sardis 0.3.0__tar.gz

sardis-0.3.0/.dockerignore

@@ -0,0 +1,15 @@
+node_modules
+.git
+.env
+*.pyc
+__pycache__
+.pytest_cache
+.mypy_cache
+dist
+build
+.next
+landing/node_modules
+dashboard/node_modules
+demos/*/node_modules
+*.egg-info
+.venv

sardis-0.3.0/.env.example

@@ -0,0 +1,147 @@
+# =============================================================================
+# Sardis Environment Configuration
+# =============================================================================
+# Copy this file to .env and fill in the values.
+# NEVER commit .env to version control!
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Environment
+# -----------------------------------------------------------------------------
+# Options: dev, sandbox, prod
+SARDIS_ENVIRONMENT=dev
+
+# -----------------------------------------------------------------------------
+# Database (Required for production)
+# -----------------------------------------------------------------------------
+# PostgreSQL connection string (Neon, Supabase, or self-hosted)
+# Example: postgresql://user:password@ep-xxx.us-east-2.aws.neon.tech/sardis?sslmode=require
+DATABASE_URL=postgresql://localhost:5432/sardis
+
+# Legacy config (uses DATABASE_URL if not set)
+# SARDIS_DATABASE_URL=postgresql://localhost:5432/sardis
+
+# -----------------------------------------------------------------------------
+# Security (Required for production)
+# -----------------------------------------------------------------------------
+# Generate with: python -c "import secrets; print(secrets.token_urlsafe(32))"
+SARDIS_SECRET_KEY=change-me-generate-with-python-secrets-token-urlsafe-32
+
+# JWT signing secret for dashboard/admin sessions (HS256)
+# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+JWT_SECRET_KEY=
+# JWT_EXPIRATION_HOURS=24
+
+# Admin password (change in production!)
+SARDIS_ADMIN_PASSWORD=
+
+# -----------------------------------------------------------------------------
+# CORS - Allowed Origins
+# -----------------------------------------------------------------------------
+# Comma-separated list of allowed origins for CORS
+# Example: https://sardis.network,https://dashboard.sardis.network
+SARDIS_ALLOWED_ORIGINS=http://localhost:3005,http://localhost:5173
+
+# -----------------------------------------------------------------------------
+# API Configuration
+# -----------------------------------------------------------------------------
+SARDIS_API_HOST=0.0.0.0
+SARDIS_API_PORT=8000
+SARDIS_API_BASE_URL=http://localhost:8000
+
+# -----------------------------------------------------------------------------
+# Chain Configuration
+# -----------------------------------------------------------------------------
+# Options: simulated, live
+SARDIS_CHAIN_MODE=simulated
+
+# Blockchain RPC endpoints (testnet defaults)
+SARDIS_BASE_RPC_URL=https://sepolia.base.org
+SARDIS_POLYGON_RPC_URL=https://rpc-amoy.polygon.technology
+SARDIS_ETHEREUM_RPC_URL=https://rpc.sepolia.org
+
+# -----------------------------------------------------------------------------
+# MPC Provider (Required for live chain mode)
+# -----------------------------------------------------------------------------
+# Options: turnkey, fireblocks, simulated
+SARDIS_MPC__NAME=simulated
+SARDIS_MPC__API_BASE=https://api.turnkey.com
+SARDIS_MPC__CREDENTIAL_ID=
+
+# Turnkey MPC Configuration (required if MPC__NAME=turnkey)
+# Get these from your Turnkey dashboard
+TURNKEY_API_PUBLIC_KEY=
+TURNKEY_API_PRIVATE_KEY=
+TURNKEY_ORGANIZATION_ID=
+
+# Fireblocks Configuration (required if MPC__NAME=fireblocks)
+# FIREBLOCKS_API_KEY=
+# FIREBLOCKS_API_SECRET_PATH=
+# FIREBLOCKS_VAULT_ID=
+
+# -----------------------------------------------------------------------------
+# Redis/Upstash (Required for production)
+# -----------------------------------------------------------------------------
+# Redis URL for caching, idempotency, webhook replay protection, and JWT revocation
+# Upstash example: rediss://default:xxx@xxx.upstash.io:6379
+# Local Redis: redis://localhost:6379
+SARDIS_REDIS_URL=
+
+# -----------------------------------------------------------------------------
+# Rate Limiting (Optional - uses Upstash Redis)
+# -----------------------------------------------------------------------------
+# UPSTASH_REDIS_URL=redis://default:xxx@xxx.upstash.io:6379
+
+# -----------------------------------------------------------------------------
+# External Integrations (Optional)
+# -----------------------------------------------------------------------------
+# OpenAI API key for AI agent features
+# SARDIS_OPENAI_API_KEY=
+
+# Webhook signing secret
+# SARDIS_WEBHOOK_SECRET=
+
+# -----------------------------------------------------------------------------
+# Smart Contract Addresses (Optional - for live mode)
+# -----------------------------------------------------------------------------
+# SARDIS_WALLET_FACTORY_BASE=0x...
+# SARDIS_WALLET_FACTORY_POLYGON=0x...
+# SARDIS_ESCROW_BASE=0x...
+# SARDIS_ESCROW_POLYGON=0x...
+
+# -----------------------------------------------------------------------------
+# Compliance Providers (Optional - for production)
+# -----------------------------------------------------------------------------
+# Persona KYC
+# PERSONA_API_KEY=
+
+# Elliptic sanctions screening
+# ELLIPTIC_API_KEY=
+
+# -----------------------------------------------------------------------------
+# Fiat Ramp (Optional - for on/off-ramp)
+# -----------------------------------------------------------------------------
+# Onramper widget integration (fiat → crypto)
+# ONRAMPER_API_KEY=
+# ONRAMPER_WEBHOOK_SECRET=
+
+# Bridge.xyz off-ramp (crypto → fiat)
+# BRIDGE_API_KEY=
+# BRIDGE_API_SECRET=
+
+# Lithic funding account for card top-ups via offramp
+# LITHIC_FUNDING_ACCOUNT_ID=
+
+# -----------------------------------------------------------------------------
+# Virtual Cards (Optional)
+# -----------------------------------------------------------------------------
+# Set to "1" or "true" to enable card endpoints
+# SARDIS_ENABLE_CARDS=false
+# LITHIC_API_KEY=
+# LITHIC_WEBHOOK_SECRET=
+
+# -----------------------------------------------------------------------------
+# Monitoring (Optional)
+# -----------------------------------------------------------------------------
+# DATADOG_API_KEY=
+# SENTRY_DSN=

sardis-0.3.0/.github/dependabot.yml

@@ -0,0 +1,175 @@
+# Dependabot configuration for automated dependency updates
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+
+updates:
+  # Python dependencies (uv)
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 10
+    reviewers:
+      - "sardis-maintainers"
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "fix(deps)"
+      include: "scope"
+    groups:
+      python-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Sardis MCP Server (TypeScript)
+  - package-ecosystem: "npm"
+    directory: "/packages/sardis-mcp-server"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "sardis-maintainers"
+    labels:
+      - "dependencies"
+      - "typescript"
+      - "mcp-server"
+    commit-message:
+      prefix: "fix(deps)"
+      include: "scope"
+    groups:
+      mcp-server-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # Ignore major version updates for stability
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  # Sardis SDK JS
+  - package-ecosystem: "npm"
+    directory: "/packages/sardis-sdk-js"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "sardis-maintainers"
+    labels:
+      - "dependencies"
+      - "typescript"
+      - "sdk"
+    commit-message:
+      prefix: "fix(deps)"
+      include: "scope"
+    groups:
+      sdk-js-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Landing page
+  - package-ecosystem: "npm"
+    directory: "/landing"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "sardis-maintainers"
+    labels:
+      - "dependencies"
+      - "frontend"
+      - "landing"
+    commit-message:
+      prefix: "fix(deps)"
+      include: "scope"
+    groups:
+      landing-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Dashboard
+  - package-ecosystem: "npm"
+    directory: "/dashboard"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "sardis-maintainers"
+    labels:
+      - "dependencies"
+      - "frontend"
+      - "dashboard"
+    commit-message:
+      prefix: "fix(deps)"
+      include: "scope"
+    groups:
+      dashboard-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "sardis-maintainers"
+    labels:
+      - "dependencies"
+      - "github-actions"
+      - "ci"
+    commit-message:
+      prefix: "ci(deps)"
+      include: "scope"
+
+  # Docker (if using Docker)
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 3
+    reviewers:
+      - "sardis-maintainers"
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "fix(deps)"
+      include: "scope"
+
+# Security-focused settings
+# Dependabot will automatically:
+# - Create PRs for security updates immediately (not just weekly)
+# - Prioritize security updates over regular updates
+# - Group minor/patch updates to reduce PR noise
+# - Auto-merge patch updates (if auto-merge is enabled in repo settings)

sardis-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,330 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+env:
+  PYTHON_VERSION: "3.12"
+  NODE_VERSION: "20"
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v6
+      
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      
+      - name: Install linting tools
+        run: |
+          pip install ruff mypy
+      
+      - name: Run Ruff
+        run: ruff check api sardis packages scripts tests --exit-zero
+
+      - name: Run Ruff format check
+        run: ruff format --check api sardis packages scripts tests || true
+
+      - name: Run mypy type checking
+        run: |
+          mypy packages/sardis-core/src \
+               packages/sardis-api/src \
+               packages/sardis-chain/src \
+               packages/sardis-wallet/src \
+               packages/sardis-protocol/src \
+               packages/sardis-compliance/src \
+               packages/sardis-cards/src \
+               packages/sardis-ramp/src \
+               --ignore-missing-imports \
+               --no-strict-optional \
+               --warn-unused-ignores \
+               --show-error-codes \
+               || echo "mypy found type issues - please fix"
+
+      - name: Strict lint for protocol packages
+        run: |
+          ruff check packages/sardis-protocol/src packages/sardis-ucp/src
+
+      - name: Strict format check for protocol packages
+        run: |
+          ruff format --check packages/sardis-protocol/src packages/sardis-ucp/src
+
+  test-python:
+    name: Test Python
+    runs-on: ubuntu-latest
+    
+    steps:
+      - uses: actions/checkout@v6
+      
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      
+      - name: Install dependencies
+        run: |
+          pip install -e packages/sardis-core
+          pip install -e packages/sardis-protocol
+          pip install -e packages/sardis-wallet
+          pip install -e packages/sardis-chain
+          pip install -e packages/sardis-ledger
+          pip install -e packages/sardis-compliance
+          pip install -e packages/sardis-api
+          pip install pytest pytest-asyncio pytest-cov httpx
+      
+      - name: Run tests
+        env:
+          SARDIS_SECRET_KEY: test-secret-key-for-ci-only-32chars
+          SARDIS_ENVIRONMENT: dev
+        run: |
+          pytest tests/ -v \
+            --ignore=tests/e2e \
+            --ignore=tests/integration \
+            --ignore-glob='*e2e*' \
+            --ignore-glob='*real*' \
+            --cov=sardis_v2_core --cov=sardis_api --cov=sardis_chain \
+            --cov-report=xml --cov-report=term-missing
+      
+      - name: Enforce coverage threshold
+        run: |
+          coverage report --fail-under=40
+      
+      - name: Upload coverage
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false
+
+  protocol-conformance:
+    name: Protocol Conformance
+    runs-on: ubuntu-latest
+    needs: [test-python]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install dependencies
+        run: |
+          pip install -e packages/sardis-core
+          pip install -e packages/sardis-protocol
+          pip install -e packages/sardis-ucp
+          pip install -e packages/sardis-wallet
+          pip install -e packages/sardis-chain
+          pip install -e packages/sardis-ledger
+          pip install -e packages/sardis-compliance
+          pip install -e packages/sardis-api
+          pip install pytest pytest-asyncio pytest-cov pytest-json-report httpx
+
+      - name: Run protocol conformance tests
+        env:
+          SARDIS_SECRET_KEY: test-secret-key-for-ci-only-32chars
+          SARDIS_ENVIRONMENT: dev
+        run: |
+          pytest -m protocol_conformance tests/ \
+            --ignore=tests/integration \
+            --ignore=tests/e2e \
+            --strict-markers \
+            -v --tb=short \
+            --cov=sardis_protocol --cov=sardis_ucp \
+            --cov-report=xml --cov-report=term-missing \
+            --json-report --json-report-file=protocol-report.json
+          (
+            cd packages/sardis-ucp
+            PYTHONPATH=src pytest -q tests
+          )
+
+      - name: Enforce protocol coverage threshold
+        run: |
+          coverage report --fail-under=60
+
+  test-typescript-sdk:
+    name: Test TypeScript SDK
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Run tests
+        working-directory: packages/sardis-sdk-js
+        run: pnpm test
+
+      - name: Build
+        working-directory: packages/sardis-sdk-js
+        run: pnpm run build
+
+  test-python-sdk:
+    name: Test Python SDK
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install dependencies
+        working-directory: packages/sardis-sdk-python
+        run: |
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        working-directory: packages/sardis-sdk-python
+        run: pytest --cov=sardis_sdk --cov-report=term-missing
+
+  test-mcp-server:
+    name: Test MCP Server
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Run tests
+        working-directory: packages/sardis-mcp-server
+        run: pnpm test
+
+      - name: Build
+        working-directory: packages/sardis-mcp-server
+        run: pnpm run build
+
+  test-ai-sdk:
+    name: Test AI SDK
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Run tests
+        working-directory: packages/sardis-ai-sdk
+        run: pnpm test
+
+      - name: Build
+        working-directory: packages/sardis-ai-sdk
+        run: pnpm run build
+
+  build-landing:
+    name: Build Landing Page
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Build
+        working-directory: landing
+        run: pnpm run build
+
+  test-dashboard:
+    name: Test Dashboard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Type check
+        working-directory: dashboard
+        run: pnpm run typecheck
+
+      - name: Build
+        working-directory: dashboard
+        run: pnpm run build
+        env:
+          VITE_API_URL: http://localhost:8000
+
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      
+      - name: Install safety
+        run: pip install safety
+      
+      - name: Check for vulnerabilities
+        run: safety check -r requirements.txt
+      
+      - name: Check for secrets
+        uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          head: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          extra_args: --only-verified