tenzro-wallet 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,128 @@
+# tenzro-wallet
+
+[![npm](https://img.shields.io/npm/v/tenzro-wallet)](https://www.npmjs.com/package/tenzro-wallet)
+[![License](https://img.shields.io/badge/license-Apache--2.0-green)](LICENSE)
+
+The official wallet for [Tenzro Network](https://tenzro.com) — a browser-clean, ESM-only TypeScript engine you embed in your own host (extension, web app, mobile WebView, agent service worker). One identity, four VM surfaces, post-quantum signed, agent-aware.
+
+- **TDIP `did:tenzro:`** — one identity controls native TNZO, EVM contracts, Solana programs, and Canton/DAML assets at the same time.
+- **Passkey-quorum custody** — no seed phrases. Device share + node-TEE co-signer, FROST-signed Ed25519 + ML-DSA-65 (FIPS 204) post-quantum leg.
+- **Cross-VM moves on Tenzro are pointer ops, not bridges.** Native ↔ EVM ↔ SVM go through precompile `0x1003` / the `tenzro_cross_vm` SVM program — instant, no bridge risk.
+- **Agent payments built-in** — AP2 (Google), x402 (Coinbase), Visa TAP, Mastercard Agent Pay, OpenAI ACP, ERC-8004 trustless agent identity, ERC-7802 cross-chain mint/burn.
+- **Six-vendor bridge router** — LI.FI, Chainlink CCIP, LayerZero V2, Wormhole, deBridge, Canton HTLC. The kernel never picks a vendor for you; it surfaces all available quotes.
+
+## Install
+
+```bash
+npm install tenzro-wallet tenzro-sdk
+```
+
+Peer-style dependency: `tenzro-wallet` imports `tenzro-sdk` for RPC + types. Pin both together.
+
+## Quick start
+
+```typescript
+import {
+  WalletKernel,
+  TenzroSdkAdapter,
+  walletNew,
+  buildEip6963Announcement,
+} from 'tenzro-wallet';
+import { TenzroClient, TESTNET_CONFIG } from 'tenzro-sdk';
+
+// 1. Build the SDK adapter (the only file allowed to import tenzro-sdk).
+const sdkClient = new TenzroClient(TESTNET_CONFIG);
+const tenzroPort = TenzroSdkAdapter.fromClient(sdkClient);
+
+// 2. Provision a new wallet — passkey-quorum custody, post-quantum signed.
+const wallet = await walletNew({
+  // … host-supplied custody, identity, and policy ports
+});
+
+// 3. Assemble the kernel and announce on EIP-6963 so dApps discover it.
+const kernel = new WalletKernel({ tenzro: tenzroPort, /* … */ });
+const announcement = buildEip6963Announcement(kernel);
+window.dispatchEvent(new CustomEvent('eip6963:announceProvider', {
+  detail: announcement,
+}));
+```
+
+## Architecture
+
+```
+                  ┌─────────────────────────────┐
+                  │   one TDIP did:tenzro:…     │
+                  │   passkey-quorum custody    │
+                  └──────────────┬──────────────┘
+                                 │
+        ┌────────────┬───────────┼───────────┬────────────┐
+        ▼            ▼           ▼           ▼            ▼
+  Tenzro native  EVM-on-     SVM-on-      Canton/DAML   Bridge to
+  (Ed25519,     Tenzro       Tenzro       MainNet       external
+   18-dec)      (secp256k1,  (Ed25519,    (Canton       chains
+                 18-dec)      9-dec)       external)
+```
+
+Built on a strict **ports + adapters** pattern:
+
+- Wallet core and surfaces only depend on port interfaces.
+- The only files allowed to import `tenzro-sdk` live under `src/ports/*/adapters/`.
+- SDK shape changes break exactly one file.
+
+Six independent surfaces (Tenzro native, EVM-on-Tenzro, SVM-on-Tenzro, Canton internal, Canton external, Canton onboarding) share one identity through TDIP-derived `SurfaceKey`s.
+
+## Modules
+
+| Export | Purpose |
+|--------|---------|
+| `WalletKernel` | Top-level facade — wires surfaces, custody, ports, agent stack. |
+| `walletNew()` / `walletRecover()` | Identity orchestrators — provision a new wallet or recover an existing one through the configured custody quorum. |
+| `TenzroSdkAdapter` | The one allowed `tenzro-sdk` import. Construct from a `TenzroClient` to feed `WalletKernel`. |
+| `buildEip6963Announcement()` | Generate the EIP-6963 announcement payload for `window.tenzro` discovery. |
+| `KernelEip1193Provider` | EIP-1193 `request(method, params)` provider built on top of a `WalletKernel`. |
+| Custody drivers | `frostEd25519Driver`, `frostSecp256k1Driver`, `hybridEd25519MlDsaDriver`, `mlDsaCoordinator`, passkey-share unwrappers (PRF/largeBlob/escrow). |
+| Agent ports | AP2, ACP, ERC-8004, ERC-7802, HTLC escrow, nanopayment channels, agent-bond, insurance, lifecycle, principal-chain, fee estimator, session-key, payment-rails (Visa/Mastercard/x402), TEE attestation. |
+| Bridge adapters | `LiFiBridgeAdapter`, `CcipBridgeAdapter`, `LayerZeroBridgeAdapter`, `WormholeBridgeAdapter`, `DebridgeAdapter`, `CantonBridgeAdapter`. |
+| Surfaces | `tenzroNativeSurface`, `evmOnTenzroSurface`, `svmOnTenzroSurface`, `cantonInternalSurface`, `cantonExternalSurface`, `cantonOnboardingSurface`. |
+| Router | `routeIntent()` — chooses the right surface (or bridge) for an intent and returns a typed plan. |
+| Balance aggregator | `BalanceAggregator` — single-pass cross-surface balance read. |
+| Consent engine | Policy + consent receipts (every privileged action returns a typed receipt). |
+
+## Architectural rules
+
+These are load-bearing and apply to every consumer that extends `tenzro-wallet`:
+
+1. **Ports + adapters.** Surfaces and the kernel only depend on port interfaces. Only `src/ports/*/adapters/` may import `tenzro-sdk`.
+2. **Four surfaces, one identity.** TDIP `did:tenzro:` is the root; each surface has a derived `SurfaceKey` (Ed25519 native, secp256k1 EVM, Ed25519 SVM, Canton external party).
+3. **Cross-VM moves on Tenzro are pointer ops, not bridges.** Pointer ops flow through precompile `0x1003` / the `tenzro_cross_vm` SVM program. Tenzro↔Canton-MainNet and Tenzro↔external chains go through the bridge router.
+4. **Passkey-quorum custody is the default.** No seed phrases. Device share + node-TEE co-signer. Ed25519 leg threshold-signed via FROST; ML-DSA-65 leg supplied by node TEE alone until threshold ML-DSA matures.
+5. **Decimals are not interchangeable.** Native + EVM = 18; SVM = 9; Canton CC = `Numeric 10`. The router surfaces dust-truncation warnings.
+6. **Browser-clean.** No `node:` imports, no `process.env` reads outside integration tests. Web Crypto, `fetch`, `TextEncoder` only.
+
+## Status
+
+Testnet-functional today against the live Tenzro testnet at `rpc.tenzro.network`.
+
+| Milestone | What | State |
+|---|---|---|
+| M1 | Kernel skeleton, ports + adapters | Done |
+| M2 | Tenzro native surface | Done — live on testnet |
+| M3 | EVM + SVM on-Tenzro surfaces, cross-VM pointer ops | Done — live on testnet |
+| M4a | Canton ports + adapters (design + interfaces) | Done |
+| M4b | Canton MainNet surface | Gated on Splice 0.5.x baseline (post-2026-05-05) |
+| M5 | Passkey-quorum custody (kernel pieces) | Done |
+| M5.5 | 2-of-3 pre-launch upgrade | Designed |
+| M6 | `window.tenzro` injection (extension + web embed) | Kernel ready; host scaffolds in repo |
+| M7 | Settlement (Visa TAP, Mastercard Agent Pay, x402) | Ports declared, SDK-pending |
+| M8 | Bridge router (six vendors) | Ports + six adapters shipped, SDK-pending |
+| M9 | TDIP integration (delegate sets, recovery flows) | Kernel orchestrators shipped |
+
+**395 unit tests** pass; 4 env-gated integration smokes exercise the live testnet end-to-end.
+
+## Repository
+
+The full monorepo (apps, browser extension, design docs) lives at [github.com/tenzro/tenzro-wallet](https://github.com/tenzro/tenzro-wallet). The authoritative architecture document is [`docs/DESIGN.md`](https://github.com/tenzro/tenzro-wallet/blob/main/docs/DESIGN.md).
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE).

package/dist/balance/aggregator.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Unified balance aggregator. Group by asset, not by surface — this is the
+ * single most user-visible feature of Tenzro Wallet.
+ *
+ * For Tenzro-on-Tenzro assets (TNZO), one balance is exposed under multiple
+ * surfaces; the aggregator MUST NOT double-count, so the source of truth is the
+ * native balance and the EVM/SVM/canton-internal views just describe how it
+ * surfaces.
+ */
+import type { AssetView, UnifiedBalance } from '../types/asset.js';
+export interface BalanceProvider {
+    /** Per-surface balance fetch — returns AssetViews discovered on that surface. */
+    fetchViews(): Promise<readonly AssetView[]>;
+}
+export declare function aggregateBalances(providers: readonly BalanceProvider[]): Promise<readonly UnifiedBalance[]>;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/balance/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../src/balance/aggregator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAW,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAG5E,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,UAAU,IAAI,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;CAC7C;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,SAAS,eAAe,EAAE,GACpC,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAkBpC"}

package/dist/balance/aggregator.js

@@ -0,0 +1,73 @@
+/**
+ * Unified balance aggregator. Group by asset, not by surface — this is the
+ * single most user-visible feature of Tenzro Wallet.
+ *
+ * For Tenzro-on-Tenzro assets (TNZO), one balance is exposed under multiple
+ * surfaces; the aggregator MUST NOT double-count, so the source of truth is the
+ * native balance and the EVM/SVM/canton-internal views just describe how it
+ * surfaces.
+ */
+import { SURFACE_NATIVE_DECIMALS } from "../types/surface.js";
+export async function aggregateBalances(providers) {
+    const allViews = (await Promise.all(providers.map((p) => p.fetchViews()))).flat();
+    const byAsset = new Map();
+    for (const v of allViews) {
+        const key = assetKey(v.asset);
+        const existing = byAsset.get(key);
+        if (existing)
+            existing.push(v);
+        else
+            byAsset.set(key, [v]);
+    }
+    const out = [];
+    for (const [, views] of byAsset) {
+        const asset = views[0].asset;
+        const total = computeTotal(asset, views);
+        const warnings = computeWarnings(asset, views);
+        out.push({ asset, total, views, warnings });
+    }
+    return out;
+}
+function assetKey(a) {
+    return `${a.scope}/${a.symbol}/${a.nativeId ?? ''}`;
+}
+/**
+ * For tenzro-native assets, all on-Tenzro views are pointers at the same
+ * native balance — return the native view as the total, falling back to the
+ * largest view if no native one is present. For everything else, sum.
+ */
+function computeTotal(asset, views) {
+    if (asset.scope === 'tenzro-native') {
+        const nativeView = views.find((v) => v.surface === 'tenzro-native');
+        if (nativeView)
+            return nativeView.balance;
+        // No native view in this snapshot; trust the canonical-decimal view.
+        let max = 0n;
+        for (const v of views)
+            if (v.balance > max)
+                max = v.balance;
+        return max;
+    }
+    let sum = 0n;
+    for (const v of views)
+        sum += v.balance;
+    return sum;
+}
+function computeWarnings(asset, views) {
+    const w = [];
+    if (asset.scope === 'tenzro-native') {
+        const native = views.find((v) => v.surface === 'tenzro-native')?.balance;
+        const svm = views.find((v) => v.surface === 'svm-on-tenzro')?.balance;
+        if (native !== undefined && svm !== undefined) {
+            // SVM truncates to 9 decimals; sub-9-decimal dust on native won't appear there.
+            const svmDecimals = SURFACE_NATIVE_DECIMALS['svm-on-tenzro'];
+            const div = 10n ** BigInt(asset.decimals - svmDecimals);
+            const truncated = (native / div) * div;
+            if (truncated !== native) {
+                w.push('sub-lamport dust on Tenzro native is not visible to Solana programs');
+            }
+        }
+    }
+    return w;
+}
+//# sourceMappingURL=aggregator.js.map

package/dist/balance/aggregator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.js","sourceRoot":"","sources":["../../src/balance/aggregator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAO9D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqC;IAErC,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;QAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAc,EAAE,KAA2B;IAC/D,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC;QACpE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC,OAAO,CAAC;QAC1C,qEAAqE;QACrE,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAA2B;IAClE,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,EAAE,OAAO,CAAC;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,EAAE,OAAO,CAAC;QACtE,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9C,gFAAgF;YAChF,MAAM,WAAW,GAAG,uBAAuB,CAAC,eAAe,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACvC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,CAAC,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/balance/index.d.ts

@@ -0,0 +1,3 @@
+export { aggregateBalances } from './aggregator.js';
+export type { BalanceProvider } from './aggregator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/balance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/balance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/balance/index.js

@@ -0,0 +1,2 @@
+export { aggregateBalances } from "./aggregator.js";
+//# sourceMappingURL=index.js.map

package/dist/balance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/balance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/consent/index.d.ts

@@ -0,0 +1,3 @@
+export { enforcePolicy, PolicyViolationError } from './policy.js';
+export type { PolicyContext } from './policy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/consent/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/consent/index.js

@@ -0,0 +1,2 @@
+export { enforcePolicy, PolicyViolationError } from "./policy.js";
+//# sourceMappingURL=index.js.map

package/dist/consent/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/consent/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/consent/policy.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Effective-limit enforcement.
+ *
+ * Effective limit = sessionPolicy ∩ delegationScope.
+ * The kernel's `sign()` calls `enforcePolicy` before invoking the surface
+ * module's `sign()`. A policy violation throws — there's no "warn and proceed."
+ */
+import type { Consent, KycTier, SpendingPolicy } from '../types/consent.js';
+import type { Intent } from '../types/intent.js';
+export declare class PolicyViolationError extends Error {
+    constructor(reason: string);
+}
+export interface PolicyContext {
+    /** Identity-level scope set by the user when delegating to this session. */
+    readonly delegationScope?: SpendingPolicy;
+    /** Per-session policy set when the session was opened. */
+    readonly sessionPolicy?: SpendingPolicy;
+    /** Total spend already debited under the active session, in canonical units. */
+    readonly spentSoFarToday?: bigint;
+    /**
+     * Current KYC tier of the signing identity. When `effective.minKycTier`
+     * is set, this must be ≥ that tier. Defaults to `Unverified` when omitted.
+     */
+    readonly signerKycTier?: KycTier;
+}
+export declare function enforcePolicy(intent: Intent, consent: Consent, ctx: PolicyContext): void;
+//# sourceMappingURL=policy.d.ts.map

package/dist/consent/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/consent/policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,MAAM,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC;IACxC,gFAAgF;IAChF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI,CAkCxF"}

package/dist/consent/policy.js

@@ -0,0 +1,121 @@
+/**
+ * Effective-limit enforcement.
+ *
+ * Effective limit = sessionPolicy ∩ delegationScope.
+ * The kernel's `sign()` calls `enforcePolicy` before invoking the surface
+ * module's `sign()`. A policy violation throws — there's no "warn and proceed."
+ */
+import { compareKycTier } from "../types/consent.js";
+export class PolicyViolationError extends Error {
+    constructor(reason) {
+        super(`policy violation: ${reason}`);
+        this.name = 'PolicyViolationError';
+    }
+}
+export function enforcePolicy(intent, consent, ctx) {
+    if (intent.kind !== 'send')
+        return;
+    const effective = intersect(ctx.delegationScope, ctx.sessionPolicy);
+    if (!effective)
+        return;
+    if (effective.expiresAt !== undefined && consent.approvedAt > effective.expiresAt) {
+        throw new PolicyViolationError('session expired');
+    }
+    if (effective.maxPerTx !== undefined && intent.amount > effective.maxPerTx) {
+        throw new PolicyViolationError(`amount exceeds maxPerTx (${effective.maxPerTx})`);
+    }
+    if (effective.maxPerDay !== undefined) {
+        const projected = (ctx.spentSoFarToday ?? 0n) + intent.amount;
+        if (projected > effective.maxPerDay) {
+            throw new PolicyViolationError(`daily cap exceeded (would total ${projected}, cap ${effective.maxPerDay})`);
+        }
+    }
+    if (effective.assetWhitelist && effective.assetWhitelist.length > 0) {
+        const allowed = effective.assetWhitelist.some((a) => a.symbol === intent.asset.symbol && a.scope === intent.asset.scope);
+        if (!allowed)
+            throw new PolicyViolationError(`asset ${intent.asset.symbol} not in whitelist`);
+    }
+    if (effective.minKycTier !== undefined) {
+        const signerTier = ctx.signerKycTier ?? 'Unverified';
+        if (compareKycTier(signerTier, effective.minKycTier) < 0) {
+            throw new PolicyViolationError(`signer KYC tier ${signerTier} is below required ${effective.minKycTier}`);
+        }
+    }
+}
+/**
+ * The intersection is the more-restrictive of any two limits, and the union
+ * (well, intersection) of any whitelists. Undefined means "no limit on this
+ * dimension".
+ */
+function intersect(a, b) {
+    if (!a && !b)
+        return undefined;
+    if (!a)
+        return b;
+    if (!b)
+        return a;
+    const out = {};
+    const maxPerTx = minBigint(a.maxPerTx, b.maxPerTx);
+    if (maxPerTx !== undefined)
+        out.maxPerTx = maxPerTx;
+    const maxPerDay = minBigint(a.maxPerDay, b.maxPerDay);
+    if (maxPerDay !== undefined)
+        out.maxPerDay = maxPerDay;
+    const assets = intersectWhitelist(a.assetWhitelist, b.assetWhitelist);
+    if (assets !== undefined)
+        out.assetWhitelist = assets;
+    const contracts = intersectStringList(a.contractWhitelist, b.contractWhitelist);
+    if (contracts !== undefined)
+        out.contractWhitelist = contracts;
+    const ops = intersectStringList(a.operationWhitelist, b.operationWhitelist);
+    if (ops !== undefined)
+        out.operationWhitelist = ops;
+    const expiresAt = minNumber(a.expiresAt, b.expiresAt);
+    if (expiresAt !== undefined)
+        out.expiresAt = expiresAt;
+    const minKycTier = maxKycTier(a.minKycTier, b.minKycTier);
+    if (minKycTier !== undefined)
+        out.minKycTier = minKycTier;
+    return out;
+}
+/**
+ * Intersection picks the *more restrictive* KYC requirement: when both
+ * sides specify a tier, the higher one wins. Undefined on a side means
+ * "no KYC requirement from this layer".
+ */
+function maxKycTier(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    return compareKycTier(a, b) >= 0 ? a : b;
+}
+function minBigint(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    return a < b ? a : b;
+}
+function minNumber(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    return a < b ? a : b;
+}
+function intersectWhitelist(a, b) {
+    if (!a)
+        return b;
+    if (!b)
+        return a;
+    return a.filter((x) => b.some((y) => y.symbol === x.symbol && y.scope === x.scope));
+}
+function intersectStringList(a, b) {
+    if (!a)
+        return b;
+    if (!b)
+        return a;
+    return a.filter((x) => b.includes(x));
+}
+//# sourceMappingURL=policy.js.map

package/dist/consent/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/consent/policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAc;QACxB,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAgBD,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAgB,EAAE,GAAkB;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IAEnC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,IAAI,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,oBAAoB,CAC5B,mCAAmC,SAAS,SAAS,SAAS,CAAC,SAAS,GAAG,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAC1E,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,UAAU,GAAY,GAAG,CAAC,aAAa,IAAI,YAAY,CAAC;QAC9D,IAAI,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAC5B,mBAAmB,UAAU,sBAAsB,SAAS,CAAC,UAAU,EAAE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,CAA6B,EAC7B,CAA6B;IAE7B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAEjB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACpD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IACvD,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAChF,IAAI,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAC/D,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC5E,IAAI,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC;IACpD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC1D,OAAO,GAAqB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAsB,EAAE,CAAsB;IAChE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,CAAqB,EAAE,CAAqB;IAC7D,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AACD,SAAS,SAAS,CAAC,CAAqB,EAAE,CAAqB;IAC7D,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AACD,SAAS,kBAAkB,CACzB,CAA2B,EAC3B,CAA2B;IAE3B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACtF,CAAC;AACD,SAAS,mBAAmB,CAC1B,CAAgC,EAChC,CAAgC;IAEhC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC"}