confidia-sdk 1.0.0

package/README.md

@@ -0,0 +1,74 @@
+# confidia-sdk
+
+Legal Context Protocol (LCP) client and a compliance policy engine, extracted
+from [Confidia](https://github.com/Eras256/Confidia) — private, compliant
+distribution rails for tokenized USD (USDC/EURC) on Stellar. Live demo:
+[confidia.vercel.app](https://confidia.vercel.app).
+
+Everything this package exports is real, dependency-free logic — no mocks, no
+simulated network calls, no fabricated data:
+
+- **`LcpClient`** — discovers a counterparty's Legal Context Protocol document
+  over a genuine HTTPS fetch, validates its shape, and verifies the linked
+  terms document's SHA-256 hash against the declared `atrHash`.
+- **`PolicyEngine`** — evaluates a transaction against compliance rules
+  (jurisdiction allow-lists, standard-vs-confidential thresholds, required
+  proof types) and returns a decision plus the reasons behind it.
+- **SEP-10 helpers** (`fetchSep10Challenge`, `verifySep10Signature`) — thin,
+  typed wrappers around a Stellar SEP-10 web-authentication challenge/response
+  flow against your own API.
+
+## Install
+
+```bash
+npm install confidia-sdk
+```
+
+## Usage
+
+```ts
+import { LcpClient, PolicyEngine } from "confidia-sdk";
+
+const lcp = new LcpClient();
+
+// Real network fetch + real SHA-256 hash verification — no fixtures.
+const doc = await lcp.fetchLegalContext("confidia.vercel.app");
+if (!lcp.validateLegalContext(doc)) {
+  throw new Error("Missing required LCP fields");
+}
+const terms = await lcp.fetchTermsDocument(doc.terms);
+const hashMatches = lcp.verifyAtrHash(terms, doc.atrHash); // true
+
+const policy = new PolicyEngine();
+const decision = policy.evaluate(
+  { amount: 12000, assetCode: "USDC", jurisdiction: "MX", isAccredited: true },
+  {
+    maxStandardAmount: 5000,
+    requireConfidential: false,
+    requiredProofs: ["zkBalance"],
+    allowedJurisdictions: ["MX", "US"],
+  }
+);
+// decision.tokenType === "confidential" (amount exceeds maxStandardAmount)
+```
+
+## What this package deliberately does not include
+
+Confidia's dashboard also ships real zero-knowledge verification (a deployed
+[Nethermind UltraHonk verifier](https://github.com/NethermindEth) doing
+genuine BN254 pairing checks on Stellar Soroban) and a real on-chain claim
+vault — those are Rust/Soroban contracts, not JS, so they aren't part of this
+npm package. See [`contracts/real-verifier`](https://github.com/Eras256/Confidia/tree/main/contracts/real-verifier)
+and the live Claim Portal for that code and its evidence trail on
+[stellar.expert](https://stellar.expert/explorer/testnet).
+
+An earlier internal build of this SDK also included a simulated ZK-proof
+client and a simulated confidential-token wrapper for demo purposes. Those
+were deliberately excluded from this public package — they encoded proofs as
+plain JSON and called an in-memory mock RPC, not real cryptography or a real
+contract, and publishing them under an SDK meant to represent real compliance
+tooling would have been misleading.
+
+## License
+
+MIT

package/dist/cjs/src/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./lcp.js";
+export * from "./policy.js";
+export * from "./sep10.js";

package/dist/cjs/src/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lcp.js"), exports);
+__exportStar(require("./policy.js"), exports);
+__exportStar(require("./sep10.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,8CAA4B;AAC5B,6CAA2B"}

package/dist/cjs/src/lcp.d.ts

@@ -0,0 +1,41 @@
+export interface LcpDocument {
+    terms: string;
+    atrHash: string;
+    termsFormat: string;
+    acceptanceRequired: boolean;
+    jurisdiction?: string;
+    disputeResolution?: string;
+    consentModel?: string;
+}
+export interface AgreementRecord {
+    agentId: string;
+    domain: string;
+    atrHash: string;
+    consentTimestamp: string;
+    signature: string;
+    status: "signed" | "active" | "disputed";
+}
+export declare class LcpClient {
+    /**
+     * Discovers and retrieves the legal context from a domain via a genuine
+     * network fetch to https://<domain>/.well-known/legal-context.json — no
+     * demo-domain special-casing, so behavior is identical for every caller.
+     */
+    fetchLegalContext(domain: string): Promise<LcpDocument>;
+    /**
+     * Fetches the raw terms document referenced by an LcpDocument's `terms` URL.
+     */
+    fetchTermsDocument(termsUrl: string): Promise<string>;
+    /**
+     * Validates LcpDocument according to the protocol rules.
+     */
+    validateLegalContext(lcp: any): boolean;
+    /**
+     * Verifies if the terms text SHA-256 matches the expected ATR hash.
+     */
+    verifyAtrHash(termsText: string, expectedHash: string): boolean;
+    /**
+     * Signs and creates a verifiable Agreement Record.
+     */
+    createAgreementRecord(agentId: string, domain: string, atrHash: string, agentPrivateKey: string): Promise<AgreementRecord>;
+}

package/dist/cjs/src/lcp.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LcpClient = void 0;
+const crypto = __importStar(require("crypto"));
+// Required fields per the Legal Context Protocol spec v1.0.0.
+const LCP_REQUIRED_FIELDS = ["terms", "atrHash"];
+class LcpClient {
+    /**
+     * Discovers and retrieves the legal context from a domain via a genuine
+     * network fetch to https://<domain>/.well-known/legal-context.json — no
+     * demo-domain special-casing, so behavior is identical for every caller.
+     */
+    async fetchLegalContext(domain) {
+        const url = `https://${domain}/.well-known/legal-context.json`;
+        const response = await fetch(url);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch LCP document: ${response.statusText}`);
+        }
+        const text = await response.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            // A 2xx response that isn't JSON usually means the domain has no real
+            // LCP document at this path (e.g. a SPA/catch-all route serving its
+            // index.html for any unknown path) — surface that plainly instead of
+            // leaking a raw "Unexpected token '<'" parse error.
+            throw new Error(`Domain does not publish a valid legal-context.json document at ${url}`);
+        }
+    }
+    /**
+     * Fetches the raw terms document referenced by an LcpDocument's `terms` URL.
+     */
+    async fetchTermsDocument(termsUrl) {
+        const response = await fetch(termsUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch terms document: ${response.statusText}`);
+        }
+        return await response.text();
+    }
+    /**
+     * Validates LcpDocument according to the protocol rules.
+     */
+    validateLegalContext(lcp) {
+        for (const field of LCP_REQUIRED_FIELDS) {
+            if (!lcp || typeof lcp !== "object" || !(field in lcp)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Verifies if the terms text SHA-256 matches the expected ATR hash.
+     */
+    verifyAtrHash(termsText, expectedHash) {
+        // Standardize newlines before hashing
+        const normalized = termsText.replace(/\r\n/g, "\n");
+        const hash = crypto.createHash("sha256").update(normalized).digest("hex");
+        // Clean expected hash (remove prefix 0x if present)
+        const cleanExpected = expectedHash.replace(/^0x/, "");
+        return hash === cleanExpected;
+    }
+    /**
+     * Signs and creates a verifiable Agreement Record.
+     */
+    async createAgreementRecord(agentId, domain, atrHash, agentPrivateKey) {
+        const consentTimestamp = new Date().toISOString();
+        const payload = `${agentId}:${domain}:${atrHash}:${consentTimestamp}`;
+        // Compute signature using mock/SHA256 signature
+        const signature = crypto
+            .createHmac("sha256", agentPrivateKey)
+            .update(payload)
+            .digest("hex");
+        return {
+            agentId,
+            domain,
+            atrHash,
+            consentTimestamp,
+            signature,
+            status: "signed"
+        };
+    }
+}
+exports.LcpClient = LcpClient;
+//# sourceMappingURL=lcp.js.map

package/dist/cjs/src/lcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lcp.js","sourceRoot":"","sources":["../../../src/lcp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAEjC,8DAA8D;AAC9D,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAqBjD,MAAa,SAAS;IACpB;;;;OAIG;IACI,KAAK,CAAC,iBAAiB,CAAC,MAAc;QAC3C,MAAM,GAAG,GAAG,WAAW,MAAM,iCAAiC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,oEAAoE;YACpE,qEAAqE;YACrE,oDAAoD;YACpD,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CAAC,GAAQ;QAClC,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,SAAiB,EAAE,YAAoB;QAC1D,sCAAsC;QACtC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1E,oDAAoD;QACpD,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,KAAK,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAChC,OAAe,EACf,MAAc,EACd,OAAe,EACf,eAAuB;QAEvB,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,MAAM,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAEtE,gDAAgD;QAChD,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;aACrC,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,OAAO;YACL,OAAO;YACP,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,SAAS;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;CACF;AAvFD,8BAuFC"}

package/dist/cjs/src/policy.d.ts

@@ -0,0 +1,23 @@
+export interface PolicyRules {
+    maxStandardAmount: number;
+    requireConfidential: boolean;
+    requiredProofs: string[];
+    allowedJurisdictions: string[];
+}
+export interface PolicyEvaluationResult {
+    allowed: boolean;
+    tokenType: "standard" | "confidential";
+    requiredProofs: string[];
+    reasons: string[];
+}
+export declare class PolicyEngine {
+    /**
+     * Evaluates if a transaction satisfies global policy rules and determines ZK requirements.
+     */
+    evaluate(transaction: {
+        amount: number;
+        assetCode: string;
+        jurisdiction?: string;
+        isAccredited?: boolean;
+    }, policy: PolicyRules): PolicyEvaluationResult;
+}

package/dist/cjs/src/policy.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyEngine = void 0;
+class PolicyEngine {
+    /**
+     * Evaluates if a transaction satisfies global policy rules and determines ZK requirements.
+     */
+    evaluate(transaction, policy) {
+        const reasons = [];
+        let allowed = true;
+        let tokenType = "standard";
+        const requiredProofs = [...policy.requiredProofs];
+        // Check jurisdiction constraints
+        if (transaction.jurisdiction && policy.allowedJurisdictions.length > 0) {
+            if (!policy.allowedJurisdictions.includes(transaction.jurisdiction)) {
+                allowed = false;
+                reasons.push(`Jurisdiction ${transaction.jurisdiction} is not authorized by the compliance policy.`);
+            }
+        }
+        // Determine standard vs confidential token selection
+        if (policy.requireConfidential || transaction.amount > policy.maxStandardAmount) {
+            tokenType = "confidential";
+            reasons.push(`Transaction amount ${transaction.amount} exceeds public threshold ${policy.maxStandardAmount} or privacy is explicitly mandated.`);
+        }
+        // Accumulate required ZK proofs based on transaction parameters
+        if (tokenType === "confidential") {
+            if (!requiredProofs.includes("zkBalance")) {
+                requiredProofs.push("zkBalance");
+            }
+            if (transaction.amount > policy.maxStandardAmount * 2 && !requiredProofs.includes("zkExposure")) {
+                requiredProofs.push("zkExposure");
+            }
+        }
+        // Add zkEligibility if accreditation or compliance checks are required
+        if (policy.requiredProofs.includes("zkEligibility") && !transaction.isAccredited) {
+            allowed = false;
+            reasons.push("ZK accreditation eligibility proof is required but account eligibility state is false.");
+        }
+        return {
+            allowed,
+            tokenType,
+            requiredProofs,
+            reasons
+        };
+    }
+}
+exports.PolicyEngine = PolicyEngine;
+//# sourceMappingURL=policy.js.map

package/dist/cjs/src/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/policy.ts"],"names":[],"mappings":";;;AAcA,MAAa,YAAY;IACvB;;OAEG;IACI,QAAQ,CACb,WAKC,EACD,MAAmB;QAEnB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,SAAS,GAAgC,UAAU,CAAC;QACxD,MAAM,cAAc,GAAa,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAE5D,iCAAiC;QACjC,IAAI,WAAW,CAAC,YAAY,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,OAAO,GAAG,KAAK,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,gBAAgB,WAAW,CAAC,YAAY,8CAA8C,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,mBAAmB,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChF,SAAS,GAAG,cAAc,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,MAAM,6BAA6B,MAAM,CAAC,iBAAiB,qCAAqC,CAAC,CAAC;QACnJ,CAAC;QAED,gEAAgE;QAChE,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1C,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;YACjF,OAAO,GAAG,KAAK,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;QACzG,CAAC;QAED,OAAO;YACL,OAAO;YACP,SAAS;YACT,cAAc;YACd,OAAO;SACR,CAAC;IACJ,CAAC;CACF;AAvDD,oCAuDC"}

package/dist/cjs/src/sdk.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cjs/src/sdk.test.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const index_js_1 = require("./index.js");
+(0, vitest_1.describe)("Confidia SDK Integration Verification", () => {
+    const lcpClient = new index_js_1.LcpClient();
+    const policyEngine = new index_js_1.PolicyEngine();
+    (0, vitest_1.describe)("LcpClient", () => {
+        (0, vitest_1.it)("should fetch and validate a real LCP config from a live domain", async () => {
+            const lcp = await lcpClient.fetchLegalContext("confidia.vercel.app");
+            (0, vitest_1.expect)(lcp.jurisdiction).toBe("US-DE");
+            (0, vitest_1.expect)(lcpClient.validateLegalContext(lcp)).toBe(true);
+        });
+        (0, vitest_1.it)("should check ATR terms document SHA-256 hash match", async () => {
+            const lcp = await lcpClient.fetchLegalContext("confidia.vercel.app");
+            const terms = await lcpClient.fetchTermsDocument(lcp.terms);
+            (0, vitest_1.expect)(lcpClient.verifyAtrHash(terms, lcp.atrHash)).toBe(true);
+            (0, vitest_1.expect)(lcpClient.verifyAtrHash("altered terms", lcp.atrHash)).toBe(false);
+        });
+        (0, vitest_1.it)("should sign a verifiable Agreement Record", async () => {
+            const record = await lcpClient.createAgreementRecord("agent-1", "confidia.vercel.app", "mock_atr_hash", "secret_priv_key");
+            (0, vitest_1.expect)(record.agentId).toBe("agent-1");
+            (0, vitest_1.expect)(record.status).toBe("signed");
+            (0, vitest_1.expect)(record.signature).toBeDefined();
+        });
+    });
+    (0, vitest_1.describe)("PolicyEngine", () => {
+        const rules = {
+            maxStandardAmount: 5000,
+            requireConfidential: false,
+            requiredProofs: ["zkBalance"],
+            allowedJurisdictions: ["MX", "US"]
+        };
+        (0, vitest_1.it)("should choose standard token standard below threshold", () => {
+            const evalRes = policyEngine.evaluate({ amount: 3000, assetCode: "USDC", jurisdiction: "MX", isAccredited: true }, rules);
+            (0, vitest_1.expect)(evalRes.allowed).toBe(true);
+            (0, vitest_1.expect)(evalRes.tokenType).toBe("standard");
+        });
+        (0, vitest_1.it)("should choose confidential token standard above threshold", () => {
+            const evalRes = policyEngine.evaluate({ amount: 12000, assetCode: "USDC", jurisdiction: "MX", isAccredited: true }, rules);
+            (0, vitest_1.expect)(evalRes.allowed).toBe(true);
+            (0, vitest_1.expect)(evalRes.tokenType).toBe("confidential");
+            (0, vitest_1.expect)(evalRes.requiredProofs).toContain("zkBalance");
+        });
+        (0, vitest_1.it)("should block transacting in unauthorized jurisdictions", () => {
+            const evalRes = policyEngine.evaluate({ amount: 2000, assetCode: "USDC", jurisdiction: "CA" }, rules);
+            (0, vitest_1.expect)(evalRes.allowed).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=sdk.test.js.map

package/dist/cjs/src/sdk.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.test.js","sourceRoot":"","sources":["../../../src/sdk.test.ts"],"names":[],"mappings":";;AAAA,mCAA8C;AAC9C,yCAAqD;AAErD,IAAA,iBAAQ,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,MAAM,SAAS,GAAG,IAAI,oBAAS,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,uBAAY,EAAE,CAAC;IAExC,IAAA,iBAAQ,EAAC,WAAW,EAAE,GAAG,EAAE;QACzB,IAAA,WAAE,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;YAC9E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YACrE,IAAA,eAAM,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAA,eAAM,EAAC,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAA,eAAM,EAAC,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAClD,SAAS,EACT,qBAAqB,EACrB,eAAe,EACf,iBAAiB,CAClB,CAAC;YACF,IAAA,eAAM,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAA,eAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,MAAM,KAAK,GAAG;YACZ,iBAAiB,EAAE,IAAI;YACvB,mBAAmB,EAAE,KAAK;YAC1B,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,oBAAoB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;SACnC,CAAC;QAEF,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CACnC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAC3E,KAAK,CACN,CAAC;YACF,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAA,eAAM,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CACnC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAC5E,KAAK,CACN,CAAC;YACF,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAA,eAAM,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/C,IAAA,eAAM,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CACnC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EACvD,KAAK,CACN,CAAC;YACF,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cjs/src/sep10.d.ts

@@ -0,0 +1,30 @@
+/**
+ * SEP-10 Web Authentication types and client helpers for Confidia SDK.
+ * These types are shared between the frontend (wallet-kit, auth.ts) and backend (server.ts).
+ */
+export interface Sep10Challenge {
+    /** Base64-encoded XDR of the unsigned challenge transaction */
+    transaction: string;
+    /** Stellar network passphrase the transaction was built for */
+    network_passphrase: string;
+}
+export interface Sep10VerifyRequest {
+    /** Signed XDR envelope returned by the wallet */
+    transaction: string;
+}
+export interface Sep10Session {
+    /** JWT token issued after successful SEP-10 challenge verification */
+    token: string;
+    /** Stellar G-address of the authenticated account */
+    address: string;
+    /** Unix timestamp when the session expires */
+    expiresAt: number;
+}
+/**
+ * Fetches a SEP-10 challenge for the given Stellar address from a Confidia API endpoint.
+ */
+export declare function fetchSep10Challenge(apiBase: string, address: string): Promise<Sep10Challenge>;
+/**
+ * Submits a signed SEP-10 challenge transaction to receive a session JWT.
+ */
+export declare function verifySep10Signature(apiBase: string, signedXdr: string): Promise<Sep10Session>;

package/dist/cjs/src/sep10.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * SEP-10 Web Authentication types and client helpers for Confidia SDK.
+ * These types are shared between the frontend (wallet-kit, auth.ts) and backend (server.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchSep10Challenge = fetchSep10Challenge;
+exports.verifySep10Signature = verifySep10Signature;
+/**
+ * Fetches a SEP-10 challenge for the given Stellar address from a Confidia API endpoint.
+ */
+async function fetchSep10Challenge(apiBase, address) {
+    const res = await fetch(`${apiBase}/auth/challenge?address=${address}`);
+    const text = await res.text();
+    try {
+        const data = JSON.parse(text);
+        if (data.error)
+            throw new Error(data.error);
+        return data;
+    }
+    catch {
+        throw new Error(`SEP-10 challenge endpoint returned non-JSON (status ${res.status}). Is the API running?`);
+    }
+}
+/**
+ * Submits a signed SEP-10 challenge transaction to receive a session JWT.
+ */
+async function verifySep10Signature(apiBase, signedXdr) {
+    const res = await fetch(`${apiBase}/auth/verify`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ transaction: signedXdr })
+    });
+    const text = await res.text();
+    try {
+        const data = JSON.parse(text);
+        if (data.error)
+            throw new Error(data.error);
+        return {
+            token: data.token,
+            address: data.address || "",
+            expiresAt: Math.floor(Date.now() / 1000) + 3600
+        };
+    }
+    catch {
+        throw new Error(`SEP-10 verify endpoint returned non-JSON (status ${res.status}). Is the API running?`);
+    }
+}
+//# sourceMappingURL=sep10.js.map

package/dist/cjs/src/sep10.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sep10.js","sourceRoot":"","sources":["../../../src/sep10.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA0BH,kDAeC;AAKD,oDAuBC;AA9CD;;GAEG;AACI,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,2BAA2B,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,IAAsB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uDAAuD,GAAG,CAAC,MAAM,wBAAwB,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,EAA+B,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,CAAC,MAAM,wBAAwB,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/esm/src/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./lcp.js";
+export * from "./policy.js";
+export * from "./sep10.js";

package/dist/esm/src/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lcp.js"), exports);
+__exportStar(require("./policy.js"), exports);
+__exportStar(require("./sep10.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/esm/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,8CAA4B;AAC5B,6CAA2B"}

package/dist/esm/src/lcp.d.ts

@@ -0,0 +1,41 @@
+export interface LcpDocument {
+    terms: string;
+    atrHash: string;
+    termsFormat: string;
+    acceptanceRequired: boolean;
+    jurisdiction?: string;
+    disputeResolution?: string;
+    consentModel?: string;
+}
+export interface AgreementRecord {
+    agentId: string;
+    domain: string;
+    atrHash: string;
+    consentTimestamp: string;
+    signature: string;
+    status: "signed" | "active" | "disputed";
+}
+export declare class LcpClient {
+    /**
+     * Discovers and retrieves the legal context from a domain via a genuine
+     * network fetch to https://<domain>/.well-known/legal-context.json — no
+     * demo-domain special-casing, so behavior is identical for every caller.
+     */
+    fetchLegalContext(domain: string): Promise<LcpDocument>;
+    /**
+     * Fetches the raw terms document referenced by an LcpDocument's `terms` URL.
+     */
+    fetchTermsDocument(termsUrl: string): Promise<string>;
+    /**
+     * Validates LcpDocument according to the protocol rules.
+     */
+    validateLegalContext(lcp: any): boolean;
+    /**
+     * Verifies if the terms text SHA-256 matches the expected ATR hash.
+     */
+    verifyAtrHash(termsText: string, expectedHash: string): boolean;
+    /**
+     * Signs and creates a verifiable Agreement Record.
+     */
+    createAgreementRecord(agentId: string, domain: string, atrHash: string, agentPrivateKey: string): Promise<AgreementRecord>;
+}

package/dist/esm/src/lcp.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LcpClient = void 0;
+const crypto = __importStar(require("crypto"));
+// Required fields per the Legal Context Protocol spec v1.0.0.
+const LCP_REQUIRED_FIELDS = ["terms", "atrHash"];
+class LcpClient {
+    /**
+     * Discovers and retrieves the legal context from a domain via a genuine
+     * network fetch to https://<domain>/.well-known/legal-context.json — no
+     * demo-domain special-casing, so behavior is identical for every caller.
+     */
+    async fetchLegalContext(domain) {
+        const url = `https://${domain}/.well-known/legal-context.json`;
+        const response = await fetch(url);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch LCP document: ${response.statusText}`);
+        }
+        const text = await response.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            // A 2xx response that isn't JSON usually means the domain has no real
+            // LCP document at this path (e.g. a SPA/catch-all route serving its
+            // index.html for any unknown path) — surface that plainly instead of
+            // leaking a raw "Unexpected token '<'" parse error.
+            throw new Error(`Domain does not publish a valid legal-context.json document at ${url}`);
+        }
+    }
+    /**
+     * Fetches the raw terms document referenced by an LcpDocument's `terms` URL.
+     */
+    async fetchTermsDocument(termsUrl) {
+        const response = await fetch(termsUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch terms document: ${response.statusText}`);
+        }
+        return await response.text();
+    }
+    /**
+     * Validates LcpDocument according to the protocol rules.
+     */
+    validateLegalContext(lcp) {
+        for (const field of LCP_REQUIRED_FIELDS) {
+            if (!lcp || typeof lcp !== "object" || !(field in lcp)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Verifies if the terms text SHA-256 matches the expected ATR hash.
+     */
+    verifyAtrHash(termsText, expectedHash) {
+        // Standardize newlines before hashing
+        const normalized = termsText.replace(/\r\n/g, "\n");
+        const hash = crypto.createHash("sha256").update(normalized).digest("hex");
+        // Clean expected hash (remove prefix 0x if present)
+        const cleanExpected = expectedHash.replace(/^0x/, "");
+        return hash === cleanExpected;
+    }
+    /**
+     * Signs and creates a verifiable Agreement Record.
+     */
+    async createAgreementRecord(agentId, domain, atrHash, agentPrivateKey) {
+        const consentTimestamp = new Date().toISOString();
+        const payload = `${agentId}:${domain}:${atrHash}:${consentTimestamp}`;
+        // Compute signature using mock/SHA256 signature
+        const signature = crypto
+            .createHmac("sha256", agentPrivateKey)
+            .update(payload)
+            .digest("hex");
+        return {
+            agentId,
+            domain,
+            atrHash,
+            consentTimestamp,
+            signature,
+            status: "signed"
+        };
+    }
+}
+exports.LcpClient = LcpClient;
+//# sourceMappingURL=lcp.js.map

package/dist/esm/src/lcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lcp.js","sourceRoot":"","sources":["../../../src/lcp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAEjC,8DAA8D;AAC9D,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAqBjD,MAAa,SAAS;IACpB;;;;OAIG;IACI,KAAK,CAAC,iBAAiB,CAAC,MAAc;QAC3C,MAAM,GAAG,GAAG,WAAW,MAAM,iCAAiC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,oEAAoE;YACpE,qEAAqE;YACrE,oDAAoD;YACpD,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CAAC,GAAQ;QAClC,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,SAAiB,EAAE,YAAoB;QAC1D,sCAAsC;QACtC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1E,oDAAoD;QACpD,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,KAAK,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAChC,OAAe,EACf,MAAc,EACd,OAAe,EACf,eAAuB;QAEvB,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,MAAM,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAEtE,gDAAgD;QAChD,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;aACrC,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,OAAO;YACL,OAAO;YACP,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,SAAS;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;CACF;AAvFD,8BAuFC"}

package/dist/esm/src/policy.d.ts

@@ -0,0 +1,23 @@
+export interface PolicyRules {
+    maxStandardAmount: number;
+    requireConfidential: boolean;
+    requiredProofs: string[];
+    allowedJurisdictions: string[];
+}
+export interface PolicyEvaluationResult {
+    allowed: boolean;
+    tokenType: "standard" | "confidential";
+    requiredProofs: string[];
+    reasons: string[];
+}
+export declare class PolicyEngine {
+    /**
+     * Evaluates if a transaction satisfies global policy rules and determines ZK requirements.
+     */
+    evaluate(transaction: {
+        amount: number;
+        assetCode: string;
+        jurisdiction?: string;
+        isAccredited?: boolean;
+    }, policy: PolicyRules): PolicyEvaluationResult;
+}

package/dist/esm/src/policy.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyEngine = void 0;
+class PolicyEngine {
+    /**
+     * Evaluates if a transaction satisfies global policy rules and determines ZK requirements.
+     */
+    evaluate(transaction, policy) {
+        const reasons = [];
+        let allowed = true;
+        let tokenType = "standard";
+        const requiredProofs = [...policy.requiredProofs];
+        // Check jurisdiction constraints
+        if (transaction.jurisdiction && policy.allowedJurisdictions.length > 0) {
+            if (!policy.allowedJurisdictions.includes(transaction.jurisdiction)) {
+                allowed = false;
+                reasons.push(`Jurisdiction ${transaction.jurisdiction} is not authorized by the compliance policy.`);
+            }
+        }
+        // Determine standard vs confidential token selection
+        if (policy.requireConfidential || transaction.amount > policy.maxStandardAmount) {
+            tokenType = "confidential";
+            reasons.push(`Transaction amount ${transaction.amount} exceeds public threshold ${policy.maxStandardAmount} or privacy is explicitly mandated.`);
+        }
+        // Accumulate required ZK proofs based on transaction parameters
+        if (tokenType === "confidential") {
+            if (!requiredProofs.includes("zkBalance")) {
+                requiredProofs.push("zkBalance");
+            }
+            if (transaction.amount > policy.maxStandardAmount * 2 && !requiredProofs.includes("zkExposure")) {
+                requiredProofs.push("zkExposure");
+            }
+        }
+        // Add zkEligibility if accreditation or compliance checks are required
+        if (policy.requiredProofs.includes("zkEligibility") && !transaction.isAccredited) {
+            allowed = false;
+            reasons.push("ZK accreditation eligibility proof is required but account eligibility state is false.");
+        }
+        return {
+            allowed,
+            tokenType,
+            requiredProofs,
+            reasons
+        };
+    }
+}
+exports.PolicyEngine = PolicyEngine;
+//# sourceMappingURL=policy.js.map

package/dist/esm/src/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/policy.ts"],"names":[],"mappings":";;;AAcA,MAAa,YAAY;IACvB;;OAEG;IACI,QAAQ,CACb,WAKC,EACD,MAAmB;QAEnB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,SAAS,GAAgC,UAAU,CAAC;QACxD,MAAM,cAAc,GAAa,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAE5D,iCAAiC;QACjC,IAAI,WAAW,CAAC,YAAY,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,OAAO,GAAG,KAAK,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,gBAAgB,WAAW,CAAC,YAAY,8CAA8C,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,mBAAmB,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChF,SAAS,GAAG,cAAc,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,MAAM,6BAA6B,MAAM,CAAC,iBAAiB,qCAAqC,CAAC,CAAC;QACnJ,CAAC;QAED,gEAAgE;QAChE,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1C,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;YACjF,OAAO,GAAG,KAAK,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;QACzG,CAAC;QAED,OAAO;YACL,OAAO;YACP,SAAS;YACT,cAAc;YACd,OAAO;SACR,CAAC;IACJ,CAAC;CACF;AAvDD,oCAuDC"}

package/dist/esm/src/sdk.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/src/sdk.test.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const index_js_1 = require("./index.js");
+(0, vitest_1.describe)("Confidia SDK Integration Verification", () => {
+    const lcpClient = new index_js_1.LcpClient();
+    const policyEngine = new index_js_1.PolicyEngine();
+    (0, vitest_1.describe)("LcpClient", () => {
+        (0, vitest_1.it)("should fetch and validate a real LCP config from a live domain", async () => {
+            const lcp = await lcpClient.fetchLegalContext("confidia.vercel.app");
+            (0, vitest_1.expect)(lcp.jurisdiction).toBe("US-DE");
+            (0, vitest_1.expect)(lcpClient.validateLegalContext(lcp)).toBe(true);
+        });
+        (0, vitest_1.it)("should check ATR terms document SHA-256 hash match", async () => {
+            const lcp = await lcpClient.fetchLegalContext("confidia.vercel.app");
+            const terms = await lcpClient.fetchTermsDocument(lcp.terms);
+            (0, vitest_1.expect)(lcpClient.verifyAtrHash(terms, lcp.atrHash)).toBe(true);
+            (0, vitest_1.expect)(lcpClient.verifyAtrHash("altered terms", lcp.atrHash)).toBe(false);
+        });
+        (0, vitest_1.it)("should sign a verifiable Agreement Record", async () => {
+            const record = await lcpClient.createAgreementRecord("agent-1", "confidia.vercel.app", "mock_atr_hash", "secret_priv_key");
+            (0, vitest_1.expect)(record.agentId).toBe("agent-1");
+            (0, vitest_1.expect)(record.status).toBe("signed");
+            (0, vitest_1.expect)(record.signature).toBeDefined();
+        });
+    });
+    (0, vitest_1.describe)("PolicyEngine", () => {
+        const rules = {
+            maxStandardAmount: 5000,
+            requireConfidential: false,
+            requiredProofs: ["zkBalance"],
+            allowedJurisdictions: ["MX", "US"]
+        };
+        (0, vitest_1.it)("should choose standard token standard below threshold", () => {
+            const evalRes = policyEngine.evaluate({ amount: 3000, assetCode: "USDC", jurisdiction: "MX", isAccredited: true }, rules);
+            (0, vitest_1.expect)(evalRes.allowed).toBe(true);
+            (0, vitest_1.expect)(evalRes.tokenType).toBe("standard");
+        });
+        (0, vitest_1.it)("should choose confidential token standard above threshold", () => {
+            const evalRes = policyEngine.evaluate({ amount: 12000, assetCode: "USDC", jurisdiction: "MX", isAccredited: true }, rules);
+            (0, vitest_1.expect)(evalRes.allowed).toBe(true);
+            (0, vitest_1.expect)(evalRes.tokenType).toBe("confidential");
+            (0, vitest_1.expect)(evalRes.requiredProofs).toContain("zkBalance");
+        });
+        (0, vitest_1.it)("should block transacting in unauthorized jurisdictions", () => {
+            const evalRes = policyEngine.evaluate({ amount: 2000, assetCode: "USDC", jurisdiction: "CA" }, rules);
+            (0, vitest_1.expect)(evalRes.allowed).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=sdk.test.js.map

package/dist/esm/src/sdk.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.test.js","sourceRoot":"","sources":["../../../src/sdk.test.ts"],"names":[],"mappings":";;AAAA,mCAA8C;AAC9C,yCAAqD;AAErD,IAAA,iBAAQ,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,MAAM,SAAS,GAAG,IAAI,oBAAS,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,uBAAY,EAAE,CAAC;IAExC,IAAA,iBAAQ,EAAC,WAAW,EAAE,GAAG,EAAE;QACzB,IAAA,WAAE,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;YAC9E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YACrE,IAAA,eAAM,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAA,eAAM,EAAC,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAA,eAAM,EAAC,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAClD,SAAS,EACT,qBAAqB,EACrB,eAAe,EACf,iBAAiB,CAClB,CAAC;YACF,IAAA,eAAM,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAA,eAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,MAAM,KAAK,GAAG;YACZ,iBAAiB,EAAE,IAAI;YACvB,mBAAmB,EAAE,KAAK;YAC1B,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,oBAAoB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;SACnC,CAAC;QAEF,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CACnC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAC3E,KAAK,CACN,CAAC;YACF,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAA,eAAM,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CACnC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAC5E,KAAK,CACN,CAAC;YACF,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAA,eAAM,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/C,IAAA,eAAM,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CACnC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EACvD,KAAK,CACN,CAAC;YACF,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/src/sep10.d.ts

@@ -0,0 +1,30 @@
+/**
+ * SEP-10 Web Authentication types and client helpers for Confidia SDK.
+ * These types are shared between the frontend (wallet-kit, auth.ts) and backend (server.ts).
+ */
+export interface Sep10Challenge {
+    /** Base64-encoded XDR of the unsigned challenge transaction */
+    transaction: string;
+    /** Stellar network passphrase the transaction was built for */
+    network_passphrase: string;
+}
+export interface Sep10VerifyRequest {
+    /** Signed XDR envelope returned by the wallet */
+    transaction: string;
+}
+export interface Sep10Session {
+    /** JWT token issued after successful SEP-10 challenge verification */
+    token: string;
+    /** Stellar G-address of the authenticated account */
+    address: string;
+    /** Unix timestamp when the session expires */
+    expiresAt: number;
+}
+/**
+ * Fetches a SEP-10 challenge for the given Stellar address from a Confidia API endpoint.
+ */
+export declare function fetchSep10Challenge(apiBase: string, address: string): Promise<Sep10Challenge>;
+/**
+ * Submits a signed SEP-10 challenge transaction to receive a session JWT.
+ */
+export declare function verifySep10Signature(apiBase: string, signedXdr: string): Promise<Sep10Session>;

package/dist/esm/src/sep10.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * SEP-10 Web Authentication types and client helpers for Confidia SDK.
+ * These types are shared between the frontend (wallet-kit, auth.ts) and backend (server.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchSep10Challenge = fetchSep10Challenge;
+exports.verifySep10Signature = verifySep10Signature;
+/**
+ * Fetches a SEP-10 challenge for the given Stellar address from a Confidia API endpoint.
+ */
+async function fetchSep10Challenge(apiBase, address) {
+    const res = await fetch(`${apiBase}/auth/challenge?address=${address}`);
+    const text = await res.text();
+    try {
+        const data = JSON.parse(text);
+        if (data.error)
+            throw new Error(data.error);
+        return data;
+    }
+    catch {
+        throw new Error(`SEP-10 challenge endpoint returned non-JSON (status ${res.status}). Is the API running?`);
+    }
+}
+/**
+ * Submits a signed SEP-10 challenge transaction to receive a session JWT.
+ */
+async function verifySep10Signature(apiBase, signedXdr) {
+    const res = await fetch(`${apiBase}/auth/verify`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ transaction: signedXdr })
+    });
+    const text = await res.text();
+    try {
+        const data = JSON.parse(text);
+        if (data.error)
+            throw new Error(data.error);
+        return {
+            token: data.token,
+            address: data.address || "",
+            expiresAt: Math.floor(Date.now() / 1000) + 3600
+        };
+    }
+    catch {
+        throw new Error(`SEP-10 verify endpoint returned non-JSON (status ${res.status}). Is the API running?`);
+    }
+}
+//# sourceMappingURL=sep10.js.map

package/dist/esm/src/sep10.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sep10.js","sourceRoot":"","sources":["../../../src/sep10.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA0BH,kDAeC;AAKD,oDAuBC;AA9CD;;GAEG;AACI,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,2BAA2B,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,IAAsB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uDAAuD,GAAG,CAAC,MAAM,wBAAwB,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,EAA+B,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,CAAC,MAAM,wBAAwB,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "confidia-sdk",
+  "version": "1.0.0",
+  "description": "Legal Context Protocol (LCP) client and compliance policy engine for private, compliant tokenized-dollar distribution on Stellar.",
+  "keywords": ["stellar", "soroban", "compliance", "legal-context-protocol", "sep-10"],
+  "license": "MIT",
+  "author": "Confidia",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Eras256/Confidia.git",
+    "directory": "packages/confidia-sdk"
+  },
+  "homepage": "https://github.com/Eras256/Confidia#readme",
+  "main": "./dist/cjs/src/index.js",
+  "module": "./dist/esm/src/index.js",
+  "types": "./dist/esm/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/esm/src/index.d.ts",
+      "import": "./dist/esm/src/index.js",
+      "require": "./dist/cjs/src/index.js"
+    }
+  },
+  "files": [
+    "dist/esm/src",
+    "dist/cjs/src",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.esm.json && tsc -p tsconfig.cjs.json",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.5",
+    "vitest": "^1.6.0"
+  }
+}