@crediolabs/policy-synth 0.2.0 → 0.3.1

package/src/install/plan-merge-policy.ts

@@ -1,133 +0,0 @@
-//! Planning the merge remedy for a cross-rule authority overlap.
-//!
-//! When two rules our interpreter polices can serve the same calls, the
-//! tightening remedy is to replace one rule's predicate with the conjunction
-//! of both (see `authority-overlap.ts`). Carrying that out against an OZ smart
-//! account is not one call, and the reasons are worth stating because they
-//! shape the whole tool:
-//!
-//!   1. A Soroban transaction carries exactly ONE operation - "smart contract
-//!      transactions can only have one operation per transaction" - so the
-//!      detach and the re-attach cannot be bundled even though the host would
-//!      run them in order happily. And `add_policy` panics `DuplicatePolicy`
-//!      while the policy is still attached (`smart_account/storage.rs`
-//!      `add_policy`), so the second transaction cannot even be simulated
-//!      until the first has confirmed.
-//!   2. `remove_policy` calls `try_uninstall` and DISCARDS the result
-//!      (`smart_account/storage.rs`: `let _ = ...try_uninstall(...)`), so the
-//!      policy is detached whether or not our `uninstall` succeeded. When it
-//!      succeeded the document, nonce, signer hash, master set and counters
-//!      are gone and the re-install is a fresh install at nonce 1. When it
-//!      panicked - our `uninstall` panics `MissingState` if the master set has
-//!      been archived - the nonce SURVIVES, and re-installing at 1 would be
-//!      refused on chain as a replay, leaving the rule stuck unpoliced. The
-//!      nonce is therefore READ at reinstall time rather than assumed.
-//!   3. Because of (2), any rate-limit or spend window on that rule is reset
-//!      by the merge. A signer who had consumed most of a window gets a clean
-//!      one. That is a real cost of tightening this way and the caller has to
-//!      be told, not discover it.
-//!   4. So the caller performs step 1, waits for it to confirm, then asks for
-//!      step 2.
-//!
-//! This module is pure. It decides what should happen and why; the XDR is
-//! built by `build-merge-policy.ts`.
-
-import type { PredicateNode } from '../types.ts'
-import type { ObservedRule } from './authority-overlap.ts'
-import { type MergeResult, mergeIntoAnd } from './authority-overlap.ts'
-
-export type MergeStep = 'detach' | 'reinstall'
-
-export interface MergePlanRefused {
-  ok: false
-  /** Why the merge cannot proceed, in terms the caller can act on. */
-  reason: string
-}
-
-export interface MergePlanAccepted {
-  ok: true
-  /** The conjunction to install in step 2. */
-  predicate: PredicateNode
-  /** OZ registry id of the interpreter policy on this rule, for
-   *  `remove_policy`. */
-  policyId: number
-  /** Oracle bounds to re-install with the merged predicate. Carried from the
-   *  document being replaced: they are tighten-only overrides against the wasm
-   *  defaults, so omitting them would quietly widen the policy while the
-   *  operator believed they were tightening it. */
-  oracleParams?: {
-    maxStalenessSeconds?: number
-    maxDeviationBps?: number
-    maxCrossFeedDeviationBps?: number
-  }
-  /** Consequences the caller must see BEFORE signing step 1, because step 1 is
-   *  the destructive one. */
-  warnings: string[]
-  /** What the caller should do after the requested step confirms. */
-  followUp: string
-}
-
-export type MergePlan = MergePlanRefused | MergePlanAccepted
-
-/** The interpreter's registry id on a rule, or null when it is not attached
- *  or the ids were not readable. */
-export function interpreterPolicyId(rule: ObservedRule, interpreterAddress: string): number | null {
-  const index = rule.policyAddresses.indexOf(interpreterAddress)
-  if (index < 0) return null
-  const id = rule.policyIds?.[index]
-  return typeof id === 'number' ? id : null
-}
-
-/**
- * Decide whether the merge can proceed, and say what it will cost.
- *
- * Refuses rather than guesses whenever the account is not in the shape the
- * remedy assumes: the rule must be policed by our interpreter, its predicate
- * must have been readable, and the ids needed to detach it must be present. A
- * merge built on a predicate we could not read would silently replace a rule
- * with something narrower or wider than its author wrote.
- */
-export function planMergePolicy(args: {
-  rule: ObservedRule
-  interpreterAddress: string
-  incoming: PredicateNode
-  step: MergeStep
-}): MergePlan {
-  const policyId = interpreterPolicyId(args.rule, args.interpreterAddress)
-  if (policyId === null) {
-    return {
-      ok: false,
-      reason: `rule ${args.rule.id} is not policed by the interpreter at ${args.interpreterAddress}, or its policy ids could not be read, so there is nothing to merge into and no id to detach. The merge hard-pins to that interpreter and has no opt-out: the auth digest it builds binds to the audited deployment. A rule installed against a different interpreter has to be replaced rather than merged.`,
-    }
-  }
-
-  const existing = args.rule.predicate
-  if (!existing) {
-    return {
-      ok: false,
-      reason: `the predicate installed on rule ${args.rule.id} could not be read, so it cannot be conjoined; merging against an unknown predicate would replace the rule with something other than what its author wrote`,
-    }
-  }
-
-  const merged: MergeResult = mergeIntoAnd(existing, args.incoming)
-  if (!merged.ok || !merged.predicate) {
-    return { ok: false, reason: merged.reason ?? 'the two predicates cannot be conjoined' }
-  }
-
-  const warnings = [
-    `detaching the policy uninstalls it, which removes every counter on rule ${args.rule.id}: any rate limit or spend window there restarts from zero after the merge`,
-    'the rule is unpoliced between the two transactions, so a signer of it is unconstrained by this policy until step 2 confirms',
-  ]
-
-  return {
-    ok: true,
-    predicate: merged.predicate,
-    policyId,
-    ...(args.rule.oracleBounds ? { oracleParams: args.rule.oracleBounds } : {}),
-    warnings,
-    followUp:
-      args.step === 'detach'
-        ? "sign and submit this transaction, wait for it to confirm, then call again with step: 'reinstall' to install the merged predicate"
-        : 'sign and submit this transaction; the merged predicate is then the only policy governing this rule',
-  }
-}

package/src/install/read-account-rules.ts

@@ -1,376 +0,0 @@
-//! Reading an OpenZeppelin smart account's context rules back off chain.
-//!
-//! `authority-overlap.ts` needs to know what a signer can already do before a
-//! new policy is installed. That means every rule on the account: its context
-//! type, its signers, its attached policies, and - for rules our interpreter
-//! polices - the predicate itself.
-//!
-//! The predicate is NOT reachable through a contract call. The interpreter
-//! exposes no getter for `StoredDoc` (`lib.rs` publishes only `grammar_version`,
-//! `install`, `enforce`, the pause pair, `uninstall` and
-//! `rotate_master_signer_set`), so it is read as a ledger entry instead. That
-//! keeps this a pure client-side capability: adding a getter would change a
-//! deployed contract's ABI and force a redeploy plus re-audit to obtain data
-//! the ledger already exposes.
-//!
-//! The decoders here are pure so they can be tested without a network; the
-//! caller supplies raw `ScVal`s.
-
-import {
-  Account,
-  Address,
-  BASE_FEE,
-  Contract,
-  Keypair,
-  rpc,
-  TransactionBuilder,
-  xdr,
-} from '@stellar/stellar-sdk'
-import { decodePredicate } from '../predicate/decode.ts'
-import type { SignerDraft } from '../types.ts'
-import type { ContextType, ObservedRule } from './authority-overlap.ts'
-
-/** `storage.rs:295` - the third element of the persistent doc key tuple. */
-export const K_DOC = 1
-
-/** Persistent-storage key for a rule's stored document:
- *  `(account, rule_id, K_DOC)`, per `storage.rs:4`. */
-export function docKeyScVal(smartAccount: string, ruleId: number): xdr.ScVal {
-  return xdr.ScVal.scvVec([
-    new Address(smartAccount).toScVal(),
-    xdr.ScVal.scvU32(ruleId),
-    xdr.ScVal.scvU32(K_DOC),
-  ])
-}
-
-/** Ledger key for the interpreter's persistent entry holding that document. */
-export function docLedgerKey(
-  interpreter: string,
-  smartAccount: string,
-  ruleId: number
-): xdr.LedgerKey {
-  return xdr.LedgerKey.contractData(
-    new xdr.LedgerKeyContractData({
-      contract: new Address(interpreter).toScAddress(),
-      key: docKeyScVal(smartAccount, ruleId),
-      durability: xdr.ContractDataDurability.persistent(),
-    })
-  )
-}
-
-// ---- ScVal helpers -----
-
-/** Field of a `#[contracttype]` struct, which the host encodes as a map keyed
- *  by field-name symbol. Returns undefined when the field is absent so a
- *  caller can distinguish "not there" from "there and empty". */
-function mapField(v: xdr.ScVal, name: string): xdr.ScVal | undefined {
-  if (v.switch() !== xdr.ScValType.scvMap()) return undefined
-  for (const entry of v.map() ?? []) {
-    const key = entry.key()
-    if (key.switch() === xdr.ScValType.scvSymbol() && key.sym().toString() === name) {
-      return entry.val()
-    }
-  }
-  return undefined
-}
-
-function u32Of(v: xdr.ScVal | undefined): number | undefined {
-  return v?.switch() === xdr.ScValType.scvU32() ? v.u32() : undefined
-}
-
-function addressOf(v: xdr.ScVal | undefined): string | undefined {
-  if (!v || v.switch() !== xdr.ScValType.scvAddress()) return undefined
-  return Address.fromScAddress(v.address()).toString()
-}
-
-/** An enum variant of a `#[contracttype]` enum: `ScVal::Vec([Symbol, ...args])`. */
-function enumVariant(v: xdr.ScVal | undefined): { tag: string; args: xdr.ScVal[] } | undefined {
-  if (!v || v.switch() !== xdr.ScValType.scvVec()) return undefined
-  const items = v.vec() ?? []
-  const head = items[0]
-  if (!head || head.switch() !== xdr.ScValType.scvSymbol()) return undefined
-  return { tag: head.sym().toString(), args: items.slice(1) }
-}
-
-// ---- decoders -----
-
-/** OZ `ContextRuleType`. An unrecognised tag is reported as `default`, which
- *  is the widest reading and therefore the safe one: it makes the rule look
- *  like it could serve any call, so overlap is over-reported, never missed. */
-export function decodeContextType(v: xdr.ScVal | undefined): ContextType {
-  const variant = enumVariant(v)
-  if (!variant) return { kind: 'default' }
-  if (variant.tag === 'CallContract') {
-    const addr = addressOf(variant.args[0])
-    return addr ? { kind: 'call_contract', address: addr } : { kind: 'default' }
-  }
-  if (variant.tag === 'CreateContract') {
-    const arg = variant.args[0]
-    const hash = arg?.switch() === xdr.ScValType.scvBytes() ? arg.bytes().toString('hex') : ''
-    return { kind: 'create_contract', wasmHash: hash }
-  }
-  return { kind: 'default' }
-}
-
-/** OZ `Signer::Delegated(Address) | Signer::External(Address, Bytes)`. */
-export function decodeSigner(v: xdr.ScVal): SignerDraft | undefined {
-  const variant = enumVariant(v)
-  if (!variant) return undefined
-  if (variant.tag === 'Delegated') {
-    const addr = addressOf(variant.args[0])
-    return addr ? { kind: 'delegated', address: addr } : undefined
-  }
-  if (variant.tag === 'External') {
-    const verifier = addressOf(variant.args[0])
-    const keyArg = variant.args[1]
-    const keyBytes =
-      keyArg?.switch() === xdr.ScValType.scvBytes() ? keyArg.bytes().toString('hex') : ''
-    return verifier ? { kind: 'external', verifier, keyBytes } : undefined
-  }
-  return undefined
-}
-
-/** A full OZ `ContextRule` as returned by `get_context_rule(id)`.
- *  `predicate` is filled in separately from the ledger entry. */
-export function decodeContextRule(v: xdr.ScVal): ObservedRule | undefined {
-  const id = u32Of(mapField(v, 'id'))
-  if (id === undefined) return undefined
-
-  const signersVal = mapField(v, 'signers')
-  const signers: SignerDraft[] = []
-  if (signersVal?.switch() === xdr.ScValType.scvVec()) {
-    for (const s of signersVal.vec() ?? []) {
-      const decoded = decodeSigner(s)
-      if (decoded) signers.push(decoded)
-    }
-  }
-
-  const policiesVal = mapField(v, 'policies')
-  const policyAddresses: string[] = []
-  if (policiesVal?.switch() === xdr.ScValType.scvVec()) {
-    for (const p of policiesVal.vec() ?? []) {
-      const addr = addressOf(p)
-      if (addr) policyAddresses.push(addr)
-    }
-  }
-
-  // `policy_ids` is index-aligned with `policies` in OZ's ContextRule. Only
-  // the ids can be passed to `remove_policy`, so a detach is impossible
-  // without them; they are read here rather than looked up again later.
-  const policyIdsVal = mapField(v, 'policy_ids')
-  const policyIds: number[] = []
-  if (policyIdsVal?.switch() === xdr.ScValType.scvVec()) {
-    for (const pid of policyIdsVal.vec() ?? []) {
-      const n = u32Of(pid)
-      if (n !== undefined) policyIds.push(n)
-    }
-  }
-
-  return {
-    id,
-    contextType: decodeContextType(mapField(v, 'context_type')),
-    signers,
-    policyAddresses,
-    ...(policyIds.length > 0 ? { policyIds } : {}),
-  }
-}
-
-/** `storage.rs:296` - the third element of the persistent nonce key tuple. */
-export const K_NONCE = 2
-
-/** Ledger key for a rule's stored install nonce. Read directly for the same
- *  reason as the document: the interpreter publishes no getter. */
-export function nonceLedgerKey(
-  interpreter: string,
-  smartAccount: string,
-  ruleId: number
-): xdr.LedgerKey {
-  return xdr.LedgerKey.contractData(
-    new xdr.LedgerKeyContractData({
-      contract: new Address(interpreter).toScAddress(),
-      key: xdr.ScVal.scvVec([
-        new Address(smartAccount).toScVal(),
-        xdr.ScVal.scvU32(ruleId),
-        xdr.ScVal.scvU32(K_NONCE),
-      ]),
-      durability: xdr.ContractDataDurability.persistent(),
-    })
-  )
-}
-
-/** Per-policy oracle bounds carried on a `StoredDoc`.
- *
- *  These must survive a merge. They are tighten-only overrides against the
- *  wasm defaults, so dropping them does not fail loudly: the rule keeps
- *  working and silently tolerates staler prices and wider deviation than its
- *  author chose. */
-export interface StoredOracleBounds {
-  maxStalenessSeconds?: number
-  maxDeviationBps?: number
-  maxCrossFeedDeviationBps?: number
-}
-
-export function decodeStoredOracleBounds(v: xdr.ScVal): StoredOracleBounds {
-  const read = (name: string): number | undefined => u32Of(mapField(v, name))
-  const staleness = read('oracle_max_staleness_seconds')
-  const deviation = read('oracle_max_deviation_bps')
-  const xfeed = read('oracle_max_xfeed_dev_bps')
-  return {
-    ...(staleness !== undefined ? { maxStalenessSeconds: staleness } : {}),
-    ...(deviation !== undefined ? { maxDeviationBps: deviation } : {}),
-    ...(xfeed !== undefined ? { maxCrossFeedDeviationBps: xfeed } : {}),
-  }
-}
-
-/** Raw predicate bytes out of a `StoredDoc` ledger entry value. */
-export function decodeStoredPredicateBytes(v: xdr.ScVal): Buffer | undefined {
-  const field = mapField(v, 'predicate_bytes')
-  if (!field || field.switch() !== xdr.ScValType.scvBytes()) return undefined
-  return field.bytes()
-}
-
-// ---- collection -----
-
-/** The three reads the scan needs. Kept as an interface so the collection
- *  below is testable without a network, matching the `InstallRpcClient`
- *  pattern in `build-install-policy.ts`. */
-export interface AccountRuleReader {
-  /** OZ `get_context_rules_count()`. */
-  getContextRuleCount(smartAccount: string): Promise<number>
-  /** OZ `get_context_rule(id)`. Undefined when the id is absent. */
-  getContextRule(smartAccount: string, ruleId: number): Promise<xdr.ScVal | undefined>
-  /** The interpreter's persistent `StoredDoc` entry, read as a ledger entry.
-   *  Undefined when no document is stored for that rule. */
-  getStoredDoc(
-    interpreter: string,
-    smartAccount: string,
-    ruleId: number
-  ): Promise<xdr.ScVal | undefined>
-}
-
-/** How far the id scan will probe before giving up. OZ imposes no per-account
- *  rule cap, so there is no exact bound to derive; this one is far above any
- *  realistic account and keeps a malformed `Count` from spinning forever. */
-export const MAX_RULE_ID_SCAN = 512
-
-export interface CollectedRules {
-  rules: ObservedRule[]
-  /** Rule ids whose stored predicate could not be read even though the
-   *  interpreter is attached. Such a rule is reported without a predicate,
-   *  which classifies it as opaque rather than as safely narrow. */
-  unreadablePredicateRuleIds: number[]
-  /** True when the scan stopped before accounting for every live rule. The
-   *  result is then a SUBSET of the account's rules, so an empty overlap list
-   *  proves nothing and the caller must not present it as safety. */
-  incomplete: boolean
-}
-
-/**
- * Every context rule on the account, with predicates filled in for the rules
- * our interpreter polices.
- *
- * Rule ids are NOT contiguous. OZ assigns them from a monotonic `NextId` and
- * decrements `Count` on removal without ever reusing an id
- * (`smart_account/storage.rs`: `add_context_rule` bumps `NextId`,
- * `remove_context_rule` only lowers `Count`), so after any removal
- * `Count < NextId` and the live ids have gaps. Iterating `0..Count-1` would
- * silently skip live rules at higher ids, and a skipped rule is a missed
- * overlap - the one error that reports safety which does not exist. Instead
- * the scan walks ids upward until it has accounted for `Count` live rules.
- *
- * A rule whose predicate cannot be read is deliberately left without one. That
- * demotes it to the `foreign` class, so the scan reports it as opaque instead
- * of assuming it is narrow.
- */
-export async function collectObservedRules(args: {
-  reader: AccountRuleReader
-  smartAccount: string
-  interpreterAddress: string
-  maxRuleIdScan?: number
-}): Promise<CollectedRules> {
-  const count = await args.reader.getContextRuleCount(args.smartAccount)
-  const limit = args.maxRuleIdScan ?? MAX_RULE_ID_SCAN
-  const rules: ObservedRule[] = []
-  const unreadablePredicateRuleIds: number[] = []
-
-  let id = 0
-  while (rules.length < count && id < limit) {
-    const raw = await args.reader.getContextRule(args.smartAccount, id)
-    id++
-    if (!raw) continue
-    const rule = decodeContextRule(raw)
-    if (!rule) continue
-
-    if (rule.policyAddresses.includes(args.interpreterAddress)) {
-      const doc = await args.reader.getStoredDoc(
-        args.interpreterAddress,
-        args.smartAccount,
-        rule.id
-      )
-      const bytes = doc ? decodeStoredPredicateBytes(doc) : undefined
-      if (bytes) {
-        try {
-          rule.predicate = decodePredicate(bytes)
-          // Carried so a merge can re-install the SAME bounds. They are
-          // tighten-only overrides, so losing them widens the policy quietly.
-          if (doc) rule.oracleBounds = decodeStoredOracleBounds(doc)
-        } catch {
-          unreadablePredicateRuleIds.push(rule.id)
-        }
-      } else {
-        unreadablePredicateRuleIds.push(rule.id)
-      }
-    }
-    rules.push(rule)
-  }
-
-  return { rules, unreadablePredicateRuleIds, incomplete: rules.length < count }
-}
-
-/**
- * An `AccountRuleReader` over a live RPC server.
- *
- * The two OZ getters are read-only simulations, built the same way as
- * `getContractVersion` in `build-install-policy.ts`: the source account is
- * constructed locally because a simulation never checks its sequence number,
- * and asking the network for a random key would 404.
- *
- * The stored document is fetched as a ledger entry rather than a contract
- * call, because the interpreter publishes no getter for it.
- */
-export function accountRuleReaderFromServer(
-  server: rpc.Server,
-  networkPassphrase: string
-): AccountRuleReader {
-  async function simulateCall(
-    contract: string,
-    method: string,
-    ...args: xdr.ScVal[]
-  ): Promise<xdr.ScVal | undefined> {
-    const account = new Account(Keypair.random().publicKey(), '0')
-    const tx = new TransactionBuilder(account, { fee: BASE_FEE, networkPassphrase })
-      .addOperation(new Contract(contract).call(method, ...args))
-      .setTimeout(30)
-      .build()
-    const sim = await server.simulateTransaction(tx)
-    if (rpc.Api.isSimulationError(sim)) return undefined
-    return sim.result?.retval
-  }
-
-  return {
-    async getContextRuleCount(smartAccount) {
-      const val = await simulateCall(smartAccount, 'get_context_rules_count')
-      return u32Of(val) ?? 0
-    },
-    async getContextRule(smartAccount, ruleId) {
-      return simulateCall(smartAccount, 'get_context_rule', xdr.ScVal.scvU32(ruleId))
-    },
-    async getStoredDoc(interpreter, smartAccount, ruleId) {
-      const key = docLedgerKey(interpreter, smartAccount, ruleId)
-      const res = await server.getLedgerEntries(key)
-      const entry = res.entries?.[0]?.val
-      if (!entry || entry.switch() !== xdr.LedgerEntryType.contractData()) return undefined
-      return entry.contractData().val()
-    },
-  }
-}

package/src/ir/index.ts

@@ -1,13 +0,0 @@
-// src/ir/index.ts - re-export the PolicyIR ("Policy Tree") types.
-
-export type {
-  IRCompare,
-  IRCompOp,
-  IRCondition,
-  IRLogic,
-  IRPolicyRule,
-  IRScalarType,
-  IRSelector,
-  IRVecMode,
-  PolicyIR,
-} from './types.ts'

package/src/ir/types.ts

@@ -1,132 +0,0 @@
-// src/ir/types.ts - the PolicyIR ("Policy Tree").
-//
-// `PolicyIR` is the custody-agnostic "Policy Tree" hub (the diagram's Policy
-// Tree) that every CustodyAdapter compiles FROM. It generalizes the NEAR-V2
-// policy schema (roles / scope filter / guard / constraint / comparison leaves /
-// default behaviour) into one chain-neutral shape and extends it with the
-// OZ-only selectors (spend window, oracle price, invocation count, time) so a
-// single IR can serve every backend. NEAR-V2 has no stateful spend window,
-// oracle, time/expiry, or invocation-count; those are marked as OZ extensions
-// below and are only lowered by adapters that declare support for them.
-
-/** Comparison operator. Mirrors NEAR-V2 `CompOp`. */
-export type IRCompOp = 'eq' | 'lt' | 'lte' | 'gt' | 'gte'
-
-/** Boolean combinator. Mirrors NEAR-V2 `LogicOp`. */
-export type IRLogic = 'and' | 'or'
-
-/** Vector match mode for a repeated arg. Mirrors NEAR-V2 `VecMode`. */
-export type IRVecMode = 'all' | 'any'
-
-/** Scalar value type. Mirrors NEAR-V2 `ScValType`, superset for OZ. */
-export type IRScalarType =
-  | 'address'
-  | 'i128'
-  | 'u128'
-  | 'u32'
-  | 'u64'
-  | 'i64'
-  | 'symbol'
-  | 'bytes'
-  | 'bool'
-
-/** WHERE in the authorized call a value is read. NEAR-V2 selectors first, OZ
- *  extensions after (an adapter that cannot express an extension flags it). */
-export type IRSelector =
-  // --- NEAR-V2 selectors ---
-  | {
-      kind: 'arg'
-      argIndex: number
-      fieldIndex?: number
-      vecMode?: IRVecMode
-      scalarType: IRScalarType
-    } // Stellar StellarComp
-  | { kind: 'arg_len'; argIndex: number } // length of a vec-typed argument as u32
-  | {
-      kind: 'arg_field'
-      argIndex: number
-      element: number
-      field: string
-      scalarType: IRScalarType
-    } // field of a map element within a vec-typed argument
-  | { kind: 'calldata'; offset: number; length: number } // EVM ByteComp
-  | { kind: 'value' } // EVM tx.value
-  // --- OZ extensions (not in NEAR-V2; lowered only by adapters that support them) ---
-  | { kind: 'amount'; token: string } // token amount this call moves
-  | { kind: 'window_spent'; token: string; windowSeconds: number } // stateful cumulative spend
-  | { kind: 'invocation_count'; windowSeconds: number }
-  | { kind: 'now' }
-  | { kind: 'valid_until' }
-  | { kind: 'oracle_price'; asset: string }
-
-/** A single comparison leaf. `value` is a decimal/hex string (i128-safe;
- *  never a JS number). */
-export interface IRCompare {
-  selector: IRSelector
-  operator: IRCompOp
-  value: string
-  /** Decimal basis of `value`, for selectors whose comparand is not on a basis
-   *  the contract can infer. Set for `oracle_price`, where prices normalise to
-   *  9 dp and an undeclared basis fails OPEN. */
-  valueDecimals?: number
-}
-
-/** Condition tree. NEAR-V2 guard/constraint are flat And/Or; the IR allows
- *  nesting + `not` + `in` + `eq_seq` so the same IR can later lower to the OZ
- *  predicate DSL. Week-1 adapters only lower the flat supported subset and flag
- *  the rest. */
-export type IRCondition =
-  | { op: 'and' | 'or'; children: IRCondition[] }
-  | { op: 'not'; child: IRCondition }
-  | { op: 'compare'; compare: IRCompare }
-  | { op: 'in'; selector: IRSelector; values: string[] }
-  /** Exact ordered sequence equality. The IR-level selector value MUST EQUAL
-   *  `values` as an ORDERED sequence (e.g. a swap hop `path`). `in` is pure
-   *  set membership and cannot express order; `eq_seq` is the construct that
-   *  does. Adapters that cannot express an exact ordered vector (OZ built-ins)
-   *  flag this as `uncovered` rather than silently dropping it. */
-  | { op: 'eq_seq'; selector: IRSelector; values: string[] }
-  /** A swap's output floor, expressed against its own input: the output arg
-   *  must be at least `inArgIndex * num / den`.
-   *
-   *  It is its own construct because `compare` bounds a selector against a
-   *  CONSTANT, and a slippage floor has no constant to bound against - the
-   *  acceptable output depends on the input of the same call. Encoding the
-   *  recorded output as a constant would pin a policy to one trade size.
-   *
-   *  `num/den` is the caller's minimum acceptable output per unit of input.
-   *  It is never derived from the recording: the recorded rate is a price at
-   *  one moment, and freezing it as policy would deny normal trades later.
-   *  Adapters that cannot express it (the OZ built-ins) flag it `uncovered`. */
-  | {
-      op: 'slippage_floor'
-      outArgIndex: number
-      inArgIndex: number
-      num: string
-      den: string
-    }
-
-export interface IRPolicyRule {
-  /** NEAR-V2 roles whitelist (empty = any; owner exempt). */
-  roles: string[]
-  /** NEAR-V2 scope filter; each field optional (absent = wildcard). */
-  scope: { chainId?: number; contract?: string; method?: string }
-  /** NEAR-V2 guard (applicability; skip the rule when it fails). */
-  guard?: IRCondition
-  /** NEAR-V2 constraint (AND; reject the transaction when any fails). */
-  constraints: IRCondition[]
-  // --- OZ extensions ---
-  /** M-of-N approval (OZ threshold primitives). */
-  approval?: { kind: 'threshold'; threshold: number; weights?: Record<string, number> }
-  /** OZ context-rule expiry. */
-  expiry?: { validUntilLedger?: number; validUntilUnixSeconds?: number }
-}
-
-export interface PolicyIR {
-  /** NEAR-V2 PolicyChain. */
-  chain: 'stellar' | 'evm'
-  /** NEAR-V2 DefaultBehavior. OZ context rules are deny-by-default, so
-   *  `deny_all` is the OZ default fallback when no rule matches. */
-  defaultBehavior: 'allow_all' | 'deny_all'
-  rules: IRPolicyRule[]
-}

package/src/mandate/index.ts

@@ -1,4 +0,0 @@
-// src/mandate/index.ts - re-export the Mandate source.
-
-export { mandateToPolicyIR } from './to-ir.ts'
-export type { MandateSpec } from './types.ts'