@crediolabs/policy-builder-mcp 0.3.1 → 0.4.0

package/dist/src/schemas.d.ts

@@ -834,6 +834,21 @@ export declare const VerifyPolicyToolShape: {
     readonly validUntilLedger: z.ZodOptional<z.ZodNumber>;
 };
 export type { GetInterpreterInfoInput, InstallPolicyInput, RevokePolicyInput, SimulatePolicyInput, VerifyPolicyInput, } from '@crediolabs/policy-synth/run';
+/** Flat ZodRawShape for `declare_policy`. The DECLARATIVE front-end: the
+ *  constraint stated outright, with no transaction to decode. Every field is
+ *  optional except `fn`; the body re-validates against the strict
+ *  `DeclarePolicyInputSchema`, which is `.strict()` and so refuses the removed
+ *  MandateSpec fields (`spendingLimit`, `approvalThreshold`) rather than
+ *  accepting them in silence. */
+export declare const DeclarePolicyToolShape: {
+    readonly fn: z.ZodString;
+    readonly contract: z.ZodOptional<z.ZodString>;
+    readonly maxAmount: z.ZodOptional<z.ZodString>;
+    readonly amountArgIndex: z.ZodOptional<z.ZodNumber>;
+    readonly recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    readonly recipientArgIndex: z.ZodOptional<z.ZodNumber>;
+    readonly allowZeroCap: z.ZodOptional<z.ZodBoolean>;
+};
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union
  *  the SDK does not accept at registration; the body re-validates
@@ -842,6 +857,10 @@ export type { GetInterpreterInfoInput, InstallPolicyInput, RevokePolicyInput, Si
  *  (the policy already carries the encoded predicate); the run-layer
  *  extracts them from there. */
 export declare const InstallPolicyToolShape: {
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan; omitting them returns `authorityScan: null`, which means
+     *  "not checked" rather than "nothing found". */
+    readonly existingRules: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
     readonly rule: z.ZodOptional<z.ZodUnknown>;
     readonly installNonce: z.ZodOptional<z.ZodNumber>;
     readonly interpreterAddress: z.ZodOptional<z.ZodString>;

package/dist/src/schemas.js

@@ -84,6 +84,21 @@ const SmartAccountToolShape = {
     rpcUrl: z.string().url().optional(),
     baseFee: z.number().int().positive().optional(),
 };
+/** Flat ZodRawShape for `declare_policy`. The DECLARATIVE front-end: the
+ *  constraint stated outright, with no transaction to decode. Every field is
+ *  optional except `fn`; the body re-validates against the strict
+ *  `DeclarePolicyInputSchema`, which is `.strict()` and so refuses the removed
+ *  MandateSpec fields (`spendingLimit`, `approvalThreshold`) rather than
+ *  accepting them in silence. */
+export const DeclarePolicyToolShape = {
+    fn: z.string().min(1),
+    contract: z.string().optional(),
+    maxAmount: z.string().optional(),
+    amountArgIndex: z.number().int().nonnegative().optional(),
+    recipients: z.array(z.string()).optional(),
+    recipientArgIndex: z.number().int().nonnegative().optional(),
+    allowZeroCap: z.boolean().optional(),
+};
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union
  *  the SDK does not accept at registration; the body re-validates
@@ -93,6 +108,10 @@ const SmartAccountToolShape = {
  *  extracts them from there. */
 export const InstallPolicyToolShape = {
     ...SmartAccountToolShape,
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan; omitting them returns `authorityScan: null`, which means
+     *  "not checked" rather than "nothing found". */
+    existingRules: z.array(z.unknown()).optional(),
     rule: z.unknown().optional(),
     installNonce: z.number().int().positive().optional(),
     interpreterAddress: z.string().optional(),

package/dist/src/server.js

@@ -10,9 +10,9 @@
 // Stateless: a fresh McpServer is constructed per transport (stdio/HTTP). No
 // shared mutable state across calls; nothing here caches, queues, or holds
 // key material.
-import { runGetInterpreterInfo, runInstallPolicy, runRecordTransaction, runRevokePolicy, runSimulatePolicy, runSynthesizePolicy, runVerifyPolicy, } from '@crediolabs/policy-synth/run';
+import { runDeclarePolicy, runGetInterpreterInfo, runInstallPolicy, runRecordTransaction, runRevokePolicy, runSimulatePolicy, runSynthesizePolicy, runVerifyPolicy, } from '@crediolabs/policy-synth/run';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { GetInterpreterInfoToolShape, InstallPolicyToolShape, RecordTransactionToolShape, RevokePolicyToolShape, SimulatePolicyToolShape, SynthesizePolicyToolShape, VerifyPolicyToolShape, } from "./schemas.js";
+import { DeclarePolicyToolShape, GetInterpreterInfoToolShape, InstallPolicyToolShape, RecordTransactionToolShape, RevokePolicyToolShape, SimulatePolicyToolShape, SynthesizePolicyToolShape, VerifyPolicyToolShape, } from "./schemas.js";
 import { mcpResultFromCore } from "./tools/result.js";
 /** Our envelope types `structuredContent` precisely (T / ToolError); the SDK's
  *  CallToolResult widens it to Record<string, unknown>, so the nominal types
@@ -32,7 +32,8 @@ export function registerTools(server) {
     server.tool('synthesize_policy', 'Synthesize a ProposedPolicy from a RecordedTransaction (`source: recording`).', SynthesizePolicyToolShape, (args) => runSynthesizePolicy(args).then(toCallToolResult));
     server.tool('simulate_policy', 'Evaluate a predicate against one recorded call and report permit/deny with the deny reason. The evaluator is a second implementation of the on-chain semantics, cross-checked against the Rust interpreter by the conformance harness, so a verdict here is a claim about what the contract would do. Pass the `predicate` returned by `synthesize_policy` under `explain`.', SimulatePolicyToolShape, (args) => toCallToolResult(runSimulatePolicy(args)));
     server.tool('verify_policy', 'Check a predicate against the transaction it was synthesised from, plus a generated deny case per dimension. Reports `ok` only when the permit case is permitted AND every deny case is denied - a denied permit case means the policy is too strict, a permitted deny case means it is too loose.', VerifyPolicyToolShape, (args) => toCallToolResult(runVerifyPolicy(args)));
-    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', InstallPolicyToolShape, (args) => runInstallPolicy(args).then(toCallToolResult));
+    server.tool('declare_policy', 'Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap and a recipient allowlist. Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 3.', DeclarePolicyToolShape, (args) => Promise.resolve(runDeclarePolicy(args)).then(toCallToolResult));
+    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. Pass `existingRules` to get an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. Omitting them returns `authorityScan: null`, meaning NOT CHECKED. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', InstallPolicyToolShape, (args) => runInstallPolicy(args).then(toCallToolResult));
     server.tool('revoke_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.remove_context_rule(ruleId)` that removes a policy rule from the given smart account. The smart account handles uninstalling each attached policy itself. Auth is master-only - the source account MUST be the master signer set; delegated signers cannot uninstall.', RevokePolicyToolShape, (args) => runRevokePolicy(args).then(toCallToolResult));
     server.tool('get_interpreter_info', 'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.', GetInterpreterInfoToolShape, (args) => runGetInterpreterInfo(args).then(toCallToolResult));
 }

package/dist-cjs/src/schemas.d.ts

@@ -834,6 +834,21 @@ export declare const VerifyPolicyToolShape: {
     readonly validUntilLedger: z.ZodOptional<z.ZodNumber>;
 };
 export type { GetInterpreterInfoInput, InstallPolicyInput, RevokePolicyInput, SimulatePolicyInput, VerifyPolicyInput, } from '@crediolabs/policy-synth/run';
+/** Flat ZodRawShape for `declare_policy`. The DECLARATIVE front-end: the
+ *  constraint stated outright, with no transaction to decode. Every field is
+ *  optional except `fn`; the body re-validates against the strict
+ *  `DeclarePolicyInputSchema`, which is `.strict()` and so refuses the removed
+ *  MandateSpec fields (`spendingLimit`, `approvalThreshold`) rather than
+ *  accepting them in silence. */
+export declare const DeclarePolicyToolShape: {
+    readonly fn: z.ZodString;
+    readonly contract: z.ZodOptional<z.ZodString>;
+    readonly maxAmount: z.ZodOptional<z.ZodString>;
+    readonly amountArgIndex: z.ZodOptional<z.ZodNumber>;
+    readonly recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    readonly recipientArgIndex: z.ZodOptional<z.ZodNumber>;
+    readonly allowZeroCap: z.ZodOptional<z.ZodBoolean>;
+};
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union
  *  the SDK does not accept at registration; the body re-validates
@@ -842,6 +857,10 @@ export type { GetInterpreterInfoInput, InstallPolicyInput, RevokePolicyInput, Si
  *  (the policy already carries the encoded predicate); the run-layer
  *  extracts them from there. */
 export declare const InstallPolicyToolShape: {
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan; omitting them returns `authorityScan: null`, which means
+     *  "not checked" rather than "nothing found". */
+    readonly existingRules: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
     readonly rule: z.ZodOptional<z.ZodUnknown>;
     readonly installNonce: z.ZodOptional<z.ZodNumber>;
     readonly interpreterAddress: z.ZodOptional<z.ZodString>;

package/dist-cjs/src/schemas.js

@@ -22,7 +22,7 @@
 // the strict schemas - a drift in field type or optionality breaks the
 // SDK's emitted JSON Schema.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GetInterpreterInfoToolShape = exports.RevokePolicyToolShape = exports.InstallPolicyToolShape = exports.VerifyPolicyToolShape = exports.SimulatePolicyToolShape = exports.SynthesizePolicyToolShape = exports.RecordTransactionToolShape = exports.ToolErrorSchema = exports.SynthesizePolicyInputSchema = exports.RevokePolicyInputSchema = exports.RecordTransactionInputSchema = exports.RecordedTransactionSchema = exports.PredicateNodeSchema = exports.NetworkSchema = exports.InterpreterOptionsSchema = exports.InstallPolicyInputSchema = exports.GetInterpreterInfoInputSchema = exports.ComposeUserResponsesSchema = void 0;
+exports.GetInterpreterInfoToolShape = exports.RevokePolicyToolShape = exports.InstallPolicyToolShape = exports.DeclarePolicyToolShape = exports.VerifyPolicyToolShape = exports.SimulatePolicyToolShape = exports.SynthesizePolicyToolShape = exports.RecordTransactionToolShape = exports.ToolErrorSchema = exports.SynthesizePolicyInputSchema = exports.RevokePolicyInputSchema = exports.RecordTransactionInputSchema = exports.RecordedTransactionSchema = exports.PredicateNodeSchema = exports.NetworkSchema = exports.InterpreterOptionsSchema = exports.InstallPolicyInputSchema = exports.GetInterpreterInfoInputSchema = exports.ComposeUserResponsesSchema = void 0;
 const run_1 = require("@crediolabs/policy-synth/run");
 Object.defineProperty(exports, "ComposeUserResponsesSchema", { enumerable: true, get: function () { return run_1.ComposeUserResponsesSchema; } });
 Object.defineProperty(exports, "GetInterpreterInfoInputSchema", { enumerable: true, get: function () { return run_1.GetInterpreterInfoInputSchema; } });
@@ -92,6 +92,21 @@ const SmartAccountToolShape = {
     rpcUrl: zod_1.z.string().url().optional(),
     baseFee: zod_1.z.number().int().positive().optional(),
 };
+/** Flat ZodRawShape for `declare_policy`. The DECLARATIVE front-end: the
+ *  constraint stated outright, with no transaction to decode. Every field is
+ *  optional except `fn`; the body re-validates against the strict
+ *  `DeclarePolicyInputSchema`, which is `.strict()` and so refuses the removed
+ *  MandateSpec fields (`spendingLimit`, `approvalThreshold`) rather than
+ *  accepting them in silence. */
+exports.DeclarePolicyToolShape = {
+    fn: zod_1.z.string().min(1),
+    contract: zod_1.z.string().optional(),
+    maxAmount: zod_1.z.string().optional(),
+    amountArgIndex: zod_1.z.number().int().nonnegative().optional(),
+    recipients: zod_1.z.array(zod_1.z.string()).optional(),
+    recipientArgIndex: zod_1.z.number().int().nonnegative().optional(),
+    allowZeroCap: zod_1.z.boolean().optional(),
+};
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union
  *  the SDK does not accept at registration; the body re-validates
@@ -101,6 +116,10 @@ const SmartAccountToolShape = {
  *  extracts them from there. */
 exports.InstallPolicyToolShape = {
     ...SmartAccountToolShape,
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan; omitting them returns `authorityScan: null`, which means
+     *  "not checked" rather than "nothing found". */
+    existingRules: zod_1.z.array(zod_1.z.unknown()).optional(),
     rule: zod_1.z.unknown().optional(),
     installNonce: zod_1.z.number().int().positive().optional(),
     interpreterAddress: zod_1.z.string().optional(),

package/dist-cjs/src/server.js

@@ -36,7 +36,8 @@ function registerTools(server) {
     server.tool('synthesize_policy', 'Synthesize a ProposedPolicy from a RecordedTransaction (`source: recording`).', schemas_ts_1.SynthesizePolicyToolShape, (args) => (0, run_1.runSynthesizePolicy)(args).then(toCallToolResult));
     server.tool('simulate_policy', 'Evaluate a predicate against one recorded call and report permit/deny with the deny reason. The evaluator is a second implementation of the on-chain semantics, cross-checked against the Rust interpreter by the conformance harness, so a verdict here is a claim about what the contract would do. Pass the `predicate` returned by `synthesize_policy` under `explain`.', schemas_ts_1.SimulatePolicyToolShape, (args) => toCallToolResult((0, run_1.runSimulatePolicy)(args)));
     server.tool('verify_policy', 'Check a predicate against the transaction it was synthesised from, plus a generated deny case per dimension. Reports `ok` only when the permit case is permitted AND every deny case is denied - a denied permit case means the policy is too strict, a permitted deny case means it is too loose.', schemas_ts_1.VerifyPolicyToolShape, (args) => toCallToolResult((0, run_1.runVerifyPolicy)(args)));
-    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', schemas_ts_1.InstallPolicyToolShape, (args) => (0, run_1.runInstallPolicy)(args).then(toCallToolResult));
+    server.tool('declare_policy', 'Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap and a recipient allowlist. Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 3.', schemas_ts_1.DeclarePolicyToolShape, (args) => Promise.resolve((0, run_1.runDeclarePolicy)(args)).then(toCallToolResult));
+    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. Pass `existingRules` to get an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. Omitting them returns `authorityScan: null`, meaning NOT CHECKED. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', schemas_ts_1.InstallPolicyToolShape, (args) => (0, run_1.runInstallPolicy)(args).then(toCallToolResult));
     server.tool('revoke_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.remove_context_rule(ruleId)` that removes a policy rule from the given smart account. The smart account handles uninstalling each attached policy itself. Auth is master-only - the source account MUST be the master signer set; delegated signers cannot uninstall.', schemas_ts_1.RevokePolicyToolShape, (args) => (0, run_1.runRevokePolicy)(args).then(toCallToolResult));
     server.tool('get_interpreter_info', 'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.', schemas_ts_1.GetInterpreterInfoToolShape, (args) => (0, run_1.runGetInterpreterInfo)(args).then(toCallToolResult));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-builder-mcp",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "MCP server exposing the OZ policy-synth core (record_transaction + synthesize_policy) over stdio and Streamable HTTP transports.",
   "type": "module",
@@ -63,7 +63,7 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-synth": "0.3.1",
+    "@crediolabs/policy-synth": "0.4.0",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@stellar/stellar-sdk": "14.4.0",
     "zod": "3.25.76"

package/src/schemas.ts

@@ -124,6 +124,22 @@ const SmartAccountToolShape = {
   baseFee: z.number().int().positive().optional(),
 }
 
+/** Flat ZodRawShape for `declare_policy`. The DECLARATIVE front-end: the
+ *  constraint stated outright, with no transaction to decode. Every field is
+ *  optional except `fn`; the body re-validates against the strict
+ *  `DeclarePolicyInputSchema`, which is `.strict()` and so refuses the removed
+ *  MandateSpec fields (`spendingLimit`, `approvalThreshold`) rather than
+ *  accepting them in silence. */
+export const DeclarePolicyToolShape = {
+  fn: z.string().min(1),
+  contract: z.string().optional(),
+  maxAmount: z.string().optional(),
+  amountArgIndex: z.number().int().nonnegative().optional(),
+  recipients: z.array(z.string()).optional(),
+  recipientArgIndex: z.number().int().nonnegative().optional(),
+  allowZeroCap: z.boolean().optional(),
+} as const
+
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union
  *  the SDK does not accept at registration; the body re-validates
@@ -133,6 +149,10 @@ const SmartAccountToolShape = {
  *  extracts them from there. */
 export const InstallPolicyToolShape = {
   ...SmartAccountToolShape,
+  /** Rules already on the account. Supplying them turns on the cross-rule
+   *  authority scan; omitting them returns `authorityScan: null`, which means
+   *  "not checked" rather than "nothing found". */
+  existingRules: z.array(z.unknown()).optional(),
   rule: z.unknown().optional(),
   installNonce: z.number().int().positive().optional(),
   interpreterAddress: z.string().optional(),

package/src/server.ts

@@ -13,6 +13,7 @@
 
 import type { ToolResponse } from '@crediolabs/policy-synth'
 import {
+  runDeclarePolicy,
   runGetInterpreterInfo,
   runInstallPolicy,
   runRecordTransaction,
@@ -24,6 +25,7 @@ import {
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js'
 import {
+  DeclarePolicyToolShape,
   GetInterpreterInfoToolShape,
   InstallPolicyToolShape,
   RecordTransactionToolShape,
@@ -83,9 +85,16 @@ export function registerTools(server: McpServer): void {
     (args) => toCallToolResult(runVerifyPolicy(args))
   )
 
+  server.tool(
+    'declare_policy',
+    'Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap and a recipient allowlist. Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 3.',
+    DeclarePolicyToolShape,
+    (args) => Promise.resolve(runDeclarePolicy(args)).then(toCallToolResult)
+  )
+
   server.tool(
     'install_policy',
-    'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.',
+    'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. Pass `existingRules` to get an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. Omitting them returns `authorityScan: null`, meaning NOT CHECKED. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.',
     InstallPolicyToolShape,
     (args) => runInstallPolicy(args).then(toCallToolResult)
   )