@crediolabs/policy-synth 0.1.18 → 0.3.0

package/dist/run/index.js

@@ -18,16 +18,16 @@
 // drive the CLI (which calls into the same core directly without MCP).
 import { createHash } from 'node:crypto';
 import { rpc } from '@stellar/stellar-sdk';
-import { placeholderOzConfig, recordTransaction, synthesizeFromMandate, synthesizeFromRecording, } from "../index.js";
+import { recordTransaction, synthesizeFromRecording, } from "../index.js";
 import { buildInstallPolicyXdr, buildRevokePolicyXdr, rpcClientFromServer, } from "../install/build-install-policy.js";
 import { getInterpreterInfo } from "../install/get-interpreter-info.js";
-import { simulatePolicy, verifyPolicy } from "../verify/index.js";
+import { evaluate, generateCases } from "../simulate/index.js";
 import { GetInterpreterInfoInputSchema, InstallPolicyInputSchema, NETWORK_PASSPHRASES, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_WASM_SHA256, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SimulatePolicyInputSchema, SynthesizePolicyInputSchema, VerifyPolicyInputSchema, } from "./schemas.js";
 // Re-export the underlying Zod schemas so the MCP package (and any other
 // downstream consumer) can import the canonical input shapes from the same
 // module that owns the tool-body glue. The strict schemas are the source of
 // truth - MCP tool shapes are derived from them.
-export { ComposeUserResponsesSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, MandateSpecSchema, NetworkSchema, OraclePriceFixtureSchema, OzAdapterConfigSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SimulatePolicyInputSchema, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, VerifyPolicyInputSchema, } from "./schemas.js";
+export { ComposeUserResponsesSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, NetworkSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, } from "./schemas.js";
 /** Map every tool name to its canonical domain error code. Replaces a 7-way
  *  if/else so adding a tool adds one line here rather than a new branch in
  *  each envelope call. */
@@ -54,10 +54,7 @@ const TOOL_ERROR_CODE = {
 export async function runRecordTransaction(raw) {
     const parsed = RecordTransactionInputSchema.safeParse(raw);
     if (!parsed.success) {
-        return {
-            ok: false,
-            error: validationError('record_transaction', parsed.error.issues),
-        };
+        return { ok: false, error: validationError('record_transaction', parsed.error.issues) };
     }
     const input = parsed.data;
     // Strip the wire-only `confidenceOverride` and pass the rest straight through.
@@ -73,14 +70,10 @@ export async function runRecordTransaction(raw) {
         return await recordTransaction(coreInput);
     }
     catch (e) {
-        return {
-            ok: false,
-            error: caughtError('record_transaction', 'RECORDING_FAILED', e),
-        };
+        return toolFailure('record_transaction', e);
     }
 }
 /** `synthesize_policy` body - discriminated union on `source`:
- *    - `mandate`   -> synthesizeFromMandate
  *    - `recording` -> synthesizeFromRecording
  *  Exposing BOTH front-ends through ONE tool keeps the MCP surface tiny while
  *  letting the agent pick the deterministic or the inferred path. The CLI
@@ -94,21 +87,10 @@ export async function runRecordTransaction(raw) {
 export async function runSynthesizePolicy(raw) {
     const parsed = SynthesizePolicyInputSchema.safeParse(raw);
     if (!parsed.success) {
-        return {
-            ok: false,
-            error: validationError('synthesize_policy', parsed.error.issues),
-        };
+        return { ok: false, error: validationError('synthesize_policy', parsed.error.issues) };
     }
     const input = parsed.data;
-    const ozConfig = resolveOzConfig(input);
     try {
-        if (input.source === 'mandate') {
-            // Zod's optional fields widen to `T | undefined`, which the core's
-            // exact-optional MandateSpec rejects; the schema already validated the
-            // shape, so assert it (same pattern as the recordedTx cast below).
-            return await synthesizeFromMandate(input.mandate, ozConfig, input.explain === true ? { explain: true } : {});
-        }
-        // recording source
         const recorded = input.recordedTx;
         return await synthesizeFromRecording(recorded, {
             network: input.network,
@@ -118,112 +100,16 @@ export async function runSynthesizePolicy(raw) {
                 : {}),
             ...(input.interpreter !== undefined ? { interpreter: input.interpreter } : {}),
             ...(input.explain === true ? { explain: true } : {}),
-        }, ozConfig);
-    }
-    catch (e) {
-        return {
-            ok: false,
-            error: caughtError('synthesize_policy', 'SYNTHESIS_ERROR', e),
-        };
-    }
-}
-function resolveOzConfig(input) {
-    if (input.ozConfig)
-        return input.ozConfig;
-    // The mandate path is network-agnostic; fall back to mainnet so the
-    // placeholder OZ instance addresses are deterministic.
-    return placeholderOzConfig('mainnet');
-}
-/** `simulate_policy` body - thin wrapper over `simulatePolicy`. The engine
- *  already returns fail-closed `{ok:false, error}` for runtime failures
- *  (SIMULATION_ERROR), so the try/catch envelope is for raw SDK throws
- *  only - same pattern as the other two wrappers. The predicate is
- *  passed inline (stateless by design; no `proposed_policy_id` lookup). */
-export async function runSimulatePolicy(raw) {
-    const parsed = SimulatePolicyInputSchema.safeParse(raw);
-    if (!parsed.success) {
-        return {
-            ok: false,
-            error: validationError('simulate_policy', parsed.error.issues),
-        };
-    }
-    const input = parsed.data;
-    try {
-        // The recursive PredicateNodeSchema + ContractInvocationSchema are
-        // typed `z.ZodType<unknown>` to survive TS's circular inference; the
-        // engine wants typed `PredicateNode | null` + `RecordedTransaction`.
-        // The schema already validated the shape, so assert through the
-        // unknown back to the core types. Same pattern as the recordedTx
-        // cast in `runSynthesizePolicy`.
-        return simulatePolicy(input.predicate, input.permitTx, {
-            ...(input.validUntilLedger !== undefined
-                ? { validUntilLedger: input.validUntilLedger }
-                : {}),
-            ...(input.oraclePricesByAsset !== undefined
-                ? { oraclePricesByAsset: input.oraclePricesByAsset }
-                : {}),
         });
     }
     catch (e) {
-        return {
-            ok: false,
-            error: caughtError('simulate_policy', 'SIMULATION_ERROR', e),
-        };
+        return toolFailure('synthesize_policy', e);
     }
 }
-/** `verify_policy` body - thin wrapper over `verifyPolicy`. The engine
- *  already returns `{ok:false, error}` with code VERIFICATION_FAILED when
- *  the minimality check fails; the try/catch envelope is for raw SDK
- *  throws only. Mirrors `runSimulatePolicy` exactly. */
-export async function runVerifyPolicy(raw) {
-    const parsed = VerifyPolicyInputSchema.safeParse(raw);
-    if (!parsed.success) {
-        return {
-            ok: false,
-            error: validationError('verify_policy', parsed.error.issues),
-        };
-    }
-    const input = parsed.data;
-    try {
-        // Same cast as runSimulatePolicy: the recursive schemas are typed
-        // `unknown`; the engine wants typed `PredicateNode` +
-        // `RecordedTransaction`. The schema already validated the shape.
-        return verifyPolicy(input.predicate, input.permitTx, {
-            ...(input.validUntilLedger !== undefined ? { validUntilLedger: input.validUntilLedger } : {}),
-            ...(input.oraclePricesByAsset !== undefined
-                ? { oraclePricesByAsset: input.oraclePricesByAsset }
-                : {}),
-        });
-    }
-    catch (e) {
-        return {
-            ok: false,
-            error: caughtError('verify_policy', 'VERIFICATION_FAILED', e),
-        };
-    }
-}
-/** `install_policy` body - thin wrapper over `buildInstallPolicyXdr`.
- *  Returns the unsigned Soroban transaction envelope (base64 XDR) the
- *  wallet signs. The wallet signature IS the user-confirmation step - no
- *  `action_id` two-call pair (the server is stateless, see server.ts:10-12).
- *  One call installs the policy outright: `add_context_rule` carries the
- *  predicate to the interpreter in its `policies` install_param, so no
- *  separate `interpreter.install` call is needed or possible.
- *
- *  Default-deny: an interpreter policy address other than the pinned
- *  interpreter for the selected network is REFUSED (the smart account
- *  would delegate to an interpreter the caller controls); the same
- *  applies to a non-pinned RPC URL (the auth nonce the wallet signs
- *  comes from the RPC). Both gates accept an explicit opt-in flag.
- *  Pin selection follows `input.network` (defaults to `testnet` so the
- *  pre-mainnet callers keep working unchanged). */
 export async function runInstallPolicy(raw) {
     const parsed = InstallPolicyInputSchema.safeParse(raw);
     if (!parsed.success) {
-        return {
-            ok: false,
-            error: validationError('install_policy', parsed.error.issues),
-        };
+        return { ok: false, error: validationError('install_policy', parsed.error.issues) };
     }
     const input = parsed.data;
     const network = input.network ?? 'testnet';
@@ -243,10 +129,7 @@ export async function runInstallPolicy(raw) {
         rpcClient = buildRpcClientFromInput(input.rpcUrl, network);
     }
     catch (e) {
-        return {
-            ok: false,
-            error: caughtError('install_policy', 'INSTALL_BUILD_FAILED', e),
-        };
+        return toolFailure('install_policy', e);
     }
     try {
         const interpreterPolicy = input.rule.policies.find((p) => p.kind === 'interpreter');
@@ -268,10 +151,7 @@ export async function runInstallPolicy(raw) {
         return { ok: true, data: result };
     }
     catch (e) {
-        return {
-            ok: false,
-            error: caughtError('install_policy', 'INSTALL_BUILD_FAILED', e),
-        };
+        return toolFailure('install_policy', e);
     }
 }
 /** `revoke_policy` body - thin wrapper over `buildRevokePolicyXdr`.
@@ -286,10 +166,7 @@ export async function runInstallPolicy(raw) {
 export async function runRevokePolicy(raw) {
     const parsed = RevokePolicyInputSchema.safeParse(raw);
     if (!parsed.success) {
-        return {
-            ok: false,
-            error: validationError('revoke_policy', parsed.error.issues),
-        };
+        return { ok: false, error: validationError('revoke_policy', parsed.error.issues) };
     }
     const input = parsed.data;
     const network = input.network ?? 'testnet';
@@ -303,10 +180,7 @@ export async function runRevokePolicy(raw) {
         rpcClient = buildRpcClientFromInput(input.rpcUrl, network);
     }
     catch (e) {
-        return {
-            ok: false,
-            error: caughtError('revoke_policy', 'REVOKE_BUILD_FAILED', e),
-        };
+        return toolFailure('revoke_policy', e);
     }
     try {
         const result = await buildRevokePolicyXdr({
@@ -320,10 +194,7 @@ export async function runRevokePolicy(raw) {
         return { ok: true, data: result };
     }
     catch (e) {
-        return {
-            ok: false,
-            error: caughtError('revoke_policy', 'REVOKE_BUILD_FAILED', e),
-        };
+        return toolFailure('revoke_policy', e);
     }
 }
 /** `get_interpreter_info` body - thin wrapper over `getInterpreterInfo`.
@@ -345,14 +216,105 @@ export async function runRevokePolicy(raw) {
  *  a non-pinned `rpcUrl` would silently bind the caller to a host they
  *  picked. The pin is enforced here too, with the same `allowUnpinnedRpcUrl`
  *  opt-in as install/revoke. */
-export async function runGetInterpreterInfo(raw) {
-    const parsed = GetInterpreterInfoInputSchema.safeParse(raw);
+/** The call a predicate is evaluated against: the single top-level invocation
+ *  the smart account authorises. `Policy::enforce` receives one `Context`, not
+ *  a sub-invocation tree, so simulating anything deeper would claim a
+ *  guarantee the contract does not make. */
+function evalContextFromRecording(tx) {
+    const top = tx.invocations[0];
+    if (!top)
+        return null;
+    return { contract: top.contract, fn: top.fn, args: top.args };
+}
+/** Both `simulate_policy` and `verify_policy` evaluate against a context derived
+ *  from `permitTx`; neither has anything to evaluate when the recording carries
+ *  no top-level invocation. */
+function noInvocationError(toolName) {
+    return {
+        code: TOOL_ERROR_CODE[toolName],
+        message: `${toolName}: permitTx carries no invocation to evaluate`,
+        severity: 'error',
+        retryable: false,
+    };
+}
+/** `simulate_policy` body - evaluate a predicate against one recorded call.
+ *
+ *  The evaluator is a second implementation of the on-chain semantics, and the
+ *  conformance harness asserts it agrees with the Rust interpreter case for
+ *  case. A verdict here is therefore a claim about what the contract would do,
+ *  not a guess. */
+export function runSimulatePolicy(raw) {
+    const parsed = SimulatePolicyInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return { ok: false, error: validationError('simulate_policy', parsed.error.issues) };
+    }
+    const input = parsed.data;
+    const ctx = evalContextFromRecording(input.permitTx);
+    if (!ctx)
+        return { ok: false, error: noInvocationError('simulate_policy') };
+    try {
+        const res = evaluate(input.predicate, ctx);
+        return {
+            ok: true,
+            data: {
+                permitted: res.permit,
+                reason: res.permit ? null : res.reason,
+                call: { contract: ctx.contract, fn: ctx.fn, argCount: ctx.args.length },
+            },
+        };
+    }
+    catch (e) {
+        return toolFailure('simulate_policy', e);
+    }
+}
+/** `verify_policy` body - the permit case plus a generated deny case per
+ *  dimension.
+ *
+ *  Two failure modes are being checked, and they are not the same thing. A
+ *  permit case that denies means the policy is too STRICT: it would refuse the
+ *  very transaction it was synthesised from. A deny case that permits means it
+ *  is too LOOSE: some mutation of that transaction still gets through. `ok` is
+ *  true only when neither holds. */
+export function runVerifyPolicy(raw) {
+    const parsed = VerifyPolicyInputSchema.safeParse(raw);
     if (!parsed.success) {
+        return { ok: false, error: validationError('verify_policy', parsed.error.issues) };
+    }
+    const input = parsed.data;
+    const ctx = evalContextFromRecording(input.permitTx);
+    if (!ctx)
+        return { ok: false, error: noInvocationError('verify_policy') };
+    try {
+        const predicate = input.predicate;
+        const cases = generateCases(predicate, ctx);
+        const permitRes = evaluate(predicate, cases.permit);
+        const denies = cases.denies.map((d) => {
+            const r = evaluate(predicate, d.ctx);
+            return {
+                dimension: d.dimension,
+                denied: !r.permit,
+                reason: r.permit ? null : r.reason,
+            };
+        });
         return {
-            ok: false,
-            error: validationError('get_interpreter_info', parsed.error.issues),
+            ok: true,
+            data: {
+                ok: permitRes.permit && denies.every((d) => d.denied),
+                permit: { permitted: permitRes.permit, reason: permitRes.permit ? null : permitRes.reason },
+                denies,
+                dimensionsCovered: denies.length,
+            },
         };
     }
+    catch (e) {
+        return toolFailure('verify_policy', e);
+    }
+}
+export async function runGetInterpreterInfo(raw) {
+    const parsed = GetInterpreterInfoInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return { ok: false, error: validationError('get_interpreter_info', parsed.error.issues) };
+    }
     const input = parsed.data;
     const network = input.network ?? 'testnet';
     const expectedRpc = RPC_URL_BY_NETWORK[network];
@@ -385,10 +347,7 @@ export async function runGetInterpreterInfo(raw) {
         return { ok: true, data: info };
     }
     catch (e) {
-        return {
-            ok: false,
-            error: caughtError('get_interpreter_info', 'RECORDING_FAILED', e),
-        };
+        return toolFailure('get_interpreter_info', e);
     }
 }
 /** Build an InstallRpcClient from an optional URL override + selected
@@ -442,13 +401,8 @@ function enforceInterpreterPin(policies, allowUnpinned, expectedInterpreterAddre
 function enforceRpcPin(toolName, rpcUrl, allowUnpinned, expectedRpc, network) {
     if (!rpcUrl || rpcUrl === expectedRpc || allowUnpinned === true)
         return null;
-    const code = toolName === 'install_policy'
-        ? 'INSTALL_BUILD_FAILED'
-        : toolName === 'revoke_policy'
-            ? 'REVOKE_BUILD_FAILED'
-            : 'RECORDING_FAILED';
     return {
-        code,
+        code: TOOL_ERROR_CODE[toolName],
         message: `${toolName}: rpcUrl must equal the pinned ${expectedRpc} (${network}); set allowUnpinnedRpcUrl: true to opt in to a custom endpoint`,
         severity: 'error',
         retryable: false,
@@ -475,6 +429,11 @@ function validationError(toolName, issues) {
  *  error in `details` for the agent to inspect. Exported as a test-only seam
  *  so the suite in run/index.test.ts can drive the envelope path without
  *  standing up a full recordTransaction pipeline. */
+/** The fail-closed return every tool body uses in its `catch`. Taking only the
+ *  tool name keeps the tool -> error-code mapping in TOOL_ERROR_CODE alone. */
+function toolFailure(toolName, e) {
+    return { ok: false, error: caughtError(toolName, TOOL_ERROR_CODE[toolName], e) };
+}
 export function caughtError(toolName, code, e) {
     return {
         code,