@crediolabs/policy-synth 0.1.12 → 0.1.13

package/dist-cjs/run/schemas.js

@@ -16,7 +16,7 @@
 // imports them here so its tool-shape bindings stay in step; the CLI imports
 // them here so it can build the same args envelope the MCP transport builds.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolErrorSchema = exports.SynthesizePolicyInputSchema = exports.SynthesizePolicyRecordingInputSchema = exports.InterpreterOptionsSchema = exports.SynthesizePolicyMandateInputSchema = exports.RecordTransactionInputSchema = exports.OzAdapterConfigSchema = exports.ComposeUserResponsesSchema = exports.MandateSpecSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
+exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.InstallPolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.DEFAULT_AUTH_VALID_UNTIL_LEDGERS = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.OraclePriceFixtureSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.SynthesizePolicyRecordingInputSchema = exports.InterpreterOptionsSchema = exports.SynthesizePolicyMandateInputSchema = exports.RecordTransactionInputSchema = exports.OzAdapterConfigSchema = exports.ComposeUserResponsesSchema = exports.MandateSpecSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
 const zod_1 = require("zod");
 const address_ts_1 = require("../synth/address.js");
 /** Soroban `valid_until` is a u32 ledger sequence; a value above this cannot be
@@ -222,6 +222,294 @@ exports.SynthesizePolicyInputSchema = zod_1.z.discriminatedUnion('source', [
     exports.SynthesizePolicyMandateInputSchema,
     exports.SynthesizePolicyRecordingInputSchema,
 ]);
+// ===== PredicateNode / PredicateLeaf =====
+//
+// Hand-written zod mirrors of the predicate grammar in types.ts:132-180.
+// Recursive (`and`/`or`/`not` nest), so the schemas use the same
+// `z.lazy` + explicit `z.ZodType<unknown>` annotation that ScValSchema
+// already uses - without the annotation TS's circular type inference
+// breaks the recursive reference. i128-shaped numerics (`num`, `den`)
+// are decimal STRINGS, never JS numbers, matching the on-chain i128
+// convention used everywhere else in this file. The grammar is the
+// single source of truth (types.ts); a drift test in this package
+// asserts the two stay in step.
+/** PredicateLeaf mirrors the core `PredicateLeaf` union. Every variant
+ *  is a `kind` discriminator; literals carry their primitive value inline.
+ *  `literal_vec.elements` is recursive (a vec may contain literals that
+ *  themselves nest) so the leaf schema is lazily self-referential. */
+exports.PredicateLeafSchema = zod_1.z.lazy(() => zod_1.z.union([
+    zod_1.z.object({ kind: zod_1.z.literal('call_contract') }),
+    zod_1.z.object({ kind: zod_1.z.literal('call_fn') }),
+    zod_1.z.object({ kind: zod_1.z.literal('call_arg'), index: zod_1.z.number().int().nonnegative() }),
+    zod_1.z.object({ kind: zod_1.z.literal('call_arg_len'), index: zod_1.z.number().int().nonnegative() }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('call_arg_field'),
+        index: zod_1.z.number().int().nonnegative(),
+        element: zod_1.z.number().int().nonnegative(),
+        field: zod_1.z.string(),
+    }),
+    // num/den are i128 on chain; JSON numbers lose precision past 2^53,
+    // so the wire is a decimal string. The contract refuses `den == 0` and
+    // `num <= 0` / `den <= 0` at install (types.ts:162-163 + the install
+    // gate); mirroring that bound here closes the gap where simulate /
+    // verify green-light a policy the install gate will reject. The
+    // positive-only regex is the cheapest unambiguous check.
+    zod_1.z.object({
+        kind: zod_1.z.literal('call_arg_scaled'),
+        index: zod_1.z.number().int().nonnegative(),
+        num: zod_1.z.string().regex(/^[1-9][0-9]*$/),
+        den: zod_1.z.string().regex(/^[1-9][0-9]*$/),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('amount'), token: zod_1.z.string() }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('window_spent'),
+        token: zod_1.z.string(),
+        windowSeconds: zod_1.z.number().int().positive(),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('now') }),
+    zod_1.z.object({ kind: zod_1.z.literal('valid_until') }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('invocation_count_in_window'),
+        windowSecs: zod_1.z.number().int().positive(),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('oracle_price'), asset: zod_1.z.string() }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('oracle_threshold'),
+        value: zod_1.z.string().regex(/^-?[0-9]+$/),
+        decimals: zod_1.z.number().int().nonnegative(),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_address'), value: zod_1.z.string() }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_i128'), value: zod_1.z.string().regex(/^-?[0-9]+$/) }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_symbol'), value: zod_1.z.string() }),
+    // `literal_u32` is u32 on chain. A negative value would wrap, and a
+    // value above U32_MAX would be refused at the encode boundary
+    // anyway. Bound at the schema so the wire cannot carry a value the
+    // contract will reject.
+    zod_1.z.object({
+        kind: zod_1.z.literal('literal_u32'),
+        value: zod_1.z.number().int().nonnegative().max(U32_MAX),
+    }),
+    zod_1.z.object({ kind: zod_1.z.literal('literal_u64'), value: zod_1.z.string().regex(/^[0-9]+$/) }),
+    // `literal_bytes` is hex on chain. `Buffer.from(value, 'hex')` silently
+    // drops non-hex chars AND yields an empty buffer when the whole input
+    // is non-hex - so a user passing 'zzzz' would get a predicate that
+    // compares against empty bytes instead of being rejected. The
+    // strict even-length hex regex closes that gap at the boundary.
+    zod_1.z.object({
+        kind: zod_1.z.literal('literal_bytes'),
+        value: zod_1.z
+            .string()
+            .regex(/^[0-9a-fA-F]*$/)
+            .refine((v) => v.length % 2 === 0, 'must be even-length hex'),
+    }),
+    // elements are themselves PredicateLeaf; lazy to break the cycle.
+    zod_1.z.object({ kind: zod_1.z.literal('literal_vec'), elements: zod_1.z.array(exports.PredicateLeafSchema) }),
+]));
+/** PredicateNode mirrors the core `PredicateNode` union. Recursive through
+ *  `and`/`or`/`not`; the lazy + annotation pattern keeps the recursion
+ *  type-safe. */
+exports.PredicateNodeSchema = zod_1.z.lazy(() => zod_1.z.union([
+    zod_1.z.object({ op: zod_1.z.literal('and'), children: zod_1.z.array(exports.PredicateNodeSchema) }),
+    zod_1.z.object({ op: zod_1.z.literal('or'), children: zod_1.z.array(exports.PredicateNodeSchema) }),
+    zod_1.z.object({ op: zod_1.z.literal('not'), child: exports.PredicateNodeSchema }),
+    zod_1.z.object({
+        op: zod_1.z.literal('eq'),
+        left: exports.PredicateLeafSchema,
+        right: exports.PredicateLeafSchema,
+    }),
+    zod_1.z.object({
+        op: zod_1.z.enum(['lt', 'lte', 'gt', 'gte']),
+        left: exports.PredicateLeafSchema,
+        right: exports.PredicateLeafSchema,
+    }),
+    zod_1.z.object({
+        op: zod_1.z.literal('in'),
+        needle: exports.PredicateLeafSchema,
+        haystack: zod_1.z.array(exports.PredicateLeafSchema),
+    }),
+]));
+// ===== simulate_policy / verify_policy =====
+//
+// The oracle fixture shape mirrors `SimulateOptions` / `VerifyOptions`
+// in packages/policy-synth/src/verify/{simulate,verify}.ts - the same
+// sorted set of error enum values is used by both engines. u32
+// `validUntilLedger` is bounded at the boundary so a hand-crafted
+// payload cannot leak a u32 overflow into the engine's permit context.
+/** Oracle price fixture - mirror of the entry type in `SimulateOptions` /
+ *  `VerifyOptions`. Discriminated by presence of `error` vs `price`. */
+exports.OraclePriceFixtureSchema = zod_1.z.union([
+    zod_1.z.object({
+        price: zod_1.z.string().regex(/^[0-9]+$/),
+        timestampSeconds: zod_1.z.number().int().nonnegative(),
+    }),
+    zod_1.z.object({
+        error: zod_1.z.enum(['stale', 'missing', 'deviation', 'paused', 'decimals', 'fingerprint']),
+    }),
+]);
+exports.SimulatePolicyInputSchema = zod_1.z.object({
+    // simulatePolicy accepts a null predicate (OZ-only policy); verifyPolicy
+    // does not. The asymmetry is mirrored at the schema boundary.
+    predicate: exports.PredicateNodeSchema.nullable(),
+    permitTx: exports.RecordedTransactionSchema,
+    validUntilLedger: zod_1.z.number().int().positive().max(U32_MAX).optional(),
+    oraclePricesByAsset: zod_1.z.record(zod_1.z.string(), exports.OraclePriceFixtureSchema).optional(),
+});
+exports.VerifyPolicyInputSchema = zod_1.z.object({
+    // verifyPolicy requires a non-null predicate; the engine refuses
+    // `null` outright. The schema mirrors that contract.
+    predicate: exports.PredicateNodeSchema,
+    permitTx: exports.RecordedTransactionSchema,
+    validUntilLedger: zod_1.z.number().int().positive().max(U32_MAX).optional(),
+    oraclePricesByAsset: zod_1.z.record(zod_1.z.string(), exports.OraclePriceFixtureSchema).optional(),
+});
+// ===== install_policy / revoke_policy / get_interpreter_info =====
+//
+// The install/revoke pair drives the OZ smart-account admin flow. Both surface
+// unsigned Soroban transaction XDRs (base64) and the tool body NEVER signs:
+// the wallet signature IS the user-confirmation step. See `run/index.ts` for
+// the rationale (no `action_id` two-call pair; the MCP server is stateless).
+//
+// `get_interpreter_info` is a read-only fingerprint lookup. It returns the
+// pinned address + grammar version + wasm hash AND, when requested, runs an
+// optional `grammar_version()` RPC call to check whether the deployed contract
+// matches the pin. A mismatch is worth MORE than a fabricated audit field.
+//
+// All three input schemas live BELOW the MandateSpecSchemaForRule declaration
+// so the const reference there is not in the temporal dead zone (no JS hoisting
+// for `const`).
+/** Minimal rule-draft schema for the install input. Mirrors ContextRuleDraft
+ *  from the core (`types.ts`); we keep this hand-rolled + flat rather than
+ *  importing the recursive discriminated union because the wire shape is
+ *  fixed (the user supplies one rule, not a nested AST). Declared BEFORE
+ *  InstallPolicyInputSchema below so the const reference there is not in
+ *  the temporal dead zone (no JS hoisting for `const`). */
+const MAX_SIGNERS_PER_RULE = 15;
+const MAX_POLICIES_PER_RULE = 5;
+const MandateSpecSchemaForRule = zod_1.z
+    .object({
+    contextRuleType: zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({ kind: zod_1.z.literal('default') }),
+        zod_1.z.object({ kind: zod_1.z.literal('call_contract'), contract: zod_1.z.string() }),
+        zod_1.z.object({ kind: zod_1.z.literal('create_contract'), wasmHash: zod_1.z.string() }),
+    ]),
+    name: zod_1.z.string().min(1),
+    validUntilLedger: zod_1.z.number().int().positive().max(U32_MAX).nullable(),
+    signers: zod_1.z
+        .array(zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({ kind: zod_1.z.literal('delegated'), address: zod_1.z.string() }),
+        zod_1.z.object({
+            kind: zod_1.z.literal('external'),
+            verifier: zod_1.z.string(),
+            keyBytes: zod_1.z.string(),
+        }),
+    ]))
+        .max(MAX_SIGNERS_PER_RULE),
+    policies: zod_1.z
+        .array(zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({
+            kind: zod_1.z.literal('interpreter'),
+            interpreterAddress: zod_1.z.string(),
+            predicateBlobBase64: zod_1.z.string().min(1),
+        }),
+        zod_1.z.object({
+            kind: zod_1.z.literal('oz_builtin'),
+            primitive: zod_1.z.object({
+                primitive: zod_1.z.enum(['spending_limit', 'simple_threshold', 'weighted_threshold']),
+                params: zod_1.z.record(zod_1.z.unknown()),
+            }),
+            instanceAddress: zod_1.z.string(),
+        }),
+    ]))
+        .max(MAX_POLICIES_PER_RULE),
+})
+    .passthrough()
+    .refine((v) => !(v.signers.length === 0 && v.policies.length === 0), 'a rule with no signers and no policies is refused at install (NoSignersAndPolicies)');
+// install/revoke/get_info schemas live HERE (after the helper) so the const
+// reference resolves at module init. They are the new tools on top of the
+// existing four.
+/** Pinned interpreter address (testnet). Mirrors DEPLOYMENTS.md:156-157.
+ *  Single source for the MCP layer; do not embed elsewhere. */
+exports.PINNED_INTERPRETER_TESTNET_ADDRESS = 'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP';
+/** Pinned interpreter wasm sha256 (hex). Mirrors DEPLOYMENTS.md:156-157. */
+exports.PINNED_INTERPRETER_WASM_SHA256 = '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443';
+/** The grammar version the interpreter enforces (matches SELF_VERSION in
+ *  packages/policy-interpreter/src/version.rs). */
+exports.PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
+/** Default Soroban RPC for the install / revoke / info tools. The recorder
+ *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
+ *  than a Server; the two are deliberately different surfaces, so this is
+ *  pinned beside the addresses it is used with rather than shared. */
+exports.TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org';
+/** Soroban `valid_until` window (ledgers) added to the latest ledger when
+ *  building the auth entry. ~25 minutes at 5s/ledger. */
+exports.DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300;
+/** Stellar network passphrases. Pinned here so the XDR envelope uses the
+ *  matching passphrase when the wallet signs (a mismatch yields invalid
+ *  hashes). */
+exports.NETWORK_PASSPHRASES = {
+    testnet: 'Test SDF Network ; September 2015',
+    mainnet: 'Public Global Stellar Network ; September 2015',
+};
+exports.InstallPolicyInputSchema = zod_1.z
+    .object({
+    /** The smart account contract address (C...) that will receive the rule. */
+    smartAccount: zod_1.z.string(),
+    /** The signer that authorises the install (G... wallet). Used only for
+     *  sequence number + auth nonce simulation; never persisted, never signed. */
+    sourceAccount: zod_1.z.string(),
+    /** The proposed rule draft. Mirrors the core `ContextRuleDraft` shape. */
+    rule: MandateSpecSchemaForRule,
+    /** Per-rule install nonce; 1 for a fresh install. */
+    installNonce: zod_1.z.number().int().positive(),
+    /** Optional RPC URL override. Defaults to the public testnet endpoint
+     *  (`TESTNET_RPC_URL`); the override is refused unless
+     *  `allowUnpinnedRpcUrl: true`, because the auth nonce and
+     *  rootInvocation in the response come from whichever RPC answered. */
+    rpcUrl: zod_1.z.string().url().optional(),
+    /** Opt-in to using a non-pinned RPC URL. Without this flag the tool
+     *  refuses any `rpcUrl` other than `TESTNET_RPC_URL` because the
+     *  caller's auth-digest binds to whatever the RPC returned. */
+    allowUnpinnedRpcUrl: zod_1.z.boolean().optional(),
+    /** Opt-in to pointing the rule's interpreter policy at any address
+     *  other than the pinned testnet interpreter. Default-deny: a caller
+     *  that controls the interpreter can permit everything. */
+    allowUnpinnedInterpreter: zod_1.z.boolean().optional(),
+    /** Base fee in stroops; defaults to BASE_FEE (100). */
+    baseFee: zod_1.z.number().int().positive().optional(),
+})
+    .refine((v) => Boolean(v.smartAccount) && Boolean(v.sourceAccount), {
+    message: 'smartAccount and sourceAccount are required',
+});
+exports.RevokePolicyInputSchema = zod_1.z
+    .object({
+    /** The smart account contract address (C...). */
+    smartAccount: zod_1.z.string(),
+    /** The wallet that will sign the removal. The ACCOUNT decides whether it
+     *  accepts that signer; this schema does not assert a rule it cannot
+     *  verify, since the account's source is not in this repo. Proven on
+     *  testnet: the account's deployer can revoke. */
+    sourceAccount: zod_1.z.string(),
+    /** The rule id to remove from the smart account + interpreter. */
+    ruleId: zod_1.z.number().int().nonnegative(),
+    /** Optional RPC URL override; same pin as install. */
+    rpcUrl: zod_1.z.string().url().optional(),
+    /** Opt-in to using a non-pinned RPC URL. Same semantics as install. */
+    allowUnpinnedRpcUrl: zod_1.z.boolean().optional(),
+    /** Base fee in stroops; defaults to BASE_FEE (100). */
+    baseFee: zod_1.z.number().int().positive().optional(),
+})
+    .refine((v) => Boolean(v.smartAccount) && Boolean(v.sourceAccount), {
+    message: 'smartAccount and sourceAccount are required',
+});
+exports.GetInterpreterInfoInputSchema = zod_1.z.object({
+    /** Network to query. The pin differs per network; defaults to testnet. */
+    network: exports.NetworkSchema.optional(),
+    /** When true, perform an optional live `grammar_version()` RPC call to
+     *  verify the deployed contract matches the pin. */
+    verifyLive: zod_1.z.boolean().optional(),
+    /** Optional RPC URL override. */
+    rpcUrl: zod_1.z.string().url().optional(),
+});
 // ===== Error envelope (canonical) =====
 //
 // Mirrors ToolError from packages/policy-synth/src/errors.ts. We use a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",