@crediolabs/policy-synth 0.1.18 → 0.3.0

package/src/errors.ts

@@ -28,7 +28,6 @@ export type ErrorCode =
   | 'PREDICATE_TOO_DEEP'
   | 'TOO_MANY_LEAVES'
   | 'IN_OPERAND_LIMIT'
-  | 'PREDICATE_ORACLE_OVER_LIMIT'
   | 'POLICY_CAP_EXCEEDED'
   | 'WASM_TOO_LARGE'
   // --- interpreter-side denies (canonical names; matches Rust DenyCode) ---
@@ -44,24 +43,6 @@ export type ErrorCode =
   | 'UNSUPPORTED_NODE'
   | 'STATEFUL_BOUND'
   | 'NOT_IN_ALLOWLIST'
-  | 'FREQUENCY'
-  // A `call_arg >= call_arg_scaled(..)` slippage floor was not met. Distinct
-  // from the generic ARG_MISMATCH/STATEFUL_BOUND so a violated swap floor
-  // reads as itself on the review card.
-  | 'SLIPPAGE_FLOOR'
-  // --- oracle denies (fatal evaluator errors) ---
-  | 'ORACLE_STALE'
-  | 'ORACLE_MISSING'
-  | 'ORACLE_NO_CONFIRMATION'
-  | 'ORACLE_DEVIATION_EXCEEDED'
-  | 'ORACLE_MALFORMED_HISTORY'
-  | 'ORACLE_FINGERPRINT_DRIFT'
-  | 'ORACLE_PAUSED'
-  | 'ORACLE_LEAF_INVALID_POSITION'
-  | 'ORACLE_PARAMS_OUT_OF_RANGE'
-  | 'ORACLE_DECIMALS_MISMATCH'
-  | 'ORACLE_THRESHOLD_DECIMALS_OUT_OF_RANGE'
-  | 'ORACLE_THRESHOLD_BASIS_REQUIRED'
   // --- escape-hatch compile gate ---
   | 'COMPILE_OK'
   | 'COMPILE_GATE_FAILED'

package/src/index.ts

@@ -1,11 +1,8 @@
-export * from './adapters/oz/index.ts'
 export * from './errors.ts'
-export * from './ir/index.ts'
-export * from './mandate/index.ts'
 export * from './predicate/index.ts'
 export * from './record/index.ts'
 export * from './registry/index.ts'
 export * from './review-card/index.ts'
-export * from './seams/index.ts'
+export * from './simulate/index.ts'
 export * from './synth/index.ts'
 export * from './types.ts'

package/src/install/build-add-context-rule.ts

@@ -52,8 +52,8 @@ import { Address, xdr } from '@stellar/stellar-sdk'
 import type { ToolError } from '../errors.ts'
 import {
   type ContextRuleDraft,
+  GRAMMAR_VERSION,
   OZ_LIMITS,
-  type OZPrimitiveConfig,
   type PolicyRef,
   type SignerDraft,
 } from '../types.ts'
@@ -66,8 +66,8 @@ export interface BuildAddContextRuleArgs {
    *  admin session. The deployer signs the install call via the admin rule
    *  already on the account, which is separate from this list. */
   signers: SignerDraft[]
-  /** The policy(ies) to attach to the new rule. Only `interpreter` refs
-   *  reach the wire today; `oz_builtin` is reserved for Phase 06 follow-ups. */
+  /** The policy(ies) to attach to the new rule. `interpreter` is the only
+   *  kind: the OpenZeppelin built-in backend was removed. */
   policies: PolicyRef[]
   /** Per-policy install nonce; 1 for a fresh install. */
   installNonce: number
@@ -77,20 +77,12 @@ export interface BuildAddContextRuleArgs {
   encodedPredicate: string
   /** Hex sha256 of the canonical predicate XDR bytes. */
   predicateHash: string
-  /** Per-policy oracle overrides. Absent on any key uses the wasm default. */
-  oracleParams?: {
-    maxStalenessSeconds?: number
-    maxDeviationBps?: number
-    /** Bound between the primary and secondary feeds. Tighten-only against
-     *  the wasm default, like the other two. */
-    maxCrossFeedDeviationBps?: number
-  }
   /** Hard pin to the interpreter's wasm grammar. Refusing here fails closed
    *  before the chain does; the contract will refuse a mismatch again. */
   grammarVersion?: number
 }
 
-export const DEFAULT_GRAMMAR_VERSION = 1 as const
+export const DEFAULT_GRAMMAR_VERSION = GRAMMAR_VERSION
 
 /** The verb `add_context_rule` takes on the wire. */
 export const ADD_CONTEXT_RULE_SYMBOL = 'add_context_rule' as const
@@ -130,20 +122,6 @@ export function buildAddContextRuleArgs(
       'a rule with no signers and no policies is refused at install (NoSignersAndPolicies)'
     )
   }
-  // OZ's spending_limit caps spend on the CONTEXT CONTRACT - it takes no
-  // token argument - so it refuses a Default rule on chain with a bare
-  // #3227. Say which rule shape it needs here, before the encoding, rather
-  // than letting the user read a numeric trap.
-  if (
-    args.policies.some((p) => p.kind === 'oz_builtin' && p.primitive.primitive === 'spending_limit')
-  ) {
-    if (draft.contextRuleType.kind !== 'call_contract') {
-      throw limitError(
-        'INSTALL_BUILD_FAILED',
-        `spending_limit caps spend on the rule's context contract, so the rule must be call_contract-scoped to that token - a "${draft.contextRuleType.kind}" rule is refused on chain (#3227)`
-      )
-    }
-  }
 
   // ---- 2. context_type encoding ----
   const contextType = encodeContextRuleType(draft.contextRuleType)
@@ -173,15 +151,6 @@ const POLICY_INSTALL_PARAM_FIELDS = [
   'install_nonce',
   'predicate',
   'predicate_hash',
-  'oracle_max_staleness_seconds',
-  'oracle_max_deviation_bps',
-  // Cross-feed divergence bound. A field added to the contract's
-  // `PolicyInstallParams` changes the ABI: the host unpacks the map by field
-  // count, so omitting one fails the entire install with
-  // `Error(Object, UnexpectedSize)` and no indication of which field is
-  // missing. The Rust tests build that struct in Rust and never cross this
-  // boundary, so only a real install against a deployed contract catches it.
-  'oracle_max_xfeed_dev_bps',
 ] as const
 
 function encodeContextRuleType(
@@ -232,92 +201,12 @@ function encodePoliciesMap(args: BuildAddContextRuleArgs): xdr.ScVal {
           val: encodePolicyInstallParams(args),
         })
       )
-    } else if (ref.kind === 'oz_builtin') {
-      entries.push(
-        new xdr.ScMapEntry({
-          key: Address.fromString(ref.instanceAddress).toScVal(),
-          val: encodeOzPrimitiveParams(ref.primitive),
-        })
-      )
     }
   }
   entries.sort(sortByScValSymbolString)
   return xdr.ScVal.scvMap(entries)
 }
 
-/** Encode the install params for one OZ built-in policy.
- *
- *  Field names and types are read from the deployed contracts' own spec:
- *    SpendingLimitAccountParams   { period_ledgers: u32, spending_limit: i128 }
- *    SimpleThresholdAccountParams { threshold: u32 }
- *    WeightedThresholdAccountParams { signer_weights: map, threshold: u32 }
- *  Entries are symbol-string ordered for the same reason the interpreter's
- *  are: the host orders by symbol, not by XDR bytes.
- */
-function encodeOzPrimitiveParams(primitive: OZPrimitiveConfig): xdr.ScVal {
-  const entries: xdr.ScMapEntry[] = []
-  const push = (name: string, val: xdr.ScVal) =>
-    entries.push(new xdr.ScMapEntry({ key: xdr.ScVal.scvSymbol(name), val }))
-  const p = primitive.params as Record<string, unknown>
-  switch (primitive.primitive) {
-    case 'spending_limit': {
-      const limit = p.spending_limit
-      const period = p.period_ledgers
-      if (typeof limit !== 'string' || typeof period !== 'number') {
-        throw limitError(
-          'INSTALL_BUILD_FAILED',
-          'spending_limit needs { spending_limit: string; period_ledgers: number }'
-        )
-      }
-      push('period_ledgers', xdr.ScVal.scvU32(period))
-      push('spending_limit', encodeI128(limit))
-      break
-    }
-    case 'simple_threshold': {
-      const threshold = p.threshold
-      if (typeof threshold !== 'number') {
-        throw limitError('INSTALL_BUILD_FAILED', 'simple_threshold needs { threshold: number }')
-      }
-      push('threshold', xdr.ScVal.scvU32(threshold))
-      break
-    }
-    case 'weighted_threshold': {
-      const threshold = p.threshold
-      const weights = p.weights as Record<string, number> | undefined
-      if (typeof threshold !== 'number' || !weights) {
-        throw limitError(
-          'INSTALL_BUILD_FAILED',
-          'weighted_threshold needs { threshold: number; weights: Record<address, number> }'
-        )
-      }
-      const weightEntries = Object.entries(weights)
-        .map(
-          ([addr, w]) =>
-            new xdr.ScMapEntry({
-              key: Address.fromString(addr).toScVal(),
-              val: xdr.ScVal.scvU32(w),
-            })
-        )
-        .sort((a, b) => (a.key().toXDR('base64') < b.key().toXDR('base64') ? -1 : 1))
-      push('signer_weights', xdr.ScVal.scvMap(weightEntries))
-      push('threshold', xdr.ScVal.scvU32(threshold))
-      break
-    }
-  }
-  entries.sort((a, b) => sortBySymbolString(a.key(), b.key()))
-  return xdr.ScVal.scvMap(entries)
-}
-
-function encodeI128(value: string): xdr.ScVal {
-  const v = BigInt(value)
-  return xdr.ScVal.scvI128(
-    new xdr.Int128Parts({
-      hi: new xdr.Int64(BigInt.asIntN(64, v >> 64n)),
-      lo: new xdr.Uint64(BigInt.asUintN(64, v)),
-    })
-  )
-}
-
 function encodePolicyInstallParams(args: BuildAddContextRuleArgs): xdr.ScVal {
   const predicate = Buffer.from(args.encodedPredicate, 'base64')
   const computedHash = createHash('sha256').update(predicate).digest('hex')
@@ -330,15 +219,11 @@ function encodePolicyInstallParams(args: BuildAddContextRuleArgs): xdr.ScVal {
   // Per-field value encoders. Each entry returns the ScVal to drop into the
   // map; the key symbol comes from the surrounding loop. Adding a field is
   // one row here plus the symbol in POLICY_INSTALL_PARAM_FIELDS.
-  const oracleParams = args.oracleParams
   const valueFor: Record<(typeof POLICY_INSTALL_PARAM_FIELDS)[number], () => xdr.ScVal> = {
     grammar_version: () => xdr.ScVal.scvU32(args.grammarVersion ?? DEFAULT_GRAMMAR_VERSION),
     install_nonce: () => xdr.ScVal.scvU32(args.installNonce),
     predicate: () => xdr.ScVal.scvBytes(predicate),
     predicate_hash: () => xdr.ScVal.scvBytes(Buffer.from(args.predicateHash, 'hex')),
-    oracle_max_staleness_seconds: () => encodeOptionU32(oracleParams?.maxStalenessSeconds),
-    oracle_max_deviation_bps: () => encodeOptionU32(oracleParams?.maxDeviationBps),
-    oracle_max_xfeed_dev_bps: () => encodeOptionU32(oracleParams?.maxCrossFeedDeviationBps),
   }
   const entries = POLICY_INSTALL_PARAM_FIELDS.map(
     (k) => new xdr.ScMapEntry({ key: xdr.ScVal.scvSymbol(k), val: valueFor[k]() })
@@ -351,14 +236,6 @@ function encodePolicyInstallParams(args: BuildAddContextRuleArgs): xdr.ScVal {
   return xdr.ScVal.scvMap(entries)
 }
 
-function encodeOptionU32(v: number | undefined): xdr.ScVal {
-  if (v === undefined) return xdr.ScVal.scvVoid()
-  if (!Number.isFinite(v) || v < 0 || v > 0xffffffff) {
-    throw limitError('INSTALL_BUILD_FAILED', `oracle params value ${v} is outside u32 range`)
-  }
-  return xdr.ScVal.scvU32(v)
-}
-
 /** Sort host-map keys by their symbol-string form. The host orders map
  *  entries by the SYMBOL STRING, not by the key's XDR bytes (a length
  *  prefix in the encoding would otherwise put `amount` before `address`).

package/src/install/build-install-policy.ts

@@ -19,6 +19,7 @@
 
 import { createHash } from 'node:crypto'
 import {
+  Account,
   Address,
   BASE_FEE,
   Contract,
@@ -30,7 +31,8 @@ import {
   TransactionBuilder,
   xdr,
 } from '@stellar/stellar-sdk'
-import { buildAddContextRuleArgs, DEFAULT_GRAMMAR_VERSION } from './build-add-context-rule.ts'
+import type { ContextRuleDraft } from '../types.ts'
+import { buildAddContextRuleArgs } from './build-add-context-rule.ts'
 import {
   accountEntry,
   authDigest,
@@ -106,20 +108,14 @@ export interface BuildInstallPolicyArgs {
   sourceAccount: string
   /** Network passphrase - pins the hash the auth digest binds. */
   networkPassphrase: string
-  /** The new rule to install. Mirrors the core `ContextRuleDraft`. */
-  rule: BuildInstallPolicyRuleDraft
+  /** The new rule to install. */
+  rule: ContextRuleDraft
   /** Per-rule install nonce; 1 for a fresh install. */
   installNonce: number
   /** Already-encoded (base64) canonical ScVal of the predicate. */
   encodedPredicate: string
   /** Hex sha256 of the canonical predicate XDR bytes. */
   predicateHash: string
-  /** Per-policy oracle overrides. */
-  oracleParams?: {
-    maxStalenessSeconds?: number
-    maxDeviationBps?: number
-    maxCrossFeedDeviationBps?: number
-  }
   /** Grammar version override; defaults to 1. */
   grammarVersion?: number
   /** Base fee in stroops; defaults to BASE_FEE (100). */
@@ -130,36 +126,6 @@ export interface BuildInstallPolicyArgs {
   authValidUntilLedgers?: number
 }
 
-export type BuildInstallPolicyRuleDraft = {
-  contextRuleType:
-    | { kind: 'default' }
-    | { kind: 'call_contract'; contract: string }
-    | { kind: 'create_contract'; wasmHash: string }
-  name: string
-  validUntilLedger: number | null
-  signers: BuildInstallPolicySignerDraft[]
-  policies: BuildInstallPolicyPolicyRef[]
-}
-
-export type BuildInstallPolicySignerDraft =
-  | { kind: 'delegated'; address: string }
-  | { kind: 'external'; verifier: string; keyBytes: string }
-
-export type BuildInstallPolicyPolicyRef =
-  | {
-      kind: 'interpreter'
-      interpreterAddress: string
-      predicateBlobBase64: string
-    }
-  | {
-      kind: 'oz_builtin'
-      instanceAddress: string
-      primitive: {
-        primitive: 'spending_limit' | 'simple_threshold' | 'weighted_threshold'
-        params: Record<string, unknown>
-      }
-    }
-
 /** Human-readable description of the install call, decoded FROM the built
  *  XDR (not from the input args). The XDR is the source of truth: a
  *  human approving a review card needs the description to mirror the bytes
@@ -193,20 +159,13 @@ export interface InstallCallDescribes {
    *  sha256 of the predicate blob actually embedded in the XDR - so a
    *  mismatch between the wire bytes and the review card is detectable
    *  by reading `describes`. */
-  policies: Array<
-    | {
-        kind: 'interpreter'
-        address: string
-        installNonce: number
-        predicateHash: string
-        predicateSha256OfEmbeddedBytes: string
-      }
-    | {
-        kind: 'oz_builtin'
-        address: string
-        primitive: 'spending_limit' | 'simple_threshold' | 'weighted_threshold'
-      }
-  >
+  policies: Array<{
+    kind: 'interpreter'
+    address: string
+    installNonce: number
+    predicateHash: string
+    predicateSha256OfEmbeddedBytes: string
+  }>
   /** The install nonce, decoded from the interpreter policy's
    *  `install_nonce` field. Echoed at the top level for reviewer convenience;
    *  the per-policy entry is the source of truth. */
@@ -261,102 +220,30 @@ export async function buildInstallPolicyXdr(
       name: args.rule.name,
       validUntilLedger: args.rule.validUntilLedger,
       signers: args.rule.signers,
-      policies: args.rule.policies.map(adaptPolicyRef),
+      policies: args.rule.policies,
     },
     {
       signers: args.rule.signers,
-      policies: args.rule.policies.map(adaptPolicyRef),
+      policies: args.rule.policies,
       installNonce: args.installNonce,
       encodedPredicate: args.encodedPredicate,
       predicateHash: args.predicateHash,
-      ...(args.oracleParams ? { oracleParams: args.oracleParams } : {}),
       ...(args.grammarVersion !== undefined ? { grammarVersion: args.grammarVersion } : {}),
     }
   )
 
-  // 2. Fetch the source sequence, then build the recording transaction with a
-  //    bare host call. The recording pass assigns the smart-account auth nonce
-  //    and root invocation needed to construct OZ's AuthPayload.
-  const source = await args.rpc.getAccount(args.sourceAccount)
-  const hostFunction = xdr.HostFunction.hostFunctionTypeInvokeContract(
-    new xdr.InvokeContractArgs({
-      contractAddress: new Address(args.smartAccount).toScAddress(),
-      functionName: 'add_context_rule',
-      args: [...callArgs],
-    })
-  )
-  const makeOperation = (auth: xdr.SorobanAuthorizationEntry[] = []) =>
-    Operation.invokeHostFunction({ func: hostFunction, auth })
-  const baseFee = args.baseFee !== undefined ? String(args.baseFee) : BASE_FEE
-  const buildTx = (op: xdr.Operation) =>
-    buildUnsignedTx({
-      sourceAccount: args.sourceAccount,
-      sequence: source.sequenceNumber(),
-      fee: baseFee,
-      networkPassphrase: args.networkPassphrase,
-      op,
-    })
-  const recordingTx = buildTx(makeOperation())
-
-  // 3. Recording simulation: capture the smart account's nonce and invocation
-  //    tree. Nothing is signed here.
-  const recorded = await args.rpc.simulateTransaction(recordingTx)
-  if (rpc.Api.isSimulationError(recorded)) {
-    // Short, stable reason. The full `simulateTransaction` error (which
-    // carries host + URL detail) stays in the SDK's own logs - never
-    // reflected back into a user-facing message where it would
-    // reconnoitre the RPC.
-    throw new Error('install_policy: simulateTransaction failed')
-  }
-  const original = (recorded.result?.auth ?? []).find(
-    (entry) =>
-      entry.credentials().switch().name === 'sorobanCredentialsAddress' &&
-      Address.fromScAddress(entry.credentials().address().address()).toString() ===
-        args.smartAccount
-  )
-  if (!original) {
-    throw new Error(
-      `install_policy: no Soroban auth entry for smart account ${args.smartAccount}; this call does not route through the smart account`
-    )
-  }
-
-  // 4. `add_context_rule` is authorised by the deploy-time admin rule (rule 0).
+  // 2. `add_context_rule` is authorised by the deploy-time admin rule (rule 0).
   //    The delegated signer uses source-account credentials, so its signature
   //    bytes stay empty and the ordinary transaction-envelope signature covers
   //    the call when the consumer signs it.
-  const validUntilLedger =
-    (await args.rpc.getLatestLedger()).sequence +
-    (args.authValidUntilLedgers ?? DEFAULT_AUTH_VALID_UNTIL_LEDGERS)
-  const contextRuleIds = [0]
-  const digest = authDigest(
-    signaturePayload(
-      args.networkPassphrase,
-      original.credentials().address().nonce(),
-      validUntilLedger,
-      original.rootInvocation()
-    ),
-    contextRuleIds
+  const { finalTx, original, validUntilLedger } = await buildAuthorisedSmartAccountTx(
+    args,
+    'add_context_rule',
+    [...callArgs],
+    'install_policy'
   )
-  const authEntries = [
-    accountEntry(
-      original,
-      validUntilLedger,
-      authPayload([args.sourceAccount], contextRuleIds, () => Buffer.alloc(0))
-    ),
-    ...contextRuleIds.map(() => delegatedSignerEntry(args.smartAccount, digest)),
-  ]
 
-  // 5. Simulate again with the OZ entries already attached. The SDK preserves
-  //    existing auth during assembly and adds the simulated Soroban footprint +
-  //    resource fee, yielding a complete unsigned envelope.
-  const txWithAuth = buildTx(makeOperation(authEntries))
-  const enforcing = await args.rpc.simulateTransaction(txWithAuth)
-  if (rpc.Api.isSimulationError(enforcing)) {
-    throw new Error('install_policy: auth simulateTransaction failed')
-  }
-  const finalTx = rpc.assembleTransaction(txWithAuth, enforcing).build()
-
-  // 6. Decode the structured description FROM the final assembled transaction.
+  // 3. Decode the structured description FROM the final assembled transaction.
   //    The human approval binds to the exact bytes the wallet will sign.
   const describes = decodeInstallCallDescribes(finalTx, args.installNonce)
 
@@ -392,12 +279,75 @@ export async function buildRevokePolicyXdr(args: {
   baseFee?: number
   authValidUntilLedgers?: number
 }): Promise<BuildRevokePolicyResult> {
+  // Removal is master-only, so the deploy-time admin rule authorises it. The
+  // recorded rootInvocation still includes remove_context_rule(ruleId), binding
+  // the auth payload to the exact rule being removed. As with install,
+  // source-account credentials carry the delegated signer entry and the
+  // consumer supplies only the ordinary envelope signature.
+  const { finalTx, original, validUntilLedger } = await buildAuthorisedSmartAccountTx(
+    args,
+    'remove_context_rule',
+    [xdr.ScVal.scvU32(args.ruleId)],
+    'revoke_policy'
+  )
+
+  return {
+    unsignedXdr: finalTx.toEnvelope().toXDR().toString('base64'),
+    smartAccount: args.smartAccount,
+    sourceAccount: args.sourceAccount,
+    call: { contract: args.smartAccount, fn: 'remove_context_rule', ruleId: args.ruleId },
+    authNonce: original.credentials().address().nonce().toString(),
+    authValidUntilLedger: validUntilLedger,
+    rootInvocationXdr: original.rootInvocation().toXDR().toString('base64'),
+  }
+}
+
+export interface BuildRevokePolicyResult {
+  unsignedXdr: string
+  smartAccount: string
+  sourceAccount: string
+  call: { contract: string; fn: 'remove_context_rule'; ruleId: number }
+  authNonce: string
+  authValidUntilLedger: number
+  rootInvocationXdr: string
+}
+
+/** ~25 minutes at 5s/ledger. */
+const DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300
+
+// ---- internals ----
+
+/** Record a bare call to the smart account, attach the deploy-time admin rule's
+ *  auth entries, and re-simulate to assemble the footprint.
+ *
+ *  Install and revoke differ only in the call they wrap, so they share this
+ *  spine: the recording pass supplies the auth nonce and root invocation OZ's
+ *  AuthPayload binds to, and the second simulation adds the Soroban footprint +
+ *  resource fee. Nothing here is signed. `errorPrefix` names the calling tool in
+ *  the fail-closed messages so a caller can still tell which call failed. */
+async function buildAuthorisedSmartAccountTx(
+  args: {
+    smartAccount: string
+    sourceAccount: string
+    networkPassphrase: string
+    rpc: InstallRpcClient
+    baseFee?: number
+    authValidUntilLedgers?: number
+  },
+  functionName: string,
+  callArgs: xdr.ScVal[],
+  errorPrefix: string
+): Promise<{
+  finalTx: Transaction
+  original: xdr.SorobanAuthorizationEntry
+  validUntilLedger: number
+}> {
   const source = await args.rpc.getAccount(args.sourceAccount)
   const hostFunction = xdr.HostFunction.hostFunctionTypeInvokeContract(
     new xdr.InvokeContractArgs({
       contractAddress: new Address(args.smartAccount).toScAddress(),
-      functionName: 'remove_context_rule',
-      args: [xdr.ScVal.scvU32(args.ruleId)],
+      functionName,
+      args: callArgs,
     })
   )
   const makeOperation = (auth: xdr.SorobanAuthorizationEntry[] = []) =>
@@ -418,7 +368,7 @@ export async function buildRevokePolicyXdr(args: {
     // carries host + URL detail) stays in the SDK's own logs - never
     // reflected back into a user-facing message where it would
     // reconnoitre the RPC.
-    throw new Error('revoke_policy: simulateTransaction failed')
+    throw new Error(`${errorPrefix}: simulateTransaction failed`)
   }
   const original = (recorded.result?.auth ?? []).find(
     (entry) =>
@@ -428,15 +378,10 @@ export async function buildRevokePolicyXdr(args: {
   )
   if (!original) {
     throw new Error(
-      `revoke_policy: no Soroban auth entry for smart account ${args.smartAccount}; this call does not route through the smart account`
+      `${errorPrefix}: no Soroban auth entry for smart account ${args.smartAccount}; this call does not route through the smart account`
     )
   }
 
-  // Removal is master-only, so the deploy-time admin rule authorises it. The
-  // recorded rootInvocation still includes remove_context_rule(ruleId), binding
-  // the auth payload to the exact rule being removed. As with install,
-  // source-account credentials carry the delegated signer entry and the
-  // consumer supplies only the ordinary envelope signature.
   const validUntilLedger =
     (await args.rpc.getLatestLedger()).sequence +
     (args.authValidUntilLedgers ?? DEFAULT_AUTH_VALID_UNTIL_LEDGERS)
@@ -461,52 +406,12 @@ export async function buildRevokePolicyXdr(args: {
   const txWithAuth = buildTx(makeOperation(authEntries))
   const enforcing = await args.rpc.simulateTransaction(txWithAuth)
   if (rpc.Api.isSimulationError(enforcing)) {
-    throw new Error('revoke_policy: auth simulateTransaction failed')
-  }
-  const finalTx = rpc.assembleTransaction(txWithAuth, enforcing).build()
-
-  return {
-    unsignedXdr: finalTx.toEnvelope().toXDR().toString('base64'),
-    smartAccount: args.smartAccount,
-    sourceAccount: args.sourceAccount,
-    call: { contract: args.smartAccount, fn: 'remove_context_rule', ruleId: args.ruleId },
-    authNonce: original.credentials().address().nonce().toString(),
-    authValidUntilLedger: validUntilLedger,
-    rootInvocationXdr: original.rootInvocation().toXDR().toString('base64'),
-  }
-}
-
-export interface BuildRevokePolicyResult {
-  unsignedXdr: string
-  smartAccount: string
-  sourceAccount: string
-  call: { contract: string; fn: 'remove_context_rule'; ruleId: number }
-  authNonce: string
-  authValidUntilLedger: number
-  rootInvocationXdr: string
-}
-
-/** ~25 minutes at 5s/ledger. */
-const DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300
-
-// ---- internals ----
-
-/** Adapter: turn the install-policy wire `PolicyRef` shape into the core
- *  `PolicyRef` shape `buildAddContextRuleArgs` expects. Keeps the wire
- *  schema hand-rolled + flat (the strict union would need a recursive
- *  schema) while delegating to the proven encoder for the actual bytes. */
-function adaptPolicyRef(p: BuildInstallPolicyPolicyRef) {
-  if (p.kind === 'interpreter') {
-    return {
-      kind: 'interpreter' as const,
-      interpreterAddress: p.interpreterAddress,
-      predicateBlobBase64: p.predicateBlobBase64,
-    }
+    throw new Error(`${errorPrefix}: auth simulateTransaction failed`)
   }
   return {
-    kind: 'oz_builtin' as const,
-    instanceAddress: p.instanceAddress,
-    primitive: p.primitive,
+    finalTx: rpc.assembleTransaction(txWithAuth, enforcing).build(),
+    original,
+    validUntilLedger,
   }
 }
 
@@ -580,14 +485,13 @@ function decodeInstallCallDescribes(
       `install_policy: built op has ${scvArgs.length} args, expected 5 (context_type, name, valid_until, signers, policies)`
     )
   }
-  const contextType = scvArgs[0]
   const nameScv = scvArgs[1]
   const validUntilScv = scvArgs[2]
   const signersScv = scvArgs[3]
   const policiesScv = scvArgs[4]
   // The length check above pins these as defined; the local references
   // satisfy noUncheckedIndexedAccess on the accessors below.
-  if (!nameScv || !validUntilScv || !signersScv || !policiesScv || !contextType) {
+  if (!nameScv || !validUntilScv || !signersScv || !policiesScv) {
     throw new Error('install_policy: built op args include an undefined slot despite length check')
   }
 
@@ -672,7 +576,6 @@ function decodeInstallCallDescribes(
       fields.set(fk.sym().toString(), inner.val())
     }
     // Interpreter policy fields carry grammar_version/install_nonce/predicate.
-    // OZ primitives carry spending_limit/period_ledgers/threshold/signers.
     if (fields.has('predicate') || fields.has('grammar_version') || fields.has('install_nonce')) {
       const installNonceScv = fields.get('install_nonce')
       if (installNonceScv?.switch().name !== 'scvU32') {
@@ -706,21 +609,6 @@ function decodeInstallCallDescribes(
       observedInstallNonce = installNonce
       continue
     }
-    // OZ built-in primitive. Distinguish by the parameter shape we
-    // emitted; matching one of the three primitives exactly pins the
-    // kind we built.
-    if (fields.has('spending_limit') && fields.has('period_ledgers')) {
-      policies.push({ kind: 'oz_builtin', address, primitive: 'spending_limit' })
-      continue
-    }
-    if (fields.has('threshold') && fields.has('signer_weights')) {
-      policies.push({ kind: 'oz_builtin', address, primitive: 'weighted_threshold' })
-      continue
-    }
-    if (fields.has('threshold')) {
-      policies.push({ kind: 'oz_builtin', address, primitive: 'simple_threshold' })
-      continue
-    }
     throw new Error(
       `install_policy: policies[${address}] value has an unknown field set; the encoder may have drifted`
     )
@@ -752,12 +640,3 @@ function decodeInstallCallDescribes(
     installNonce,
   }
 }
-
-/** Re-export so the run-layer does not need to import from
- *  build-add-context-rule.ts (keeps the install/ -> install/ dependency
- *  direction intact). */
-export { Contract, DEFAULT_GRAMMAR_VERSION }
-
-// Local re-import to avoid pulling the class from the SDK module path
-// at the top of the file (avoids the unused-import lint).
-import { Account } from '@stellar/stellar-sdk'