@crediolabs/policy-builder-cli 0.1.6 → 0.1.8

package/dist-cjs/src/commands/synthesize.js

@@ -0,0 +1,297 @@
+"use strict";
+// apps/policy-builder-cli/src/commands/synthesize.ts
+//
+// `policy-builder synthesize` subcommand. Dispatches to ONE of the two
+// front-ends (mandate / recording) based on which file flag is supplied:
+//   --mandate <path.json>     -> synthesizeFromMandate
+//   --recorded-tx <path.json> -> synthesizeFromRecording
+//
+// The CLI mirrors the MCP tool's discriminated union: one subcommand, two
+// front-ends, mutually exclusive.
+//
+// Per-field response flags (--window-seconds, --valid-until, --limit-amount,
+// --invocation-limit) merge into `userResponses`. A flag overrides the same
+// field from --responses (CLI flags are explicit; the file is a default bag).
+// Oracle params (--oracle-max-staleness, --oracle-max-deviation) are part of
+// the interpreter opt-in and are rejected without --smart-account; tighten-only
+// bounds are validated by the core.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSynthesizeCommand = runSynthesizeCommand;
+const policy_synth_1 = require("@crediolabs/policy-synth");
+const run_1 = require("@crediolabs/policy-synth/run");
+const output_ts_1 = require("../output.js");
+// Positive-int flags and i128 amount strings share the same wire shape: a
+// base-10 unsigned decimal, no sign. The i128 stays a string at the boundary
+// because it is wider than Number.MAX_SAFE_INTEGER.
+const POSITIVE_INT_RE = /^[0-9]+$/;
+async function runSynthesizeCommand(argv, flags) {
+    const pairs = (0, output_ts_1.parsePairs)(argv);
+    const hasMandate = Boolean(pairs.mandate);
+    const hasRecorded = Boolean(pairs['recorded-tx']);
+    if (hasMandate === hasRecorded) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'synthesize: exactly one of --mandate <path> or --recorded-tx <path> is required',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    if (hasMandate) {
+        const mandate = (0, output_ts_1.readJsonFile)(pairs.mandate);
+        const args = { source: 'mandate', mandate };
+        if (pairs['oz-config'] !== undefined) {
+            args.ozConfig = readOzConfigFile(pairs['oz-config']);
+        }
+        if (pairs.confidence !== undefined) {
+            args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
+        }
+        const res = await (0, run_1.runSynthesizePolicy)(args);
+        return (0, output_ts_1.formatToolResponse)(res, flags, 'synthesize(mandate)');
+    }
+    // hasRecorded
+    const recordedFile = (0, output_ts_1.readJsonFile)(pairs['recorded-tx']);
+    // Accept either a bare RecordedTransaction or the `{ ok, data }` artifact that
+    // `record --out` writes (same shape as `--json`), so `record --out X` followed
+    // by `synthesize --recorded-tx X` works end to end.
+    const recordedTx = recordedFile?.ok === true && typeof recordedFile.data === 'object' && recordedFile.data !== null
+        ? recordedFile.data
+        : recordedFile;
+    const network = pairs.network;
+    if (!network) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'synthesize: --network <mainnet|testnet> is required with --recorded-tx',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    const args = { source: 'recording', recordedTx, network };
+    // userResponses precedence: --responses file is the base; per-field flags
+    // override the same field. Only the override'd fields are merged in.
+    const userResponses = {};
+    if (pairs.responses) {
+        const file = (0, output_ts_1.readJsonFile)(pairs.responses);
+        if (file !== null && typeof file === 'object' && !Array.isArray(file)) {
+            Object.assign(userResponses, file);
+        }
+        else {
+            throw new output_ts_1.CliError({
+                code: 'CLI_INVALID_JSON',
+                message: `synthesize: --responses ${pairs.responses} must be a JSON object`,
+                severity: 'error',
+                retryable: false,
+            });
+        }
+    }
+    if (pairs['window-seconds'] !== undefined) {
+        userResponses.windowSeconds = parsePositiveInt(pairs['window-seconds'], '--window-seconds');
+    }
+    if (pairs['valid-until'] !== undefined) {
+        userResponses.validUntilLedger = parsePositiveInt(pairs['valid-until'], '--valid-until');
+    }
+    if (pairs['limit-amount'] !== undefined) {
+        userResponses.limitAmount = parseI128String(pairs['limit-amount'], '--limit-amount');
+    }
+    if (pairs['invocation-limit'] !== undefined) {
+        userResponses.invocationLimit = parsePositiveInt(pairs['invocation-limit'], '--invocation-limit');
+    }
+    // --recipient <C...|G...> is REPEATABLE (parsePairs collapses duplicate keys,
+    // so it is collected straight from argv). Each value builds the swap-recipient
+    // allowlist; supplying it REPLACES the default pin to the recorded recipient.
+    const recipients = collectRepeated(argv, 'recipient');
+    if (recipients.length > 0) {
+        for (const r of recipients) {
+            // Same validator the run-layer schema applies (SDK StrKey underneath) - a
+            // swap recipient may be a G... wallet or a C... contract. Shared rather
+            // than re-inlined so the CLI and the schema cannot drift apart.
+            if (!(0, policy_synth_1.isStellarAddress)(r)) {
+                throw new output_ts_1.CliError({
+                    code: 'CLI_MISSING_ARG',
+                    message: `synthesize: --recipient "${r}" is not a valid Stellar address (expected a G... wallet or C... contract)`,
+                    severity: 'error',
+                    retryable: false,
+                });
+            }
+        }
+        userResponses.swapRecipientAllowlist = recipients;
+    }
+    if (Object.keys(userResponses).length > 0) {
+        args.userResponses = userResponses;
+    }
+    if (pairs['oz-config'] !== undefined) {
+        args.ozConfig = readOzConfigFile(pairs['oz-config']);
+    }
+    if (pairs.confidence !== undefined) {
+        args.confidenceOverride = { threshold: parseConfidence(pairs.confidence) };
+    }
+    // --smart-account <C...> opts into the interpreter adapter, so constraints OZ
+    // cannot express (per-method scoping, invocation-count windows, oracle bounds,
+    // exact hop paths) lower to a real predicate document instead of just warnings.
+    // The core validates the address and installNonce; a bad value surfaces there.
+    //
+    // Use `!== undefined` (not truthy) so `--smart-account ""` and `--install-nonce`
+    // without `--smart-account` are rejected up front instead of being silently
+    // dropped. The foot-gun: an empty value previously produced an "ok" envelope
+    // with 0 policyDocuments, so callers thought the constraint had been enforced
+    // when in fact it had been silently skipped.
+    const smartAccountRaw = pairs['smart-account'];
+    const installNonceRaw = pairs['install-nonce'];
+    const oracleStalenessRaw = pairs['oracle-max-staleness'];
+    const oracleDeviationRaw = pairs['oracle-max-deviation'];
+    if (installNonceRaw !== undefined && smartAccountRaw === undefined) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'synthesize: --install-nonce requires --smart-account <C...> (interpreter opt-in)',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    // Oracle params are an interpreter-only knob; reject up front so they cannot
+    // be silently dropped when --smart-account is absent.
+    if ((oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) &&
+        smartAccountRaw === undefined) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: 'synthesize: --oracle-max-staleness / --oracle-max-deviation require --smart-account <C...> (interpreter opt-in)',
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    if (smartAccountRaw !== undefined) {
+        const smartAccount = smartAccountRaw.trim();
+        if (smartAccount.length === 0) {
+            throw new output_ts_1.CliError({
+                code: 'CLI_MISSING_ARG',
+                message: 'synthesize: --smart-account <C...> was passed empty; provide a 56-character contract strkey or omit the flag',
+                severity: 'error',
+                retryable: false,
+            });
+        }
+        if (!/^C[2-7A-Z]{55}$/.test(smartAccount)) {
+            throw new output_ts_1.CliError({
+                code: 'CLI_MISSING_ARG',
+                message: `synthesize: --smart-account "${smartAccount}" is not a valid C... contract strkey (expected 56 chars starting with C)`,
+                severity: 'error',
+                retryable: false,
+            });
+        }
+        const interpreter = { smartAccountAddress: smartAccount };
+        if (installNonceRaw !== undefined) {
+            const nonce = Number(installNonceRaw);
+            if (!Number.isInteger(nonce) || nonce < 0) {
+                throw new output_ts_1.CliError({
+                    code: 'CLI_MISSING_ARG',
+                    message: `synthesize: --install-nonce "${installNonceRaw}" is not a non-negative integer`,
+                    severity: 'error',
+                    retryable: false,
+                });
+            }
+            interpreter.installNonce = nonce;
+        }
+        // Oracle params only attach when at least one bound was provided. The
+        // core validates tighten-only (maxStalenessSeconds <= 600,
+        // maxDeviationBps <= 200) - a too-loose value surfaces as SYNTHESIS_ERROR.
+        if (oracleStalenessRaw !== undefined || oracleDeviationRaw !== undefined) {
+            const oracleParams = {};
+            if (oracleStalenessRaw !== undefined) {
+                oracleParams.maxStalenessSeconds = parsePositiveInt(oracleStalenessRaw, '--oracle-max-staleness');
+            }
+            if (oracleDeviationRaw !== undefined) {
+                oracleParams.maxDeviationBps = parsePositiveInt(oracleDeviationRaw, '--oracle-max-deviation');
+            }
+            interpreter.oracleParams = oracleParams;
+        }
+        args.interpreter = interpreter;
+    }
+    const res = await (0, run_1.runSynthesizePolicy)(args);
+    return (0, output_ts_1.formatToolResponse)(res, flags, 'synthesize(recording)');
+}
+/** Read and validate an OzAdapterConfig JSON file. Throws CLI_FILE_NOT_FOUND /
+ *  CLI_INVALID_JSON for filesystem / parse failures; the core's strict schema
+ *  on `ozConfig` catches shape mismatches downstream. */
+function readOzConfigFile(path) {
+    const value = (0, output_ts_1.readJsonFile)(path);
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_INVALID_JSON',
+            message: `synthesize: --oz-config ${path} must be a JSON object`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return value;
+}
+/** Parse and validate `--confidence <n>` as a finite number in [0, 1]. A
+ *  threshold above 1 would disable the recorder gate; reject it up front. */
+function parseConfidence(raw) {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 0 || n > 1) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: --confidence "${raw}" must be a finite number within [0, 1]`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return n;
+}
+/** Parse a strictly positive integer (windowSeconds, validUntilLedger,
+ *  invocationLimit, oracleParams bounds). The core re-validates these with
+ *  field-specific caps; the CLI just enforces "looks like an integer > 0". */
+function parsePositiveInt(raw, flagName) {
+    if (!POSITIVE_INT_RE.test(raw)) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: ${flagName} "${raw}" must be a positive integer`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return n;
+}
+/** Collect ALL values for a repeatable `--<name> <value>` / `--<name>=<value>`
+ *  flag from argv, in order. Unlike `parsePairs` (which keeps only the last
+ *  occurrence of a key), this preserves every occurrence so a flag like
+ *  `--recipient` can be supplied multiple times to build an allowlist. A
+ *  trailing `--<name>` with no value (or another flag next) is skipped. */
+function collectRepeated(argv, name) {
+    const out = [];
+    const eqPrefix = `--${name}=`;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === `--${name}`) {
+            const next = argv[i + 1];
+            if (next !== undefined && !next.startsWith('--')) {
+                out.push(next);
+                i++;
+            }
+        }
+        else if (a?.startsWith(eqPrefix)) {
+            out.push(a.slice(eqPrefix.length));
+        }
+    }
+    return out;
+}
+/** Parse an i128 decimal string (positive, base 10). The synth gate, not the
+ *  CLI, decides what to do with negatives - real recordings carry positive
+ *  amounts on the wire for `limitAmount`. */
+function parseI128String(raw, flagName) {
+    if (!POSITIVE_INT_RE.test(raw)) {
+        throw new output_ts_1.CliError({
+            code: 'CLI_MISSING_ARG',
+            message: `synthesize: ${flagName} "${raw}" must be a positive decimal integer string (base-10 i128)`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    return raw;
+}

package/dist-cjs/src/index.d.ts

@@ -0,0 +1,3 @@
+export { runRecordCommand } from './commands/record.ts';
+export { runSynthesizeCommand } from './commands/synthesize.ts';
+export { formatToolResponse, readJsonFile, writeJsonFile } from './output.ts';

package/dist-cjs/src/index.js

@@ -0,0 +1,12 @@
+"use strict";
+// apps/policy-builder-cli/src/index.ts - public re-exports for the CLI package.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeJsonFile = exports.readJsonFile = exports.formatToolResponse = exports.runSynthesizeCommand = exports.runRecordCommand = void 0;
+var record_ts_1 = require("./commands/record.js");
+Object.defineProperty(exports, "runRecordCommand", { enumerable: true, get: function () { return record_ts_1.runRecordCommand; } });
+var synthesize_ts_1 = require("./commands/synthesize.js");
+Object.defineProperty(exports, "runSynthesizeCommand", { enumerable: true, get: function () { return synthesize_ts_1.runSynthesizeCommand; } });
+var output_ts_1 = require("./output.js");
+Object.defineProperty(exports, "formatToolResponse", { enumerable: true, get: function () { return output_ts_1.formatToolResponse; } });
+Object.defineProperty(exports, "readJsonFile", { enumerable: true, get: function () { return output_ts_1.readJsonFile; } });
+Object.defineProperty(exports, "writeJsonFile", { enumerable: true, get: function () { return output_ts_1.writeJsonFile; } });

package/dist-cjs/src/output.d.ts

@@ -0,0 +1,56 @@
+import type { ErrorCode, ToolError, ToolResponse } from '@crediolabs/policy-synth';
+/** CLI flags (the only ones shipped in T1). */
+export interface CliFlags {
+    json: boolean;
+    quiet: boolean;
+    out: string | null;
+}
+/** Parse the argv tail for the known flags. Unrecognised flags are ignored
+ *  (the caller enforces per-subcommand required flags separately). */
+export declare function parseFlags(argv: ReadonlyArray<string>): CliFlags;
+/** Resolve `--value <v>` style pairs after the subcommand name. Returns
+ *  an object keyed by the option name (without `--`). Throws on missing
+ *  value or duplicate keys.
+ *
+ *  Note: an empty value (`--smart-account ""`) IS captured as an empty
+ *  string so the caller can distinguish "flag omitted" from "flag passed
+ *  empty" - a foot-gun: silently dropping empty values caused callers to
+ *  believe the interpreter adapter was engaged when it was not. The next
+ *  token is treated as a value iff it is present and does not start with
+ *  `--`; tokens starting with `--` are never consumed as values. */
+export declare function parsePairs(argv: ReadonlyArray<string>): Record<string, string>;
+/** Read a JSON file, parse it, and return the value. Throws with a CLI-
+ *  friendly error if the file is missing or malformed. */
+export declare function readJsonFile(path: string): unknown;
+/** Write a JSON-serialisable value to disk. Pretty-prints by default so the
+ *  artefact is human-readable; CI scripts that need compact JSON can pipe
+ *  through `jq` instead. */
+export declare function writeJsonFile(path: string, value: unknown): void;
+/** Wraps a core ToolResponse for the CLI:
+ *    - always prints something useful (JSON or a short summary)
+ *    - exits non-zero on ToolError so CI scripts can gate on `$?`
+ *    - writes the `{ ok, data }` envelope to --out when present (matches
+ *      the --json stdout shape so CI scripts get a single canonical payload)
+ *
+ *  Throws CliError so the router can map it to a process exit code + a
+ *  structured JSON envelope under --json. */
+export declare function formatToolResponse<T>(res: ToolResponse<T>, flags: CliFlags, outLabel?: string): T;
+/** CLI-specific error codes, distinct from the core's ErrorCode union. They
+ *  cover failures that arise around the core call (bad argv, missing or
+ *  malformed input files) and never collide with a core code. */
+export type CliErrorCode = 'CLI_MISSING_ARG' | 'CLI_FILE_NOT_FOUND' | 'CLI_INVALID_JSON' | 'CLI_INTERNAL';
+/** A ToolError whose `code` may be a core ErrorCode OR a CLI-local code. The
+ *  CLI wraps both core failures and its own argv / IO failures in this shape;
+ *  a core ToolError is assignable here since ErrorCode is a subset. */
+export type CliToolError = Omit<ToolError, 'code'> & {
+    code: ErrorCode | CliErrorCode;
+};
+/** CLI-local error class wrapping a (core or CLI) ToolError so the router can
+ *  map it to a non-zero exit. The error is preserved verbatim for --json. */
+export declare class CliError extends Error {
+    readonly toolError: CliToolError;
+    constructor(err: CliToolError);
+}
+/** Pretty-print a CliError to stderr and exit non-zero. Used by the router
+ *  when the catch fires. */
+export declare function emitCliError(e: unknown, flags: CliFlags): never;

package/dist-cjs/src/output.js

@@ -0,0 +1,166 @@
+"use strict";
+// apps/policy-builder-cli/src/output.ts
+//
+// Output helpers for the CLI: formatToolResponse for the `--json` flag and
+// file I/O for `--out`. The CLI is intentionally tiny - no commander / yargs
+// dependency; the router is a hand-rolled argv parser.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliError = void 0;
+exports.parseFlags = parseFlags;
+exports.parsePairs = parsePairs;
+exports.readJsonFile = readJsonFile;
+exports.writeJsonFile = writeJsonFile;
+exports.formatToolResponse = formatToolResponse;
+exports.emitCliError = emitCliError;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** Parse the argv tail for the known flags. Unrecognised flags are ignored
+ *  (the caller enforces per-subcommand required flags separately). */
+function parseFlags(argv) {
+    let json = false;
+    let quiet = false;
+    let out = null;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--json')
+            json = true;
+        else if (a === '--quiet')
+            quiet = true;
+        else if (a === '--out' && argv[i + 1]) {
+            out = argv[i + 1];
+            i++;
+        }
+        else if (a?.startsWith('--out=')) {
+            out = a.slice('--out='.length);
+        }
+    }
+    return { json, quiet, out };
+}
+/** Resolve `--value <v>` style pairs after the subcommand name. Returns
+ *  an object keyed by the option name (without `--`). Throws on missing
+ *  value or duplicate keys.
+ *
+ *  Note: an empty value (`--smart-account ""`) IS captured as an empty
+ *  string so the caller can distinguish "flag omitted" from "flag passed
+ *  empty" - a foot-gun: silently dropping empty values caused callers to
+ *  believe the interpreter adapter was engaged when it was not. The next
+ *  token is treated as a value iff it is present and does not start with
+ *  `--`; tokens starting with `--` are never consumed as values. */
+function parsePairs(argv) {
+    const out = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a?.startsWith('--') && a.includes('=')) {
+            const eq = a.indexOf('=');
+            const key = a.slice(2, eq);
+            const val = a.slice(eq + 1);
+            if (key && val !== undefined)
+                out[key] = val;
+        }
+        else if (a?.startsWith('--')) {
+            const key = a.slice(2);
+            if (!key)
+                continue;
+            const next = argv[i + 1];
+            // Only consume the next token if it is present AND does not look like
+            // another flag. Empty strings DO count as values so callers can
+            // distinguish "omitted" from "passed empty".
+            if (next !== undefined && !next.startsWith('--')) {
+                out[key] = next;
+                i++;
+            }
+            else {
+                // Standalone flag (no value) - record as empty string so `!== undefined`
+                // checks upstream can detect presence.
+                out[key] = '';
+            }
+        }
+    }
+    return out;
+}
+/** Read a JSON file, parse it, and return the value. Throws with a CLI-
+ *  friendly error if the file is missing or malformed. */
+function readJsonFile(path) {
+    const abs = (0, node_path_1.resolve)(path);
+    if (!(0, node_fs_1.existsSync)(abs)) {
+        throw new CliError({
+            code: 'CLI_FILE_NOT_FOUND',
+            message: `file not found: ${path}`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+    const raw = (0, node_fs_1.readFileSync)(abs, 'utf8');
+    try {
+        return JSON.parse(raw);
+    }
+    catch (e) {
+        throw new CliError({
+            code: 'CLI_INVALID_JSON',
+            message: `invalid JSON in ${path}: ${e.message}`,
+            severity: 'error',
+            retryable: false,
+        });
+    }
+}
+/** Write a JSON-serialisable value to disk. Pretty-prints by default so the
+ *  artefact is human-readable; CI scripts that need compact JSON can pipe
+ *  through `jq` instead. */
+function writeJsonFile(path, value) {
+    const abs = (0, node_path_1.resolve)(path);
+    (0, node_fs_1.writeFileSync)(abs, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+}
+/** Wraps a core ToolResponse for the CLI:
+ *    - always prints something useful (JSON or a short summary)
+ *    - exits non-zero on ToolError so CI scripts can gate on `$?`
+ *    - writes the `{ ok, data }` envelope to --out when present (matches
+ *      the --json stdout shape so CI scripts get a single canonical payload)
+ *
+ *  Throws CliError so the router can map it to a process exit code + a
+ *  structured JSON envelope under --json. */
+function formatToolResponse(res, flags, outLabel = 'result') {
+    if (res.ok) {
+        const envelope = { ok: true, data: res.data };
+        if (flags.out)
+            writeJsonFile(flags.out, envelope);
+        if (flags.json) {
+            // newline-terminated JSON so it pipes cleanly
+            process.stdout.write(`${JSON.stringify(envelope)}\n`);
+        }
+        else if (!flags.quiet) {
+            process.stdout.write(`${outLabel}: ok\n`);
+        }
+        return res.data;
+    }
+    throw new CliError(res.error);
+}
+/** CLI-local error class wrapping a (core or CLI) ToolError so the router can
+ *  map it to a non-zero exit. The error is preserved verbatim for --json. */
+class CliError extends Error {
+    toolError;
+    constructor(err) {
+        super(err.message);
+        this.toolError = err;
+    }
+}
+exports.CliError = CliError;
+/** Pretty-print a CliError to stderr and exit non-zero. Used by the router
+ *  when the catch fires. */
+function emitCliError(e, flags) {
+    if (e instanceof CliError) {
+        if (flags.json) {
+            process.stdout.write(`${JSON.stringify({ ok: false, error: e.toolError })}\n`);
+        }
+        else {
+            process.stderr.write(`error: ${e.toolError.code} - ${e.toolError.message}\n`);
+        }
+        process.exit(1);
+    }
+    if (flags.json) {
+        process.stdout.write(`${JSON.stringify({ ok: false, error: { code: 'CLI_INTERNAL', message: e.message, severity: 'fatal', retryable: false } })}\n`);
+    }
+    else {
+        process.stderr.write(`internal error: ${e.message}\n`);
+    }
+    process.exit(2);
+}

package/package.json

@@ -1,16 +1,43 @@
 {
   "name": "@crediolabs/policy-builder-cli",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "license": "MIT",
   "description": "CLI wrapper around the OZ policy-synth core (record + synthesize) for solo-dev and CI workflows.",
   "type": "module",
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
+  "engines": {
+    "node": ">=22.12",
+    "bun": ">=1.3.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/untangledfinance/oz-policy-builder.git",
+    "directory": "apps/policy-builder-cli"
+  },
+  "homepage": "https://github.com/untangledfinance/oz-policy-builder#readme",
+  "bugs": {
+    "url": "https://github.com/untangledfinance/oz-policy-builder/issues"
+  },
+  "keywords": [
+    "stellar",
+    "soroban",
+    "openzeppelin",
+    "policy",
+    "smart-account",
+    "authorization"
+  ],
+  "sideEffects": false,
+  "author": {
+    "name": "Untangled Finance Limited",
+    "url": "https://untangled.finance"
+  },
   "exports": {
     ".": {
       "types": "./dist/src/index.d.ts",
       "bun": "./src/index.ts",
       "import": "./dist/src/index.js",
+      "require": "./dist-cjs/src/index.js",
       "default": "./dist/src/index.js"
     },
     "./package.json": "./package.json"
@@ -20,6 +47,7 @@
   },
   "files": [
     "dist",
+    "dist-cjs",
     "src",
     "!src/**/*.test.ts"
   ],
@@ -28,15 +56,19 @@
   },
   "scripts": {
     "test": "bun test",
-    "build": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
+    "build:esm": "tsc -p tsconfig.build.json",
+    "build:cjs": "tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
+    "prepublishOnly": "bun run build && bun test",
+    "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-builder-mcp": "^0.1.6",
-    "@crediolabs/policy-synth": "^0.1.4",
+    "@crediolabs/policy-synth": "0.1.6",
     "zod": "3.25.76"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.5",
+    "@types/bun": "^1.3.0",
     "@types/node": "^26.1.1",
     "typescript": "5.9.3"
   }

package/src/commands/record.ts

@@ -4,8 +4,8 @@
 // `recordTransaction` - no business logic, just argv -> RecordInput + the
 // canonical CLI envelope.
 
-import { runRecordTransaction } from '@crediolabs/policy-builder-mcp'
 import type { RecordedTransaction } from '@crediolabs/policy-synth'
+import { runRecordTransaction } from '@crediolabs/policy-synth/run'
 import { CliError, type CliFlags, formatToolResponse, parsePairs } from '../output.ts'
 
 export async function runRecordCommand(