adding a shared flag
+ *  adds one branch here rather than two copies in the command body. */
+function applySharedFlags(
+  args: Record<string, unknown>,
+  pairs: Record<string, string>,
+  explain: boolean
+): void {
+  if (pairs['oz-config'] !== undefined) {
+    args.ozConfig = readOzConfigFile(pairs['oz-config'] as string)
+  }
+  if (pairs.confidence !== undefined) {
+    args.confidenceOverride = { threshold: parseConfidence(pairs.confidence as string) }
+  }
+  if (explain) args.explain = true
+}
+
 /** Augment the tool response envelope with the --explain fields and
  *  (in non-JSON mode) print the review card readably. The CLI is the
  *  single seam that places `review` + `predicateTree` on the wire
@@ -366,9 +357,11 @@ function parseConfidence(raw: string): number {
 
 /** Parse a strictly positive integer (windowSeconds, validUntilLedger,
  *  invocationLimit, oracleParams bounds). The core re-validates these with
- *  field-specific caps; the CLI just enforces "looks like an integer > 0". */
+ *  field-specific caps; the CLI just enforces "looks like an integer > 0".
+ *  The `^[0-9]+$` regex already pins the shape to a non-negative integer, so
+ *  the only thing left to check is "not zero". */
 function parsePositiveInt(raw: string, flagName: string): number {
-  if (!POSITIVE_INT_RE.test(raw)) {
+  if (!POSITIVE_INT_RE.test(raw) || raw === '0') {
     throw new CliError({
       code: 'CLI_MISSING_ARG',
       message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
@@ -376,16 +369,7 @@ function parsePositiveInt(raw: string, flagName: string): number {
       retryable: false,
     })
   }
-  const n = Number(raw)
-  if (!Number.isInteger(n) || n <= 0) {
-    throw new CliError({
-      code: 'CLI_MISSING_ARG',
-      message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
-      severity: 'error',
-      retryable: false,
-    })
-  }
-  return n
+  return Number(raw)
 }
 
 /** Collect ALL values for a repeatable `--<name> <value>` / `--<name>=<value>`

package/src/index.ts

@@ -1,5 +1,6 @@
-// apps/policy-builder-cli/src/index.ts - public re-exports for the CLI package.
+// packages/policy-builder-cli/src/index.ts - public re-exports for the CLI package.
 
+export { runMergeCommand } from './commands/merge.ts'
 export { runRecordCommand } from './commands/record.ts'
 export { runSynthesizeCommand } from './commands/synthesize.ts'
 export { formatToolResponse, readJsonFile, writeJsonFile } from './output.ts'