@crediolabs/policy-synth 0.1.18 → 0.3.0

package/src/run/index.ts

@@ -21,16 +21,12 @@ import { createHash } from 'node:crypto'
 import { rpc } from '@stellar/stellar-sdk'
 import {
   type ErrorCode,
-  type MandateSpec,
   type Network,
-  type OzAdapterConfig,
   type PredicateNode,
   type ProposedPolicy,
-  placeholderOzConfig,
   type RecordedTransaction,
   recordTransaction,
   type SynthesizeFromRecordingOptions,
-  synthesizeFromMandate,
   synthesizeFromRecording,
   type ToolError,
   type ToolResponse,
@@ -44,8 +40,7 @@ import {
   rpcClientFromServer,
 } from '../install/build-install-policy.ts'
 import { getInterpreterInfo } from '../install/get-interpreter-info.ts'
-import type { SimulationResult } from '../verify/envelope.ts'
-import { simulatePolicy, verifyPolicy } from '../verify/index.ts'
+import { type EvalContext, evaluate, generateCases } from '../simulate/index.ts'
 import {
   type GetInterpreterInfoInput,
   GetInterpreterInfoInputSchema,
@@ -87,10 +82,7 @@ export {
   InstallPolicyInputSchema,
   InterpreterOptionsSchema,
   MAINNET_RPC_URL,
-  MandateSpecSchema,
   NetworkSchema,
-  OraclePriceFixtureSchema,
-  OzAdapterConfigSchema,
   PINNED_INTERPRETER_ADDRESS_BY_NETWORK,
   PINNED_INTERPRETER_GRAMMAR_VERSION,
   PINNED_INTERPRETER_MAINNET_ADDRESS,
@@ -102,11 +94,9 @@ export {
   RecordTransactionInputSchema,
   RevokePolicyInputSchema,
   RPC_URL_BY_NETWORK,
-  SimulatePolicyInputSchema,
   SynthesizePolicyInputSchema,
   TESTNET_RPC_URL,
   ToolErrorSchema,
-  VerifyPolicyInputSchema,
 } from './schemas.ts'
 
 export type RunRecordTransactionInput = RecordTransactionInput
@@ -152,10 +142,7 @@ export async function runRecordTransaction(
 ): Promise<ToolResponse<RecordedTransaction>> {
   const parsed = RecordTransactionInputSchema.safeParse(raw)
   if (!parsed.success) {
-    return {
-      ok: false,
-      error: validationError('record_transaction', parsed.error.issues),
-    }
+    return { ok: false, error: validationError('record_transaction', parsed.error.issues) }
   }
   const input: RecordTransactionInput = parsed.data
   // Strip the wire-only `confidenceOverride` and pass the rest straight through.
@@ -170,15 +157,11 @@ export async function runRecordTransaction(
   try {
     return await recordTransaction(coreInput)
   } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('record_transaction', 'RECORDING_FAILED', e),
-    }
+    return toolFailure('record_transaction', e)
   }
 }
 
 /** `synthesize_policy` body - discriminated union on `source`:
- *    - `mandate`   -> synthesizeFromMandate
  *    - `recording` -> synthesizeFromRecording
  *  Exposing BOTH front-ends through ONE tool keeps the MCP surface tiny while
  *  letting the agent pick the deterministic or the inferred path. The CLI
@@ -193,157 +176,37 @@ export async function runSynthesizePolicy(raw: unknown): Promise<
   ToolResponse<ProposedPolicy> & {
     explain?: {
       predicateTree: PredicateNode | null
-      simulation: SimulationResult
     }
   }
 > {
   const parsed = SynthesizePolicyInputSchema.safeParse(raw)
   if (!parsed.success) {
-    return {
-      ok: false,
-      error: validationError('synthesize_policy', parsed.error.issues),
-    }
+    return { ok: false, error: validationError('synthesize_policy', parsed.error.issues) }
   }
   const input = parsed.data
-  const ozConfig: OzAdapterConfig = resolveOzConfig(input)
 
   try {
-    if (input.source === 'mandate') {
-      // Zod's optional fields widen to `T | undefined`, which the core's
-      // exact-optional MandateSpec rejects; the schema already validated the
-      // shape, so assert it (same pattern as the recordedTx cast below).
-      return await synthesizeFromMandate(
-        input.mandate as MandateSpec,
-        ozConfig,
-        input.explain === true ? { explain: true } : {}
-      )
-    }
-    // recording source
     const recorded: RecordedTransaction = input.recordedTx as RecordedTransaction
-    return await synthesizeFromRecording(
-      recorded,
-      {
-        network: input.network,
-        ...(input.userResponses !== undefined ? { userResponses: input.userResponses } : {}),
-        ...(input.confidenceOverride !== undefined
-          ? { confidenceOverride: input.confidenceOverride }
-          : {}),
-        ...(input.interpreter !== undefined ? { interpreter: input.interpreter } : {}),
-        ...(input.explain === true ? { explain: true } : {}),
-      } as SynthesizeFromRecordingOptions,
-      ozConfig
-    )
-  } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('synthesize_policy', 'SYNTHESIS_ERROR', e),
-    }
-  }
-}
-
-function resolveOzConfig(input: SynthesizePolicyInput): OzAdapterConfig {
-  if (input.ozConfig) return input.ozConfig
-  // The mandate path is network-agnostic; fall back to mainnet so the
-  // placeholder OZ instance addresses are deterministic.
-  return placeholderOzConfig('mainnet')
-}
-
-/** `simulate_policy` body - thin wrapper over `simulatePolicy`. The engine
- *  already returns fail-closed `{ok:false, error}` for runtime failures
- *  (SIMULATION_ERROR), so the try/catch envelope is for raw SDK throws
- *  only - same pattern as the other two wrappers. The predicate is
- *  passed inline (stateless by design; no `proposed_policy_id` lookup). */
-export async function runSimulatePolicy(raw: unknown): Promise<ToolResponse<SimulationResult>> {
-  const parsed = SimulatePolicyInputSchema.safeParse(raw)
-  if (!parsed.success) {
-    return {
-      ok: false,
-      error: validationError('simulate_policy', parsed.error.issues),
-    }
-  }
-  const input: SimulatePolicyInput = parsed.data
-  try {
-    // The recursive PredicateNodeSchema + ContractInvocationSchema are
-    // typed `z.ZodType<unknown>` to survive TS's circular inference; the
-    // engine wants typed `PredicateNode | null` + `RecordedTransaction`.
-    // The schema already validated the shape, so assert through the
-    // unknown back to the core types. Same pattern as the recordedTx
-    // cast in `runSynthesizePolicy`.
-    return simulatePolicy(
-      input.predicate as PredicateNode | null,
-      input.permitTx as RecordedTransaction,
-      {
-        ...(input.validUntilLedger !== undefined
-          ? { validUntilLedger: input.validUntilLedger }
-          : {}),
-        ...(input.oraclePricesByAsset !== undefined
-          ? { oraclePricesByAsset: input.oraclePricesByAsset }
-          : {}),
-      }
-    )
-  } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('simulate_policy', 'SIMULATION_ERROR', e),
-    }
-  }
-}
-
-/** `verify_policy` body - thin wrapper over `verifyPolicy`. The engine
- *  already returns `{ok:false, error}` with code VERIFICATION_FAILED when
- *  the minimality check fails; the try/catch envelope is for raw SDK
- *  throws only. Mirrors `runSimulatePolicy` exactly. */
-export async function runVerifyPolicy(raw: unknown): Promise<ToolResponse<true>> {
-  const parsed = VerifyPolicyInputSchema.safeParse(raw)
-  if (!parsed.success) {
-    return {
-      ok: false,
-      error: validationError('verify_policy', parsed.error.issues),
-    }
-  }
-  const input: VerifyPolicyInput = parsed.data
-  try {
-    // Same cast as runSimulatePolicy: the recursive schemas are typed
-    // `unknown`; the engine wants typed `PredicateNode` +
-    // `RecordedTransaction`. The schema already validated the shape.
-    return verifyPolicy(input.predicate as PredicateNode, input.permitTx as RecordedTransaction, {
-      ...(input.validUntilLedger !== undefined ? { validUntilLedger: input.validUntilLedger } : {}),
-      ...(input.oraclePricesByAsset !== undefined
-        ? { oraclePricesByAsset: input.oraclePricesByAsset }
+    return await synthesizeFromRecording(recorded, {
+      network: input.network,
+      ...(input.userResponses !== undefined ? { userResponses: input.userResponses } : {}),
+      ...(input.confidenceOverride !== undefined
+        ? { confidenceOverride: input.confidenceOverride }
         : {}),
-    })
+      ...(input.interpreter !== undefined ? { interpreter: input.interpreter } : {}),
+      ...(input.explain === true ? { explain: true } : {}),
+    } as SynthesizeFromRecordingOptions)
   } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('verify_policy', 'VERIFICATION_FAILED', e),
-    }
+    return toolFailure('synthesize_policy', e)
   }
 }
 
-/** `install_policy` body - thin wrapper over `buildInstallPolicyXdr`.
- *  Returns the unsigned Soroban transaction envelope (base64 XDR) the
- *  wallet signs. The wallet signature IS the user-confirmation step - no
- *  `action_id` two-call pair (the server is stateless, see server.ts:10-12).
- *  One call installs the policy outright: `add_context_rule` carries the
- *  predicate to the interpreter in its `policies` install_param, so no
- *  separate `interpreter.install` call is needed or possible.
- *
- *  Default-deny: an interpreter policy address other than the pinned
- *  interpreter for the selected network is REFUSED (the smart account
- *  would delegate to an interpreter the caller controls); the same
- *  applies to a non-pinned RPC URL (the auth nonce the wallet signs
- *  comes from the RPC). Both gates accept an explicit opt-in flag.
- *  Pin selection follows `input.network` (defaults to `testnet` so the
- *  pre-mainnet callers keep working unchanged). */
 export async function runInstallPolicy(
   raw: unknown
 ): Promise<ToolResponse<BuildInstallPolicyResult>> {
   const parsed = InstallPolicyInputSchema.safeParse(raw)
   if (!parsed.success) {
-    return {
-      ok: false,
-      error: validationError('install_policy', parsed.error.issues),
-    }
+    return { ok: false, error: validationError('install_policy', parsed.error.issues) }
   }
   const input: InstallPolicyInput = parsed.data
   const network: Network = input.network ?? 'testnet'
@@ -372,10 +235,7 @@ export async function runInstallPolicy(
   try {
     rpcClient = buildRpcClientFromInput(input.rpcUrl, network)
   } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('install_policy', 'INSTALL_BUILD_FAILED', e),
-    }
+    return toolFailure('install_policy', e)
   }
   try {
     const interpreterPolicy = input.rule.policies.find((p) => p.kind === 'interpreter')
@@ -396,10 +256,7 @@ export async function runInstallPolicy(
     })
     return { ok: true, data: result }
   } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('install_policy', 'INSTALL_BUILD_FAILED', e),
-    }
+    return toolFailure('install_policy', e)
   }
 }
 
@@ -417,10 +274,7 @@ export async function runRevokePolicy(
 ): Promise<ToolResponse<BuildRevokePolicyResult>> {
   const parsed = RevokePolicyInputSchema.safeParse(raw)
   if (!parsed.success) {
-    return {
-      ok: false,
-      error: validationError('revoke_policy', parsed.error.issues),
-    }
+    return { ok: false, error: validationError('revoke_policy', parsed.error.issues) }
   }
   const input: RevokePolicyInput = parsed.data
   const network: Network = input.network ?? 'testnet'
@@ -439,10 +293,7 @@ export async function runRevokePolicy(
   try {
     rpcClient = buildRpcClientFromInput(input.rpcUrl, network)
   } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('revoke_policy', 'REVOKE_BUILD_FAILED', e),
-    }
+    return toolFailure('revoke_policy', e)
   }
   try {
     const result = await buildRevokePolicyXdr({
@@ -455,10 +306,7 @@ export async function runRevokePolicy(
     })
     return { ok: true, data: result }
   } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('revoke_policy', 'REVOKE_BUILD_FAILED', e),
-    }
+    return toolFailure('revoke_policy', e)
   }
 }
 
@@ -481,15 +329,114 @@ export async function runRevokePolicy(
  *  a non-pinned `rpcUrl` would silently bind the caller to a host they
  *  picked. The pin is enforced here too, with the same `allowUnpinnedRpcUrl`
  *  opt-in as install/revoke. */
+/** The call a predicate is evaluated against: the single top-level invocation
+ *  the smart account authorises. `Policy::enforce` receives one `Context`, not
+ *  a sub-invocation tree, so simulating anything deeper would claim a
+ *  guarantee the contract does not make. */
+function evalContextFromRecording(tx: RecordedTransaction): EvalContext | null {
+  const top = tx.invocations[0]
+  if (!top) return null
+  return { contract: top.contract, fn: top.fn, args: top.args }
+}
+
+/** Both `simulate_policy` and `verify_policy` evaluate against a context derived
+ *  from `permitTx`; neither has anything to evaluate when the recording carries
+ *  no top-level invocation. */
+function noInvocationError(toolName: 'simulate_policy' | 'verify_policy'): ToolError {
+  return {
+    code: TOOL_ERROR_CODE[toolName],
+    message: `${toolName}: permitTx carries no invocation to evaluate`,
+    severity: 'error',
+    retryable: false,
+  }
+}
+
+/** `simulate_policy` body - evaluate a predicate against one recorded call.
+ *
+ *  The evaluator is a second implementation of the on-chain semantics, and the
+ *  conformance harness asserts it agrees with the Rust interpreter case for
+ *  case. A verdict here is therefore a claim about what the contract would do,
+ *  not a guess. */
+export function runSimulatePolicy(raw: unknown): ToolResponse<{
+  permitted: boolean
+  reason: string | null
+  call: { contract: string; fn: string; argCount: number }
+}> {
+  const parsed = SimulatePolicyInputSchema.safeParse(raw)
+  if (!parsed.success) {
+    return { ok: false, error: validationError('simulate_policy', parsed.error.issues) }
+  }
+  const input: SimulatePolicyInput = parsed.data
+  const ctx = evalContextFromRecording(input.permitTx as RecordedTransaction)
+  if (!ctx) return { ok: false, error: noInvocationError('simulate_policy') }
+  try {
+    const res = evaluate(input.predicate as PredicateNode, ctx)
+    return {
+      ok: true,
+      data: {
+        permitted: res.permit,
+        reason: res.permit ? null : res.reason,
+        call: { contract: ctx.contract, fn: ctx.fn, argCount: ctx.args.length },
+      },
+    }
+  } catch (e) {
+    return toolFailure('simulate_policy', e)
+  }
+}
+
+/** `verify_policy` body - the permit case plus a generated deny case per
+ *  dimension.
+ *
+ *  Two failure modes are being checked, and they are not the same thing. A
+ *  permit case that denies means the policy is too STRICT: it would refuse the
+ *  very transaction it was synthesised from. A deny case that permits means it
+ *  is too LOOSE: some mutation of that transaction still gets through. `ok` is
+ *  true only when neither holds. */
+export function runVerifyPolicy(raw: unknown): ToolResponse<{
+  ok: boolean
+  permit: { permitted: boolean; reason: string | null }
+  denies: Array<{ dimension: string; denied: boolean; reason: string | null }>
+  dimensionsCovered: number
+}> {
+  const parsed = VerifyPolicyInputSchema.safeParse(raw)
+  if (!parsed.success) {
+    return { ok: false, error: validationError('verify_policy', parsed.error.issues) }
+  }
+  const input: VerifyPolicyInput = parsed.data
+  const ctx = evalContextFromRecording(input.permitTx as RecordedTransaction)
+  if (!ctx) return { ok: false, error: noInvocationError('verify_policy') }
+  try {
+    const predicate = input.predicate as PredicateNode
+    const cases = generateCases(predicate, ctx)
+    const permitRes = evaluate(predicate, cases.permit)
+    const denies = cases.denies.map((d) => {
+      const r = evaluate(predicate, d.ctx)
+      return {
+        dimension: d.dimension,
+        denied: !r.permit,
+        reason: r.permit ? null : r.reason,
+      }
+    })
+    return {
+      ok: true,
+      data: {
+        ok: permitRes.permit && denies.every((d) => d.denied),
+        permit: { permitted: permitRes.permit, reason: permitRes.permit ? null : permitRes.reason },
+        denies,
+        dimensionsCovered: denies.length,
+      },
+    }
+  } catch (e) {
+    return toolFailure('verify_policy', e)
+  }
+}
+
 export async function runGetInterpreterInfo(
   raw: unknown
 ): Promise<ToolResponse<ReturnType<typeof getInterpreterInfo>>> {
   const parsed = GetInterpreterInfoInputSchema.safeParse(raw)
   if (!parsed.success) {
-    return {
-      ok: false,
-      error: validationError('get_interpreter_info', parsed.error.issues),
-    }
+    return { ok: false, error: validationError('get_interpreter_info', parsed.error.issues) }
   }
   const input: GetInterpreterInfoInput = parsed.data
   const network: Network = input.network ?? 'testnet'
@@ -528,10 +475,7 @@ export async function runGetInterpreterInfo(
     })
     return { ok: true, data: info }
   } catch (e) {
-    return {
-      ok: false,
-      error: caughtError('get_interpreter_info', 'RECORDING_FAILED', e),
-    }
+    return toolFailure('get_interpreter_info', e)
   }
 }
 
@@ -597,14 +541,8 @@ function enforceRpcPin(
   network: Network
 ): ToolError | null {
   if (!rpcUrl || rpcUrl === expectedRpc || allowUnpinned === true) return null
-  const code: ErrorCode =
-    toolName === 'install_policy'
-      ? 'INSTALL_BUILD_FAILED'
-      : toolName === 'revoke_policy'
-        ? 'REVOKE_BUILD_FAILED'
-        : 'RECORDING_FAILED'
   return {
-    code,
+    code: TOOL_ERROR_CODE[toolName],
     message: `${toolName}: rpcUrl must equal the pinned ${expectedRpc} (${network}); set allowUnpinnedRpcUrl: true to opt in to a custom endpoint`,
     severity: 'error',
     retryable: false,
@@ -636,6 +574,12 @@ function validationError(
  *  error in `details` for the agent to inspect. Exported as a test-only seam
  *  so the suite in run/index.test.ts can drive the envelope path without
  *  standing up a full recordTransaction pipeline. */
+/** The fail-closed return every tool body uses in its `catch`. Taking only the
+ *  tool name keeps the tool -> error-code mapping in TOOL_ERROR_CODE alone. */
+function toolFailure(toolName: RunToolName, e: unknown): { ok: false; error: ToolError } {
+  return { ok: false, error: caughtError(toolName, TOOL_ERROR_CODE[toolName], e) }
+}
+
 export function caughtError(toolName: RunToolName, code: ErrorCode, e: unknown): ToolError {
   return {
     code,