Emergency stop for the sole money-moving path.
fn pause(env: soroban_sdk::Env)Restore the money-moving path after an emergency stop.
fn unpause(env: soroban_sdk::Env)Replace this contract's WASM at the same address. Upgrades require the administrator's authorization and an already-paused money path.
fn upgrade(
env: soroban_sdk::Env,
new_wasm_hash: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>Current operational administrator.
fn get_admin(env: soroban_sdk::Env) -> soroban_sdk::AddressRead the emergency-stop state without authorization.
fn is_paused(env: soroban_sdk::Env) -> boolNon-value-moving accessor for inspection and off-chain preflight. A successful read may refresh the mandate's persistence horizon.
fn get_mandate(
env: soroban_sdk::Env,
mandate_id: soroban_sdk::BytesN<32>,
) -> ResultAccept a pending handoff. Authorized by the proposed administrator.
fn accept_admin(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>Atomically establishes the initial administrator during deployment. Constructors run only once; WASM upgrades do not rerun them.
fn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
initial_asset: soroban_sdk::Address,
)Propose a recoverable authority handoff. The current administrator keeps
control until the candidate proves control by calling accept_admin.
fn propose_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)User withdrawal of consent. Authorized by the bound user.
fn revoke_mandate(
env: soroban_sdk::Env,
mandate_id: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>The only money path. State consumption and transfer are atomic; a token
failure reverts the stored spent, seq, and status changes.
fn execute_payment(
env: soroban_sdk::Env,
mandate_id: soroban_sdk::BytesN<32>,
amount: i128,
expected_seq: u32,
) -> Result<(), soroban_sdk::Error>Whether an asset is currently admitted for validation and settlement.
fn is_asset_allowed(env: soroban_sdk::Env, asset: soroban_sdk::Address) -> boolStore a user-authorized mandate. Mutable fields are initialized by the contract so the caller cannot seed a spent balance, sequence, or status.
fn register_mandate(
env: soroban_sdk::Env,
user: soroban_sdk::Address,
agent: soroban_sdk::Address,
merchant: soroban_sdk::Address,
asset: soroban_sdk::Address,
max_amount: i128,
expiry: u64,
vc_hash: soroban_sdk::BytesN<32>,
) -> Result, soroban_sdk::Error> Non-value-moving preview. It may refresh TTLs; the authoritative checks
are repeated by execute_payment against current stored state.
fn validate_mandate(
env: soroban_sdk::Env,
mandate_id: soroban_sdk::BytesN<32>,
amount: i128,
expected_seq: u32,
merchant: soroban_sdk::Address,
asset: soroban_sdk::Address,
) -> Result<(), soroban_sdk::Error>Deterministically derive the domain-separated identifier returned by
register_mandate without depending on any x402 wire representation.
fn derive_mandate_id(
env: soroban_sdk::Env,
user: soroban_sdk::Address,
agent: soroban_sdk::Address,
merchant: soroban_sdk::Address,
asset: soroban_sdk::Address,
max_amount: i128,
expiry: u64,
vc_hash: soroban_sdk::BytesN<32>,
) -> soroban_sdk::BytesN<32>Candidate administrator waiting to accept a proposed handoff.
fn get_pending_admin(env: soroban_sdk::Env) -> OptionChange the reviewed-token admission policy. Policy changes are allowed only while the money path is paused; removal also blocks existing mandates from executing against that asset.
fn set_asset_allowed(
env: soroban_sdk::Env,
asset: soroban_sdk::Address,
allowed: bool,
) -> Result<(), soroban_sdk::Error>Current durable storage schema. Money-path methods reject a missing or unexpected version so an incompatible upgrade cannot fail open.
fn get_schema_version(env: soroban_sdk::Env) -> Result