@mooring-live/x402-client 0.0.0-stage → 0.1.0

package/dist/scheme.js

@@ -0,0 +1,220 @@
+import { Address, contract, nativeToScVal, rpc } from "@stellar/stellar-sdk";
+import { findDefaultAsset, getNetworkPassphrase, getRpcUrl, validateStellarAssetAddress, validateStellarDestinationAddress, } from "@x402/stellar";
+import { CARD_ERROR_CODES, CardPolicyDenied, PaymentError, classifyContractError } from "./denial.js";
+import { signCardAuthEntries } from "./signer.js";
+/**
+ * Seconds per ledger assumed when turning `maxTimeoutSeconds` into an auth
+ * expiration. Deliberately slower than `@x402/stellar`'s 5 s constant: the
+ * facilitator derives its own ceiling from a Horizon sample, and a slower
+ * ledger makes that ceiling *smaller*. Assuming 6 s keeps the client below it.
+ */
+const CONSERVATIVE_LEDGER_SECONDS = 6;
+/** Ledgers subtracted from (and floored at) the derived expiration. */
+const LEDGER_MARGIN = 2;
+/**
+ * How far ahead the card's auth entry may be valid.
+ *
+ * The facilitator computes `maxLedger = currentLedger + ceil(maxTimeoutSeconds
+ * / estimatedLedgerSeconds)` and rejects an entry more than 2 ledgers beyond
+ * it (`invalid_exact_stellar_signature_expiration_too_far`). Its estimate is
+ * sampled from Horizon, so it can be slower than the 5 s the stock client
+ * assumes — on pubnet it usually is. Aiming low costs nothing: the expiry only
+ * has to outlive settlement, and a shorter one is never rejected.
+ */
+export function authExpirationLedgers(maxTimeoutSeconds) {
+    return Math.max(LEDGER_MARGIN, Math.ceil(maxTimeoutSeconds / CONSERVATIVE_LEDGER_SECONDS) - LEDGER_MARGIN);
+}
+/**
+ * x402 "exact" scheme client whose payer is a Mooring card (a Soroban custom
+ * account). It produces exactly the same payload as `@x402/stellar`'s
+ * `ExactStellarScheme` — one `invokeHostFunction` calling
+ * `asset.transfer(card, payTo, amount)`, re-simulated after signing, returned
+ * as a base64 transaction envelope. Only the signing differs: the card's auth
+ * entries are signed by the agent key through `signCardAuthEntries`, so
+ * `__check_auth` enforces the budget, allowlist and expiry at settlement.
+ */
+export class CardExactStellarScheme {
+    scheme = "exact";
+    findDefaultAsset = findDefaultAsset;
+    card;
+    agent;
+    network;
+    rpcUrl;
+    passphrase;
+    onDenial;
+    onPaymentError;
+    constructor(opts) {
+        this.card = opts.card;
+        this.agent = opts.agent;
+        this.network = opts.network;
+        this.onDenial = opts.onDenial;
+        this.onPaymentError = opts.onPaymentError;
+        this.rpcUrl = getRpcUrl(opts.network, opts.rpcUrl ? { url: opts.rpcUrl } : undefined);
+        this.passphrase = getNetworkPassphrase(opts.network);
+    }
+    /** Throws unless the requirements are an `exact` payment this client can make. */
+    validateRequirements(req) {
+        if (req.scheme !== "exact")
+            throw new Error(`Unsupported scheme: ${req.scheme}`);
+        if (req.network !== this.network) {
+            throw new Error(`Unsupported network: ${req.network} (client is ${this.network})`);
+        }
+        if (!validateStellarDestinationAddress(req.payTo)) {
+            throw new Error(`Invalid Stellar destination address: ${req.payTo}`);
+        }
+        if (!validateStellarAssetAddress(req.asset)) {
+            throw new Error(`Invalid Stellar asset address: ${req.asset}`);
+        }
+        if (!/^\d+$/.test(req.amount) || BigInt(req.amount) <= 0n) {
+            throw new Error(`Invalid amount: ${req.amount}. Amount must be a positive integer.`);
+        }
+        if (req.extra?.areFeesSponsored !== true) {
+            throw new Error("Exact scheme requires areFeesSponsored to be true");
+        }
+    }
+    async createPaymentPayload(x402Version, req) {
+        this.validateRequirements(req);
+        const tx = await this.buildTransfer(req.asset, this.card, req.payTo, BigInt(req.amount));
+        this.assertLegacyCardCredentials(tx);
+        const pending = tx.needsNonInvokerSigningBy();
+        if (!pending.includes(this.card) || pending.length > 1) {
+            throw new Error(`Expected to sign with [${this.card}], but got [${pending.join(", ")}]`);
+        }
+        // The stock client samples Horizon for the real ledger close time; this
+        // avoids that dependency by assuming a slower ledger than it would find,
+        // which is the safe direction (see `authExpirationLedgers`).
+        const maxLedger = (await this.latestLedger()) + authExpirationLedgers(req.maxTimeoutSeconds);
+        await this.sign(tx, maxLedger);
+        // Re-simulate so the transaction carries the signed auth entries and the
+        // resources they cost. Signed entries make this simulation *enforcing*:
+        // the card's `__check_auth` runs, so a payment its policy refuses fails
+        // here — before the facilitator, and before any fee is paid.
+        try {
+            await tx.simulate({ useUpgradedAuth: false });
+            assertSimulationOk(tx.simulation);
+        }
+        catch (err) {
+            const denial = this.denialFromCard(err);
+            if (!denial)
+                throw err;
+            this.onDenial?.(denial);
+            throw denial;
+        }
+        const still = tx.needsNonInvokerSigningBy();
+        if (still.length > 0) {
+            throw new Error(`unexpected signer(s) required: [${still.join(", ")}]`);
+        }
+        return { x402Version, payload: { transaction: tx.built.toXDR() } };
+    }
+    /**
+     * Turns a failed enforcing simulation into a typed denial when it was the
+     * card's `__check_auth` that said no.
+     *
+     * The card's address alone is not evidence: it appears in the `transfer`
+     * arguments of every diagnostic this transaction can produce, and the token's
+     * own error codes overlap the card's 1–8 range — a SAC balance error would be
+     * read as a policy decision. What identifies an auth failure is the host's
+     * phrase, which names the failing account and its error together:
+     *
+     *   ["failed account authentication with error", <card>, Error(Contract, #N)]
+     *
+     * so the reason is taken from that fragment and nowhere else. Anything that
+     * does not match stays an ordinary error.
+     */
+    denialFromCard(err) {
+        const text = err instanceof Error ? err.message : String(err);
+        const fragment = new RegExp(`failed account authentication with error"?,\\s*${this.card}\\s*,[^\\]]*`).exec(text);
+        if (!fragment)
+            return null;
+        const parsed = classifyContractError(fragment[0]);
+        if (!parsed || !(parsed.code in CARD_ERROR_CODES))
+            return null;
+        return new CardPolicyDenied(parsed.reason, "simulate", {
+            contractError: parsed.code,
+            detail: text.split("\n")[0],
+        });
+    }
+    /**
+     * Refuses to build a payment whose card auth entry the deployed facilitator
+     * cannot decode.
+     *
+     * `buildTransfer` asks the RPC to record legacy v1 `ADDRESS` credentials
+     * (`useUpgradedAuth: false`) because OZ Channels rejects CAP-71 `ADDRESS_V2`
+     * as `invalid_exact_stellar_payload_malformed`. That flag is transitional —
+     * it becomes a no-op from protocol 28 — and an RPC or SDK that ignores it
+     * would otherwise produce a payload that is signed, sent and refused with a
+     * reason that says nothing about why. This checks what was actually
+     * recorded, and fails before the agent key signs anything.
+     */
+    assertLegacyCardCredentials(tx) {
+        const op = tx.built?.operations?.[0];
+        for (const entry of op?.auth ?? []) {
+            const credentials = entry.credentials;
+            if (credentials.type !== "sorobanCredentialsAddressV2")
+                continue;
+            if (Address.fromScAddress(credentials.value.address).toString() !== this.card)
+                continue;
+            const error = new PaymentError({
+                kind: "rejected",
+                detail: "RPC returned CAP-71 ADDRESS_V2 credentials; the deployed OZ Channels " +
+                    "facilitator rejects them (see docs/x402-integration.md, CAP-71 note)",
+            });
+            this.onPaymentError?.(error);
+            throw error;
+        }
+    }
+    // --- collaborators (protected so tests can stub them) ---
+    /** Builds and simulates `asset.transfer(from, to, amount)` (SEP-41). */
+    async buildTransfer(asset, from, to, amount) {
+        const tx = await contract.AssembledTransaction.build({
+            contractId: asset,
+            method: "transfer",
+            args: [
+                nativeToScVal(Address.fromString(from), { type: "address" }),
+                nativeToScVal(Address.fromString(to), { type: "address" }),
+                nativeToScVal(amount, { type: "i128" }),
+            ],
+            networkPassphrase: this.passphrase,
+            rpcUrl: this.rpcUrl,
+            parseResultXdr: (r) => r,
+            // Record legacy (v1) address credentials rather than the CAP-71 v2 ones
+            // stellar-sdk 17 asks for by default. Measured 2026-09-12 against OZ
+            // Channels testnet: a v2 payload is rejected as
+            // `invalid_exact_stellar_payload_malformed`, the identical v1 payload
+            // verifies. The `@x402/stellar` JS library does understand v2, so the
+            // refusal comes from somewhere else in the deployed facilitator stack —
+            // most likely a Rust `stellar-xdr` decoder, since `stellar xdr decode`
+            // (CLI 26.1.0) also fails on a v2 envelope. Both formats are valid
+            // on-chain and carry the same agent signature; only the signed preimage
+            // differs (v2 binds the address). Drop this once OZ Channels accepts
+            // ADDRESS_V2 — and note the SDK flag is transitional: it becomes a no-op
+            // in protocol 28, so that has to happen first.
+            useUpgradedAuth: false,
+        });
+        assertSimulationOk(tx.simulation);
+        return tx;
+    }
+    /** Signs the card's auth entries with the agent key. */
+    async sign(tx, expirationLedger) {
+        await signCardAuthEntries(tx, this.card, this.agent, expirationLedger);
+    }
+    /** Current ledger sequence, used as the auth-entry expiration base. */
+    async latestLedger() {
+        const server = new rpc.Server(this.rpcUrl, {
+            allowHttp: this.network === "stellar:testnet",
+        });
+        return (await server.getLatestLedger()).sequence;
+    }
+}
+/** Throws unless a simulation succeeded outright (no error, no restore). */
+function assertSimulationOk(sim) {
+    if (!sim)
+        throw new Error("Stellar simulation result is undefined");
+    if (rpc.Api.isSimulationError(sim)) {
+        throw new Error(`Stellar simulation failed${sim.error ? `: ${sim.error}` : ""}`);
+    }
+    if (rpc.Api.isSimulationRestore(sim)) {
+        throw new Error("Stellar simulation requires a ledger entry restore");
+    }
+}
+//# sourceMappingURL=scheme.js.map

package/dist/scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheme.js","sourceRoot":"","sources":["../src/scheme.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAW,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAO,MAAM,sBAAsB,CAAC;AAM3F,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,SAAS,EACT,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIlD;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,uEAAuE;AACvE,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,iBAAyB;IAC7D,OAAO,IAAI,CAAC,GAAG,CACb,aAAa,EACb,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,2BAA2B,CAAC,GAAG,aAAa,CAC3E,CAAC;AACJ,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IACxB,MAAM,GAAG,OAAO,CAAC;IACjB,gBAAgB,GAAG,gBAAgB,CAAC;IAC5B,IAAI,CAAS;IACb,KAAK,CAAU;IACf,OAAO,CAAiB;IACxB,MAAM,CAAS;IACf,UAAU,CAAS;IACnB,QAAQ,CAAsC;IAC9C,cAAc,CAAiC;IAEhE,YAAY,IAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,kFAAkF;IAClF,oBAAoB,CAAC,GAAwB;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,eAAe,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,sCAAsC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,WAAmB,EACnB,GAAwB;QAExB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,EAAE,CAAC,wBAAwB,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAE/B,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,kBAAkB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,CAAC;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,wBAAwB,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,cAAc,CAAC,GAAY;QACjC,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,kDAAkD,IAAI,CAAC,IAAI,cAAc,CAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE;YACrD,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACK,2BAA2B,CAAC,EAA0C;QAC5E,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAEtB,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YACtC,IAAI,WAAW,CAAC,IAAI,KAAK,6BAA6B;gBAAE,SAAS;YACjE,IAAI,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,IAAI;gBAAE,SAAS;YACxF,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC;gBAC7B,IAAI,EAAE,UAAU;gBAChB,MAAM,EACJ,uEAAuE;oBACvE,sEAAsE;aACzE,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,2DAA2D;IAE3D,wEAAwE;IAC9D,KAAK,CAAC,aAAa,CAC3B,KAAa,EACb,IAAY,EACZ,EAAU,EACV,MAAc;QAEd,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC;YACnD,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE;gBACJ,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC5D,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC1D,aAAa,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;aACxC;YACD,iBAAiB,EAAE,IAAI,CAAC,UAAU;YAClC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,wEAAwE;YACxE,qEAAqE;YACrE,gDAAgD;YAChD,sEAAsE;YACtE,sEAAsE;YACtE,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,qEAAqE;YACrE,yEAAyE;YACzE,+CAA+C;YAC/C,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,kBAAkB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,wDAAwD;IAC9C,KAAK,CAAC,IAAI,CAClB,EAA0C,EAC1C,gBAAwB;QAExB,MAAM,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzE,CAAC;IAED,uEAAuE;IAC7D,KAAK,CAAC,YAAY;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;YACzC,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,iBAAiB;SAC9C,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC;IACnD,CAAC;CACF;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,GAAyC;IACnE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/signer.d.ts

@@ -0,0 +1,13 @@
+import { contract, Keypair } from "@stellar/stellar-sdk";
+/**
+ * Signs every auth entry addressed to `cardAddress` with the agent key.
+ *
+ * The stock SEP-43 path cannot do this: `signAuthEntries`' default
+ * `authorizeEntry` derives the signer public key from the entry's credential
+ * address, which here is the card's `C…` address, and `Keypair.fromPublicKey`
+ * rejects a contract strkey. So we override `authorizeEntry` and hand it a
+ * `SigningCallback` that returns `{ signature, publicKey }`. The SDK then
+ * encodes the credential signature as `Vec[{ public_key, signature }]`, which
+ * is exactly what the card's `__check_auth` (`Signature = Vec<Sig>`) consumes.
+ */
+export declare function signCardAuthEntries(tx: contract.AssembledTransaction<unknown>, cardAddress: string, agent: Keypair, expirationLedger: number): Promise<void>;

package/dist/signer.js

@@ -0,0 +1,31 @@
+import { authorizeEntry, } from "@stellar/stellar-sdk";
+/**
+ * Signs every auth entry addressed to `cardAddress` with the agent key.
+ *
+ * The stock SEP-43 path cannot do this: `signAuthEntries`' default
+ * `authorizeEntry` derives the signer public key from the entry's credential
+ * address, which here is the card's `C…` address, and `Keypair.fromPublicKey`
+ * rejects a contract strkey. So we override `authorizeEntry` and hand it a
+ * `SigningCallback` that returns `{ signature, publicKey }`. The SDK then
+ * encodes the credential signature as `Vec[{ public_key, signature }]`, which
+ * is exactly what the card's `__check_auth` (`Signature = Vec<Sig>`) consumes.
+ */
+export async function signCardAuthEntries(tx, cardAddress, agent, expirationLedger) {
+    // `payload` is already the `Uint8Array` `Keypair.sign` takes, and the result
+    // is one too: no node `Buffer` is involved, so the client signs in a browser.
+    const signPayload = async (_preimage, payload) => ({
+        signature: agent.sign(payload),
+        publicKey: agent.publicKey(),
+    });
+    await tx.signAuthEntries({
+        address: cardAddress,
+        expiration: expirationLedger,
+        authorizeEntry: (entry, _signer, validUntilLedgerSeq, networkPassphrase, 
+        // `authorizeEntry`'s real 5th parameter, used for nested/delegate
+        // credentials. `signAuthEntries` calls this callback with 4 arguments,
+        // so it is always `undefined` here; it is forwarded verbatim so the
+        // override stays a drop-in for the SDK's default.
+        forAddress) => authorizeEntry(entry, signPayload, validUntilLedgerSeq, networkPassphrase, forAddress),
+    });
+}
+//# sourceMappingURL=signer.js.map

package/dist/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAKf,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAA0C,EAC1C,WAAmB,EACnB,KAAc,EACd,gBAAwB;IAExB,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,WAAW,GAAoB,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KAC7B,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,eAAe,CAAC;QACvB,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,CACd,KAAoC,EACpC,OAAkC,EAClC,mBAA2B,EAC3B,iBAAyB;QACzB,kEAAkE;QAClE,uEAAuE;QACvE,oEAAoE;QACpE,kDAAkD;QAClD,UAAmB,EACnB,EAAE,CACF,cAAc,CACZ,KAAK,EACL,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,CACX;KACJ,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,71 @@
 {
   "name": "@mooring-live/x402-client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Pay x402-protected APIs from a Mooring spending card on Stellar.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/berkay1532/mooring.git",
+    "directory": "packages/x402-client"
+  },
+  "homepage": "https://mooring.live",
+  "bugs": {
+    "url": "https://github.com/berkay1532/mooring/issues"
+  },
+  "keywords": [
+    "stellar",
+    "soroban",
+    "x402",
+    "usdc",
+    "ai-agents",
+    "agentic-payments",
+    "spending-limits",
+    "custom-account"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./errors": {
+      "types": "./dist/denial.d.ts",
+      "import": "./dist/denial.js"
+    }
+  },
+  "//exports": "./errors is the card error table on its own, so a consumer that only translates contract errors (the web app) does not pull the payment client, its scheme and the @x402/* packages into its bundle.",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "prepublishOnly": "npm run build",
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run",
+    "e2e": "tsx e2e/testnet.e2e.ts"
+  },
+  "//": "@stellar/stellar-sdk is pinned exactly: CardExactStellarScheme records legacy (v1) auth credentials via `useUpgradedAuth: false`, a transitional flag the deployed OZ Channels facilitator still requires (see docs/x402-integration.md, CAP-71 note). An SDK that changes how auth credentials are recorded would silently change the payload; the client also asserts the recorded format at build time.",
+  "dependencies": {
+    "@stellar/stellar-sdk": "17.0.1",
+    "@x402/core": "2.25.0",
+    "@x402/fetch": "2.25.0",
+    "@x402/stellar": "2.25.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "dotenv": "^16.4.5",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "vitest": "^3.0.0"
+  }
+}