@crediolabs/policy-synth 0.5.1 → 0.5.2

package/dist/install/authority-overlap.js

@@ -18,7 +18,7 @@
 // rather than by tooling - which is why the tooling now exists.
 //
 // Adapted to grammar 3 from the version published in `@crediolabs/policy-synth`
-// 0.2.0, which came from the `octogate` repository and was lost when the npm
+// 0.2.0, which came from a different repository and was lost when the npm
 // lineage moved here. `or` and `not` are gone from the grammar, so the cases
 // handling them are gone too; oracle bounds are gone from the stored document.
 //

package/dist/install/build-add-context-rule.js

@@ -121,12 +121,23 @@ function encodeSigner(s) {
 function encodePoliciesMap(args) {
     const entries = [];
     for (const ref of args.policies) {
-        if (ref.kind === 'interpreter') {
-            entries.push(new xdr.ScMapEntry({
-                key: Address.fromString(ref.interpreterAddress).toScVal(),
-                val: encodePolicyInstallParams(args),
-            }));
+        // Refuse anything that is not an interpreter policy rather than skipping
+        // it. This loop used to `if (kind === 'interpreter')` and drop everything
+        // else in silence, so a caller attaching an OZ `spending_limit` beside the
+        // interpreter got a rule WITHOUT the cap and no indication of it - the
+        // policy the user asked for was simply absent from the install they signed.
+        // `PolicyRef` has one shape today, so TypeScript narrows this branch to
+        // `never`; the guard is for callers reaching the built JS untyped, and for
+        // the next kind added to `PolicyRef` without a case here. Failing loudly is
+        // the only safe direction: a dropped policy is a missing restriction.
+        if (ref.kind !== 'interpreter') {
+            const kind = JSON.stringify(ref.kind ?? null);
+            throw limitError('INSTALL_BUILD_FAILED', `policy kind ${kind} is not supported; this builder attaches interpreter policies only. Attach an OpenZeppelin built-in through the account layer instead - dropping it here would install a rule missing the restriction you asked for.`);
         }
+        entries.push(new xdr.ScMapEntry({
+            key: Address.fromString(ref.interpreterAddress).toScVal(),
+            val: encodePolicyInstallParams(args),
+        }));
     }
     entries.sort(sortByScValSymbolString);
     return xdr.ScVal.scvMap(entries);

package/dist-cjs/install/authority-overlap.js

@@ -19,7 +19,7 @@
 // rather than by tooling - which is why the tooling now exists.
 //
 // Adapted to grammar 3 from the version published in `@crediolabs/policy-synth`
-// 0.2.0, which came from the `octogate` repository and was lost when the npm
+// 0.2.0, which came from a different repository and was lost when the npm
 // lineage moved here. `or` and `not` are gone from the grammar, so the cases
 // handling them are gone too; oracle bounds are gone from the stored document.
 //

package/dist-cjs/install/build-add-context-rule.js

@@ -125,12 +125,23 @@ function encodeSigner(s) {
 function encodePoliciesMap(args) {
     const entries = [];
     for (const ref of args.policies) {
-        if (ref.kind === 'interpreter') {
-            entries.push(new stellar_sdk_1.xdr.ScMapEntry({
-                key: stellar_sdk_1.Address.fromString(ref.interpreterAddress).toScVal(),
-                val: encodePolicyInstallParams(args),
-            }));
+        // Refuse anything that is not an interpreter policy rather than skipping
+        // it. This loop used to `if (kind === 'interpreter')` and drop everything
+        // else in silence, so a caller attaching an OZ `spending_limit` beside the
+        // interpreter got a rule WITHOUT the cap and no indication of it - the
+        // policy the user asked for was simply absent from the install they signed.
+        // `PolicyRef` has one shape today, so TypeScript narrows this branch to
+        // `never`; the guard is for callers reaching the built JS untyped, and for
+        // the next kind added to `PolicyRef` without a case here. Failing loudly is
+        // the only safe direction: a dropped policy is a missing restriction.
+        if (ref.kind !== 'interpreter') {
+            const kind = JSON.stringify(ref.kind ?? null);
+            throw limitError('INSTALL_BUILD_FAILED', `policy kind ${kind} is not supported; this builder attaches interpreter policies only. Attach an OpenZeppelin built-in through the account layer instead - dropping it here would install a rule missing the restriction you asked for.`);
         }
+        entries.push(new stellar_sdk_1.xdr.ScMapEntry({
+            key: stellar_sdk_1.Address.fromString(ref.interpreterAddress).toScVal(),
+            val: encodePolicyInstallParams(args),
+        }));
     }
     entries.sort(sortByScValSymbolString);
     return stellar_sdk_1.xdr.ScVal.scvMap(entries);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/install/authority-overlap.ts

@@ -18,7 +18,7 @@
 // rather than by tooling - which is why the tooling now exists.
 //
 // Adapted to grammar 3 from the version published in `@crediolabs/policy-synth`
-// 0.2.0, which came from the `octogate` repository and was lost when the npm
+// 0.2.0, which came from a different repository and was lost when the npm
 // lineage moved here. `or` and `not` are gone from the grammar, so the cases
 // handling them are gone too; oracle bounds are gone from the stored document.
 //

package/src/install/build-add-context-rule.ts

@@ -194,14 +194,28 @@ function encodeSigner(s: SignerDraft): xdr.ScVal {
 function encodePoliciesMap(args: BuildAddContextRuleArgs): xdr.ScVal {
   const entries: xdr.ScMapEntry[] = []
   for (const ref of args.policies) {
-    if (ref.kind === 'interpreter') {
-      entries.push(
-        new xdr.ScMapEntry({
-          key: Address.fromString(ref.interpreterAddress).toScVal(),
-          val: encodePolicyInstallParams(args),
-        })
+    // Refuse anything that is not an interpreter policy rather than skipping
+    // it. This loop used to `if (kind === 'interpreter')` and drop everything
+    // else in silence, so a caller attaching an OZ `spending_limit` beside the
+    // interpreter got a rule WITHOUT the cap and no indication of it - the
+    // policy the user asked for was simply absent from the install they signed.
+    // `PolicyRef` has one shape today, so TypeScript narrows this branch to
+    // `never`; the guard is for callers reaching the built JS untyped, and for
+    // the next kind added to `PolicyRef` without a case here. Failing loudly is
+    // the only safe direction: a dropped policy is a missing restriction.
+    if (ref.kind !== 'interpreter') {
+      const kind = JSON.stringify((ref as { kind?: unknown }).kind ?? null)
+      throw limitError(
+        'INSTALL_BUILD_FAILED',
+        `policy kind ${kind} is not supported; this builder attaches interpreter policies only. Attach an OpenZeppelin built-in through the account layer instead - dropping it here would install a rule missing the restriction you asked for.`
       )
     }
+    entries.push(
+      new xdr.ScMapEntry({
+        key: Address.fromString(ref.interpreterAddress).toScVal(),
+        val: encodePolicyInstallParams(args),
+      })
+    )
   }
   entries.sort(sortByScValSymbolString)
   return xdr.ScVal.scvMap(entries)