@crediolabs/policy-synth 0.2.0 → 0.3.0

package/dist/adapters/oz/adapter.js

@@ -6,7 +6,7 @@
 //   expiry.validUntilLedger   -> ContextRuleDraft.validUntilLedger
 //   window_spent(t,w) <= L    -> `spending_limit` primitive
 //   approval.threshold        -> `simple_threshold` / `weighted_threshold`
-// Anything needing a capability this backend lacks (oracle price, invocation
+// Anything needing a capability this backend lacks (invocation
 // count, per-arg comparison/allowlist, guard, nested boolean predicate) is NOT
 // emitted: it is named in `uncovered` and `covered` is set false. Nothing is
 // silently dropped.
@@ -40,8 +40,6 @@ const CAPABILITIES = {
     supportsSpendWindow: true,
     supportsThreshold: true,
     supportsTimeExpiry: true,
-    supportsOraclePrice: false,
-    supportsInvocationCount: false,
     supportsGeneralPredicate: false,
 };
 export function createOzAdapter(config) {
@@ -206,10 +204,6 @@ function matchSpendingLimit(c) {
  *  cannot express, used to populate `uncovered`. */
 function describeCondition(cond) {
     switch (cond.op) {
-        case 'slippage_floor':
-            // OZ primitives bound a value against a constant; this bounds one call
-            // argument against another, which none of them can express.
-            return `slippage floor on arg[${cond.outArgIndex}] (OZ built-ins cannot bound one argument against another)`;
         case 'in':
             return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`;
         case 'eq_seq':
@@ -222,10 +216,6 @@ function describeCondition(cond) {
         case 'compare': {
             const s = cond.compare.selector;
             switch (s.kind) {
-                case 'oracle_price':
-                    return `oracle price condition on ${s.asset} (oracle price not supported in week-1)`;
-                case 'invocation_count':
-                    return `invocation-count window (${s.windowSeconds}s) condition (not supported in week-1)`;
                 case 'window_spent':
                     return `spend-window comparison with operator '${cond.compare.operator}' (only 'lte' lowers to spending_limit)`;
                 case 'amount':
@@ -259,10 +249,6 @@ function describeSelector(s) {
             return `amount(${s.token})`;
         case 'window_spent':
             return `window_spent(${s.token})`;
-        case 'oracle_price':
-            return `oracle_price(${s.asset})`;
-        case 'invocation_count':
-            return `invocation_count(${s.windowSeconds}s)`;
         case 'calldata':
             return `calldata[${s.offset}:${s.offset + s.length}]`;
         default:

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type ErrorCode = 'RECORDING_FAILED' | 'RECORDING_VALIDATION_FAILED' | 'SCOPE_UNRESOLVED' | 'SYNTHESIS_ERROR' | 'MALFORMED_PREDICATE' | 'SIMULATION_ERROR' | 'VERIFICATION_FAILED' | 'DENY_CASE_FAILURE' | 'PERMIT_CASE_FAILED' | 'SUMMARY_DRIFT' | 'INSTALL_BUILD_FAILED' | 'INSTALL_CONFIRM_MISSING' | 'INSTALL_CONFIRM_EXPIRED' | 'REVOKE_BUILD_FAILED' | 'REVOKE_CONFIRM_MISSING' | 'USER_REJECTED_SIGN' | 'WALLET_TIMEOUT' | 'WALLET_UNAVAILABLE' | 'PREDICATE_TOO_LARGE' | 'PREDICATE_TOO_DEEP' | 'TOO_MANY_LEAVES' | 'IN_OPERAND_LIMIT' | 'PREDICATE_ORACLE_OVER_LIMIT' | 'POLICY_CAP_EXCEEDED' | 'WASM_TOO_LARGE' | 'MASTER_AUTH_REQUIRED' | 'NONCE_REPLAY' | 'VERSION_MISMATCH' | 'ARITHMETIC_OVERFLOW' | 'AMOUNT_OVERFLOW' | 'RULE_SIGNERS_CHANGED' | 'SCOPE_SELF_CALL' | 'ARG_MISMATCH' | 'CONTRACT_SCOPE' | 'UNSUPPORTED_NODE' | 'STATEFUL_BOUND' | 'NOT_IN_ALLOWLIST' | 'FREQUENCY' | 'SLIPPAGE_FLOOR' | 'ORACLE_STALE' | 'ORACLE_MISSING' | 'ORACLE_NO_CONFIRMATION' | 'ORACLE_DEVIATION_EXCEEDED' | 'ORACLE_MALFORMED_HISTORY' | 'ORACLE_FINGERPRINT_DRIFT' | 'ORACLE_PAUSED' | 'ORACLE_LEAF_INVALID_POSITION' | 'ORACLE_PARAMS_OUT_OF_RANGE' | 'ORACLE_DECIMALS_MISMATCH' | 'ORACLE_THRESHOLD_DECIMALS_OUT_OF_RANGE' | 'ORACLE_THRESHOLD_BASIS_REQUIRED' | 'COMPILE_OK' | 'COMPILE_GATE_FAILED';
+export type ErrorCode = 'RECORDING_FAILED' | 'RECORDING_VALIDATION_FAILED' | 'SCOPE_UNRESOLVED' | 'SYNTHESIS_ERROR' | 'MALFORMED_PREDICATE' | 'SIMULATION_ERROR' | 'VERIFICATION_FAILED' | 'DENY_CASE_FAILURE' | 'PERMIT_CASE_FAILED' | 'SUMMARY_DRIFT' | 'INSTALL_BUILD_FAILED' | 'INSTALL_CONFIRM_MISSING' | 'INSTALL_CONFIRM_EXPIRED' | 'REVOKE_BUILD_FAILED' | 'REVOKE_CONFIRM_MISSING' | 'USER_REJECTED_SIGN' | 'WALLET_TIMEOUT' | 'WALLET_UNAVAILABLE' | 'PREDICATE_TOO_LARGE' | 'PREDICATE_TOO_DEEP' | 'TOO_MANY_LEAVES' | 'IN_OPERAND_LIMIT' | 'POLICY_CAP_EXCEEDED' | 'WASM_TOO_LARGE' | 'MASTER_AUTH_REQUIRED' | 'NONCE_REPLAY' | 'VERSION_MISMATCH' | 'ARITHMETIC_OVERFLOW' | 'AMOUNT_OVERFLOW' | 'RULE_SIGNERS_CHANGED' | 'SCOPE_SELF_CALL' | 'ARG_MISMATCH' | 'CONTRACT_SCOPE' | 'UNSUPPORTED_NODE' | 'STATEFUL_BOUND' | 'NOT_IN_ALLOWLIST' | 'COMPILE_OK' | 'COMPILE_GATE_FAILED';
 export interface ToolError {
     code: ErrorCode;
     message: string;

package/dist/index.d.ts

@@ -1,11 +1,8 @@
-export * from './adapters/oz/index.ts';
 export * from './errors.ts';
-export * from './ir/index.ts';
-export * from './mandate/index.ts';
 export * from './predicate/index.ts';
 export * from './record/index.ts';
 export * from './registry/index.ts';
 export * from './review-card/index.ts';
-export * from './seams/index.ts';
+export * from './simulate/index.ts';
 export * from './synth/index.ts';
 export * from './types.ts';

package/dist/index.js

@@ -1,11 +1,8 @@
-export * from "./adapters/oz/index.js";
 export * from "./errors.js";
-export * from "./ir/index.js";
-export * from "./mandate/index.js";
 export * from "./predicate/index.js";
 export * from "./record/index.js";
 export * from "./registry/index.js";
 export * from "./review-card/index.js";
-export * from "./seams/index.js";
+export * from "./simulate/index.js";
 export * from "./synth/index.js";
 export * from "./types.js";

package/dist/install/build-add-context-rule.d.ts

@@ -8,8 +8,8 @@ export interface BuildAddContextRuleArgs {
      *  admin session. The deployer signs the install call via the admin rule
      *  already on the account, which is separate from this list. */
     signers: SignerDraft[];
-    /** The policy(ies) to attach to the new rule. Only `interpreter` refs
-     *  reach the wire today; `oz_builtin` is reserved for Phase 06 follow-ups. */
+    /** The policy(ies) to attach to the new rule. `interpreter` is the only
+     *  kind: the OpenZeppelin built-in backend was removed. */
     policies: PolicyRef[];
     /** Per-policy install nonce; 1 for a fresh install. */
     installNonce: number;
@@ -19,19 +19,11 @@ export interface BuildAddContextRuleArgs {
     encodedPredicate: string;
     /** Hex sha256 of the canonical predicate XDR bytes. */
     predicateHash: string;
-    /** Per-policy oracle overrides. Absent on any key uses the wasm default. */
-    oracleParams?: {
-        maxStalenessSeconds?: number;
-        maxDeviationBps?: number;
-        /** Bound between the primary and secondary feeds. Tighten-only against
-         *  the wasm default, like the other two. */
-        maxCrossFeedDeviationBps?: number;
-    };
     /** Hard pin to the interpreter's wasm grammar. Refusing here fails closed
      *  before the chain does; the contract will refuse a mismatch again. */
     grammarVersion?: number;
 }
-export declare const DEFAULT_GRAMMAR_VERSION: 1;
+export declare const DEFAULT_GRAMMAR_VERSION: 3;
 /** The verb `add_context_rule` takes on the wire. */
 export declare const ADD_CONTEXT_RULE_SYMBOL: "add_context_rule";
 /** Tuple of `ScVal` arguments to pass to `Operation.invokeHostFunction` for
@@ -46,11 +38,3 @@ export type AddContextRuleArgs = readonly [
 /** Build the `add_context_rule` invocation args. Throws a `ToolError`-shaped
  *  error on limit breaches or malformed input. */
 export declare function buildAddContextRuleArgs(draft: ContextRuleDraft, args: BuildAddContextRuleArgs): AddContextRuleArgs;
-/** The `PolicyInstallParams` ScVal an interpreter policy receives.
- *
- *  Exported so the merge remedy can re-install a policy through `add_policy`
- *  using the SAME encoder as a fresh install. Re-implementing it would risk
- *  exactly the drift this file warns about: the field order is ABI-significant
- *  and a differing encoding yields a rule that denies every call. */
-export type PolicyInstallParamArgs = Pick<BuildAddContextRuleArgs, 'encodedPredicate' | 'predicateHash' | 'installNonce' | 'oracleParams' | 'grammarVersion'>;
-export declare function encodePolicyInstallParams(args: PolicyInstallParamArgs): xdr.ScVal;

package/dist/install/build-add-context-rule.js

@@ -48,8 +48,8 @@
 // the account refuses with `Error(Auth, InvalidAction)`.
 import { createHash } from 'node:crypto';
 import { Address, xdr } from '@stellar/stellar-sdk';
-import { OZ_LIMITS, } from "../types.js";
-export const DEFAULT_GRAMMAR_VERSION = 1;
+import { GRAMMAR_VERSION, OZ_LIMITS, } from "../types.js";
+export const DEFAULT_GRAMMAR_VERSION = GRAMMAR_VERSION;
 /** The verb `add_context_rule` takes on the wire. */
 export const ADD_CONTEXT_RULE_SYMBOL = 'add_context_rule';
 /** Build the `add_context_rule` invocation args. Throws a `ToolError`-shaped
@@ -65,15 +65,6 @@ export function buildAddContextRuleArgs(draft, args) {
     if (args.signers.length === 0 && args.policies.length === 0) {
         throw limitError('INSTALL_BUILD_FAILED', 'a rule with no signers and no policies is refused at install (NoSignersAndPolicies)');
     }
-    // OZ's spending_limit caps spend on the CONTEXT CONTRACT - it takes no
-    // token argument - so it refuses a Default rule on chain with a bare
-    // #3227. Say which rule shape it needs here, before the encoding, rather
-    // than letting the user read a numeric trap.
-    if (args.policies.some((p) => p.kind === 'oz_builtin' && p.primitive.primitive === 'spending_limit')) {
-        if (draft.contextRuleType.kind !== 'call_contract') {
-            throw limitError('INSTALL_BUILD_FAILED', `spending_limit caps spend on the rule's context contract, so the rule must be call_contract-scoped to that token - a "${draft.contextRuleType.kind}" rule is refused on chain (#3227)`);
-        }
-    }
     // ---- 2. context_type encoding ----
     const contextType = encodeContextRuleType(draft.contextRuleType);
     // ---- 3. name (string) + valid_until (Option<u32>) ----
@@ -95,15 +86,6 @@ const POLICY_INSTALL_PARAM_FIELDS = [
     'install_nonce',
     'predicate',
     'predicate_hash',
-    'oracle_max_staleness_seconds',
-    'oracle_max_deviation_bps',
-    // Cross-feed divergence bound. A field added to the contract's
-    // `PolicyInstallParams` changes the ABI: the host unpacks the map by field
-    // count, so omitting one fails the entire install with
-    // `Error(Object, UnexpectedSize)` and no indication of which field is
-    // missing. The Rust tests build that struct in Rust and never cross this
-    // boundary, so only a real install against a deployed contract catches it.
-    'oracle_max_xfeed_dev_bps',
 ];
 function encodeContextRuleType(rule) {
     switch (rule.kind) {
@@ -145,76 +127,11 @@ function encodePoliciesMap(args) {
                 val: encodePolicyInstallParams(args),
             }));
         }
-        else if (ref.kind === 'oz_builtin') {
-            entries.push(new xdr.ScMapEntry({
-                key: Address.fromString(ref.instanceAddress).toScVal(),
-                val: encodeOzPrimitiveParams(ref.primitive),
-            }));
-        }
     }
     entries.sort(sortByScValSymbolString);
     return xdr.ScVal.scvMap(entries);
 }
-/** Encode the install params for one OZ built-in policy.
- *
- *  Field names and types are read from the deployed contracts' own spec:
- *    SpendingLimitAccountParams   { period_ledgers: u32, spending_limit: i128 }
- *    SimpleThresholdAccountParams { threshold: u32 }
- *    WeightedThresholdAccountParams { signer_weights: map, threshold: u32 }
- *  Entries are symbol-string ordered for the same reason the interpreter's
- *  are: the host orders by symbol, not by XDR bytes.
- */
-function encodeOzPrimitiveParams(primitive) {
-    const entries = [];
-    const push = (name, val) => entries.push(new xdr.ScMapEntry({ key: xdr.ScVal.scvSymbol(name), val }));
-    const p = primitive.params;
-    switch (primitive.primitive) {
-        case 'spending_limit': {
-            const limit = p.spending_limit;
-            const period = p.period_ledgers;
-            if (typeof limit !== 'string' || typeof period !== 'number') {
-                throw limitError('INSTALL_BUILD_FAILED', 'spending_limit needs { spending_limit: string; period_ledgers: number }');
-            }
-            push('period_ledgers', xdr.ScVal.scvU32(period));
-            push('spending_limit', encodeI128(limit));
-            break;
-        }
-        case 'simple_threshold': {
-            const threshold = p.threshold;
-            if (typeof threshold !== 'number') {
-                throw limitError('INSTALL_BUILD_FAILED', 'simple_threshold needs { threshold: number }');
-            }
-            push('threshold', xdr.ScVal.scvU32(threshold));
-            break;
-        }
-        case 'weighted_threshold': {
-            const threshold = p.threshold;
-            const weights = p.weights;
-            if (typeof threshold !== 'number' || !weights) {
-                throw limitError('INSTALL_BUILD_FAILED', 'weighted_threshold needs { threshold: number; weights: Record<address, number> }');
-            }
-            const weightEntries = Object.entries(weights)
-                .map(([addr, w]) => new xdr.ScMapEntry({
-                key: Address.fromString(addr).toScVal(),
-                val: xdr.ScVal.scvU32(w),
-            }))
-                .sort((a, b) => (a.key().toXDR('base64') < b.key().toXDR('base64') ? -1 : 1));
-            push('signer_weights', xdr.ScVal.scvMap(weightEntries));
-            push('threshold', xdr.ScVal.scvU32(threshold));
-            break;
-        }
-    }
-    entries.sort((a, b) => sortBySymbolString(a.key(), b.key()));
-    return xdr.ScVal.scvMap(entries);
-}
-function encodeI128(value) {
-    const v = BigInt(value);
-    return xdr.ScVal.scvI128(new xdr.Int128Parts({
-        hi: new xdr.Int64(BigInt.asIntN(64, v >> 64n)),
-        lo: new xdr.Uint64(BigInt.asUintN(64, v)),
-    }));
-}
-export function encodePolicyInstallParams(args) {
+function encodePolicyInstallParams(args) {
     const predicate = Buffer.from(args.encodedPredicate, 'base64');
     const computedHash = createHash('sha256').update(predicate).digest('hex');
     if (computedHash !== args.predicateHash) {
@@ -223,15 +140,11 @@ export function encodePolicyInstallParams(args) {
     // Per-field value encoders. Each entry returns the ScVal to drop into the
     // map; the key symbol comes from the surrounding loop. Adding a field is
     // one row here plus the symbol in POLICY_INSTALL_PARAM_FIELDS.
-    const oracleParams = args.oracleParams;
     const valueFor = {
         grammar_version: () => xdr.ScVal.scvU32(args.grammarVersion ?? DEFAULT_GRAMMAR_VERSION),
         install_nonce: () => xdr.ScVal.scvU32(args.installNonce),
         predicate: () => xdr.ScVal.scvBytes(predicate),
         predicate_hash: () => xdr.ScVal.scvBytes(Buffer.from(args.predicateHash, 'hex')),
-        oracle_max_staleness_seconds: () => encodeOptionU32(oracleParams?.maxStalenessSeconds),
-        oracle_max_deviation_bps: () => encodeOptionU32(oracleParams?.maxDeviationBps),
-        oracle_max_xfeed_dev_bps: () => encodeOptionU32(oracleParams?.maxCrossFeedDeviationBps),
     };
     const entries = POLICY_INSTALL_PARAM_FIELDS.map((k) => new xdr.ScMapEntry({ key: xdr.ScVal.scvSymbol(k), val: valueFor[k]() }));
     // The host orders map entries by the SYMBOL STRING, not by XDR bytes. A
@@ -241,14 +154,6 @@ export function encodePolicyInstallParams(args) {
     entries.sort((a, b) => sortBySymbolString(a.key(), b.key()));
     return xdr.ScVal.scvMap(entries);
 }
-function encodeOptionU32(v) {
-    if (v === undefined)
-        return xdr.ScVal.scvVoid();
-    if (!Number.isFinite(v) || v < 0 || v > 0xffffffff) {
-        throw limitError('INSTALL_BUILD_FAILED', `oracle params value ${v} is outside u32 range`);
-    }
-    return xdr.ScVal.scvU32(v);
-}
 /** Sort host-map keys by their symbol-string form. The host orders map
  *  entries by the SYMBOL STRING, not by the key's XDR bytes (a length
  *  prefix in the encoding would otherwise put `amount` before `address`).

package/dist/install/build-install-policy.d.ts

@@ -1,5 +1,5 @@
-import { Contract, rpc, type Transaction } from '@stellar/stellar-sdk';
-import { DEFAULT_GRAMMAR_VERSION } from './build-add-context-rule.ts';
+import { rpc, type Transaction } from '@stellar/stellar-sdk';
+import type { ContextRuleDraft } from '../types.ts';
 /** Minimal Soroban RPC surface the install pipeline needs. Test seams
  *  inject a stub so the builder stays deterministic; production builds
  *  the real one via `createRpcServer` from `../record/rpc.ts`. */
@@ -31,20 +31,14 @@ export interface BuildInstallPolicyArgs {
     sourceAccount: string;
     /** Network passphrase - pins the hash the auth digest binds. */
     networkPassphrase: string;
-    /** The new rule to install. Mirrors the core `ContextRuleDraft`. */
-    rule: BuildInstallPolicyRuleDraft;
+    /** The new rule to install. */
+    rule: ContextRuleDraft;
     /** Per-rule install nonce; 1 for a fresh install. */
     installNonce: number;
     /** Already-encoded (base64) canonical ScVal of the predicate. */
     encodedPredicate: string;
     /** Hex sha256 of the canonical predicate XDR bytes. */
     predicateHash: string;
-    /** Per-policy oracle overrides. */
-    oracleParams?: {
-        maxStalenessSeconds?: number;
-        maxDeviationBps?: number;
-        maxCrossFeedDeviationBps?: number;
-    };
     /** Grammar version override; defaults to 1. */
     grammarVersion?: number;
     /** Base fee in stroops; defaults to BASE_FEE (100). */
@@ -54,41 +48,6 @@ export interface BuildInstallPolicyArgs {
     /** Ledger window (in ledgers) for the auth entry's `validUntil`. */
     authValidUntilLedgers?: number;
 }
-export type BuildInstallPolicyRuleDraft = {
-    contextRuleType: {
-        kind: 'default';
-    } | {
-        kind: 'call_contract';
-        contract: string;
-    } | {
-        kind: 'create_contract';
-        wasmHash: string;
-    };
-    name: string;
-    validUntilLedger: number | null;
-    signers: BuildInstallPolicySignerDraft[];
-    policies: BuildInstallPolicyPolicyRef[];
-};
-export type BuildInstallPolicySignerDraft = {
-    kind: 'delegated';
-    address: string;
-} | {
-    kind: 'external';
-    verifier: string;
-    keyBytes: string;
-};
-export type BuildInstallPolicyPolicyRef = {
-    kind: 'interpreter';
-    interpreterAddress: string;
-    predicateBlobBase64: string;
-} | {
-    kind: 'oz_builtin';
-    instanceAddress: string;
-    primitive: {
-        primitive: 'spending_limit' | 'simple_threshold' | 'weighted_threshold';
-        params: Record<string, unknown>;
-    };
-};
 /** Human-readable description of the install call, decoded FROM the built
  *  XDR (not from the input args). The XDR is the source of truth: a
  *  human approving a review card needs the description to mirror the bytes
@@ -134,10 +93,6 @@ export interface InstallCallDescribes {
         installNonce: number;
         predicateHash: string;
         predicateSha256OfEmbeddedBytes: string;
-    } | {
-        kind: 'oz_builtin';
-        address: string;
-        primitive: 'spending_limit' | 'simple_threshold' | 'weighted_threshold';
     }>;
     /** The install nonce, decoded from the interpreter policy's
      *  `install_nonce` field. Echoed at the top level for reviewer convenience;
@@ -217,7 +172,3 @@ export interface BuildRevokePolicyResult {
     authValidUntilLedger: number;
     rootInvocationXdr: string;
 }
-/** Re-export so the run-layer does not need to import from
- *  build-add-context-rule.ts (keeps the install/ -> install/ dependency
- *  direction intact). */
-export { Contract, DEFAULT_GRAMMAR_VERSION };

package/dist/install/build-install-policy.js

@@ -17,8 +17,8 @@
 // forwards each install_param to that policy, so the interpreter stores the
 // predicate document as part of this same transaction.
 import { createHash } from 'node:crypto';
-import { Address, BASE_FEE, Contract, Keypair, Operation, rpc, scValToBigInt, TransactionBuilder, xdr, } from '@stellar/stellar-sdk';
-import { buildAddContextRuleArgs, DEFAULT_GRAMMAR_VERSION } from "./build-add-context-rule.js";
+import { Account, Address, BASE_FEE, Contract, Keypair, Operation, rpc, scValToBigInt, TransactionBuilder, xdr, } from '@stellar/stellar-sdk';
+import { buildAddContextRuleArgs } from "./build-add-context-rule.js";
 import { accountEntry, authDigest, authPayload, delegatedSignerEntry, signaturePayload, } from "./oz-auth.js";
 /** Convert a real rpc.Server into the InstallRpcClient surface. The
  *  `getContractVersion` lookup uses `simulateTransaction` against
@@ -72,73 +72,21 @@ export async function buildInstallPolicyXdr(args) {
         name: args.rule.name,
         validUntilLedger: args.rule.validUntilLedger,
         signers: args.rule.signers,
-        policies: args.rule.policies.map(adaptPolicyRef),
+        policies: args.rule.policies,
     }, {
         signers: args.rule.signers,
-        policies: args.rule.policies.map(adaptPolicyRef),
+        policies: args.rule.policies,
         installNonce: args.installNonce,
         encodedPredicate: args.encodedPredicate,
         predicateHash: args.predicateHash,
-        ...(args.oracleParams ? { oracleParams: args.oracleParams } : {}),
         ...(args.grammarVersion !== undefined ? { grammarVersion: args.grammarVersion } : {}),
     });
-    // 2. Fetch the source sequence, then build the recording transaction with a
-    //    bare host call. The recording pass assigns the smart-account auth nonce
-    //    and root invocation needed to construct OZ's AuthPayload.
-    const source = await args.rpc.getAccount(args.sourceAccount);
-    const hostFunction = xdr.HostFunction.hostFunctionTypeInvokeContract(new xdr.InvokeContractArgs({
-        contractAddress: new Address(args.smartAccount).toScAddress(),
-        functionName: 'add_context_rule',
-        args: [...callArgs],
-    }));
-    const makeOperation = (auth = []) => Operation.invokeHostFunction({ func: hostFunction, auth });
-    const baseFee = args.baseFee !== undefined ? String(args.baseFee) : BASE_FEE;
-    const buildTx = (op) => buildUnsignedTx({
-        sourceAccount: args.sourceAccount,
-        sequence: source.sequenceNumber(),
-        fee: baseFee,
-        networkPassphrase: args.networkPassphrase,
-        op,
-    });
-    const recordingTx = buildTx(makeOperation());
-    // 3. Recording simulation: capture the smart account's nonce and invocation
-    //    tree. Nothing is signed here.
-    const recorded = await args.rpc.simulateTransaction(recordingTx);
-    if (rpc.Api.isSimulationError(recorded)) {
-        // Short, stable reason. The full `simulateTransaction` error (which
-        // carries host + URL detail) stays in the SDK's own logs - never
-        // reflected back into a user-facing message where it would
-        // reconnoitre the RPC.
-        throw new Error('install_policy: simulateTransaction failed');
-    }
-    const original = (recorded.result?.auth ?? []).find((entry) => entry.credentials().switch().name === 'sorobanCredentialsAddress' &&
-        Address.fromScAddress(entry.credentials().address().address()).toString() ===
-            args.smartAccount);
-    if (!original) {
-        throw new Error(`install_policy: no Soroban auth entry for smart account ${args.smartAccount}; this call does not route through the smart account`);
-    }
-    // 4. `add_context_rule` is authorised by the deploy-time admin rule (rule 0).
+    // 2. `add_context_rule` is authorised by the deploy-time admin rule (rule 0).
     //    The delegated signer uses source-account credentials, so its signature
     //    bytes stay empty and the ordinary transaction-envelope signature covers
     //    the call when the consumer signs it.
-    const validUntilLedger = (await args.rpc.getLatestLedger()).sequence +
-        (args.authValidUntilLedgers ?? DEFAULT_AUTH_VALID_UNTIL_LEDGERS);
-    const contextRuleIds = [0];
-    const digest = authDigest(signaturePayload(args.networkPassphrase, original.credentials().address().nonce(), validUntilLedger, original.rootInvocation()), contextRuleIds);
-    const authEntries = [
-        accountEntry(original, validUntilLedger, authPayload([args.sourceAccount], contextRuleIds, () => Buffer.alloc(0))),
-        ...contextRuleIds.map(() => delegatedSignerEntry(args.smartAccount, digest)),
-    ];
-    // 5. Simulate again with the OZ entries already attached. The SDK preserves
-    //    existing auth during assembly and adds the simulated Soroban footprint +
-    //    resource fee, yielding a complete unsigned envelope.
-    const txWithAuth = buildTx(makeOperation(authEntries));
-    const enforcing = await args.rpc.simulateTransaction(txWithAuth);
-    if (rpc.Api.isSimulationError(enforcing)) {
-        throw new Error('install_policy: auth simulateTransaction failed');
-    }
-    const finalTx = rpc.assembleTransaction(txWithAuth, enforcing).build();
-    // 6. Decode the structured description FROM the final assembled transaction.
+    const { finalTx, original, validUntilLedger } = await buildAuthorisedSmartAccountTx(args, 'add_context_rule', [...callArgs], 'install_policy');
+    // 3. Decode the structured description FROM the final assembled transaction.
     //    The human approval binds to the exact bytes the wallet will sign.
     const describes = decodeInstallCallDescribes(finalTx, args.installNonce);
     return {
@@ -164,11 +112,39 @@ export async function buildInstallPolicyXdr(args) {
  *  deployer can revoke. This builder does not pre-check the signer: it would
  *  be guessing at a contract it cannot read, and the chain is the authority. */
 export async function buildRevokePolicyXdr(args) {
+    // Removal is master-only, so the deploy-time admin rule authorises it. The
+    // recorded rootInvocation still includes remove_context_rule(ruleId), binding
+    // the auth payload to the exact rule being removed. As with install,
+    // source-account credentials carry the delegated signer entry and the
+    // consumer supplies only the ordinary envelope signature.
+    const { finalTx, original, validUntilLedger } = await buildAuthorisedSmartAccountTx(args, 'remove_context_rule', [xdr.ScVal.scvU32(args.ruleId)], 'revoke_policy');
+    return {
+        unsignedXdr: finalTx.toEnvelope().toXDR().toString('base64'),
+        smartAccount: args.smartAccount,
+        sourceAccount: args.sourceAccount,
+        call: { contract: args.smartAccount, fn: 'remove_context_rule', ruleId: args.ruleId },
+        authNonce: original.credentials().address().nonce().toString(),
+        authValidUntilLedger: validUntilLedger,
+        rootInvocationXdr: original.rootInvocation().toXDR().toString('base64'),
+    };
+}
+/** ~25 minutes at 5s/ledger. */
+const DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300;
+// ---- internals ----
+/** Record a bare call to the smart account, attach the deploy-time admin rule's
+ *  auth entries, and re-simulate to assemble the footprint.
+ *
+ *  Install and revoke differ only in the call they wrap, so they share this
+ *  spine: the recording pass supplies the auth nonce and root invocation OZ's
+ *  AuthPayload binds to, and the second simulation adds the Soroban footprint +
+ *  resource fee. Nothing here is signed. `errorPrefix` names the calling tool in
+ *  the fail-closed messages so a caller can still tell which call failed. */
+async function buildAuthorisedSmartAccountTx(args, functionName, callArgs, errorPrefix) {
     const source = await args.rpc.getAccount(args.sourceAccount);
     const hostFunction = xdr.HostFunction.hostFunctionTypeInvokeContract(new xdr.InvokeContractArgs({
         contractAddress: new Address(args.smartAccount).toScAddress(),
-        functionName: 'remove_context_rule',
-        args: [xdr.ScVal.scvU32(args.ruleId)],
+        functionName,
+        args: callArgs,
     }));
     const makeOperation = (auth = []) => Operation.invokeHostFunction({ func: hostFunction, auth });
     const baseFee = args.baseFee !== undefined ? String(args.baseFee) : BASE_FEE;
@@ -185,19 +161,14 @@ export async function buildRevokePolicyXdr(args) {
         // carries host + URL detail) stays in the SDK's own logs - never
         // reflected back into a user-facing message where it would
         // reconnoitre the RPC.
-        throw new Error('revoke_policy: simulateTransaction failed');
+        throw new Error(`${errorPrefix}: simulateTransaction failed`);
     }
     const original = (recorded.result?.auth ?? []).find((entry) => entry.credentials().switch().name === 'sorobanCredentialsAddress' &&
         Address.fromScAddress(entry.credentials().address().address()).toString() ===
             args.smartAccount);
     if (!original) {
-        throw new Error(`revoke_policy: no Soroban auth entry for smart account ${args.smartAccount}; this call does not route through the smart account`);
+        throw new Error(`${errorPrefix}: no Soroban auth entry for smart account ${args.smartAccount}; this call does not route through the smart account`);
     }
-    // Removal is master-only, so the deploy-time admin rule authorises it. The
-    // recorded rootInvocation still includes remove_context_rule(ruleId), binding
-    // the auth payload to the exact rule being removed. As with install,
-    // source-account credentials carry the delegated signer entry and the
-    // consumer supplies only the ordinary envelope signature.
     const validUntilLedger = (await args.rpc.getLatestLedger()).sequence +
         (args.authValidUntilLedgers ?? DEFAULT_AUTH_VALID_UNTIL_LEDGERS);
     const contextRuleIds = [0];
@@ -209,38 +180,12 @@ export async function buildRevokePolicyXdr(args) {
     const txWithAuth = buildTx(makeOperation(authEntries));
     const enforcing = await args.rpc.simulateTransaction(txWithAuth);
     if (rpc.Api.isSimulationError(enforcing)) {
-        throw new Error('revoke_policy: auth simulateTransaction failed');
-    }
-    const finalTx = rpc.assembleTransaction(txWithAuth, enforcing).build();
-    return {
-        unsignedXdr: finalTx.toEnvelope().toXDR().toString('base64'),
-        smartAccount: args.smartAccount,
-        sourceAccount: args.sourceAccount,
-        call: { contract: args.smartAccount, fn: 'remove_context_rule', ruleId: args.ruleId },
-        authNonce: original.credentials().address().nonce().toString(),
-        authValidUntilLedger: validUntilLedger,
-        rootInvocationXdr: original.rootInvocation().toXDR().toString('base64'),
-    };
-}
-/** ~25 minutes at 5s/ledger. */
-const DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300;
-// ---- internals ----
-/** Adapter: turn the install-policy wire `PolicyRef` shape into the core
- *  `PolicyRef` shape `buildAddContextRuleArgs` expects. Keeps the wire
- *  schema hand-rolled + flat (the strict union would need a recursive
- *  schema) while delegating to the proven encoder for the actual bytes. */
-function adaptPolicyRef(p) {
-    if (p.kind === 'interpreter') {
-        return {
-            kind: 'interpreter',
-            interpreterAddress: p.interpreterAddress,
-            predicateBlobBase64: p.predicateBlobBase64,
-        };
+        throw new Error(`${errorPrefix}: auth simulateTransaction failed`);
     }
     return {
-        kind: 'oz_builtin',
-        instanceAddress: p.instanceAddress,
-        primitive: p.primitive,
+        finalTx: rpc.assembleTransaction(txWithAuth, enforcing).build(),
+        original,
+        validUntilLedger,
     };
 }
 /** Build an unsigned Soroban transaction envelope. The `sequence` is
@@ -294,14 +239,13 @@ function decodeInstallCallDescribes(tx, expectedInstallNonce) {
     if (scvArgs.length !== 5) {
         throw new Error(`install_policy: built op has ${scvArgs.length} args, expected 5 (context_type, name, valid_until, signers, policies)`);
     }
-    const contextType = scvArgs[0];
     const nameScv = scvArgs[1];
     const validUntilScv = scvArgs[2];
     const signersScv = scvArgs[3];
     const policiesScv = scvArgs[4];
     // The length check above pins these as defined; the local references
     // satisfy noUncheckedIndexedAccess on the accessors below.
-    if (!nameScv || !validUntilScv || !signersScv || !policiesScv || !contextType) {
+    if (!nameScv || !validUntilScv || !signersScv || !policiesScv) {
         throw new Error('install_policy: built op args include an undefined slot despite length check');
     }
     // name
@@ -382,7 +326,6 @@ function decodeInstallCallDescribes(tx, expectedInstallNonce) {
             fields.set(fk.sym().toString(), inner.val());
         }
         // Interpreter policy fields carry grammar_version/install_nonce/predicate.
-        // OZ primitives carry spending_limit/period_ledgers/threshold/signers.
         if (fields.has('predicate') || fields.has('grammar_version') || fields.has('install_nonce')) {
             const installNonceScv = fields.get('install_nonce');
             if (installNonceScv?.switch().name !== 'scvU32') {
@@ -411,21 +354,6 @@ function decodeInstallCallDescribes(tx, expectedInstallNonce) {
             observedInstallNonce = installNonce;
             continue;
         }
-        // OZ built-in primitive. Distinguish by the parameter shape we
-        // emitted; matching one of the three primitives exactly pins the
-        // kind we built.
-        if (fields.has('spending_limit') && fields.has('period_ledgers')) {
-            policies.push({ kind: 'oz_builtin', address, primitive: 'spending_limit' });
-            continue;
-        }
-        if (fields.has('threshold') && fields.has('signer_weights')) {
-            policies.push({ kind: 'oz_builtin', address, primitive: 'weighted_threshold' });
-            continue;
-        }
-        if (fields.has('threshold')) {
-            policies.push({ kind: 'oz_builtin', address, primitive: 'simple_threshold' });
-            continue;
-        }
         throw new Error(`install_policy: policies[${address}] value has an unknown field set; the encoder may have drifted`);
     }
     // `observedInstallNonce` is the nonce baked into whichever interpreter
@@ -454,10 +382,3 @@ function decodeInstallCallDescribes(tx, expectedInstallNonce) {
         installNonce,
     };
 }
-/** Re-export so the run-layer does not need to import from
- *  build-add-context-rule.ts (keeps the install/ -> install/ dependency
- *  direction intact). */
-export { Contract, DEFAULT_GRAMMAR_VERSION };
-// Local re-import to avoid pulling the class from the SDK module path
-// at the top of the file (avoids the unused-import lint).
-import { Account } from '@stellar/stellar-sdk';

package/dist/install/index.d.ts

@@ -1,3 +1 @@
-export { ANY, type AuthorityOverlap, type ContextType, effectiveSelectors, findAuthorityOverlaps, type IntendedInstall, intersectSelectors, type MergeResult, mergeIntoAnd, type ObservedRule, type OverlapSeverity, permittedSelectors, type RuleClass, type Selector, signerKey, } from './authority-overlap.ts';
 export { ADD_CONTEXT_RULE_SYMBOL, type AddContextRuleArgs, type BuildAddContextRuleArgs, buildAddContextRuleArgs, DEFAULT_GRAMMAR_VERSION, } from './build-add-context-rule.ts';
-export { type AccountRuleReader, accountRuleReaderFromServer, type CollectedRules, collectObservedRules, decodeContextRule, decodeContextType, decodeSigner, docLedgerKey, MAX_RULE_ID_SCAN, } from './read-account-rules.ts';

package/dist/install/index.js

@@ -12,11 +12,4 @@
 // Exported here rather than from the package root to keep the root surface
 // about synthesis, and because these are transaction-building primitives whose
 // callers should know they are reaching for them.
-// Cross-rule authority analysis. A caller installing a policy needs to know
-// whether its signers can already reach the same calls through another context
-// rule, because OZ lets the signer name the rule and enforces only that one's
-// policies. Without this, a second, tighter rule reads as a restriction while
-// restricting nothing.
-export { ANY, effectiveSelectors, findAuthorityOverlaps, intersectSelectors, mergeIntoAnd, permittedSelectors, signerKey, } from "./authority-overlap.js";
 export { ADD_CONTEXT_RULE_SYMBOL, buildAddContextRuleArgs, DEFAULT_GRAMMAR_VERSION, } from "./build-add-context-rule.js";
-export { accountRuleReaderFromServer, collectObservedRules, decodeContextRule, decodeContextType, decodeSigner, docLedgerKey, MAX_RULE_ID_SCAN, } from "./read-account-rules.js";

package/dist/ir/index.d.ts

@@ -1 +1 @@
-export type { IRCompare, IRCompOp, IRCondition, IRLogic, IRPolicyRule, IRScalarType, IRSelector, IRVecMode, PolicyIR, } from './types.ts';
+export type { IRCompare, IRCompOp, IRCondition, IRLogic, IRPolicyRule, IRScalarType, IRSelector, PolicyIR, } from './types.ts';