Generated from docs/interfaces

Contract interfaces

This page lists the public interfaces exposed by the compliance primitives. The site version is generated from the Markdown files in this directory.

allowlist-token

The wrapper forwards a transfer only when both participants are on the allowlist.

add_to_allowlist(admin, address, expiration_ledger)
is_allowed(address) -> bool
transfer(from, to, amount) -> bool

denylist-gate

A composable gate that other contracts call before moving funds.

add_to_denylist(admin, address)
check(address) -> bool

jurisdiction-flag

Stores issuer-controlled jurisdiction codes and checks permitted code lists.

set_jurisdiction(issuer, address, code)
is_permitted_jurisdiction(address, allowed_codes) -> bool

allowlist-token

A SEP-41-compatible token wrapper that gates transfers against an on-chain allowlist.

| Method | Purpose |

| --- | --- |

| `initialize(admin, token)` | Configure the administrator and underlying token. |

| `add_to_allowlist(admin, address, expiration_ledger: Option<u32>)` | Add an address to the allowlist. With `Some(n)` the entry auto-expires after ledger `n` (valid while sequence `<= n`); `None` never expires. |

| `add_multiple_to_allowlist(admin, addresses, expiration_ledger: Option<u32>)` | Add up to `MAX_BATCH_SIZE` addresses with one optional expiration ledger. |

| `remove_from_allowlist(admin, address)` | Remove an address from the allowlist. |

| `remove_multiple_from_allowlist(admin, addresses)` | Remove up to `MAX_BATCH_SIZE` addresses. |

| `is_allowed(address) -> bool` | Read whether an address is currently allowed. Expired entries read as `false`. |

| `get_allowlist_entry(address) -> Option<AllowlistEntry>` | Read the raw stored entry, including its `expiration_ledger`. |

| `transfer(from, to, amount)` | Transfer only when the compliance policy permits it. |

This is a reference interface; confirm the deployed contract configuration before invoking write methods.

audit-log

An append-only Soroban event log for compliance and governance records.

| Method | Purpose |

| --- | --- |

| `initialize(admin)` | Configure the authorized writer. |

| `record(writer, event_type, subject, data)` | Append a structured audit event. |

| `get_events(subject)` | Read events associated with an address or subject. |

Events are intended for off-chain indexing and on-chain auditability.

circuit-breaker

An emergency control that lets an authorized operator stop and resume protected flows.

| Method | Purpose |

| --- | --- |

| `initialize(admin)` | Configure the administrator. |

| `is_tripped() -> bool` | Read the current breaker state. |

| `trip(admin)` | Enter the emergency-tripped state. |

| `reset(admin)` | Resume normal operation. |

| `upgrade(admin, new_wasm_hash)` | Admin-only. Move the contract code to a new WASM hash; storage is preserved. See the "Upgradeability" section in `contracts/circuit-breaker/src/lib.rs`. |

compliance-aggregator

A composition point for evaluating multiple compliance primitives as one decision.

| Method | Purpose |

| --- | --- |

| `initialize(admin, checks)` | Configure the checks and administrator. |

| `evaluate(from, to) -> bool` | Evaluate the configured policy for a transfer. |

| `get_checks() -> checks` | Inspect configured compliance checks. |

Use the deployed contract’s generated interface for exact enum and address encoding.

denylist-gate

A standalone denylist that other contracts can call before allowing a transfer.

| Method | Purpose |

| --- | --- |

| `initialize(admin)` | Configure the administrator. |

| `add_to_denylist(admin, address)` | Deny an address. |

| `remove_from_denylist(admin, address)` | Clear an address. |

| `check(address) -> bool` | Return whether the address is clear to transact. |

jurisdiction-flag

An issuer-controlled mapping from addresses to jurisdiction codes.

| Method | Purpose |

| --- | --- |

| `initialize(issuer)` | Configure the issuer. |

| `set_jurisdiction(issuer, address, code)` | Set or replace an address jurisdiction. |

| `get_jurisdiction(address)` | Read the current code and expiry state. |

| `is_permitted_jurisdiction(address, allowed_codes) -> bool` | Read whether an address matches an allowed code. |

multisig-admin

M-of-N administrative governance for protected contract actions.

| Method | Purpose |

| --- | --- |

| `initialize(signers, threshold)` | Configure signers and the approval threshold. |

| `propose(action)` | Create a pending administrative proposal. |

| `approve(signer, proposal_id)` | Approve a proposal as an authorized signer. |

| `execute(proposal_id)` | Execute a proposal after the threshold is met. |

| `upgrade(new_wasm_hash)` | Move the contract to a new WASM hash. Requires the M-of-N threshold. |

Upgrade path

`upgrade(new_wasm_hash)` swaps the contract code via

`env.deployer().update_current_contract_wasm`, gated by

`env.current_contract_address().require_auth()` — i.e. the current M-of-N

signer threshold must approve it through `__check_auth`, the same as

`add_signer` or `update_threshold`.

1. Build and upload the new WASM:

`stellar contract upload --wasm target/wasm32v1-none/release/multisig_admin.wasm`

and note the returned hash.

2. Invoke `upgrade --new_wasm_hash <HASH>` on the multisig with authorization

from at least `threshold` signers.

3. Verify with `get_signers` / `get_proposal` that state is intact.

The swap does not touch storage: the signer set, threshold, pending proposals

and the next proposal ID are preserved, and the contract address stays the

same, so every primitive that uses the multisig as its admin keeps working

without reconfiguration. An `Upgraded` event carrying the new WASM hash is

emitted. A future version that changes the storage layout must ship a

migration entrypoint (see [`STORAGE_VERSIONING.md`](../../STORAGE_VERSIONING.md)).

pausable

A shared helper crate used by contracts that need an emergency pause flag. It is a library component, not a standalone deployable contract.

| Method | Purpose |

| --- | --- |

| `is_paused()` | Read the contract-local pause state. |

| `pause(admin)` | Set the pause flag after authorization by the host contract. |

| `unpause(admin)` | Clear the pause flag after authorization by the host contract. |

| `require_not_paused()` | Return the host contract’s pause error when the flag is set. |

policy-engine

A configurable policy composition contract that evaluates denylist and jurisdiction checks together.

| Method | Purpose |

| --- | --- |

| `initialize(admin, combine_op)` | Initialize governance and combine semantics. |

| `propose_upgrade(admin, new_wasm, delay_ledgers)` | Propose an upgrade that is installable after the ledger delay. |

| `commit_upgrade(admin)` | Install the pending upgrade after its delay. |

| `cancel_upgrade(admin)` | Cancel a pending upgrade. |

| `add_check(admin, check)` | Add a configured compliance check. |

| `remove_check(admin, index)` | Remove a configured check. |

| `evaluate(from, to) -> bool` | Return the combined policy decision. |

| `get_checks()` | Read the configured checks. |

| `get_op()` | Read whether checks are combined with all/any semantics. |