@crediolabs/policy-synth 0.1.17 → 0.2.0

package/dist/install/plan-merge-policy.d.ts

@@ -0,0 +1,49 @@
+import type { PredicateNode } from '../types.ts';
+import type { ObservedRule } from './authority-overlap.ts';
+export type MergeStep = 'detach' | 'reinstall';
+export interface MergePlanRefused {
+    ok: false;
+    /** Why the merge cannot proceed, in terms the caller can act on. */
+    reason: string;
+}
+export interface MergePlanAccepted {
+    ok: true;
+    /** The conjunction to install in step 2. */
+    predicate: PredicateNode;
+    /** OZ registry id of the interpreter policy on this rule, for
+     *  `remove_policy`. */
+    policyId: number;
+    /** Oracle bounds to re-install with the merged predicate. Carried from the
+     *  document being replaced: they are tighten-only overrides against the wasm
+     *  defaults, so omitting them would quietly widen the policy while the
+     *  operator believed they were tightening it. */
+    oracleParams?: {
+        maxStalenessSeconds?: number;
+        maxDeviationBps?: number;
+        maxCrossFeedDeviationBps?: number;
+    };
+    /** Consequences the caller must see BEFORE signing step 1, because step 1 is
+     *  the destructive one. */
+    warnings: string[];
+    /** What the caller should do after the requested step confirms. */
+    followUp: string;
+}
+export type MergePlan = MergePlanRefused | MergePlanAccepted;
+/** The interpreter's registry id on a rule, or null when it is not attached
+ *  or the ids were not readable. */
+export declare function interpreterPolicyId(rule: ObservedRule, interpreterAddress: string): number | null;
+/**
+ * Decide whether the merge can proceed, and say what it will cost.
+ *
+ * Refuses rather than guesses whenever the account is not in the shape the
+ * remedy assumes: the rule must be policed by our interpreter, its predicate
+ * must have been readable, and the ids needed to detach it must be present. A
+ * merge built on a predicate we could not read would silently replace a rule
+ * with something narrower or wider than its author wrote.
+ */
+export declare function planMergePolicy(args: {
+    rule: ObservedRule;
+    interpreterAddress: string;
+    incoming: PredicateNode;
+    step: MergeStep;
+}): MergePlan;

package/dist/install/plan-merge-policy.js

@@ -0,0 +1,86 @@
+//! Planning the merge remedy for a cross-rule authority overlap.
+//!
+//! When two rules our interpreter polices can serve the same calls, the
+//! tightening remedy is to replace one rule's predicate with the conjunction
+//! of both (see `authority-overlap.ts`). Carrying that out against an OZ smart
+//! account is not one call, and the reasons are worth stating because they
+//! shape the whole tool:
+//!
+//!   1. A Soroban transaction carries exactly ONE operation - "smart contract
+//!      transactions can only have one operation per transaction" - so the
+//!      detach and the re-attach cannot be bundled even though the host would
+//!      run them in order happily. And `add_policy` panics `DuplicatePolicy`
+//!      while the policy is still attached (`smart_account/storage.rs`
+//!      `add_policy`), so the second transaction cannot even be simulated
+//!      until the first has confirmed.
+//!   2. `remove_policy` calls `try_uninstall` and DISCARDS the result
+//!      (`smart_account/storage.rs`: `let _ = ...try_uninstall(...)`), so the
+//!      policy is detached whether or not our `uninstall` succeeded. When it
+//!      succeeded the document, nonce, signer hash, master set and counters
+//!      are gone and the re-install is a fresh install at nonce 1. When it
+//!      panicked - our `uninstall` panics `MissingState` if the master set has
+//!      been archived - the nonce SURVIVES, and re-installing at 1 would be
+//!      refused on chain as a replay, leaving the rule stuck unpoliced. The
+//!      nonce is therefore READ at reinstall time rather than assumed.
+//!   3. Because of (2), any rate-limit or spend window on that rule is reset
+//!      by the merge. A signer who had consumed most of a window gets a clean
+//!      one. That is a real cost of tightening this way and the caller has to
+//!      be told, not discover it.
+//!   4. So the caller performs step 1, waits for it to confirm, then asks for
+//!      step 2.
+//!
+//! This module is pure. It decides what should happen and why; the XDR is
+//! built by `build-merge-policy.ts`.
+import { mergeIntoAnd } from "./authority-overlap.js";
+/** The interpreter's registry id on a rule, or null when it is not attached
+ *  or the ids were not readable. */
+export function interpreterPolicyId(rule, interpreterAddress) {
+    const index = rule.policyAddresses.indexOf(interpreterAddress);
+    if (index < 0)
+        return null;
+    const id = rule.policyIds?.[index];
+    return typeof id === 'number' ? id : null;
+}
+/**
+ * Decide whether the merge can proceed, and say what it will cost.
+ *
+ * Refuses rather than guesses whenever the account is not in the shape the
+ * remedy assumes: the rule must be policed by our interpreter, its predicate
+ * must have been readable, and the ids needed to detach it must be present. A
+ * merge built on a predicate we could not read would silently replace a rule
+ * with something narrower or wider than its author wrote.
+ */
+export function planMergePolicy(args) {
+    const policyId = interpreterPolicyId(args.rule, args.interpreterAddress);
+    if (policyId === null) {
+        return {
+            ok: false,
+            reason: `rule ${args.rule.id} is not policed by the interpreter at ${args.interpreterAddress}, or its policy ids could not be read, so there is nothing to merge into and no id to detach. The merge hard-pins to that interpreter and has no opt-out: the auth digest it builds binds to the audited deployment. A rule installed against a different interpreter has to be replaced rather than merged.`,
+        };
+    }
+    const existing = args.rule.predicate;
+    if (!existing) {
+        return {
+            ok: false,
+            reason: `the predicate installed on rule ${args.rule.id} could not be read, so it cannot be conjoined; merging against an unknown predicate would replace the rule with something other than what its author wrote`,
+        };
+    }
+    const merged = mergeIntoAnd(existing, args.incoming);
+    if (!merged.ok || !merged.predicate) {
+        return { ok: false, reason: merged.reason ?? 'the two predicates cannot be conjoined' };
+    }
+    const warnings = [
+        `detaching the policy uninstalls it, which removes every counter on rule ${args.rule.id}: any rate limit or spend window there restarts from zero after the merge`,
+        'the rule is unpoliced between the two transactions, so a signer of it is unconstrained by this policy until step 2 confirms',
+    ];
+    return {
+        ok: true,
+        predicate: merged.predicate,
+        policyId,
+        ...(args.rule.oracleBounds ? { oracleParams: args.rule.oracleBounds } : {}),
+        warnings,
+        followUp: args.step === 'detach'
+            ? "sign and submit this transaction, wait for it to confirm, then call again with step: 'reinstall' to install the merged predicate"
+            : 'sign and submit this transaction; the merged predicate is then the only policy governing this rule',
+    };
+}

package/dist/install/read-account-rules.d.ts

@@ -0,0 +1,100 @@
+import { rpc, xdr } from '@stellar/stellar-sdk';
+import type { SignerDraft } from '../types.ts';
+import type { ContextType, ObservedRule } from './authority-overlap.ts';
+/** `storage.rs:295` - the third element of the persistent doc key tuple. */
+export declare const K_DOC = 1;
+/** Persistent-storage key for a rule's stored document:
+ *  `(account, rule_id, K_DOC)`, per `storage.rs:4`. */
+export declare function docKeyScVal(smartAccount: string, ruleId: number): xdr.ScVal;
+/** Ledger key for the interpreter's persistent entry holding that document. */
+export declare function docLedgerKey(interpreter: string, smartAccount: string, ruleId: number): xdr.LedgerKey;
+/** OZ `ContextRuleType`. An unrecognised tag is reported as `default`, which
+ *  is the widest reading and therefore the safe one: it makes the rule look
+ *  like it could serve any call, so overlap is over-reported, never missed. */
+export declare function decodeContextType(v: xdr.ScVal | undefined): ContextType;
+/** OZ `Signer::Delegated(Address) | Signer::External(Address, Bytes)`. */
+export declare function decodeSigner(v: xdr.ScVal): SignerDraft | undefined;
+/** A full OZ `ContextRule` as returned by `get_context_rule(id)`.
+ *  `predicate` is filled in separately from the ledger entry. */
+export declare function decodeContextRule(v: xdr.ScVal): ObservedRule | undefined;
+/** `storage.rs:296` - the third element of the persistent nonce key tuple. */
+export declare const K_NONCE = 2;
+/** Ledger key for a rule's stored install nonce. Read directly for the same
+ *  reason as the document: the interpreter publishes no getter. */
+export declare function nonceLedgerKey(interpreter: string, smartAccount: string, ruleId: number): xdr.LedgerKey;
+/** Per-policy oracle bounds carried on a `StoredDoc`.
+ *
+ *  These must survive a merge. They are tighten-only overrides against the
+ *  wasm defaults, so dropping them does not fail loudly: the rule keeps
+ *  working and silently tolerates staler prices and wider deviation than its
+ *  author chose. */
+export interface StoredOracleBounds {
+    maxStalenessSeconds?: number;
+    maxDeviationBps?: number;
+    maxCrossFeedDeviationBps?: number;
+}
+export declare function decodeStoredOracleBounds(v: xdr.ScVal): StoredOracleBounds;
+/** Raw predicate bytes out of a `StoredDoc` ledger entry value. */
+export declare function decodeStoredPredicateBytes(v: xdr.ScVal): Buffer | undefined;
+/** The three reads the scan needs. Kept as an interface so the collection
+ *  below is testable without a network, matching the `InstallRpcClient`
+ *  pattern in `build-install-policy.ts`. */
+export interface AccountRuleReader {
+    /** OZ `get_context_rules_count()`. */
+    getContextRuleCount(smartAccount: string): Promise<number>;
+    /** OZ `get_context_rule(id)`. Undefined when the id is absent. */
+    getContextRule(smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>;
+    /** The interpreter's persistent `StoredDoc` entry, read as a ledger entry.
+     *  Undefined when no document is stored for that rule. */
+    getStoredDoc(interpreter: string, smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>;
+}
+/** How far the id scan will probe before giving up. OZ imposes no per-account
+ *  rule cap, so there is no exact bound to derive; this one is far above any
+ *  realistic account and keeps a malformed `Count` from spinning forever. */
+export declare const MAX_RULE_ID_SCAN = 512;
+export interface CollectedRules {
+    rules: ObservedRule[];
+    /** Rule ids whose stored predicate could not be read even though the
+     *  interpreter is attached. Such a rule is reported without a predicate,
+     *  which classifies it as opaque rather than as safely narrow. */
+    unreadablePredicateRuleIds: number[];
+    /** True when the scan stopped before accounting for every live rule. The
+     *  result is then a SUBSET of the account's rules, so an empty overlap list
+     *  proves nothing and the caller must not present it as safety. */
+    incomplete: boolean;
+}
+/**
+ * Every context rule on the account, with predicates filled in for the rules
+ * our interpreter polices.
+ *
+ * Rule ids are NOT contiguous. OZ assigns them from a monotonic `NextId` and
+ * decrements `Count` on removal without ever reusing an id
+ * (`smart_account/storage.rs`: `add_context_rule` bumps `NextId`,
+ * `remove_context_rule` only lowers `Count`), so after any removal
+ * `Count < NextId` and the live ids have gaps. Iterating `0..Count-1` would
+ * silently skip live rules at higher ids, and a skipped rule is a missed
+ * overlap - the one error that reports safety which does not exist. Instead
+ * the scan walks ids upward until it has accounted for `Count` live rules.
+ *
+ * A rule whose predicate cannot be read is deliberately left without one. That
+ * demotes it to the `foreign` class, so the scan reports it as opaque instead
+ * of assuming it is narrow.
+ */
+export declare function collectObservedRules(args: {
+    reader: AccountRuleReader;
+    smartAccount: string;
+    interpreterAddress: string;
+    maxRuleIdScan?: number;
+}): Promise<CollectedRules>;
+/**
+ * An `AccountRuleReader` over a live RPC server.
+ *
+ * The two OZ getters are read-only simulations, built the same way as
+ * `getContractVersion` in `build-install-policy.ts`: the source account is
+ * constructed locally because a simulation never checks its sequence number,
+ * and asking the network for a random key would 404.
+ *
+ * The stored document is fetched as a ledger entry rather than a contract
+ * call, because the interpreter publishes no getter for it.
+ */
+export declare function accountRuleReaderFromServer(server: rpc.Server, networkPassphrase: string): AccountRuleReader;

package/dist/install/read-account-rules.js

@@ -0,0 +1,283 @@
+//! Reading an OpenZeppelin smart account's context rules back off chain.
+//!
+//! `authority-overlap.ts` needs to know what a signer can already do before a
+//! new policy is installed. That means every rule on the account: its context
+//! type, its signers, its attached policies, and - for rules our interpreter
+//! polices - the predicate itself.
+//!
+//! The predicate is NOT reachable through a contract call. The interpreter
+//! exposes no getter for `StoredDoc` (`lib.rs` publishes only `grammar_version`,
+//! `install`, `enforce`, the pause pair, `uninstall` and
+//! `rotate_master_signer_set`), so it is read as a ledger entry instead. That
+//! keeps this a pure client-side capability: adding a getter would change a
+//! deployed contract's ABI and force a redeploy plus re-audit to obtain data
+//! the ledger already exposes.
+//!
+//! The decoders here are pure so they can be tested without a network; the
+//! caller supplies raw `ScVal`s.
+import { Account, Address, BASE_FEE, Contract, Keypair, rpc, TransactionBuilder, xdr, } from '@stellar/stellar-sdk';
+import { decodePredicate } from "../predicate/decode.js";
+/** `storage.rs:295` - the third element of the persistent doc key tuple. */
+export const K_DOC = 1;
+/** Persistent-storage key for a rule's stored document:
+ *  `(account, rule_id, K_DOC)`, per `storage.rs:4`. */
+export function docKeyScVal(smartAccount, ruleId) {
+    return xdr.ScVal.scvVec([
+        new Address(smartAccount).toScVal(),
+        xdr.ScVal.scvU32(ruleId),
+        xdr.ScVal.scvU32(K_DOC),
+    ]);
+}
+/** Ledger key for the interpreter's persistent entry holding that document. */
+export function docLedgerKey(interpreter, smartAccount, ruleId) {
+    return xdr.LedgerKey.contractData(new xdr.LedgerKeyContractData({
+        contract: new Address(interpreter).toScAddress(),
+        key: docKeyScVal(smartAccount, ruleId),
+        durability: xdr.ContractDataDurability.persistent(),
+    }));
+}
+// ---- ScVal helpers -----
+/** Field of a `#[contracttype]` struct, which the host encodes as a map keyed
+ *  by field-name symbol. Returns undefined when the field is absent so a
+ *  caller can distinguish "not there" from "there and empty". */
+function mapField(v, name) {
+    if (v.switch() !== xdr.ScValType.scvMap())
+        return undefined;
+    for (const entry of v.map() ?? []) {
+        const key = entry.key();
+        if (key.switch() === xdr.ScValType.scvSymbol() && key.sym().toString() === name) {
+            return entry.val();
+        }
+    }
+    return undefined;
+}
+function u32Of(v) {
+    return v?.switch() === xdr.ScValType.scvU32() ? v.u32() : undefined;
+}
+function addressOf(v) {
+    if (!v || v.switch() !== xdr.ScValType.scvAddress())
+        return undefined;
+    return Address.fromScAddress(v.address()).toString();
+}
+/** An enum variant of a `#[contracttype]` enum: `ScVal::Vec([Symbol, ...args])`. */
+function enumVariant(v) {
+    if (!v || v.switch() !== xdr.ScValType.scvVec())
+        return undefined;
+    const items = v.vec() ?? [];
+    const head = items[0];
+    if (!head || head.switch() !== xdr.ScValType.scvSymbol())
+        return undefined;
+    return { tag: head.sym().toString(), args: items.slice(1) };
+}
+// ---- decoders -----
+/** OZ `ContextRuleType`. An unrecognised tag is reported as `default`, which
+ *  is the widest reading and therefore the safe one: it makes the rule look
+ *  like it could serve any call, so overlap is over-reported, never missed. */
+export function decodeContextType(v) {
+    const variant = enumVariant(v);
+    if (!variant)
+        return { kind: 'default' };
+    if (variant.tag === 'CallContract') {
+        const addr = addressOf(variant.args[0]);
+        return addr ? { kind: 'call_contract', address: addr } : { kind: 'default' };
+    }
+    if (variant.tag === 'CreateContract') {
+        const arg = variant.args[0];
+        const hash = arg?.switch() === xdr.ScValType.scvBytes() ? arg.bytes().toString('hex') : '';
+        return { kind: 'create_contract', wasmHash: hash };
+    }
+    return { kind: 'default' };
+}
+/** OZ `Signer::Delegated(Address) | Signer::External(Address, Bytes)`. */
+export function decodeSigner(v) {
+    const variant = enumVariant(v);
+    if (!variant)
+        return undefined;
+    if (variant.tag === 'Delegated') {
+        const addr = addressOf(variant.args[0]);
+        return addr ? { kind: 'delegated', address: addr } : undefined;
+    }
+    if (variant.tag === 'External') {
+        const verifier = addressOf(variant.args[0]);
+        const keyArg = variant.args[1];
+        const keyBytes = keyArg?.switch() === xdr.ScValType.scvBytes() ? keyArg.bytes().toString('hex') : '';
+        return verifier ? { kind: 'external', verifier, keyBytes } : undefined;
+    }
+    return undefined;
+}
+/** A full OZ `ContextRule` as returned by `get_context_rule(id)`.
+ *  `predicate` is filled in separately from the ledger entry. */
+export function decodeContextRule(v) {
+    const id = u32Of(mapField(v, 'id'));
+    if (id === undefined)
+        return undefined;
+    const signersVal = mapField(v, 'signers');
+    const signers = [];
+    if (signersVal?.switch() === xdr.ScValType.scvVec()) {
+        for (const s of signersVal.vec() ?? []) {
+            const decoded = decodeSigner(s);
+            if (decoded)
+                signers.push(decoded);
+        }
+    }
+    const policiesVal = mapField(v, 'policies');
+    const policyAddresses = [];
+    if (policiesVal?.switch() === xdr.ScValType.scvVec()) {
+        for (const p of policiesVal.vec() ?? []) {
+            const addr = addressOf(p);
+            if (addr)
+                policyAddresses.push(addr);
+        }
+    }
+    // `policy_ids` is index-aligned with `policies` in OZ's ContextRule. Only
+    // the ids can be passed to `remove_policy`, so a detach is impossible
+    // without them; they are read here rather than looked up again later.
+    const policyIdsVal = mapField(v, 'policy_ids');
+    const policyIds = [];
+    if (policyIdsVal?.switch() === xdr.ScValType.scvVec()) {
+        for (const pid of policyIdsVal.vec() ?? []) {
+            const n = u32Of(pid);
+            if (n !== undefined)
+                policyIds.push(n);
+        }
+    }
+    return {
+        id,
+        contextType: decodeContextType(mapField(v, 'context_type')),
+        signers,
+        policyAddresses,
+        ...(policyIds.length > 0 ? { policyIds } : {}),
+    };
+}
+/** `storage.rs:296` - the third element of the persistent nonce key tuple. */
+export const K_NONCE = 2;
+/** Ledger key for a rule's stored install nonce. Read directly for the same
+ *  reason as the document: the interpreter publishes no getter. */
+export function nonceLedgerKey(interpreter, smartAccount, ruleId) {
+    return xdr.LedgerKey.contractData(new xdr.LedgerKeyContractData({
+        contract: new Address(interpreter).toScAddress(),
+        key: xdr.ScVal.scvVec([
+            new Address(smartAccount).toScVal(),
+            xdr.ScVal.scvU32(ruleId),
+            xdr.ScVal.scvU32(K_NONCE),
+        ]),
+        durability: xdr.ContractDataDurability.persistent(),
+    }));
+}
+export function decodeStoredOracleBounds(v) {
+    const read = (name) => u32Of(mapField(v, name));
+    const staleness = read('oracle_max_staleness_seconds');
+    const deviation = read('oracle_max_deviation_bps');
+    const xfeed = read('oracle_max_xfeed_dev_bps');
+    return {
+        ...(staleness !== undefined ? { maxStalenessSeconds: staleness } : {}),
+        ...(deviation !== undefined ? { maxDeviationBps: deviation } : {}),
+        ...(xfeed !== undefined ? { maxCrossFeedDeviationBps: xfeed } : {}),
+    };
+}
+/** Raw predicate bytes out of a `StoredDoc` ledger entry value. */
+export function decodeStoredPredicateBytes(v) {
+    const field = mapField(v, 'predicate_bytes');
+    if (!field || field.switch() !== xdr.ScValType.scvBytes())
+        return undefined;
+    return field.bytes();
+}
+/** How far the id scan will probe before giving up. OZ imposes no per-account
+ *  rule cap, so there is no exact bound to derive; this one is far above any
+ *  realistic account and keeps a malformed `Count` from spinning forever. */
+export const MAX_RULE_ID_SCAN = 512;
+/**
+ * Every context rule on the account, with predicates filled in for the rules
+ * our interpreter polices.
+ *
+ * Rule ids are NOT contiguous. OZ assigns them from a monotonic `NextId` and
+ * decrements `Count` on removal without ever reusing an id
+ * (`smart_account/storage.rs`: `add_context_rule` bumps `NextId`,
+ * `remove_context_rule` only lowers `Count`), so after any removal
+ * `Count < NextId` and the live ids have gaps. Iterating `0..Count-1` would
+ * silently skip live rules at higher ids, and a skipped rule is a missed
+ * overlap - the one error that reports safety which does not exist. Instead
+ * the scan walks ids upward until it has accounted for `Count` live rules.
+ *
+ * A rule whose predicate cannot be read is deliberately left without one. That
+ * demotes it to the `foreign` class, so the scan reports it as opaque instead
+ * of assuming it is narrow.
+ */
+export async function collectObservedRules(args) {
+    const count = await args.reader.getContextRuleCount(args.smartAccount);
+    const limit = args.maxRuleIdScan ?? MAX_RULE_ID_SCAN;
+    const rules = [];
+    const unreadablePredicateRuleIds = [];
+    let id = 0;
+    while (rules.length < count && id < limit) {
+        const raw = await args.reader.getContextRule(args.smartAccount, id);
+        id++;
+        if (!raw)
+            continue;
+        const rule = decodeContextRule(raw);
+        if (!rule)
+            continue;
+        if (rule.policyAddresses.includes(args.interpreterAddress)) {
+            const doc = await args.reader.getStoredDoc(args.interpreterAddress, args.smartAccount, rule.id);
+            const bytes = doc ? decodeStoredPredicateBytes(doc) : undefined;
+            if (bytes) {
+                try {
+                    rule.predicate = decodePredicate(bytes);
+                    // Carried so a merge can re-install the SAME bounds. They are
+                    // tighten-only overrides, so losing them widens the policy quietly.
+                    if (doc)
+                        rule.oracleBounds = decodeStoredOracleBounds(doc);
+                }
+                catch {
+                    unreadablePredicateRuleIds.push(rule.id);
+                }
+            }
+            else {
+                unreadablePredicateRuleIds.push(rule.id);
+            }
+        }
+        rules.push(rule);
+    }
+    return { rules, unreadablePredicateRuleIds, incomplete: rules.length < count };
+}
+/**
+ * An `AccountRuleReader` over a live RPC server.
+ *
+ * The two OZ getters are read-only simulations, built the same way as
+ * `getContractVersion` in `build-install-policy.ts`: the source account is
+ * constructed locally because a simulation never checks its sequence number,
+ * and asking the network for a random key would 404.
+ *
+ * The stored document is fetched as a ledger entry rather than a contract
+ * call, because the interpreter publishes no getter for it.
+ */
+export function accountRuleReaderFromServer(server, networkPassphrase) {
+    async function simulateCall(contract, method, ...args) {
+        const account = new Account(Keypair.random().publicKey(), '0');
+        const tx = new TransactionBuilder(account, { fee: BASE_FEE, networkPassphrase })
+            .addOperation(new Contract(contract).call(method, ...args))
+            .setTimeout(30)
+            .build();
+        const sim = await server.simulateTransaction(tx);
+        if (rpc.Api.isSimulationError(sim))
+            return undefined;
+        return sim.result?.retval;
+    }
+    return {
+        async getContextRuleCount(smartAccount) {
+            const val = await simulateCall(smartAccount, 'get_context_rules_count');
+            return u32Of(val) ?? 0;
+        },
+        async getContextRule(smartAccount, ruleId) {
+            return simulateCall(smartAccount, 'get_context_rule', xdr.ScVal.scvU32(ruleId));
+        },
+        async getStoredDoc(interpreter, smartAccount, ruleId) {
+            const key = docLedgerKey(interpreter, smartAccount, ruleId);
+            const res = await server.getLedgerEntries(key);
+            const entry = res.entries?.[0]?.val;
+            if (!entry || entry.switch() !== xdr.LedgerEntryType.contractData())
+                return undefined;
+            return entry.contractData().val();
+        },
+    };
+}

package/dist/predicate/decode.js

@@ -7,7 +7,7 @@
 // this module takes it from there.
 //
 // Mirrors `decode_leaf` / `decode_node` in
-// `packages/policy-interpreter/src/dsl.rs`. Two rules carry most of the
+// `contracts/policy-interpreter/src/dsl.rs`. Two rules carry most of the
 // weight, and both come from the Rust decoder verbatim:
 //
 //   1. A `Vec` whose FIRST element is a Symbol is a selector tuple. A `Vec`