@crediolabs/policy-builder-cli 0.1.18 → 0.3.0

package/README.md

@@ -58,9 +58,11 @@ small: the two commands that fit a pipe.
 
 ## Security model
 
-The CLI holds no key material and signs nothing. The on-chain interpreter the
-policies target is **unaudited**; see the
-[architecture document](https://github.com/untangledfinance/octogate/blob/main/docs/architecture.md).
+The CLI holds no key material and signs nothing. See the
+[architecture document](https://github.com/untangledfinance/oz-policy-builder/blob/main/docs/architecture.md)
+for what the on-chain interpreter does and does not enforce, and the
+[repository README](https://github.com/untangledfinance/oz-policy-builder#readme) for
+the contracts' audit status.
 
 ## License
 

package/dist/bin/policy-builder.js

@@ -4,16 +4,11 @@
 // Usage:
 //   policy-builder record --network <mainnet|testnet> --hash <tx>
 //                                 [--xdr <b64>] [--json] [--quiet] [--out <path>]
-//   policy-builder synthesize --mandate <path.json>
-//                              [--oz-config <path.json>] [--confidence <0..1>]
-//                              [--explain] [--json] [--quiet] [--out <path>]
 //   policy-builder synthesize --recorded-tx <path.json> --network <mainnet|testnet>
 //                              [--responses <path.json>]
-//                              [--oz-config <path.json>] [--confidence <0..1>]
+//                              [--confidence <0..1>]
 //                              [--smart-account <C...>] [--install-nonce <n>]
-//                              [--oracle-max-staleness <s>] [--oracle-max-deviation <bps>]
-//                              [--window-seconds <n>] [--valid-until <ledger>]
-//                              [--limit-amount <i128str>] [--invocation-limit <n>]
+//                              [--valid-until <ledger>] [--limit-amount <i128str>]
 //                              [--recipient <C...|G...>]...
 //                              [--explain] [--json] [--quiet] [--out <path>]
 //
@@ -69,52 +64,33 @@ function printHelp() {
 Usage:
   policy-builder record     --network <mainnet|testnet> --hash <tx> | --xdr <b64>
                             [--json] [--quiet] [--out <path>]
-  policy-builder synthesize --mandate <path.json>
-                            [--oz-config <path.json>] [--confidence <0..1>]
-                            [--json] [--quiet] [--out <path>]
   policy-builder synthesize --recorded-tx <path.json> --network <mainnet|testnet>
                             [--responses <path.json>]
-                            [--oz-config <path.json>] [--confidence <0..1>]
+                            [--confidence <0..1>]
                             [--smart-account <C...>] [--install-nonce <n>]
-                            [--oracle-max-staleness <s>] [--oracle-max-deviation <bps>]
-                            [--window-seconds <n>] [--valid-until <ledger>]
-                            [--limit-amount <i128str>] [--invocation-limit <n>]
+                            [--valid-until <ledger>] [--limit-amount <i128str>]
                             [--recipient <C...|G...>]...
-                            [--json] [--quiet] [--out <path>]
+                            [--explain] [--json] [--quiet] [--out <path>]
 
 Flags:
   --json                    emit machine-readable JSON on stdout
   --quiet                   suppress progress / non-error output
   --out                     write artefact to file (JSON)
-  --oz-config               path to a JSON OzAdapterConfig (custom OZ instance
-                            addresses for the network); applies to both the
-                            --mandate and --recorded-tx synthesize paths
   --confidence              recorder confidence GATE threshold (0..1, inclusive);
                             rejects when parseConfidence.overall < threshold; does
                             not change the recording's parseConfidence.thresholdUsed
                             in the output
-  --smart-account           C... account to opt into the interpreter adapter, so
-                            non-OZ constraints (per-method scoping, invocation-count
-                            windows, oracle bounds, exact hop paths) lower to a real
-                            predicate document instead of warnings
+  --smart-account           C... account the interpreter policy installs against;
+                            required for the recording to lower to a predicate
+                            document (amount caps, recipient allowlists, exact
+                            hop paths) instead of warnings
   --install-nonce           per-rule install nonce for the interpreter policy
                             (default 1); requires --smart-account
-  --oracle-max-staleness    interpreter oracle max staleness in seconds
-                            (positive integer <= 600, tighten-only);
-                            requires --smart-account
-  --oracle-max-deviation    interpreter oracle max deviation in basis points
-                            (positive integer <= 200, tighten-only);
-                            requires --smart-account
-  --window-seconds          per-field override of userResponses.windowSeconds;
-                            overrides the same field from --responses (CLI flag
-                            wins)
   --valid-until             per-field override of userResponses.validUntilLedger;
                             overrides the same field from --responses
   --limit-amount            per-field override of userResponses.limitAmount
                             (i128 decimal string); overrides the same field
                             from --responses
-  --invocation-limit        per-field override of userResponses.invocationLimit;
-                            overrides the same field from --responses
   --recipient               swap-recipient allowlist entry (C... contract or
                             G... wallet) for a SoroSwap swap; REPEATABLE. Absent,
                             the recorded recipient is pinned by default; supplying

package/dist/src/commands/synthesize.js

@@ -1,22 +1,20 @@
 // packages/policy-builder-cli/src/commands/synthesize.ts
 //
 // `policy-builder synthesize` subcommand. Dispatches to ONE of the two
-// front-ends (mandate / recording) based on which file flag is supplied:
-//   --mandate <path.json>     -> synthesizeFromMandate
+// One front-end:
 //   --recorded-tx <path.json> -> synthesizeFromRecording
 //
 // The CLI mirrors the MCP tool's discriminated union: one subcommand, two
 // front-ends, mutually exclusive.
 //
-// Per-field response flags (--window-seconds, --valid-until, --limit-amount,
-// --invocation-limit) merge into `userResponses`. A flag overrides the same
+// Per-field response flags (--valid-until, --limit-amount) merge into
+// `userResponses`. A flag overrides the same
 // field from --responses (CLI flags are explicit; the file is a default bag).
-// Oracle params (--oracle-max-staleness, --oracle-max-deviation) are part of
 // the interpreter opt-in and are rejected without --smart-account; tighten-only
 // bounds are validated by the core.
 //
 // --explain (Phase 1) makes the synthesised policy human-readable. The
-// orchestrator attaches the in-memory predicate tree + a SimulationResult
+// orchestrator attaches the in-memory predicate tree
 // to the success envelope; the CLI builds the deterministic review card
 // from those inputs and emits it alongside the policy. Without --explain
 // the output is byte-identical to today.
@@ -29,12 +27,10 @@ import { CliError, formatToolResponse, parsePairs, readJsonFile } from "../outpu
 const POSITIVE_INT_RE = /^[0-9]+$/;
 export async function runSynthesizeCommand(argv, flags) {
     const pairs = parsePairs(argv);
-    const hasMandate = Boolean(pairs.mandate);
-    const hasRecorded = Boolean(pairs['recorded-tx']);
-    if (hasMandate === hasRecorded) {
+    if (!pairs['recorded-tx']) {
         throw new CliError({
             code: 'CLI_MISSING_ARG',
-            message: 'synthesize: exactly one of --mandate <path> or --recorded-tx <path> is required',
+            message: 'synthesize: --recorded-tx <path> is required',
             severity: 'error',
             retryable: false,
         });
@@ -45,16 +41,6 @@ export async function runSynthesizeCommand(argv, flags) {
     // output gains `review` + `predicateTree` and remains unchanged
     // otherwise.
     const explain = pairs.explain !== undefined;
-    if (hasMandate) {
-        const mandate = readJsonFile(pairs.mandate);
-        const args = { source: 'mandate', mandate };
-        applySharedFlags(args, pairs, explain);
-        const res = await runSynthesizePolicy(args);
-        if (explain)
-            emitExplainBlock(res, flags);
-        return formatToolResponse(res, flags, 'synthesize(mandate)');
-    }
-    // hasRecorded
     const recordedFile = readJsonFile(pairs['recorded-tx']);
     // Accept either a bare RecordedTransaction or the `{ ok, data }` artifact that
     // `record --out` writes (same shape as `--json`), so `record --out X` followed
@@ -90,10 +76,8 @@ export async function runSynthesizeCommand(argv, flags) {
     // Per-field overrides. Each entry: argv flag name, userResponses key,
     // and a parser that validates the raw string.
     const userResponseFlags = [
-        ['window-seconds', 'windowSeconds', parsePositiveInt],
         ['valid-until', 'validUntilLedger', parsePositiveInt],
         ['limit-amount', 'limitAmount', parseI128String],
-        ['invocation-limit', 'invocationLimit', parsePositiveInt],
     ];
     for (const [flag, key, parse] of userResponseFlags) {
         if (pairs[flag] !== undefined) {
@@ -122,9 +106,10 @@ export async function runSynthesizeCommand(argv, flags) {
     if (Object.keys(userResponses).length > 0)
         args.userResponses = userResponses;
     applySharedFlags(args, pairs, explain);
-    // --smart-account <C...> opts into the interpreter adapter, so constraints OZ
-    // cannot express (per-method scoping, invocation-count windows, oracle bounds,
-    // exact hop paths) lower to a real predicate document instead of just warnings.
+    // --smart-account <C...> names the account the interpreter policy installs
+    // against. It is what lets the recording lower to a real predicate document
+    // (amount caps, recipient allowlists, exact hop paths) rather than warnings;
+    // without it the core reports that no installable policy was synthesised.
     // The core validates the address and installNonce; a bad value surfaces there.
     //
     // Use `!== undefined` (not truthy) so `--smart-account ""` and `--install-nonce`
@@ -134,9 +119,6 @@ export async function runSynthesizeCommand(argv, flags) {
     // when it had been silently skipped.
     const smartAccountRaw = pairs['smart-account'];
     const installNonceRaw = pairs['install-nonce'];
-    const oracleStalenessRaw = pairs['oracle-max-staleness'];
-    const oracleDeviationRaw = pairs['oracle-max-deviation'];
-    // --install-nonce and the oracle knobs are interpreter-only. Reject up
     // front so they cannot be silently dropped when --smart-account is absent.
     if (smartAccountRaw === undefined) {
         if (installNonceRaw !== undefined) {
@@ -147,14 +129,6 @@ export async function runSynthesizeCommand(argv, flags) {
                 retryable: false,
             });
         }
-        if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
-            throw new CliError({
-                code: 'CLI_MISSING_ARG',
-                message: 'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
-                severity: 'error',
-                retryable: false,
-            });
-        }
     }
     else {
         const smartAccount = smartAccountRaw.trim();
@@ -187,19 +161,8 @@ export async function runSynthesizeCommand(argv, flags) {
             }
             interpreter.installNonce = nonce;
         }
-        // Oracle params only attach when at least one bound was provided. The
         // core validates tighten-only (maxStalenessSeconds <= 600,
         // maxDeviationBps <= 200) - a too-loose value surfaces as SYNTHESIS_ERROR.
-        if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
-            const oracleParams = {};
-            if (oracleStalenessRaw !== undefined) {
-                oracleParams.maxStalenessSeconds = parsePositiveInt(oracleStalenessRaw, '--oracle-max-staleness');
-            }
-            if (oracleDeviationRaw !== undefined) {
-                oracleParams.maxDeviationBps = parsePositiveInt(oracleDeviationRaw, '--oracle-max-deviation');
-            }
-            interpreter.oracleParams = oracleParams;
-        }
         args.interpreter = interpreter;
     }
     if (explain)
@@ -213,13 +176,9 @@ export async function runSynthesizeCommand(argv, flags) {
         emitExplainBlock(res, flags);
     return formatToolResponse(res, flags, 'synthesize(recording)');
 }
-/** Apply flags shared between the mandate and recording synthesize paths:
- *  --oz-config, --confidence, --explain. Pulled out so adding a shared flag
- *  adds one branch here rather than two copies in the command body. */
+/** Apply the flags that are not part of the recording payload itself:
+ *  --confidence, --explain. */
 function applySharedFlags(args, pairs, explain) {
-    if (pairs['oz-config'] !== undefined) {
-        args.ozConfig = readOzConfigFile(pairs['oz-config']);
-    }
     if (pairs.confidence !== undefined) {
         args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
     }
@@ -239,15 +198,15 @@ function emitExplainBlock(res, flags) {
     const review = buildReviewCardSummary(
     // The orchestrator's `predicateTree` is the exact in-memory AST
     // (canonical JSON shape). The builder's input is typed as
-    // `PredicateNode | null`; the orchestrator's `null` is the truthful
-    // OZ-only / mandate value, so a null here is honest.
-    (res.explain.predicateTree ?? null), res.data?.policyRefs ?? [], res.data?.contextRule ?? {
+    // `PredicateNode | null`; a null is the truthful value when the
+    // interpreter adapter was not engaged.
+    (res.explain.predicateTree ?? null), res.data?.contextRule ?? {
         contextRuleType: { kind: 'default' },
         name: 'unknown',
         validUntilLedger: null,
         signers: [],
         policies: [],
-    }, res.explain.simulation);
+    }, 'interpreter-v1');
     res.data.review =
         review;
     res.data.predicateTree = res.explain.predicateTree;
@@ -269,23 +228,6 @@ function emitExplainBlock(res, flags) {
         }
     }
 }
-/** Read and validate an OzAdapterConfig JSON file. Throws CLI_FILE_NOT_FOUND /
- *  CLI_INVALID_JSON for filesystem / parse failures; the core's strict schema
- *  on `ozConfig` catches shape mismatches downstream. */
-function readOzConfigFile(path) {
-    const value = readJsonFile(path);
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-        throw new CliError({
-            code: 'CLI_INVALID_JSON',
-            message: `synthesize: --oz-config ${path} must be a JSON object`,
-            severity: 'error',
-            retryable: false,
-        });
-    }
-    return value;
-}
-/** Parse and validate `--confidence <n>` as a finite number in [0, 1]. A
- *  threshold above 1 would disable the recorder gate; reject it up front. */
 function parseConfidence(raw) {
     const n = Number(raw);
     if (!Number.isFinite(n) || n < 0 || n > 1) {
@@ -298,8 +240,7 @@ function parseConfidence(raw) {
     }
     return n;
 }
-/** Parse a strictly positive integer (windowSeconds, validUntilLedger,
- *  invocationLimit, oracleParams bounds). The core re-validates these with
+/** Parse a strictly positive integer (validUntilLedger,
  *  field-specific caps; the CLI just enforces "looks like an integer > 0".
  *  The `^[0-9]+$` regex already pins the shape to a non-negative integer, so
  *  the only thing left to check is "not zero". */

package/dist-cjs/src/commands/synthesize.js

@@ -2,22 +2,20 @@
 // packages/policy-builder-cli/src/commands/synthesize.ts
 //
 // `policy-builder synthesize` subcommand. Dispatches to ONE of the two
-// front-ends (mandate / recording) based on which file flag is supplied:
-//   --mandate <path.json>     -> synthesizeFromMandate
+// One front-end:
 //   --recorded-tx <path.json> -> synthesizeFromRecording
 //
 // The CLI mirrors the MCP tool's discriminated union: one subcommand, two
 // front-ends, mutually exclusive.
 //
-// Per-field response flags (--window-seconds, --valid-until, --limit-amount,
-// --invocation-limit) merge into `userResponses`. A flag overrides the same
+// Per-field response flags (--valid-until, --limit-amount) merge into
+// `userResponses`. A flag overrides the same
 // field from --responses (CLI flags are explicit; the file is a default bag).
-// Oracle params (--oracle-max-staleness, --oracle-max-deviation) are part of
 // the interpreter opt-in and are rejected without --smart-account; tighten-only
 // bounds are validated by the core.
 //
 // --explain (Phase 1) makes the synthesised policy human-readable. The
-// orchestrator attaches the in-memory predicate tree + a SimulationResult
+// orchestrator attaches the in-memory predicate tree
 // to the success envelope; the CLI builds the deterministic review card
 // from those inputs and emits it alongside the policy. Without --explain
 // the output is byte-identical to today.
@@ -32,12 +30,10 @@ const output_ts_1 = require("../output.js");
 const POSITIVE_INT_RE = /^[0-9]+$/;
 async function runSynthesizeCommand(argv, flags) {
     const pairs = (0, output_ts_1.parsePairs)(argv);
-    const hasMandate = Boolean(pairs.mandate);
-    const hasRecorded = Boolean(pairs['recorded-tx']);
-    if (hasMandate === hasRecorded) {
+    if (!pairs['recorded-tx']) {
         throw new output_ts_1.CliError({
             code: 'CLI_MISSING_ARG',
-            message: 'synthesize: exactly one of --mandate <path> or --recorded-tx <path> is required',
+            message: 'synthesize: --recorded-tx <path> is required',
             severity: 'error',
             retryable: false,
         });
@@ -48,16 +44,6 @@ async function runSynthesizeCommand(argv, flags) {
     // output gains `review` + `predicateTree` and remains unchanged
     // otherwise.
     const explain = pairs.explain !== undefined;
-    if (hasMandate) {
-        const mandate = (0, output_ts_1.readJsonFile)(pairs.mandate);
-        const args = { source: 'mandate', mandate };
-        applySharedFlags(args, pairs, explain);
-        const res = await (0, run_1.runSynthesizePolicy)(args);
-        if (explain)
-            emitExplainBlock(res, flags);
-        return (0, output_ts_1.formatToolResponse)(res, flags, 'synthesize(mandate)');
-    }
-    // hasRecorded
     const recordedFile = (0, output_ts_1.readJsonFile)(pairs['recorded-tx']);
     // Accept either a bare RecordedTransaction or the `{ ok, data }` artifact that
     // `record --out` writes (same shape as `--json`), so `record --out X` followed
@@ -93,10 +79,8 @@ async function runSynthesizeCommand(argv, flags) {
     // Per-field overrides. Each entry: argv flag name, userResponses key,
     // and a parser that validates the raw string.
     const userResponseFlags = [
-        ['window-seconds', 'windowSeconds', parsePositiveInt],
         ['valid-until', 'validUntilLedger', parsePositiveInt],
         ['limit-amount', 'limitAmount', parseI128String],
-        ['invocation-limit', 'invocationLimit', parsePositiveInt],
     ];
     for (const [flag, key, parse] of userResponseFlags) {
         if (pairs[flag] !== undefined) {
@@ -125,9 +109,10 @@ async function runSynthesizeCommand(argv, flags) {
     if (Object.keys(userResponses).length > 0)
         args.userResponses = userResponses;
     applySharedFlags(args, pairs, explain);
-    // --smart-account <C...> opts into the interpreter adapter, so constraints OZ
-    // cannot express (per-method scoping, invocation-count windows, oracle bounds,
-    // exact hop paths) lower to a real predicate document instead of just warnings.
+    // --smart-account <C...> names the account the interpreter policy installs
+    // against. It is what lets the recording lower to a real predicate document
+    // (amount caps, recipient allowlists, exact hop paths) rather than warnings;
+    // without it the core reports that no installable policy was synthesised.
     // The core validates the address and installNonce; a bad value surfaces there.
     //
     // Use `!== undefined` (not truthy) so `--smart-account ""` and `--install-nonce`
@@ -137,9 +122,6 @@ async function runSynthesizeCommand(argv, flags) {
     // when it had been silently skipped.
     const smartAccountRaw = pairs['smart-account'];
     const installNonceRaw = pairs['install-nonce'];
-    const oracleStalenessRaw = pairs['oracle-max-staleness'];
-    const oracleDeviationRaw = pairs['oracle-max-deviation'];
-    // --install-nonce and the oracle knobs are interpreter-only. Reject up
     // front so they cannot be silently dropped when --smart-account is absent.
     if (smartAccountRaw === undefined) {
         if (installNonceRaw !== undefined) {
@@ -150,14 +132,6 @@ async function runSynthesizeCommand(argv, flags) {
                 retryable: false,
             });
         }
-        if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
-            throw new output_ts_1.CliError({
-                code: 'CLI_MISSING_ARG',
-                message: 'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
-                severity: 'error',
-                retryable: false,
-            });
-        }
     }
     else {
         const smartAccount = smartAccountRaw.trim();
@@ -190,19 +164,8 @@ async function runSynthesizeCommand(argv, flags) {
             }
             interpreter.installNonce = nonce;
         }
-        // Oracle params only attach when at least one bound was provided. The
         // core validates tighten-only (maxStalenessSeconds <= 600,
         // maxDeviationBps <= 200) - a too-loose value surfaces as SYNTHESIS_ERROR.
-        if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
-            const oracleParams = {};
-            if (oracleStalenessRaw !== undefined) {
-                oracleParams.maxStalenessSeconds = parsePositiveInt(oracleStalenessRaw, '--oracle-max-staleness');
-            }
-            if (oracleDeviationRaw !== undefined) {
-                oracleParams.maxDeviationBps = parsePositiveInt(oracleDeviationRaw, '--oracle-max-deviation');
-            }
-            interpreter.oracleParams = oracleParams;
-        }
         args.interpreter = interpreter;
     }
     if (explain)
@@ -216,13 +179,9 @@ async function runSynthesizeCommand(argv, flags) {
         emitExplainBlock(res, flags);
     return (0, output_ts_1.formatToolResponse)(res, flags, 'synthesize(recording)');
 }
-/** Apply flags shared between the mandate and recording synthesize paths:
- *  --oz-config, --confidence, --explain. Pulled out so adding a shared flag
- *  adds one branch here rather than two copies in the command body. */
+/** Apply the flags that are not part of the recording payload itself:
+ *  --confidence, --explain. */
 function applySharedFlags(args, pairs, explain) {
-    if (pairs['oz-config'] !== undefined) {
-        args.ozConfig = readOzConfigFile(pairs['oz-config']);
-    }
     if (pairs.confidence !== undefined) {
         args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
     }
@@ -242,15 +201,15 @@ function emitExplainBlock(res, flags) {
     const review = (0, policy_synth_1.buildReviewCardSummary)(
     // The orchestrator's `predicateTree` is the exact in-memory AST
     // (canonical JSON shape). The builder's input is typed as
-    // `PredicateNode | null`; the orchestrator's `null` is the truthful
-    // OZ-only / mandate value, so a null here is honest.
-    (res.explain.predicateTree ?? null), res.data?.policyRefs ?? [], res.data?.contextRule ?? {
+    // `PredicateNode | null`; a null is the truthful value when the
+    // interpreter adapter was not engaged.
+    (res.explain.predicateTree ?? null), res.data?.contextRule ?? {
         contextRuleType: { kind: 'default' },
         name: 'unknown',
         validUntilLedger: null,
         signers: [],
         policies: [],
-    }, res.explain.simulation);
+    }, 'interpreter-v1');
     res.data.review =
         review;
     res.data.predicateTree = res.explain.predicateTree;
@@ -272,23 +231,6 @@ function emitExplainBlock(res, flags) {
         }
     }
 }
-/** Read and validate an OzAdapterConfig JSON file. Throws CLI_FILE_NOT_FOUND /
- *  CLI_INVALID_JSON for filesystem / parse failures; the core's strict schema
- *  on `ozConfig` catches shape mismatches downstream. */
-function readOzConfigFile(path) {
-    const value = (0, output_ts_1.readJsonFile)(path);
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-        throw new output_ts_1.CliError({
-            code: 'CLI_INVALID_JSON',
-            message: `synthesize: --oz-config ${path} must be a JSON object`,
-            severity: 'error',
-            retryable: false,
-        });
-    }
-    return value;
-}
-/** Parse and validate `--confidence <n>` as a finite number in [0, 1]. A
- *  threshold above 1 would disable the recorder gate; reject it up front. */
 function parseConfidence(raw) {
     const n = Number(raw);
     if (!Number.isFinite(n) || n < 0 || n > 1) {
@@ -301,8 +243,7 @@ function parseConfidence(raw) {
     }
     return n;
 }
-/** Parse a strictly positive integer (windowSeconds, validUntilLedger,
- *  invocationLimit, oracleParams bounds). The core re-validates these with
+/** Parse a strictly positive integer (validUntilLedger,
  *  field-specific caps; the CLI just enforces "looks like an integer > 0".
  *  The `^[0-9]+$` regex already pins the shape to a non-negative integer, so
  *  the only thing left to check is "not zero". */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-builder-cli",
-  "version": "0.1.18",
+  "version": "0.3.0",
   "license": "MIT",
   "description": "CLI wrapper around the OZ policy-synth core (record + synthesize) for solo-dev and CI workflows.",
   "type": "module",
@@ -12,12 +12,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/untangledfinance/octogate.git",
+    "url": "https://github.com/untangledfinance/oz-policy-builder.git",
     "directory": "packages/policy-builder-cli"
   },
-  "homepage": "https://github.com/untangledfinance/octogate#readme",
+  "homepage": "https://github.com/untangledfinance/oz-policy-builder#readme",
   "bugs": {
-    "url": "https://github.com/untangledfinance/octogate/issues"
+    "url": "https://github.com/untangledfinance/oz-policy-builder/issues"
   },
   "keywords": [
     "stellar",
@@ -63,7 +63,7 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-synth": "0.1.18",
+    "@crediolabs/policy-synth": "0.3.0",
     "@stellar/stellar-sdk": "14.4.0",
     "zod": "3.25.76"
   },

package/src/commands/synthesize.ts

@@ -1,22 +1,20 @@
 // packages/policy-builder-cli/src/commands/synthesize.ts
 //
 // `policy-builder synthesize` subcommand. Dispatches to ONE of the two
-// front-ends (mandate / recording) based on which file flag is supplied:
-//   --mandate <path.json>     -> synthesizeFromMandate
+// One front-end:
 //   --recorded-tx <path.json> -> synthesizeFromRecording
 //
 // The CLI mirrors the MCP tool's discriminated union: one subcommand, two
 // front-ends, mutually exclusive.
 //
-// Per-field response flags (--window-seconds, --valid-until, --limit-amount,
-// --invocation-limit) merge into `userResponses`. A flag overrides the same
+// Per-field response flags (--valid-until, --limit-amount) merge into
+// `userResponses`. A flag overrides the same
 // field from --responses (CLI flags are explicit; the file is a default bag).
-// Oracle params (--oracle-max-staleness, --oracle-max-deviation) are part of
 // the interpreter opt-in and are rejected without --smart-account; tighten-only
 // bounds are validated by the core.
 //
 // --explain (Phase 1) makes the synthesised policy human-readable. The
-// orchestrator attaches the in-memory predicate tree + a SimulationResult
+// orchestrator attaches the in-memory predicate tree
 // to the success envelope; the CLI builds the deterministic review card
 // from those inputs and emits it alongside the policy. Without --explain
 // the output is byte-identical to today.
@@ -30,17 +28,6 @@ import {
 import { runSynthesizePolicy } from '@crediolabs/policy-synth/run'
 import { CliError, type CliFlags, formatToolResponse, parsePairs, readJsonFile } from '../output.ts'
 
-/** Local mirror of the synth core's `SimulationResult` shape. The verify
- *  module is internal to the package, so the CLI keeps this minimal copy
- *  instead of importing the deep path - the contract is small enough that
- *  a structural type is cheaper than a new package export. */
-type SimulationResult = {
-  permit: { tx: 'permit' } | { tx: 'deny'; reason: string }
-  evaluatedCases: Array<{ dimension: string; outcome: 'permit' | 'deny'; reason: string }>
-  backend: 'interpreter-v1' | 'ts-model'
-  simulatorVersion: string
-}
-
 // Positive-int flags and i128 amount strings share the same wire shape: a
 // base-10 unsigned decimal, no sign. The i128 stays a string at the boundary
 // because it is wider than Number.MAX_SAFE_INTEGER.
@@ -51,12 +38,10 @@ export async function runSynthesizeCommand(
   flags: CliFlags
 ): Promise<ProposedPolicy> {
   const pairs = parsePairs(argv)
-  const hasMandate = Boolean(pairs.mandate)
-  const hasRecorded = Boolean(pairs['recorded-tx'])
-  if (hasMandate === hasRecorded) {
+  if (!pairs['recorded-tx']) {
     throw new CliError({
       code: 'CLI_MISSING_ARG',
-      message: 'synthesize: exactly one of --mandate <path> or --recorded-tx <path> is required',
+      message: 'synthesize: --recorded-tx <path> is required',
       severity: 'error',
       retryable: false,
     })
@@ -69,16 +54,6 @@ export async function runSynthesizeCommand(
   // otherwise.
   const explain = pairs.explain !== undefined
 
-  if (hasMandate) {
-    const mandate = readJsonFile(pairs.mandate as string) as Record<string, unknown>
-    const args: Record<string, unknown> = { source: 'mandate', mandate }
-    applySharedFlags(args, pairs, explain)
-    const res = await runSynthesizePolicy(args)
-    if (explain) emitExplainBlock(res, flags)
-    return formatToolResponse(res, flags, 'synthesize(mandate)')
-  }
-
-  // hasRecorded
   const recordedFile = readJsonFile(pairs['recorded-tx'] as string) as Record<string, unknown>
   // Accept either a bare RecordedTransaction or the `{ ok, data }` artifact that
   // `record --out` writes (same shape as `--json`), so `record --out X` followed
@@ -116,10 +91,8 @@ export async function runSynthesizeCommand(
   // Per-field overrides. Each entry: argv flag name, userResponses key,
   // and a parser that validates the raw string.
   const userResponseFlags: Array<[string, string, (raw: string, flag: string) => unknown]> = [
-    ['window-seconds', 'windowSeconds', parsePositiveInt],
     ['valid-until', 'validUntilLedger', parsePositiveInt],
     ['limit-amount', 'limitAmount', parseI128String],
-    ['invocation-limit', 'invocationLimit', parsePositiveInt],
   ]
   for (const [flag, key, parse] of userResponseFlags) {
     if (pairs[flag] !== undefined) {
@@ -148,9 +121,10 @@ export async function runSynthesizeCommand(
 
   applySharedFlags(args, pairs, explain)
 
-  // --smart-account <C...> opts into the interpreter adapter, so constraints OZ
-  // cannot express (per-method scoping, invocation-count windows, oracle bounds,
-  // exact hop paths) lower to a real predicate document instead of just warnings.
+  // --smart-account <C...> names the account the interpreter policy installs
+  // against. It is what lets the recording lower to a real predicate document
+  // (amount caps, recipient allowlists, exact hop paths) rather than warnings;
+  // without it the core reports that no installable policy was synthesised.
   // The core validates the address and installNonce; a bad value surfaces there.
   //
   // Use `!== undefined` (not truthy) so `--smart-account ""` and `--install-nonce`
@@ -160,9 +134,6 @@ export async function runSynthesizeCommand(
   // when it had been silently skipped.
   const smartAccountRaw = pairs['smart-account']
   const installNonceRaw = pairs['install-nonce']
-  const oracleStalenessRaw = pairs['oracle-max-staleness']
-  const oracleDeviationRaw = pairs['oracle-max-deviation']
-  // --install-nonce and the oracle knobs are interpreter-only. Reject up
   // front so they cannot be silently dropped when --smart-account is absent.
   if (smartAccountRaw === undefined) {
     if (installNonceRaw !== undefined) {
@@ -173,15 +144,6 @@ export async function runSynthesizeCommand(
         retryable: false,
       })
     }
-    if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
-      throw new CliError({
-        code: 'CLI_MISSING_ARG',
-        message:
-          'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
-        severity: 'error',
-        retryable: false,
-      })
-    }
   } else {
     const smartAccount = smartAccountRaw.trim()
     if (smartAccount.length === 0) {
@@ -214,25 +176,8 @@ export async function runSynthesizeCommand(
       }
       interpreter.installNonce = nonce
     }
-    // Oracle params only attach when at least one bound was provided. The
     // core validates tighten-only (maxStalenessSeconds <= 600,
     // maxDeviationBps <= 200) - a too-loose value surfaces as SYNTHESIS_ERROR.
-    if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
-      const oracleParams: Record<string, number> = {}
-      if (oracleStalenessRaw !== undefined) {
-        oracleParams.maxStalenessSeconds = parsePositiveInt(
-          oracleStalenessRaw,
-          '--oracle-max-staleness'
-        )
-      }
-      if (oracleDeviationRaw !== undefined) {
-        oracleParams.maxDeviationBps = parsePositiveInt(
-          oracleDeviationRaw,
-          '--oracle-max-deviation'
-        )
-      }
-      interpreter.oracleParams = oracleParams
-    }
     args.interpreter = interpreter
   }
   if (explain) args.explain = true
@@ -245,17 +190,13 @@ export async function runSynthesizeCommand(
   return formatToolResponse(res, flags, 'synthesize(recording)')
 }
 
-/** Apply flags shared between the mandate and recording synthesize paths:
- *  --oz-config, --confidence, --explain. Pulled out so adding a shared flag
- *  adds one branch here rather than two copies in the command body. */
+/** Apply the flags that are not part of the recording payload itself:
+ *  --confidence, --explain. */
 function applySharedFlags(
   args: Record<string, unknown>,
   pairs: Record<string, string>,
   explain: boolean
 ): void {
-  if (pairs['oz-config'] !== undefined) {
-    args.ozConfig = readOzConfigFile(pairs['oz-config'] as string)
-  }
   if (pairs.confidence !== undefined) {
     args.confidenceOverride = { threshold: parseConfidence(pairs.confidence as string) }
   }
@@ -275,7 +216,6 @@ function emitExplainBlock(
     data?: ProposedPolicy
     explain?: {
       predicateTree: unknown
-      simulation: SimulationResult
     }
   },
   flags: CliFlags
@@ -284,10 +224,9 @@ function emitExplainBlock(
   const review = buildReviewCardSummary(
     // The orchestrator's `predicateTree` is the exact in-memory AST
     // (canonical JSON shape). The builder's input is typed as
-    // `PredicateNode | null`; the orchestrator's `null` is the truthful
-    // OZ-only / mandate value, so a null here is honest.
+    // `PredicateNode | null`; a null is the truthful value when the
+    // interpreter adapter was not engaged.
     (res.explain.predicateTree ?? null) as never,
-    res.data?.policyRefs ?? [],
     res.data?.contextRule ?? {
       contextRuleType: { kind: 'default' as const },
       name: 'unknown',
@@ -295,7 +234,7 @@ function emitExplainBlock(
       signers: [],
       policies: [],
     },
-    res.explain.simulation
+    'interpreter-v1'
   )
   // Attach the two additive fields to the on-wire envelope. formatToolResponse
   // reads from `res` and writes the JSON; we mutate the same object so the
@@ -324,24 +263,6 @@ function emitExplainBlock(
   }
 }
 
-/** Read and validate an OzAdapterConfig JSON file. Throws CLI_FILE_NOT_FOUND /
- *  CLI_INVALID_JSON for filesystem / parse failures; the core's strict schema
- *  on `ozConfig` catches shape mismatches downstream. */
-function readOzConfigFile(path: string): Record<string, unknown> {
-  const value = readJsonFile(path)
-  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-    throw new CliError({
-      code: 'CLI_INVALID_JSON',
-      message: `synthesize: --oz-config ${path} must be a JSON object`,
-      severity: 'error',
-      retryable: false,
-    })
-  }
-  return value as Record<string, unknown>
-}
-
-/** Parse and validate `--confidence <n>` as a finite number in [0, 1]. A
- *  threshold above 1 would disable the recorder gate; reject it up front. */
 function parseConfidence(raw: string): number {
   const n = Number(raw)
   if (!Number.isFinite(n) || n < 0 || n > 1) {
@@ -355,8 +276,7 @@ function parseConfidence(raw: string): number {
   return n
 }
 
-/** Parse a strictly positive integer (windowSeconds, validUntilLedger,
- *  invocationLimit, oracleParams bounds). The core re-validates these with
+/** Parse a strictly positive integer (validUntilLedger,
  *  field-specific caps; the CLI just enforces "looks like an integer > 0".
  *  The `^[0-9]+$` regex already pins the shape to a non-negative integer, so
  *  the only thing left to check is "not zero". */