@crediolabs/policy-synth 0.3.0 → 0.3.1

package/dist/record/freshness.d.ts

@@ -16,15 +16,21 @@ export declare function isBelowThreshold(c: ParseConfidence): boolean;
  *  under-confidence recording.
  *
  *  The remediation text branches on which diagnostic bucket is non-empty:
- *    - unknownContracts only -> user MUST supply an ABI (or re-capture
- *      against a known protocol version). The contract is real, the
- *      recorder just cannot decode it.
- *    - opaqueScVals only -> the recorder encountered a value shape it
- *      should support but did not decode. The user cannot supply an ABI
- *      to fix a decoder bug; the guidance explicitly says so and points at
- *      re-running after a tool upgrade / reporting the path.
- *    - both -> list both diagnostics AND chain the right remediation for
- *      each (the user supplies an ABI AND reports the decoder gap).
- *    - neither (the "denom === 0" path) -> unchanged from the pre-fix
- *      text; the user did not actually hit a code-level barrier. */
+ *    - unknownContracts only -> the contract is not in the compiled-in
+ *      registry. NOT "the contract has no interface": most Soroban
+ *      contracts publish a typed spec on chain, this package just never
+ *      reads one. The reason code stays `no-abi` because it is a published
+ *      enum value, so the TEXT has to carry the correction.
+ *    - opaqueScVals only -> the recorder met a value shape it should
+ *      support but did not decode. That is a decoder bug, and the guidance
+ *      says so rather than implying the caller can fix it.
+ *    - both -> list both diagnostics and chain the right remediation.
+ *    - neither (the "denom === 0" path) -> the caller did not actually hit
+ *      a code-level barrier.
+ *
+ *  Do NOT tell the caller to supply an ABI. There is no input for one:
+ *  recognition runs off the compiled-in registry plus a known-contract set
+ *  that no public tool boundary exposes. The old text named an action
+ *  nobody could take and sent users looking for a file they do not have and
+ *  would not need. */
 export declare function buildLowConfidenceQuestion(c: ParseConfidence): string;

package/dist/record/freshness.js

@@ -39,17 +39,23 @@ export function isBelowThreshold(c) {
  *  under-confidence recording.
  *
  *  The remediation text branches on which diagnostic bucket is non-empty:
- *    - unknownContracts only -> user MUST supply an ABI (or re-capture
- *      against a known protocol version). The contract is real, the
- *      recorder just cannot decode it.
- *    - opaqueScVals only -> the recorder encountered a value shape it
- *      should support but did not decode. The user cannot supply an ABI
- *      to fix a decoder bug; the guidance explicitly says so and points at
- *      re-running after a tool upgrade / reporting the path.
- *    - both -> list both diagnostics AND chain the right remediation for
- *      each (the user supplies an ABI AND reports the decoder gap).
- *    - neither (the "denom === 0" path) -> unchanged from the pre-fix
- *      text; the user did not actually hit a code-level barrier. */
+ *    - unknownContracts only -> the contract is not in the compiled-in
+ *      registry. NOT "the contract has no interface": most Soroban
+ *      contracts publish a typed spec on chain, this package just never
+ *      reads one. The reason code stays `no-abi` because it is a published
+ *      enum value, so the TEXT has to carry the correction.
+ *    - opaqueScVals only -> the recorder met a value shape it should
+ *      support but did not decode. That is a decoder bug, and the guidance
+ *      says so rather than implying the caller can fix it.
+ *    - both -> list both diagnostics and chain the right remediation.
+ *    - neither (the "denom === 0" path) -> the caller did not actually hit
+ *      a code-level barrier.
+ *
+ *  Do NOT tell the caller to supply an ABI. There is no input for one:
+ *  recognition runs off the compiled-in registry plus a known-contract set
+ *  that no public tool boundary exposes. The old text named an action
+ *  nobody could take and sent users looking for a file they do not have and
+ *  would not need. */
 export function buildLowConfidenceQuestion(c) {
     const hasUnknown = c.unknownContracts.length > 0;
     const hasOpaque = c.opaqueScVals.length > 0;
@@ -62,16 +68,20 @@ export function buildLowConfidenceQuestion(c) {
     }
     const why = reasons.length === 0 ? 'no diagnostic reason available' : reasons.join('; ');
     const header = `Recording refused: parseConfidence ${c.overall.toFixed(3)} is below the threshold ${c.thresholdUsed.toFixed(3)}. Diagnostic: ${why}.`;
-    // The two remediation branches are explicit so the user (or the agent)
-    // can dispatch on the verb. The "unknown contract" branch is the only
-    // one that asks for an ABI; the "opaque ScVal" branch asks the user to
-    // report the path and re-run after a tool upgrade.
+    // The remediation branches are explicit so the user (or the agent) can
+    // dispatch on the verb. Neither branch asks for an ABI: there is no input
+    // that accepts one, and for the unknown-contract branch the contract's
+    // own spec is usually on chain already - it is this package that does not
+    // read it.
+    const unknownAdvice = `The contract is not in this package's built-in registry - "no-abi" means unrecognised here, not that the contract lacks an interface. ` +
+        `You cannot supply one: the registry is compiled in. Either build the policy without deriving it from this transaction, or re-capture against a protocol the registry covers. ` +
+        `Passing confidenceOverride accepts the recording as it stands, including the arguments this tool could not attribute - do that only if you have checked them yourself.`;
     if (hasUnknown && hasOpaque) {
-        return (`${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version; ` +
-            `also file the opaque ScVal path against the recorder (decoder limitation) and re-run record_transaction after a tool upgrade.`);
+        return (`${header} ${unknownAdvice} Separately, file the opaque ScVal path against the recorder (a decoder limitation) ` +
+            `and re-run record_transaction after a tool upgrade.`);
     }
     if (hasUnknown) {
-        return `${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version, then re-run record_transaction.`;
+        return `${header} ${unknownAdvice}`;
     }
     if (hasOpaque) {
         return `${header} This is a recorder decoder limitation (the value shape is supported in principle but not yet decoded) - the agent cannot fix it by supplying an ABI. Report the opaque ScVal path above against the recorder and re-run record_transaction after a tool upgrade.`;

package/dist-cjs/record/freshness.d.ts

@@ -16,15 +16,21 @@ export declare function isBelowThreshold(c: ParseConfidence): boolean;
  *  under-confidence recording.
  *
  *  The remediation text branches on which diagnostic bucket is non-empty:
- *    - unknownContracts only -> user MUST supply an ABI (or re-capture
- *      against a known protocol version). The contract is real, the
- *      recorder just cannot decode it.
- *    - opaqueScVals only -> the recorder encountered a value shape it
- *      should support but did not decode. The user cannot supply an ABI
- *      to fix a decoder bug; the guidance explicitly says so and points at
- *      re-running after a tool upgrade / reporting the path.
- *    - both -> list both diagnostics AND chain the right remediation for
- *      each (the user supplies an ABI AND reports the decoder gap).
- *    - neither (the "denom === 0" path) -> unchanged from the pre-fix
- *      text; the user did not actually hit a code-level barrier. */
+ *    - unknownContracts only -> the contract is not in the compiled-in
+ *      registry. NOT "the contract has no interface": most Soroban
+ *      contracts publish a typed spec on chain, this package just never
+ *      reads one. The reason code stays `no-abi` because it is a published
+ *      enum value, so the TEXT has to carry the correction.
+ *    - opaqueScVals only -> the recorder met a value shape it should
+ *      support but did not decode. That is a decoder bug, and the guidance
+ *      says so rather than implying the caller can fix it.
+ *    - both -> list both diagnostics and chain the right remediation.
+ *    - neither (the "denom === 0" path) -> the caller did not actually hit
+ *      a code-level barrier.
+ *
+ *  Do NOT tell the caller to supply an ABI. There is no input for one:
+ *  recognition runs off the compiled-in registry plus a known-contract set
+ *  that no public tool boundary exposes. The old text named an action
+ *  nobody could take and sent users looking for a file they do not have and
+ *  would not need. */
 export declare function buildLowConfidenceQuestion(c: ParseConfidence): string;

package/dist-cjs/record/freshness.js

@@ -44,17 +44,23 @@ function isBelowThreshold(c) {
  *  under-confidence recording.
  *
  *  The remediation text branches on which diagnostic bucket is non-empty:
- *    - unknownContracts only -> user MUST supply an ABI (or re-capture
- *      against a known protocol version). The contract is real, the
- *      recorder just cannot decode it.
- *    - opaqueScVals only -> the recorder encountered a value shape it
- *      should support but did not decode. The user cannot supply an ABI
- *      to fix a decoder bug; the guidance explicitly says so and points at
- *      re-running after a tool upgrade / reporting the path.
- *    - both -> list both diagnostics AND chain the right remediation for
- *      each (the user supplies an ABI AND reports the decoder gap).
- *    - neither (the "denom === 0" path) -> unchanged from the pre-fix
- *      text; the user did not actually hit a code-level barrier. */
+ *    - unknownContracts only -> the contract is not in the compiled-in
+ *      registry. NOT "the contract has no interface": most Soroban
+ *      contracts publish a typed spec on chain, this package just never
+ *      reads one. The reason code stays `no-abi` because it is a published
+ *      enum value, so the TEXT has to carry the correction.
+ *    - opaqueScVals only -> the recorder met a value shape it should
+ *      support but did not decode. That is a decoder bug, and the guidance
+ *      says so rather than implying the caller can fix it.
+ *    - both -> list both diagnostics and chain the right remediation.
+ *    - neither (the "denom === 0" path) -> the caller did not actually hit
+ *      a code-level barrier.
+ *
+ *  Do NOT tell the caller to supply an ABI. There is no input for one:
+ *  recognition runs off the compiled-in registry plus a known-contract set
+ *  that no public tool boundary exposes. The old text named an action
+ *  nobody could take and sent users looking for a file they do not have and
+ *  would not need. */
 function buildLowConfidenceQuestion(c) {
     const hasUnknown = c.unknownContracts.length > 0;
     const hasOpaque = c.opaqueScVals.length > 0;
@@ -67,16 +73,20 @@ function buildLowConfidenceQuestion(c) {
     }
     const why = reasons.length === 0 ? 'no diagnostic reason available' : reasons.join('; ');
     const header = `Recording refused: parseConfidence ${c.overall.toFixed(3)} is below the threshold ${c.thresholdUsed.toFixed(3)}. Diagnostic: ${why}.`;
-    // The two remediation branches are explicit so the user (or the agent)
-    // can dispatch on the verb. The "unknown contract" branch is the only
-    // one that asks for an ABI; the "opaque ScVal" branch asks the user to
-    // report the path and re-run after a tool upgrade.
+    // The remediation branches are explicit so the user (or the agent) can
+    // dispatch on the verb. Neither branch asks for an ABI: there is no input
+    // that accepts one, and for the unknown-contract branch the contract's
+    // own spec is usually on chain already - it is this package that does not
+    // read it.
+    const unknownAdvice = `The contract is not in this package's built-in registry - "no-abi" means unrecognised here, not that the contract lacks an interface. ` +
+        `You cannot supply one: the registry is compiled in. Either build the policy without deriving it from this transaction, or re-capture against a protocol the registry covers. ` +
+        `Passing confidenceOverride accepts the recording as it stands, including the arguments this tool could not attribute - do that only if you have checked them yourself.`;
     if (hasUnknown && hasOpaque) {
-        return (`${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version; ` +
-            `also file the opaque ScVal path against the recorder (decoder limitation) and re-run record_transaction after a tool upgrade.`);
+        return (`${header} ${unknownAdvice} Separately, file the opaque ScVal path against the recorder (a decoder limitation) ` +
+            `and re-run record_transaction after a tool upgrade.`);
     }
     if (hasUnknown) {
-        return `${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version, then re-run record_transaction.`;
+        return `${header} ${unknownAdvice}`;
     }
     if (hasOpaque) {
         return `${header} This is a recorder decoder limitation (the value shape is supported in principle but not yet decoded) - the agent cannot fix it by supplying an ABI. Report the opaque ScVal path above against the recorder and re-run record_transaction after a tool upgrade.`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",
@@ -67,7 +67,7 @@
   },
   "scripts": {
     "test": "bun test",
-    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
+    "build": "rm -rf dist dist-cjs && tsc -p tsconfig.build.json && tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
     "build:esm": "tsc -p tsconfig.build.json",
     "build:cjs": "tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
     "prepublishOnly": "bun run build && bun test",

package/src/record/freshness.ts

@@ -52,17 +52,23 @@ export function isBelowThreshold(c: ParseConfidence): boolean {
  *  under-confidence recording.
  *
  *  The remediation text branches on which diagnostic bucket is non-empty:
- *    - unknownContracts only -> user MUST supply an ABI (or re-capture
- *      against a known protocol version). The contract is real, the
- *      recorder just cannot decode it.
- *    - opaqueScVals only -> the recorder encountered a value shape it
- *      should support but did not decode. The user cannot supply an ABI
- *      to fix a decoder bug; the guidance explicitly says so and points at
- *      re-running after a tool upgrade / reporting the path.
- *    - both -> list both diagnostics AND chain the right remediation for
- *      each (the user supplies an ABI AND reports the decoder gap).
- *    - neither (the "denom === 0" path) -> unchanged from the pre-fix
- *      text; the user did not actually hit a code-level barrier. */
+ *    - unknownContracts only -> the contract is not in the compiled-in
+ *      registry. NOT "the contract has no interface": most Soroban
+ *      contracts publish a typed spec on chain, this package just never
+ *      reads one. The reason code stays `no-abi` because it is a published
+ *      enum value, so the TEXT has to carry the correction.
+ *    - opaqueScVals only -> the recorder met a value shape it should
+ *      support but did not decode. That is a decoder bug, and the guidance
+ *      says so rather than implying the caller can fix it.
+ *    - both -> list both diagnostics and chain the right remediation.
+ *    - neither (the "denom === 0" path) -> the caller did not actually hit
+ *      a code-level barrier.
+ *
+ *  Do NOT tell the caller to supply an ABI. There is no input for one:
+ *  recognition runs off the compiled-in registry plus a known-contract set
+ *  that no public tool boundary exposes. The old text named an action
+ *  nobody could take and sent users looking for a file they do not have and
+ *  would not need. */
 export function buildLowConfidenceQuestion(c: ParseConfidence): string {
   const hasUnknown = c.unknownContracts.length > 0
   const hasOpaque = c.opaqueScVals.length > 0
@@ -75,18 +81,23 @@ export function buildLowConfidenceQuestion(c: ParseConfidence): string {
   }
   const why = reasons.length === 0 ? 'no diagnostic reason available' : reasons.join('; ')
   const header = `Recording refused: parseConfidence ${c.overall.toFixed(3)} is below the threshold ${c.thresholdUsed.toFixed(3)}. Diagnostic: ${why}.`
-  // The two remediation branches are explicit so the user (or the agent)
-  // can dispatch on the verb. The "unknown contract" branch is the only
-  // one that asks for an ABI; the "opaque ScVal" branch asks the user to
-  // report the path and re-run after a tool upgrade.
+  // The remediation branches are explicit so the user (or the agent) can
+  // dispatch on the verb. Neither branch asks for an ABI: there is no input
+  // that accepts one, and for the unknown-contract branch the contract's
+  // own spec is usually on chain already - it is this package that does not
+  // read it.
+  const unknownAdvice =
+    `The contract is not in this package's built-in registry - "no-abi" means unrecognised here, not that the contract lacks an interface. ` +
+    `You cannot supply one: the registry is compiled in. Either build the policy without deriving it from this transaction, or re-capture against a protocol the registry covers. ` +
+    `Passing confidenceOverride accepts the recording as it stands, including the arguments this tool could not attribute - do that only if you have checked them yourself.`
   if (hasUnknown && hasOpaque) {
     return (
-      `${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version; ` +
-      `also file the opaque ScVal path against the recorder (decoder limitation) and re-run record_transaction after a tool upgrade.`
+      `${header} ${unknownAdvice} Separately, file the opaque ScVal path against the recorder (a decoder limitation) ` +
+      `and re-run record_transaction after a tool upgrade.`
     )
   }
   if (hasUnknown) {
-    return `${header} Supply an ABI for the unknown contract(s) or re-capture the transaction against a known protocol version, then re-run record_transaction.`
+    return `${header} ${unknownAdvice}`
   }
   if (hasOpaque) {
     return `${header} This is a recorder decoder limitation (the value shape is supported in principle but not yet decoded) - the agent cannot fix it by supplying an ABI. Report the opaque ScVal path above against the recorder and re-run record_transaction after a tool upgrade.`

package/dist/adapters/interpreter/index.d.ts

@@ -1 +0,0 @@
-export { createInterpreterAdapter, type InterpreterAdapterConfig, PLACEHOLDER_INTERPRETER_ADDRESS, } from './adapter.ts';

package/dist/adapters/interpreter/index.js

@@ -1,2 +0,0 @@
-// src/adapters/interpreter/index.ts - re-export the interpreter-policy CustodyAdapter.
-export { createInterpreterAdapter, PLACEHOLDER_INTERPRETER_ADDRESS, } from "./adapter.js";

package/dist/adapters/oz/adapter.d.ts

@@ -1,20 +0,0 @@
-import type { CustodyAdapter } from '../../seams/types.ts';
-import type { Network } from '../../types.ts';
-/** OZ built-in policy contract instance addresses, per primitive. */
-export interface OzPrimitiveInstances {
-    spending_limit: string;
-    simple_threshold: string;
-    weighted_threshold: string;
-}
-/** Per-network config for the OZ adapter. */
-export interface OzAdapterConfig {
-    network: Network;
-    instances: OzPrimitiveInstances;
-}
-/** [VERIFY] NOT real deployed addresses. The OZ built-in policy instances are
- *  per-network deploy artifacts we do not have yet; install is a later phase.
- *  Injected so the adapter never invents a Stellar contract address. */
-export declare const PLACEHOLDER_OZ_INSTANCES: OzPrimitiveInstances;
-/** Week-1 OZ adapter config with placeholder instance addresses. */
-export declare function placeholderOzConfig(network: Network): OzAdapterConfig;
-export declare function createOzAdapter(config: OzAdapterConfig): CustodyAdapter;

package/dist/adapters/oz/adapter.js

@@ -1,281 +0,0 @@
-// src/adapters/oz/adapter.ts - the OZ Accounts CustodyAdapter.
-//
-// Compiles a PolicyIR to an OZ `ProposedPolicy` using OZ built-in policy
-// primitives. Only the constructs OZ can express natively are lowered:
-//   scope.contract            -> ContextRuleType.call_contract (else default)
-//   expiry.validUntilLedger   -> ContextRuleDraft.validUntilLedger
-//   window_spent(t,w) <= L    -> `spending_limit` primitive
-//   approval.threshold        -> `simple_threshold` / `weighted_threshold`
-// Anything needing a capability this backend lacks (invocation
-// count, per-arg comparison/allowlist, guard, nested boolean predicate) is NOT
-// emitted: it is named in `uncovered` and `covered` is set false. Nothing is
-// silently dropped.
-//
-// OZ built-in policy instance addresses are per-network deploy artifacts we do
-// not have yet (install is a later phase). They are injected via config; week-1
-// ships a clearly-labelled [VERIFY] placeholder so nothing invents an address.
-import { OZ_LIMITS, SOROBAN_LIMITS } from "../../types.js";
-/** [VERIFY] NOT real deployed addresses. The OZ built-in policy instances are
- *  per-network deploy artifacts we do not have yet; install is a later phase.
- *  Injected so the adapter never invents a Stellar contract address. */
-export const PLACEHOLDER_OZ_INSTANCES = {
-    spending_limit: 'VERIFY-oz-spending-limit-instance-address',
-    simple_threshold: 'VERIFY-oz-simple-threshold-instance-address',
-    weighted_threshold: 'VERIFY-oz-weighted-threshold-instance-address',
-};
-/** Week-1 OZ adapter config with placeholder instance addresses. */
-export function placeholderOzConfig(network) {
-    return { network, instances: PLACEHOLDER_OZ_INSTANCES };
-}
-/** Parse confidence for a deterministic (non-decoded) input: full (1.0). A
- *  mandate needs no decoding, so the gate is not applicable. */
-const FULL_PARSE_CONFIDENCE = {
-    overall: 1,
-    knownContracts: [],
-    unknownContracts: [],
-    opaqueScVals: [],
-    thresholdUsed: 1,
-};
-const CAPABILITIES = {
-    supportsSpendWindow: true,
-    supportsThreshold: true,
-    supportsTimeExpiry: true,
-    supportsGeneralPredicate: false,
-};
-export function createOzAdapter(config) {
-    return {
-        name: 'oz-accounts',
-        mode: 'enforce',
-        capabilities: () => ({ ...CAPABILITIES }),
-        compile: (ir) => compile(ir, config),
-        simulate: () => simulateStub(),
-        export: (ir) => canonicalStringify(ir),
-    };
-}
-function compile(ir, config) {
-    const uncovered = [];
-    const firstRule = ir.rules[0];
-    if (!firstRule) {
-        return { covered: false, uncovered: ['empty PolicyIR (no rules to compile)'] };
-    }
-    if (ir.rules.length > 1) {
-        uncovered.push(`multi-rule PolicyIR: ${ir.rules.length - 1} rule(s) beyond the first are not compiled (a ProposedPolicy carries a single context rule in this slice)`);
-    }
-    const lowered = lowerRule(firstRule, config);
-    uncovered.push(...lowered.uncovered);
-    const result = { covered: uncovered.length === 0, uncovered };
-    if (!lowered.capExceeded) {
-        const proposed = {
-            contextRule: lowered.contextRule,
-            policyDocuments: [],
-            policyRefs: lowered.policyRefs,
-            parseConfidence: { ...FULL_PARSE_CONFIDENCE },
-            warnings: [],
-            ambiguities: [],
-        };
-        result.proposed = proposed;
-    }
-    return result;
-}
-function lowerRule(rule, config) {
-    const uncovered = [];
-    const policyRefs = [];
-    // scope -> context rule type. OZ scopes by contract (CallContract); a
-    // method-level restriction is flagged as not covered because CallContract
-    // alone permits other methods on the same contract (e.g. an unbounded approve
-    // alongside a capped transfer).
-    const contextRuleType = rule.scope.contract !== undefined
-        ? { kind: 'call_contract', contract: rule.scope.contract }
-        : { kind: 'default' };
-    if (rule.scope.method !== undefined && rule.scope.contract !== undefined) {
-        uncovered.push(`per-method scoping to \`${rule.scope.method}\` (OZ CallContract scopes by contract only; requires the interpreter predicate)`);
-    }
-    if (rule.scope.chainId !== undefined) {
-        uncovered.push(`chainId \`${rule.scope.chainId}\` not bindable by the Stellar OZ adapter (network is per-context, not per-rule)`);
-    }
-    if (rule.roles.length > 0) {
-        uncovered.push(`roles [${rule.roles.join(', ')}] dropped (role-to-signer mapping is a later phase; OZ signers carry addresses, not role names)`);
-    }
-    // expiry -> validUntilLedger. Unix-timestamp expiry cannot be expressed by an
-    // OZ context rule (it expires by ledger sequence), so flag it.
-    let validUntilLedger = null;
-    if (rule.expiry) {
-        if (rule.expiry.validUntilLedger !== undefined) {
-            validUntilLedger = rule.expiry.validUntilLedger;
-        }
-        else if (rule.expiry.validUntilUnixSeconds !== undefined) {
-            uncovered.push('time expiry given as a unix timestamp (OZ context rules expire by ledger sequence; supply expiry.validUntilLedger)');
-        }
-    }
-    // guard -> not covered (applicability predicates are not an OZ built-in).
-    if (rule.guard) {
-        uncovered.push(`guard: ${describeCondition(rule.guard)}`);
-    }
-    // constraints -> spending_limit where they match; else not covered. The OZ
-    // spending_limit takes `{ spending_limit: i128, period_ledgers: u32 }` and
-    // has NO token param: it only accepts a CallContract context rule
-    // (OnlyCallContractAllowed) and limits transfers of that context's contract,
-    // so the spent token must equal the scope contract, and the window is a
-    // ledger count (~5s/ledger), not seconds.
-    for (const c of rule.constraints) {
-        const spend = matchSpendingLimit(c);
-        if (!spend) {
-            uncovered.push(describeCondition(c));
-            continue;
-        }
-        if (contextRuleType.kind !== 'call_contract' || spend.token !== contextRuleType.contract) {
-            uncovered.push(`spending_limit on token ${spend.token} needs a CallContract context scoped to that token (OZ pins the limit to the context contract, not a token param)`);
-            continue;
-        }
-        policyRefs.push({
-            kind: 'oz_builtin',
-            primitive: {
-                primitive: 'spending_limit',
-                params: {
-                    spending_limit: spend.limit,
-                    period_ledgers: secondsToLedgers(spend.windowSeconds),
-                },
-            },
-            instanceAddress: config.instances.spending_limit,
-        });
-    }
-    // approval.threshold -> simple/weighted threshold primitive. A threshold < 1
-    // is not a real M-of-N gate (0 approvals authorises everything), so refuse to
-    // emit a no-op primitive and flag it as not covered.
-    if (rule.approval) {
-        if (!Number.isInteger(rule.approval.threshold) || rule.approval.threshold < 1) {
-            uncovered.push(`approval threshold ${rule.approval.threshold} is not a positive integer (a 0 or negative threshold is not an M-of-N gate)`);
-        }
-        else {
-            const weights = rule.approval.weights;
-            if (weights && Object.keys(weights).length > 0) {
-                policyRefs.push({
-                    kind: 'oz_builtin',
-                    primitive: {
-                        primitive: 'weighted_threshold',
-                        params: { threshold: rule.approval.threshold, weights },
-                    },
-                    instanceAddress: config.instances.weighted_threshold,
-                });
-            }
-            else {
-                policyRefs.push({
-                    kind: 'oz_builtin',
-                    primitive: {
-                        primitive: 'simple_threshold',
-                        params: { threshold: rule.approval.threshold },
-                    },
-                    instanceAddress: config.instances.simple_threshold,
-                });
-            }
-        }
-    }
-    const capExceeded = policyRefs.length > OZ_LIMITS.maxPoliciesPerRule;
-    if (capExceeded) {
-        uncovered.push(`policy count ${policyRefs.length} exceeds OZ maxPoliciesPerRule (${OZ_LIMITS.maxPoliciesPerRule})`);
-    }
-    const contextRule = {
-        contextRuleType,
-        name: contextRuleType.kind === 'call_contract'
-            ? `call_contract:${contextRuleType.contract}`
-            : 'default',
-        validUntilLedger,
-        signers: [],
-        policies: policyRefs,
-    };
-    return { contextRule, policyRefs, uncovered, capExceeded };
-}
-/** Convert a spend window in seconds to OZ `period_ledgers` (u32, >= 1).
- *  Stellar targets a ~5s ledger close time. */
-function secondsToLedgers(windowSeconds) {
-    return Math.max(1, Math.round(windowSeconds / SOROBAN_LIMITS.secondsPerLedger));
-}
-/** Match the `window_spent(token, window) <= limit` compare that lowers to the
- *  OZ `spending_limit` primitive. Only `lte` matches (the spend-cap semantic). */
-function matchSpendingLimit(c) {
-    if (c.op !== 'compare')
-        return null;
-    const { selector, operator, value } = c.compare;
-    if (selector.kind !== 'window_spent' || operator !== 'lte')
-        return null;
-    return { token: selector.token, limit: value, windowSeconds: selector.windowSeconds };
-}
-/** Human-readable descriptor for a construct the OZ built-in-primitive backend
- *  cannot express, used to populate `uncovered`. */
-function describeCondition(cond) {
-    switch (cond.op) {
-        case 'in':
-            return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`;
-        case 'eq_seq':
-            return `exact ordered sequence on ${describeSelector(cond.selector)} (OZ built-ins cannot express an exact vector)`;
-        case 'not':
-            return 'negated condition (predicate DSL)';
-        case 'and':
-        case 'or':
-            return `nested ${cond.op} condition (predicate DSL)`;
-        case 'compare': {
-            const s = cond.compare.selector;
-            switch (s.kind) {
-                case 'window_spent':
-                    return `spend-window comparison with operator '${cond.compare.operator}' (only 'lte' lowers to spending_limit)`;
-                case 'amount':
-                    return `per-call amount comparison on ${s.token} (predicate DSL)`;
-                case 'arg':
-                    return `argument comparison on arg ${s.argIndex} (predicate DSL)`;
-                case 'arg_len':
-                    return `vec length comparison on arg ${s.argIndex} (predicate DSL)`;
-                case 'arg_field':
-                    return `map field comparison on arg ${s.argIndex}.${s.field} (predicate DSL)`;
-                case 'calldata':
-                    return 'EVM calldata comparison (predicate DSL)';
-                case 'value':
-                    return 'tx.value comparison (predicate DSL)';
-                case 'now':
-                case 'valid_until':
-                    return 'time comparison (predicate DSL)';
-            }
-        }
-    }
-}
-function describeSelector(s) {
-    switch (s.kind) {
-        case 'arg':
-            return `arg ${s.argIndex}`;
-        case 'arg_len':
-            return `arg_len(${s.argIndex})`;
-        case 'arg_field':
-            return `arg_field(${s.argIndex}, ${s.element}, ${s.field})`;
-        case 'amount':
-            return `amount(${s.token})`;
-        case 'window_spent':
-            return `window_spent(${s.token})`;
-        case 'calldata':
-            return `calldata[${s.offset}:${s.offset + s.length}]`;
-        default:
-            return s.kind;
-    }
-}
-function simulateStub() {
-    return {
-        backend: 'ts-model',
-        permitted: null,
-        evaluations: [],
-        notes: ['stub: real permit/deny semantics wiring is a later phase'],
-    };
-}
-/** Canonical JSON with recursively sorted object keys (stable across runs). */
-function canonicalStringify(value) {
-    return JSON.stringify(sortKeys(value));
-}
-function sortKeys(value) {
-    if (Array.isArray(value))
-        return value.map(sortKeys);
-    if (value && typeof value === 'object') {
-        const out = {};
-        for (const key of Object.keys(value).sort()) {
-            out[key] = sortKeys(value[key]);
-        }
-        return out;
-    }
-    return value;
-}

package/dist/adapters/oz/index.d.ts

@@ -1 +0,0 @@
-export { createOzAdapter, type OzAdapterConfig, type OzPrimitiveInstances, PLACEHOLDER_OZ_INSTANCES, placeholderOzConfig, } from './adapter.ts';

package/dist/adapters/oz/index.js

@@ -1,2 +0,0 @@
-// src/adapters/oz/index.ts - re-export the OZ Accounts CustodyAdapter.
-export { createOzAdapter, PLACEHOLDER_OZ_INSTANCES, placeholderOzConfig, } from "./adapter.js";