@crediolabs/policy-synth 0.2.0 → 0.3.0

package/dist/install/plan-merge-policy.d.ts

@@ -1,49 +0,0 @@
-import type { PredicateNode } from '../types.ts';
-import type { ObservedRule } from './authority-overlap.ts';
-export type MergeStep = 'detach' | 'reinstall';
-export interface MergePlanRefused {
-    ok: false;
-    /** Why the merge cannot proceed, in terms the caller can act on. */
-    reason: string;
-}
-export interface MergePlanAccepted {
-    ok: true;
-    /** The conjunction to install in step 2. */
-    predicate: PredicateNode;
-    /** OZ registry id of the interpreter policy on this rule, for
-     *  `remove_policy`. */
-    policyId: number;
-    /** Oracle bounds to re-install with the merged predicate. Carried from the
-     *  document being replaced: they are tighten-only overrides against the wasm
-     *  defaults, so omitting them would quietly widen the policy while the
-     *  operator believed they were tightening it. */
-    oracleParams?: {
-        maxStalenessSeconds?: number;
-        maxDeviationBps?: number;
-        maxCrossFeedDeviationBps?: number;
-    };
-    /** Consequences the caller must see BEFORE signing step 1, because step 1 is
-     *  the destructive one. */
-    warnings: string[];
-    /** What the caller should do after the requested step confirms. */
-    followUp: string;
-}
-export type MergePlan = MergePlanRefused | MergePlanAccepted;
-/** The interpreter's registry id on a rule, or null when it is not attached
- *  or the ids were not readable. */
-export declare function interpreterPolicyId(rule: ObservedRule, interpreterAddress: string): number | null;
-/**
- * Decide whether the merge can proceed, and say what it will cost.
- *
- * Refuses rather than guesses whenever the account is not in the shape the
- * remedy assumes: the rule must be policed by our interpreter, its predicate
- * must have been readable, and the ids needed to detach it must be present. A
- * merge built on a predicate we could not read would silently replace a rule
- * with something narrower or wider than its author wrote.
- */
-export declare function planMergePolicy(args: {
-    rule: ObservedRule;
-    interpreterAddress: string;
-    incoming: PredicateNode;
-    step: MergeStep;
-}): MergePlan;

package/dist/install/plan-merge-policy.js

@@ -1,86 +0,0 @@
-//! Planning the merge remedy for a cross-rule authority overlap.
-//!
-//! When two rules our interpreter polices can serve the same calls, the
-//! tightening remedy is to replace one rule's predicate with the conjunction
-//! of both (see `authority-overlap.ts`). Carrying that out against an OZ smart
-//! account is not one call, and the reasons are worth stating because they
-//! shape the whole tool:
-//!
-//!   1. A Soroban transaction carries exactly ONE operation - "smart contract
-//!      transactions can only have one operation per transaction" - so the
-//!      detach and the re-attach cannot be bundled even though the host would
-//!      run them in order happily. And `add_policy` panics `DuplicatePolicy`
-//!      while the policy is still attached (`smart_account/storage.rs`
-//!      `add_policy`), so the second transaction cannot even be simulated
-//!      until the first has confirmed.
-//!   2. `remove_policy` calls `try_uninstall` and DISCARDS the result
-//!      (`smart_account/storage.rs`: `let _ = ...try_uninstall(...)`), so the
-//!      policy is detached whether or not our `uninstall` succeeded. When it
-//!      succeeded the document, nonce, signer hash, master set and counters
-//!      are gone and the re-install is a fresh install at nonce 1. When it
-//!      panicked - our `uninstall` panics `MissingState` if the master set has
-//!      been archived - the nonce SURVIVES, and re-installing at 1 would be
-//!      refused on chain as a replay, leaving the rule stuck unpoliced. The
-//!      nonce is therefore READ at reinstall time rather than assumed.
-//!   3. Because of (2), any rate-limit or spend window on that rule is reset
-//!      by the merge. A signer who had consumed most of a window gets a clean
-//!      one. That is a real cost of tightening this way and the caller has to
-//!      be told, not discover it.
-//!   4. So the caller performs step 1, waits for it to confirm, then asks for
-//!      step 2.
-//!
-//! This module is pure. It decides what should happen and why; the XDR is
-//! built by `build-merge-policy.ts`.
-import { mergeIntoAnd } from "./authority-overlap.js";
-/** The interpreter's registry id on a rule, or null when it is not attached
- *  or the ids were not readable. */
-export function interpreterPolicyId(rule, interpreterAddress) {
-    const index = rule.policyAddresses.indexOf(interpreterAddress);
-    if (index < 0)
-        return null;
-    const id = rule.policyIds?.[index];
-    return typeof id === 'number' ? id : null;
-}
-/**
- * Decide whether the merge can proceed, and say what it will cost.
- *
- * Refuses rather than guesses whenever the account is not in the shape the
- * remedy assumes: the rule must be policed by our interpreter, its predicate
- * must have been readable, and the ids needed to detach it must be present. A
- * merge built on a predicate we could not read would silently replace a rule
- * with something narrower or wider than its author wrote.
- */
-export function planMergePolicy(args) {
-    const policyId = interpreterPolicyId(args.rule, args.interpreterAddress);
-    if (policyId === null) {
-        return {
-            ok: false,
-            reason: `rule ${args.rule.id} is not policed by the interpreter at ${args.interpreterAddress}, or its policy ids could not be read, so there is nothing to merge into and no id to detach. The merge hard-pins to that interpreter and has no opt-out: the auth digest it builds binds to the audited deployment. A rule installed against a different interpreter has to be replaced rather than merged.`,
-        };
-    }
-    const existing = args.rule.predicate;
-    if (!existing) {
-        return {
-            ok: false,
-            reason: `the predicate installed on rule ${args.rule.id} could not be read, so it cannot be conjoined; merging against an unknown predicate would replace the rule with something other than what its author wrote`,
-        };
-    }
-    const merged = mergeIntoAnd(existing, args.incoming);
-    if (!merged.ok || !merged.predicate) {
-        return { ok: false, reason: merged.reason ?? 'the two predicates cannot be conjoined' };
-    }
-    const warnings = [
-        `detaching the policy uninstalls it, which removes every counter on rule ${args.rule.id}: any rate limit or spend window there restarts from zero after the merge`,
-        'the rule is unpoliced between the two transactions, so a signer of it is unconstrained by this policy until step 2 confirms',
-    ];
-    return {
-        ok: true,
-        predicate: merged.predicate,
-        policyId,
-        ...(args.rule.oracleBounds ? { oracleParams: args.rule.oracleBounds } : {}),
-        warnings,
-        followUp: args.step === 'detach'
-            ? "sign and submit this transaction, wait for it to confirm, then call again with step: 'reinstall' to install the merged predicate"
-            : 'sign and submit this transaction; the merged predicate is then the only policy governing this rule',
-    };
-}

package/dist/install/read-account-rules.d.ts

@@ -1,100 +0,0 @@
-import { rpc, xdr } from '@stellar/stellar-sdk';
-import type { SignerDraft } from '../types.ts';
-import type { ContextType, ObservedRule } from './authority-overlap.ts';
-/** `storage.rs:295` - the third element of the persistent doc key tuple. */
-export declare const K_DOC = 1;
-/** Persistent-storage key for a rule's stored document:
- *  `(account, rule_id, K_DOC)`, per `storage.rs:4`. */
-export declare function docKeyScVal(smartAccount: string, ruleId: number): xdr.ScVal;
-/** Ledger key for the interpreter's persistent entry holding that document. */
-export declare function docLedgerKey(interpreter: string, smartAccount: string, ruleId: number): xdr.LedgerKey;
-/** OZ `ContextRuleType`. An unrecognised tag is reported as `default`, which
- *  is the widest reading and therefore the safe one: it makes the rule look
- *  like it could serve any call, so overlap is over-reported, never missed. */
-export declare function decodeContextType(v: xdr.ScVal | undefined): ContextType;
-/** OZ `Signer::Delegated(Address) | Signer::External(Address, Bytes)`. */
-export declare function decodeSigner(v: xdr.ScVal): SignerDraft | undefined;
-/** A full OZ `ContextRule` as returned by `get_context_rule(id)`.
- *  `predicate` is filled in separately from the ledger entry. */
-export declare function decodeContextRule(v: xdr.ScVal): ObservedRule | undefined;
-/** `storage.rs:296` - the third element of the persistent nonce key tuple. */
-export declare const K_NONCE = 2;
-/** Ledger key for a rule's stored install nonce. Read directly for the same
- *  reason as the document: the interpreter publishes no getter. */
-export declare function nonceLedgerKey(interpreter: string, smartAccount: string, ruleId: number): xdr.LedgerKey;
-/** Per-policy oracle bounds carried on a `StoredDoc`.
- *
- *  These must survive a merge. They are tighten-only overrides against the
- *  wasm defaults, so dropping them does not fail loudly: the rule keeps
- *  working and silently tolerates staler prices and wider deviation than its
- *  author chose. */
-export interface StoredOracleBounds {
-    maxStalenessSeconds?: number;
-    maxDeviationBps?: number;
-    maxCrossFeedDeviationBps?: number;
-}
-export declare function decodeStoredOracleBounds(v: xdr.ScVal): StoredOracleBounds;
-/** Raw predicate bytes out of a `StoredDoc` ledger entry value. */
-export declare function decodeStoredPredicateBytes(v: xdr.ScVal): Buffer | undefined;
-/** The three reads the scan needs. Kept as an interface so the collection
- *  below is testable without a network, matching the `InstallRpcClient`
- *  pattern in `build-install-policy.ts`. */
-export interface AccountRuleReader {
-    /** OZ `get_context_rules_count()`. */
-    getContextRuleCount(smartAccount: string): Promise<number>;
-    /** OZ `get_context_rule(id)`. Undefined when the id is absent. */
-    getContextRule(smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>;
-    /** The interpreter's persistent `StoredDoc` entry, read as a ledger entry.
-     *  Undefined when no document is stored for that rule. */
-    getStoredDoc(interpreter: string, smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>;
-}
-/** How far the id scan will probe before giving up. OZ imposes no per-account
- *  rule cap, so there is no exact bound to derive; this one is far above any
- *  realistic account and keeps a malformed `Count` from spinning forever. */
-export declare const MAX_RULE_ID_SCAN = 512;
-export interface CollectedRules {
-    rules: ObservedRule[];
-    /** Rule ids whose stored predicate could not be read even though the
-     *  interpreter is attached. Such a rule is reported without a predicate,
-     *  which classifies it as opaque rather than as safely narrow. */
-    unreadablePredicateRuleIds: number[];
-    /** True when the scan stopped before accounting for every live rule. The
-     *  result is then a SUBSET of the account's rules, so an empty overlap list
-     *  proves nothing and the caller must not present it as safety. */
-    incomplete: boolean;
-}
-/**
- * Every context rule on the account, with predicates filled in for the rules
- * our interpreter polices.
- *
- * Rule ids are NOT contiguous. OZ assigns them from a monotonic `NextId` and
- * decrements `Count` on removal without ever reusing an id
- * (`smart_account/storage.rs`: `add_context_rule` bumps `NextId`,
- * `remove_context_rule` only lowers `Count`), so after any removal
- * `Count < NextId` and the live ids have gaps. Iterating `0..Count-1` would
- * silently skip live rules at higher ids, and a skipped rule is a missed
- * overlap - the one error that reports safety which does not exist. Instead
- * the scan walks ids upward until it has accounted for `Count` live rules.
- *
- * A rule whose predicate cannot be read is deliberately left without one. That
- * demotes it to the `foreign` class, so the scan reports it as opaque instead
- * of assuming it is narrow.
- */
-export declare function collectObservedRules(args: {
-    reader: AccountRuleReader;
-    smartAccount: string;
-    interpreterAddress: string;
-    maxRuleIdScan?: number;
-}): Promise<CollectedRules>;
-/**
- * An `AccountRuleReader` over a live RPC server.
- *
- * The two OZ getters are read-only simulations, built the same way as
- * `getContractVersion` in `build-install-policy.ts`: the source account is
- * constructed locally because a simulation never checks its sequence number,
- * and asking the network for a random key would 404.
- *
- * The stored document is fetched as a ledger entry rather than a contract
- * call, because the interpreter publishes no getter for it.
- */
-export declare function accountRuleReaderFromServer(server: rpc.Server, networkPassphrase: string): AccountRuleReader;

package/dist/install/read-account-rules.js

@@ -1,283 +0,0 @@
-//! Reading an OpenZeppelin smart account's context rules back off chain.
-//!
-//! `authority-overlap.ts` needs to know what a signer can already do before a
-//! new policy is installed. That means every rule on the account: its context
-//! type, its signers, its attached policies, and - for rules our interpreter
-//! polices - the predicate itself.
-//!
-//! The predicate is NOT reachable through a contract call. The interpreter
-//! exposes no getter for `StoredDoc` (`lib.rs` publishes only `grammar_version`,
-//! `install`, `enforce`, the pause pair, `uninstall` and
-//! `rotate_master_signer_set`), so it is read as a ledger entry instead. That
-//! keeps this a pure client-side capability: adding a getter would change a
-//! deployed contract's ABI and force a redeploy plus re-audit to obtain data
-//! the ledger already exposes.
-//!
-//! The decoders here are pure so they can be tested without a network; the
-//! caller supplies raw `ScVal`s.
-import { Account, Address, BASE_FEE, Contract, Keypair, rpc, TransactionBuilder, xdr, } from '@stellar/stellar-sdk';
-import { decodePredicate } from "../predicate/decode.js";
-/** `storage.rs:295` - the third element of the persistent doc key tuple. */
-export const K_DOC = 1;
-/** Persistent-storage key for a rule's stored document:
- *  `(account, rule_id, K_DOC)`, per `storage.rs:4`. */
-export function docKeyScVal(smartAccount, ruleId) {
-    return xdr.ScVal.scvVec([
-        new Address(smartAccount).toScVal(),
-        xdr.ScVal.scvU32(ruleId),
-        xdr.ScVal.scvU32(K_DOC),
-    ]);
-}
-/** Ledger key for the interpreter's persistent entry holding that document. */
-export function docLedgerKey(interpreter, smartAccount, ruleId) {
-    return xdr.LedgerKey.contractData(new xdr.LedgerKeyContractData({
-        contract: new Address(interpreter).toScAddress(),
-        key: docKeyScVal(smartAccount, ruleId),
-        durability: xdr.ContractDataDurability.persistent(),
-    }));
-}
-// ---- ScVal helpers -----
-/** Field of a `#[contracttype]` struct, which the host encodes as a map keyed
- *  by field-name symbol. Returns undefined when the field is absent so a
- *  caller can distinguish "not there" from "there and empty". */
-function mapField(v, name) {
-    if (v.switch() !== xdr.ScValType.scvMap())
-        return undefined;
-    for (const entry of v.map() ?? []) {
-        const key = entry.key();
-        if (key.switch() === xdr.ScValType.scvSymbol() && key.sym().toString() === name) {
-            return entry.val();
-        }
-    }
-    return undefined;
-}
-function u32Of(v) {
-    return v?.switch() === xdr.ScValType.scvU32() ? v.u32() : undefined;
-}
-function addressOf(v) {
-    if (!v || v.switch() !== xdr.ScValType.scvAddress())
-        return undefined;
-    return Address.fromScAddress(v.address()).toString();
-}
-/** An enum variant of a `#[contracttype]` enum: `ScVal::Vec([Symbol, ...args])`. */
-function enumVariant(v) {
-    if (!v || v.switch() !== xdr.ScValType.scvVec())
-        return undefined;
-    const items = v.vec() ?? [];
-    const head = items[0];
-    if (!head || head.switch() !== xdr.ScValType.scvSymbol())
-        return undefined;
-    return { tag: head.sym().toString(), args: items.slice(1) };
-}
-// ---- decoders -----
-/** OZ `ContextRuleType`. An unrecognised tag is reported as `default`, which
- *  is the widest reading and therefore the safe one: it makes the rule look
- *  like it could serve any call, so overlap is over-reported, never missed. */
-export function decodeContextType(v) {
-    const variant = enumVariant(v);
-    if (!variant)
-        return { kind: 'default' };
-    if (variant.tag === 'CallContract') {
-        const addr = addressOf(variant.args[0]);
-        return addr ? { kind: 'call_contract', address: addr } : { kind: 'default' };
-    }
-    if (variant.tag === 'CreateContract') {
-        const arg = variant.args[0];
-        const hash = arg?.switch() === xdr.ScValType.scvBytes() ? arg.bytes().toString('hex') : '';
-        return { kind: 'create_contract', wasmHash: hash };
-    }
-    return { kind: 'default' };
-}
-/** OZ `Signer::Delegated(Address) | Signer::External(Address, Bytes)`. */
-export function decodeSigner(v) {
-    const variant = enumVariant(v);
-    if (!variant)
-        return undefined;
-    if (variant.tag === 'Delegated') {
-        const addr = addressOf(variant.args[0]);
-        return addr ? { kind: 'delegated', address: addr } : undefined;
-    }
-    if (variant.tag === 'External') {
-        const verifier = addressOf(variant.args[0]);
-        const keyArg = variant.args[1];
-        const keyBytes = keyArg?.switch() === xdr.ScValType.scvBytes() ? keyArg.bytes().toString('hex') : '';
-        return verifier ? { kind: 'external', verifier, keyBytes } : undefined;
-    }
-    return undefined;
-}
-/** A full OZ `ContextRule` as returned by `get_context_rule(id)`.
- *  `predicate` is filled in separately from the ledger entry. */
-export function decodeContextRule(v) {
-    const id = u32Of(mapField(v, 'id'));
-    if (id === undefined)
-        return undefined;
-    const signersVal = mapField(v, 'signers');
-    const signers = [];
-    if (signersVal?.switch() === xdr.ScValType.scvVec()) {
-        for (const s of signersVal.vec() ?? []) {
-            const decoded = decodeSigner(s);
-            if (decoded)
-                signers.push(decoded);
-        }
-    }
-    const policiesVal = mapField(v, 'policies');
-    const policyAddresses = [];
-    if (policiesVal?.switch() === xdr.ScValType.scvVec()) {
-        for (const p of policiesVal.vec() ?? []) {
-            const addr = addressOf(p);
-            if (addr)
-                policyAddresses.push(addr);
-        }
-    }
-    // `policy_ids` is index-aligned with `policies` in OZ's ContextRule. Only
-    // the ids can be passed to `remove_policy`, so a detach is impossible
-    // without them; they are read here rather than looked up again later.
-    const policyIdsVal = mapField(v, 'policy_ids');
-    const policyIds = [];
-    if (policyIdsVal?.switch() === xdr.ScValType.scvVec()) {
-        for (const pid of policyIdsVal.vec() ?? []) {
-            const n = u32Of(pid);
-            if (n !== undefined)
-                policyIds.push(n);
-        }
-    }
-    return {
-        id,
-        contextType: decodeContextType(mapField(v, 'context_type')),
-        signers,
-        policyAddresses,
-        ...(policyIds.length > 0 ? { policyIds } : {}),
-    };
-}
-/** `storage.rs:296` - the third element of the persistent nonce key tuple. */
-export const K_NONCE = 2;
-/** Ledger key for a rule's stored install nonce. Read directly for the same
- *  reason as the document: the interpreter publishes no getter. */
-export function nonceLedgerKey(interpreter, smartAccount, ruleId) {
-    return xdr.LedgerKey.contractData(new xdr.LedgerKeyContractData({
-        contract: new Address(interpreter).toScAddress(),
-        key: xdr.ScVal.scvVec([
-            new Address(smartAccount).toScVal(),
-            xdr.ScVal.scvU32(ruleId),
-            xdr.ScVal.scvU32(K_NONCE),
-        ]),
-        durability: xdr.ContractDataDurability.persistent(),
-    }));
-}
-export function decodeStoredOracleBounds(v) {
-    const read = (name) => u32Of(mapField(v, name));
-    const staleness = read('oracle_max_staleness_seconds');
-    const deviation = read('oracle_max_deviation_bps');
-    const xfeed = read('oracle_max_xfeed_dev_bps');
-    return {
-        ...(staleness !== undefined ? { maxStalenessSeconds: staleness } : {}),
-        ...(deviation !== undefined ? { maxDeviationBps: deviation } : {}),
-        ...(xfeed !== undefined ? { maxCrossFeedDeviationBps: xfeed } : {}),
-    };
-}
-/** Raw predicate bytes out of a `StoredDoc` ledger entry value. */
-export function decodeStoredPredicateBytes(v) {
-    const field = mapField(v, 'predicate_bytes');
-    if (!field || field.switch() !== xdr.ScValType.scvBytes())
-        return undefined;
-    return field.bytes();
-}
-/** How far the id scan will probe before giving up. OZ imposes no per-account
- *  rule cap, so there is no exact bound to derive; this one is far above any
- *  realistic account and keeps a malformed `Count` from spinning forever. */
-export const MAX_RULE_ID_SCAN = 512;
-/**
- * Every context rule on the account, with predicates filled in for the rules
- * our interpreter polices.
- *
- * Rule ids are NOT contiguous. OZ assigns them from a monotonic `NextId` and
- * decrements `Count` on removal without ever reusing an id
- * (`smart_account/storage.rs`: `add_context_rule` bumps `NextId`,
- * `remove_context_rule` only lowers `Count`), so after any removal
- * `Count < NextId` and the live ids have gaps. Iterating `0..Count-1` would
- * silently skip live rules at higher ids, and a skipped rule is a missed
- * overlap - the one error that reports safety which does not exist. Instead
- * the scan walks ids upward until it has accounted for `Count` live rules.
- *
- * A rule whose predicate cannot be read is deliberately left without one. That
- * demotes it to the `foreign` class, so the scan reports it as opaque instead
- * of assuming it is narrow.
- */
-export async function collectObservedRules(args) {
-    const count = await args.reader.getContextRuleCount(args.smartAccount);
-    const limit = args.maxRuleIdScan ?? MAX_RULE_ID_SCAN;
-    const rules = [];
-    const unreadablePredicateRuleIds = [];
-    let id = 0;
-    while (rules.length < count && id < limit) {
-        const raw = await args.reader.getContextRule(args.smartAccount, id);
-        id++;
-        if (!raw)
-            continue;
-        const rule = decodeContextRule(raw);
-        if (!rule)
-            continue;
-        if (rule.policyAddresses.includes(args.interpreterAddress)) {
-            const doc = await args.reader.getStoredDoc(args.interpreterAddress, args.smartAccount, rule.id);
-            const bytes = doc ? decodeStoredPredicateBytes(doc) : undefined;
-            if (bytes) {
-                try {
-                    rule.predicate = decodePredicate(bytes);
-                    // Carried so a merge can re-install the SAME bounds. They are
-                    // tighten-only overrides, so losing them widens the policy quietly.
-                    if (doc)
-                        rule.oracleBounds = decodeStoredOracleBounds(doc);
-                }
-                catch {
-                    unreadablePredicateRuleIds.push(rule.id);
-                }
-            }
-            else {
-                unreadablePredicateRuleIds.push(rule.id);
-            }
-        }
-        rules.push(rule);
-    }
-    return { rules, unreadablePredicateRuleIds, incomplete: rules.length < count };
-}
-/**
- * An `AccountRuleReader` over a live RPC server.
- *
- * The two OZ getters are read-only simulations, built the same way as
- * `getContractVersion` in `build-install-policy.ts`: the source account is
- * constructed locally because a simulation never checks its sequence number,
- * and asking the network for a random key would 404.
- *
- * The stored document is fetched as a ledger entry rather than a contract
- * call, because the interpreter publishes no getter for it.
- */
-export function accountRuleReaderFromServer(server, networkPassphrase) {
-    async function simulateCall(contract, method, ...args) {
-        const account = new Account(Keypair.random().publicKey(), '0');
-        const tx = new TransactionBuilder(account, { fee: BASE_FEE, networkPassphrase })
-            .addOperation(new Contract(contract).call(method, ...args))
-            .setTimeout(30)
-            .build();
-        const sim = await server.simulateTransaction(tx);
-        if (rpc.Api.isSimulationError(sim))
-            return undefined;
-        return sim.result?.retval;
-    }
-    return {
-        async getContextRuleCount(smartAccount) {
-            const val = await simulateCall(smartAccount, 'get_context_rules_count');
-            return u32Of(val) ?? 0;
-        },
-        async getContextRule(smartAccount, ruleId) {
-            return simulateCall(smartAccount, 'get_context_rule', xdr.ScVal.scvU32(ruleId));
-        },
-        async getStoredDoc(interpreter, smartAccount, ruleId) {
-            const key = docLedgerKey(interpreter, smartAccount, ruleId);
-            const res = await server.getLedgerEntries(key);
-            const entry = res.entries?.[0]?.val;
-            if (!entry || entry.switch() !== xdr.LedgerEntryType.contractData())
-                return undefined;
-            return entry.contractData().val();
-        },
-    };
-}

package/dist-cjs/install/authority-overlap.d.ts

@@ -1,134 +0,0 @@
-import type { PredicateNode, SignerDraft } from '../types.ts';
-/** Wildcard component of a `Selector`: the predicate does not pin this half. */
-export declare const ANY = "*";
-/** A (contract, function) pair a predicate may permit. `ANY` in either half
- *  means unconstrained, so `{contract: ANY, fn: ANY}` is "any call at all". */
-export interface Selector {
-    contract: string;
-    fn: string;
-}
-export type ContextType = {
-    kind: 'default';
-} | {
-    kind: 'call_contract';
-    address: string;
-} | {
-    kind: 'create_contract';
-    wasmHash: string;
-};
-/** How much we can say about a neighbouring rule.
- *  - `interpreter`: policed by our interpreter and the predicate was readable,
- *    so its authority is known exactly and it can be merged.
- *  - `foreign`: policed by some other contract. The address is visible, the
- *    semantics are not, so it must be reviewed by hand.
- *  - `unpoliced`: no policy at all. Whatever the rule's context type allows,
- *    its signers may do without constraint. */
-export type RuleClass = 'interpreter' | 'foreign' | 'unpoliced';
-export interface ObservedRule {
-    id: number;
-    contextType: ContextType;
-    signers: SignerDraft[];
-    /** Policy contract addresses attached to the rule, in OZ's order. */
-    policyAddresses: string[];
-    /** OZ's global registry ids for those policies, index-aligned with
-     *  `policyAddresses`. `remove_policy` takes the id, not the address, so
-     *  detaching a policy is impossible without them. */
-    policyIds?: number[];
-    /** Per-policy oracle bounds from the stored document, when it was
-     *  readable. A merge must re-install these or it silently widens them. */
-    oracleBounds?: {
-        maxStalenessSeconds?: number;
-        maxDeviationBps?: number;
-        maxCrossFeedDeviationBps?: number;
-    };
-    /** Decoded predicate. Present only when the rule is policed by our
-     *  interpreter AND the stored document was readable. */
-    predicate?: PredicateNode;
-}
-export interface IntendedInstall {
-    /** Rule the predicate is being installed onto. A re-install onto the same
-     *  id is a replacement, not an overlap, so this id is skipped. */
-    ruleId: number;
-    contextType: ContextType;
-    signers: SignerDraft[];
-    predicate: PredicateNode;
-}
-export type OverlapSeverity = 
-/** A neighbouring rule imposes no constraint at all on the shared calls. */
-'bypass'
-/** A neighbouring policy exists but we cannot read what it permits. */
- | 'unknown'
-/** Both rules are ours. The new rule will not restrict the shared calls,
- *  because the signer can name whichever rule is more permissive. */
- | 'not-restricting';
-export interface AuthorityOverlap {
-    ruleId: number;
-    ruleClass: RuleClass;
-    severity: OverlapSeverity;
-    /** Signers present in both rules. Overlap is only reachable by a signer who
-     *  can name both rules, so a rule sharing no signer is not a collision. */
-    sharedSigners: SignerDraft[];
-    /** The selectors both rules can serve. Non-empty by construction. */
-    sharedSelectors: Selector[];
-    /** True when the neighbour is ours and can therefore be replaced by the
-     *  conjunction of the two predicates. */
-    mergeable: boolean;
-    advice: string;
-}
-/** Canonical key for signer equality. Mirrors OZ's `Signer` enum: a delegated
- *  signer is its address, an external signer is the verifier plus the key
- *  bytes, since one verifier may hold many keys. */
-export declare function signerKey(s: SignerDraft): string;
-/** Intersection of two selector SETS: every compatible pairing survives. */
-export declare function intersectSelectors(a: Selector[], b: Selector[]): Selector[];
-/**
- * The set of `(contract, fn)` selectors a predicate may permit.
- *
- * This is a deliberate OVER-approximation: every call the predicate actually
- * permits is covered by some returned selector, and unrecognised structure
- * widens to the wildcard rather than narrowing. That direction is what makes
- * the emptiness test below sound. A call carries exactly one `(contract, fn)`,
- * so if two predicates' over-approximations do not intersect, no single call
- * can be routed to either of them and the rules provably cannot collide.
- *
- * `not` is treated as unconstrained. Complementing a selector set would need
- * the universe of addresses and function names, which is not available and
- * would not be sound to guess.
- */
-export declare function permittedSelectors(node: PredicateNode): Selector[];
-/** Selectors a context type admits, before the predicate narrows them. */
-export declare function selectorsForContextType(ct: ContextType): Selector[];
-/** What a rule can actually authorise: its context type narrowed by its
- *  predicate. An unpoliced or unreadable rule contributes no narrowing. */
-export declare function effectiveSelectors(rule: ObservedRule): Selector[];
-/**
- * Every existing rule that a signer of the intended install could name instead.
- *
- * A rule collides when it shares at least one signer AND at least one selector,
- * because both conditions are needed for the signer to have a choice. The rule
- * being installed onto is skipped: re-installing over it replaces its
- * predicate rather than adding a second source of authority.
- */
-export declare function findAuthorityOverlaps(args: {
-    intended: IntendedInstall;
-    existing: ObservedRule[];
-}): AuthorityOverlap[];
-export interface MergeResult {
-    ok: boolean;
-    predicate?: PredicateNode;
-    /** Set when `ok` is false. */
-    reason?: string;
-}
-/**
- * Conjunction of an existing predicate with a new one, for the tightening case.
- *
- * `and` children are flattened so repeated merges do not nest, which keeps the
- * encoded form closer to the byte cap.
- *
- * The guard matters more than the merge. `and` is only correct when the caller
- * means to tighten. Applied to two predicates that pin DIFFERENT selectors it
- * produces a predicate permitting nothing, which silently disables the policy
- * instead of restricting it. That case is refused, because the caller wanted
- * two capabilities and two rules already express that correctly.
- */
-export declare function mergeIntoAnd(existing: PredicateNode, incoming: PredicateNode): MergeResult;