Soroban contracts for capped metered x402 upto payment sessions, optional
smart-wallet policy examples, test token utilities, generated bindings,
deployment scripts, and contract security evidence.
contracts/
upto-session/
policy-wallet-example/
test-token/The first production-oriented contract is upto-session. It lets a buyer
authorize a maximum spend for one resource while the seller settles only the
actual usage amount.
policy-wallet-example is example-only smart account policy code.
test-token is reserved for local and testnet utility token behavior.
Contract WASM builds require stellar-cli 25.2.0 or newer.
cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-features
stellar contract build --locked
node scripts/report-resource-usage.mjs
node scripts/check-backend-handoff.mjs
node scripts/check-security-checklist.mjs
node scripts/check-audit-readiness.mjsBackend integration notes are in docs/backend-integration-handoff.md.
Security review evidence is in docs/security-checklist.md.
Audit readiness notes are in docs/audit-readiness.md.
Authorization boundaries and known limitations are in docs/threat-model.md.
Set a local Stellar network in the CLI, then run:
node scripts/local/deploy-local.mjs
node scripts/local/initialize-local.mjsUse --dry-run with either script to print commands without submitting transactions. See scripts/local/sample-commands.md for create, settle, cancel, and inspect examples.
Export the values from .env.testnet.example, then run:
node scripts/testnet/deploy-testnet.mjs
node scripts/testnet/initialize-testnet.mjs
node scripts/testnet/verify-testnet.mjsThe scripts write an ignored deployments/testnet.json. Sanitized public deployment evidence is in
deployments/testnet-2026-09-06.json; it records the test-only LBT asset accurately and does not
claim that deployment alone proves a live payment.