@crediolabs/policy-synth 0.1.12 → 0.1.14

package/dist-cjs/install/oz-auth.js

@@ -0,0 +1,114 @@
+"use strict";
+// Build the authorization entries OpenZeppelin's smart account requires.
+//
+// This is the piece that makes an end-to-end test of the account -> policy
+// path possible. Without it, every attempt to exercise `__check_auth`
+// produces a false positive: mocked auth skips `__check_auth` entirely,
+// direct invocation is rejected by the host, and recording-mode simulation
+// does not verify auth at all.
+//
+// Two entries are needed per call:
+//
+//   1. The ACCOUNT's entry. Its `signature` slot is not a signature - OZ puts
+//      an `AuthPayload { signers, context_rule_ids }` there, which
+//      `__check_auth` receives as its `signatures` argument.
+//
+//   2. One entry per DELEGATED signer. `do_check_auth` calls
+//      `addr.require_auth_for_args((auth_digest,))` for each, which is a
+//      nested authorization requirement the host will not record during
+//      simulation (it never runs `__check_auth` in recording mode), so it has
+//      to be constructed by hand.
+//
+// The digest OZ binds is NOT the raw auth payload hash:
+//
+//   auth_digest = sha256(signature_payload || xdr(context_rule_ids))
+//
+// where `signature_payload` is the standard Soroban authorization preimage
+// hash. See `do_check_auth` in
+// stellar-contracts/packages/accounts/src/smart_account/storage.rs.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegatedSigner = void 0;
+exports.signaturePayload = signaturePayload;
+exports.authDigest = authDigest;
+exports.authPayload = authPayload;
+exports.delegatedSignerEntry = delegatedSignerEntry;
+exports.accountEntry = accountEntry;
+const stellar_sdk_1 = require("@stellar/stellar-sdk");
+const sym = (s) => stellar_sdk_1.xdr.ScVal.scvSymbol(s);
+const u32 = (n) => stellar_sdk_1.xdr.ScVal.scvU32(n);
+const vec = (i) => stellar_sdk_1.xdr.ScVal.scvVec(i);
+const bytes = (b) => stellar_sdk_1.xdr.ScVal.scvBytes(b);
+function struct(fields) {
+    return stellar_sdk_1.xdr.ScVal.scvMap(Object.keys(fields)
+        .sort()
+        .map((k) => new stellar_sdk_1.xdr.ScMapEntry({ key: sym(k), val: fields[k] })));
+}
+/** `Signer::Delegated(addr)`. */
+const delegatedSigner = (a) => vec([sym('Delegated'), new stellar_sdk_1.Address(a).toScVal()]);
+exports.delegatedSigner = delegatedSigner;
+/** The standard Soroban authorization preimage hash for one entry. */
+function signaturePayload(networkPassphrase, nonce, signatureExpirationLedger, invocation) {
+    const preimage = stellar_sdk_1.xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(new stellar_sdk_1.xdr.HashIdPreimageSorobanAuthorization({
+        networkId: (0, stellar_sdk_1.hash)(Buffer.from(networkPassphrase)),
+        nonce,
+        signatureExpirationLedger,
+        invocation,
+    }));
+    return (0, stellar_sdk_1.hash)(preimage.toXDR());
+}
+/**
+ * `sha256(signature_payload || xdr(context_rule_ids))`.
+ *
+ * OZ binds the selected rule ids into the digest so a signature for one rule
+ * cannot be replayed against another.
+ */
+function authDigest(payload, contextRuleIds) {
+    const idsXdr = vec(contextRuleIds.map(u32)).toXDR();
+    return (0, stellar_sdk_1.hash)(Buffer.concat([payload, idsXdr]));
+}
+/** `AuthPayload { signers, context_rule_ids }` - the account's "signature". */
+function authPayload(signerAddresses, contextRuleIds, signatureFor) {
+    return struct({
+        signers: stellar_sdk_1.xdr.ScVal.scvMap(signerAddresses
+            .map((a) => new stellar_sdk_1.xdr.ScMapEntry({ key: (0, exports.delegatedSigner)(a), val: bytes(signatureFor(a)) }))
+            // Host maps must be sorted by key.
+            .sort((x, y) => Buffer.compare(x.key().toXDR(), y.key().toXDR()))),
+        context_rule_ids: vec(contextRuleIds.map(u32)),
+    });
+}
+/**
+ * The nested entry a `Delegated` signer needs.
+ *
+ * `require_auth_for_args` authorizes the CURRENT frame, which while
+ * `__check_auth` is running is the account contract executing `__check_auth`,
+ * with the digest as its single argument.
+ *
+ * The signer is the transaction source here, so source-account credentials
+ * carry it and no separate signature is required.
+ */
+function delegatedSignerEntry(accountId, digest) {
+    return new stellar_sdk_1.xdr.SorobanAuthorizationEntry({
+        credentials: stellar_sdk_1.xdr.SorobanCredentials.sorobanCredentialsSourceAccount(),
+        rootInvocation: new stellar_sdk_1.xdr.SorobanAuthorizedInvocation({
+            function: stellar_sdk_1.xdr.SorobanAuthorizedFunction.sorobanAuthorizedFunctionTypeContractFn(new stellar_sdk_1.xdr.InvokeContractArgs({
+                contractAddress: new stellar_sdk_1.Address(accountId).toScAddress(),
+                functionName: '__check_auth',
+                args: [bytes(digest)],
+            })),
+            subInvocations: [],
+        }),
+    });
+}
+/** Rebuild the account's entry with the AuthPayload in the signature slot. */
+function accountEntry(original, signatureExpirationLedger, payload) {
+    const creds = original.credentials().address();
+    return new stellar_sdk_1.xdr.SorobanAuthorizationEntry({
+        credentials: stellar_sdk_1.xdr.SorobanCredentials.sorobanCredentialsAddress(new stellar_sdk_1.xdr.SorobanAddressCredentials({
+            address: creds.address(),
+            nonce: creds.nonce(),
+            signatureExpirationLedger,
+            signature: payload,
+        })),
+        rootInvocation: original.rootInvocation(),
+    });
+}

package/dist-cjs/run/index.d.ts

@@ -1,10 +1,14 @@
 import { type ErrorCode, type PredicateNode, type ProposedPolicy, type RecordedTransaction, type ToolError, type ToolResponse } from '../index.ts';
+import { type BuildInstallPolicyResult, type BuildRevokePolicyResult } from '../install/build-install-policy.ts';
+import { getInterpreterInfo } from '../install/get-interpreter-info.ts';
 import type { SimulationResult } from '../verify/envelope.ts';
-import { type RecordTransactionInput, type SynthesizePolicyInput } from './schemas.ts';
-export type { RecordTransactionInput, SynthesizePolicyInput } from './schemas.ts';
-export { ComposeUserResponsesSchema, InterpreterOptionsSchema, MandateSpecSchema, NetworkSchema, OzAdapterConfigSchema, RecordedTransactionSchema, RecordTransactionInputSchema, SynthesizePolicyInputSchema, ToolErrorSchema, } from './schemas.ts';
+import { type RecordTransactionInput, type SimulatePolicyInput, type SynthesizePolicyInput, type VerifyPolicyInput } from './schemas.ts';
+export type { GetInterpreterInfoInput, InstallPolicyInput, RecordTransactionInput, RevokePolicyInput, SimulatePolicyInput, SynthesizePolicyInput, VerifyPolicyInput, } from './schemas.ts';
+export { ComposeUserResponsesSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MandateSpecSchema, NetworkSchema, OraclePriceFixtureSchema, OzAdapterConfigSchema, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, SimulatePolicyInputSchema, SynthesizePolicyInputSchema, ToolErrorSchema, VerifyPolicyInputSchema, } from './schemas.ts';
 export type RunRecordTransactionInput = RecordTransactionInput;
 export type RunSynthesizePolicyInput = SynthesizePolicyInput;
+export type RunSimulatePolicyInput = SimulatePolicyInput;
+export type RunVerifyPolicyInput = VerifyPolicyInput;
 /** `record_transaction` body - wraps `recordTransaction`. The tool input
  *  matches the core RecordInput minus the injected `fetcher` (the transport
  *  layer does not own the RPC). Returns the core ToolResponse unchanged.
@@ -35,6 +39,47 @@ export declare function runSynthesizePolicy(raw: unknown): Promise<ToolResponse<
         simulation: SimulationResult;
     };
 }>;
+/** `simulate_policy` body - thin wrapper over `simulatePolicy`. The engine
+ *  already returns fail-closed `{ok:false, error}` for runtime failures
+ *  (SIMULATION_ERROR), so the try/catch envelope is for raw SDK throws
+ *  only - same pattern as the other two wrappers. The predicate is
+ *  passed inline (stateless by design; no `proposed_policy_id` lookup). */
+export declare function runSimulatePolicy(raw: unknown): Promise<ToolResponse<SimulationResult>>;
+/** `verify_policy` body - thin wrapper over `verifyPolicy`. The engine
+ *  already returns `{ok:false, error}` with code VERIFICATION_FAILED when
+ *  the minimality check fails; the try/catch envelope is for raw SDK
+ *  throws only. Mirrors `runSimulatePolicy` exactly. */
+export declare function runVerifyPolicy(raw: unknown): Promise<ToolResponse<true>>;
+/** `install_policy` body - thin wrapper over `buildInstallPolicyXdr`.
+ *  Returns the unsigned Soroban transaction envelope (base64 XDR) the
+ *  wallet signs. The wallet signature IS the user-confirmation step - no
+ *  `action_id` two-call pair (the server is stateless, see server.ts:10-12).
+ *  Per design decision 4, only CALL 1 (account.add_context_rule) is
+ *  emitted; CALL 2 (interpreter.install) requires the rule id the account
+ *  assigns in call 1 and is documented under `followUp` in the response.
+ *
+ *  Default-deny: an interpreter policy address other than the pinned
+ *  testnet interpreter is REFUSED (the smart account would delegate to
+ *  an interpreter the caller controls); the same applies to a non-pinned
+ *  RPC URL (the auth nonce the wallet signs comes from the RPC). Both
+ *  gates accept an explicit opt-in flag. */
+export declare function runInstallPolicy(raw: unknown): Promise<ToolResponse<BuildInstallPolicyResult>>;
+/** `revoke_policy` body - thin wrapper over `buildRevokePolicyXdr`.
+ *  Emits an unsigned XDR for `account.remove_context_rule(ruleId)`; the
+ *  smart account itself handles uninstalling each attached policy. Auth
+ *  is master-only; the source account MUST be the master signer set.
+ *
+ *  Same RPC pin as install: a non-pinned `rpcUrl` is refused unless
+ *  `allowUnpinnedRpcUrl: true`. Revoke does not carry an interpreter
+ *  policy payload, so the interpreter pin is not re-checked here. */
+export declare function runRevokePolicy(raw: unknown): Promise<ToolResponse<BuildRevokePolicyResult>>;
+/** `get_interpreter_info` body - thin wrapper over `getInterpreterInfo`.
+ *  Returns the pinned deployment fingerprint + an optional live
+ *  `grammar_version()` comparison. The audit field is deliberately
+ *  OMITTED (phase-04's "audit #44" has no source of truth in the repo -
+ *  fabricating it would be a lie on a security surface; the live
+ *  mismatch check is worth MORE). */
+export declare function runGetInterpreterInfo(raw: unknown): Promise<ToolResponse<ReturnType<typeof getInterpreterInfo>>>;
 /** Build a canonical ToolError for a thrown exception caught by the tool
  *  envelope. The MCP SDK stringifies thrown objects as "[object Object]" by
  *  default, so we extract a string-friendly message and tag the original
@@ -46,4 +91,4 @@ export declare function runSynthesizePolicy(raw: unknown): Promise<ToolResponse<
  *  Exported as `_caughtError` (the leading underscore signals the test-only
  *  seam) so the suite in run/index.test.ts can drive the envelope path
  *  without standing up a full recordTransaction pipeline. */
-export declare function caughtError(toolName: 'record_transaction' | 'synthesize_policy', code: ErrorCode, e: unknown): ToolError;
+export declare function caughtError(toolName: 'record_transaction' | 'synthesize_policy' | 'simulate_policy' | 'verify_policy' | 'install_policy' | 'revoke_policy' | 'get_interpreter_info', code: ErrorCode, e: unknown): ToolError;

package/dist-cjs/run/index.js

@@ -18,11 +18,21 @@
 // No business logic. No retries. No session state. The same call shape can
 // drive the CLI (which calls into the same core directly without MCP).
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolErrorSchema = exports.SynthesizePolicyInputSchema = exports.RecordTransactionInputSchema = exports.RecordedTransactionSchema = exports.OzAdapterConfigSchema = exports.NetworkSchema = exports.MandateSpecSchema = exports.InterpreterOptionsSchema = exports.ComposeUserResponsesSchema = void 0;
+exports.VerifyPolicyInputSchema = exports.ToolErrorSchema = exports.SynthesizePolicyInputSchema = exports.SimulatePolicyInputSchema = exports.RevokePolicyInputSchema = exports.RecordTransactionInputSchema = exports.RecordedTransactionSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.OzAdapterConfigSchema = exports.OraclePriceFixtureSchema = exports.NetworkSchema = exports.MandateSpecSchema = exports.InterpreterOptionsSchema = exports.InstallPolicyInputSchema = exports.GetInterpreterInfoInputSchema = exports.ComposeUserResponsesSchema = void 0;
 exports.runRecordTransaction = runRecordTransaction;
 exports.runSynthesizePolicy = runSynthesizePolicy;
+exports.runSimulatePolicy = runSimulatePolicy;
+exports.runVerifyPolicy = runVerifyPolicy;
+exports.runInstallPolicy = runInstallPolicy;
+exports.runRevokePolicy = runRevokePolicy;
+exports.runGetInterpreterInfo = runGetInterpreterInfo;
 exports.caughtError = caughtError;
+const node_crypto_1 = require("node:crypto");
+const stellar_sdk_1 = require("@stellar/stellar-sdk");
 const index_ts_1 = require("../index.js");
+const build_install_policy_ts_1 = require("../install/build-install-policy.js");
+const get_interpreter_info_ts_1 = require("../install/get-interpreter-info.js");
+const index_ts_2 = require("../verify/index.js");
 const schemas_ts_1 = require("./schemas.js");
 // Re-export the underlying Zod schemas so the MCP package (and any other
 // downstream consumer) can import the canonical input shapes from the same
@@ -30,14 +40,25 @@ const schemas_ts_1 = require("./schemas.js");
 // truth - MCP tool shapes are derived from them.
 var schemas_ts_2 = require("./schemas.js");
 Object.defineProperty(exports, "ComposeUserResponsesSchema", { enumerable: true, get: function () { return schemas_ts_2.ComposeUserResponsesSchema; } });
+Object.defineProperty(exports, "GetInterpreterInfoInputSchema", { enumerable: true, get: function () { return schemas_ts_2.GetInterpreterInfoInputSchema; } });
+Object.defineProperty(exports, "InstallPolicyInputSchema", { enumerable: true, get: function () { return schemas_ts_2.InstallPolicyInputSchema; } });
 Object.defineProperty(exports, "InterpreterOptionsSchema", { enumerable: true, get: function () { return schemas_ts_2.InterpreterOptionsSchema; } });
 Object.defineProperty(exports, "MandateSpecSchema", { enumerable: true, get: function () { return schemas_ts_2.MandateSpecSchema; } });
 Object.defineProperty(exports, "NetworkSchema", { enumerable: true, get: function () { return schemas_ts_2.NetworkSchema; } });
+Object.defineProperty(exports, "OraclePriceFixtureSchema", { enumerable: true, get: function () { return schemas_ts_2.OraclePriceFixtureSchema; } });
 Object.defineProperty(exports, "OzAdapterConfigSchema", { enumerable: true, get: function () { return schemas_ts_2.OzAdapterConfigSchema; } });
+Object.defineProperty(exports, "PINNED_INTERPRETER_GRAMMAR_VERSION", { enumerable: true, get: function () { return schemas_ts_2.PINNED_INTERPRETER_GRAMMAR_VERSION; } });
+Object.defineProperty(exports, "PINNED_INTERPRETER_TESTNET_ADDRESS", { enumerable: true, get: function () { return schemas_ts_2.PINNED_INTERPRETER_TESTNET_ADDRESS; } });
+Object.defineProperty(exports, "PINNED_INTERPRETER_WASM_SHA256", { enumerable: true, get: function () { return schemas_ts_2.PINNED_INTERPRETER_WASM_SHA256; } });
+Object.defineProperty(exports, "PredicateLeafSchema", { enumerable: true, get: function () { return schemas_ts_2.PredicateLeafSchema; } });
+Object.defineProperty(exports, "PredicateNodeSchema", { enumerable: true, get: function () { return schemas_ts_2.PredicateNodeSchema; } });
 Object.defineProperty(exports, "RecordedTransactionSchema", { enumerable: true, get: function () { return schemas_ts_2.RecordedTransactionSchema; } });
 Object.defineProperty(exports, "RecordTransactionInputSchema", { enumerable: true, get: function () { return schemas_ts_2.RecordTransactionInputSchema; } });
+Object.defineProperty(exports, "RevokePolicyInputSchema", { enumerable: true, get: function () { return schemas_ts_2.RevokePolicyInputSchema; } });
+Object.defineProperty(exports, "SimulatePolicyInputSchema", { enumerable: true, get: function () { return schemas_ts_2.SimulatePolicyInputSchema; } });
 Object.defineProperty(exports, "SynthesizePolicyInputSchema", { enumerable: true, get: function () { return schemas_ts_2.SynthesizePolicyInputSchema; } });
 Object.defineProperty(exports, "ToolErrorSchema", { enumerable: true, get: function () { return schemas_ts_2.ToolErrorSchema; } });
+Object.defineProperty(exports, "VerifyPolicyInputSchema", { enumerable: true, get: function () { return schemas_ts_2.VerifyPolicyInputSchema; } });
 /** `record_transaction` body - wraps `recordTransaction`. The tool input
  *  matches the core RecordInput minus the injected `fetcher` (the transport
  *  layer does not own the RPC). Returns the core ToolResponse unchanged.
@@ -132,11 +153,323 @@ function resolveOzConfig(input) {
     // placeholder OZ instance addresses are deterministic.
     return (0, index_ts_1.placeholderOzConfig)('mainnet');
 }
+/** `simulate_policy` body - thin wrapper over `simulatePolicy`. The engine
+ *  already returns fail-closed `{ok:false, error}` for runtime failures
+ *  (SIMULATION_ERROR), so the try/catch envelope is for raw SDK throws
+ *  only - same pattern as the other two wrappers. The predicate is
+ *  passed inline (stateless by design; no `proposed_policy_id` lookup). */
+async function runSimulatePolicy(raw) {
+    const parsed = schemas_ts_1.SimulatePolicyInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            error: validationError('simulate_policy', parsed.error.issues),
+        };
+    }
+    const input = parsed.data;
+    try {
+        // The recursive PredicateNodeSchema + ContractInvocationSchema are
+        // typed `z.ZodType<unknown>` to survive TS's circular inference; the
+        // engine wants typed `PredicateNode | null` + `RecordedTransaction`.
+        // The schema already validated the shape, so assert through the
+        // unknown back to the core types. Same pattern as the recordedTx
+        // cast in `runSynthesizePolicy`.
+        return (0, index_ts_2.simulatePolicy)(input.predicate, input.permitTx, {
+            ...(input.validUntilLedger !== undefined
+                ? { validUntilLedger: input.validUntilLedger }
+                : {}),
+            ...(input.oraclePricesByAsset !== undefined
+                ? { oraclePricesByAsset: input.oraclePricesByAsset }
+                : {}),
+        });
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: caughtError('simulate_policy', 'SIMULATION_ERROR', e),
+        };
+    }
+}
+/** `verify_policy` body - thin wrapper over `verifyPolicy`. The engine
+ *  already returns `{ok:false, error}` with code VERIFICATION_FAILED when
+ *  the minimality check fails; the try/catch envelope is for raw SDK
+ *  throws only. Mirrors `runSimulatePolicy` exactly. */
+async function runVerifyPolicy(raw) {
+    const parsed = schemas_ts_1.VerifyPolicyInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            error: validationError('verify_policy', parsed.error.issues),
+        };
+    }
+    const input = parsed.data;
+    try {
+        // Same cast as runSimulatePolicy: the recursive schemas are typed
+        // `unknown`; the engine wants typed `PredicateNode` +
+        // `RecordedTransaction`. The schema already validated the shape.
+        return (0, index_ts_2.verifyPolicy)(input.predicate, input.permitTx, {
+            ...(input.validUntilLedger !== undefined ? { validUntilLedger: input.validUntilLedger } : {}),
+            ...(input.oraclePricesByAsset !== undefined
+                ? { oraclePricesByAsset: input.oraclePricesByAsset }
+                : {}),
+        });
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: caughtError('verify_policy', 'VERIFICATION_FAILED', e),
+        };
+    }
+}
+/** `install_policy` body - thin wrapper over `buildInstallPolicyXdr`.
+ *  Returns the unsigned Soroban transaction envelope (base64 XDR) the
+ *  wallet signs. The wallet signature IS the user-confirmation step - no
+ *  `action_id` two-call pair (the server is stateless, see server.ts:10-12).
+ *  Per design decision 4, only CALL 1 (account.add_context_rule) is
+ *  emitted; CALL 2 (interpreter.install) requires the rule id the account
+ *  assigns in call 1 and is documented under `followUp` in the response.
+ *
+ *  Default-deny: an interpreter policy address other than the pinned
+ *  testnet interpreter is REFUSED (the smart account would delegate to
+ *  an interpreter the caller controls); the same applies to a non-pinned
+ *  RPC URL (the auth nonce the wallet signs comes from the RPC). Both
+ *  gates accept an explicit opt-in flag. */
+async function runInstallPolicy(raw) {
+    const parsed = schemas_ts_1.InstallPolicyInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            error: validationError('install_policy', parsed.error.issues),
+        };
+    }
+    const input = parsed.data;
+    // ---- Pinning gates (default-deny) ----
+    const pinningError = enforceInterpreterPin(input.rule.policies, input.allowUnpinnedInterpreter);
+    if (pinningError) {
+        return { ok: false, error: pinningError };
+    }
+    if (input.rpcUrl && input.rpcUrl !== schemas_ts_1.TESTNET_RPC_URL && input.allowUnpinnedRpcUrl !== true) {
+        return {
+            ok: false,
+            error: {
+                code: 'INSTALL_BUILD_FAILED',
+                message: `install_policy: rpcUrl must equal the pinned TESTNET_RPC_URL; set allowUnpinnedRpcUrl: true to opt in to a custom endpoint`,
+                severity: 'error',
+                retryable: false,
+                remediation: { toolCall: { name: 'install_policy', args: {} } },
+            },
+        };
+    }
+    let rpcClient;
+    try {
+        rpcClient = buildRpcClientFromInput(input.rpcUrl);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: caughtError('install_policy', 'INSTALL_BUILD_FAILED', e),
+        };
+    }
+    try {
+        const interpreterPolicy = input.rule.policies.find((p) => p.kind === 'interpreter');
+        const encodedPredicate = interpreterPolicy?.predicateBlobBase64 ?? '';
+        const predicateHash = (0, node_crypto_1.createHash)('sha256')
+            .update(Buffer.from(encodedPredicate, 'base64'))
+            .digest('hex');
+        const result = await (0, build_install_policy_ts_1.buildInstallPolicyXdr)({
+            smartAccount: input.smartAccount,
+            sourceAccount: input.sourceAccount,
+            networkPassphrase: schemas_ts_1.NETWORK_PASSPHRASES.testnet,
+            rule: input.rule,
+            installNonce: input.installNonce,
+            encodedPredicate,
+            predicateHash,
+            rpc: rpcClient,
+            ...(input.baseFee !== undefined ? { baseFee: input.baseFee } : {}),
+        });
+        return { ok: true, data: result };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: caughtError('install_policy', 'INSTALL_BUILD_FAILED', e),
+        };
+    }
+}
+/** `revoke_policy` body - thin wrapper over `buildRevokePolicyXdr`.
+ *  Emits an unsigned XDR for `account.remove_context_rule(ruleId)`; the
+ *  smart account itself handles uninstalling each attached policy. Auth
+ *  is master-only; the source account MUST be the master signer set.
+ *
+ *  Same RPC pin as install: a non-pinned `rpcUrl` is refused unless
+ *  `allowUnpinnedRpcUrl: true`. Revoke does not carry an interpreter
+ *  policy payload, so the interpreter pin is not re-checked here. */
+async function runRevokePolicy(raw) {
+    const parsed = schemas_ts_1.RevokePolicyInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            error: validationError('revoke_policy', parsed.error.issues),
+        };
+    }
+    const input = parsed.data;
+    if (input.rpcUrl && input.rpcUrl !== schemas_ts_1.TESTNET_RPC_URL && input.allowUnpinnedRpcUrl !== true) {
+        return {
+            ok: false,
+            error: {
+                code: 'REVOKE_BUILD_FAILED',
+                message: `revoke_policy: rpcUrl must equal the pinned TESTNET_RPC_URL; set allowUnpinnedRpcUrl: true to opt in to a custom endpoint`,
+                severity: 'error',
+                retryable: false,
+                remediation: { toolCall: { name: 'revoke_policy', args: {} } },
+            },
+        };
+    }
+    let rpcClient;
+    try {
+        rpcClient = buildRpcClientFromInput(input.rpcUrl);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: caughtError('revoke_policy', 'REVOKE_BUILD_FAILED', e),
+        };
+    }
+    try {
+        const result = await (0, build_install_policy_ts_1.buildRevokePolicyXdr)({
+            smartAccount: input.smartAccount,
+            sourceAccount: input.sourceAccount,
+            ruleId: input.ruleId,
+            networkPassphrase: schemas_ts_1.NETWORK_PASSPHRASES.testnet,
+            rpc: rpcClient,
+            ...(input.baseFee !== undefined ? { baseFee: input.baseFee } : {}),
+        });
+        return { ok: true, data: result };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: caughtError('revoke_policy', 'REVOKE_BUILD_FAILED', e),
+        };
+    }
+}
+/** `get_interpreter_info` body - thin wrapper over `getInterpreterInfo`.
+ *  Returns the pinned deployment fingerprint + an optional live
+ *  `grammar_version()` comparison. The audit field is deliberately
+ *  OMITTED (phase-04's "audit #44" has no source of truth in the repo -
+ *  fabricating it would be a lie on a security surface; the live
+ *  mismatch check is worth MORE). */
+async function runGetInterpreterInfo(raw) {
+    const parsed = schemas_ts_1.GetInterpreterInfoInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            error: validationError('get_interpreter_info', parsed.error.issues),
+        };
+    }
+    const input = parsed.data;
+    const network = input.network ?? 'testnet';
+    // Asking about mainnet used to return the TESTNET pin with `network:
+    // 'mainnet'` stamped on it. DEPLOYMENTS.md:3 says plainly "Testnet only.
+    // Nothing is deployed to mainnet yet", so that answer described a contract
+    // that does not exist at an address that is not on that network. This tool
+    // exists to tell a caller what they are installing against; inventing a
+    // mainnet deployment is the same failure as inventing an audit reference.
+    if (network === 'mainnet') {
+        return {
+            ok: false,
+            error: {
+                code: 'RECORDING_FAILED',
+                message: 'get_interpreter_info: no interpreter is deployed to mainnet. The pinned address and wasm hash are testnet-only; mainnet deployment is gated on the interpreter audit.',
+                severity: 'error',
+                retryable: false,
+                remediation: {
+                    toolCall: { name: 'get_interpreter_info', args: { network: 'testnet' } },
+                },
+            },
+        };
+    }
+    try {
+        let deployedGrammarVersion;
+        if (input.verifyLive === true) {
+            const rpcClient = buildRpcClientFromInput(input.rpcUrl);
+            deployedGrammarVersion = await rpcClient.getContractVersion(schemas_ts_1.PINNED_INTERPRETER_TESTNET_ADDRESS);
+        }
+        const info = (0, get_interpreter_info_ts_1.getInterpreterInfo)({
+            pinnedAddress: schemas_ts_1.PINNED_INTERPRETER_TESTNET_ADDRESS,
+            pinnedGrammarVersion: schemas_ts_1.PINNED_INTERPRETER_GRAMMAR_VERSION,
+            pinnedWasmHash: schemas_ts_1.PINNED_INTERPRETER_WASM_SHA256,
+            network,
+            ...(deployedGrammarVersion !== undefined ? { deployedGrammarVersion } : {}),
+        });
+        return { ok: true, data: info };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: caughtError('get_interpreter_info', 'RECORDING_FAILED', e),
+        };
+    }
+}
+/** Build an InstallRpcClient from an optional URL override, falling back
+ *  to the public testnet RPC (matching the design-decision rule that we
+ *  reuse `record/rpc.ts` and never hard-code a different RPC client). */
+function buildRpcClientFromInput(urlOverride) {
+    if (urlOverride) {
+        return (0, build_install_policy_ts_1.rpcClientFromServer)(new stellar_sdk_1.rpc.Server(urlOverride, { allowHttp: false }), schemas_ts_1.NETWORK_PASSPHRASES.testnet);
+    }
+    // Default: public testnet RPC. Matches the brief; the mainnet pin would
+    // need a separate deploy and is out of scope for this tool.
+    //
+    // NOT `createRpcServer` - that returns an RpcFetcher, a bare
+    // `(hash) => Promise<SorobanTxResponse|null>` for the RECORDER. Passing it
+    // here produced a client whose `getAccount` was undefined, so every live
+    // call died with "server.getAccount is not a function". The install path
+    // needs the full Server surface.
+    return (0, build_install_policy_ts_1.rpcClientFromServer)(new stellar_sdk_1.rpc.Server(schemas_ts_1.TESTNET_RPC_URL, { allowHttp: false }), schemas_ts_1.NETWORK_PASSPHRASES.testnet);
+}
+/** Default-deny: refuse any interpreter policy whose address differs from
+ *  the pinned testnet interpreter. An interpreter the caller controls
+ *  can permit anything, so the smart account's authorization must bind
+ *  to the pinned contract unless the caller explicitly opts in via
+ *  `allowUnpinnedInterpreter`. OZ built-in policies are not interpreters
+ *  and pass through unchanged. Returns a ToolError to surface through
+ *  the run-layer envelope, or null when the policies are all pinned. */
+function enforceInterpreterPin(policies, allowUnpinned) {
+    for (const p of policies) {
+        if (p.kind !== 'interpreter')
+            continue;
+        if (p.interpreterAddress === schemas_ts_1.PINNED_INTERPRETER_TESTNET_ADDRESS)
+            continue;
+        if (allowUnpinned === true)
+            continue;
+        return {
+            code: 'INSTALL_BUILD_FAILED',
+            message: `install_policy: interpreter policy address ${p.interpreterAddress} != pinned ${schemas_ts_1.PINNED_INTERPRETER_TESTNET_ADDRESS}; set allowUnpinnedInterpreter: true to opt in to a non-pinned interpreter`,
+            severity: 'error',
+            retryable: false,
+            remediation: { toolCall: { name: 'install_policy', args: {} } },
+        };
+    }
+    return null;
+}
 /** Build a canonical ToolError for a Zod validation failure. The remediation
  *  hint points the agent back at the right tool with an empty arg bag - the
  *  tool name IS the machine-readable hint. */
 function validationError(toolName, issues) {
-    const code = toolName === 'record_transaction' ? 'RECORDING_FAILED' : 'SYNTHESIS_ERROR';
+    const code = toolName === 'record_transaction'
+        ? 'RECORDING_FAILED'
+        : toolName === 'synthesize_policy'
+            ? 'SYNTHESIS_ERROR'
+            : toolName === 'simulate_policy'
+                ? 'SIMULATION_ERROR'
+                : toolName === 'verify_policy'
+                    ? 'VERIFICATION_FAILED'
+                    : toolName === 'install_policy'
+                        ? 'INSTALL_BUILD_FAILED'
+                        : toolName === 'revoke_policy'
+                            ? 'REVOKE_BUILD_FAILED'
+                            : 'RECORDING_FAILED';
     return {
         code,
         message: `${toolName}: invalid input: ${issues
@@ -217,8 +550,11 @@ function safeStringify(v) {
             return value.toString();
         if (typeof value === 'function')
             return `[function ${value.name || 'anonymous'}]`;
+        // `stack` is a server-controlled diagnostic. Stack traces from a host
+        // we do not own are reconnaissance, not a signal the caller can act on.
+        // Surface `name` + `message` only.
         if (value instanceof Error) {
-            return { name: value.name, message: value.message, stack: value.stack };
+            return { name: value.name, message: value.message };
         }
         if (value !== null && typeof value === 'object') {
             if (seen.has(value))