@crediolabs/policy-builder-cli 0.1.6 → 0.1.8

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Untangled Finance Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -19,10 +19,16 @@ policy-builder record     --network <mainnet|testnet> --hash <tx> | --xdr <b64>
                           [--json] [--quiet] [--out <path>]
 
 policy-builder synthesize --mandate <path.json>
+                          [--oz-config <path.json>] [--confidence <0..1>]
                           [--json] [--quiet] [--out <path>]
 
 policy-builder synthesize --recorded-tx <path.json> --network <mainnet|testnet>
                           [--responses <path.json>]
+                          [--oz-config <path.json>] [--confidence <0..1>]
+                          [--smart-account <C...>] [--install-nonce <n>]
+                          [--oracle-max-staleness <s>] [--oracle-max-deviation <bps>]
+                          [--window-seconds <n>] [--valid-until <ledger>]
+                          [--limit-amount <i128str>] [--invocation-limit <n>]
                           [--json] [--quiet] [--out <path>]
 ```
 
@@ -31,8 +37,47 @@ Global flags:
 - `--json` — emit a machine-readable JSON envelope (`{ ok, data }` / `{ ok, error }`) on stdout.
 - `--quiet` — suppress progress / non-error output.
 - `--out <path>` — write the artefact to a file (JSON).
-
-A `ToolError` exits non-zero (`1`), so CI scripts can gate on `$?`.
+- `--oz-config <path.json>` — JSON `OzAdapterConfig` (custom OZ instance
+  addresses for the network). Defaults to the core's mainnet placeholder.
+  Applies to both the `--mandate` and `--recorded-tx` synthesize paths.
+- `--confidence <0..1>` — recorder confidence gate threshold. The synth
+  rejects when `parseConfidence.overall < threshold`; it does not change the
+  recording's `parseConfidence.thresholdUsed` in the output. Must be a finite
+  number in `[0, 1]` (inclusive); out-of-range values are rejected with
+  `CLI_MISSING_ARG`.
+- `--smart-account <C...>` — opt into the interpreter adapter, so
+  constraints OZ built-ins cannot express (per-method scoping, invocation-count
+  windows, oracle bounds, exact hop paths) lower to a real predicate document
+  instead of warnings. Must be a Stellar contract strkey (56 chars, base32
+  alphabet `[2-7A-Z]`, matching `^C[2-7A-Z]{55}$`).
+- `--install-nonce <n>` — per-rule install nonce for the interpreter policy.
+  Requires `--smart-account`; the CLI rejects `--install-nonce` without
+  `--smart-account` so callers cannot silently drop the nonce.
+- `--oracle-max-staleness <s>` — interpreter oracle max staleness in seconds
+  (positive integer `<= 600`, tighten-only vs the wasm default). Requires
+  `--smart-account`; widen values are rejected by the core.
+- `--oracle-max-deviation <bps>` — interpreter oracle max deviation in basis
+  points (positive integer `<= 200`, tighten-only). Requires
+  `--smart-account`; widen values are rejected by the core.
+- `--window-seconds <n>` — per-field override of `userResponses.windowSeconds`.
+  Overrides the same field from `--responses` (CLI flag wins).
+- `--valid-until <ledger>` — per-field override of `userResponses.validUntilLedger`.
+  Overrides the same field from `--responses` (CLI flag wins).
+- `--limit-amount <i128str>` — per-field override of `userResponses.limitAmount`
+  (positive base-10 i128 string). Overrides the same field from `--responses`.
+- `--invocation-limit <n>` — per-field override of `userResponses.invocationLimit`.
+  Overrides the same field from `--responses` (CLI flag wins).
+
+**Precedence for per-field response flags:** `--responses <file>` provides the
+base `userResponses` object; any of the per-field flags above override the
+same-named field from the file (the CLI flag is the explicit caller intent,
+the file is the default bag). The two never merge - either-or on the same
+field.
+
+A `ToolError` exits non-zero (`1`), so CI scripts can gate on `$?`. Empty
+`--smart-account`, out-of-range `--confidence`, non-numeric `--window-seconds`,
+non-integer `--oracle-*`, and `--oracle-*` without `--smart-account` are all
+rejected with `CLI_MISSING_ARG` before the call reaches the core.
 
 ## Examples
 
@@ -43,6 +88,19 @@ policy-builder record --network mainnet --hash <tx-hash> --out recorded-tx.json
 policy-builder synthesize --recorded-tx recorded-tx.json --network mainnet --json
 ```
 
+Synthesise with the interpreter opt-in (use when the policy needs constraints
+OZ built-ins cannot express — e.g. per-claim frequency caps on Blend):
+
+```sh
+policy-builder synthesize \
+  --recorded-tx recorded-tx.json \
+  --network mainnet \
+  --responses responses.json \
+  --smart-account CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIT4C \
+  --install-nonce 1 \
+  --json
+```
+
 Synthesise deterministically from a mandate (`mandate.json`):
 
 ```json

package/dist/bin/policy-builder.js

@@ -5,10 +5,16 @@
 //   policy-builder record --network <mainnet|testnet> --hash <tx>
 //                                 [--xdr <b64>] [--json] [--quiet] [--out <path>]
 //   policy-builder synthesize --mandate <path.json>
+//                              [--oz-config <path.json>] [--confidence <0..1>]
 //                              [--json] [--quiet] [--out <path>]
 //   policy-builder synthesize --recorded-tx <path.json> --network <mainnet|testnet>
 //                              [--responses <path.json>]
+//                              [--oz-config <path.json>] [--confidence <0..1>]
 //                              [--smart-account <C...>] [--install-nonce <n>]
+//                              [--oracle-max-staleness <s>] [--oracle-max-deviation <bps>]
+//                              [--window-seconds <n>] [--valid-until <ledger>]
+//                              [--limit-amount <i128str>] [--invocation-limit <n>]
+//                              [--recipient <C...|G...>]...
 //                              [--json] [--quiet] [--out <path>]
 //
 // The router is hand-rolled (no commander / yargs dep). It splits argv into
@@ -59,21 +65,55 @@ Usage:
   policy-builder record     --network <mainnet|testnet> --hash <tx> | --xdr <b64>
                             [--json] [--quiet] [--out <path>]
   policy-builder synthesize --mandate <path.json>
+                            [--oz-config <path.json>] [--confidence <0..1>]
                             [--json] [--quiet] [--out <path>]
   policy-builder synthesize --recorded-tx <path.json> --network <mainnet|testnet>
                             [--responses <path.json>]
+                            [--oz-config <path.json>] [--confidence <0..1>]
                             [--smart-account <C...>] [--install-nonce <n>]
+                            [--oracle-max-staleness <s>] [--oracle-max-deviation <bps>]
+                            [--window-seconds <n>] [--valid-until <ledger>]
+                            [--limit-amount <i128str>] [--invocation-limit <n>]
+                            [--recipient <C...|G...>]...
                             [--json] [--quiet] [--out <path>]
 
 Flags:
-  --json            emit machine-readable JSON on stdout
-  --quiet           suppress progress / non-error output
-  --out             write artefact to file (JSON)
-  --smart-account   C... account to opt into the interpreter adapter, so
-                    non-OZ constraints (per-method scoping, invocation-count
-                    windows, oracle bounds, exact hop paths) lower to a real
-                    predicate document instead of warnings
-  --install-nonce   per-rule install nonce for the interpreter policy (default 1)
+  --json                    emit machine-readable JSON on stdout
+  --quiet                   suppress progress / non-error output
+  --out                     write artefact to file (JSON)
+  --oz-config               path to a JSON OzAdapterConfig (custom OZ instance
+                            addresses for the network); applies to both the
+                            --mandate and --recorded-tx synthesize paths
+  --confidence              recorder confidence GATE threshold (0..1, inclusive);
+                            rejects when parseConfidence.overall < threshold; does
+                            not change the recording's parseConfidence.thresholdUsed
+                            in the output
+  --smart-account           C... account to opt into the interpreter adapter, so
+                            non-OZ constraints (per-method scoping, invocation-count
+                            windows, oracle bounds, exact hop paths) lower to a real
+                            predicate document instead of warnings
+  --install-nonce           per-rule install nonce for the interpreter policy
+                            (default 1); requires --smart-account
+  --oracle-max-staleness    interpreter oracle max staleness in seconds
+                            (positive integer <= 600, tighten-only);
+                            requires --smart-account
+  --oracle-max-deviation    interpreter oracle max deviation in basis points
+                            (positive integer <= 200, tighten-only);
+                            requires --smart-account
+  --window-seconds          per-field override of userResponses.windowSeconds;
+                            overrides the same field from --responses (CLI flag
+                            wins)
+  --valid-until             per-field override of userResponses.validUntilLedger;
+                            overrides the same field from --responses
+  --limit-amount            per-field override of userResponses.limitAmount
+                            (i128 decimal string); overrides the same field
+                            from --responses
+  --invocation-limit        per-field override of userResponses.invocationLimit;
+                            overrides the same field from --responses
+  --recipient               swap-recipient allowlist entry (C... contract or
+                            G... wallet) for a SoroSwap swap; REPEATABLE. Absent,
+                            the recorded recipient is pinned by default; supplying
+                            --recipient REPLACES that pin with the given set
 `);
 }
 await main();

package/dist/src/commands/record.js

@@ -3,7 +3,7 @@
 // `policy-builder record` subcommand. Thin wrapper around the core
 // `recordTransaction` - no business logic, just argv -> RecordInput + the
 // canonical CLI envelope.
-import { runRecordTransaction } from '@crediolabs/policy-builder-mcp';
+import { runRecordTransaction } from '@crediolabs/policy-synth/run';
 import { CliError, formatToolResponse, parsePairs } from "../output.js";
 export async function runRecordCommand(argv, flags) {
     const pairs = parsePairs(argv);

package/dist/src/commands/synthesize.d.ts

@@ -1,3 +1,3 @@
-import type { ProposedPolicy } from '@crediolabs/policy-synth';
+import { type ProposedPolicy } from '@crediolabs/policy-synth';
 import { type CliFlags } from '../output.ts';
 export declare function runSynthesizeCommand(argv: ReadonlyArray<string>, flags: CliFlags): Promise<ProposedPolicy>;

package/dist/src/commands/synthesize.js

@@ -7,8 +7,20 @@
 //
 // The CLI mirrors the MCP tool's discriminated union: one subcommand, two
 // front-ends, mutually exclusive.
-import { runSynthesizePolicy } from '@crediolabs/policy-builder-mcp';
+//
+// Per-field response flags (--window-seconds, --valid-until, --limit-amount,
+// --invocation-limit) merge into `userResponses`. A flag overrides the same
+// field from --responses (CLI flags are explicit; the file is a default bag).
+// Oracle params (--oracle-max-staleness, --oracle-max-deviation) are part of
+// the interpreter opt-in and are rejected without --smart-account; tighten-only
+// bounds are validated by the core.
+import { isStellarAddress } from '@crediolabs/policy-synth';
+import { runSynthesizePolicy } from '@crediolabs/policy-synth/run';
 import { CliError, formatToolResponse, parsePairs, readJsonFile } from "../output.js";
+// Positive-int flags and i128 amount strings share the same wire shape: a
+// base-10 unsigned decimal, no sign. The i128 stays a string at the boundary
+// because it is wider than Number.MAX_SAFE_INTEGER.
+const POSITIVE_INT_RE = /^[0-9]+$/;
 export async function runSynthesizeCommand(argv, flags) {
     const pairs = parsePairs(argv);
     const hasMandate = Boolean(pairs.mandate);
@@ -23,7 +35,14 @@ export async function runSynthesizeCommand(argv, flags) {
     }
     if (hasMandate) {
         const mandate = readJsonFile(pairs.mandate);
-        const res = await runSynthesizePolicy({ source: 'mandate', mandate });
+        const args = { source: 'mandate', mandate };
+        if (pairs['oz-config'] !== undefined) {
+            args.ozConfig = readOzConfigFile(pairs['oz-config']);
+        }
+        if (pairs.confidence !== undefined) {
+            args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
+        }
+        const res = await runSynthesizePolicy(args);
         return formatToolResponse(res, flags, 'synthesize(mandate)');
     }
     // hasRecorded
@@ -44,20 +63,232 @@ export async function runSynthesizeCommand(argv, flags) {
         });
     }
     const args = { source: 'recording', recordedTx, network };
+    // userResponses precedence: --responses file is the base; per-field flags
+    // override the same field. Only the override'd fields are merged in.
+    const userResponses = {};
     if (pairs.responses) {
-        args.userResponses = readJsonFile(pairs.responses);
+        const file = readJsonFile(pairs.responses);
+        if (file !== null && typeof file === 'object' && !Array.isArray(file)) {
+            Object.assign(userResponses, file);
+        }
+        else {
+            throw new CliError({
+                code: 'CLI_INVALID_JSON',
+                message: `synthesize: --responses ${pairs.responses} must be a JSON object`,
+                severity: 'error',
+                retryable: false,
+            });
+        }
+    }
+    if (pairs['window-seconds'] !== undefined) {
+        userResponses.windowSeconds = parsePositiveInt(pairs['window-seconds'], '--window-seconds');
+    }
+    if (pairs['valid-until'] !== undefined) {
+        userResponses.validUntilLedger = parsePositiveInt(pairs['valid-until'], '--valid-until');
+    }
+    if (pairs['limit-amount'] !== undefined) {
+        userResponses.limitAmount = parseI128String(pairs['limit-amount'], '--limit-amount');
+    }
+    if (pairs['invocation-limit'] !== undefined) {
+        userResponses.invocationLimit = parsePositiveInt(pairs['invocation-limit'], '--invocation-limit');
+    }
+    // --recipient <C...|G...> is REPEATABLE (parsePairs collapses duplicate keys,
+    // so it is collected straight from argv). Each value builds the swap-recipient
+    // allowlist; supplying it REPLACES the default pin to the recorded recipient.
+    const recipients = collectRepeated(argv, 'recipient');
+    if (recipients.length > 0) {
+        for (const r of recipients) {
+            // Same validator the run-layer schema applies (SDK StrKey underneath) - a
+            // swap recipient may be a G... wallet or a C... contract. Shared rather
+            // than re-inlined so the CLI and the schema cannot drift apart.
+            if (!isStellarAddress(r)) {
+                throw new CliError({
+                    code: 'CLI_MISSING_ARG',
+                    message: `synthesize: --recipient "${r}" is not a valid Stellar address (expected a G... wallet or C... contract)`,
+                    severity: 'error',
+                    retryable: false,
+                });
+            }
+        }
+        userResponses.swapRecipientAllowlist = recipients;
+    }
+    if (Object.keys(userResponses).length > 0) {
+        args.userResponses = userResponses;
+    }
+    if (pairs['oz-config'] !== undefined) {
+        args.ozConfig = readOzConfigFile(pairs['oz-config']);
+    }
+    if (pairs.confidence !== undefined) {
+        args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
     }
     // --smart-account <C...> opts into the interpreter adapter, so constraints OZ
     // cannot express (per-method scoping, invocation-count windows, oracle bounds,
     // exact hop paths) lower to a real predicate document instead of just warnings.
     // The core validates the address and installNonce; a bad value surfaces there.
-    if (pairs['smart-account']) {
-        const interpreter = { smartAccountAddress: pairs['smart-account'] };
-        if (pairs['install-nonce']) {
-            interpreter.installNonce = Number(pairs['install-nonce']);
+    //
+    // Use `!== undefined` (not truthy) so `--smart-account ""` and `--install-nonce`
+    // without `--smart-account` are rejected up front instead of being silently
+    // dropped. The foot-gun: an empty value previously produced an "ok" envelope
+    // with 0 policyDocuments, so callers thought the constraint had been enforced
+    // when in fact it had been silently skipped.
+    const smartAccountRaw = pairs['smart-account'];
+    const installNonceRaw = pairs['install-nonce'];
+    const oracleStalenessRaw = pairs['oracle-max-staleness'];
+    const oracleDeviationRaw = pairs['oracle-max-deviation'];
+    if (installNonceRaw !== undefined && smartAccountRaw === undefined) {
+        throw new CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'synthesize: --install-nonce requires --smart-account <C...> (interpreter opt-in)',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    // Oracle params are an interpreter-only knob; reject up front so they cannot
+    // be silently dropped when --smart-account is absent.
+    if ((oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) &&
+        smartAccountRaw === undefined) {
+        throw new CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    if (smartAccountRaw !== undefined) {
+        const smartAccount = smartAccountRaw.trim();
+        if (smartAccount.length === 0) {
+            throw new CliError({
+                code: 'CLI_MISSING_ARG',
+                message: 'synthesize: --smart-account <C...> was passed empty; provide a 56-character contract strkey or omit the flag',
+                severity: 'error',
+                retryable: false,
+            });
+        }
+        if (!/^C[2-7A-Z]{55}$/.test(smartAccount)) {
+            throw new CliError({
+                code: 'CLI_MISSING_ARG',
+                message: `synthesize: --smart-account "${smartAccount}" is not a valid C... contract strkey (expected 56 chars starting with C)`,
+                severity: 'error',
+                retryable: false,
+            });
+        }
+        const interpreter = { smartAccountAddress: smartAccount };
+        if (installNonceRaw !== undefined) {
+            const nonce = Number(installNonceRaw);
+            if (!Number.isInteger(nonce) || nonce < 0) {
+                throw new CliError({
+                    code: 'CLI_MISSING_ARG',
+                    message: `synthesize: --install-nonce "${installNonceRaw}" is not a non-negative integer`,
+                    severity: 'error',
+                    retryable: false,
+                });
+            }
+            interpreter.installNonce = nonce;
+        }
+        // Oracle params only attach when at least one bound was provided. The
+        // core validates tighten-only (maxStalenessSeconds <= 600,
+        // maxDeviationBps <= 200) - a too-loose value surfaces as SYNTHESIS_ERROR.
+        if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
+            const oracleParams = {};
+            if (oracleStalenessRaw !== undefined) {
+                oracleParams.maxStalenessSeconds = parsePositiveInt(oracleStalenessRaw, '--oracle-max-staleness');
+            }
+            if (oracleDeviationRaw !== undefined) {
+                oracleParams.maxDeviationBps = parsePositiveInt(oracleDeviationRaw, '--oracle-max-deviation');
+            }
+            interpreter.oracleParams = oracleParams;
         }
         args.interpreter = interpreter;
     }
     const res = await runSynthesizePolicy(args);
     return formatToolResponse(res, flags, 'synthesize(recording)');
 }
+/** Read and validate an OzAdapterConfig JSON file. Throws CLI_FILE_NOT_FOUND /
+ *  CLI_INVALID_JSON for filesystem / parse failures; the core's strict schema
+ *  on `ozConfig` catches shape mismatches downstream. */
+function readOzConfigFile(path) {
+    const value = readJsonFile(path);
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new CliError({
+            code: 'CLI_INVALID_JSON',
+            message: `synthesize: --oz-config ${path} must be a JSON object`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return value;
+}
+/** Parse and validate `--confidence <n>` as a finite number in [0, 1]. A
+ *  threshold above 1 would disable the recorder gate; reject it up front. */
+function parseConfidence(raw) {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 0 || n > 1) {
+        throw new CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: --confidence "${raw}" must be a finite number within [0, 1]`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return n;
+}
+/** Parse a strictly positive integer (windowSeconds, validUntilLedger,
+ *  invocationLimit, oracleParams bounds). The core re-validates these with
+ *  field-specific caps; the CLI just enforces "looks like an integer > 0". */
+function parsePositiveInt(raw, flagName) {
+    if (!POSITIVE_INT_RE.test(raw)) {
+        throw new CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return n;
+}
+/** Collect ALL values for a repeatable `--<name> <value>` / `--<name>=<value>`
+ *  flag from argv, in order. Unlike `parsePairs` (which keeps only the last
+ *  occurrence of a key), this preserves every occurrence so a flag like
+ *  `--recipient` can be supplied multiple times to build an allowlist. A
+ *  trailing `--<name>` with no value (or another flag next) is skipped. */
+function collectRepeated(argv, name) {
+    const out = [];
+    const eqPrefix = `--${name}=`;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === `--${name}`) {
+            const next = argv[i + 1];
+            if (next !== undefined && !next.startsWith('--')) {
+                out.push(next);
+                i++;
+            }
+        }
+        else if (a?.startsWith(eqPrefix)) {
+            out.push(a.slice(eqPrefix.length));
+        }
+    }
+    return out;
+}
+/** Parse an i128 decimal string (positive, base 10). The synth gate, not the
+ *  CLI, decides what to do with negatives - real recordings carry positive
+ *  amounts on the wire for `limitAmount`. */
+function parseI128String(raw, flagName) {
+    if (!POSITIVE_INT_RE.test(raw)) {
+        throw new CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: ${flagName} "${raw}" must be a positive decimal integer string (base-10 i128)`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return raw;
+}

package/dist/src/output.d.ts

@@ -10,7 +10,14 @@ export interface CliFlags {
 export declare function parseFlags(argv: ReadonlyArray<string>): CliFlags;
 /** Resolve `--value <v>` style pairs after the subcommand name. Returns
  *  an object keyed by the option name (without `--`). Throws on missing
- *  value or duplicate keys. */
+ *  value or duplicate keys.
+ *
+ *  Note: an empty value (`--smart-account ""`) IS captured as an empty
+ *  string so the caller can distinguish "flag omitted" from "flag passed
+ *  empty" - a foot-gun: silently dropping empty values caused callers to
+ *  believe the interpreter adapter was engaged when it was not. The next
+ *  token is treated as a value iff it is present and does not start with
+ *  `--`; tokens starting with `--` are never consumed as values. */
 export declare function parsePairs(argv: ReadonlyArray<string>): Record<string, string>;
 /** Read a JSON file, parse it, and return the value. Throws with a CLI-
  *  friendly error if the file is missing or malformed. */

package/dist/src/output.js

@@ -29,7 +29,14 @@ export function parseFlags(argv) {
 }
 /** Resolve `--value <v>` style pairs after the subcommand name. Returns
  *  an object keyed by the option name (without `--`). Throws on missing
- *  value or duplicate keys. */
+ *  value or duplicate keys.
+ *
+ *  Note: an empty value (`--smart-account ""`) IS captured as an empty
+ *  string so the caller can distinguish "flag omitted" from "flag passed
+ *  empty" - a foot-gun: silently dropping empty values caused callers to
+ *  believe the interpreter adapter was engaged when it was not. The next
+ *  token is treated as a value iff it is present and does not start with
+ *  `--`; tokens starting with `--` are never consumed as values. */
 export function parsePairs(argv) {
     const out = {};
     for (let i = 0; i < argv.length; i++) {
@@ -41,11 +48,23 @@ export function parsePairs(argv) {
             if (key && val !== undefined)
                 out[key] = val;
         }
-        else if (a?.startsWith('--') && argv[i + 1] && !argv[i + 1]?.startsWith('--')) {
+        else if (a?.startsWith('--')) {
             const key = a.slice(2);
-            const val = argv[i + 1];
-            out[key] = val;
-            i++;
+            if (!key)
+                continue;
+            const next = argv[i + 1];
+            // Only consume the next token if it is present AND does not look like
+            // another flag. Empty strings DO count as values so callers can
+            // distinguish "omitted" from "passed empty".
+            if (next !== undefined && !next.startsWith('--')) {
+                out[key] = next;
+                i++;
+            }
+            else {
+                // Standalone flag (no value) - record as empty string so `!== undefined`
+                // checks upstream can detect presence.
+                out[key] = '';
+            }
         }
     }
     return out;

package/dist-cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist-cjs/src/commands/record.d.ts

@@ -0,0 +1,3 @@
+import type { RecordedTransaction } from '@crediolabs/policy-synth';
+import { type CliFlags } from '../output.ts';
+export declare function runRecordCommand(argv: ReadonlyArray<string>, flags: CliFlags): Promise<RecordedTransaction>;

package/dist-cjs/src/commands/record.js

@@ -0,0 +1,45 @@
+"use strict";
+// apps/policy-builder-cli/src/commands/record.ts
+//
+// `policy-builder record` subcommand. Thin wrapper around the core
+// `recordTransaction` - no business logic, just argv -> RecordInput + the
+// canonical CLI envelope.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRecordCommand = runRecordCommand;
+const run_1 = require("@crediolabs/policy-synth/run");
+const output_ts_1 = require("../output.js");
+async function runRecordCommand(argv, flags) {
+    const pairs = (0, output_ts_1.parsePairs)(argv);
+    const network = pairs.network;
+    if (!network) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'record: --network <mainnet|testnet> is required',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    if (!pairs.hash && !pairs.xdr) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'record: exactly one of --hash <tx> or --xdr <b64> is required',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    if (pairs.hash && pairs.xdr) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'record: provide exactly one of --hash or --xdr, not both',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    const args = { network };
+    if (pairs.hash)
+        args.hash = pairs.hash;
+    if (pairs.xdr)
+        args.xdr = pairs.xdr;
+    const res = await (0, run_1.runRecordTransaction)(args);
+    return (0, output_ts_1.formatToolResponse)(res, flags, 'record');
+}

package/dist-cjs/src/commands/synthesize.d.ts

@@ -0,0 +1,3 @@
+import { type ProposedPolicy } from '@crediolabs/policy-synth';
+import { type CliFlags } from '../output.ts';
+export declare function runSynthesizeCommand(argv: ReadonlyArray<string>, flags: CliFlags): Promise<ProposedPolicy>;