@crediolabs/policy-synth 0.2.0 → 0.3.0

package/src/install/read-account-rules.ts

@@ -1,376 +0,0 @@
-//! Reading an OpenZeppelin smart account's context rules back off chain.
-//!
-//! `authority-overlap.ts` needs to know what a signer can already do before a
-//! new policy is installed. That means every rule on the account: its context
-//! type, its signers, its attached policies, and - for rules our interpreter
-//! polices - the predicate itself.
-//!
-//! The predicate is NOT reachable through a contract call. The interpreter
-//! exposes no getter for `StoredDoc` (`lib.rs` publishes only `grammar_version`,
-//! `install`, `enforce`, the pause pair, `uninstall` and
-//! `rotate_master_signer_set`), so it is read as a ledger entry instead. That
-//! keeps this a pure client-side capability: adding a getter would change a
-//! deployed contract's ABI and force a redeploy plus re-audit to obtain data
-//! the ledger already exposes.
-//!
-//! The decoders here are pure so they can be tested without a network; the
-//! caller supplies raw `ScVal`s.
-
-import {
-  Account,
-  Address,
-  BASE_FEE,
-  Contract,
-  Keypair,
-  rpc,
-  TransactionBuilder,
-  xdr,
-} from '@stellar/stellar-sdk'
-import { decodePredicate } from '../predicate/decode.ts'
-import type { SignerDraft } from '../types.ts'
-import type { ContextType, ObservedRule } from './authority-overlap.ts'
-
-/** `storage.rs:295` - the third element of the persistent doc key tuple. */
-export const K_DOC = 1
-
-/** Persistent-storage key for a rule's stored document:
- *  `(account, rule_id, K_DOC)`, per `storage.rs:4`. */
-export function docKeyScVal(smartAccount: string, ruleId: number): xdr.ScVal {
-  return xdr.ScVal.scvVec([
-    new Address(smartAccount).toScVal(),
-    xdr.ScVal.scvU32(ruleId),
-    xdr.ScVal.scvU32(K_DOC),
-  ])
-}
-
-/** Ledger key for the interpreter's persistent entry holding that document. */
-export function docLedgerKey(
-  interpreter: string,
-  smartAccount: string,
-  ruleId: number
-): xdr.LedgerKey {
-  return xdr.LedgerKey.contractData(
-    new xdr.LedgerKeyContractData({
-      contract: new Address(interpreter).toScAddress(),
-      key: docKeyScVal(smartAccount, ruleId),
-      durability: xdr.ContractDataDurability.persistent(),
-    })
-  )
-}
-
-// ---- ScVal helpers -----
-
-/** Field of a `#[contracttype]` struct, which the host encodes as a map keyed
- *  by field-name symbol. Returns undefined when the field is absent so a
- *  caller can distinguish "not there" from "there and empty". */
-function mapField(v: xdr.ScVal, name: string): xdr.ScVal | undefined {
-  if (v.switch() !== xdr.ScValType.scvMap()) return undefined
-  for (const entry of v.map() ?? []) {
-    const key = entry.key()
-    if (key.switch() === xdr.ScValType.scvSymbol() && key.sym().toString() === name) {
-      return entry.val()
-    }
-  }
-  return undefined
-}
-
-function u32Of(v: xdr.ScVal | undefined): number | undefined {
-  return v?.switch() === xdr.ScValType.scvU32() ? v.u32() : undefined
-}
-
-function addressOf(v: xdr.ScVal | undefined): string | undefined {
-  if (!v || v.switch() !== xdr.ScValType.scvAddress()) return undefined
-  return Address.fromScAddress(v.address()).toString()
-}
-
-/** An enum variant of a `#[contracttype]` enum: `ScVal::Vec([Symbol, ...args])`. */
-function enumVariant(v: xdr.ScVal | undefined): { tag: string; args: xdr.ScVal[] } | undefined {
-  if (!v || v.switch() !== xdr.ScValType.scvVec()) return undefined
-  const items = v.vec() ?? []
-  const head = items[0]
-  if (!head || head.switch() !== xdr.ScValType.scvSymbol()) return undefined
-  return { tag: head.sym().toString(), args: items.slice(1) }
-}
-
-// ---- decoders -----
-
-/** OZ `ContextRuleType`. An unrecognised tag is reported as `default`, which
- *  is the widest reading and therefore the safe one: it makes the rule look
- *  like it could serve any call, so overlap is over-reported, never missed. */
-export function decodeContextType(v: xdr.ScVal | undefined): ContextType {
-  const variant = enumVariant(v)
-  if (!variant) return { kind: 'default' }
-  if (variant.tag === 'CallContract') {
-    const addr = addressOf(variant.args[0])
-    return addr ? { kind: 'call_contract', address: addr } : { kind: 'default' }
-  }
-  if (variant.tag === 'CreateContract') {
-    const arg = variant.args[0]
-    const hash = arg?.switch() === xdr.ScValType.scvBytes() ? arg.bytes().toString('hex') : ''
-    return { kind: 'create_contract', wasmHash: hash }
-  }
-  return { kind: 'default' }
-}
-
-/** OZ `Signer::Delegated(Address) | Signer::External(Address, Bytes)`. */
-export function decodeSigner(v: xdr.ScVal): SignerDraft | undefined {
-  const variant = enumVariant(v)
-  if (!variant) return undefined
-  if (variant.tag === 'Delegated') {
-    const addr = addressOf(variant.args[0])
-    return addr ? { kind: 'delegated', address: addr } : undefined
-  }
-  if (variant.tag === 'External') {
-    const verifier = addressOf(variant.args[0])
-    const keyArg = variant.args[1]
-    const keyBytes =
-      keyArg?.switch() === xdr.ScValType.scvBytes() ? keyArg.bytes().toString('hex') : ''
-    return verifier ? { kind: 'external', verifier, keyBytes } : undefined
-  }
-  return undefined
-}
-
-/** A full OZ `ContextRule` as returned by `get_context_rule(id)`.
- *  `predicate` is filled in separately from the ledger entry. */
-export function decodeContextRule(v: xdr.ScVal): ObservedRule | undefined {
-  const id = u32Of(mapField(v, 'id'))
-  if (id === undefined) return undefined
-
-  const signersVal = mapField(v, 'signers')
-  const signers: SignerDraft[] = []
-  if (signersVal?.switch() === xdr.ScValType.scvVec()) {
-    for (const s of signersVal.vec() ?? []) {
-      const decoded = decodeSigner(s)
-      if (decoded) signers.push(decoded)
-    }
-  }
-
-  const policiesVal = mapField(v, 'policies')
-  const policyAddresses: string[] = []
-  if (policiesVal?.switch() === xdr.ScValType.scvVec()) {
-    for (const p of policiesVal.vec() ?? []) {
-      const addr = addressOf(p)
-      if (addr) policyAddresses.push(addr)
-    }
-  }
-
-  // `policy_ids` is index-aligned with `policies` in OZ's ContextRule. Only
-  // the ids can be passed to `remove_policy`, so a detach is impossible
-  // without them; they are read here rather than looked up again later.
-  const policyIdsVal = mapField(v, 'policy_ids')
-  const policyIds: number[] = []
-  if (policyIdsVal?.switch() === xdr.ScValType.scvVec()) {
-    for (const pid of policyIdsVal.vec() ?? []) {
-      const n = u32Of(pid)
-      if (n !== undefined) policyIds.push(n)
-    }
-  }
-
-  return {
-    id,
-    contextType: decodeContextType(mapField(v, 'context_type')),
-    signers,
-    policyAddresses,
-    ...(policyIds.length > 0 ? { policyIds } : {}),
-  }
-}
-
-/** `storage.rs:296` - the third element of the persistent nonce key tuple. */
-export const K_NONCE = 2
-
-/** Ledger key for a rule's stored install nonce. Read directly for the same
- *  reason as the document: the interpreter publishes no getter. */
-export function nonceLedgerKey(
-  interpreter: string,
-  smartAccount: string,
-  ruleId: number
-): xdr.LedgerKey {
-  return xdr.LedgerKey.contractData(
-    new xdr.LedgerKeyContractData({
-      contract: new Address(interpreter).toScAddress(),
-      key: xdr.ScVal.scvVec([
-        new Address(smartAccount).toScVal(),
-        xdr.ScVal.scvU32(ruleId),
-        xdr.ScVal.scvU32(K_NONCE),
-      ]),
-      durability: xdr.ContractDataDurability.persistent(),
-    })
-  )
-}
-
-/** Per-policy oracle bounds carried on a `StoredDoc`.
- *
- *  These must survive a merge. They are tighten-only overrides against the
- *  wasm defaults, so dropping them does not fail loudly: the rule keeps
- *  working and silently tolerates staler prices and wider deviation than its
- *  author chose. */
-export interface StoredOracleBounds {
-  maxStalenessSeconds?: number
-  maxDeviationBps?: number
-  maxCrossFeedDeviationBps?: number
-}
-
-export function decodeStoredOracleBounds(v: xdr.ScVal): StoredOracleBounds {
-  const read = (name: string): number | undefined => u32Of(mapField(v, name))
-  const staleness = read('oracle_max_staleness_seconds')
-  const deviation = read('oracle_max_deviation_bps')
-  const xfeed = read('oracle_max_xfeed_dev_bps')
-  return {
-    ...(staleness !== undefined ? { maxStalenessSeconds: staleness } : {}),
-    ...(deviation !== undefined ? { maxDeviationBps: deviation } : {}),
-    ...(xfeed !== undefined ? { maxCrossFeedDeviationBps: xfeed } : {}),
-  }
-}
-
-/** Raw predicate bytes out of a `StoredDoc` ledger entry value. */
-export function decodeStoredPredicateBytes(v: xdr.ScVal): Buffer | undefined {
-  const field = mapField(v, 'predicate_bytes')
-  if (!field || field.switch() !== xdr.ScValType.scvBytes()) return undefined
-  return field.bytes()
-}
-
-// ---- collection -----
-
-/** The three reads the scan needs. Kept as an interface so the collection
- *  below is testable without a network, matching the `InstallRpcClient`
- *  pattern in `build-install-policy.ts`. */
-export interface AccountRuleReader {
-  /** OZ `get_context_rules_count()`. */
-  getContextRuleCount(smartAccount: string): Promise<number>
-  /** OZ `get_context_rule(id)`. Undefined when the id is absent. */
-  getContextRule(smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>
-  /** The interpreter's persistent `StoredDoc` entry, read as a ledger entry.
-   *  Undefined when no document is stored for that rule. */
-  getStoredDoc(
-    interpreter: string,
-    smartAccount: string,
-    ruleId: number
-  ): Promise<xdr.ScVal | undefined>
-}
-
-/** How far the id scan will probe before giving up. OZ imposes no per-account
- *  rule cap, so there is no exact bound to derive; this one is far above any
- *  realistic account and keeps a malformed `Count` from spinning forever. */
-export const MAX_RULE_ID_SCAN = 512
-
-export interface CollectedRules {
-  rules: ObservedRule[]
-  /** Rule ids whose stored predicate could not be read even though the
-   *  interpreter is attached. Such a rule is reported without a predicate,
-   *  which classifies it as opaque rather than as safely narrow. */
-  unreadablePredicateRuleIds: number[]
-  /** True when the scan stopped before accounting for every live rule. The
-   *  result is then a SUBSET of the account's rules, so an empty overlap list
-   *  proves nothing and the caller must not present it as safety. */
-  incomplete: boolean
-}
-
-/**
- * Every context rule on the account, with predicates filled in for the rules
- * our interpreter polices.
- *
- * Rule ids are NOT contiguous. OZ assigns them from a monotonic `NextId` and
- * decrements `Count` on removal without ever reusing an id
- * (`smart_account/storage.rs`: `add_context_rule` bumps `NextId`,
- * `remove_context_rule` only lowers `Count`), so after any removal
- * `Count < NextId` and the live ids have gaps. Iterating `0..Count-1` would
- * silently skip live rules at higher ids, and a skipped rule is a missed
- * overlap - the one error that reports safety which does not exist. Instead
- * the scan walks ids upward until it has accounted for `Count` live rules.
- *
- * A rule whose predicate cannot be read is deliberately left without one. That
- * demotes it to the `foreign` class, so the scan reports it as opaque instead
- * of assuming it is narrow.
- */
-export async function collectObservedRules(args: {
-  reader: AccountRuleReader
-  smartAccount: string
-  interpreterAddress: string
-  maxRuleIdScan?: number
-}): Promise<CollectedRules> {
-  const count = await args.reader.getContextRuleCount(args.smartAccount)
-  const limit = args.maxRuleIdScan ?? MAX_RULE_ID_SCAN
-  const rules: ObservedRule[] = []
-  const unreadablePredicateRuleIds: number[] = []
-
-  let id = 0
-  while (rules.length < count && id < limit) {
-    const raw = await args.reader.getContextRule(args.smartAccount, id)
-    id++
-    if (!raw) continue
-    const rule = decodeContextRule(raw)
-    if (!rule) continue
-
-    if (rule.policyAddresses.includes(args.interpreterAddress)) {
-      const doc = await args.reader.getStoredDoc(
-        args.interpreterAddress,
-        args.smartAccount,
-        rule.id
-      )
-      const bytes = doc ? decodeStoredPredicateBytes(doc) : undefined
-      if (bytes) {
-        try {
-          rule.predicate = decodePredicate(bytes)
-          // Carried so a merge can re-install the SAME bounds. They are
-          // tighten-only overrides, so losing them widens the policy quietly.
-          if (doc) rule.oracleBounds = decodeStoredOracleBounds(doc)
-        } catch {
-          unreadablePredicateRuleIds.push(rule.id)
-        }
-      } else {
-        unreadablePredicateRuleIds.push(rule.id)
-      }
-    }
-    rules.push(rule)
-  }
-
-  return { rules, unreadablePredicateRuleIds, incomplete: rules.length < count }
-}
-
-/**
- * An `AccountRuleReader` over a live RPC server.
- *
- * The two OZ getters are read-only simulations, built the same way as
- * `getContractVersion` in `build-install-policy.ts`: the source account is
- * constructed locally because a simulation never checks its sequence number,
- * and asking the network for a random key would 404.
- *
- * The stored document is fetched as a ledger entry rather than a contract
- * call, because the interpreter publishes no getter for it.
- */
-export function accountRuleReaderFromServer(
-  server: rpc.Server,
-  networkPassphrase: string
-): AccountRuleReader {
-  async function simulateCall(
-    contract: string,
-    method: string,
-    ...args: xdr.ScVal[]
-  ): Promise<xdr.ScVal | undefined> {
-    const account = new Account(Keypair.random().publicKey(), '0')
-    const tx = new TransactionBuilder(account, { fee: BASE_FEE, networkPassphrase })
-      .addOperation(new Contract(contract).call(method, ...args))
-      .setTimeout(30)
-      .build()
-    const sim = await server.simulateTransaction(tx)
-    if (rpc.Api.isSimulationError(sim)) return undefined
-    return sim.result?.retval
-  }
-
-  return {
-    async getContextRuleCount(smartAccount) {
-      const val = await simulateCall(smartAccount, 'get_context_rules_count')
-      return u32Of(val) ?? 0
-    },
-    async getContextRule(smartAccount, ruleId) {
-      return simulateCall(smartAccount, 'get_context_rule', xdr.ScVal.scvU32(ruleId))
-    },
-    async getStoredDoc(interpreter, smartAccount, ruleId) {
-      const key = docLedgerKey(interpreter, smartAccount, ruleId)
-      const res = await server.getLedgerEntries(key)
-      const entry = res.entries?.[0]?.val
-      if (!entry || entry.switch() !== xdr.LedgerEntryType.contractData()) return undefined
-      return entry.contractData().val()
-    },
-  }
-}

package/src/ir/index.ts

@@ -1,13 +0,0 @@
-// src/ir/index.ts - re-export the PolicyIR ("Policy Tree") types.
-
-export type {
-  IRCompare,
-  IRCompOp,
-  IRCondition,
-  IRLogic,
-  IRPolicyRule,
-  IRScalarType,
-  IRSelector,
-  IRVecMode,
-  PolicyIR,
-} from './types.ts'

package/src/ir/types.ts

@@ -1,132 +0,0 @@
-// src/ir/types.ts - the PolicyIR ("Policy Tree").
-//
-// `PolicyIR` is the custody-agnostic "Policy Tree" hub (the diagram's Policy
-// Tree) that every CustodyAdapter compiles FROM. It generalizes the NEAR-V2
-// policy schema (roles / scope filter / guard / constraint / comparison leaves /
-// default behaviour) into one chain-neutral shape and extends it with the
-// OZ-only selectors (spend window, oracle price, invocation count, time) so a
-// single IR can serve every backend. NEAR-V2 has no stateful spend window,
-// oracle, time/expiry, or invocation-count; those are marked as OZ extensions
-// below and are only lowered by adapters that declare support for them.
-
-/** Comparison operator. Mirrors NEAR-V2 `CompOp`. */
-export type IRCompOp = 'eq' | 'lt' | 'lte' | 'gt' | 'gte'
-
-/** Boolean combinator. Mirrors NEAR-V2 `LogicOp`. */
-export type IRLogic = 'and' | 'or'
-
-/** Vector match mode for a repeated arg. Mirrors NEAR-V2 `VecMode`. */
-export type IRVecMode = 'all' | 'any'
-
-/** Scalar value type. Mirrors NEAR-V2 `ScValType`, superset for OZ. */
-export type IRScalarType =
-  | 'address'
-  | 'i128'
-  | 'u128'
-  | 'u32'
-  | 'u64'
-  | 'i64'
-  | 'symbol'
-  | 'bytes'
-  | 'bool'
-
-/** WHERE in the authorized call a value is read. NEAR-V2 selectors first, OZ
- *  extensions after (an adapter that cannot express an extension flags it). */
-export type IRSelector =
-  // --- NEAR-V2 selectors ---
-  | {
-      kind: 'arg'
-      argIndex: number
-      fieldIndex?: number
-      vecMode?: IRVecMode
-      scalarType: IRScalarType
-    } // Stellar StellarComp
-  | { kind: 'arg_len'; argIndex: number } // length of a vec-typed argument as u32
-  | {
-      kind: 'arg_field'
-      argIndex: number
-      element: number
-      field: string
-      scalarType: IRScalarType
-    } // field of a map element within a vec-typed argument
-  | { kind: 'calldata'; offset: number; length: number } // EVM ByteComp
-  | { kind: 'value' } // EVM tx.value
-  // --- OZ extensions (not in NEAR-V2; lowered only by adapters that support them) ---
-  | { kind: 'amount'; token: string } // token amount this call moves
-  | { kind: 'window_spent'; token: string; windowSeconds: number } // stateful cumulative spend
-  | { kind: 'invocation_count'; windowSeconds: number }
-  | { kind: 'now' }
-  | { kind: 'valid_until' }
-  | { kind: 'oracle_price'; asset: string }
-
-/** A single comparison leaf. `value` is a decimal/hex string (i128-safe;
- *  never a JS number). */
-export interface IRCompare {
-  selector: IRSelector
-  operator: IRCompOp
-  value: string
-  /** Decimal basis of `value`, for selectors whose comparand is not on a basis
-   *  the contract can infer. Set for `oracle_price`, where prices normalise to
-   *  9 dp and an undeclared basis fails OPEN. */
-  valueDecimals?: number
-}
-
-/** Condition tree. NEAR-V2 guard/constraint are flat And/Or; the IR allows
- *  nesting + `not` + `in` + `eq_seq` so the same IR can later lower to the OZ
- *  predicate DSL. Week-1 adapters only lower the flat supported subset and flag
- *  the rest. */
-export type IRCondition =
-  | { op: 'and' | 'or'; children: IRCondition[] }
-  | { op: 'not'; child: IRCondition }
-  | { op: 'compare'; compare: IRCompare }
-  | { op: 'in'; selector: IRSelector; values: string[] }
-  /** Exact ordered sequence equality. The IR-level selector value MUST EQUAL
-   *  `values` as an ORDERED sequence (e.g. a swap hop `path`). `in` is pure
-   *  set membership and cannot express order; `eq_seq` is the construct that
-   *  does. Adapters that cannot express an exact ordered vector (OZ built-ins)
-   *  flag this as `uncovered` rather than silently dropping it. */
-  | { op: 'eq_seq'; selector: IRSelector; values: string[] }
-  /** A swap's output floor, expressed against its own input: the output arg
-   *  must be at least `inArgIndex * num / den`.
-   *
-   *  It is its own construct because `compare` bounds a selector against a
-   *  CONSTANT, and a slippage floor has no constant to bound against - the
-   *  acceptable output depends on the input of the same call. Encoding the
-   *  recorded output as a constant would pin a policy to one trade size.
-   *
-   *  `num/den` is the caller's minimum acceptable output per unit of input.
-   *  It is never derived from the recording: the recorded rate is a price at
-   *  one moment, and freezing it as policy would deny normal trades later.
-   *  Adapters that cannot express it (the OZ built-ins) flag it `uncovered`. */
-  | {
-      op: 'slippage_floor'
-      outArgIndex: number
-      inArgIndex: number
-      num: string
-      den: string
-    }
-
-export interface IRPolicyRule {
-  /** NEAR-V2 roles whitelist (empty = any; owner exempt). */
-  roles: string[]
-  /** NEAR-V2 scope filter; each field optional (absent = wildcard). */
-  scope: { chainId?: number; contract?: string; method?: string }
-  /** NEAR-V2 guard (applicability; skip the rule when it fails). */
-  guard?: IRCondition
-  /** NEAR-V2 constraint (AND; reject the transaction when any fails). */
-  constraints: IRCondition[]
-  // --- OZ extensions ---
-  /** M-of-N approval (OZ threshold primitives). */
-  approval?: { kind: 'threshold'; threshold: number; weights?: Record<string, number> }
-  /** OZ context-rule expiry. */
-  expiry?: { validUntilLedger?: number; validUntilUnixSeconds?: number }
-}
-
-export interface PolicyIR {
-  /** NEAR-V2 PolicyChain. */
-  chain: 'stellar' | 'evm'
-  /** NEAR-V2 DefaultBehavior. OZ context rules are deny-by-default, so
-   *  `deny_all` is the OZ default fallback when no rule matches. */
-  defaultBehavior: 'allow_all' | 'deny_all'
-  rules: IRPolicyRule[]
-}

package/src/mandate/index.ts

@@ -1,4 +0,0 @@
-// src/mandate/index.ts - re-export the Mandate source.
-
-export { mandateToPolicyIR } from './to-ir.ts'
-export type { MandateSpec } from './types.ts'

package/src/mandate/to-ir.ts

@@ -1,71 +0,0 @@
-// src/mandate/to-ir.ts - deterministic lowering of a MandateSpec to a PolicyIR.
-//
-// `mandateToPolicyIR` is pure and total: the same spec always lowers to a
-// byte-identical PolicyIR. No decoding, no inference, no clock. Each mandate
-// field maps to exactly one IR construct:
-//   contract/method  -> rule.scope
-//   spendingLimit    -> a `window_spent(token,window) <= limit` compare
-//   approvalThreshold-> rule.approval.threshold
-//   recipients       -> an `in` condition on the recipient arg (flagged as not
-//                       covered by the OZ adapter; that is expected)
-//   expiry           -> rule.expiry
-// The top-level default is `deny_all` (OZ context rules are deny-by-default).
-
-import type { IRCondition, IRPolicyRule, IRSelector, PolicyIR } from '../ir/types.ts'
-import type { MandateSpec } from './types.ts'
-
-/** Arg index the recipient allowlist constrains. Pinned to the SEP-41
- *  `transfer(from, to, amount)` convention where `to` is arg 1. This condition
- *  is flagged as not covered by the OZ adapter (no built-in primitive expresses
- *  an arg allowlist), so the index only needs to be deterministic in week-1. */
-const RECIPIENT_ARG_INDEX = 1
-
-export function mandateToPolicyIR(spec: MandateSpec): PolicyIR {
-  const scope: IRPolicyRule['scope'] = { contract: spec.contract }
-  if (spec.method !== undefined) scope.method = spec.method
-
-  const constraints: IRCondition[] = []
-
-  if (spec.spendingLimit) {
-    constraints.push({
-      op: 'compare',
-      compare: {
-        selector: {
-          kind: 'window_spent',
-          token: spec.spendingLimit.token,
-          windowSeconds: spec.spendingLimit.windowSeconds,
-        },
-        operator: 'lte',
-        value: spec.spendingLimit.limit,
-      },
-    })
-  }
-
-  if (spec.recipients && spec.recipients.length > 0) {
-    const selector: IRSelector = {
-      kind: 'arg',
-      argIndex: RECIPIENT_ARG_INDEX,
-      scalarType: 'address',
-    }
-    constraints.push({ op: 'in', selector, values: [...spec.recipients] })
-  }
-
-  const rule: IRPolicyRule = { roles: [], scope, constraints }
-
-  if (spec.approvalThreshold !== undefined) {
-    rule.approval = { kind: 'threshold', threshold: spec.approvalThreshold }
-  }
-
-  if (spec.expiry) {
-    const expiry: NonNullable<IRPolicyRule['expiry']> = {}
-    if (spec.expiry.validUntilLedger !== undefined) {
-      expiry.validUntilLedger = spec.expiry.validUntilLedger
-    }
-    if (spec.expiry.validUntilUnixSeconds !== undefined) {
-      expiry.validUntilUnixSeconds = spec.expiry.validUntilUnixSeconds
-    }
-    rule.expiry = expiry
-  }
-
-  return { chain: spec.chain, defaultBehavior: 'deny_all', rules: [rule] }
-}

package/src/mandate/types.ts

@@ -1,21 +0,0 @@
-// src/mandate/types.ts - the deterministic Mandate source.
-//
-// A MandateSpec is a declarative policy statement: "this account may call this
-// contract, spending at most L per window, requiring M approvals, to these
-// recipients, until this expiry". It carries NO transaction to decode, NO
-// parseConfidence, and NO inference - it lowers deterministically to a
-// PolicyIR. It is the clean end-to-end demo path, co-equal with the recorder.
-
-export interface MandateSpec {
-  chain: 'stellar'
-  contract: string
-  method?: string
-  /** -> OZ `spending_limit` primitive. `limit` is an i128 decimal string. */
-  spendingLimit?: { token: string; limit: string; windowSeconds: number }
-  /** -> OZ `simple_threshold` / `weighted_threshold` primitive. */
-  approvalThreshold?: number
-  /** Recipient allowlist -> an `in` arg condition (not covered by an OZ built-in). */
-  recipients?: string[]
-  /** -> OZ context-rule expiry. */
-  expiry?: { validUntilLedger?: number; validUntilUnixSeconds?: number }
-}

package/src/seams/index.ts

@@ -1,11 +0,0 @@
-// src/seams/index.ts - re-export the three custody-seam contracts.
-
-export type {
-  ChainDecoder,
-  CompileResult,
-  CustodyAdapter,
-  CustodyCapabilities,
-  CustodyMode,
-  PolicySource,
-  SimulationResult,
-} from './types.ts'