@crediolabs/policy-synth 0.1.18 → 0.2.0

package/dist/run/schemas.d.ts

@@ -505,18 +505,66 @@ export declare const ComposeUserResponsesSchema: z.ZodObject<{
     limitAmount: z.ZodOptional<z.ZodString>;
     invocationLimit: z.ZodOptional<z.ZodNumber>;
     swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        asset: z.ZodEffects<z.ZodString, string, string>;
+        operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+        value: z.ZodString;
+        decimals: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }>, "many">>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     windowSeconds: z.ZodOptional<z.ZodNumber>;
     validUntilLedger: z.ZodOptional<z.ZodNumber>;
     limitAmount: z.ZodOptional<z.ZodString>;
     invocationLimit: z.ZodOptional<z.ZodNumber>;
     swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        asset: z.ZodEffects<z.ZodString, string, string>;
+        operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+        value: z.ZodString;
+        decimals: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }>, "many">>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     windowSeconds: z.ZodOptional<z.ZodNumber>;
     validUntilLedger: z.ZodOptional<z.ZodNumber>;
     limitAmount: z.ZodOptional<z.ZodString>;
     invocationLimit: z.ZodOptional<z.ZodNumber>;
     swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        asset: z.ZodEffects<z.ZodString, string, string>;
+        operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+        value: z.ZodString;
+        decimals: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }>, "many">>;
 }, z.ZodTypeAny, "passthrough">>;
 /** OzAdapterConfig - the per-network OZ built-in instance addresses. */
 export declare const OzAdapterConfigSchema: z.ZodObject<{
@@ -1126,18 +1174,66 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">>>;
     confidenceOverride: z.ZodOptional<z.ZodObject<{
         threshold: z.ZodNumber;
@@ -1257,6 +1353,22 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -1322,6 +1434,22 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -1841,18 +1969,66 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">>>;
     confidenceOverride: z.ZodOptional<z.ZodObject<{
         threshold: z.ZodNumber;
@@ -1972,6 +2148,22 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -2037,6 +2229,22 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -2817,15 +3025,24 @@ export declare const VerifyPolicyInputSchema: z.ZodObject<{
 export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>;
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
-export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP";
-/** Pinned interpreter address (mainnet). Mainnet
- *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
- *  that was exercised on testnet (same wasm sha256, see
- *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing. */
+export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CALHNU4LXZRKFAXYRBODTGDANTNXHJPBTJNYGLUWLIFIP24NWSGWIE4K";
+/** Pinned interpreter address (mainnet), deployed 2026-08-04.
+ *  UNAUDITED at the time of writing. */
 export declare const PINNED_INTERPRETER_MAINNET_ADDRESS = "CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2";
-/** Pinned interpreter wasm sha256 (hex). */
+/** Pinned interpreter wasm sha256 (hex), mainnet.
+ *
+ *  The two networks no longer run the same binary. Testnet carries the
+ *  selector-leaf minimum and the signer-set cap; mainnet predates both. Read
+ *  the hash through `PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK` rather than
+ *  this constant unless mainnet is specifically what is meant, or
+ *  `get_interpreter_info` will report a hash the queried network does not
+ *  run. */
 export declare const PINNED_INTERPRETER_WASM_SHA256 = "6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443";
+/** Pinned interpreter wasm sha256 (hex), testnet. Byte-identical to the
+ *  artifact built from `contracts/policy-interpreter` at the commit that
+ *  introduced errors 216 and 217, verified by fetching the deployed wasm back
+ *  off chain. */
+export declare const PINNED_INTERPRETER_WASM_SHA256_TESTNET = "a4d58bc88fd82bbb8e223941ba5889db919717fae92ced13f6f55bfe583b8e22";
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
 export declare const PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
@@ -2839,11 +3056,12 @@ export declare const TESTNET_RPC_URL = "https://soroban-testnet.stellar.org";
  *  RPC rather than always testnet. Public mainnet endpoint, the same one
  *  the deploy script hit during the 2026-08-04 mainnet rollout. */
 export declare const MAINNET_RPC_URL = "https://mainnet.sorobanrpc.com";
-/** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
- *  is identical across both networks (the same binary was uploaded both
- *  places), so `PINNED_INTERPRETER_WASM_SHA256` stays
- *  a single constant - only the addresses and RPCs are network-scoped. */
+/** Pin + RPC lookup for the gate enforcement. Addresses, RPCs and wasm
+ *  hashes are all network-scoped: the networks diverged when the
+ *  selector-leaf and signer-cap controls were deployed to testnet ahead of
+ *  mainnet. */
 export declare const PINNED_INTERPRETER_ADDRESS_BY_NETWORK: Record<Network, string>;
+export declare const PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK: Record<Network, string>;
 export declare const RPC_URL_BY_NETWORK: Record<Network, string>;
 /** Soroban `valid_until` window (ledgers) added to the latest ledger when
  *  building the auth entry. ~25 minutes at 5s/ledger. */
@@ -3337,6 +3555,17 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
      *  everything. Selecting `network: 'mainnet'` is NOT an opt-in -
      *  the mainnet pin is its own deny-by-default anchor. */
     allowUnpinnedInterpreter: z.ZodOptional<z.ZodBoolean>;
+    /** Opt-in to installing when a signer of this rule can already reach the
+     *  same calls through a context rule that has NO policy attached. OZ lets
+     *  the signer choose which rule authorises a call and enforces only that
+     *  rule's policies, so an unpoliced rule covering the same calls makes
+     *  this policy decorative. Default-deny, because the caller almost
+     *  certainly believes they are restricting something. */
+    allowAuthorityOverlap: z.ZodOptional<z.ZodBoolean>;
+    /** Skip the cross-rule authority scan entirely. The scan costs one RPC
+     *  read per rule on the account; skipping it means the response carries
+     *  no statement about what the signers can already do. */
+    skipAuthorityScan: z.ZodOptional<z.ZodBoolean>;
     /** Base fee in stroops; defaults to BASE_FEE (100). */
     baseFee: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
@@ -3382,6 +3611,8 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }, {
     installNonce: number;
@@ -3426,6 +3657,8 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }>, {
     installNonce: number;
@@ -3470,6 +3703,8 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }, {
     installNonce: number;
@@ -3514,9 +3749,53 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }>;
 export type InstallPolicyInput = z.infer<typeof InstallPolicyInputSchema>;
+/** `merge_policy` input.
+ *
+ *  The tightening remedy for a cross-rule overlap: replace a rule's predicate
+ *  with the conjunction of it and a new one. Two transactions, in order,
+ *  because OZ refuses to re-attach a policy already on the rule - so the
+ *  caller runs `detach`, waits for it to confirm, then runs `reinstall`. */
+export declare const MergePolicyInputSchema: z.ZodObject<{
+    smartAccount: z.ZodString;
+    sourceAccount: z.ZodString;
+    /** The rule whose predicate is being tightened. */
+    ruleId: z.ZodNumber;
+    /** The predicate to conjoin, base64 canonical ScVal, as emitted by
+     *  `synthesize_policy`. */
+    incomingPredicateBlobBase64: z.ZodString;
+    /** Which half of the remedy to build. */
+    step: z.ZodEnum<["detach", "reinstall"]>;
+    network: z.ZodOptional<z.ZodEnum<["mainnet", "testnet"]>>;
+    rpcUrl: z.ZodOptional<z.ZodString>;
+    allowUnpinnedRpcUrl: z.ZodOptional<z.ZodBoolean>;
+    baseFee: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    smartAccount: string;
+    sourceAccount: string;
+    step: "detach" | "reinstall";
+    ruleId: number;
+    incomingPredicateBlobBase64: string;
+    network?: "mainnet" | "testnet" | undefined;
+    rpcUrl?: string | undefined;
+    allowUnpinnedRpcUrl?: boolean | undefined;
+    baseFee?: number | undefined;
+}, {
+    smartAccount: string;
+    sourceAccount: string;
+    step: "detach" | "reinstall";
+    ruleId: number;
+    incomingPredicateBlobBase64: string;
+    network?: "mainnet" | "testnet" | undefined;
+    rpcUrl?: string | undefined;
+    allowUnpinnedRpcUrl?: boolean | undefined;
+    baseFee?: number | undefined;
+}>;
+export type MergePolicyInput = z.infer<typeof MergePolicyInputSchema>;
 export declare const RevokePolicyInputSchema: z.ZodEffects<z.ZodObject<{
     /** The smart account contract address (C...). */
     smartAccount: z.ZodString;

package/dist/run/schemas.js

@@ -155,6 +155,21 @@ export const ComposeUserResponsesSchema = z
     swapRecipientAllowlist: z
         .array(z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'))
         .optional(),
+    // Per-asset oracle-price bound, one entry per asset. Reaches
+    // `compose-from-recording` and emits an `oracle_price` compare. Declared
+    // here because the object is `.passthrough()`: the field already worked
+    // undeclared, which left the accepted surface wider than the documented
+    // one. `decimals` is REQUIRED - oracle prices normalise to 9 dp and a
+    // threshold silently assumed to share that basis is what let a raw 14-dp
+    // bound permit everything.
+    oraclePriceBound: z
+        .array(z.object({
+        asset: z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'),
+        operator: z.enum(['eq', 'lt', 'lte', 'gt', 'gte']),
+        value: z.string().regex(/^[0-9]+$/),
+        decimals: z.number().int().min(0).max(U32_MAX),
+    }))
+        .optional(),
 })
     .passthrough();
 /** OzAdapterConfig - the per-network OZ built-in instance addresses. */
@@ -445,15 +460,24 @@ const MandateSpecSchemaForRule = z
 // existing four.
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
-export const PINNED_INTERPRETER_TESTNET_ADDRESS = 'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP';
-/** Pinned interpreter address (mainnet). Mainnet
- *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
- *  that was exercised on testnet (same wasm sha256, see
- *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing. */
+export const PINNED_INTERPRETER_TESTNET_ADDRESS = 'CALHNU4LXZRKFAXYRBODTGDANTNXHJPBTJNYGLUWLIFIP24NWSGWIE4K';
+/** Pinned interpreter address (mainnet), deployed 2026-08-04.
+ *  UNAUDITED at the time of writing. */
 export const PINNED_INTERPRETER_MAINNET_ADDRESS = 'CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2';
-/** Pinned interpreter wasm sha256 (hex). */
+/** Pinned interpreter wasm sha256 (hex), mainnet.
+ *
+ *  The two networks no longer run the same binary. Testnet carries the
+ *  selector-leaf minimum and the signer-set cap; mainnet predates both. Read
+ *  the hash through `PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK` rather than
+ *  this constant unless mainnet is specifically what is meant, or
+ *  `get_interpreter_info` will report a hash the queried network does not
+ *  run. */
 export const PINNED_INTERPRETER_WASM_SHA256 = '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443';
+/** Pinned interpreter wasm sha256 (hex), testnet. Byte-identical to the
+ *  artifact built from `contracts/policy-interpreter` at the commit that
+ *  introduced errors 216 and 217, verified by fetching the deployed wasm back
+ *  off chain. */
+export const PINNED_INTERPRETER_WASM_SHA256_TESTNET = 'a4d58bc88fd82bbb8e223941ba5889db919717fae92ced13f6f55bfe583b8e22';
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
 export const PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
@@ -467,14 +491,18 @@ export const TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org';
  *  RPC rather than always testnet. Public mainnet endpoint, the same one
  *  the deploy script hit during the 2026-08-04 mainnet rollout. */
 export const MAINNET_RPC_URL = 'https://mainnet.sorobanrpc.com';
-/** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
- *  is identical across both networks (the same binary was uploaded both
- *  places), so `PINNED_INTERPRETER_WASM_SHA256` stays
- *  a single constant - only the addresses and RPCs are network-scoped. */
+/** Pin + RPC lookup for the gate enforcement. Addresses, RPCs and wasm
+ *  hashes are all network-scoped: the networks diverged when the
+ *  selector-leaf and signer-cap controls were deployed to testnet ahead of
+ *  mainnet. */
 export const PINNED_INTERPRETER_ADDRESS_BY_NETWORK = {
     testnet: PINNED_INTERPRETER_TESTNET_ADDRESS,
     mainnet: PINNED_INTERPRETER_MAINNET_ADDRESS,
 };
+export const PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK = {
+    testnet: PINNED_INTERPRETER_WASM_SHA256_TESTNET,
+    mainnet: PINNED_INTERPRETER_WASM_SHA256,
+};
 export const RPC_URL_BY_NETWORK = {
     testnet: TESTNET_RPC_URL,
     mainnet: MAINNET_RPC_URL,
@@ -538,12 +566,50 @@ export const InstallPolicyInputSchema = z
      *  everything. Selecting `network: 'mainnet'` is NOT an opt-in -
      *  the mainnet pin is its own deny-by-default anchor. */
     allowUnpinnedInterpreter: z.boolean().optional(),
+    /** Opt-in to installing when a signer of this rule can already reach the
+     *  same calls through a context rule that has NO policy attached. OZ lets
+     *  the signer choose which rule authorises a call and enforces only that
+     *  rule's policies, so an unpoliced rule covering the same calls makes
+     *  this policy decorative. Default-deny, because the caller almost
+     *  certainly believes they are restricting something. */
+    allowAuthorityOverlap: z.boolean().optional(),
+    /** Skip the cross-rule authority scan entirely. The scan costs one RPC
+     *  read per rule on the account; skipping it means the response carries
+     *  no statement about what the signers can already do. */
+    skipAuthorityScan: z.boolean().optional(),
     /** Base fee in stroops; defaults to BASE_FEE (100). */
     baseFee: z.number().int().positive().optional(),
 })
     .refine((v) => Boolean(v.smartAccount) && Boolean(v.sourceAccount), {
     message: 'smartAccount and sourceAccount are required',
 });
+/** `merge_policy` input.
+ *
+ *  The tightening remedy for a cross-rule overlap: replace a rule's predicate
+ *  with the conjunction of it and a new one. Two transactions, in order,
+ *  because OZ refuses to re-attach a policy already on the rule - so the
+ *  caller runs `detach`, waits for it to confirm, then runs `reinstall`. */
+export const MergePolicyInputSchema = z
+    .object({
+    smartAccount: z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
+    sourceAccount: z
+        .string()
+        .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
+    /** The rule whose predicate is being tightened. */
+    ruleId: z.number().int().nonnegative(),
+    /** The predicate to conjoin, base64 canonical ScVal, as emitted by
+     *  `synthesize_policy`. */
+    incomingPredicateBlobBase64: z.string().min(1),
+    /** Which half of the remedy to build. */
+    step: z.enum(['detach', 'reinstall']),
+    network: NetworkSchema.optional(),
+    rpcUrl: z.string().url().optional(),
+    allowUnpinnedRpcUrl: z.boolean().optional(),
+    baseFee: z.number().int().positive().optional(),
+})
+    .strict();
 export const RevokePolicyInputSchema = z
     .object({
     /** The smart account contract address (C...). */