@crediolabs/policy-synth 0.1.18 → 0.2.0

package/dist-cjs/run/schemas.d.ts

@@ -505,18 +505,66 @@ export declare const ComposeUserResponsesSchema: z.ZodObject<{
     limitAmount: z.ZodOptional<z.ZodString>;
     invocationLimit: z.ZodOptional<z.ZodNumber>;
     swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        asset: z.ZodEffects<z.ZodString, string, string>;
+        operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+        value: z.ZodString;
+        decimals: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }>, "many">>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     windowSeconds: z.ZodOptional<z.ZodNumber>;
     validUntilLedger: z.ZodOptional<z.ZodNumber>;
     limitAmount: z.ZodOptional<z.ZodString>;
     invocationLimit: z.ZodOptional<z.ZodNumber>;
     swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        asset: z.ZodEffects<z.ZodString, string, string>;
+        operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+        value: z.ZodString;
+        decimals: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }>, "many">>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     windowSeconds: z.ZodOptional<z.ZodNumber>;
     validUntilLedger: z.ZodOptional<z.ZodNumber>;
     limitAmount: z.ZodOptional<z.ZodString>;
     invocationLimit: z.ZodOptional<z.ZodNumber>;
     swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        asset: z.ZodEffects<z.ZodString, string, string>;
+        operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+        value: z.ZodString;
+        decimals: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }, {
+        value: string;
+        operator: "eq" | "lt" | "lte" | "gt" | "gte";
+        asset: string;
+        decimals: number;
+    }>, "many">>;
 }, z.ZodTypeAny, "passthrough">>;
 /** OzAdapterConfig - the per-network OZ built-in instance addresses. */
 export declare const OzAdapterConfigSchema: z.ZodObject<{
@@ -1126,18 +1174,66 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">>>;
     confidenceOverride: z.ZodOptional<z.ZodObject<{
         threshold: z.ZodNumber;
@@ -1257,6 +1353,22 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -1322,6 +1434,22 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -1841,18 +1969,66 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">>>;
     confidenceOverride: z.ZodOptional<z.ZodObject<{
         threshold: z.ZodNumber;
@@ -1972,6 +2148,22 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -2037,6 +2229,22 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
     confidenceOverride?: {
         threshold: number;
@@ -2817,15 +3025,24 @@ export declare const VerifyPolicyInputSchema: z.ZodObject<{
 export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>;
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
-export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP";
-/** Pinned interpreter address (mainnet). Mainnet
- *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
- *  that was exercised on testnet (same wasm sha256, see
- *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing. */
+export declare const PINNED_INTERPRETER_TESTNET_ADDRESS = "CALHNU4LXZRKFAXYRBODTGDANTNXHJPBTJNYGLUWLIFIP24NWSGWIE4K";
+/** Pinned interpreter address (mainnet), deployed 2026-08-04.
+ *  UNAUDITED at the time of writing. */
 export declare const PINNED_INTERPRETER_MAINNET_ADDRESS = "CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2";
-/** Pinned interpreter wasm sha256 (hex). */
+/** Pinned interpreter wasm sha256 (hex), mainnet.
+ *
+ *  The two networks no longer run the same binary. Testnet carries the
+ *  selector-leaf minimum and the signer-set cap; mainnet predates both. Read
+ *  the hash through `PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK` rather than
+ *  this constant unless mainnet is specifically what is meant, or
+ *  `get_interpreter_info` will report a hash the queried network does not
+ *  run. */
 export declare const PINNED_INTERPRETER_WASM_SHA256 = "6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443";
+/** Pinned interpreter wasm sha256 (hex), testnet. Byte-identical to the
+ *  artifact built from `contracts/policy-interpreter` at the commit that
+ *  introduced errors 216 and 217, verified by fetching the deployed wasm back
+ *  off chain. */
+export declare const PINNED_INTERPRETER_WASM_SHA256_TESTNET = "a4d58bc88fd82bbb8e223941ba5889db919717fae92ced13f6f55bfe583b8e22";
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
 export declare const PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
@@ -2839,11 +3056,12 @@ export declare const TESTNET_RPC_URL = "https://soroban-testnet.stellar.org";
  *  RPC rather than always testnet. Public mainnet endpoint, the same one
  *  the deploy script hit during the 2026-08-04 mainnet rollout. */
 export declare const MAINNET_RPC_URL = "https://mainnet.sorobanrpc.com";
-/** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
- *  is identical across both networks (the same binary was uploaded both
- *  places), so `PINNED_INTERPRETER_WASM_SHA256` stays
- *  a single constant - only the addresses and RPCs are network-scoped. */
+/** Pin + RPC lookup for the gate enforcement. Addresses, RPCs and wasm
+ *  hashes are all network-scoped: the networks diverged when the
+ *  selector-leaf and signer-cap controls were deployed to testnet ahead of
+ *  mainnet. */
 export declare const PINNED_INTERPRETER_ADDRESS_BY_NETWORK: Record<Network, string>;
+export declare const PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK: Record<Network, string>;
 export declare const RPC_URL_BY_NETWORK: Record<Network, string>;
 /** Soroban `valid_until` window (ledgers) added to the latest ledger when
  *  building the auth entry. ~25 minutes at 5s/ledger. */
@@ -3337,6 +3555,17 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
      *  everything. Selecting `network: 'mainnet'` is NOT an opt-in -
      *  the mainnet pin is its own deny-by-default anchor. */
     allowUnpinnedInterpreter: z.ZodOptional<z.ZodBoolean>;
+    /** Opt-in to installing when a signer of this rule can already reach the
+     *  same calls through a context rule that has NO policy attached. OZ lets
+     *  the signer choose which rule authorises a call and enforces only that
+     *  rule's policies, so an unpoliced rule covering the same calls makes
+     *  this policy decorative. Default-deny, because the caller almost
+     *  certainly believes they are restricting something. */
+    allowAuthorityOverlap: z.ZodOptional<z.ZodBoolean>;
+    /** Skip the cross-rule authority scan entirely. The scan costs one RPC
+     *  read per rule on the account; skipping it means the response carries
+     *  no statement about what the signers can already do. */
+    skipAuthorityScan: z.ZodOptional<z.ZodBoolean>;
     /** Base fee in stroops; defaults to BASE_FEE (100). */
     baseFee: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
@@ -3382,6 +3611,8 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }, {
     installNonce: number;
@@ -3426,6 +3657,8 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }>, {
     installNonce: number;
@@ -3470,6 +3703,8 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }, {
     installNonce: number;
@@ -3514,9 +3749,53 @@ export declare const InstallPolicyInputSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | undefined;
     allowUnpinnedRpcUrl?: boolean | undefined;
     allowUnpinnedInterpreter?: boolean | undefined;
+    allowAuthorityOverlap?: boolean | undefined;
+    skipAuthorityScan?: boolean | undefined;
     baseFee?: number | undefined;
 }>;
 export type InstallPolicyInput = z.infer<typeof InstallPolicyInputSchema>;
+/** `merge_policy` input.
+ *
+ *  The tightening remedy for a cross-rule overlap: replace a rule's predicate
+ *  with the conjunction of it and a new one. Two transactions, in order,
+ *  because OZ refuses to re-attach a policy already on the rule - so the
+ *  caller runs `detach`, waits for it to confirm, then runs `reinstall`. */
+export declare const MergePolicyInputSchema: z.ZodObject<{
+    smartAccount: z.ZodString;
+    sourceAccount: z.ZodString;
+    /** The rule whose predicate is being tightened. */
+    ruleId: z.ZodNumber;
+    /** The predicate to conjoin, base64 canonical ScVal, as emitted by
+     *  `synthesize_policy`. */
+    incomingPredicateBlobBase64: z.ZodString;
+    /** Which half of the remedy to build. */
+    step: z.ZodEnum<["detach", "reinstall"]>;
+    network: z.ZodOptional<z.ZodEnum<["mainnet", "testnet"]>>;
+    rpcUrl: z.ZodOptional<z.ZodString>;
+    allowUnpinnedRpcUrl: z.ZodOptional<z.ZodBoolean>;
+    baseFee: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    smartAccount: string;
+    sourceAccount: string;
+    step: "detach" | "reinstall";
+    ruleId: number;
+    incomingPredicateBlobBase64: string;
+    network?: "mainnet" | "testnet" | undefined;
+    rpcUrl?: string | undefined;
+    allowUnpinnedRpcUrl?: boolean | undefined;
+    baseFee?: number | undefined;
+}, {
+    smartAccount: string;
+    sourceAccount: string;
+    step: "detach" | "reinstall";
+    ruleId: number;
+    incomingPredicateBlobBase64: string;
+    network?: "mainnet" | "testnet" | undefined;
+    rpcUrl?: string | undefined;
+    allowUnpinnedRpcUrl?: boolean | undefined;
+    baseFee?: number | undefined;
+}>;
+export type MergePolicyInput = z.infer<typeof MergePolicyInputSchema>;
 export declare const RevokePolicyInputSchema: z.ZodEffects<z.ZodObject<{
     /** The smart account contract address (C...). */
     smartAccount: z.ZodString;

package/dist-cjs/run/schemas.js

@@ -16,7 +16,7 @@
 // imports them here so its tool-shape bindings stay in step; the CLI imports
 // them here so it can build the same args envelope the MCP transport builds.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.InstallPolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.DEFAULT_AUTH_VALID_UNTIL_LEDGERS = exports.RPC_URL_BY_NETWORK = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.MAINNET_RPC_URL = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.OraclePriceFixtureSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.SynthesizePolicyRecordingInputSchema = exports.InterpreterOptionsSchema = exports.SynthesizePolicyMandateInputSchema = exports.RecordTransactionInputSchema = exports.OzAdapterConfigSchema = exports.ComposeUserResponsesSchema = exports.MandateSpecSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
+exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.MergePolicyInputSchema = exports.InstallPolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.DEFAULT_AUTH_VALID_UNTIL_LEDGERS = exports.RPC_URL_BY_NETWORK = exports.PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.MAINNET_RPC_URL = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256_TESTNET = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.OraclePriceFixtureSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.SynthesizePolicyRecordingInputSchema = exports.InterpreterOptionsSchema = exports.SynthesizePolicyMandateInputSchema = exports.RecordTransactionInputSchema = exports.OzAdapterConfigSchema = exports.ComposeUserResponsesSchema = exports.MandateSpecSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
 const zod_1 = require("zod");
 const address_ts_1 = require("../synth/address.js");
 /** Soroban `valid_until` is a u32 ledger sequence; a value above this cannot be
@@ -158,6 +158,21 @@ exports.ComposeUserResponsesSchema = zod_1.z
     swapRecipientAllowlist: zod_1.z
         .array(zod_1.z.string().refine(address_ts_1.isStellarAddress, 'must be a Stellar address (G... or C...)'))
         .optional(),
+    // Per-asset oracle-price bound, one entry per asset. Reaches
+    // `compose-from-recording` and emits an `oracle_price` compare. Declared
+    // here because the object is `.passthrough()`: the field already worked
+    // undeclared, which left the accepted surface wider than the documented
+    // one. `decimals` is REQUIRED - oracle prices normalise to 9 dp and a
+    // threshold silently assumed to share that basis is what let a raw 14-dp
+    // bound permit everything.
+    oraclePriceBound: zod_1.z
+        .array(zod_1.z.object({
+        asset: zod_1.z.string().refine(address_ts_1.isStellarAddress, 'must be a Stellar address (G... or C...)'),
+        operator: zod_1.z.enum(['eq', 'lt', 'lte', 'gt', 'gte']),
+        value: zod_1.z.string().regex(/^[0-9]+$/),
+        decimals: zod_1.z.number().int().min(0).max(U32_MAX),
+    }))
+        .optional(),
 })
     .passthrough();
 /** OzAdapterConfig - the per-network OZ built-in instance addresses. */
@@ -448,15 +463,24 @@ const MandateSpecSchemaForRule = zod_1.z
 // existing four.
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
-exports.PINNED_INTERPRETER_TESTNET_ADDRESS = 'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP';
-/** Pinned interpreter address (mainnet). Mainnet
- *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
- *  that was exercised on testnet (same wasm sha256, see
- *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing. */
+exports.PINNED_INTERPRETER_TESTNET_ADDRESS = 'CALHNU4LXZRKFAXYRBODTGDANTNXHJPBTJNYGLUWLIFIP24NWSGWIE4K';
+/** Pinned interpreter address (mainnet), deployed 2026-08-04.
+ *  UNAUDITED at the time of writing. */
 exports.PINNED_INTERPRETER_MAINNET_ADDRESS = 'CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2';
-/** Pinned interpreter wasm sha256 (hex). */
+/** Pinned interpreter wasm sha256 (hex), mainnet.
+ *
+ *  The two networks no longer run the same binary. Testnet carries the
+ *  selector-leaf minimum and the signer-set cap; mainnet predates both. Read
+ *  the hash through `PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK` rather than
+ *  this constant unless mainnet is specifically what is meant, or
+ *  `get_interpreter_info` will report a hash the queried network does not
+ *  run. */
 exports.PINNED_INTERPRETER_WASM_SHA256 = '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443';
+/** Pinned interpreter wasm sha256 (hex), testnet. Byte-identical to the
+ *  artifact built from `contracts/policy-interpreter` at the commit that
+ *  introduced errors 216 and 217, verified by fetching the deployed wasm back
+ *  off chain. */
+exports.PINNED_INTERPRETER_WASM_SHA256_TESTNET = 'a4d58bc88fd82bbb8e223941ba5889db919717fae92ced13f6f55bfe583b8e22';
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
 exports.PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
@@ -470,14 +494,18 @@ exports.TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org';
  *  RPC rather than always testnet. Public mainnet endpoint, the same one
  *  the deploy script hit during the 2026-08-04 mainnet rollout. */
 exports.MAINNET_RPC_URL = 'https://mainnet.sorobanrpc.com';
-/** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
- *  is identical across both networks (the same binary was uploaded both
- *  places), so `PINNED_INTERPRETER_WASM_SHA256` stays
- *  a single constant - only the addresses and RPCs are network-scoped. */
+/** Pin + RPC lookup for the gate enforcement. Addresses, RPCs and wasm
+ *  hashes are all network-scoped: the networks diverged when the
+ *  selector-leaf and signer-cap controls were deployed to testnet ahead of
+ *  mainnet. */
 exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = {
     testnet: exports.PINNED_INTERPRETER_TESTNET_ADDRESS,
     mainnet: exports.PINNED_INTERPRETER_MAINNET_ADDRESS,
 };
+exports.PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK = {
+    testnet: exports.PINNED_INTERPRETER_WASM_SHA256_TESTNET,
+    mainnet: exports.PINNED_INTERPRETER_WASM_SHA256,
+};
 exports.RPC_URL_BY_NETWORK = {
     testnet: exports.TESTNET_RPC_URL,
     mainnet: exports.MAINNET_RPC_URL,
@@ -541,12 +569,50 @@ exports.InstallPolicyInputSchema = zod_1.z
      *  everything. Selecting `network: 'mainnet'` is NOT an opt-in -
      *  the mainnet pin is its own deny-by-default anchor. */
     allowUnpinnedInterpreter: zod_1.z.boolean().optional(),
+    /** Opt-in to installing when a signer of this rule can already reach the
+     *  same calls through a context rule that has NO policy attached. OZ lets
+     *  the signer choose which rule authorises a call and enforces only that
+     *  rule's policies, so an unpoliced rule covering the same calls makes
+     *  this policy decorative. Default-deny, because the caller almost
+     *  certainly believes they are restricting something. */
+    allowAuthorityOverlap: zod_1.z.boolean().optional(),
+    /** Skip the cross-rule authority scan entirely. The scan costs one RPC
+     *  read per rule on the account; skipping it means the response carries
+     *  no statement about what the signers can already do. */
+    skipAuthorityScan: zod_1.z.boolean().optional(),
     /** Base fee in stroops; defaults to BASE_FEE (100). */
     baseFee: zod_1.z.number().int().positive().optional(),
 })
     .refine((v) => Boolean(v.smartAccount) && Boolean(v.sourceAccount), {
     message: 'smartAccount and sourceAccount are required',
 });
+/** `merge_policy` input.
+ *
+ *  The tightening remedy for a cross-rule overlap: replace a rule's predicate
+ *  with the conjunction of it and a new one. Two transactions, in order,
+ *  because OZ refuses to re-attach a policy already on the rule - so the
+ *  caller runs `detach`, waits for it to confirm, then runs `reinstall`. */
+exports.MergePolicyInputSchema = zod_1.z
+    .object({
+    smartAccount: zod_1.z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
+    sourceAccount: zod_1.z
+        .string()
+        .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
+    /** The rule whose predicate is being tightened. */
+    ruleId: zod_1.z.number().int().nonnegative(),
+    /** The predicate to conjoin, base64 canonical ScVal, as emitted by
+     *  `synthesize_policy`. */
+    incomingPredicateBlobBase64: zod_1.z.string().min(1),
+    /** Which half of the remedy to build. */
+    step: zod_1.z.enum(['detach', 'reinstall']),
+    network: exports.NetworkSchema.optional(),
+    rpcUrl: zod_1.z.string().url().optional(),
+    allowUnpinnedRpcUrl: zod_1.z.boolean().optional(),
+    baseFee: zod_1.z.number().int().positive().optional(),
+})
+    .strict();
 exports.RevokePolicyInputSchema = zod_1.z
     .object({
     /** The smart account contract address (C...). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.18",
+  "version": "0.2.0",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/install/build-add-context-rule.ts

@@ -318,7 +318,18 @@ function encodeI128(value: string): xdr.ScVal {
   )
 }
 
-function encodePolicyInstallParams(args: BuildAddContextRuleArgs): xdr.ScVal {
+/** The `PolicyInstallParams` ScVal an interpreter policy receives.
+ *
+ *  Exported so the merge remedy can re-install a policy through `add_policy`
+ *  using the SAME encoder as a fresh install. Re-implementing it would risk
+ *  exactly the drift this file warns about: the field order is ABI-significant
+ *  and a differing encoding yields a rule that denies every call. */
+export type PolicyInstallParamArgs = Pick<
+  BuildAddContextRuleArgs,
+  'encodedPredicate' | 'predicateHash' | 'installNonce' | 'oracleParams' | 'grammarVersion'
+>
+
+export function encodePolicyInstallParams(args: PolicyInstallParamArgs): xdr.ScVal {
   const predicate = Buffer.from(args.encodedPredicate, 'base64')
   const computedHash = createHash('sha256').update(predicate).digest('hex')
   if (computedHash !== args.predicateHash) {