@crediolabs/policy-synth 0.5.0 → 0.5.1

package/dist/predicate/from-json.js

@@ -48,6 +48,13 @@ function jsonToLeaf(value) {
             return { kind: 'call_arg', index: numberField(v, 'index') };
         case 'call_arg_len':
             return { kind: 'call_arg_len', index: numberField(v, 'index') };
+        case 'call_arg_field':
+            return {
+                kind: 'call_arg_field',
+                index: numberField(v, 'index'),
+                element: numberField(v, 'element'),
+                field: stringField(v, 'field'),
+            };
         case 'call_arg_scaled':
             // num/den stay decimal STRINGS: an i128 ratio does not survive a JS
             // number, and silently rounding one would change the floor.

package/dist/run/index.d.ts

@@ -3,8 +3,8 @@ import { type AuthorityOverlap } from '../install/authority-overlap.ts';
 import { type BuildInstallPolicyResult, type BuildRevokePolicyResult } from '../install/build-install-policy.ts';
 import { getInterpreterInfo } from '../install/get-interpreter-info.ts';
 import { type RecordTransactionInput, type SimulatePolicyInput, type SynthesizePolicyInput, type VerifyPolicyInput } from './schemas.ts';
-export type { DeclarePolicyInput, GetInterpreterInfoInput, InstallPolicyInput, RecordTransactionInput, RevokePolicyInput, SimulatePolicyInput, SynthesizePolicyInput, VerifyPolicyInput, } from './schemas.ts';
-export { ComposeUserResponsesSchema, DeclarePolicyInputSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, NetworkSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, } from './schemas.ts';
+export type { DeclarePolicyInput, GetInterpreterInfoInput, InstallPolicyInput, OzBuiltinPolicy, RecordTransactionInput, RevokePolicyInput, SimulatePolicyInput, SynthesizePolicyInput, VerifyPolicyInput, } from './schemas.ts';
+export { ComposeUserResponsesSchema, DeclarePolicyInputSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, NetworkSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PINNED_OZ_POLICY_ADDRESS_BY_NETWORK, PINNED_OZ_POLICY_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, } from './schemas.ts';
 export type RunRecordTransactionInput = RecordTransactionInput;
 export type RunSynthesizePolicyInput = SynthesizePolicyInput;
 export type RunSimulatePolicyInput = SimulatePolicyInput;

package/dist/run/index.js

@@ -30,7 +30,7 @@ import { DeclarePolicyInputSchema, GetInterpreterInfoInputSchema, InstallPolicyI
 // downstream consumer) can import the canonical input shapes from the same
 // module that owns the tool-body glue. The strict schemas are the source of
 // truth - MCP tool shapes are derived from them.
-export { ComposeUserResponsesSchema, DeclarePolicyInputSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, NetworkSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, } from "./schemas.js";
+export { ComposeUserResponsesSchema, DeclarePolicyInputSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, NetworkSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PINNED_OZ_POLICY_ADDRESS_BY_NETWORK, PINNED_OZ_POLICY_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, } from "./schemas.js";
 /** Map every tool name to its canonical domain error code. Replaces a 7-way
  *  if/else so adding a tool adds one line here rather than a new branch in
  *  each envelope call. */

package/dist/run/schemas.d.ts

@@ -1627,6 +1627,25 @@ export declare const MAINNET_RPC_URL = "https://mainnet.sorobanrpc.com";
  *  a single constant - only the addresses and RPCs are network-scoped. */
 export declare const PINNED_INTERPRETER_ADDRESS_BY_NETWORK: Record<Network, string>;
 export declare const RPC_URL_BY_NETWORK: Record<Network, string>;
+/** The OpenZeppelin built-in policies we deployed instances of. These are OZ
+ *  EXAMPLE contracts, built by us from `OpenZeppelin/stellar-contracts` at tag
+ *  v0.7.2 and deployed by us. We have NOT audited them and upstream ships an
+ *  "experimental software ... as is" disclaimer; anything surfacing one of
+ *  these to a user must say so rather than implying we vouch for the code.
+ *  Provenance detail in `docs/audit/README.md` finding 7. */
+export type OzBuiltinPolicy = 'spending_limit' | 'simple_threshold' | 'weighted_threshold';
+/** Instance addresses per network. Exported so consumers import the pin
+ *  instead of copying a literal - a copied address is how a testnet id ends up
+ *  being queried against mainnet, which returns `Error(Storage, MissingValue)`
+ *  and reads exactly like "nothing is deployed there".
+ *
+ *  Instance ids are network-scoped, so the addresses differ while the wasm
+ *  hash does not: each pair below was created from the same uploaded wasm (see
+ *  `PINNED_OZ_POLICY_WASM_SHA256`), verified by fetching the deployed bytes
+ *  back from both networks. */
+export declare const PINNED_OZ_POLICY_ADDRESS_BY_NETWORK: Record<Network, Record<OzBuiltinPolicy, string>>;
+/** sha256 of each deployed policy wasm, identical across both networks. */
+export declare const PINNED_OZ_POLICY_WASM_SHA256: Record<OzBuiltinPolicy, string>;
 /** Stellar network passphrases. Pinned here so the XDR envelope uses the
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */

package/dist/run/schemas.js

@@ -364,6 +364,33 @@ export const RPC_URL_BY_NETWORK = {
     testnet: TESTNET_RPC_URL,
     mainnet: MAINNET_RPC_URL,
 };
+/** Instance addresses per network. Exported so consumers import the pin
+ *  instead of copying a literal - a copied address is how a testnet id ends up
+ *  being queried against mainnet, which returns `Error(Storage, MissingValue)`
+ *  and reads exactly like "nothing is deployed there".
+ *
+ *  Instance ids are network-scoped, so the addresses differ while the wasm
+ *  hash does not: each pair below was created from the same uploaded wasm (see
+ *  `PINNED_OZ_POLICY_WASM_SHA256`), verified by fetching the deployed bytes
+ *  back from both networks. */
+export const PINNED_OZ_POLICY_ADDRESS_BY_NETWORK = {
+    testnet: {
+        spending_limit: 'CDH4KOBRUEZI6TTZ72YXR5YUIODB6RH3AF75KX56Z73DELRCA5TWFISP',
+        simple_threshold: 'CAYTIVQOEZDOQI4GC3XBXEEYHQUANQQJHPJVMXVRBREGSAP6TCN3DID6',
+        weighted_threshold: 'CCTNRFZCL45GTJICA3Z2KFQO3VEGBHGCVBLHQ3GLJKAGACQIJMYJS7T2',
+    },
+    mainnet: {
+        spending_limit: 'CA7IBD266HIHFDUIBZLPIAITJUA3DVY4JAG6K3QMGBKLZCXXLP5E2F7A',
+        simple_threshold: 'CDOGPGUFGGUDG25P3TG6XIXJKRRYOZ3PXUZIEPVH74KXRZIDKZ5HYEOS',
+        weighted_threshold: 'CDWPZ4YZ3YIJ64XSHRMERRF2L2H7XD6SPUZDP3KI56T7QXQCICC25V3J',
+    },
+};
+/** sha256 of each deployed policy wasm, identical across both networks. */
+export const PINNED_OZ_POLICY_WASM_SHA256 = {
+    spending_limit: '9ce30ea1fe5c2dc5c9c49cf3462adb32e2c11d7dfadb15ef43a51ba56568de2b',
+    simple_threshold: '01c0be09eb6fb288cab2e878b4e890f7a38f75afab99aeb197861f44e2e2dfe6',
+    weighted_threshold: '78030272b06afb09d2949ab8877c9a8ae1ab9025b48f4edafd5816cc44f76eaa',
+};
 /** Stellar network passphrases. Pinned here so the XDR envelope uses the
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */

package/dist-cjs/predicate/from-json.js

@@ -51,6 +51,13 @@ function jsonToLeaf(value) {
             return { kind: 'call_arg', index: numberField(v, 'index') };
         case 'call_arg_len':
             return { kind: 'call_arg_len', index: numberField(v, 'index') };
+        case 'call_arg_field':
+            return {
+                kind: 'call_arg_field',
+                index: numberField(v, 'index'),
+                element: numberField(v, 'element'),
+                field: stringField(v, 'field'),
+            };
         case 'call_arg_scaled':
             // num/den stay decimal STRINGS: an i128 ratio does not survive a JS
             // number, and silently rounding one would change the floor.

package/dist-cjs/run/index.d.ts

@@ -3,8 +3,8 @@ import { type AuthorityOverlap } from '../install/authority-overlap.ts';
 import { type BuildInstallPolicyResult, type BuildRevokePolicyResult } from '../install/build-install-policy.ts';
 import { getInterpreterInfo } from '../install/get-interpreter-info.ts';
 import { type RecordTransactionInput, type SimulatePolicyInput, type SynthesizePolicyInput, type VerifyPolicyInput } from './schemas.ts';
-export type { DeclarePolicyInput, GetInterpreterInfoInput, InstallPolicyInput, RecordTransactionInput, RevokePolicyInput, SimulatePolicyInput, SynthesizePolicyInput, VerifyPolicyInput, } from './schemas.ts';
-export { ComposeUserResponsesSchema, DeclarePolicyInputSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, NetworkSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, } from './schemas.ts';
+export type { DeclarePolicyInput, GetInterpreterInfoInput, InstallPolicyInput, OzBuiltinPolicy, RecordTransactionInput, RevokePolicyInput, SimulatePolicyInput, SynthesizePolicyInput, VerifyPolicyInput, } from './schemas.ts';
+export { ComposeUserResponsesSchema, DeclarePolicyInputSchema, GetInterpreterInfoInputSchema, InstallPolicyInputSchema, InterpreterOptionsSchema, MAINNET_RPC_URL, NetworkSchema, PINNED_INTERPRETER_ADDRESS_BY_NETWORK, PINNED_INTERPRETER_GRAMMAR_VERSION, PINNED_INTERPRETER_MAINNET_ADDRESS, PINNED_INTERPRETER_TESTNET_ADDRESS, PINNED_INTERPRETER_WASM_SHA256, PINNED_OZ_POLICY_ADDRESS_BY_NETWORK, PINNED_OZ_POLICY_WASM_SHA256, PredicateLeafSchema, PredicateNodeSchema, RecordedTransactionSchema, RecordTransactionInputSchema, RevokePolicyInputSchema, RPC_URL_BY_NETWORK, SynthesizePolicyInputSchema, TESTNET_RPC_URL, ToolErrorSchema, } from './schemas.ts';
 export type RunRecordTransactionInput = RecordTransactionInput;
 export type RunSynthesizePolicyInput = SynthesizePolicyInput;
 export type RunSimulatePolicyInput = SimulatePolicyInput;

package/dist-cjs/run/index.js

@@ -18,7 +18,7 @@
 // No business logic. No retries. No session state. The same call shape can
 // drive the CLI (which calls into the same core directly without MCP).
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolErrorSchema = exports.TESTNET_RPC_URL = exports.SynthesizePolicyInputSchema = exports.RPC_URL_BY_NETWORK = exports.RevokePolicyInputSchema = exports.RecordTransactionInputSchema = exports.RecordedTransactionSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.NetworkSchema = exports.MAINNET_RPC_URL = exports.InterpreterOptionsSchema = exports.InstallPolicyInputSchema = exports.GetInterpreterInfoInputSchema = exports.DeclarePolicyInputSchema = exports.ComposeUserResponsesSchema = void 0;
+exports.ToolErrorSchema = exports.TESTNET_RPC_URL = exports.SynthesizePolicyInputSchema = exports.RPC_URL_BY_NETWORK = exports.RevokePolicyInputSchema = exports.RecordTransactionInputSchema = exports.RecordedTransactionSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.PINNED_OZ_POLICY_WASM_SHA256 = exports.PINNED_OZ_POLICY_ADDRESS_BY_NETWORK = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.NetworkSchema = exports.MAINNET_RPC_URL = exports.InterpreterOptionsSchema = exports.InstallPolicyInputSchema = exports.GetInterpreterInfoInputSchema = exports.DeclarePolicyInputSchema = exports.ComposeUserResponsesSchema = void 0;
 exports.runRecordTransaction = runRecordTransaction;
 exports.runSynthesizePolicy = runSynthesizePolicy;
 exports.runInstallPolicy = runInstallPolicy;
@@ -55,6 +55,8 @@ Object.defineProperty(exports, "PINNED_INTERPRETER_GRAMMAR_VERSION", { enumerabl
 Object.defineProperty(exports, "PINNED_INTERPRETER_MAINNET_ADDRESS", { enumerable: true, get: function () { return schemas_ts_2.PINNED_INTERPRETER_MAINNET_ADDRESS; } });
 Object.defineProperty(exports, "PINNED_INTERPRETER_TESTNET_ADDRESS", { enumerable: true, get: function () { return schemas_ts_2.PINNED_INTERPRETER_TESTNET_ADDRESS; } });
 Object.defineProperty(exports, "PINNED_INTERPRETER_WASM_SHA256", { enumerable: true, get: function () { return schemas_ts_2.PINNED_INTERPRETER_WASM_SHA256; } });
+Object.defineProperty(exports, "PINNED_OZ_POLICY_ADDRESS_BY_NETWORK", { enumerable: true, get: function () { return schemas_ts_2.PINNED_OZ_POLICY_ADDRESS_BY_NETWORK; } });
+Object.defineProperty(exports, "PINNED_OZ_POLICY_WASM_SHA256", { enumerable: true, get: function () { return schemas_ts_2.PINNED_OZ_POLICY_WASM_SHA256; } });
 Object.defineProperty(exports, "PredicateLeafSchema", { enumerable: true, get: function () { return schemas_ts_2.PredicateLeafSchema; } });
 Object.defineProperty(exports, "PredicateNodeSchema", { enumerable: true, get: function () { return schemas_ts_2.PredicateNodeSchema; } });
 Object.defineProperty(exports, "RecordedTransactionSchema", { enumerable: true, get: function () { return schemas_ts_2.RecordedTransactionSchema; } });

package/dist-cjs/run/schemas.d.ts

@@ -1627,6 +1627,25 @@ export declare const MAINNET_RPC_URL = "https://mainnet.sorobanrpc.com";
  *  a single constant - only the addresses and RPCs are network-scoped. */
 export declare const PINNED_INTERPRETER_ADDRESS_BY_NETWORK: Record<Network, string>;
 export declare const RPC_URL_BY_NETWORK: Record<Network, string>;
+/** The OpenZeppelin built-in policies we deployed instances of. These are OZ
+ *  EXAMPLE contracts, built by us from `OpenZeppelin/stellar-contracts` at tag
+ *  v0.7.2 and deployed by us. We have NOT audited them and upstream ships an
+ *  "experimental software ... as is" disclaimer; anything surfacing one of
+ *  these to a user must say so rather than implying we vouch for the code.
+ *  Provenance detail in `docs/audit/README.md` finding 7. */
+export type OzBuiltinPolicy = 'spending_limit' | 'simple_threshold' | 'weighted_threshold';
+/** Instance addresses per network. Exported so consumers import the pin
+ *  instead of copying a literal - a copied address is how a testnet id ends up
+ *  being queried against mainnet, which returns `Error(Storage, MissingValue)`
+ *  and reads exactly like "nothing is deployed there".
+ *
+ *  Instance ids are network-scoped, so the addresses differ while the wasm
+ *  hash does not: each pair below was created from the same uploaded wasm (see
+ *  `PINNED_OZ_POLICY_WASM_SHA256`), verified by fetching the deployed bytes
+ *  back from both networks. */
+export declare const PINNED_OZ_POLICY_ADDRESS_BY_NETWORK: Record<Network, Record<OzBuiltinPolicy, string>>;
+/** sha256 of each deployed policy wasm, identical across both networks. */
+export declare const PINNED_OZ_POLICY_WASM_SHA256: Record<OzBuiltinPolicy, string>;
 /** Stellar network passphrases. Pinned here so the XDR envelope uses the
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */

package/dist-cjs/run/schemas.js

@@ -16,7 +16,7 @@
 // imports them here so its tool-shape bindings stay in step; the CLI imports
 // them here so it can build the same args envelope the MCP transport builds.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.InstallPolicyInputSchema = exports.DeclarePolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.RPC_URL_BY_NETWORK = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.MAINNET_RPC_URL = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.ObservedRuleSchema = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.InterpreterOptionsSchema = exports.RecordTransactionInputSchema = exports.ComposeUserResponsesSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
+exports.ToolErrorSchema = exports.GetInterpreterInfoInputSchema = exports.RevokePolicyInputSchema = exports.InstallPolicyInputSchema = exports.DeclarePolicyInputSchema = exports.NETWORK_PASSPHRASES = exports.PINNED_OZ_POLICY_WASM_SHA256 = exports.PINNED_OZ_POLICY_ADDRESS_BY_NETWORK = exports.RPC_URL_BY_NETWORK = exports.PINNED_INTERPRETER_ADDRESS_BY_NETWORK = exports.MAINNET_RPC_URL = exports.TESTNET_RPC_URL = exports.PINNED_INTERPRETER_GRAMMAR_VERSION = exports.PINNED_INTERPRETER_WASM_SHA256 = exports.PINNED_INTERPRETER_MAINNET_ADDRESS = exports.PINNED_INTERPRETER_TESTNET_ADDRESS = exports.ObservedRuleSchema = exports.VerifyPolicyInputSchema = exports.SimulatePolicyInputSchema = exports.PredicateNodeSchema = exports.PredicateLeafSchema = exports.SynthesizePolicyInputSchema = exports.InterpreterOptionsSchema = exports.RecordTransactionInputSchema = exports.ComposeUserResponsesSchema = exports.RecordedTransactionSchema = exports.ParseConfidenceSchema = exports.OnChainEventSchema = exports.TokenMovementSchema = exports.ContractInvocationSchema = exports.ScValSchema = exports.NetworkSchema = void 0;
 const zod_1 = require("zod");
 const address_ts_1 = require("../synth/address.js");
 /** Soroban `valid_until` is a u32 ledger sequence; a value above this cannot be
@@ -367,6 +367,33 @@ exports.RPC_URL_BY_NETWORK = {
     testnet: exports.TESTNET_RPC_URL,
     mainnet: exports.MAINNET_RPC_URL,
 };
+/** Instance addresses per network. Exported so consumers import the pin
+ *  instead of copying a literal - a copied address is how a testnet id ends up
+ *  being queried against mainnet, which returns `Error(Storage, MissingValue)`
+ *  and reads exactly like "nothing is deployed there".
+ *
+ *  Instance ids are network-scoped, so the addresses differ while the wasm
+ *  hash does not: each pair below was created from the same uploaded wasm (see
+ *  `PINNED_OZ_POLICY_WASM_SHA256`), verified by fetching the deployed bytes
+ *  back from both networks. */
+exports.PINNED_OZ_POLICY_ADDRESS_BY_NETWORK = {
+    testnet: {
+        spending_limit: 'CDH4KOBRUEZI6TTZ72YXR5YUIODB6RH3AF75KX56Z73DELRCA5TWFISP',
+        simple_threshold: 'CAYTIVQOEZDOQI4GC3XBXEEYHQUANQQJHPJVMXVRBREGSAP6TCN3DID6',
+        weighted_threshold: 'CCTNRFZCL45GTJICA3Z2KFQO3VEGBHGCVBLHQ3GLJKAGACQIJMYJS7T2',
+    },
+    mainnet: {
+        spending_limit: 'CA7IBD266HIHFDUIBZLPIAITJUA3DVY4JAG6K3QMGBKLZCXXLP5E2F7A',
+        simple_threshold: 'CDOGPGUFGGUDG25P3TG6XIXJKRRYOZ3PXUZIEPVH74KXRZIDKZ5HYEOS',
+        weighted_threshold: 'CDWPZ4YZ3YIJ64XSHRMERRF2L2H7XD6SPUZDP3KI56T7QXQCICC25V3J',
+    },
+};
+/** sha256 of each deployed policy wasm, identical across both networks. */
+exports.PINNED_OZ_POLICY_WASM_SHA256 = {
+    spending_limit: '9ce30ea1fe5c2dc5c9c49cf3462adb32e2c11d7dfadb15ef43a51ba56568de2b',
+    simple_threshold: '01c0be09eb6fb288cab2e878b4e890f7a38f75afab99aeb197861f44e2e2dfe6',
+    weighted_threshold: '78030272b06afb09d2949ab8877c9a8ae1ab9025b48f4edafd5816cc44f76eaa',
+};
 /** Stellar network passphrases. Pinned here so the XDR envelope uses the
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/predicate/from-json.ts

@@ -57,6 +57,13 @@ function jsonToLeaf(value: unknown): PredicateLeaf {
       return { kind: 'call_arg', index: numberField(v, 'index') }
     case 'call_arg_len':
       return { kind: 'call_arg_len', index: numberField(v, 'index') }
+    case 'call_arg_field':
+      return {
+        kind: 'call_arg_field',
+        index: numberField(v, 'index'),
+        element: numberField(v, 'element'),
+        field: stringField(v, 'field'),
+      }
     case 'call_arg_scaled':
       // num/den stay decimal STRINGS: an i128 ratio does not survive a JS
       // number, and silently rounding one would change the floor.

package/src/run/index.ts

@@ -77,6 +77,7 @@ export type {
   DeclarePolicyInput,
   GetInterpreterInfoInput,
   InstallPolicyInput,
+  OzBuiltinPolicy,
   RecordTransactionInput,
   RevokePolicyInput,
   SimulatePolicyInput,
@@ -100,6 +101,8 @@ export {
   PINNED_INTERPRETER_MAINNET_ADDRESS,
   PINNED_INTERPRETER_TESTNET_ADDRESS,
   PINNED_INTERPRETER_WASM_SHA256,
+  PINNED_OZ_POLICY_ADDRESS_BY_NETWORK,
+  PINNED_OZ_POLICY_WASM_SHA256,
   PredicateLeafSchema,
   PredicateNodeSchema,
   RecordedTransactionSchema,

package/src/run/schemas.ts

@@ -421,6 +421,46 @@ export const RPC_URL_BY_NETWORK: Record<Network, string> = {
   mainnet: MAINNET_RPC_URL,
 }
 
+/** The OpenZeppelin built-in policies we deployed instances of. These are OZ
+ *  EXAMPLE contracts, built by us from `OpenZeppelin/stellar-contracts` at tag
+ *  v0.7.2 and deployed by us. We have NOT audited them and upstream ships an
+ *  "experimental software ... as is" disclaimer; anything surfacing one of
+ *  these to a user must say so rather than implying we vouch for the code.
+ *  Provenance detail in `docs/audit/README.md` finding 7. */
+export type OzBuiltinPolicy = 'spending_limit' | 'simple_threshold' | 'weighted_threshold'
+
+/** Instance addresses per network. Exported so consumers import the pin
+ *  instead of copying a literal - a copied address is how a testnet id ends up
+ *  being queried against mainnet, which returns `Error(Storage, MissingValue)`
+ *  and reads exactly like "nothing is deployed there".
+ *
+ *  Instance ids are network-scoped, so the addresses differ while the wasm
+ *  hash does not: each pair below was created from the same uploaded wasm (see
+ *  `PINNED_OZ_POLICY_WASM_SHA256`), verified by fetching the deployed bytes
+ *  back from both networks. */
+export const PINNED_OZ_POLICY_ADDRESS_BY_NETWORK: Record<
+  Network,
+  Record<OzBuiltinPolicy, string>
+> = {
+  testnet: {
+    spending_limit: 'CDH4KOBRUEZI6TTZ72YXR5YUIODB6RH3AF75KX56Z73DELRCA5TWFISP',
+    simple_threshold: 'CAYTIVQOEZDOQI4GC3XBXEEYHQUANQQJHPJVMXVRBREGSAP6TCN3DID6',
+    weighted_threshold: 'CCTNRFZCL45GTJICA3Z2KFQO3VEGBHGCVBLHQ3GLJKAGACQIJMYJS7T2',
+  },
+  mainnet: {
+    spending_limit: 'CA7IBD266HIHFDUIBZLPIAITJUA3DVY4JAG6K3QMGBKLZCXXLP5E2F7A',
+    simple_threshold: 'CDOGPGUFGGUDG25P3TG6XIXJKRRYOZ3PXUZIEPVH74KXRZIDKZ5HYEOS',
+    weighted_threshold: 'CDWPZ4YZ3YIJ64XSHRMERRF2L2H7XD6SPUZDP3KI56T7QXQCICC25V3J',
+  },
+}
+
+/** sha256 of each deployed policy wasm, identical across both networks. */
+export const PINNED_OZ_POLICY_WASM_SHA256: Record<OzBuiltinPolicy, string> = {
+  spending_limit: '9ce30ea1fe5c2dc5c9c49cf3462adb32e2c11d7dfadb15ef43a51ba56568de2b',
+  simple_threshold: '01c0be09eb6fb288cab2e878b4e890f7a38f75afab99aeb197861f44e2e2dfe6',
+  weighted_threshold: '78030272b06afb09d2949ab8877c9a8ae1ab9025b48f4edafd5816cc44f76eaa',
+}
+
 /** Stellar network passphrases. Pinned here so the XDR envelope uses the
  *  matching passphrase when the wallet signs (a mismatch yields invalid
  *  hashes). */