@crediolabs/policy-synth 0.1.18 → 0.3.0

package/src/run/schemas.ts

@@ -8,8 +8,8 @@
 //
 // i128 amounts and other large integers are carried as base-10 decimal strings
 // end-to-end. Networks are pinned to the same closed set the core defines.
-// The discriminated union on `source` exposes BOTH synthesize_policy
-// front-ends through a single tool input.
+// `source` is a single-variant discriminator (`recording`); it stays a union
+// so an unknown value is rejected with a discriminator error.
 //
 // This module is the SINGLE source of truth for these shapes. The MCP package
 // imports them here so its tool-shape bindings stay in step; the CLI imports
@@ -113,62 +113,13 @@ export const RecordedTransactionSchema = z
   })
   .passthrough()
 
-/** MandateSpec mirrors the core MandateSpec. The deterministic Mandate
- *  front-end needs no parseConfidence; the tool adapter injects the full
- *  confidence after synthesis so the orchestrator can compare. */
-export const MandateSpecSchema = z
-  .object({
-    chain: z.literal('stellar'),
-    contract: z.string(),
-    method: z.string().optional(),
-    spendingLimit: z
-      .object({
-        token: z.string(),
-        limit: z.string().regex(/^[0-9]+$/),
-        windowSeconds: z.number().int().positive(),
-      })
-      .optional(),
-    // A threshold of 0 means "0 approvals", which is not a real M-of-N gate.
-    approvalThreshold: z.number().int().positive().optional(),
-    recipients: z.array(z.string()).optional(),
-    expiry: z
-      .object({
-        validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
-        validUntilUnixSeconds: z.number().int().positive().optional(),
-      })
-      .optional(),
-  })
-  .passthrough()
-  // TS-F4/F6: a `recipients` allowlist is only meaningful against a SEP-41
-  // method whose arg 1 IS the recipient (SAC/SEP-41 `transfer(from, to,
-  // amount)` and SEP-41 `mint(to, amount)`). Without this gate the
-  // `to-ir.ts` lowering pins the allowlist to `RECIPIENT_ARG_INDEX = 1`
-  // for any contract+method, which would let a non-SEP-41 method's
-  // arg[1] (e.g. an amount, an op type, an arbitrary address payload)
-  // be silently constrained as if it were a recipient. Refusing
-  // non-SEP-41 methods at the boundary is the fail-closed shape.
-  .refine(
-    (v) =>
-      v.recipients === undefined ||
-      v.recipients.length === 0 ||
-      v.method === 'transfer' ||
-      v.method === 'mint',
-    {
-      message:
-        'recipients is only valid when method is a SEP-41 method (transfer or mint); other methods do not have a recipient at arg[1]',
-    }
-  )
-
-/** ComposeUserResponses mirrors the core. */
 export const ComposeUserResponsesSchema = z
   .object({
-    windowSeconds: z.number().int().positive().optional(),
     validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
     limitAmount: z
       .string()
       .regex(/^[0-9]+$/)
       .optional(),
-    invocationLimit: z.number().int().positive().optional(),
     // Swap recipient allowlist (SoroSwap call_arg[3]). Each entry must be a
     // Stellar address (G... wallet or C... contract); supplying it REPLACES the
     // default pin to the recorded recipient. Validated with the shared StrKey
@@ -177,19 +128,10 @@ export const ComposeUserResponsesSchema = z
       .array(z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'))
       .optional(),
   })
-  .passthrough()
-
-/** OzAdapterConfig - the per-network OZ built-in instance addresses. */
-export const OzAdapterConfigSchema = z.object({
-  network: NetworkSchema,
-  instances: z.object({
-    spending_limit: z.string(),
-    simple_threshold: z.string(),
-    weighted_threshold: z.string(),
-  }),
-})
-
-// ===== record_transaction =====
+  // Strict, not passthrough: a response key the synthesiser no longer reads
+  // (or a typo) would otherwise be accepted in silence, and the caller would
+  // believe they had answered a question that is still open.
+  .strict()
 
 export const RecordTransactionInputSchema = z
   .object({
@@ -206,48 +148,18 @@ export const RecordTransactionInputSchema = z
   })
 export type RecordTransactionInput = z.infer<typeof RecordTransactionInputSchema>
 
-// ===== synthesize_policy =====
-//
-// Discriminated union on `source` exposes BOTH front-ends through ONE tool.
-// - `source: 'mandate'` -> calls synthesizeFromMandate
-// - `source: 'recording'` -> calls synthesizeFromRecording
-
-export const SynthesizePolicyMandateInputSchema = z.object({
-  source: z.literal('mandate'),
-  mandate: MandateSpecSchema,
-  ozConfig: OzAdapterConfigSchema.optional(),
-  // --explain opt-in. When true, the orchestrator attaches the
-  // in-memory predicate tree (null for the mandate path) + a minimal
-  // honest SimulationResult to the success envelope. Absent or false
-  // -> the success envelope is unchanged (byte-identical to today).
-  explain: z.boolean().optional(),
-})
-
-/** Interpreter opt-in for the recording path. Present -> constraints OZ cannot
- *  express (per-method scoping, invocation-count windows, oracle bounds, exact
- *  hop paths) lower to a real interpreter predicate document instead of being
- *  surfaced as warnings. The core deep-validates `smartAccountAddress` (a C...
- *  contract, not the recording's G... source) and the tighten-only oracle
- *  bounds; the schema stays light so the core owns the friendly ToolErrors. */
 export const InterpreterOptionsSchema = z.object({
   smartAccountAddress: z.string(),
   installNonce: z.number().int().positive().optional(),
-  oracleParams: z
-    .object({
-      maxStalenessSeconds: z.number().int().positive().optional(),
-      maxDeviationBps: z.number().int().positive().optional(),
-    })
-    .optional(),
 })
 
-export const SynthesizePolicyRecordingInputSchema = z.object({
+export const SynthesizePolicyInputSchema = z.object({
   source: z.literal('recording'),
   recordedTx: RecordedTransactionSchema,
   network: NetworkSchema,
   userResponses: ComposeUserResponsesSchema.optional(),
   confidenceOverride: z.object({ threshold: z.number().min(0).max(1) }).optional(),
   interpreter: InterpreterOptionsSchema.optional(),
-  ozConfig: OzAdapterConfigSchema.optional(),
   // --explain opt-in. When true, the orchestrator attaches the
   // in-memory PredicateNode + the corresponding SimulationResult
   // (real one from the self-verify pipeline when the interpreter is
@@ -259,10 +171,6 @@ export const SynthesizePolicyRecordingInputSchema = z.object({
   explain: z.boolean().optional(),
 })
 
-export const SynthesizePolicyInputSchema = z.discriminatedUnion('source', [
-  SynthesizePolicyMandateInputSchema,
-  SynthesizePolicyRecordingInputSchema,
-])
 export type SynthesizePolicyInput = z.infer<typeof SynthesizePolicyInputSchema>
 
 // ===== PredicateNode / PredicateLeaf =====
@@ -293,41 +201,6 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
       element: z.number().int().nonnegative(),
       field: z.string(),
     }),
-    // num/den are i128 on chain; JSON numbers lose precision past 2^53,
-    // so the wire is a decimal string. The contract refuses `den == 0` and
-    // `num <= 0` / `den <= 0` at install (types.ts:162-163 + the install
-    // gate); mirroring that bound here closes the gap where simulate /
-    // verify green-light a policy the install gate will reject. The
-    // positive-only regex is the cheapest unambiguous check.
-    z.object({
-      kind: z.literal('call_arg_scaled'),
-      index: z.number().int().nonnegative(),
-      num: z.string().regex(/^[1-9][0-9]*$/),
-      den: z.string().regex(/^[1-9][0-9]*$/),
-    }),
-    z.object({ kind: z.literal('amount'), token: z.string() }),
-    z.object({
-      kind: z.literal('window_spent'),
-      token: z.string(),
-      windowSeconds: z.number().int().positive(),
-    }),
-    z.object({ kind: z.literal('now') }),
-    // `valid_until` is NOT in the public predicate grammar: the encoder +
-    // decoder already throw on it, so accepting it here would let a
-    // hand-crafted payload through the schema and only surface a 200+
-    // character internal-commentary error at encode time. Drop it - the
-    // policy's expiry is carried at the install layer (MandateSpec +
-    // validUntilLedger) instead.
-    z.object({
-      kind: z.literal('invocation_count_in_window'),
-      windowSecs: z.number().int().positive(),
-    }),
-    z.object({ kind: z.literal('oracle_price'), asset: z.string() }),
-    z.object({
-      kind: z.literal('oracle_threshold'),
-      value: z.string().regex(/^-?[0-9]+$/),
-      decimals: z.number().int().nonnegative(),
-    }),
     z.object({ kind: z.literal('literal_address'), value: z.string() }),
     z.object({ kind: z.literal('literal_i128'), value: z.string().regex(/^-?[0-9]+$/) }),
     z.object({ kind: z.literal('literal_symbol'), value: z.string() }),
@@ -339,39 +212,23 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
       kind: z.literal('literal_u32'),
       value: z.number().int().nonnegative().max(U32_MAX),
     }),
-    z.object({ kind: z.literal('literal_u64'), value: z.string().regex(/^[0-9]+$/) }),
-    // `literal_bytes` is hex on chain. `Buffer.from(value, 'hex')` silently
-    // drops non-hex chars AND yields an empty buffer when the whole input
-    // is non-hex - so a user passing 'zzzz' would get a predicate that
-    // compares against empty bytes instead of being rejected. The
-    // strict even-length hex regex closes that gap at the boundary.
-    z.object({
-      kind: z.literal('literal_bytes'),
-      value: z
-        .string()
-        .regex(/^[0-9a-fA-F]*$/)
-        .refine((v) => v.length % 2 === 0, 'must be even-length hex'),
-    }),
     // elements are themselves PredicateLeaf; lazy to break the cycle.
     z.object({ kind: z.literal('literal_vec'), elements: z.array(PredicateLeafSchema) }),
   ])
 )
 
 /** PredicateNode mirrors the core `PredicateNode` union. Recursive through
- *  `and`/`or`/`not`; the lazy + annotation pattern keeps the recursion
- *  type-safe. */
+ *  `and`; the lazy + annotation pattern keeps the recursion type-safe. */
 export const PredicateNodeSchema: z.ZodType<unknown> = z.lazy(() =>
   z.union([
     z.object({ op: z.literal('and'), children: z.array(PredicateNodeSchema) }),
-    z.object({ op: z.literal('or'), children: z.array(PredicateNodeSchema) }),
-    z.object({ op: z.literal('not'), child: PredicateNodeSchema }),
     z.object({
       op: z.literal('eq'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
     z.object({
-      op: z.enum(['lt', 'lte', 'gt', 'gte']),
+      op: z.literal('lte'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
@@ -385,42 +242,18 @@ export const PredicateNodeSchema: z.ZodType<unknown> = z.lazy(() =>
 
 // ===== simulate_policy / verify_policy =====
 //
-// The oracle fixture shape mirrors `SimulateOptions` / `VerifyOptions`
-// in packages/policy-synth/src/verify/{simulate,verify}.ts - the same
-// sorted set of error enum values is used by both engines. u32
-// `validUntilLedger` is bounded at the boundary so a hand-crafted
-// payload cannot leak a u32 overflow into the engine's permit context.
-
-/** Oracle price fixture - mirror of the entry type in `SimulateOptions` /
- *  `VerifyOptions`. Discriminated by presence of `error` vs `price`. */
-export const OraclePriceFixtureSchema = z.union([
-  z.object({
-    price: z.string().regex(/^[0-9]+$/),
-    timestampSeconds: z.number().int().nonnegative(),
-  }),
-  z.object({
-    error: z.enum(['stale', 'missing', 'deviation', 'paused', 'decimals', 'fingerprint']),
-  }),
-])
-
+// Both tools evaluate the same predicate against the same recording, so they
+// take the same input. A null predicate used to mean "OZ built-in policies
+// only"; that backend is gone, so every policy carries a predicate and there is
+// nothing to simulate without one.
 export const SimulatePolicyInputSchema = z.object({
-  // simulatePolicy accepts a null predicate (OZ-only policy); verifyPolicy
-  // does not. The asymmetry is mirrored at the schema boundary.
-  predicate: PredicateNodeSchema.nullable(),
+  predicate: PredicateNodeSchema,
   permitTx: RecordedTransactionSchema,
   validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
 })
 export type SimulatePolicyInput = z.infer<typeof SimulatePolicyInputSchema>
 
-export const VerifyPolicyInputSchema = z.object({
-  // verifyPolicy requires a non-null predicate; the engine refuses
-  // `null` outright. The schema mirrors that contract.
-  predicate: PredicateNodeSchema,
-  permitTx: RecordedTransactionSchema,
-  validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
-})
+export const VerifyPolicyInputSchema = SimulatePolicyInputSchema
 export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>
 
 // ===== install_policy / revoke_policy / get_interpreter_info =====
@@ -435,7 +268,7 @@ export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>
 // optional `grammar_version()` RPC call to check whether the deployed contract
 // matches the pin. A mismatch is worth MORE than a fabricated audit field.
 //
-// All three input schemas live BELOW the MandateSpecSchemaForRule declaration
+// All three input schemas live BELOW the ContextRuleDraftSchema declaration
 // so the const reference there is not in the temporal dead zone (no JS hoisting
 // for `const`).
 
@@ -448,7 +281,7 @@ export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>
 const MAX_SIGNERS_PER_RULE = 15
 const MAX_POLICIES_PER_RULE = 5
 
-const MandateSpecSchemaForRule = z
+const ContextRuleDraftSchema = z
   .object({
     contextRuleType: z.discriminatedUnion('kind', [
       z.object({ kind: z.literal('default') }),
@@ -471,21 +304,11 @@ const MandateSpecSchemaForRule = z
       .max(MAX_SIGNERS_PER_RULE),
     policies: z
       .array(
-        z.discriminatedUnion('kind', [
-          z.object({
-            kind: z.literal('interpreter'),
-            interpreterAddress: z.string(),
-            predicateBlobBase64: z.string().min(1),
-          }),
-          z.object({
-            kind: z.literal('oz_builtin'),
-            primitive: z.object({
-              primitive: z.enum(['spending_limit', 'simple_threshold', 'weighted_threshold']),
-              params: z.record(z.unknown()),
-            }),
-            instanceAddress: z.string(),
-          }),
-        ])
+        z.object({
+          kind: z.literal('interpreter'),
+          interpreterAddress: z.string(),
+          predicateBlobBase64: z.string().min(1),
+        })
       )
       .max(MAX_POLICIES_PER_RULE),
   })
@@ -502,23 +325,28 @@ const MandateSpecSchemaForRule = z
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 export const PINNED_INTERPRETER_TESTNET_ADDRESS =
-  'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP'
-
-/** Pinned interpreter address (mainnet). Mainnet
- *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
- *  that was exercised on testnet (same wasm sha256, see
- *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing. */
+  'CCL336TCK2Y5OFNRCMN2M3HVPBCEX4PW5H6EQ5VW5NPMXOCP4ESB5XR4'
+
+/** Pinned interpreter address (mainnet), redeployed 2026-08-22 from a reproducible build. The mainnet
+ *  interpreter IS the binary exercised on testnet - both instances were created
+ *  from the same uploaded wasm hash (see PINNED_INTERPRETER_WASM_SHA256), and
+ *  both were read back with `grammar_version()` returning 3. The address differs
+ *  because instance ids are network-scoped. UNAUDITED at the time of writing.
+ *
+ *  These four constants move together or not at all. The grammar version and
+ *  wasm hash are single values covering BOTH networks, so re-pinning one network
+ *  alone would have the builder emit a version the other network refuses - with
+ *  a green test run, since `grammar-version-parity.test.ts` would then pass. */
 export const PINNED_INTERPRETER_MAINNET_ADDRESS =
-  'CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2'
+  'CBZXLSTQUITBFZHQH6XRXF3XIVRQR4RHRI64Q5WELS5KGY3ZKJPFWDPF'
 
 /** Pinned interpreter wasm sha256 (hex). */
 export const PINNED_INTERPRETER_WASM_SHA256 =
-  '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443'
+  'a2b36e8ac5a61caf3757af26aa79e83f2995b451099f44772383806a55fe3414'
 
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
-export const PINNED_INTERPRETER_GRAMMAR_VERSION = 1
+export const PINNED_INTERPRETER_GRAMMAR_VERSION = 3
 
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
@@ -545,10 +373,6 @@ export const RPC_URL_BY_NETWORK: Record<Network, string> = {
   mainnet: MAINNET_RPC_URL,
 }
 
-/** Soroban `valid_until` window (ledgers) added to the latest ledger when
- *  building the auth entry. ~25 minutes at 5s/ledger. */
-export const DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300
-
 /** Stellar network passphrases. Pinned here so the XDR envelope uses the
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */
@@ -587,7 +411,7 @@ export const InstallPolicyInputSchema = z
      *  pin and RPC pin do not move by themselves). */
     network: NetworkSchema.optional(),
     /** The proposed rule draft. Mirrors the core `ContextRuleDraft` shape. */
-    rule: MandateSpecSchemaForRule,
+    rule: ContextRuleDraftSchema,
     /** Per-rule install nonce; 1 for a fresh install. */
     installNonce: z.number().int().positive(),
     /** Optional RPC URL override. Defaults to the pinned RPC for the