@mooring-live/x402-client 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,168 @@
-# Temporary Holding Version
+# @mooring-live/x402-client
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![npm](https://img.shields.io/npm/v/%40mooring-live%2Fx402-client)](https://www.npmjs.com/package/@mooring-live/x402-client)
+
+Pay [x402](https://x402.org)-protected APIs from a **Mooring spending card** on Stellar.
+
+A card is a Soroban custom account (`__check_auth`) that holds USDC and enforces a spending
+policy — periodic budget, per-payment cap, merchant allowlist, expiry, freeze/cancel — inside the
+authorization path. This package is the agent-side client: it detects a `402`, checks the card's
+policy locally, signs the payment with the agent key so the **card** is the payer, and turns every
+refusal into a typed error instead of a bare `402` — `CardPolicyDenied` when the card's policy
+said no, `PaymentError` for everything else.
+
+The server side stays stock x402 (`@x402/express` + `@x402/stellar` + any facilitator built on
+them — OpenZeppelin Channels and Rail402 are both verified); only the client scheme is Mooring's,
+because the stock one cannot sign for a contract account.
+
+Apache-2.0. **Stellar testnet only** — not audited, not on mainnet.
+
+## Install
+
+```sh
+npm i @mooring-live/x402-client @stellar/stellar-sdk
+```
+
+`@stellar/stellar-sdk` is a dependency of the client, but you import `Keypair` from it yourself,
+so install it alongside. The CLI (`npm i -g @mooring-live/cli`) wraps the same client for shell use.
+
+Requires Node.js 20+.
+
+## Usage
+
+```ts
+import { Keypair } from "@stellar/stellar-sdk";
+import { CardPolicyDenied, PaymentError, createMooringFetch, getSettlement } from "@mooring-live/x402-client";
+
+const fetchWithPayment = createMooringFetch({
+  card: "CAJPWJBF…AHCJ",                                 // card contract address (the payer)
+  agent: Keypair.fromSecret(process.env.AGENT_SECRET!),  // the card's registered signer
+  network: "stellar:testnet",
+});
+
+const res = await fetchWithPayment("https://api.example.com/weather");
+console.log(await res.json());
+console.log("settled:", getSettlement(res)?.transaction);
+```
+
+That is the whole integration: `fetchWithPayment` is a drop-in `fetch`. A `402` is answered by
+paying from the card and retrying; a `200` carries a `PAYMENT-RESPONSE` header that
+`getSettlement` decodes into `{ success, transaction, network, payer }`, where `payer` is the
+card.
+
+## Handling a refusal
+
+```ts
+try {
+  await fetchWithPayment(url);
+} catch (err) {
+  if (err instanceof CardPolicyDenied) {
+    // err.reason: "over_budget" | "not_allowlisted" | "expired" | …
+    // err.stage:  "precheck" | "simulate" | "verify" | "settle"
+    // err.contractError: the card's error code, when the contract spoke (1–8)
+    console.error(`payment refused: ${err.reason} at ${err.stage}`);
+  } else if (err instanceof PaymentError) {
+    // Not the card's verdict. err.kind: "rejected" | "unconfirmed"
+    console.error(`payment ${err.kind}: ${err.detail}`, err.transaction);
+  } else {
+    throw err; // a network/server problem the client did not classify
+  }
+}
+```
+
+**Failed payments are never retried automatically**, at any stage.
+
+`CardPolicyDenied` means exactly one thing: **the card's policy refused**. Everything else is a
+`PaymentError`, so a caller can treat the first as a policy decision without further checks.
+
+| `PaymentError.kind` | When | Was the card debited? |
+|---|---|---|
+| `rejected` | the facilitator refused before submitting — a malformed payload, a fee above its ceiling, an expiration too far out, a 5xx — or the client's own CAP-71 credential guard fired before signing | no |
+| `unconfirmed` | the settlement state is unknown or contradictory: the server reported a failure for a transaction the ledger accepted, the transaction was never observed within the reconciliation window, or the server answered a bare `402` with no `PAYMENT-REQUIRED` and no `PAYMENT-RESPONSE` | possibly — reconcile `err.transaction` and the card's `spent` before retrying |
+
+The facilitator answers `settle_exact_stellar_transaction_failed` both for a transaction the
+ledger rejected and for one it stopped waiting for, so a settle failure carrying a hash is
+reconciled against the RPC (~10 s) before it is named: a transaction the ledger accepted is never
+reported as a policy denial.
+
+### Stages
+
+| Stage | When | Reached the network? |
+|---|---|---|
+| `precheck` | the local policy mirror refused, before anything was signed | two read-only simulations of the card's views |
+| `simulate` | the card's own `__check_auth` refused, in the enforcing simulation the client runs after signing | no — nothing left the process, no fee paid |
+| `verify` | the facilitator refused the payload | yes; nothing submitted on-chain |
+| `settle` | the settlement transaction failed on-chain — confirmed with the RPC, and attributed to the card only when the failure's diagnostics name it | yes; a transaction was submitted and failed |
+
+### Reasons
+
+`frozen`, `cancelled`, `expired`, `not_allowlisted`, `over_per_tx_cap`, `over_budget`,
+`wrong_token`, `insufficient_balance`, `bad_signature`, `wrong_context`, `unknown`.
+
+Card contract codes map as #1 `bad_signature`, #2 `wrong_context`, #3 `frozen`, #4 `cancelled`,
+#5 `expired`, #6 `not_allowlisted`, #7 `over_per_tx_cap`, #8 `over_budget`. `wrong_token` and
+`insufficient_balance` are pre-check-only verdicts. `unknown` is **not a policy verdict** — only
+an unclassified one: the card refused but the client could not read which rule. It covers a card
+that could not be read (the pre-check fails **closed**), a facilitator `simulation_failed` the
+re-run pre-check no longer explains, and an on-chain failure whose diagnostics do not name the
+card.
+
+## Allowing a merchant from a denial
+
+A `not_allowlisted` denial carries `err.merchant` (`payTo`, and when known `amount`, `network` and
+`url`, the service URL with its query string removed). When `url` is known the message ends with a
+link the card's owner can open to allow the merchant:
+
+```
+https://app.mooring.live/allow?card=<C…>&url=<service url without query>
+```
+
+`allowMerchantUrl(appUrl, card, serviceUrl)` builds the same link. Point it at another deployment
+of the app with the `appUrl` option (default `https://app.mooring.live`).
+
+## Options
+
+| Option | Type | Default | Meaning |
+|---|---|---|---|
+| `card` | `string` | — | card contract address (`C…`); it is the payer |
+| `agent` | `Keypair` | — | the card's registered signer |
+| `network` | `"stellar:testnet" \| "stellar:pubnet"` | — | CAIP-2 network |
+| `rpcUrl` | `string` | testnet default; **required** on pubnet | Soroban RPC endpoint |
+| `precheck` | `boolean` | `true` | run the local policy mirror before signing |
+| `appUrl` | `string` | `https://app.mooring.live` | base URL of the Mooring app used in the allow link |
+| `onDenial` | `(d: CardPolicyDenied) => void` | — | called at every denial stage |
+| `onPaymentError` | `(e: PaymentError) => void` | — | called for every non-policy failure |
+| `fetch` | `typeof fetch` | `globalThis.fetch` | transport (`createMooringFetch` only) |
+
+## API
+
+| Export | What it does |
+|---|---|
+| `createMooringFetch(opts)` | a `fetch` that pays from the card and rejects with `CardPolicyDenied` or `PaymentError`, never a bare `402`; builds a fresh client per call, so it is safe to share |
+| `createMooringClient(opts)` | the underlying `x402Client`. **Single-flight per instance** — x402's hooks carry no request identity, so build one per payment. Used directly it is stock x402: it throws generic errors and returns bare `402`s, and only `onDenial` / `onPaymentError` carry the typed reason |
+| `getSettlement(res)` | decodes `PAYMENT-RESPONSE`; `null` when absent or undecodable (a settlement you cannot read is not a failed payment) |
+| `CardPolicyDenied`, `DenialReason`, `DenialStage`, `CARD_ERROR_CODES`, `classifyContractError`, `cardDenialFromEvents` | typed denials (payment-path codes 1-8) |
+| `CARD_ERRORS` | the full contract error table (codes 1-13, including owner-operation errors like `InvalidLabel`) mapped to short user-facing sentences |
+| `PaymentError` | every failure that is *not* the card's policy (`rejected` / `unconfirmed`) |
+| `reconcileSettlement(rpcUrl, network, hash)` | asks the ledger what became of a settlement transaction |
+| `precheck(info, merchants, terms, now)` | the local policy mirror, on its own |
+| `readCardInfo(rpcUrl, passphrase, card)`, `readMerchants(…)` | read-only card views (`info()`, `merchants()`); `CardInfo.label` is the owner-chosen display name |
+| `CardExactStellarScheme` | the x402 `exact` scheme client whose payer is the card |
+| `signCardAuthEntries(tx, card, agent, expirationLedger)` | signs a card auth entry with the agent key |
+
+## Notes
+
+- The pre-check is **advisory**. The card contract is the authority and runs again at settlement;
+  the pre-check only avoids spending a signature and a round-trip on an obvious refusal.
+- Muxed (`M…`) destinations are not payable — a Soroban `Address` does not exist for them.
+- The client records legacy (v1) auth credentials (`useUpgradedAuth: false`) because the deployed
+  OZ Channels stack rejects CAP-71 `ADDRESS_V2` as malformed. It also **asserts** what the RPC
+  actually recorded and refuses to sign a v2 card entry, and `@stellar/stellar-sdk` is pinned
+  exactly to `17.0.1` while the workaround stands. All three go away together; see
+  `docs/x402-integration.md`.
+- The auth entry expires at `latestLedger + max(2, ceil(maxTimeoutSeconds / 6) - 2)` — a
+  deliberately conservative ledger estimate, so the expiry stays inside the window the facilitator
+  computes from its own.
+
+Full guide: [`docs/x402-integration.md`](../../docs/x402-integration.md). Testnet evidence:
+[`docs/testnet.md`](../../docs/testnet.md).

package/dist/card.d.ts

@@ -0,0 +1,60 @@
+export type CardState = 0 | 1 | 2;
+export interface CardPolicy {
+    period_amount: bigint;
+    period_duration: bigint;
+    max_per_tx: bigint;
+    expiry: bigint;
+}
+export interface CardInfo {
+    owner: string;
+    signer: Uint8Array;
+    token: string;
+    label: string;
+    policy: CardPolicy;
+    state: CardState;
+    period: {
+        start: bigint;
+        spent: bigint;
+    };
+    remaining: bigint;
+    balance: bigint;
+    allow_count: number;
+}
+/** `CardInfo` as `scValToNative` hands it back, before normalization. */
+export type RawCardInfo = {
+    owner: string;
+    signer: Uint8Array;
+    token: string;
+    label?: string;
+    policy: CardPolicy;
+    state: number;
+    period: {
+        start: bigint;
+        spent: bigint;
+    };
+    remaining: bigint;
+    balance: bigint;
+    allow_count: number;
+};
+/**
+ * Normalizes a raw `info()` result into `CardInfo`: `signer` becomes a
+ * plain `Uint8Array` (`scValToNative` hands back a node `Buffer`, which is one
+ * — copying it keeps node's type out of the published API), `allow_count` a
+ * `number`, and
+ * `state` is range-checked before it is narrowed. Every other field is already
+ * the `bigint` the contract declared, and is passed through untouched.
+ *
+ * @throws if `state` is not one of the contract's three variants.
+ * @throws if `label` is missing (a card deployed from a pre-label factory).
+ */
+export declare function normalizeInfo(raw: RawCardInfo): CardInfo;
+/**
+ * Normalizes a raw `merchants()` result into strkeys. `scValToNative` already
+ * renders an `ScAddress` as a strkey, so the guard is a no-op today; it keeps
+ * the reader honest if a future SDK hands back the raw XDR instead.
+ */
+export declare function normalizeMerchants(list: readonly unknown[]): string[];
+/** Reads the card's `info()` view via simulation (no signing, no fees). */
+export declare function readCardInfo(rpcUrl: string, networkPassphrase: string, card: string): Promise<CardInfo>;
+/** Reads the card's `merchants()` view via simulation. */
+export declare function readMerchants(rpcUrl: string, networkPassphrase: string, card: string): Promise<string[]>;

package/dist/card.js

@@ -0,0 +1,67 @@
+import { Address, contract, scValToNative } from "@stellar/stellar-sdk";
+/**
+ * Simulates a read-only contract method and returns its parsed result.
+ *
+ * `AssembledTransaction.build` without a `publicKey` simulates from a null
+ * account, so nothing is signed, submitted or charged.
+ */
+async function simulateView(rpcUrl, networkPassphrase, card, method) {
+    const tx = await contract.AssembledTransaction.build({
+        contractId: card,
+        method,
+        args: [],
+        networkPassphrase,
+        rpcUrl,
+        parseResultXdr: (v) => scValToNative(v),
+    });
+    return tx.result;
+}
+/**
+ * Normalizes a raw `info()` result into `CardInfo`: `signer` becomes a
+ * plain `Uint8Array` (`scValToNative` hands back a node `Buffer`, which is one
+ * — copying it keeps node's type out of the published API), `allow_count` a
+ * `number`, and
+ * `state` is range-checked before it is narrowed. Every other field is already
+ * the `bigint` the contract declared, and is passed through untouched.
+ *
+ * @throws if `state` is not one of the contract's three variants.
+ * @throws if `label` is missing (a card deployed from a pre-label factory).
+ */
+export function normalizeInfo(raw) {
+    const state = Number(raw.state);
+    if (state !== 0 && state !== 1 && state !== 2) {
+        throw new Error(`Unknown card state: ${raw.state}`);
+    }
+    if (typeof raw.label !== "string") {
+        throw new Error("card info has no label (card deployed from a pre-label factory?)");
+    }
+    return {
+        owner: raw.owner,
+        signer: new Uint8Array(raw.signer),
+        token: raw.token,
+        label: raw.label,
+        policy: raw.policy,
+        state: state,
+        period: raw.period,
+        remaining: raw.remaining,
+        balance: raw.balance,
+        allow_count: Number(raw.allow_count),
+    };
+}
+/**
+ * Normalizes a raw `merchants()` result into strkeys. `scValToNative` already
+ * renders an `ScAddress` as a strkey, so the guard is a no-op today; it keeps
+ * the reader honest if a future SDK hands back the raw XDR instead.
+ */
+export function normalizeMerchants(list) {
+    return list.map((a) => typeof a === "string" ? a : Address.fromScAddress(a).toString());
+}
+/** Reads the card's `info()` view via simulation (no signing, no fees). */
+export async function readCardInfo(rpcUrl, networkPassphrase, card) {
+    return normalizeInfo(await simulateView(rpcUrl, networkPassphrase, card, "info"));
+}
+/** Reads the card's `merchants()` view via simulation. */
+export async function readMerchants(rpcUrl, networkPassphrase, card) {
+    return normalizeMerchants(await simulateView(rpcUrl, networkPassphrase, card, "merchants"));
+}
+//# sourceMappingURL=card.js.map

package/dist/card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../src/card.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAO,MAAM,sBAAsB,CAAC;AAsC7E;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,iBAAyB,EACzB,IAAY,EACZ,MAAc;IAEd,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAI;QACtD,UAAU,EAAE,IAAI;QAChB,MAAM;QACN,IAAI,EAAE,EAAE;QACR,iBAAiB;QACjB,MAAM;QACN,cAAc,EAAE,CAAC,CAAY,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAM;KACxD,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,MAAM,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,KAAkB;QACzB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;KACrC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAkB,CAAC,CAAC,QAAQ,EAAE,CACjF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,iBAAyB,EACzB,IAAY;IAEZ,OAAO,aAAa,CAAC,MAAM,YAAY,CAAc,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,iBAAyB,EACzB,IAAY;IAEZ,OAAO,kBAAkB,CAAC,MAAM,YAAY,CAAY,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AACzG,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,77 @@
+import type { Keypair } from "@stellar/stellar-sdk";
+import { x402Client } from "@x402/fetch";
+import { CardPolicyDenied, PaymentError } from "./denial.js";
+import { type StellarNetwork } from "./scheme.js";
+export interface MooringClientOptions {
+    card: string;
+    agent: Keypair;
+    network: StellarNetwork;
+    rpcUrl?: string;
+    /** Run the local policy pre-check before signing (default true). */
+    precheck?: boolean;
+    /** Base URL of the Mooring app used in the allow link on a denial (default `DEFAULT_APP_URL`). */
+    appUrl?: string;
+    /** Called whenever the card's policy denies a payment, at any stage. */
+    onDenial?: (denial: CardPolicyDenied) => void;
+    /** Called whenever a payment fails for a reason that is *not* the card's policy. */
+    onPaymentError?: (error: PaymentError) => void;
+}
+export interface Settlement {
+    success: boolean;
+    transaction: string;
+    network: string;
+    payer?: string;
+    errorReason?: string;
+}
+/** Everything `createMooringFetch` can reject with. */
+type PaymentFailure = CardPolicyDenied | PaymentError;
+/**
+ * Internal: the last failure recorded by the hooks, so the fetch wrapper can
+ * rethrow it typed. `@x402/fetch` turns an aborted payment into a generic
+ * `Error` and returns verify/settle failures as a plain 402 response, so the
+ * hooks are the only place where the reason survives.
+ */
+declare class FailureBox {
+    last?: PaymentFailure;
+    set(failure: PaymentFailure, opts: MooringClientOptions): void;
+}
+/**
+ * Builds an x402 client that pays from a Mooring card.
+ *
+ * The card enforces the budget, allowlist and expiry on-chain; this client
+ * mirrors that policy locally so an over-limit payment is refused before the
+ * agent key signs anything, and classifies every other outcome into
+ * `CardPolicyDenied` (the card's policy refused) or `PaymentError` (anything
+ * else).
+ *
+ * **One instance is single-flight.** x402's hook contexts carry no request
+ * identity, so the failure recorded by one payment cannot be told apart from
+ * another's: do not run concurrent payments through the same client. Build one
+ * per payment, or use `createMooringFetch`, which does that for you.
+ *
+ * Used directly, the returned `x402Client` still throws x402's own generic
+ * errors and hands back bare 402 responses: only `onDenial` / `onPaymentError`
+ * surface the typed reason. `createMooringFetch` is what turns them into
+ * thrown `CardPolicyDenied` / `PaymentError`.
+ */
+export declare function createMooringClient(opts: MooringClientOptions, box?: FailureBox, requestUrl?: string): x402Client;
+/**
+ * A `fetch` that pays x402-protected requests from the card, and rejects with
+ * `CardPolicyDenied` (the card's policy refused) or `PaymentError` (anything
+ * else) — never a bare 402 — whenever the payment does not deliver the
+ * resource. Failed payments are never retried.
+ *
+ * Each call builds its own client and failure scope — `x402Client.fromConfig`
+ * does no I/O — so concurrent requests through the same returned `fetch` cannot
+ * observe each other's failures.
+ */
+export declare function createMooringFetch(opts: MooringClientOptions & {
+    fetch?: typeof globalThis.fetch;
+}): typeof globalThis.fetch;
+/**
+ * Decodes the PAYMENT-RESPONSE header of a paid response. Returns `null` when
+ * the header is absent or undecodable — a settlement we cannot read is not a
+ * failed payment, and must never turn a 200 into an error.
+ */
+export declare function getSettlement(res: Response): Settlement | null;
+export {};

package/dist/client.js

@@ -0,0 +1,272 @@
+import { decodePaymentResponseHeader, wrapFetchWithPayment, x402Client } from "@x402/fetch";
+import { getNetworkPassphrase, getRpcUrl } from "@x402/stellar";
+import { readCardInfo, readMerchants } from "./card.js";
+import { CARD_ERROR_CODES, CardPolicyDenied, DEFAULT_APP_URL, PaymentError, cardDenialFromEvents, classifyContractError, isAbsoluteHttpUrl, stripQuery, } from "./denial.js";
+import { precheck } from "./precheck.js";
+import { reconcileSettlement } from "./reconcile.js";
+import { CardExactStellarScheme } from "./scheme.js";
+/**
+ * Internal: the last failure recorded by the hooks, so the fetch wrapper can
+ * rethrow it typed. `@x402/fetch` turns an aborted payment into a generic
+ * `Error` and returns verify/settle failures as a plain 402 response, so the
+ * hooks are the only place where the reason survives.
+ */
+class FailureBox {
+    last;
+    set(failure, opts) {
+        this.last = failure;
+        if (failure instanceof CardPolicyDenied)
+            opts.onDenial?.(failure);
+        else
+            opts.onPaymentError?.(failure);
+    }
+}
+/**
+ * Builds an x402 client that pays from a Mooring card.
+ *
+ * The card enforces the budget, allowlist and expiry on-chain; this client
+ * mirrors that policy locally so an over-limit payment is refused before the
+ * agent key signs anything, and classifies every other outcome into
+ * `CardPolicyDenied` (the card's policy refused) or `PaymentError` (anything
+ * else).
+ *
+ * **One instance is single-flight.** x402's hook contexts carry no request
+ * identity, so the failure recorded by one payment cannot be told apart from
+ * another's: do not run concurrent payments through the same client. Build one
+ * per payment, or use `createMooringFetch`, which does that for you.
+ *
+ * Used directly, the returned `x402Client` still throws x402's own generic
+ * errors and hands back bare 402 responses: only `onDenial` / `onPaymentError`
+ * surface the typed reason. `createMooringFetch` is what turns them into
+ * thrown `CardPolicyDenied` / `PaymentError`.
+ */
+export function createMooringClient(opts, box = new FailureBox(), requestUrl) {
+    const rpcUrl = getRpcUrl(opts.network, opts.rpcUrl ? { url: opts.rpcUrl } : undefined);
+    const passphrase = getNetworkPassphrase(opts.network);
+    const scheme = new CardExactStellarScheme({
+        card: opts.card,
+        agent: opts.agent,
+        network: opts.network,
+        rpcUrl: opts.rpcUrl,
+        appUrl: opts.appUrl,
+        requestUrl,
+        // A failure raised inside the scheme (the card refusing the enforcing
+        // simulation, or the CAP-71 credential guard) travels out as a thrown
+        // error, but it must reach the hooks and the box like every other stage.
+        onDenial: (denial) => box.set(denial, opts),
+        onPaymentError: (error) => box.set(error, opts),
+    });
+    /** What a denial carries so the owner can allow the merchant: its terms, the card and the app. */
+    const denialContext = (req) => ({
+        merchant: {
+            payTo: req.payTo,
+            amount: req.amount,
+            network: req.network,
+            ...(requestUrl ? { url: requestUrl } : {}),
+        },
+        card: opts.card,
+        appUrl: opts.appUrl ?? DEFAULT_APP_URL,
+    });
+    const evaluate = async (req) => {
+        const [info, merchants] = await Promise.all([
+            readCardInfo(rpcUrl, passphrase, opts.card),
+            readMerchants(rpcUrl, passphrase, opts.card),
+        ]);
+        return precheck(info, merchants, { payTo: req.payTo, amount: req.amount, asset: req.asset }, Math.floor(Date.now() / 1000));
+    };
+    /**
+     * Classifies a refusal that happened *before* anything was submitted.
+     *
+     * The facilitator does not say whose rule it applied, so the card is asked
+     * instead: if the card's own state explains the refusal it is a policy
+     * denial, and `simulation_failed` is policy-shaped too (a card denial is a
+     * simulation failure — that is the whole of finding the reason on-chain, and
+     * a race can produce one the re-run pre-check no longer sees). Every other
+     * reason the facilitator can give — a malformed payload, a fee above its
+     * ceiling, an expiration too far out — is not the card's verdict and must
+     * not be reported as one.
+     */
+    const classifyRefusal = async (stage, text, req) => {
+        const parsed = classifyContractError(text);
+        if (parsed && parsed.code in CARD_ERROR_CODES) {
+            return new CardPolicyDenied(parsed.reason, stage, {
+                contractError: parsed.code,
+                detail: text || undefined,
+                ...denialContext(req),
+            });
+        }
+        let reason = null;
+        try {
+            reason = await evaluate(req);
+        }
+        catch {
+            /* the card could not be read; fall through to the reason string */
+        }
+        if (reason) {
+            return new CardPolicyDenied(reason, stage, { detail: text || undefined, ...denialContext(req) });
+        }
+        if (text.includes("simulation_failed")) {
+            return new CardPolicyDenied("unknown", stage, { detail: text || undefined, ...denialContext(req) });
+        }
+        return new PaymentError({ kind: "rejected", detail: text || undefined });
+    };
+    /**
+     * Decides what a failed settlement means, by asking the ledger.
+     *
+     * A settle failure that carries a transaction hash is *not* evidence the
+     * payment did not happen: the facilitator returns the same
+     * `settle_exact_stellar_transaction_failed` when its poll times out, and
+     * inclusion can follow that answer. So the hash is reconciled before the
+     * failure is named — a transaction the ledger accepted is never reported as
+     * a policy denial, however the server described it.
+     */
+    const classifySettleFailure = async (settle, req) => {
+        const reason = settle.errorReason ?? "settle failed";
+        const hash = settle.transaction;
+        if (!hash)
+            return classifyRefusal("settle", reason, req);
+        let outcome;
+        try {
+            outcome = await reconcileSettlement(rpcUrl, opts.network, hash);
+        }
+        catch (err) {
+            return new PaymentError({
+                kind: "unconfirmed",
+                transaction: hash,
+                detail: `${reason}; reconciliation failed: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+        if (outcome.status === "SUCCESS") {
+            return new PaymentError({
+                kind: "unconfirmed",
+                transaction: hash,
+                detail: "settled on-chain but the server reported failure; reconcile",
+            });
+        }
+        if (outcome.status === "NOT_FOUND") {
+            return new PaymentError({
+                kind: "unconfirmed",
+                transaction: hash,
+                detail: `${reason}; not observed on-chain within the reconciliation window`,
+            });
+        }
+        const parsed = cardDenialFromEvents(outcome.events, opts.card);
+        return new CardPolicyDenied(parsed?.reason ?? "unknown", "settle", {
+            contractError: parsed?.code,
+            detail: `${reason} tx=${hash}`,
+            ...denialContext(req),
+        });
+    };
+    const client = x402Client.fromConfig({
+        schemes: [{ network: opts.network, client: scheme }],
+        // The card enforces limits on-chain; x402's USD-based client caps would only get in the way.
+        spendControls: false,
+    });
+    client.onBeforePaymentCreation(async ({ selectedRequirements }) => {
+        if (opts.precheck === false)
+            return;
+        let reason;
+        try {
+            reason = await evaluate(selectedRequirements);
+        }
+        catch (err) {
+            // Fail closed: a card we cannot read is a card we cannot spend from.
+            const detail = `pre-check unavailable: ${err instanceof Error ? err.message : String(err)}`;
+            box.set(new CardPolicyDenied("unknown", "precheck", { detail, ...denialContext(selectedRequirements) }), opts);
+            return { abort: true, reason: detail };
+        }
+        if (reason) {
+            box.set(new CardPolicyDenied(reason, "precheck", denialContext(selectedRequirements)), opts);
+            return { abort: true, reason };
+        }
+    });
+    client.onPaymentResponse(async ({ requirements, settleResponse, paymentRequired, error }) => {
+        if (settleResponse && !settleResponse.success) {
+            box.set(await classifySettleFailure(settleResponse, requirements), opts);
+            return;
+        }
+        if (paymentRequired && !settleResponse) {
+            // Verify failed. The facilitator does not say why; ask the card.
+            const text = paymentRequired.error ?? error?.message ?? "";
+            box.set(await classifyRefusal("verify", text, requirements), opts);
+        }
+    });
+    return client;
+}
+/**
+ * A `fetch` that pays x402-protected requests from the card, and rejects with
+ * `CardPolicyDenied` (the card's policy refused) or `PaymentError` (anything
+ * else) — never a bare 402 — whenever the payment does not deliver the
+ * resource. Failed payments are never retried.
+ *
+ * Each call builds its own client and failure scope — `x402Client.fromConfig`
+ * does no I/O — so concurrent requests through the same returned `fetch` cannot
+ * observe each other's failures.
+ */
+export function createMooringFetch(opts) {
+    const transport = opts.fetch ?? globalThis.fetch;
+    return (async (input, init) => {
+        const box = new FailureBox();
+        // Only an absolute http(s) URL can become an allow link; anything else
+        // (a relative path, another scheme) is left off the denial entirely.
+        const rawUrl = input instanceof Request ? input.url : String(input);
+        const requestUrl = isAbsoluteHttpUrl(rawUrl) ? stripQuery(rawUrl) : undefined;
+        const wrapped = wrapFetchWithPayment(transport, createMooringClient(opts, box, requestUrl));
+        try {
+            const res = await wrapped(input, init);
+            // Verify and settle failures come back as a non-2xx response, not a
+            // throw; the hooks have recorded why, so surface it typed.
+            if (box.last)
+                throw box.last;
+            const settlement = getSettlement(res);
+            if (settlement && !settlement.success) {
+                // The hooks classify every settlement they see; reaching here means
+                // the header said "failed" without the hook firing, so the settlement
+                // state is exactly as unknown as the header is unexplained.
+                box.set(new PaymentError({
+                    kind: "unconfirmed",
+                    transaction: settlement.transaction || undefined,
+                    detail: settlement.errorReason ?? "settle failed",
+                }), opts);
+                throw box.last;
+            }
+            if (res.status === 402) {
+                // The payment was made and the resource still withheld, with nothing
+                // in the response to say what happened to it. `@x402/express` answers
+                // exactly this from its settlement path, *after* the facilitator may
+                // have submitted — so this is an unknown settlement, not a denial.
+                box.set(new PaymentError({
+                    kind: "unconfirmed",
+                    detail: "402 without PAYMENT-REQUIRED or PAYMENT-RESPONSE; settlement state unknown",
+                }), opts);
+                throw box.last;
+            }
+            return res;
+        }
+        catch (err) {
+            // A pre-check abort reaches us as a generic Error from @x402/fetch.
+            if (err instanceof CardPolicyDenied || err instanceof PaymentError)
+                throw err;
+            if (box.last)
+                throw box.last;
+            throw err;
+        }
+    });
+}
+/**
+ * Decodes the PAYMENT-RESPONSE header of a paid response. Returns `null` when
+ * the header is absent or undecodable — a settlement we cannot read is not a
+ * failed payment, and must never turn a 200 into an error.
+ */
+export function getSettlement(res) {
+    const header = res.headers.get("PAYMENT-RESPONSE") ?? res.headers.get("X-PAYMENT-RESPONSE");
+    if (!header)
+        return null;
+    try {
+        return decodePaymentResponseHeader(header);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=client.js.map