LumenBazaar Contracts

Soroban contracts for capped metered x402 upto payment sessions, optional smart-wallet policy examples, test token utilities, generated bindings, deployment scripts, and contract security evidence.

Contracts

contracts/
  upto-session/
  policy-wallet-example/
  test-token/

The first production-oriented contract is upto-session. It lets a buyer authorize a maximum spend for one resource while the seller settles only the actual usage amount.

policy-wallet-example is example-only smart account policy code.

test-token is reserved for local and testnet utility token behavior.

Local Verification

Reproducible contract WASM builds require the exact versions in docs/release-toolchain.md, including Stellar CLI 28.0.0. Newer or older CLI optimizers can produce a different WASM hash from the reviewed release even when the Rust source is unchanged.

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-features
stellar contract build --locked
node scripts/report-resource-usage.mjs
node scripts/check-backend-handoff.mjs
node scripts/check-security-checklist.mjs
node scripts/check-audit-readiness.mjs

Backend integration notes are in docs/backend-integration-handoff.md. Security review evidence is in docs/security-checklist.md. Audit readiness notes are in docs/audit-readiness.md. Authorization boundaries and known limitations are in docs/threat-model.md.

Local Deployment

Set a local Stellar network in the CLI, then run:

node scripts/local/deploy-local.mjs
node scripts/local/initialize-local.mjs

Use --dry-run with either script to print commands without submitting transactions. See scripts/local/sample-commands.md for create, settle, cancel, and inspect examples.

Testnet Deployment

Export the values from .env.testnet.example, then run:

node scripts/testnet/deploy-testnet.mjs
node scripts/testnet/initialize-testnet.mjs
node scripts/testnet/verify-testnet.mjs

The scripts write an ignored deployments/testnet.json and ignored network receipts. Publish a sanitized manifest with node scripts/testnet/generate-public-manifest.mjs; see deployments/README.md for what it refuses to write, the live rejection runner, and the scheduled Horizon verification. Sanitized public deployment evidence is in deployments/testnet-2026-09-06.json; it records the test-only LBT asset accurately and does not claim that deployment alone proves a live payment. To produce fresh create, settle, cancel, and replay evidence on testnet, see docs/testnet-lifecycle-smoke.md.

Related Repositories

• Frontend
• Backend
• Documentation