[SEM-5] Add Policy Enforcement to WDK Core

README.md

@@ -85,6 +85,7 @@ constructor(seed: string | Uint8Array)
 - `registerWallet<W>(blockchain: string, wallet: W, config: WalletConfig): WDK`
 - `registerProtocol<P>(blockchain: string, label: string, protocol: P, config: ProtocolConfig): WDK`
 - `registerMiddleware(blockchain: string, middleware: MiddlewareFunction): WDK`
+- `registerPolicies(policies: Array<Policy>): WDK`
 
 #### Get Accounts
 - `getAccount(blockchain: string, index?: number): Promise<IWalletAccountWithProtocols>`
@@ -136,6 +137,93 @@ wdk.registerMiddleware('ethereum', async (account) => {
 })
 ```
 
+### Register Policies
+
+```typescript
+wdk.registerPolicies([
+  {
+    name: 'max-transfer-1eth',
+    method: 'sendTransaction',
+    evaluate({ method, params }) {
+      if (method !== 'sendTransaction') return true
+      return BigInt(params.value ?? 0) <= 10n ** 18n
+    }
+  }
+])
+```
+
+### Wallet-Specific Policy
+
+```typescript
+wdk.registerPolicies([
+  {
+    name: 'ethereum-only-bridge',
+    target: { blockchain: 'ethereum' },
+    method: 'bridge',
+    evaluate: () => false
+  }
+])
+```
+
+### Protocol-Targeted Policy
+
+```typescript
+wdk.registerPolicies([
+  {
+    name: 'swap-max-fee',
+    target: {
+      protocol: { blockchain: 'ethereum', label: 'paraswap' }
+    },
+    method: 'swap',
+    evaluate: () => false
+  }
+])
+```
+
+### Multiple Methods
+
+```typescript
+wdk.registerPolicies([
+  {
+    name: 'disable-critical-ops',
+    target: { blockchain: 'ethereum' },
+    method: ['bridge', 'stake', 'unstake'],
+    evaluate: () => false
+  }
+])
+```
+
+### Recipient Whitelist
+
+```typescript
+const allowed = new Set(['0xabc...', '0xdef...'])
+
+wdk.registerPolicies([
+  {
+    name: 'recipient-whitelist',
+    method: 'sendTransaction',
+    evaluate({ params }) {
+      if (!params?.to) return true
+      return allowed.has(params.to.toLowerCase())
+    }
+  }
+])
+```
+
+### Async Policy
+
+```typescript
+wdk.registerPolicies([
+  {
+    name: 'business-hours',
+    async evaluate() {
+      const hour = new Date().getUTCHours()
+      return hour >= 8 && hour < 18
+    }
+  }
+])
+```
+
 ## License
 
 This project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.
@@ -150,4 +238,4 @@ For support, please open an issue on the GitHub repository.
 
 ## Learn More
 
-For full docs, visit [docs.wallet.tether.io](https://docs.wallet.tether.io)
+For full docs, visit [docs.wallet.tether.io](https://docs.wallet.tether.io)

index.js

@@ -21,3 +21,4 @@
 /** @typedef {import('./src/wallet-account-with-protocols.js').IWalletAccountWithProtocols} IWalletAccountWithProtocols */
 
 export { default } from './src/wdk-manager.js'
+export { PolicyViolationError } from './src/errors'

src/errors/PolicyViolationError.js

@@ -0,0 +1,31 @@
+/** @typedef {import('../wdk-manager.js').PolicyTarget} PolicyTarget */
+
+/**
+ * Error thrown when a registered policy rejects an operation.
+ */
+export class PolicyViolationError extends Error {
+  /**
+   * @param {string} policyName
+   * @param {string} method
+   * @param {PolicyTarget} target
+   */
+  constructor (policyName, method, target = {}) {
+    const targetDesc = target.wallet
+      ? `wallet: ${target.wallet}`
+      : target.protocol
+        ? `protocol: ${JSON.stringify(target.protocol)}`
+        : 'global'
+
+    super(
+      `Policy "${policyName}" rejected method "${method}" for ${targetDesc}`
+    )
+
+    this.name = 'PolicyViolationError'
+    /** @type {string} */
+    this.policy = policyName
+    /** @type {string} */
+    this.method = method
+    /** @type {Object} */
+    this.target = target
+  }
+}

src/errors/index.js

@@ -0,0 +1 @@
+export { PolicyViolationError } from './PolicyViolationError.js'