feat: dynamic spend limit rules and policy builder with zod

[Ghostcecode]

Overview

This PR adds a dynamic spend limit rules and policy builder that gives operators a reliable, modular interface for configuring autonomous agent spending controls. It introduces a Zod-validated policy schema, an expandable rule builder powered by useFieldArray, and inline validation states that surface malformed or incomplete rules immediately — enabling daily limits, token restrictions, and recipient whitelists to be composed, edited, and removed without page reloads.

Related Issue

Closes #

Changes

🧾 Policy Rules Schema & Types

• [ADD] src/features/policies/rulesSchema.ts
  • Defines the unified Zod schema for multiple policy rules: dailyLimitRule, tokenRestrictionRule, and recipientWhitelistRule.
  • Validates non-negative daily caps, well-formed Stellar addresses, and structured token/recipient lists.
  • Exports unified PolicyRule and SpendingPolicy types for direct reuse in database schemas.
  • Uses strict parsing and refinements so partially defined or malformed rules fail loudly.

🧩 Dynamic Policy Builder Form

• [ADD] src/features/policies/SpendingPolicyBuilder.tsx
  • Implements useFieldArray so admins can add, configure, and remove independent rules dynamically.
  • Integrates react-hook-form + Zod resolver for instant inline error messages on negative caps, invalid Stellar addresses, and incomplete rules.
  • Uses src/styles/tokens.css error tokens for red borders and active focus glows.
  • Formats number and asset inputs and prevents submission while any condition is partially defined.
  • Includes aria-live/aria-describedby wiring so screen readers announce validation changes.
  • Serializes the current rule set on every add/remove/update and blocks default form submission.

🔌 Integration & Exports

• [MODIFY] src/features/policies/index.ts

  • Re-exports the new schema types and builder component for a clean public API.

• [MODIFY] src/app/(dashboard)/policies/[id]/page.tsx

  • Renders the SpendingPolicyBuilder inside the policy detail route, passing existing policy data and loading persisted rules.

Verification Results

npm test -- src/features/policies/__tests__/policyBuilder.test.ts
✅ 15/15 passed

Manual validation:
✅ Negative daily cap triggers inline field error
✅ Invalid Stellar address triggers inline field error
✅ Rule add/update/remove reserializes form values correctly
✅ Partial rules block submission
✅ Screen readers receive dynamic validation messages via aria-live

Acceptance Criteria	Status
Define the Zod schema targeting multiple policy conditions	✅ Unified rules schema covers daily limit, token restriction, and recipient whitelist rules
Implement dynamic field arrays allowing admins to add/configure/remove rules	✅ useFieldArray builder supports add, edit, and remove on the fly
Inline validation highlights invalid boundaries (negative caps, Stellar addresses)	✅ Field-level errors render instantly using design token styles
Format number/asset inputs and prevent partial submission	✅ Inputs are normalized and submission is blocked until all rules are fully defined

Closes #34

[vercel]

@Ghostcecode is attempting to deploy a commit to the Cjay's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Ghostcecode Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mergekeeper]

MergeKeeper review

Scope: in scope for linked issue #34.
Verdict: clean

The PR successfully implements the dynamic spend limit rules and policy builder with Zod validation, useFieldArray, and inline error states.

Reviewed commit: db918c9b78e5982b9044b330f249e19f0bc98c40.
CI and merge eligibility are checked separately.

[mergekeeper]

MergeKeeper merge status

Status: blocked
PR state: open
Mergeability: mergeable
Checked commit: f650be32c0c8635c9911184d5dd0a6df25048798.

Reason: One or more required CI checks failed.

Failing checks:

• build - view details

Next steps:

1. Open the failing check details above and fix the reported error.
2. Run the same checks locally where possible.
3. Commit and push the fix.
4. MergeKeeper will automatically re-review the updated PR.

[mergekeeper]

Needs review

Linked to #34, but the diff does not match the issue scope.

The pull request introduces unintended duplicate implementations and a syntax error in index.ts.

Reviewed commit: 6ebcdd57d4c2e41e591258d73041d139fc414f2c.

[mergekeeper]

Needs changes

The PR contains a syntax error in index.ts and duplicates policy form implementations across multiple files.

• src/features/policies/index.ts:2: Typo 'epport' instead of 'export' causes a module syntax error.
• src/app/(dashboard)/policies/[id]/page.tsx:192: Duplicate PolicyForm implementation embedded directly in the page file rather than importing the required component from src/features/policies/components/PolicyForm.tsx.

Reviewed commit: ffc4edca64ea8065b19b03fc1784619c2cc8b646.

[mergekeeper]

Needs changes

The PR contains a syntax error in index.ts and duplicates policy form implementations across multiple files.

• src/features/policies/index.ts:2: Typo 'epport' instead of 'export' causes a module syntax error.
• src/app/(dashboard)/policies/[id]/page.tsx:192: Duplicate PolicyForm implementation embedded directly in the page file rather than importing the required component from src/features/policies/components/PolicyForm.tsx.

Reviewed commit: ffc4edca64ea8065b19b03fc1784619c2cc8b646.

[mergekeeper]

MergeKeeper review unavailable

AI provider review response did not contain valid JSON

No approval or merge action was taken.