@crediolabs/policy-synth 0.2.0 → 0.3.0

package/src/errors.ts

@@ -28,7 +28,6 @@ export type ErrorCode =
   | 'PREDICATE_TOO_DEEP'
   | 'TOO_MANY_LEAVES'
   | 'IN_OPERAND_LIMIT'
-  | 'PREDICATE_ORACLE_OVER_LIMIT'
   | 'POLICY_CAP_EXCEEDED'
   | 'WASM_TOO_LARGE'
   // --- interpreter-side denies (canonical names; matches Rust DenyCode) ---
@@ -44,24 +43,6 @@ export type ErrorCode =
   | 'UNSUPPORTED_NODE'
   | 'STATEFUL_BOUND'
   | 'NOT_IN_ALLOWLIST'
-  | 'FREQUENCY'
-  // A `call_arg >= call_arg_scaled(..)` slippage floor was not met. Distinct
-  // from the generic ARG_MISMATCH/STATEFUL_BOUND so a violated swap floor
-  // reads as itself on the review card.
-  | 'SLIPPAGE_FLOOR'
-  // --- oracle denies (fatal evaluator errors) ---
-  | 'ORACLE_STALE'
-  | 'ORACLE_MISSING'
-  | 'ORACLE_NO_CONFIRMATION'
-  | 'ORACLE_DEVIATION_EXCEEDED'
-  | 'ORACLE_MALFORMED_HISTORY'
-  | 'ORACLE_FINGERPRINT_DRIFT'
-  | 'ORACLE_PAUSED'
-  | 'ORACLE_LEAF_INVALID_POSITION'
-  | 'ORACLE_PARAMS_OUT_OF_RANGE'
-  | 'ORACLE_DECIMALS_MISMATCH'
-  | 'ORACLE_THRESHOLD_DECIMALS_OUT_OF_RANGE'
-  | 'ORACLE_THRESHOLD_BASIS_REQUIRED'
   // --- escape-hatch compile gate ---
   | 'COMPILE_OK'
   | 'COMPILE_GATE_FAILED'

package/src/index.ts

@@ -1,11 +1,8 @@
-export * from './adapters/oz/index.ts'
 export * from './errors.ts'
-export * from './ir/index.ts'
-export * from './mandate/index.ts'
 export * from './predicate/index.ts'
 export * from './record/index.ts'
 export * from './registry/index.ts'
 export * from './review-card/index.ts'
-export * from './seams/index.ts'
+export * from './simulate/index.ts'
 export * from './synth/index.ts'
 export * from './types.ts'

package/src/install/build-add-context-rule.ts

@@ -52,8 +52,8 @@ import { Address, xdr } from '@stellar/stellar-sdk'
 import type { ToolError } from '../errors.ts'
 import {
   type ContextRuleDraft,
+  GRAMMAR_VERSION,
   OZ_LIMITS,
-  type OZPrimitiveConfig,
   type PolicyRef,
   type SignerDraft,
 } from '../types.ts'
@@ -66,8 +66,8 @@ export interface BuildAddContextRuleArgs {
    *  admin session. The deployer signs the install call via the admin rule
    *  already on the account, which is separate from this list. */
   signers: SignerDraft[]
-  /** The policy(ies) to attach to the new rule. Only `interpreter` refs
-   *  reach the wire today; `oz_builtin` is reserved for Phase 06 follow-ups. */
+  /** The policy(ies) to attach to the new rule. `interpreter` is the only
+   *  kind: the OpenZeppelin built-in backend was removed. */
   policies: PolicyRef[]
   /** Per-policy install nonce; 1 for a fresh install. */
   installNonce: number
@@ -77,20 +77,12 @@ export interface BuildAddContextRuleArgs {
   encodedPredicate: string
   /** Hex sha256 of the canonical predicate XDR bytes. */
   predicateHash: string
-  /** Per-policy oracle overrides. Absent on any key uses the wasm default. */
-  oracleParams?: {
-    maxStalenessSeconds?: number
-    maxDeviationBps?: number
-    /** Bound between the primary and secondary feeds. Tighten-only against
-     *  the wasm default, like the other two. */
-    maxCrossFeedDeviationBps?: number
-  }
   /** Hard pin to the interpreter's wasm grammar. Refusing here fails closed
    *  before the chain does; the contract will refuse a mismatch again. */
   grammarVersion?: number
 }
 
-export const DEFAULT_GRAMMAR_VERSION = 1 as const
+export const DEFAULT_GRAMMAR_VERSION = GRAMMAR_VERSION
 
 /** The verb `add_context_rule` takes on the wire. */
 export const ADD_CONTEXT_RULE_SYMBOL = 'add_context_rule' as const
@@ -130,20 +122,6 @@ export function buildAddContextRuleArgs(
       'a rule with no signers and no policies is refused at install (NoSignersAndPolicies)'
     )
   }
-  // OZ's spending_limit caps spend on the CONTEXT CONTRACT - it takes no
-  // token argument - so it refuses a Default rule on chain with a bare
-  // #3227. Say which rule shape it needs here, before the encoding, rather
-  // than letting the user read a numeric trap.
-  if (
-    args.policies.some((p) => p.kind === 'oz_builtin' && p.primitive.primitive === 'spending_limit')
-  ) {
-    if (draft.contextRuleType.kind !== 'call_contract') {
-      throw limitError(
-        'INSTALL_BUILD_FAILED',
-        `spending_limit caps spend on the rule's context contract, so the rule must be call_contract-scoped to that token - a "${draft.contextRuleType.kind}" rule is refused on chain (#3227)`
-      )
-    }
-  }
 
   // ---- 2. context_type encoding ----
   const contextType = encodeContextRuleType(draft.contextRuleType)
@@ -173,15 +151,6 @@ const POLICY_INSTALL_PARAM_FIELDS = [
   'install_nonce',
   'predicate',
   'predicate_hash',
-  'oracle_max_staleness_seconds',
-  'oracle_max_deviation_bps',
-  // Cross-feed divergence bound. A field added to the contract's
-  // `PolicyInstallParams` changes the ABI: the host unpacks the map by field
-  // count, so omitting one fails the entire install with
-  // `Error(Object, UnexpectedSize)` and no indication of which field is
-  // missing. The Rust tests build that struct in Rust and never cross this
-  // boundary, so only a real install against a deployed contract catches it.
-  'oracle_max_xfeed_dev_bps',
 ] as const
 
 function encodeContextRuleType(
@@ -232,104 +201,13 @@ function encodePoliciesMap(args: BuildAddContextRuleArgs): xdr.ScVal {
           val: encodePolicyInstallParams(args),
         })
       )
-    } else if (ref.kind === 'oz_builtin') {
-      entries.push(
-        new xdr.ScMapEntry({
-          key: Address.fromString(ref.instanceAddress).toScVal(),
-          val: encodeOzPrimitiveParams(ref.primitive),
-        })
-      )
     }
   }
   entries.sort(sortByScValSymbolString)
   return xdr.ScVal.scvMap(entries)
 }
 
-/** Encode the install params for one OZ built-in policy.
- *
- *  Field names and types are read from the deployed contracts' own spec:
- *    SpendingLimitAccountParams   { period_ledgers: u32, spending_limit: i128 }
- *    SimpleThresholdAccountParams { threshold: u32 }
- *    WeightedThresholdAccountParams { signer_weights: map, threshold: u32 }
- *  Entries are symbol-string ordered for the same reason the interpreter's
- *  are: the host orders by symbol, not by XDR bytes.
- */
-function encodeOzPrimitiveParams(primitive: OZPrimitiveConfig): xdr.ScVal {
-  const entries: xdr.ScMapEntry[] = []
-  const push = (name: string, val: xdr.ScVal) =>
-    entries.push(new xdr.ScMapEntry({ key: xdr.ScVal.scvSymbol(name), val }))
-  const p = primitive.params as Record<string, unknown>
-  switch (primitive.primitive) {
-    case 'spending_limit': {
-      const limit = p.spending_limit
-      const period = p.period_ledgers
-      if (typeof limit !== 'string' || typeof period !== 'number') {
-        throw limitError(
-          'INSTALL_BUILD_FAILED',
-          'spending_limit needs { spending_limit: string; period_ledgers: number }'
-        )
-      }
-      push('period_ledgers', xdr.ScVal.scvU32(period))
-      push('spending_limit', encodeI128(limit))
-      break
-    }
-    case 'simple_threshold': {
-      const threshold = p.threshold
-      if (typeof threshold !== 'number') {
-        throw limitError('INSTALL_BUILD_FAILED', 'simple_threshold needs { threshold: number }')
-      }
-      push('threshold', xdr.ScVal.scvU32(threshold))
-      break
-    }
-    case 'weighted_threshold': {
-      const threshold = p.threshold
-      const weights = p.weights as Record<string, number> | undefined
-      if (typeof threshold !== 'number' || !weights) {
-        throw limitError(
-          'INSTALL_BUILD_FAILED',
-          'weighted_threshold needs { threshold: number; weights: Record<address, number> }'
-        )
-      }
-      const weightEntries = Object.entries(weights)
-        .map(
-          ([addr, w]) =>
-            new xdr.ScMapEntry({
-              key: Address.fromString(addr).toScVal(),
-              val: xdr.ScVal.scvU32(w),
-            })
-        )
-        .sort((a, b) => (a.key().toXDR('base64') < b.key().toXDR('base64') ? -1 : 1))
-      push('signer_weights', xdr.ScVal.scvMap(weightEntries))
-      push('threshold', xdr.ScVal.scvU32(threshold))
-      break
-    }
-  }
-  entries.sort((a, b) => sortBySymbolString(a.key(), b.key()))
-  return xdr.ScVal.scvMap(entries)
-}
-
-function encodeI128(value: string): xdr.ScVal {
-  const v = BigInt(value)
-  return xdr.ScVal.scvI128(
-    new xdr.Int128Parts({
-      hi: new xdr.Int64(BigInt.asIntN(64, v >> 64n)),
-      lo: new xdr.Uint64(BigInt.asUintN(64, v)),
-    })
-  )
-}
-
-/** The `PolicyInstallParams` ScVal an interpreter policy receives.
- *
- *  Exported so the merge remedy can re-install a policy through `add_policy`
- *  using the SAME encoder as a fresh install. Re-implementing it would risk
- *  exactly the drift this file warns about: the field order is ABI-significant
- *  and a differing encoding yields a rule that denies every call. */
-export type PolicyInstallParamArgs = Pick<
-  BuildAddContextRuleArgs,
-  'encodedPredicate' | 'predicateHash' | 'installNonce' | 'oracleParams' | 'grammarVersion'
->
-
-export function encodePolicyInstallParams(args: PolicyInstallParamArgs): xdr.ScVal {
+function encodePolicyInstallParams(args: BuildAddContextRuleArgs): xdr.ScVal {
   const predicate = Buffer.from(args.encodedPredicate, 'base64')
   const computedHash = createHash('sha256').update(predicate).digest('hex')
   if (computedHash !== args.predicateHash) {
@@ -341,15 +219,11 @@ export function encodePolicyInstallParams(args: PolicyInstallParamArgs): xdr.ScV
   // Per-field value encoders. Each entry returns the ScVal to drop into the
   // map; the key symbol comes from the surrounding loop. Adding a field is
   // one row here plus the symbol in POLICY_INSTALL_PARAM_FIELDS.
-  const oracleParams = args.oracleParams
   const valueFor: Record<(typeof POLICY_INSTALL_PARAM_FIELDS)[number], () => xdr.ScVal> = {
     grammar_version: () => xdr.ScVal.scvU32(args.grammarVersion ?? DEFAULT_GRAMMAR_VERSION),
     install_nonce: () => xdr.ScVal.scvU32(args.installNonce),
     predicate: () => xdr.ScVal.scvBytes(predicate),
     predicate_hash: () => xdr.ScVal.scvBytes(Buffer.from(args.predicateHash, 'hex')),
-    oracle_max_staleness_seconds: () => encodeOptionU32(oracleParams?.maxStalenessSeconds),
-    oracle_max_deviation_bps: () => encodeOptionU32(oracleParams?.maxDeviationBps),
-    oracle_max_xfeed_dev_bps: () => encodeOptionU32(oracleParams?.maxCrossFeedDeviationBps),
   }
   const entries = POLICY_INSTALL_PARAM_FIELDS.map(
     (k) => new xdr.ScMapEntry({ key: xdr.ScVal.scvSymbol(k), val: valueFor[k]() })
@@ -362,14 +236,6 @@ export function encodePolicyInstallParams(args: PolicyInstallParamArgs): xdr.ScV
   return xdr.ScVal.scvMap(entries)
 }
 
-function encodeOptionU32(v: number | undefined): xdr.ScVal {
-  if (v === undefined) return xdr.ScVal.scvVoid()
-  if (!Number.isFinite(v) || v < 0 || v > 0xffffffff) {
-    throw limitError('INSTALL_BUILD_FAILED', `oracle params value ${v} is outside u32 range`)
-  }
-  return xdr.ScVal.scvU32(v)
-}
-
 /** Sort host-map keys by their symbol-string form. The host orders map
  *  entries by the SYMBOL STRING, not by the key's XDR bytes (a length
  *  prefix in the encoding would otherwise put `amount` before `address`).