@integraledger/lcp-binding-stellar 0.9.0

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;8GAG8G;AAC9G,eAAO,MAAM,UAAU,EAAG,kBAA2B,CAAC;AAEtD,8DAA8D;AAC9D,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElD;;;wFAGwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,cAAc,CAAC;IACxB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,eAAO,MAAM,kBAAkB,sCAAsC,CAAC;AACtE;;gCAEgC;AAChC,eAAO,MAAM,iBAAiB,mDACoB,CAAC;AAkBnD;gCACgC;AAChC,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,GACtB,oBAAoB,CAEtB;AAED,uEAAuE;AACvE,eAAO,MAAM,aAAa,IAAI,CAAC"}

package/dist/constants.js

@@ -0,0 +1,46 @@
+/**
+ * Stellar network constants for the LCP CAP-67 muxed-address binding. The binding rides
+ * `mux_id = atrHash[:8]` inside a CAP-67 muxed M-address that the seller advertises as `payTo`; the buyer
+ * signs a Soroban SAC `transfer(from, to, amount)` whose `to` is that M-address, so the buyer's signature
+ * commits the 8-byte prefix atomically with the transfer (canonical LCP §8.3.1 Native Field per the LCP
+ * per-chain binding table — the CAP-67 muxed id, not an overlay contract).
+ *
+ * ★ ONLY 8 bytes ride on-chain. A CAP-67 muxed id is exactly 8 bytes, so the FULL 32-byte atrHash does not
+ * fit — the on-chain artifact confirms `atrHash[:8]`, it does not recover the whole hash (that comes from
+ * off-chain `extensions.legalContext.info`). See `mux.ts` and the manifest for how the surface stays honest.
+ */
+/** The single canonical mux-id derivation scheme LCP-on-Stellar commits to: `mux_id = atrHash[:8]`. The
+ *  prefix is deliberately public (project_stellar_mux_prefix8_audit) — any observer holding the atrHash can
+ *  confirm the on-chain mux id matches, which IS the audit-trail property the protocol wants. No HMAC /
+ *  per-seller-key variant is wired (that would trade auditability for unlinkability, which is not wanted). */
+export const MUX_SCHEME = "atrHash-prefix-8";
+/** The mux id is the first 8 bytes of the 32-byte atrHash. */
+export const MUX_ID_BYTES = 8;
+/** Stellar network passphrases (from the SDK's `Networks`; inlined here so constants stays SDK-free). */
+export const TESTNET_PASSPHRASE = "Test SDF Network ; September 2015";
+/** The pubnet passphrase. Note the spacing — ` ; ` with spaces either side is part of the string, and the
+ *  passphrase is hashed into every signature, so a single wrong character produces a transaction that
+ *  verifies against nothing. */
+export const PUBNET_PASSPHRASE = "Public Global Stellar Network ; September 2015";
+const TESTNET = {
+    network: "testnet",
+    networkPassphrase: TESTNET_PASSPHRASE,
+    horizonUrl: "https://horizon-testnet.stellar.org",
+    sorobanRpcUrl: "https://soroban-testnet.stellar.org",
+    usdcSacContractId: "CAQCFVLOBK5GIULPNZRGATJJMIZL5BSP7X5YJVMGCPTUEPFM4AVSRCJU",
+};
+const PUBNET = {
+    network: "pubnet",
+    networkPassphrase: PUBNET_PASSPHRASE,
+    horizonUrl: "https://horizon.stellar.org",
+    sorobanRpcUrl: "https://mainnet.sorobanrpc.com",
+    usdcSacContractId: "CCW67TSZV3SSS2HXMBQ5JFGCKJNXKZM7UQUWUZPUTHXSTZLEO7SJMI75",
+};
+/** The constants for one network. Both are usable — the CAP-67 muxed id is a ledger primitive, so nothing
+ *  has to be deployed first. */
+export function getStellarConfig(network) {
+    return network === "testnet" ? TESTNET : PUBNET;
+}
+/** USDC on Stellar has 7 decimals — 1 USDC = 10_000_000 base units. */
+export const USDC_DECIMALS = 7;
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;8GAG8G;AAC9G,MAAM,CAAC,MAAM,UAAU,GAAG,kBAA2B,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAqB9B,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AACtE;;gCAEgC;AAChC,MAAM,CAAC,MAAM,iBAAiB,GAC5B,gDAAgD,CAAC;AAEnD,MAAM,OAAO,GAAyB;IACpC,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,kBAAkB;IACrC,UAAU,EAAE,qCAAqC;IACjD,aAAa,EAAE,qCAAqC;IACpD,iBAAiB,EAAE,0DAA0D;CAC9E,CAAC;AAEF,MAAM,MAAM,GAAyB;IACnC,OAAO,EAAE,QAAQ;IACjB,iBAAiB,EAAE,iBAAiB;IACpC,UAAU,EAAE,6BAA6B;IACzC,aAAa,EAAE,gCAAgC;IAC/C,iBAAiB,EAAE,0DAA0D;CAC9E,CAAC;AAEF;gCACgC;AAChC,MAAM,UAAU,gBAAgB,CAC9B,OAAuB;IAEvB,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { buildMuxedDestination, createStellarAdapter, isSettledSuccessfully, STELLAR_PREFIX_NOTE, type StellarAdapter, type StellarMuxConfirmation, type StellarMuxPrefixRecovery, type StellarReader, type StellarSettlementRef, type StellarSettlementView, } from "./adapter.js";
+export { getStellarConfig, MUX_ID_BYTES, MUX_SCHEME, PUBNET_PASSPHRASE, type StellarNetwork, type StellarNetworkConfig, TESTNET_PASSPHRASE, USDC_DECIMALS, } from "./constants.js";
+export { STELLAR_MANIFEST } from "./manifest.js";
+export { type DecodedMuxedAddress, decodeMuxedAddress, deriveMuxId, encodeMuxedAddress, recoverMuxIdPrefix8, verifyMuxedBinding, } from "./mux.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { buildMuxedDestination, createStellarAdapter, isSettledSuccessfully, STELLAR_PREFIX_NOTE, } from "./adapter.js";
+export { getStellarConfig, MUX_ID_BYTES, MUX_SCHEME, PUBNET_PASSPHRASE, TESTNET_PASSPHRASE, USDC_DECIMALS, } from "./constants.js";
+export { STELLAR_MANIFEST } from "./manifest.js";
+export { decodeMuxedAddress, deriveMuxId, encodeMuxedAddress, recoverMuxIdPrefix8, verifyMuxedBinding, } from "./mux.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GAOpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,iBAAiB,EAGjB,kBAAkB,EAClB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAEL,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,UAAU,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,32 @@
+import type { BindingManifest } from "@integraledger/lcp-binding-core";
+/**
+ * The Stellar CAP-67 muxed-address binding manifest.
+ *
+ * **pattern = "native-field"** — the binding rides `mux_id` inside a CAP-67 muxed M-address (an existing
+ * Stellar account primitive), not an overlay contract (canonical LCP §8.3.1 per the LCP per-chain table). The
+ * buyer signs the Soroban SAC `transfer` whose `to` is that M-address, so the weld is **signature-grade** —
+ * the payer's signature commits the mux id atomically with the transfer.
+ *
+ * **★ recovery.zeroPartyRecoverable = false AND recovery.forwardIndexable = false — deliberately honest.**
+ * A CAP-67 muxed id is exactly **8 bytes**, so only `atrHash[:8]` rides on-chain; the FULL 32-byte atrHash
+ * does NOT fit. From a settlement alone you can recover only the 8-byte prefix, which is not the atrHash —
+ * so the binding CONFIRMS a known atrHash's prefix-8 against the on-chain mux id (`verifyMuxedBinding`), it
+ * does NOT reconstruct the full hash from the chain (that comes from off-chain `extensions.legalContext.info`). Hence
+ * `zeroPartyRecoverable: false` (a party with only the settlement cannot derive the atrHash) and
+ * `forwardIndexable: false` (no native index over mux prefixes; `enumerate` is a best-effort account scan,
+ * `indexing: "account-scan:mux-prefix8"`). The prefix-8 truncation is stated in `finality.note` too.
+ *
+ * **NO `protocol`, and here is precisely what it is neutral OF.** This binding welds into the destination
+ * of a CLASSIC Stellar payment. x402's `exact` scheme for Stellar (read 2026-08-08) is a different flow
+ * entirely: "This spec covers SEP-41-compliant Soroban tokens **only**. Classic Stellar assets are not
+ * supported", and the payment is an `invokeHostFunction` calling `transfer(from, to, amount)` where
+ * "Argument 1 (to): MUST equal `requirements.payTo` exactly".
+ *
+ * A muxed destination cannot appear in that call — there is no classic payment to mux, and an `M…` address
+ * would not equal `payTo` exactly. So a deployment settling through an x402-Stellar facilitator does not
+ * get this carrier. That is a scoping fact, not a defect: the binding has never declared `protocol`, and
+ * the mux weld is correct on the rail it targets. Stated here so the absence is a measured claim rather
+ * than an unexamined default.
+ */
+export declare const STELLAR_MANIFEST: BindingManifest;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAkB9B,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,49 @@
+/**
+ * The Stellar CAP-67 muxed-address binding manifest.
+ *
+ * **pattern = "native-field"** — the binding rides `mux_id` inside a CAP-67 muxed M-address (an existing
+ * Stellar account primitive), not an overlay contract (canonical LCP §8.3.1 per the LCP per-chain table). The
+ * buyer signs the Soroban SAC `transfer` whose `to` is that M-address, so the weld is **signature-grade** —
+ * the payer's signature commits the mux id atomically with the transfer.
+ *
+ * **★ recovery.zeroPartyRecoverable = false AND recovery.forwardIndexable = false — deliberately honest.**
+ * A CAP-67 muxed id is exactly **8 bytes**, so only `atrHash[:8]` rides on-chain; the FULL 32-byte atrHash
+ * does NOT fit. From a settlement alone you can recover only the 8-byte prefix, which is not the atrHash —
+ * so the binding CONFIRMS a known atrHash's prefix-8 against the on-chain mux id (`verifyMuxedBinding`), it
+ * does NOT reconstruct the full hash from the chain (that comes from off-chain `extensions.legalContext.info`). Hence
+ * `zeroPartyRecoverable: false` (a party with only the settlement cannot derive the atrHash) and
+ * `forwardIndexable: false` (no native index over mux prefixes; `enumerate` is a best-effort account scan,
+ * `indexing: "account-scan:mux-prefix8"`). The prefix-8 truncation is stated in `finality.note` too.
+ *
+ * **NO `protocol`, and here is precisely what it is neutral OF.** This binding welds into the destination
+ * of a CLASSIC Stellar payment. x402's `exact` scheme for Stellar (read 2026-08-08) is a different flow
+ * entirely: "This spec covers SEP-41-compliant Soroban tokens **only**. Classic Stellar assets are not
+ * supported", and the payment is an `invokeHostFunction` calling `transfer(from, to, amount)` where
+ * "Argument 1 (to): MUST equal `requirements.payTo` exactly".
+ *
+ * A muxed destination cannot appear in that call — there is no classic payment to mux, and an `M…` address
+ * would not equal `payTo` exactly. So a deployment settling through an x402-Stellar facilitator does not
+ * get this carrier. That is a scoping fact, not a defect: the binding has never declared `protocol`, and
+ * the mux weld is correct on the rail it targets. Stated here so the absence is a measured claim rather
+ * than an unexamined default.
+ */
+export const STELLAR_MANIFEST = {
+    rail: "stellar",
+    pattern: "native-field",
+    nativeField: "cap67-mux-id",
+    recovery: {
+        onChain: true,
+        zeroPartyRecoverable: false,
+        forwardIndexable: false,
+    },
+    assetBinding: "none", // envelope weld — the mux id carries atrHash[:8] only; the asset never appears in the view
+    successGate: "raw-field", // Horizon successful; a txFAILED tx keeps its M-address in the envelope
+    indexing: "account-scan:mux-prefix8",
+    finality: {
+        reversible: false,
+        note: "final on ledger close (Soroban SAC transfer) — no on-rail reversal; only atrHash[:8] rides in the CAP-67 mux id, so settlement alone confirms the prefix-8 match but does NOT recover the full hash (the full atrHash comes from off-chain extensions.legalContext.info); recourse is the record's elected forum (PAY-3/RCS-5), never dispute resolution",
+    },
+    weldGrades: { "cap67-mux": "signature" },
+    lifecycleStates: ["proposed", "settled"],
+};
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,cAAc;IAC3B,QAAQ,EAAE;QACR,OAAO,EAAE,IAAI;QACb,oBAAoB,EAAE,KAAK;QAC3B,gBAAgB,EAAE,KAAK;KACxB;IACD,YAAY,EAAE,MAAM,EAAE,2FAA2F;IACjH,WAAW,EAAE,WAAW,EAAE,wEAAwE;IAClG,QAAQ,EAAE,0BAA0B;IACpC,QAAQ,EAAE;QACR,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,0VAA0V;KACjW;IACD,UAAU,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;IACxC,eAAe,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;CACzC,CAAC"}

package/dist/mux.d.ts

@@ -0,0 +1,27 @@
+/** Derive the 8-byte mux id from a known atrHash: `mux_id = atrHash[:8]`. Throws on a malformed atrHash
+ *  (fail-fast). Pure — no SDK. */
+export declare function deriveMuxId(atrHash: string): Uint8Array;
+/** Encode a base G-pubkey (StrKey) + 8-byte mux id as a 69-character CAP-67 M-address. Throws on a
+ *  wrong-length mux id (fail-fast). */
+export declare function encodeMuxedAddress(basePubkey: string, muxId: Uint8Array): string;
+/** The decoded parts of a CAP-67 M-address: the base G-pubkey and the 8-byte mux id prefix. */
+export interface DecodedMuxedAddress {
+    basePubkey: string;
+    muxId: Uint8Array;
+}
+/** Decode a CAP-67 M-address into its base G-pubkey and 8-byte mux id. Returns `null` for anything that is
+ *  not a valid M-address (so a settlement scan skips a non-muxed destination without treating it as an
+ *  error — mirrors the codec's null-vs-throw convention). */
+export declare function decodeMuxedAddress(mAddr: string): DecodedMuxedAddress | null;
+/** Recover the 8-byte mux id PREFIX from a settlement's CAP-67 M-address. This is the ONLY thing on-chain —
+ *  it is `atrHash[:8]`, NOT the full atrHash. Returned as raw 8 bytes (never a `0x…64hex` value that would
+ *  read as a full hash). `null` if the address is not a valid M-address. */
+export declare function recoverMuxIdPrefix8(mAddr: string): Uint8Array | null;
+/** CONFIRM (not recover): does a known atrHash's prefix-8 equal the mux id carried by `mAddr`? This is the
+ *  primary honest surface — an observer holding the atrHash checks the on-chain destination binds to it.
+ *  `false` for a non-M-address or a malformed atrHash (never throws on those; fail-CLOSED). */
+export declare function verifyMuxedBinding(inputs: {
+    muxedM: string;
+    atrHash: string;
+}): boolean;
+//# sourceMappingURL=mux.d.ts.map

package/dist/mux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mux.d.ts","sourceRoot":"","sources":["../src/mux.ts"],"names":[],"mappings":"AA0BA;kCACkC;AAClC,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAKvD;AAED;uCACuC;AACvC,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,UAAU,GAChB,MAAM,CAiBR;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;6DAE6D;AAC7D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAS5E;AAED;;4EAE4E;AAC5E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAGpE;AAED;;+FAE+F;AAC/F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAKV"}

package/dist/mux.js

@@ -0,0 +1,70 @@
+/**
+ * The CAP-67 muxed-address atrHash codec — the honest heart of the Stellar binding. Ported from the proven
+ * reference mux codec, restricted to the single canonical scheme `mux_id = atrHash[:8]`
+ * (project_stellar_mux_prefix8_audit — the HMAC variant is deliberately NOT ported; it trades the wanted
+ * auditability for unwanted per-seller unlinkability).
+ *
+ * ★ CONFIRM-NOT-RECOVER. A CAP-67 muxed id is exactly 8 bytes. `mux_id = atrHash[:8]` therefore carries
+ * only the FIRST 8 bytes of the 32-byte atrHash on-chain — the full hash does NOT fit. So this module can:
+ *   - DERIVE the 8-byte prefix from a known atrHash (`deriveMuxId`);
+ *   - ENCODE/DECODE a CAP-67 M-address (`encodeMuxedAddress` / `decodeMuxedAddress`), round-tripping the
+ *     8-byte id;
+ *   - CONFIRM that a known atrHash's prefix-8 equals an M-address's on-chain mux id (`verifyMuxedBinding`).
+ * It CANNOT recover the full atrHash from a settlement alone — the settlement holds 8 bytes, not 32. The
+ * full atrHash is obtained off-chain from `extensions.legalContext.info`; the on-chain mux id is the public match
+ * check, not the source of the hash. `recoverMuxIdPrefix8` returns exactly those 8 bytes, labelled as a
+ * prefix — never a `0x…64hex` value that would falsely read as a full atrHash.
+ */
+import { hexToBytes } from "@integraledger/lcp-binding-core";
+import { bytesEqual, canonicalAtrHash, isAtrHash, } from "@integraledger/lcp-kernel";
+import { StrKey } from "@stellar/stellar-sdk";
+import { MUX_ID_BYTES } from "./constants.js";
+/** Derive the 8-byte mux id from a known atrHash: `mux_id = atrHash[:8]`. Throws on a malformed atrHash
+ *  (fail-fast). Pure — no SDK. */
+export function deriveMuxId(atrHash) {
+    return hexToBytes(canonicalAtrHash(atrHash, "deriveMuxId")).slice(0, MUX_ID_BYTES);
+}
+/** Encode a base G-pubkey (StrKey) + 8-byte mux id as a 69-character CAP-67 M-address. Throws on a
+ *  wrong-length mux id (fail-fast). */
+export function encodeMuxedAddress(basePubkey, muxId) {
+    if (muxId.length !== MUX_ID_BYTES)
+        throw new Error(`encodeMuxedAddress: mux id must be exactly ${MUX_ID_BYTES} bytes, got ${muxId.length}`);
+    const baseBytes = StrKey.decodeEd25519PublicKey(basePubkey);
+    const combined = new Uint8Array(32 + MUX_ID_BYTES);
+    combined.set(new Uint8Array(baseBytes.buffer, baseBytes.byteOffset, baseBytes.byteLength), 0);
+    combined.set(muxId, 32);
+    return StrKey.encodeMed25519PublicKey(Buffer.from(combined));
+}
+/** Decode a CAP-67 M-address into its base G-pubkey and 8-byte mux id. Returns `null` for anything that is
+ *  not a valid M-address (so a settlement scan skips a non-muxed destination without treating it as an
+ *  error — mirrors the codec's null-vs-throw convention). */
+export function decodeMuxedAddress(mAddr) {
+    if (!StrKey.isValidMed25519PublicKey(mAddr))
+        return null;
+    const bytes = StrKey.decodeMed25519PublicKey(mAddr);
+    const muxId = new Uint8Array(MUX_ID_BYTES);
+    muxId.set(bytes.subarray(32, 32 + MUX_ID_BYTES));
+    return {
+        basePubkey: StrKey.encodeEd25519PublicKey(bytes.subarray(0, 32)),
+        muxId,
+    };
+}
+/** Recover the 8-byte mux id PREFIX from a settlement's CAP-67 M-address. This is the ONLY thing on-chain —
+ *  it is `atrHash[:8]`, NOT the full atrHash. Returned as raw 8 bytes (never a `0x…64hex` value that would
+ *  read as a full hash). `null` if the address is not a valid M-address. */
+export function recoverMuxIdPrefix8(mAddr) {
+    const decoded = decodeMuxedAddress(mAddr);
+    return decoded === null ? null : decoded.muxId;
+}
+/** CONFIRM (not recover): does a known atrHash's prefix-8 equal the mux id carried by `mAddr`? This is the
+ *  primary honest surface — an observer holding the atrHash checks the on-chain destination binds to it.
+ *  `false` for a non-M-address or a malformed atrHash (never throws on those; fail-CLOSED). */
+export function verifyMuxedBinding(inputs) {
+    if (!isAtrHash(inputs.atrHash))
+        return false;
+    const onChain = recoverMuxIdPrefix8(inputs.muxedM);
+    if (onChain === null)
+        return false;
+    return bytesEqual(onChain, deriveMuxId(inputs.atrHash));
+}
+//# sourceMappingURL=mux.js.map

package/dist/mux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mux.js","sourceRoot":"","sources":["../src/mux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,SAAS,GACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;kCACkC;AAClC,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAC/D,CAAC,EACD,YAAY,CACb,CAAC;AACJ,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,KAAiB;IAEjB,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;QAC/B,MAAM,IAAI,KAAK,CACb,8CAA8C,YAAY,eAAe,KAAK,CAAC,MAAM,EAAE,CACxF,CAAC;IACJ,MAAM,SAAS,GAAG,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC;IACnD,QAAQ,CAAC,GAAG,CACV,IAAI,UAAU,CACZ,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CACrB,EACD,CAAC,CACF,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC;AAQD;;6DAE6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3C,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACjD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;4EAE4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;+FAE+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,MAGlC;IACC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@integraledger/lcp-binding-stellar",
+  "version": "0.9.0",
+  "description": "Welds an ATR hash into a Stellar payment.",
+  "keywords": [
+    "lcp",
+    "legal-context-protocol",
+    "legal-terms",
+    "agentic-commerce",
+    "settlement",
+    "atr-hash",
+    "stellar"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "CHANGELOG.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/IntegraLedger/integra-protocol.git",
+    "directory": "packages/binding-stellar"
+  },
+  "bugs": {
+    "url": "https://github.com/IntegraLedger/integra-protocol/issues"
+  },
+  "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/binding-stellar#readme",
+  "dependencies": {
+    "@stellar/stellar-sdk": "16.2.0",
+    "@integraledger/lcp-binding-core": "0.9.0",
+    "@integraledger/lcp-kernel": "0.9.0"
+  },
+  "devDependencies": {
+    "@types/json-schema": "7.0.15",
+    "@types/node": "24.13.3",
+    "vitest": "4.1.10"
+  },
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}