Stablecoin payouts, with the controls finance asks for.

// 1. The ABI: any subset of the contract, readable or JSON
const abi = await cryptorail.POST('/v1/abis', {
  body: {
    fragments: [
      'function transfer(address to, uint256 amount) returns (bool)',
      'function balanceOf(address owner) view returns (uint256)',
      'event Transfer(address indexed from, address indexed to, uint256 value)',
    ],
  },
})

// 2. The contract: an address on a chain, under a name of yours
const usdc = await cryptorail.POST('/v1/contracts', {
  body: {
    chainId: 84532,
    address: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',
    label: 'pack-usdc',
    abiId: abi.data!.id,
    checkSelectors: true,   // every function must be in the deployed code
  },
})

// 3. Every function is now a call by name, arguments checked
//    against the ABI before anything is signed
await cryptorail.POST('/v1/contracts/{id}/call', {       // a read
  params: { path: { id: usdc.data!.id } },
  body: { function: 'balanceOf', args: [treasury] },
})
await cryptorail.POST('/v1/transactions', {               // a write
  body: {
    chainId: 84532,
    actor: { kind: 'identity', identityId: treasuryId },
    target: {
      kind: 'contract', contractId: usdc.data!.id,
      function: 'transfer', args: [supplierA, '2000000'],
    },
  },
})
// The same events, decoded by name, feed subscriptions and webhooks

# Check every fact of the pack against the chain, at its pinned block
node packages/pack-stablecoins/dist/bin.js verify --network base-sepolia

# Print the payout policy for the service's configuration
node packages/pack-stablecoins/dist/bin.js policy --network base-sepolia \
  --beneficiaries 0xa1…,0xb0… --threshold 5 --cap USDC=12 \
  --approvers <approver id>

# Register the tokens, the ERP's webhook and the Transfer subscriptions
CRYPTORAIL_API_KEY=<admin key> \
node packages/pack-stablecoins/dist/bin.js setup --network base-sepolia \
  --url <service URL> --receiving <treasury> --webhook <ERP URL>
# It prints what it registered, and the webhook's secret once

import { BASE_SEPOLIA, payoutPolicy } from '@cryptorail/pack-stablecoins'

// The same document the command line prints, built in code
const policy = payoutPolicy({
  version: 'treasury-2026-10',      // recorded with every decision
  network: BASE_SEPOLIA,
  beneficiaries: [supplierA, supplierB],
  dailyCap: { USDC: '12' },          // in USDC, all payouts of the day
  approvalThreshold: '5',            // from 5 USDC an approver signs
  approverIds: [treasurerId],
})

// Service configuration:
// adapters: { policy: { kind: 'rules', options: policy } }

import { createClient } from '@cryptorail/sdk'

const cryptorail = createClient({ baseUrl, apiKey })

// The ERP's payment id as idempotency key: a retry never pays twice
const { data } = await cryptorail.POST('/v1/transactions', {
  params: { header: { 'idempotency-key': `payout-${erpPaymentId}` } },
  body: {
    chainId: 84532,                      // Base Sepolia
    actor: { kind: 'identity', identityId: treasuryId },
    target: {
      kind: 'contract',
      contractId: usdcId,                // registered by the pack
      function: 'transfer',
      args: [supplierA, '2000000'],      // 2 USDC, six decimals
    },
  },
})

const tx = await cryptorail.GET('/v1/transactions/{id}', {
  params: { path: { id: data!.transactionId } },
})
// tx.data.state: CONFIRMED, PENDING_APPROVAL or REJECTED_BY_POLICY

// An unlisted beneficiary: refused before anything is signed
{
  "state": "REJECTED_BY_POLICY",
  "failure": {
    "stage": "policy",
    "cause": "policy.operation-denied",
    …
  }
}
// Over the day's cap, the cause is "policy.limit-exceeded"

// What the approver reads: the decoded call, beneficiary and amount
const approval = await cryptorail.GET('/v1/approvals/{transactionId}', {
  params: { path: { transactionId } },
})

// EIP-712 typed data with neither nonce nor fee: it never goes stale.
// Any wallet signs it, MetaMask included:
const signature = await wallet.request({
  method: 'eth_signTypedData_v4',
  params: [approverAddress, JSON.stringify(approval.data!.typedData)],
})

const signed = await cryptorail.POST(
  '/v1/approvals/{transactionId}/signatures',
  {
    params: { path: { transactionId } },
    body: { approverId: treasurerId, signature },
  },
)
// signed.data.quorumReached: the payout goes on to signing

import { verifyWebhook } from '@cryptorail/core'

// In the ERP's webhook endpoint, before trusting anything
const check = verifyWebhook([webhookSecret], {
  id: headers['webhook-id'],
  timestamp: headers['webhook-timestamp'],
  signatureHeader: headers['webhook-signature'],
  body: rawBody,
  nowSeconds: Math.floor(Date.now() / 1000),
})
if (!check.ok) return reply(401)    // never recorded

for (const event of JSON.parse(rawBody).events) {
  // event.type: 'contract.event', or 'contract.event-reverted'
  //   (with payload.originalEventId) if the chain took it back
  // event.payload: { contractLabel: 'pack-usdc',
  //   eventName: 'Transfer', params: { from, to, value }, … }
  // event.id is stable: apply each one exactly once
}