Compliance Without Identity Exposure: Prove Eligibility, Reveal Nothing

import { H33Client, ComplianceSession, ZkProof } from '@h33/agent';

const h33 = new H33Client({
  apiKey: process.env.H33_API_KEY,
  endpoint: 'https://api.h33.ai/v1',
});

// Start a compliance session
const session: ComplianceSession = await h33.compliance.startSession({
  purpose: 'onboarding-verification',
  requiredChecks: ['kyc', 'ofac', 'accredited-investor', 'jurisdiction'],
});

// Step 1: Generate ZK proof of KYC status
const kycProof: ZkProof = await h33.compliance.proveKyc({
  sessionId: session.id,
  credential: userKycCredential,    // issued by verified identity provider
  circuit: 'ProofOfKycAir',         // STARK-based KYC circuit
});

console.log(`KYC proof generated`);
console.log(`  Valid: ${kycProof.valid}`);
console.log(`  Reveals: boolean (passed/failed) -- nothing else`);
console.log(`  Proof size: ${kycProof.proofSize} bytes`);

// Step 2: OFAC screening on encrypted identity
const ofacResult = await h33.compliance.screenOfac({
  sessionId: session.id,
  encryptedIdentity: userEncryptedIdentity,  // BFV-encrypted
  encryption: {
    scheme: 'bfv',
    profile: 'h33-128',
  },
});

console.log(`OFAC screening complete`);
console.log(`  Cleared: ${ofacResult.cleared}`);
console.log(`  Identity decrypted: never`);
console.log(`  Watchlist version: ${ofacResult.watchlistVersion}`);

// Step 3: Accredited investor ZK range proof
const investorProof: ZkProof = await h33.compliance.proveAccreditedInvestor({
  sessionId: session.id,
  credential: userFinancialCredential,
  threshold: 1_000_000_00,          // $1,000,000 in cents
  circuit: 'RangeProofAir',         // STARK-based range proof
});

console.log(`Accredited investor proof generated`);
console.log(`  Threshold met: ${investorProof.valid}`);
console.log(`  Actual net worth revealed: no`);

// Step 4: Jurisdiction proof (country only)
const jurisdictionProof: ZkProof = await h33.compliance.proveJurisdiction({
  sessionId: session.id,
  credential: userResidenceCredential,
  output: 'country-code-only',      // reveals country, hides address
});

console.log(`Jurisdiction proof generated`);
console.log(`  Country: ${jurisdictionProof.output.countryCode}`);
console.log(`  Address revealed: no`);

// Step 5: Close session and get attested receipt
const receipt = await session.close();

console.log(`Compliance session complete`);
console.log(`  All checks passed: ${receipt.allPassed}`);
console.log(`  H33-74 bundle: ${receipt.attestation.bundleSize} bytes`);
console.log(`  PQ families: ${receipt.attestation.families.join(', ')}`);
console.log(`  Replay-deterministic: ${receipt.replayDeterministic}`);
console.log(`  Personal data stored: none`);

# Regulator replays compliance session at a specific timestamp
curl -X POST https://api.h33.ai/v1/replay/session \
  -H "Content-Type: application/json" \
  -d '{
    "receipt": "compliance-receipt.json",
    "at": "2026-05-01T00:00:00Z",
    "iterations": 1
  }'

# Verify individual compliance proofs
curl -X POST https://api.h33.ai/v1/verify/receipt \
  -H "Content-Type: application/json" \
  -d @compliance-receipt.json