@crediolabs/policy-synth 0.2.0 → 0.3.0

package/src/run/schemas.ts

@@ -8,8 +8,8 @@
 //
 // i128 amounts and other large integers are carried as base-10 decimal strings
 // end-to-end. Networks are pinned to the same closed set the core defines.
-// The discriminated union on `source` exposes BOTH synthesize_policy
-// front-ends through a single tool input.
+// `source` is a single-variant discriminator (`recording`); it stays a union
+// so an unknown value is rejected with a discriminator error.
 //
 // This module is the SINGLE source of truth for these shapes. The MCP package
 // imports them here so its tool-shape bindings stay in step; the CLI imports
@@ -113,62 +113,13 @@ export const RecordedTransactionSchema = z
   })
   .passthrough()
 
-/** MandateSpec mirrors the core MandateSpec. The deterministic Mandate
- *  front-end needs no parseConfidence; the tool adapter injects the full
- *  confidence after synthesis so the orchestrator can compare. */
-export const MandateSpecSchema = z
-  .object({
-    chain: z.literal('stellar'),
-    contract: z.string(),
-    method: z.string().optional(),
-    spendingLimit: z
-      .object({
-        token: z.string(),
-        limit: z.string().regex(/^[0-9]+$/),
-        windowSeconds: z.number().int().positive(),
-      })
-      .optional(),
-    // A threshold of 0 means "0 approvals", which is not a real M-of-N gate.
-    approvalThreshold: z.number().int().positive().optional(),
-    recipients: z.array(z.string()).optional(),
-    expiry: z
-      .object({
-        validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
-        validUntilUnixSeconds: z.number().int().positive().optional(),
-      })
-      .optional(),
-  })
-  .passthrough()
-  // TS-F4/F6: a `recipients` allowlist is only meaningful against a SEP-41
-  // method whose arg 1 IS the recipient (SAC/SEP-41 `transfer(from, to,
-  // amount)` and SEP-41 `mint(to, amount)`). Without this gate the
-  // `to-ir.ts` lowering pins the allowlist to `RECIPIENT_ARG_INDEX = 1`
-  // for any contract+method, which would let a non-SEP-41 method's
-  // arg[1] (e.g. an amount, an op type, an arbitrary address payload)
-  // be silently constrained as if it were a recipient. Refusing
-  // non-SEP-41 methods at the boundary is the fail-closed shape.
-  .refine(
-    (v) =>
-      v.recipients === undefined ||
-      v.recipients.length === 0 ||
-      v.method === 'transfer' ||
-      v.method === 'mint',
-    {
-      message:
-        'recipients is only valid when method is a SEP-41 method (transfer or mint); other methods do not have a recipient at arg[1]',
-    }
-  )
-
-/** ComposeUserResponses mirrors the core. */
 export const ComposeUserResponsesSchema = z
   .object({
-    windowSeconds: z.number().int().positive().optional(),
     validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
     limitAmount: z
       .string()
       .regex(/^[0-9]+$/)
       .optional(),
-    invocationLimit: z.number().int().positive().optional(),
     // Swap recipient allowlist (SoroSwap call_arg[3]). Each entry must be a
     // Stellar address (G... wallet or C... contract); supplying it REPLACES the
     // default pin to the recorded recipient. Validated with the shared StrKey
@@ -176,37 +127,11 @@ export const ComposeUserResponsesSchema = z
     swapRecipientAllowlist: z
       .array(z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'))
       .optional(),
-    // Per-asset oracle-price bound, one entry per asset. Reaches
-    // `compose-from-recording` and emits an `oracle_price` compare. Declared
-    // here because the object is `.passthrough()`: the field already worked
-    // undeclared, which left the accepted surface wider than the documented
-    // one. `decimals` is REQUIRED - oracle prices normalise to 9 dp and a
-    // threshold silently assumed to share that basis is what let a raw 14-dp
-    // bound permit everything.
-    oraclePriceBound: z
-      .array(
-        z.object({
-          asset: z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'),
-          operator: z.enum(['eq', 'lt', 'lte', 'gt', 'gte']),
-          value: z.string().regex(/^[0-9]+$/),
-          decimals: z.number().int().min(0).max(U32_MAX),
-        })
-      )
-      .optional(),
   })
-  .passthrough()
-
-/** OzAdapterConfig - the per-network OZ built-in instance addresses. */
-export const OzAdapterConfigSchema = z.object({
-  network: NetworkSchema,
-  instances: z.object({
-    spending_limit: z.string(),
-    simple_threshold: z.string(),
-    weighted_threshold: z.string(),
-  }),
-})
-
-// ===== record_transaction =====
+  // Strict, not passthrough: a response key the synthesiser no longer reads
+  // (or a typo) would otherwise be accepted in silence, and the caller would
+  // believe they had answered a question that is still open.
+  .strict()
 
 export const RecordTransactionInputSchema = z
   .object({
@@ -223,48 +148,18 @@ export const RecordTransactionInputSchema = z
   })
 export type RecordTransactionInput = z.infer<typeof RecordTransactionInputSchema>
 
-// ===== synthesize_policy =====
-//
-// Discriminated union on `source` exposes BOTH front-ends through ONE tool.
-// - `source: 'mandate'` -> calls synthesizeFromMandate
-// - `source: 'recording'` -> calls synthesizeFromRecording
-
-export const SynthesizePolicyMandateInputSchema = z.object({
-  source: z.literal('mandate'),
-  mandate: MandateSpecSchema,
-  ozConfig: OzAdapterConfigSchema.optional(),
-  // --explain opt-in. When true, the orchestrator attaches the
-  // in-memory predicate tree (null for the mandate path) + a minimal
-  // honest SimulationResult to the success envelope. Absent or false
-  // -> the success envelope is unchanged (byte-identical to today).
-  explain: z.boolean().optional(),
-})
-
-/** Interpreter opt-in for the recording path. Present -> constraints OZ cannot
- *  express (per-method scoping, invocation-count windows, oracle bounds, exact
- *  hop paths) lower to a real interpreter predicate document instead of being
- *  surfaced as warnings. The core deep-validates `smartAccountAddress` (a C...
- *  contract, not the recording's G... source) and the tighten-only oracle
- *  bounds; the schema stays light so the core owns the friendly ToolErrors. */
 export const InterpreterOptionsSchema = z.object({
   smartAccountAddress: z.string(),
   installNonce: z.number().int().positive().optional(),
-  oracleParams: z
-    .object({
-      maxStalenessSeconds: z.number().int().positive().optional(),
-      maxDeviationBps: z.number().int().positive().optional(),
-    })
-    .optional(),
 })
 
-export const SynthesizePolicyRecordingInputSchema = z.object({
+export const SynthesizePolicyInputSchema = z.object({
   source: z.literal('recording'),
   recordedTx: RecordedTransactionSchema,
   network: NetworkSchema,
   userResponses: ComposeUserResponsesSchema.optional(),
   confidenceOverride: z.object({ threshold: z.number().min(0).max(1) }).optional(),
   interpreter: InterpreterOptionsSchema.optional(),
-  ozConfig: OzAdapterConfigSchema.optional(),
   // --explain opt-in. When true, the orchestrator attaches the
   // in-memory PredicateNode + the corresponding SimulationResult
   // (real one from the self-verify pipeline when the interpreter is
@@ -276,10 +171,6 @@ export const SynthesizePolicyRecordingInputSchema = z.object({
   explain: z.boolean().optional(),
 })
 
-export const SynthesizePolicyInputSchema = z.discriminatedUnion('source', [
-  SynthesizePolicyMandateInputSchema,
-  SynthesizePolicyRecordingInputSchema,
-])
 export type SynthesizePolicyInput = z.infer<typeof SynthesizePolicyInputSchema>
 
 // ===== PredicateNode / PredicateLeaf =====
@@ -310,41 +201,6 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
       element: z.number().int().nonnegative(),
       field: z.string(),
     }),
-    // num/den are i128 on chain; JSON numbers lose precision past 2^53,
-    // so the wire is a decimal string. The contract refuses `den == 0` and
-    // `num <= 0` / `den <= 0` at install (types.ts:162-163 + the install
-    // gate); mirroring that bound here closes the gap where simulate /
-    // verify green-light a policy the install gate will reject. The
-    // positive-only regex is the cheapest unambiguous check.
-    z.object({
-      kind: z.literal('call_arg_scaled'),
-      index: z.number().int().nonnegative(),
-      num: z.string().regex(/^[1-9][0-9]*$/),
-      den: z.string().regex(/^[1-9][0-9]*$/),
-    }),
-    z.object({ kind: z.literal('amount'), token: z.string() }),
-    z.object({
-      kind: z.literal('window_spent'),
-      token: z.string(),
-      windowSeconds: z.number().int().positive(),
-    }),
-    z.object({ kind: z.literal('now') }),
-    // `valid_until` is NOT in the public predicate grammar: the encoder +
-    // decoder already throw on it, so accepting it here would let a
-    // hand-crafted payload through the schema and only surface a 200+
-    // character internal-commentary error at encode time. Drop it - the
-    // policy's expiry is carried at the install layer (MandateSpec +
-    // validUntilLedger) instead.
-    z.object({
-      kind: z.literal('invocation_count_in_window'),
-      windowSecs: z.number().int().positive(),
-    }),
-    z.object({ kind: z.literal('oracle_price'), asset: z.string() }),
-    z.object({
-      kind: z.literal('oracle_threshold'),
-      value: z.string().regex(/^-?[0-9]+$/),
-      decimals: z.number().int().nonnegative(),
-    }),
     z.object({ kind: z.literal('literal_address'), value: z.string() }),
     z.object({ kind: z.literal('literal_i128'), value: z.string().regex(/^-?[0-9]+$/) }),
     z.object({ kind: z.literal('literal_symbol'), value: z.string() }),
@@ -356,39 +212,23 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
       kind: z.literal('literal_u32'),
       value: z.number().int().nonnegative().max(U32_MAX),
     }),
-    z.object({ kind: z.literal('literal_u64'), value: z.string().regex(/^[0-9]+$/) }),
-    // `literal_bytes` is hex on chain. `Buffer.from(value, 'hex')` silently
-    // drops non-hex chars AND yields an empty buffer when the whole input
-    // is non-hex - so a user passing 'zzzz' would get a predicate that
-    // compares against empty bytes instead of being rejected. The
-    // strict even-length hex regex closes that gap at the boundary.
-    z.object({
-      kind: z.literal('literal_bytes'),
-      value: z
-        .string()
-        .regex(/^[0-9a-fA-F]*$/)
-        .refine((v) => v.length % 2 === 0, 'must be even-length hex'),
-    }),
     // elements are themselves PredicateLeaf; lazy to break the cycle.
     z.object({ kind: z.literal('literal_vec'), elements: z.array(PredicateLeafSchema) }),
   ])
 )
 
 /** PredicateNode mirrors the core `PredicateNode` union. Recursive through
- *  `and`/`or`/`not`; the lazy + annotation pattern keeps the recursion
- *  type-safe. */
+ *  `and`; the lazy + annotation pattern keeps the recursion type-safe. */
 export const PredicateNodeSchema: z.ZodType<unknown> = z.lazy(() =>
   z.union([
     z.object({ op: z.literal('and'), children: z.array(PredicateNodeSchema) }),
-    z.object({ op: z.literal('or'), children: z.array(PredicateNodeSchema) }),
-    z.object({ op: z.literal('not'), child: PredicateNodeSchema }),
     z.object({
       op: z.literal('eq'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
     z.object({
-      op: z.enum(['lt', 'lte', 'gt', 'gte']),
+      op: z.literal('lte'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
@@ -402,42 +242,18 @@ export const PredicateNodeSchema: z.ZodType<unknown> = z.lazy(() =>
 
 // ===== simulate_policy / verify_policy =====
 //
-// The oracle fixture shape mirrors `SimulateOptions` / `VerifyOptions`
-// in packages/policy-synth/src/verify/{simulate,verify}.ts - the same
-// sorted set of error enum values is used by both engines. u32
-// `validUntilLedger` is bounded at the boundary so a hand-crafted
-// payload cannot leak a u32 overflow into the engine's permit context.
-
-/** Oracle price fixture - mirror of the entry type in `SimulateOptions` /
- *  `VerifyOptions`. Discriminated by presence of `error` vs `price`. */
-export const OraclePriceFixtureSchema = z.union([
-  z.object({
-    price: z.string().regex(/^[0-9]+$/),
-    timestampSeconds: z.number().int().nonnegative(),
-  }),
-  z.object({
-    error: z.enum(['stale', 'missing', 'deviation', 'paused', 'decimals', 'fingerprint']),
-  }),
-])
-
+// Both tools evaluate the same predicate against the same recording, so they
+// take the same input. A null predicate used to mean "OZ built-in policies
+// only"; that backend is gone, so every policy carries a predicate and there is
+// nothing to simulate without one.
 export const SimulatePolicyInputSchema = z.object({
-  // simulatePolicy accepts a null predicate (OZ-only policy); verifyPolicy
-  // does not. The asymmetry is mirrored at the schema boundary.
-  predicate: PredicateNodeSchema.nullable(),
+  predicate: PredicateNodeSchema,
   permitTx: RecordedTransactionSchema,
   validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
 })
 export type SimulatePolicyInput = z.infer<typeof SimulatePolicyInputSchema>
 
-export const VerifyPolicyInputSchema = z.object({
-  // verifyPolicy requires a non-null predicate; the engine refuses
-  // `null` outright. The schema mirrors that contract.
-  predicate: PredicateNodeSchema,
-  permitTx: RecordedTransactionSchema,
-  validUntilLedger: z.number().int().positive().max(U32_MAX).optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
-})
+export const VerifyPolicyInputSchema = SimulatePolicyInputSchema
 export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>
 
 // ===== install_policy / revoke_policy / get_interpreter_info =====
@@ -452,7 +268,7 @@ export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>
 // optional `grammar_version()` RPC call to check whether the deployed contract
 // matches the pin. A mismatch is worth MORE than a fabricated audit field.
 //
-// All three input schemas live BELOW the MandateSpecSchemaForRule declaration
+// All three input schemas live BELOW the ContextRuleDraftSchema declaration
 // so the const reference there is not in the temporal dead zone (no JS hoisting
 // for `const`).
 
@@ -465,7 +281,7 @@ export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>
 const MAX_SIGNERS_PER_RULE = 15
 const MAX_POLICIES_PER_RULE = 5
 
-const MandateSpecSchemaForRule = z
+const ContextRuleDraftSchema = z
   .object({
     contextRuleType: z.discriminatedUnion('kind', [
       z.object({ kind: z.literal('default') }),
@@ -488,21 +304,11 @@ const MandateSpecSchemaForRule = z
       .max(MAX_SIGNERS_PER_RULE),
     policies: z
       .array(
-        z.discriminatedUnion('kind', [
-          z.object({
-            kind: z.literal('interpreter'),
-            interpreterAddress: z.string(),
-            predicateBlobBase64: z.string().min(1),
-          }),
-          z.object({
-            kind: z.literal('oz_builtin'),
-            primitive: z.object({
-              primitive: z.enum(['spending_limit', 'simple_threshold', 'weighted_threshold']),
-              params: z.record(z.unknown()),
-            }),
-            instanceAddress: z.string(),
-          }),
-        ])
+        z.object({
+          kind: z.literal('interpreter'),
+          interpreterAddress: z.string(),
+          predicateBlobBase64: z.string().min(1),
+        })
       )
       .max(MAX_POLICIES_PER_RULE),
   })
@@ -519,34 +325,28 @@ const MandateSpecSchemaForRule = z
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 export const PINNED_INTERPRETER_TESTNET_ADDRESS =
-  'CALHNU4LXZRKFAXYRBODTGDANTNXHJPBTJNYGLUWLIFIP24NWSGWIE4K'
+  'CCL336TCK2Y5OFNRCMN2M3HVPBCEX4PW5H6EQ5VW5NPMXOCP4ESB5XR4'
 
-/** Pinned interpreter address (mainnet), deployed 2026-08-04.
- *  UNAUDITED at the time of writing. */
+/** Pinned interpreter address (mainnet), redeployed 2026-08-22 from a reproducible build. The mainnet
+ *  interpreter IS the binary exercised on testnet - both instances were created
+ *  from the same uploaded wasm hash (see PINNED_INTERPRETER_WASM_SHA256), and
+ *  both were read back with `grammar_version()` returning 3. The address differs
+ *  because instance ids are network-scoped. UNAUDITED at the time of writing.
+ *
+ *  These four constants move together or not at all. The grammar version and
+ *  wasm hash are single values covering BOTH networks, so re-pinning one network
+ *  alone would have the builder emit a version the other network refuses - with
+ *  a green test run, since `grammar-version-parity.test.ts` would then pass. */
 export const PINNED_INTERPRETER_MAINNET_ADDRESS =
-  'CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2'
+  'CBZXLSTQUITBFZHQH6XRXF3XIVRQR4RHRI64Q5WELS5KGY3ZKJPFWDPF'
 
-/** Pinned interpreter wasm sha256 (hex), mainnet.
- *
- *  The two networks no longer run the same binary. Testnet carries the
- *  selector-leaf minimum and the signer-set cap; mainnet predates both. Read
- *  the hash through `PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK` rather than
- *  this constant unless mainnet is specifically what is meant, or
- *  `get_interpreter_info` will report a hash the queried network does not
- *  run. */
+/** Pinned interpreter wasm sha256 (hex). */
 export const PINNED_INTERPRETER_WASM_SHA256 =
-  '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443'
-
-/** Pinned interpreter wasm sha256 (hex), testnet. Byte-identical to the
- *  artifact built from `contracts/policy-interpreter` at the commit that
- *  introduced errors 216 and 217, verified by fetching the deployed wasm back
- *  off chain. */
-export const PINNED_INTERPRETER_WASM_SHA256_TESTNET =
-  'a4d58bc88fd82bbb8e223941ba5889db919717fae92ced13f6f55bfe583b8e22'
+  'a2b36e8ac5a61caf3757af26aa79e83f2995b451099f44772383806a55fe3414'
 
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
-export const PINNED_INTERPRETER_GRAMMAR_VERSION = 1
+export const PINNED_INTERPRETER_GRAMMAR_VERSION = 3
 
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
@@ -560,27 +360,19 @@ export const TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org'
  *  the deploy script hit during the 2026-08-04 mainnet rollout. */
 export const MAINNET_RPC_URL = 'https://mainnet.sorobanrpc.com'
 
-/** Pin + RPC lookup for the gate enforcement. Addresses, RPCs and wasm
- *  hashes are all network-scoped: the networks diverged when the
- *  selector-leaf and signer-cap controls were deployed to testnet ahead of
- *  mainnet. */
+/** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
+ *  is identical across both networks (the same binary was uploaded both
+ *  places), so `PINNED_INTERPRETER_WASM_SHA256` stays
+ *  a single constant - only the addresses and RPCs are network-scoped. */
 export const PINNED_INTERPRETER_ADDRESS_BY_NETWORK: Record<Network, string> = {
   testnet: PINNED_INTERPRETER_TESTNET_ADDRESS,
   mainnet: PINNED_INTERPRETER_MAINNET_ADDRESS,
 }
-export const PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK: Record<Network, string> = {
-  testnet: PINNED_INTERPRETER_WASM_SHA256_TESTNET,
-  mainnet: PINNED_INTERPRETER_WASM_SHA256,
-}
 export const RPC_URL_BY_NETWORK: Record<Network, string> = {
   testnet: TESTNET_RPC_URL,
   mainnet: MAINNET_RPC_URL,
 }
 
-/** Soroban `valid_until` window (ledgers) added to the latest ledger when
- *  building the auth entry. ~25 minutes at 5s/ledger. */
-export const DEFAULT_AUTH_VALID_UNTIL_LEDGERS = 300
-
 /** Stellar network passphrases. Pinned here so the XDR envelope uses the
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */
@@ -619,7 +411,7 @@ export const InstallPolicyInputSchema = z
      *  pin and RPC pin do not move by themselves). */
     network: NetworkSchema.optional(),
     /** The proposed rule draft. Mirrors the core `ContextRuleDraft` shape. */
-    rule: MandateSpecSchemaForRule,
+    rule: ContextRuleDraftSchema,
     /** Per-rule install nonce; 1 for a fresh install. */
     installNonce: z.number().int().positive(),
     /** Optional RPC URL override. Defaults to the pinned RPC for the
@@ -639,17 +431,6 @@ export const InstallPolicyInputSchema = z
      *  everything. Selecting `network: 'mainnet'` is NOT an opt-in -
      *  the mainnet pin is its own deny-by-default anchor. */
     allowUnpinnedInterpreter: z.boolean().optional(),
-    /** Opt-in to installing when a signer of this rule can already reach the
-     *  same calls through a context rule that has NO policy attached. OZ lets
-     *  the signer choose which rule authorises a call and enforces only that
-     *  rule's policies, so an unpoliced rule covering the same calls makes
-     *  this policy decorative. Default-deny, because the caller almost
-     *  certainly believes they are restricting something. */
-    allowAuthorityOverlap: z.boolean().optional(),
-    /** Skip the cross-rule authority scan entirely. The scan costs one RPC
-     *  read per rule on the account; skipping it means the response carries
-     *  no statement about what the signers can already do. */
-    skipAuthorityScan: z.boolean().optional(),
     /** Base fee in stroops; defaults to BASE_FEE (100). */
     baseFee: z.number().int().positive().optional(),
   })
@@ -658,36 +439,6 @@ export const InstallPolicyInputSchema = z
   })
 export type InstallPolicyInput = z.infer<typeof InstallPolicyInputSchema>
 
-/** `merge_policy` input.
- *
- *  The tightening remedy for a cross-rule overlap: replace a rule's predicate
- *  with the conjunction of it and a new one. Two transactions, in order,
- *  because OZ refuses to re-attach a policy already on the rule - so the
- *  caller runs `detach`, waits for it to confirm, then runs `reinstall`. */
-export const MergePolicyInputSchema = z
-  .object({
-    smartAccount: z
-      .string()
-      .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
-    sourceAccount: z
-      .string()
-      .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
-    /** The rule whose predicate is being tightened. */
-    ruleId: z.number().int().nonnegative(),
-    /** The predicate to conjoin, base64 canonical ScVal, as emitted by
-     *  `synthesize_policy`. */
-    incomingPredicateBlobBase64: z.string().min(1),
-    /** Which half of the remedy to build. */
-    step: z.enum(['detach', 'reinstall']),
-    network: NetworkSchema.optional(),
-    rpcUrl: z.string().url().optional(),
-    allowUnpinnedRpcUrl: z.boolean().optional(),
-    baseFee: z.number().int().positive().optional(),
-  })
-  .strict()
-
-export type MergePolicyInput = z.infer<typeof MergePolicyInputSchema>
-
 export const RevokePolicyInputSchema = z
   .object({
     /** The smart account contract address (C...). */