@mooring-live/x402-client 0.0.0-stage → 0.2.0

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5F,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EAGrB,iBAAiB,EACjB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,aAAa,CAAC;AA4B1E;;;;;GAKG;AACH,MAAM,UAAU;IACd,IAAI,CAAkB;IACtB,GAAG,CAAC,OAAuB,EAAE,IAA0B;QACrD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACpB,IAAI,OAAO,YAAY,gBAAgB;YAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;;YAC7D,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0B,EAC1B,MAAkB,IAAI,UAAU,EAAE,EAClC,UAAmB;IAEnB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC;QACxC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU;QACV,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;QAC3C,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;KAChD,CAAC,CAAC;IAEH,kGAAkG;IAClG,MAAM,aAAa,GAAG,CAAC,GAAwB,EAAE,EAAE,CAAC,CAAC;QACnD,QAAQ,EAAE;YACR,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,eAAe;KACvC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAwB,EAAgC,EAAE;QAChF,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;YAC3C,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,QAAQ,CACb,IAAI,EACJ,SAAS,EACT,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAC1D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAC9B,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAkB,EAClB,IAAY,EACZ,GAAwB,EACC,EAAE;QAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;YAC9C,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;gBAChD,aAAa,EAAE,MAAM,CAAC,IAAI;gBAC1B,MAAM,EAAE,IAAI,IAAI,SAAS;gBACzB,GAAG,aAAa,CAAC,GAAG,CAAC;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,GAAwB,IAAI,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,qBAAqB,GAAG,KAAK,EACjC,MAAkB,EAClB,GAAwB,EACC,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,eAAe,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,YAAY,CAAC;gBACtB,IAAI,EAAE,aAAa;gBACnB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,GAAG,MAAM,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAChG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,YAAY,CAAC;gBACtB,IAAI,EAAE,aAAa;gBACnB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,6DAA6D;aACtE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,IAAI,YAAY,CAAC;gBACtB,IAAI,EAAE,aAAa;gBACnB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,GAAG,MAAM,0DAA0D;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,QAAQ,EAAE;YACjE,aAAa,EAAE,MAAM,EAAE,IAAI;YAC3B,MAAM,EAAE,GAAG,MAAM,OAAO,IAAI,EAAE;YAC9B,GAAG,aAAa,CAAC,GAAG,CAAC;SACtB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACpD,6FAA6F;QAC7F,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IAEH,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;QAChE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO;QACpC,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,MAAM,MAAM,GAAG,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/G,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1F,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,MAAM,qBAAqB,CAAC,cAA4B,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,IAAI,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,iEAAiE;YACjE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAgE;IAEhE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACjD,OAAO,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACvC,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,GAAG,CAAC,IAAI;gBAAE,MAAM,GAAG,CAAC,IAAI,CAAC;YAC7B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACtC,oEAAoE;gBACpE,sEAAsE;gBACtE,4DAA4D;gBAC5D,GAAG,CAAC,GAAG,CACL,IAAI,YAAY,CAAC;oBACf,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,SAAS;oBAChD,MAAM,EAAE,UAAU,CAAC,WAAW,IAAI,eAAe;iBAClD,CAAC,EACF,IAAI,CACL,CAAC;gBACF,MAAM,GAAG,CAAC,IAAK,CAAC;YAClB,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,qEAAqE;gBACrE,sEAAsE;gBACtE,qEAAqE;gBACrE,mEAAmE;gBACnE,GAAG,CAAC,GAAG,CACL,IAAI,YAAY,CAAC;oBACf,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,4EAA4E;iBACrF,CAAC,EACF,IAAI,CACL,CAAC;gBACF,MAAM,GAAG,CAAC,IAAK,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,YAAY,YAAY;gBAAE,MAAM,GAAG,CAAC;YAC9E,IAAI,GAAG,CAAC,IAAI;gBAAE,MAAM,GAAG,CAAC,IAAI,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAA4B,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,CAAe,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/denial.d.ts

@@ -0,0 +1,104 @@
+import { type xdr } from "@stellar/stellar-sdk";
+export type DenialReason = "frozen" | "cancelled" | "expired" | "not_allowlisted" | "over_per_tx_cap" | "over_budget" | "wrong_token" | "insufficient_balance" | "bad_signature" | "wrong_context" | "unknown";
+/**
+ * Where a payment was denied.
+ *
+ * - `precheck`  — the local policy mirror, before anything is signed.
+ * - `simulate`  — the card's `__check_auth`, in the enforcing simulation the
+ *   client runs after signing and before handing the payload to a facilitator.
+ * - `verify`    — the facilitator refused the payload.
+ * - `settle`    — the settlement transaction failed on-chain.
+ */
+export type DenialStage = "precheck" | "simulate" | "verify" | "settle";
+/** Card contract error codes that mean "policy denied". */
+export declare const CARD_ERROR_CODES: Record<number, DenialReason>;
+/**
+ * Every contract error the card can raise (`CardError`, codes 1..13), with a
+ * short user-facing sentence for each. This is the full table: unlike
+ * `CARD_ERROR_CODES` (1..8, payment denials only), it also covers the owner
+ * operations the web app surfaces (`set_policy`, `set_label`, allowlist
+ * management, freeze/cancel/withdraw) so their errors can be shown directly
+ * without a separate mapping.
+ */
+export declare const CARD_ERRORS: Record<number, string>;
+/** Parses a Soroban `Error(Contract, #N)` from an error/diagnostic string. */
+export declare function classifyContractError(text: string): {
+    code: number;
+    reason: DenialReason;
+} | null;
+/**
+ * Reads the card's own `__check_auth` verdict out of a transaction's diagnostic
+ * events.
+ *
+ * The card's address alone is not evidence: it appears in the `transfer`
+ * arguments of every diagnostic this transaction can produce, and the token's
+ * own error codes overlap the card's 1-8 range — a SAC balance error would be
+ * read as a policy decision. What identifies an auth failure is the host's
+ * event, which names the failing account and its error together:
+ *
+ *   ["failed account authentication with error", <card>, Error(Contract, #N)]
+ *
+ * so the reason is taken from that event and nowhere else. Anything that does
+ * not match returns `null`, and the caller reports `unknown`.
+ */
+export declare function cardDenialFromEvents(events: readonly xdr.DiagnosticEvent[], card: string): {
+    code: number;
+    reason: DenialReason;
+} | null;
+/** The merchant a denied payment was addressed to, as far as the client knows. */
+export interface DeniedMerchant {
+    payTo: string;
+    url?: string;
+    amount?: string;
+    network?: string;
+}
+/** The hosted Mooring web app, used to build "allow this merchant" links. */
+export declare const DEFAULT_APP_URL = "https://app.mooring.live";
+/**
+ * `origin + pathname` of an absolute URL (drops query and fragment). Input
+ * that does not parse (a relative URL, say) is cut at its first `?` or `#`,
+ * so a query string can never pass through.
+ */
+export declare function stripQuery(url: string): string;
+/** True for an absolute `http:` / `https:` URL. */
+export declare function isAbsoluteHttpUrl(url: string): boolean;
+/** Link to the web app's allow page for a card and a paid service URL (query and fragment are dropped). */
+export declare function allowMerchantUrl(appBaseUrl: string, card: string, serviceUrl: string): string;
+export declare class CardPolicyDenied extends Error {
+    readonly reason: DenialReason;
+    readonly stage: DenialStage;
+    readonly contractError?: number;
+    readonly detail?: string;
+    readonly merchant?: DeniedMerchant;
+    constructor(reason: DenialReason, stage: DenialStage, opts?: {
+        contractError?: number;
+        detail?: string;
+        merchant?: DeniedMerchant;
+        card?: string;
+        appUrl?: string;
+    });
+}
+/**
+ * Why a payment did not deliver the resource, when the card's policy is *not*
+ * the reason. `CardPolicyDenied` means exactly one thing — the card refused —
+ * so everything else lands here:
+ *
+ * - `rejected`    — the facilitator (or the transport) refused the payment
+ *   before anything was submitted: a malformed payload, a fee above the
+ *   facilitator's ceiling, an expiration it will not accept, a 5xx. Nothing
+ *   was spent.
+ * - `unconfirmed` — the settlement state is unknown or contradictory: the
+ *   server reported a failure for a transaction the ledger accepted, or the
+ *   transaction was never observed. The card may have been debited; reconcile
+ *   `transaction` against the network before retrying.
+ */
+export declare class PaymentError extends Error {
+    readonly kind: "rejected" | "unconfirmed";
+    readonly transaction?: string;
+    readonly detail?: string;
+    constructor(opts: {
+        kind: "rejected" | "unconfirmed";
+        transaction?: string;
+        detail?: string;
+    });
+}

package/dist/denial.js

@@ -0,0 +1,154 @@
+import { humanizeEvents } from "@stellar/stellar-sdk";
+/** Card contract error codes that mean "policy denied". */
+export const CARD_ERROR_CODES = {
+    1: "bad_signature",
+    2: "wrong_context",
+    3: "frozen",
+    4: "cancelled",
+    5: "expired",
+    6: "not_allowlisted",
+    7: "over_per_tx_cap",
+    8: "over_budget",
+};
+/**
+ * Every contract error the card can raise (`CardError`, codes 1..13), with a
+ * short user-facing sentence for each. This is the full table: unlike
+ * `CARD_ERROR_CODES` (1..8, payment denials only), it also covers the owner
+ * operations the web app surfaces (`set_policy`, `set_label`, allowlist
+ * management, freeze/cancel/withdraw) so their errors can be shown directly
+ * without a separate mapping.
+ */
+export const CARD_ERRORS = {
+    1: "The signature is not valid for this card.",
+    2: "This action is not the one payment the card's agent key is allowed to sign.",
+    3: "This card is frozen.",
+    4: "This card has been cancelled.",
+    5: "This card has expired.",
+    6: "This merchant is not on the card's allowlist.",
+    7: "This payment is over the card's per-transaction cap.",
+    8: "This would put the card over its budget for the current period.",
+    9: "The amount must be a positive number.",
+    10: "The card's merchant allowlist is full.",
+    11: "That policy is not valid (check the budget, cap and expiry values).",
+    12: "This action is not allowed in the card's current state.",
+    13: "That label is not valid (it must be 1 to 32 bytes).",
+};
+const CONTRACT_ERROR = /Error\(Contract, #(\d+)\)/;
+/** Parses a Soroban `Error(Contract, #N)` from an error/diagnostic string. */
+export function classifyContractError(text) {
+    const m = CONTRACT_ERROR.exec(text);
+    if (!m)
+        return null;
+    const code = Number(m[1]);
+    return { code, reason: CARD_ERROR_CODES[code] ?? "unknown" };
+}
+/** The host's phrase that attributes an authorization failure to an account. */
+const AUTH_FAILURE = "failed account authentication with error";
+/**
+ * Reads the card's own `__check_auth` verdict out of a transaction's diagnostic
+ * events.
+ *
+ * The card's address alone is not evidence: it appears in the `transfer`
+ * arguments of every diagnostic this transaction can produce, and the token's
+ * own error codes overlap the card's 1-8 range — a SAC balance error would be
+ * read as a policy decision. What identifies an auth failure is the host's
+ * event, which names the failing account and its error together:
+ *
+ *   ["failed account authentication with error", <card>, Error(Contract, #N)]
+ *
+ * so the reason is taken from that event and nowhere else. Anything that does
+ * not match returns `null`, and the caller reports `unknown`.
+ */
+export function cardDenialFromEvents(events, card) {
+    for (const e of humanizeEvents([...events])) {
+        const data = e.data;
+        if (!Array.isArray(data) || data.length < 3)
+            continue;
+        if (data[0] !== AUTH_FAILURE || data[1] !== card)
+            continue;
+        const err = data[2];
+        if (err?.type !== "contract" || typeof err.code !== "number")
+            continue;
+        return { code: err.code, reason: CARD_ERROR_CODES[err.code] ?? "unknown" };
+    }
+    return null;
+}
+/** The hosted Mooring web app, used to build "allow this merchant" links. */
+export const DEFAULT_APP_URL = "https://app.mooring.live";
+/**
+ * `origin + pathname` of an absolute URL (drops query and fragment). Input
+ * that does not parse (a relative URL, say) is cut at its first `?` or `#`,
+ * so a query string can never pass through.
+ */
+export function stripQuery(url) {
+    try {
+        const u = new URL(url);
+        return u.origin + u.pathname;
+    }
+    catch {
+        const cut = url.search(/[?#]/);
+        return cut === -1 ? url : url.slice(0, cut);
+    }
+}
+/** True for an absolute `http:` / `https:` URL. */
+export function isAbsoluteHttpUrl(url) {
+    try {
+        const { protocol } = new URL(url);
+        return protocol === "http:" || protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/** Link to the web app's allow page for a card and a paid service URL (query and fragment are dropped). */
+export function allowMerchantUrl(appBaseUrl, card, serviceUrl) {
+    const base = appBaseUrl.endsWith("/") ? appBaseUrl.slice(0, -1) : appBaseUrl;
+    return `${base}/allow?card=${card}&url=${encodeURIComponent(stripQuery(serviceUrl))}`;
+}
+export class CardPolicyDenied extends Error {
+    reason;
+    stage;
+    contractError;
+    detail;
+    merchant;
+    constructor(reason, stage, opts = {}) {
+        const appUrl = opts.appUrl ?? DEFAULT_APP_URL;
+        const link = reason === "not_allowlisted" && opts.merchant?.url && opts.card && appUrl
+            ? ` — allow it: ${allowMerchantUrl(appUrl, opts.card, opts.merchant.url)}`
+            : "";
+        super(`card policy denied (${reason}) at ${stage}${opts.contractError ? ` [contract error #${opts.contractError}]` : ""}${opts.detail ? `: ${opts.detail}` : ""}${link}`);
+        this.name = "CardPolicyDenied";
+        this.reason = reason;
+        this.stage = stage;
+        this.contractError = opts.contractError;
+        this.detail = opts.detail;
+        this.merchant = opts.merchant;
+    }
+}
+/**
+ * Why a payment did not deliver the resource, when the card's policy is *not*
+ * the reason. `CardPolicyDenied` means exactly one thing — the card refused —
+ * so everything else lands here:
+ *
+ * - `rejected`    — the facilitator (or the transport) refused the payment
+ *   before anything was submitted: a malformed payload, a fee above the
+ *   facilitator's ceiling, an expiration it will not accept, a 5xx. Nothing
+ *   was spent.
+ * - `unconfirmed` — the settlement state is unknown or contradictory: the
+ *   server reported a failure for a transaction the ledger accepted, or the
+ *   transaction was never observed. The card may have been debited; reconcile
+ *   `transaction` against the network before retrying.
+ */
+export class PaymentError extends Error {
+    kind;
+    transaction;
+    detail;
+    constructor(opts) {
+        super(`payment ${opts.kind}${opts.transaction ? ` (tx ${opts.transaction})` : ""}${opts.detail ? `: ${opts.detail}` : ""}`);
+        this.name = "PaymentError";
+        this.kind = opts.kind;
+        this.transaction = opts.transaction;
+        this.detail = opts.detail;
+    }
+}
+//# sourceMappingURL=denial.js.map

package/dist/denial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denial.js","sourceRoot":"","sources":["../src/denial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAY,MAAM,sBAAsB,CAAC;AAiBhE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAiC;IAC5D,CAAC,EAAE,eAAe;IAClB,CAAC,EAAE,eAAe;IAClB,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,WAAW;IACd,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,iBAAiB;IACpB,CAAC,EAAE,iBAAiB;IACpB,CAAC,EAAE,aAAa;CACjB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,CAAC,EAAE,2CAA2C;IAC9C,CAAC,EAAE,6EAA6E;IAChF,CAAC,EAAE,sBAAsB;IACzB,CAAC,EAAE,+BAA+B;IAClC,CAAC,EAAE,wBAAwB;IAC3B,CAAC,EAAE,+CAA+C;IAClD,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,iEAAiE;IACpE,CAAC,EAAE,uCAAuC;IAC1C,EAAE,EAAE,wCAAwC;IAC5C,EAAE,EAAE,qEAAqE;IACzE,EAAE,EAAE,yDAAyD;IAC7D,EAAE,EAAE,qDAAqD;CAC1D,CAAC;AAEF,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsC,EACtC,IAAY;IAEZ,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,SAAS;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAiD,CAAC;QACpE,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAY,EAAE,UAAkB;IACnF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7E,OAAO,GAAG,IAAI,eAAe,IAAI,QAAQ,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,aAAa,CAAU;IACvB,MAAM,CAAU;IAChB,QAAQ,CAAkB;IAEnC,YACE,MAAoB,EACpB,KAAkB,EAClB,OAA+G,EAAE;QAEjH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;QAC9C,MAAM,IAAI,GACR,MAAM,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM;YACvE,CAAC,CAAC,gBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,uBAAuB,MAAM,QAAQ,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1K,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAA6B;IACjC,WAAW,CAAU;IACrB,MAAM,CAAU;IAEzB,YAAY,IAAiF;QAC3F,KAAK,CACH,WAAW,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACrH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export { signCardAuthEntries } from "./signer.js";
+export { CARD_ERROR_CODES, CARD_ERRORS, CardPolicyDenied, DEFAULT_APP_URL, PaymentError, allowMerchantUrl, cardDenialFromEvents, classifyContractError, } from "./denial.js";
+export type { DeniedMerchant, DenialReason, DenialStage } from "./denial.js";
+export { reconcileSettlement } from "./reconcile.js";
+export type { SettlementOutcome } from "./reconcile.js";
+export { precheck } from "./precheck.js";
+export type { PaymentTerms } from "./precheck.js";
+export { readCardInfo, readMerchants } from "./card.js";
+export type { CardInfo, CardPolicy, CardState } from "./card.js";
+export { CardExactStellarScheme } from "./scheme.js";
+export type { CardSchemeOptions, StellarNetwork } from "./scheme.js";
+export { createMooringClient, createMooringFetch, getSettlement } from "./client.js";
+export type { MooringClientOptions, Settlement } from "./client.js";

package/dist/index.js

@@ -0,0 +1,8 @@
+export { signCardAuthEntries } from "./signer.js";
+export { CARD_ERROR_CODES, CARD_ERRORS, CardPolicyDenied, DEFAULT_APP_URL, PaymentError, allowMerchantUrl, cardDenialFromEvents, classifyContractError, } from "./denial.js";
+export { reconcileSettlement } from "./reconcile.js";
+export { precheck } from "./precheck.js";
+export { readCardInfo, readMerchants } from "./card.js";
+export { CardExactStellarScheme } from "./scheme.js";
+export { createMooringClient, createMooringFetch, getSettlement } from "./client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/precheck.d.ts

@@ -0,0 +1,12 @@
+import type { CardInfo } from "./card.js";
+import type { DenialReason } from "./denial.js";
+export interface PaymentTerms {
+    payTo: string;
+    amount: string;
+    asset: string;
+}
+/**
+ * Local mirror of the card's on-chain policy, evaluated before signing so the agent
+ * never submits a payment the card will reject. Order matches the contract.
+ */
+export declare function precheck(info: CardInfo, merchants: string[], req: PaymentTerms, nowSeconds: number): DenialReason | null;

package/dist/precheck.js

@@ -0,0 +1,25 @@
+/**
+ * Local mirror of the card's on-chain policy, evaluated before signing so the agent
+ * never submits a payment the card will reject. Order matches the contract.
+ */
+export function precheck(info, merchants, req, nowSeconds) {
+    const amount = BigInt(req.amount);
+    if (req.asset !== info.token)
+        return "wrong_token";
+    if (info.state === 1)
+        return "frozen";
+    if (info.state === 2)
+        return "cancelled";
+    if (BigInt(nowSeconds) >= info.policy.expiry)
+        return "expired";
+    if (!merchants.includes(req.payTo))
+        return "not_allowlisted";
+    if (amount > info.policy.max_per_tx)
+        return "over_per_tx_cap";
+    if (amount > info.remaining)
+        return "over_budget";
+    if (amount > info.balance)
+        return "insufficient_balance";
+    return null;
+}
+//# sourceMappingURL=precheck.js.map

package/dist/precheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"precheck.js","sourceRoot":"","sources":["../src/precheck.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAc,EAAE,SAAmB,EAAE,GAAiB,EAAE,UAAkB;IACjG,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACnD,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC7D,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,iBAAiB,CAAC;IAC9D,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC;IAClD,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,sBAAsB,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/reconcile.d.ts

@@ -0,0 +1,37 @@
+import { type xdr } from "@stellar/stellar-sdk";
+import type { StellarNetwork } from "./scheme.js";
+/** What the ledger says about a settlement transaction. */
+export type SettlementOutcome = {
+    status: "SUCCESS";
+} | {
+    status: "FAILED";
+    events: xdr.DiagnosticEvent[];
+} | {
+    status: "NOT_FOUND";
+};
+/** Reconciliation window: ~10 s, one RPC read per second. */
+export declare const RECONCILE_ATTEMPTS = 10;
+export declare const RECONCILE_DELAY_MS = 1000;
+/**
+ * Asks the network what actually happened to a settlement transaction.
+ *
+ * The facilitator answers `settle_exact_stellar_transaction_failed` both for a
+ * transaction the ledger rejected *and* for one it simply stopped waiting for
+ * (its own poll gives up after `maxTimeoutSeconds`), so its "failed" cannot be
+ * read as "the payment did not happen" — inclusion can follow the answer. This
+ * asks the RPC directly and distinguishes the three real outcomes:
+ *
+ * - `SUCCESS`   — the payment settled; the card was debited even though the
+ *   server reported a failure and withheld the resource.
+ * - `FAILED`    — the ledger rejected it; `events` carry the reason, including
+ *   the card's own `__check_auth` verdict when that is what refused.
+ * - `NOT_FOUND` — still not visible when the window closed; the settlement
+ *   state is unknown.
+ *
+ * An RPC error is treated as "not seen yet", not as an answer: a reconciliation
+ * we could not complete must never be reported as a failed payment.
+ */
+export declare function reconcileSettlement(rpcUrl: string, network: StellarNetwork, hash: string, opts?: {
+    attempts?: number;
+    delayMs?: number;
+}): Promise<SettlementOutcome>;

package/dist/reconcile.js

@@ -0,0 +1,44 @@
+import { rpc } from "@stellar/stellar-sdk";
+/** Reconciliation window: ~10 s, one RPC read per second. */
+export const RECONCILE_ATTEMPTS = 10;
+export const RECONCILE_DELAY_MS = 1000;
+/**
+ * Asks the network what actually happened to a settlement transaction.
+ *
+ * The facilitator answers `settle_exact_stellar_transaction_failed` both for a
+ * transaction the ledger rejected *and* for one it simply stopped waiting for
+ * (its own poll gives up after `maxTimeoutSeconds`), so its "failed" cannot be
+ * read as "the payment did not happen" — inclusion can follow the answer. This
+ * asks the RPC directly and distinguishes the three real outcomes:
+ *
+ * - `SUCCESS`   — the payment settled; the card was debited even though the
+ *   server reported a failure and withheld the resource.
+ * - `FAILED`    — the ledger rejected it; `events` carry the reason, including
+ *   the card's own `__check_auth` verdict when that is what refused.
+ * - `NOT_FOUND` — still not visible when the window closed; the settlement
+ *   state is unknown.
+ *
+ * An RPC error is treated as "not seen yet", not as an answer: a reconciliation
+ * we could not complete must never be reported as a failed payment.
+ */
+export async function reconcileSettlement(rpcUrl, network, hash, opts = {}) {
+    const attempts = opts.attempts ?? RECONCILE_ATTEMPTS;
+    const delayMs = opts.delayMs ?? RECONCILE_DELAY_MS;
+    const server = new rpc.Server(rpcUrl, { allowHttp: network === "stellar:testnet" });
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const tx = await server.getTransaction(hash);
+            if (tx.status === "SUCCESS")
+                return { status: "SUCCESS" };
+            if (tx.status === "FAILED")
+                return { status: "FAILED", events: tx.diagnosticEventsXdr ?? [] };
+        }
+        catch {
+            /* not visible yet, or the RPC hiccuped: keep waiting */
+        }
+        if (i < attempts - 1)
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+    return { status: "NOT_FOUND" };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAY,MAAM,sBAAsB,CAAC;AASrD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAAuB,EACvB,IAAY,EACZ,OAAgD,EAAE;IAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,KAAK,iBAAiB,EAAE,CAAC,CAAC;IAEpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1D,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC"}

package/dist/scheme.d.ts

@@ -0,0 +1,93 @@
+import { Keypair, contract } from "@stellar/stellar-sdk";
+import type { PaymentPayloadResult, PaymentRequirements, SchemeNetworkClient } from "@x402/core/types";
+import { CardPolicyDenied, PaymentError } from "./denial.js";
+export type StellarNetwork = "stellar:testnet" | "stellar:pubnet";
+/**
+ * How far ahead the card's auth entry may be valid.
+ *
+ * The facilitator computes `maxLedger = currentLedger + ceil(maxTimeoutSeconds
+ * / estimatedLedgerSeconds)` and rejects an entry more than 2 ledgers beyond
+ * it (`invalid_exact_stellar_signature_expiration_too_far`). Its estimate is
+ * sampled from Horizon, so it can be slower than the 5 s the stock client
+ * assumes — on pubnet it usually is. Aiming low costs nothing: the expiry only
+ * has to outlive settlement, and a shorter one is never rejected.
+ */
+export declare function authExpirationLedgers(maxTimeoutSeconds: number): number;
+export interface CardSchemeOptions {
+    /** Card contract address (C...). The card is the payer. */
+    card: string;
+    /** Agent keypair registered as the card's signer. */
+    agent: Keypair;
+    network: StellarNetwork;
+    /** Required on pubnet; optional on testnet. */
+    rpcUrl?: string;
+    /** Base URL of the Mooring app used in the allow link (default `DEFAULT_APP_URL`). */
+    appUrl?: string;
+    /** The (query-stripped) URL being paid for; lets a denial carry the allow link. */
+    requestUrl?: string;
+    /** Called when the card rejects the payment in the enforcing simulation. */
+    onDenial?: (denial: CardPolicyDenied) => void;
+    /** Called when the payment fails for a reason that is not the card's policy. */
+    onPaymentError?: (error: PaymentError) => void;
+}
+/**
+ * x402 "exact" scheme client whose payer is a Mooring card (a Soroban custom
+ * account). It produces exactly the same payload as `@x402/stellar`'s
+ * `ExactStellarScheme` — one `invokeHostFunction` calling
+ * `asset.transfer(card, payTo, amount)`, re-simulated after signing, returned
+ * as a base64 transaction envelope. Only the signing differs: the card's auth
+ * entries are signed by the agent key through `signCardAuthEntries`, so
+ * `__check_auth` enforces the budget, allowlist and expiry at settlement.
+ */
+export declare class CardExactStellarScheme implements SchemeNetworkClient {
+    readonly scheme = "exact";
+    readonly findDefaultAsset: import("@x402/core/types").FindDefaultAsset<import("@x402/core/types").DefaultAsset>;
+    private readonly card;
+    private readonly agent;
+    private readonly network;
+    private readonly rpcUrl;
+    private readonly passphrase;
+    private readonly appUrl?;
+    private readonly requestUrl?;
+    private readonly onDenial?;
+    private readonly onPaymentError?;
+    constructor(opts: CardSchemeOptions);
+    /** Throws unless the requirements are an `exact` payment this client can make. */
+    validateRequirements(req: PaymentRequirements): void;
+    createPaymentPayload(x402Version: number, req: PaymentRequirements): Promise<PaymentPayloadResult>;
+    /**
+     * Turns a failed enforcing simulation into a typed denial when it was the
+     * card's `__check_auth` that said no.
+     *
+     * The card's address alone is not evidence: it appears in the `transfer`
+     * arguments of every diagnostic this transaction can produce, and the token's
+     * own error codes overlap the card's 1–8 range — a SAC balance error would be
+     * read as a policy decision. What identifies an auth failure is the host's
+     * phrase, which names the failing account and its error together:
+     *
+     *   ["failed account authentication with error", <card>, Error(Contract, #N)]
+     *
+     * so the reason is taken from that fragment and nowhere else. Anything that
+     * does not match stays an ordinary error.
+     */
+    private denialFromCard;
+    /**
+     * Refuses to build a payment whose card auth entry the deployed facilitator
+     * cannot decode.
+     *
+     * `buildTransfer` asks the RPC to record legacy v1 `ADDRESS` credentials
+     * (`useUpgradedAuth: false`) because OZ Channels rejects CAP-71 `ADDRESS_V2`
+     * as `invalid_exact_stellar_payload_malformed`. That flag is transitional —
+     * it becomes a no-op from protocol 28 — and an RPC or SDK that ignores it
+     * would otherwise produce a payload that is signed, sent and refused with a
+     * reason that says nothing about why. This checks what was actually
+     * recorded, and fails before the agent key signs anything.
+     */
+    private assertLegacyCardCredentials;
+    /** Builds and simulates `asset.transfer(from, to, amount)` (SEP-41). */
+    protected buildTransfer(asset: string, from: string, to: string, amount: bigint): Promise<contract.AssembledTransaction<unknown>>;
+    /** Signs the card's auth entries with the agent key. */
+    protected sign(tx: contract.AssembledTransaction<unknown>, expirationLedger: number): Promise<void>;
+    /** Current ledger sequence, used as the auth-entry expiration base. */
+    protected latestLedger(): Promise<number>;
+}