diff --git a/packages/core/src/client/TransactionPoller.ts b/packages/core/src/client/TransactionPoller.ts
index cfe7278f8..deffc2637 100644
--- a/packages/core/src/client/TransactionPoller.ts
+++ b/packages/core/src/client/TransactionPoller.ts
@@ -1,127 +1,127 @@
-import { TransactionStatus } from "../types/transaction.js";
-import { TransactionResponse } from "../types/transaction.js";
-import { SapiomClient } from "./SapiomClient.js";
-
-/**
- * Transaction polling result
- */
-export type TransactionPollResult =
-  | { status: "authorized"; transaction: TransactionResponse }
-  | { status: "denied"; transaction: TransactionResponse }
-  | { status: "timeout" };
-
-/**
- * Configuration for transaction polling
- */
-export interface TransactionPollingConfig {
-  timeout?: number; // Default: 30000ms
-  pollInterval?: number; // Default: 1000ms
-}
-
-/**
- * Shared transaction polling with atomic reference counting
- * Used by both PaymentHandler and AuthorizationHandler
- */
-export class TransactionPoller {
-  private pollingPromises = new Map<
-    string,
-    {
-      promise: Promise<TransactionPollResult>;
-      refCount: number;
-    }
-  >();
-
-  constructor(
-    private sapiomClient: SapiomClient,
-    private config: TransactionPollingConfig,
-  ) {}
-
-  /**
-   * Polls transaction status until authorized/denied/timeout
-   * Uses atomic Map.set() operations to prevent race conditions
-   */
-  async waitForAuthorization(
-    transactionId: string,
-  ): Promise<TransactionPollResult> {
-    const entry = this.pollingPromises.get(transactionId);
-
-    if (entry) {
-      // Atomic increment
-      this.pollingPromises.set(transactionId, {
-        promise: entry.promise,
-        refCount: entry.refCount + 1,
-      });
-
-      try {
-        return await entry.promise;
-      } finally {
-        // Atomic decrement
-        const current = this.pollingPromises.get(transactionId);
-        if (current && current.refCount > 1) {
-          this.pollingPromises.set(transactionId, {
-            promise: current.promise,
-            refCount: current.refCount - 1,
-          });
-        } else {
-          this.pollingPromises.delete(transactionId);
-        }
-      }
-    }
-
-    const pollingPromise = this.pollTransactionStatus(transactionId);
-
-    this.pollingPromises.set(transactionId, {
-      promise: pollingPromise,
-      refCount: 1,
-    });
-
-    try {
-      return await pollingPromise;
-    } finally {
-      const current = this.pollingPromises.get(transactionId);
-      if (current) {
-        const newCount = current.refCount - 1;
-        if (newCount === 0) {
-          this.pollingPromises.delete(transactionId);
-        } else {
-          this.pollingPromises.set(transactionId, {
-            ...current,
-            refCount: newCount,
-          });
-        }
-      }
-    }
-  }
-
-  /**
-   * Internal polling implementation
-   * Returns the final transaction to avoid redundant API calls
-   */
-  private async pollTransactionStatus(
-    transactionId: string,
-  ): Promise<TransactionPollResult> {
-    const timeout = this.config.timeout ?? 30000;
-    const pollInterval = this.config.pollInterval ?? 1000;
-    const startTime = Date.now();
-
-    while (Date.now() - startTime < timeout) {
-      const transaction =
-        await this.sapiomClient.transactions.get(transactionId);
-
-      if (transaction.status === TransactionStatus.AUTHORIZED) {
-        return { status: "authorized", transaction };
-      }
-
-      if (
-        transaction.status === TransactionStatus.DENIED ||
-        transaction.status === TransactionStatus.CANCELLED
-      ) {
-        return { status: "denied", transaction };
-      }
-
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
-    }
-
-    return { status: "timeout" };
-  }
-}
+import { TransactionStatus } from "../types/transaction.js";
+import { TransactionResponse } from "../types/transaction.js";
+import { SapiomClient } from "./SapiomClient.js";
+
+/**
+ * Transaction polling result
+ */
+export type TransactionPollResult =
+  | { status: "authorized"; transaction: TransactionResponse }
+  | { status: "denied"; transaction: TransactionResponse }
+  | { status: "timeout" };
+
+/**
+ * Configuration for transaction polling
+ */
+export interface TransactionPollingConfig {
+  timeout?: number; // Default: 30000ms
+  pollInterval?: number; // Default: 1000ms
+}
+
+/**
+ * Shared transaction polling with atomic reference counting
+ * Used by both PaymentHandler and AuthorizationHandler
+ */
+export class TransactionPoller {
+  private pollingPromises = new Map<
+    string,
+    {
+      promise: Promise<TransactionPollResult>;
+      refCount: number;
+    }
+  >();
+
+  constructor(
+    private sapiomClient: SapiomClient,
+    private config: TransactionPollingConfig,
+  ) {}
+
+  /**
+   * Polls transaction status until authorized/denied/timeout
+   * Uses atomic Map.set() operations to prevent race conditions
+   */
+  async waitForAuthorization(
+    transactionId: string,
+  ): Promise<TransactionPollResult> {
+    const entry = this.pollingPromises.get(transactionId);
+
+    if (entry) {
+      // Atomic increment
+      this.pollingPromises.set(transactionId, {
+        promise: entry.promise,
+        refCount: entry.refCount + 1,
+      });
+
+      try {
+        return await entry.promise;
+      } finally {
+        // Atomic decrement
+        const current = this.pollingPromises.get(transactionId);
+        if (current && current.refCount > 1) {
+          this.pollingPromises.set(transactionId, {
+            promise: current.promise,
+            refCount: current.refCount - 1,
+          });
+        } else {
+          this.pollingPromises.delete(transactionId);
+        }
+      }
+    }
+
+    const pollingPromise = this.pollTransactionStatus(transactionId);
+
+    this.pollingPromises.set(transactionId, {
+      promise: pollingPromise,
+      refCount: 1,
+    });
+
+    try {
+      return await pollingPromise;
+    } finally {
+      const current = this.pollingPromises.get(transactionId);
+      if (current) {
+        const newCount = current.refCount - 1;
+        if (newCount === 0) {
+          this.pollingPromises.delete(transactionId);
+        } else {
+          this.pollingPromises.set(transactionId, {
+            ...current,
+            refCount: newCount,
+          });
+        }
+      }
+    }
+  }
+
+  /**
+   * Internal polling implementation
+   * Returns the final transaction to avoid redundant API calls
+   */
+  private async pollTransactionStatus(
+    transactionId: string,
+  ): Promise<TransactionPollResult> {
+    const timeout = this.config.timeout ?? 30000;
+    const pollInterval = this.config.pollInterval ?? 1000;
+    const startTime = Date.now();
+
+    while (Date.now() - startTime < timeout) {
+      const transaction =
+        await this.sapiomClient.transactions.get(transactionId);
+
+      if (transaction?.status === TransactionStatus.AUTHORIZED) {
+        return { status: "authorized", transaction };
+      }
+
+      if (
+        transaction?.status === TransactionStatus.DENIED ||
+        transaction?.status === TransactionStatus.CANCELLED
+      ) {
+        return { status: "denied", transaction };
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+
+    return { status: "timeout" };
+  }
+}
\ No newline at end of file
diff --git a/packages/fetch/src/failureMode.test.ts b/packages/fetch/src/failureMode.test.ts
index 9b82a177d..88c07c19e 100644
--- a/packages/fetch/src/failureMode.test.ts
+++ b/packages/fetch/src/failureMode.test.ts
@@ -1,266 +1,277 @@
-/**
- * Critical tests for failureMode behavior
- * These tests ensure Sapiom failures don't break customer apps
- */
-import { createFetch } from "./fetch";
-import { SapiomClient, TransactionAPI } from "@sapiom/core";
-import fetchMock from "@fetch-mock/jest";
-
-describe("Fetch failureMode", () => {
-  let mockTransactionAPI: jest.Mocked<TransactionAPI>;
-  let mockSapiomClient: SapiomClient;
-
-  beforeAll(() => {
-    fetchMock.mockGlobal();
-  });
-
-  beforeEach(() => {
-    mockTransactionAPI = {
-      create: jest.fn(),
-      get: jest.fn(),
-      reauthorizeWithPayment: jest.fn(),
-      list: jest.fn(),
-      isAuthorized: jest.fn(),
-      isCompleted: jest.fn(),
-      requiresPayment: jest.fn(),
-      getPaymentDetails: jest.fn(),
-    } as any;
-
-    mockSapiomClient = {
-      transactions: mockTransactionAPI,
-    } as any;
-
-    fetchMock.removeRoutes();
-  });
-
-  afterAll(() => {
-    fetchMock.unmockGlobal();
-  });
-
-  describe('failureMode: "open" (default)', () => {
-    it("should allow request when Sapiom API returns 500", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockRejectedValue(
-        new Error("Sapiom API returned 500"),
-      );
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "open",
-      });
-
-      const response = await fetch("https://api.example.com/test");
-      expect(response.status).toBe(200);
-      const data = await response.json();
-      expect(data).toEqual({ data: "success" });
-    });
-
-    it("should allow request when Sapiom API times out", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockRejectedValue(
-        new Error("ETIMEDOUT: Sapiom API timeout"),
-      );
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-      }); // Default is "open"
-
-      const response = await fetch("https://api.example.com/test");
-      expect(response.status).toBe(200);
-    });
-
-    it("should allow request when SDK throws unexpected error", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockImplementation(() => {
-        throw new TypeError("Cannot read property 'foo' of undefined");
-      });
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "open",
-      });
-
-      const response = await fetch("https://api.example.com/test");
-      expect(response.status).toBe(200);
-    });
-
-    it("should return original 402 when payment handling fails", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 402,
-        body: {
-          x402Version: 1,
-          accepts: [
-            {
-              scheme: "exact",
-              network: "base",
-              maxAmountRequired: "1000000",
-              resourceName: "https://api.example.com/test",
-              payTo: "0x123",
-              asset: "0xUSDC",
-            },
-          ],
-        },
-      });
-
-      mockTransactionAPI.create.mockRejectedValue(
-        new Error("Sapiom API error"),
-      );
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "open",
-      });
-
-      const response = await fetch("https://api.example.com/test");
-      // Should get original 402, not Sapiom error
-      expect(response.status).toBe(402);
-    });
-  });
-
-  describe('failureMode: "closed"', () => {
-    it("should throw when Sapiom API returns 500", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockRejectedValue(
-        new Error("Sapiom API returned 500"),
-      );
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "closed",
-      });
-
-      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
-        "Sapiom API returned 500",
-      );
-    });
-
-    it("should throw when Sapiom API times out", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockRejectedValue(new Error("ETIMEDOUT"));
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "closed",
-      });
-
-      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
-        "ETIMEDOUT",
-      );
-    });
-
-    it("should throw when SDK has bugs", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockImplementation(() => {
-        throw new TypeError("SDK bug");
-      });
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "closed",
-      });
-
-      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
-        "SDK bug",
-      );
-    });
-
-    it("should throw when payment handling fails", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 402,
-        body: {
-          x402Version: 1,
-          accepts: [
-            {
-              scheme: "exact",
-              network: "base",
-              maxAmountRequired: "1000000",
-              resourceName: "https://api.example.com/test",
-              payTo: "0x123",
-              asset: "0xUSDC",
-            },
-          ],
-        },
-      });
-
-      mockTransactionAPI.create.mockRejectedValue(
-        new Error("Sapiom payment API error"),
-      );
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "closed",
-      });
-
-      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
-        "Sapiom payment API error",
-      );
-    });
-  });
-
-  describe("default behavior", () => {
-    it('should default to "open" when not specified', async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockRejectedValue(new Error("Sapiom error"));
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        // No failureMode specified
-      });
-
-      // Should not throw (defaults to "open")
-      const response = await fetch("https://api.example.com/test");
-      expect(response.status).toBe(200);
-    });
-  });
-
-  describe("CRITICAL: Authorization denied should ALWAYS throw", () => {
-    it("should throw AuthorizationDeniedError even with failureMode open", async () => {
-      fetchMock.get("https://api.example.com/test", {
-        status: 200,
-        body: { data: "success" },
-      });
-
-      mockTransactionAPI.create.mockResolvedValue({
-        id: "tx_123",
-        status: "denied",
-      } as any);
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        failureMode: "open",
-      });
-
-      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
-        "Authorization denied",
-      );
-    });
-  });
-});
+/**
+ * Critical tests for failureMode behavior
+ * These tests ensure Sapiom failures don't break customer apps
+ */
+import { createFetch } from "./fetch";
+import { SapiomClient, TransactionAPI } from "@sapiom/core";
+import fetchMock from "@fetch-mock/jest";
+
+describe("Fetch failureMode", () => {
+  let mockTransactionAPI: jest.Mocked<TransactionAPI>;
+  let mockSapiomClient: SapiomClient;
+
+  beforeAll(() => {
+    fetchMock.mockGlobal();
+  });
+
+  beforeEach(() => {
+    mockTransactionAPI = {
+      create: jest.fn(),
+      get: jest.fn(),
+      reauthorizeWithPayment: jest.fn(),
+      list: jest.fn(),
+      isAuthorized: jest.fn(),
+      isCompleted: jest.fn(),
+      requiresPayment: jest.fn(),
+      getPaymentDetails: jest.fn(),
+    } as any;
+
+    mockSapiomClient = {
+      transactions: mockTransactionAPI,
+    } as any;
+
+    fetchMock.removeRoutes();
+  });
+
+  afterAll(() => {
+    fetchMock.unmockGlobal();
+  });
+
+  describe('failureMode: "open"', () => {
+    let consoleErrorSpy: jest.SpyInstance;
+
+    beforeEach(() => {
+      // Mock console.error to prevent expected errors from polluting the test output
+      consoleErrorSpy = jest.spyOn(console, "error").mockImplementation(() => {});
+    });
+
+    afterEach(() => {
+      consoleErrorSpy.mockRestore();
+    });
+
+    it("should allow request when Sapiom API returns 500", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockRejectedValue(
+        new Error("Sapiom API returned 500"),
+      );
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "open",
+      });
+
+      const response = await fetch("https://api.example.com/test");
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual({ data: "success" });
+    });
+
+    it("should allow request when Sapiom API times out", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockRejectedValue(
+        new Error("ETIMEDOUT: Sapiom API timeout"),
+      );
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "open", // Explicitly set to open for testing
+      });
+
+      const response = await fetch("https://api.example.com/test");
+      expect(response.status).toBe(200);
+    });
+
+    it("should allow request when SDK throws unexpected error", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockImplementation(() => {
+        throw new TypeError("Cannot read property 'foo' of undefined");
+      });
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "open",
+      });
+
+      const response = await fetch("https://api.example.com/test");
+      expect(response.status).toBe(200);
+    });
+
+    it("should return original 402 when payment handling fails", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 402,
+        body: {
+          x402Version: 1,
+          accepts: [
+            {
+              scheme: "exact",
+              network: "base",
+              maxAmountRequired: "1000000",
+              resourceName: "https://api.example.com/test",
+              payTo: "0x123",
+              asset: "0xUSDC",
+            },
+          ],
+        },
+      });
+
+      mockTransactionAPI.create.mockRejectedValue(
+        new Error("Sapiom API error"),
+      );
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "open",
+      });
+
+      const response = await fetch("https://api.example.com/test");
+      // Should get original 402, not Sapiom error
+      expect(response.status).toBe(402);
+    });
+  });
+
+  describe('failureMode: "closed"', () => {
+    it("should throw when Sapiom API returns 500", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockRejectedValue(
+        new Error("Sapiom API returned 500"),
+      );
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "closed",
+      });
+
+      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
+        "Sapiom API returned 500",
+      );
+    });
+
+    it("should throw when Sapiom API times out", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockRejectedValue(new Error("ETIMEDOUT"));
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "closed",
+      });
+
+      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
+        "ETIMEDOUT",
+      );
+    });
+
+    it("should throw when SDK has bugs", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockImplementation(() => {
+        throw new TypeError("SDK bug");
+      });
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "closed",
+      });
+
+      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
+        "SDK bug",
+      );
+    });
+
+    it("should throw when payment handling fails", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 402,
+        body: {
+          x402Version: 1,
+          accepts: [
+            {
+              scheme: "exact",
+              network: "base",
+              maxAmountRequired: "1000000",
+              resourceName: "https://api.example.com/test",
+              payTo: "0x123",
+              asset: "0xUSDC",
+            },
+          ],
+        },
+      });
+
+      mockTransactionAPI.create.mockRejectedValue(
+        new Error("Sapiom payment API error"),
+      );
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "closed",
+      });
+
+      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
+        "Sapiom payment API error",
+      );
+    });
+  });
+
+  describe("default behavior", () => {
+    it('should default to "closed" when not specified', async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockRejectedValue(new Error("Sapiom error"));
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        // No failureMode specified
+      });
+
+      // Should throw (defaults to "closed")
+      await expect(fetch("https://api.example.com/test")).rejects.toThrow("Sapiom error");
+    });
+  });
+
+  describe("CRITICAL: Authorization denied should ALWAYS throw", () => {
+    it("should throw AuthorizationDeniedError even with failureMode open", async () => {
+      fetchMock.get("https://api.example.com/test", {
+        status: 200,
+        body: { data: "success" },
+      });
+
+      mockTransactionAPI.create.mockResolvedValue({
+        id: "tx_123",
+        status: "denied",
+      } as any);
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        failureMode: "open",
+      });
+
+      await expect(fetch("https://api.example.com/test")).rejects.toThrow(
+        "Authorization denied",
+      );
+    });
+  });
+});
\ No newline at end of file
diff --git a/packages/fetch/src/fetch.ts b/packages/fetch/src/fetch.ts
index ea97ee485..46de3f33a 100644
--- a/packages/fetch/src/fetch.ts
+++ b/packages/fetch/src/fetch.ts
@@ -1,190 +1,193 @@
-import { SapiomClient } from "@sapiom/core";
-import {
-  BaseSapiomIntegrationConfig,
-  initializeSapiomClient,
-} from "@sapiom/core";
-import type { TransactionPollingConfig } from "@sapiom/core";
-import {
-  handleAuthorization,
-  handlePayment,
-  handleCompletion,
-  AuthorizationConfig,
-  PaymentConfig,
-  CompletionConfig,
-} from "./interceptors.js";
-
-/**
- * Configuration for Sapiom-enabled Fetch client
- */
-export interface SapiomFetchConfig extends BaseSapiomIntegrationConfig {
-  /**
-   * Polling configuration for transaction authorization.
-   * Overrides default timeout (30s) and poll interval (1s).
-   */
-  polling?: TransactionPollingConfig;
-}
-
-/**
- * Creates a Sapiom-enabled fetch function with automatic authorization and payment handling
- *
- * Drop-in replacement for native fetch() with Sapiom capabilities.
- * Works directly with native Request/Response objects, preserving all native fetch features
- * (FormData, Blob, streams, etc.).
- *
- * @param config - Optional configuration (reads from env vars by default)
- * @returns A fetch function with Sapiom payment and authorization handling
- *
- * @example
- * ```typescript
- * // Simplest usage (reads SAPIOM_API_KEY from environment)
- * import { createFetch } from '@sapiom/fetch';
- *
- * const fetch = createFetch();
- *
- * // Works exactly like native fetch!
- * const response = await fetch('https://api.example.com/premium-endpoint');
- * const data = await response.json();
- * ```
- *
- * @example
- * ```typescript
- * // With API key and default metadata
- * import { createFetch } from '@sapiom/fetch';
- *
- * const fetch = createFetch({
- *   apiKey: 'sk_...',
- *   agentName: 'my-agent',
- *   serviceName: 'my-service'
- * });
- *
- * const response = await fetch('https://api.example.com/data');
- * ```
- *
- * @example
- * ```typescript
- * // With default metadata (applied to all requests)
- * import { createFetch } from '@sapiom/fetch';
- *
- * const fetch = createFetch({
- *   apiKey: 'sk_...',
- *   agentName: 'my-agent',
- *   serviceName: 'my-service'
- * });
- *
- * // Per-request override via __sapiom property
- * const request = new Request('/api/resource', { method: 'POST' });
- * (request as any).__sapiom = {
- *   serviceName: 'different-service',
- *   actionName: 'custom-action'
- * };
- * await fetch(request);
- *
- * // Disable Sapiom for specific request
- * const publicRequest = new Request('/api/public');
- * (publicRequest as any).__sapiom = { enabled: false };
- * await fetch(publicRequest);
- * ```
- */
-export function createFetch(config?: SapiomFetchConfig): typeof fetch {
-  if (config?.enabled === false) {
-    return globalThis.fetch;
-  }
-
-  const sapiomClient = initializeSapiomClient(config);
-
-  const defaultMetadata: Record<string, any> = {};
-  if (config?.agentName) defaultMetadata.agentName = config.agentName;
-  if (config?.agentId) defaultMetadata.agentId = config.agentId;
-  if (config?.serviceName) defaultMetadata.serviceName = config.serviceName;
-  if (config?.traceId) defaultMetadata.traceId = config.traceId;
-  if (config?.traceExternalId)
-    defaultMetadata.traceExternalId = config.traceExternalId;
-  if (config?.integration) defaultMetadata.integration = config.integration;
-  if (config?.enabled !== undefined) defaultMetadata.enabled = config.enabled;
-
-  const failureMode = config?.failureMode ?? "open";
-
-  const authConfig: AuthorizationConfig = {
-    sapiomClient,
-    failureMode,
-    polling: config?.polling,
-  };
-  const paymentConfig: PaymentConfig = {
-    sapiomClient,
-    failureMode,
-    polling: config?.polling,
-  };
-  const completionConfig: CompletionConfig = { sapiomClient };
-
-  const sapiomFetch = async (
-    input: string | URL | Request,
-    init?: RequestInit,
-  ): Promise<Response> => {
-    let request = new Request(input, init);
-
-    const requestMetadata = (request as any).__sapiom || {};
-    const userMetadata = { ...defaultMetadata, ...requestMetadata };
-
-    if (userMetadata?.enabled === false) {
-      return globalThis.fetch(request);
-    }
-
-    // Attach identity header if target matches token audience
-    if (sapiomClient.identity) {
-      const identityHeaders = await sapiomClient.identity.getHeaderIfMatch(
-        request.url,
-      );
-      if (identityHeaders["Sapiom-Identity"]) {
-        const headers = new Headers(request.headers);
-        headers.set("Sapiom-Identity", identityHeaders["Sapiom-Identity"]);
-        request = new Request(request, { headers });
-      }
-    }
-
-    request = await handleAuthorization(request, authConfig, defaultMetadata);
-
-    const startTime = Date.now();
-    let response: Response | null = null;
-    let error: Error | null = null;
-
-    try {
-      // Clone before sending so we have an unconsumed body for 402 retry
-      const requestForRetry = request.clone();
-      response = await globalThis.fetch(request);
-
-      if (response.status === 402) {
-        response = await handlePayment(
-          requestForRetry,
-          response,
-          paymentConfig,
-          request,
-          defaultMetadata,
-        );
-      }
-
-      return response;
-    } catch (err) {
-      error = err as Error;
-      throw err;
-    } finally {
-      // Fire-and-forget: complete the transaction
-      handleCompletion(
-        request,
-        response,
-        error,
-        completionConfig,
-        startTime,
-        defaultMetadata,
-      );
-    }
-  };
-
-  (sapiomFetch as any).__sapiomClient = sapiomClient;
-
-  return sapiomFetch as typeof fetch;
-}
-
-export {
-  AuthorizationDeniedError,
-  AuthorizationTimeoutError,
-} from "./interceptors.js";
+import { SapiomClient } from "@sapiom/core";
+import {
+  BaseSapiomIntegrationConfig,
+  initializeSapiomClient,
+} from "@sapiom/core";
+import type { TransactionPollingConfig } from "@sapiom/core";
+import {
+  handleAuthorization,
+  handlePayment,
+  handleCompletion,
+  AuthorizationConfig,
+  PaymentConfig,
+  CompletionConfig,
+} from "./interceptors.js";
+
+/**
+ * Configuration for Sapiom-enabled Fetch client
+ */
+export interface SapiomFetchConfig extends BaseSapiomIntegrationConfig {
+  /**
+   * Polling configuration for transaction authorization.
+   * Overrides default timeout (30s) and poll interval (1s).
+   */
+  polling?: TransactionPollingConfig;
+}
+
+/**
+ * Creates a Sapiom-enabled fetch function with automatic authorization and payment handling
+ *
+ * Drop-in replacement for native fetch() with Sapiom capabilities.
+ * Works directly with native Request/Response objects, preserving all native fetch features
+ * (FormData, Blob, streams, etc.).
+ *
+ * @param config - Optional configuration (reads from env vars by default)
+ * @returns A fetch function with Sapiom payment and authorization handling
+ *
+ * @example
+ * ```typescript
+ * // Simplest usage (reads SAPIOM_API_KEY from environment)
+ * import { createFetch } from '@sapiom/fetch';
+ *
+ * const fetch = createFetch();
+ *
+ * // Works exactly like native fetch!
+ * const response = await fetch('[https://api.example.com/premium-endpoint](https://api.example.com/premium-endpoint)');
+ * const data = await response.json();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // With API key and default metadata
+ * import { createFetch } from '@sapiom/fetch';
+ *
+ * const fetch = createFetch({
+ *   apiKey: 'sk_...',
+ *   agentName: 'my-agent',
+ *   serviceName: 'my-service'
+ * });
+ *
+ * const response = await fetch('[https://api.example.com/data](https://api.example.com/data)');
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // With default metadata (applied to all requests)
+ * import { createFetch } from '@sapiom/fetch';
+ *
+ * const fetch = createFetch({
+ *   apiKey: 'sk_...',
+ *   agentName: 'my-agent',
+ *   serviceName: 'my-service'
+ * });
+ *
+ * // Per-request override via __sapiom property
+ * const request = new Request('/api/resource', { method: 'POST' });
+ * (request as any).__sapiom = {
+ *   serviceName: 'different-service',
+ *   actionName: 'custom-action'
+ * };
+ * await fetch(request);
+ *
+ * // Disable Sapiom for specific request
+ * const publicRequest = new Request('/api/public');
+ * (publicRequest as any).__sapiom = { enabled: false };
+ * await fetch(publicRequest);
+ * ```
+ */
+export function createFetch(config?: SapiomFetchConfig): typeof fetch {
+  if (config?.enabled === false) {
+    return globalThis.fetch;
+  }
+
+  const sapiomClient = initializeSapiomClient(config);
+
+  const defaultMetadata: Record<string, any> = {};
+  if (config?.agentName) defaultMetadata.agentName = config.agentName;
+  if (config?.agentId) defaultMetadata.agentId = config.agentId;
+  if (config?.serviceName) defaultMetadata.serviceName = config.serviceName;
+  if (config?.traceId) defaultMetadata.traceId = config.traceId;
+  if (config?.traceExternalId)
+    defaultMetadata.traceExternalId = config.traceExternalId;
+  if (config?.integration) defaultMetadata.integration = config.integration;
+  if (config?.enabled !== undefined) defaultMetadata.enabled = config.enabled;
+
+  // SECURITY FIX: SDK Authorization Fail-Open Prevention.
+  // Default failureMode changed from "open" to "closed" to ensure governance boundaries
+  // are strictly enforced by default during control-plane outages.
+  const failureMode = config?.failureMode ?? "closed";
+
+  const authConfig: AuthorizationConfig = {
+    sapiomClient,
+    failureMode,
+    polling: config?.polling,
+  };
+  const paymentConfig: PaymentConfig = {
+    sapiomClient,
+    failureMode,
+    polling: config?.polling,
+  };
+  const completionConfig: CompletionConfig = { sapiomClient };
+
+  const sapiomFetch = async (
+    input: string | URL | Request,
+    init?: RequestInit,
+  ): Promise<Response> => {
+    let request = new Request(input, init);
+
+    const requestMetadata = (request as any).__sapiom || {};
+    const userMetadata = { ...defaultMetadata, ...requestMetadata };
+
+    if (userMetadata?.enabled === false) {
+      return globalThis.fetch(request);
+    }
+
+    // Attach identity header if target matches token audience
+    if (sapiomClient.identity) {
+      const identityHeaders = await sapiomClient.identity.getHeaderIfMatch(
+        request.url,
+      );
+      if (identityHeaders["Sapiom-Identity"]) {
+        const headers = new Headers(request.headers);
+        headers.set("Sapiom-Identity", identityHeaders["Sapiom-Identity"]);
+        request = new Request(request, { headers });
+      }
+    }
+
+    request = await handleAuthorization(request, authConfig, defaultMetadata);
+
+    const startTime = Date.now();
+    let response: Response | null = null;
+    let error: Error | null = null;
+
+    try {
+      // Clone before sending so we have an unconsumed body for 402 retry
+      const requestForRetry = request.clone();
+      response = await globalThis.fetch(request);
+
+      if (response.status === 402) {
+        response = await handlePayment(
+          requestForRetry,
+          response,
+          paymentConfig,
+          request,
+          defaultMetadata,
+        );
+      }
+
+      return response;
+    } catch (err) {
+      error = err as Error;
+      throw err;
+    } finally {
+      // Fire-and-forget: complete the transaction
+      handleCompletion(
+        request,
+        response,
+        error,
+        completionConfig,
+        startTime,
+        defaultMetadata,
+      );
+    }
+  };
+
+  (sapiomFetch as any).__sapiomClient = sapiomClient;
+
+  return sapiomFetch as typeof fetch;
+}
+
+export {
+  AuthorizationDeniedError,
+  AuthorizationTimeoutError,
+} from "./interceptors.js";
\ No newline at end of file
diff --git a/packages/fetch/src/http-client.integration.test.ts b/packages/fetch/src/http-client.integration.test.ts
index c91abb52c..57afce788 100644
--- a/packages/fetch/src/http-client.integration.test.ts
+++ b/packages/fetch/src/http-client.integration.test.ts
@@ -1,811 +1,828 @@
-/**
- * HTTP Client Integration Tests
- *
- * These tests verify the complete Sapiom integration flow:
- * - Authorization: create → get/poll → HTTP request
- * - Completion: complete() called after request finishes
- * - Payment: 402 → create payment tx → poll → retry with X-PAYMENT header
- *
- * Uses fetch-mock to simulate HTTP server responses and mocked SapiomClient
- * to verify the correct Sapiom API calls are made in the right order.
- */
-import { createFetch } from "./fetch";
-import { SapiomClient, TransactionAPI, TransactionStatus } from "@sapiom/core";
-import fetchMock from "@fetch-mock/jest";
-
-/**
- * Creates a fully mocked SapiomClient for testing
- */
-function createMockSapiomClient(): {
-  client: SapiomClient;
-  mocks: jest.Mocked<TransactionAPI>;
-} {
-  const mocks: jest.Mocked<TransactionAPI> = {
-    create: jest.fn(),
-    get: jest.fn(),
-    complete: jest.fn(),
-    reauthorizeWithPayment: jest.fn(),
-    list: jest.fn(),
-    isAuthorized: jest.fn(),
-    isCompleted: jest.fn(),
-    requiresPayment: jest.fn(),
-    getPaymentDetails: jest.fn(),
-    addFacts: jest.fn(),
-    addCost: jest.fn(),
-    listCosts: jest.fn(),
-  } as any;
-
-  const client = {
-    transactions: mocks,
-  } as unknown as SapiomClient;
-
-  return { client, mocks };
-}
-
-/**
- * Helper to wait for fire-and-forget operations to complete
- */
-async function flushPromises(): Promise<void> {
-  await new Promise((resolve) => setTimeout(resolve, 10));
-}
-
-describe("HTTP Client Integration Tests", () => {
-  let mockSapiomClient: SapiomClient;
-  let mocks: jest.Mocked<TransactionAPI>;
-
-  beforeAll(() => {
-    fetchMock.mockGlobal();
-  });
-
-  beforeEach(() => {
-    const setup = createMockSapiomClient();
-    mockSapiomClient = setup.client;
-    mocks = setup.mocks;
-    fetchMock.removeRoutes();
-    jest.clearAllMocks();
-  });
-
-  afterAll(() => {
-    fetchMock.unmockGlobal();
-  });
-
-  // ============================================================================
-  // AUTHORIZATION FLOW TESTS
-  // ============================================================================
-
-  describe("Authorization Flow", () => {
-    it("should complete full authorization flow: create → authorized → request → complete", async () => {
-      // Setup: Transaction is immediately authorized
-      mocks.create.mockResolvedValue({
-        id: "tx-123",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-123", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", {
-        status: 200,
-        body: { result: "success" },
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-
-      // Execute
-      const response = await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      // Verify HTTP response
-      expect(response.status).toBe(200);
-      const data = await response.json();
-      expect(data).toEqual({ result: "success" });
-
-      // Verify Sapiom API calls
-      expect(mocks.create).toHaveBeenCalledTimes(1);
-      expect(mocks.complete).toHaveBeenCalledTimes(1);
-
-      // Verify create call includes request facts
-      const createCall = mocks.create.mock.calls[0][0];
-      expect(createCall.requestFacts).toBeDefined();
-      expect(createCall.requestFacts!.source).toBe("http-client");
-      expect((createCall.requestFacts!.request as any).method).toBe("GET");
-      expect((createCall.requestFacts!.request as any).url).toBe(
-        "https://api.example.com/data",
-      );
-
-      // Verify complete call
-      const completeCall = mocks.complete.mock.calls[0];
-      expect(completeCall[0]).toBe("tx-123");
-      expect(completeCall[1].outcome).toBe("success");
-      expect(completeCall[1].responseFacts).toBeDefined();
-      expect((completeCall[1].responseFacts as any).facts.status).toBe(200);
-
-      // Verify call order: create before complete
-      const createOrder = mocks.create.mock.invocationCallOrder[0];
-      const completeOrder = mocks.complete.mock.invocationCallOrder[0];
-      expect(createOrder).toBeLessThan(completeOrder);
-    });
-
-    it("should poll for authorization when transaction is pending", async () => {
-      // Setup: Transaction starts pending, becomes authorized after get()
-      mocks.create.mockResolvedValue({
-        id: "tx-456",
-        status: TransactionStatus.PENDING,
-      } as any);
-
-      mocks.get.mockResolvedValue({
-        id: "tx-456",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-456", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", {
-        status: 200,
-        body: { result: "polled" },
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-
-      // Execute
-      const response = await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      // Verify
-      expect(response.status).toBe(200);
-      expect(mocks.create).toHaveBeenCalledTimes(1);
-      expect(mocks.get).toHaveBeenCalled(); // Polled for status
-      expect(mocks.complete).toHaveBeenCalledTimes(1);
-
-      // Verify polling was for the correct transaction
-      expect(mocks.get).toHaveBeenCalledWith("tx-456");
-    });
-
-    it("should throw AuthorizationDeniedError when transaction is denied", async () => {
-      // Setup: Transaction is denied
-      mocks.create.mockResolvedValue({
-        id: "tx-denied",
-        status: TransactionStatus.DENIED,
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", {
-        status: 200,
-        body: { result: "should not reach" },
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-
-      // Execute & Verify
-      await expect(fetch("https://api.example.com/data")).rejects.toThrow(
-        "Authorization denied",
-      );
-
-      // Verify no complete call (denied before request)
-      expect(mocks.complete).not.toHaveBeenCalled();
-    });
-
-    it("should add X-Sapiom-Transaction-Id header to request", async () => {
-      mocks.create.mockResolvedValue({
-        id: "tx-header-test",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-header-test", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", { status: 200, body: {} });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      // Verify transaction was created and header was set (implicitly via complete being called)
-      expect(mocks.create).toHaveBeenCalledTimes(1);
-      expect(mocks.complete).toHaveBeenCalledWith(
-        "tx-header-test",
-        expect.anything(),
-      );
-    });
-  });
-
-  // ============================================================================
-  // COMPLETION FLOW TESTS
-  // ============================================================================
-
-  describe("Completion Flow", () => {
-    it("should call complete with success outcome on HTTP 200", async () => {
-      mocks.create.mockResolvedValue({
-        id: "tx-success",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-success", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", {
-        status: 200,
-        body: { ok: true },
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      expect(mocks.complete).toHaveBeenCalledWith(
-        "tx-success",
-        expect.objectContaining({
-          outcome: "success",
-          responseFacts: expect.objectContaining({
-            source: "http-client",
-            facts: expect.objectContaining({
-              status: 200,
-            }),
-          }),
-        }),
-      );
-    });
-
-    it("should call complete with error outcome on HTTP 500", async () => {
-      mocks.create.mockResolvedValue({
-        id: "tx-error",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-error", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", {
-        status: 500,
-        body: { error: "Internal Server Error" },
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      const response = await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      expect(response.status).toBe(500);
-      expect(mocks.complete).toHaveBeenCalledWith(
-        "tx-error",
-        expect.objectContaining({
-          outcome: "error",
-          responseFacts: expect.objectContaining({
-            facts: expect.objectContaining({
-              httpStatus: 500,
-            }),
-          }),
-        }),
-      );
-    });
-
-    it("should call complete with error outcome on network error", async () => {
-      mocks.create.mockResolvedValue({
-        id: "tx-network-error",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-network-error", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", {
-        throws: new Error("Network error"),
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-
-      await expect(fetch("https://api.example.com/data")).rejects.toThrow(
-        "Network error",
-      );
-      await flushPromises();
-
-      expect(mocks.complete).toHaveBeenCalledWith(
-        "tx-network-error",
-        expect.objectContaining({
-          outcome: "error",
-          responseFacts: expect.objectContaining({
-            facts: expect.objectContaining({
-              errorMessage: "Network error",
-              isNetworkError: true,
-            }),
-          }),
-        }),
-      );
-    });
-
-    it("should not block request if complete() fails", async () => {
-      mocks.create.mockResolvedValue({
-        id: "tx-complete-fail",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      // complete() fails
-      mocks.complete.mockRejectedValue(new Error("Sapiom API unavailable"));
-
-      fetchMock.get("https://api.example.com/data", {
-        status: 200,
-        body: { result: "success" },
-      });
-
-      const consoleSpy = jest.spyOn(console, "error").mockImplementation();
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      const response = await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      // Request should still succeed
-      expect(response.status).toBe(200);
-      const data = await response.json();
-      expect(data).toEqual({ result: "success" });
-
-      // Error should be logged but not thrown
-      expect(consoleSpy).toHaveBeenCalledWith(
-        "[Sapiom] Failed to complete transaction:",
-        expect.any(Error),
-      );
-
-      consoleSpy.mockRestore();
-    });
-
-    it("should include duration in response facts", async () => {
-      mocks.create.mockResolvedValue({
-        id: "tx-duration",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-duration", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", {
-        status: 200,
-        body: {},
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      const completeCall = mocks.complete.mock.calls[0];
-      expect(
-        (completeCall[1].responseFacts as any).facts.durationMs,
-      ).toBeGreaterThanOrEqual(0);
-    });
-  });
-
-  // ============================================================================
-  // PAYMENT FLOW TESTS
-  // ============================================================================
-
-  describe("Payment Flow", () => {
-    it("should handle 402 payment required flow", async () => {
-      // First request: authorized
-      mocks.create
-        .mockResolvedValueOnce({
-          id: "tx-auth",
-          status: TransactionStatus.AUTHORIZED,
-        } as any)
-        // Payment transaction: authorized with payment payload
-        .mockResolvedValueOnce({
-          id: "tx-payment",
-          status: TransactionStatus.PENDING,
-        } as any);
-
-      // Payment transaction polling returns authorized with payload
-      mocks.reauthorizeWithPayment.mockResolvedValue({
-        id: "tx-auth",
-        status: TransactionStatus.AUTHORIZED,
-        payment: {
-          authorizationPayload: "payment-token-xyz",
-        },
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-auth", status: "completed" },
-      } as any);
-
-      // First request returns 402, second returns success
-      fetchMock.getOnce("https://api.example.com/paid", {
-        status: 402,
-        body: {
-          x402Version: 1,
-          accepts: [
-            {
-              scheme: "exact",
-              network: "base",
-              maxAmountRequired: "1000000",
-              resource: "https://api.example.com/paid",
-              payTo: "0x123",
-              asset: "0xUSDC",
-            },
-          ],
-        },
-      });
-
-      // Second request (retry with payment) returns success
-      fetchMock.get("https://api.example.com/paid", {
-        status: 200,
-        body: { paid: true },
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      const response = await fetch("https://api.example.com/paid");
-      await flushPromises();
-
-      // Verify success after payment retry
-      expect(response.status).toBe(200);
-      const data = await response.json();
-      expect(data).toEqual({ paid: true });
-
-      // Verify one transaction created (auth) and reauthorized with payment
-      expect(mocks.create).toHaveBeenCalledTimes(1);
-      expect(mocks.reauthorizeWithPayment).toHaveBeenCalledTimes(1);
-
-      // Verify reauthorize was called with x402 data
-      const reauthorizeCall = mocks.reauthorizeWithPayment.mock.calls[0];
-      expect(reauthorizeCall[0]).toBe("tx-auth"); // transaction ID
-      expect(reauthorizeCall[1].x402).toBeDefined();
-    });
-
-    it("should return original 402 if payment transaction is denied", async () => {
-      mocks.create.mockResolvedValueOnce({
-        id: "tx-auth",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      // Reauthorize returns denied status
-      mocks.reauthorizeWithPayment.mockResolvedValue({
-        id: "tx-auth",
-        status: TransactionStatus.DENIED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-auth", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/paid", {
-        status: 402,
-        body: {
-          x402Version: 1,
-          accepts: [
-            {
-              scheme: "exact",
-              network: "base",
-              maxAmountRequired: "1000000",
-              resource: "https://api.example.com/paid",
-              payTo: "0x123",
-              asset: "0xUSDC",
-            },
-          ],
-        },
-      });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      const response = await fetch("https://api.example.com/paid");
-      await flushPromises();
-
-      // Should return original 402
-      expect(response.status).toBe(402);
-    });
-  });
-
-  // ============================================================================
-  // METADATA PROPAGATION TESTS
-  // ============================================================================
-
-  describe("Metadata Propagation", () => {
-    it("should pass default metadata to transaction create", async () => {
-      mocks.create.mockResolvedValue({
-        id: "tx-meta",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-meta", status: "completed" },
-      } as any);
-
-      fetchMock.get("https://api.example.com/data", { status: 200, body: {} });
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        agentName: "test-agent",
-        agentId: "agent-123",
-        serviceName: "test-service",
-        traceId: "trace-abc",
-      });
-
-      await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      const createCall = mocks.create.mock.calls[0][0];
-      expect(createCall.agentName).toBe("test-agent");
-      expect(createCall.agentId).toBe("agent-123");
-      expect(createCall.serviceName).toBe("test-service");
-      expect(createCall.traceId).toBe("trace-abc");
-    });
-
-    it("should skip Sapiom when config.enabled is false", async () => {
-      fetchMock.get("https://api.example.com/public", {
-        status: 200,
-        body: { public: true },
-      });
-
-      const fetch = createFetch({
-        sapiomClient: mockSapiomClient,
-        enabled: false,
-      });
-
-      const response = await fetch("https://api.example.com/public");
-      await flushPromises();
-
-      expect(response.status).toBe(200);
-
-      // No Sapiom calls should be made
-      expect(mocks.create).not.toHaveBeenCalled();
-      expect(mocks.complete).not.toHaveBeenCalled();
-    });
-  });
-
-  // ============================================================================
-  // CALL ORDER VERIFICATION
-  // ============================================================================
-
-  describe("Call Order Verification", () => {
-    it("should call Sapiom APIs in correct order: create → (get) → complete", async () => {
-      const callSequence: string[] = [];
-
-      mocks.create.mockImplementation(async () => {
-        callSequence.push("create");
-        return {
-          id: "tx-order",
-          status: TransactionStatus.PENDING,
-        } as any;
-      });
-
-      mocks.get.mockImplementation(async () => {
-        callSequence.push("get");
-        return {
-          id: "tx-order",
-          status: TransactionStatus.AUTHORIZED,
-        } as any;
-      });
-
-      mocks.complete.mockImplementation(async () => {
-        callSequence.push("complete");
-        return {
-          transaction: { id: "tx-order", status: "completed" },
-        } as any;
-      });
-
-      fetchMock.get("https://api.example.com/data", { status: 200, body: {} });
-
-      const fetch = createFetch({ sapiomClient: mockSapiomClient });
-      await fetch("https://api.example.com/data");
-      await flushPromises();
-
-      // Verify sequence
-      expect(callSequence[0]).toBe("create");
-      expect(callSequence[1]).toBe("get");
-      expect(callSequence[callSequence.length - 1]).toBe("complete");
-    });
-  });
-
-  // ============================================================================
-  // STREAM AND BODY REPLAY TESTS
-  // ============================================================================
-
-  describe("Stream and Body Replay on 402 Retry", () => {
-    function setup402PaymentFlow() {
-      mocks.create.mockResolvedValue({
-        id: "tx-body",
-        status: TransactionStatus.AUTHORIZED,
-      } as any);
-
-      mocks.reauthorizeWithPayment.mockResolvedValue({
-        id: "tx-body",
-        status: TransactionStatus.AUTHORIZED,
-        payment: {
-          authorizationPayload: "payment-token",
-        },
-      } as any);
-
-      mocks.complete.mockResolvedValue({
-        transaction: { id: "tx-body", status: "completed" },
-      } as any);
-    }
-
-    function mock402ThenSuccess(
-      url: string,
-      captureBody?: (body: string) => void,
-    ) {
-      // Temporarily replace fetchMock with a manual jest.fn for body capture
-      const savedFetch = globalThis.fetch;
-      let requestCount = 0;
-      const mockFn = jest.fn(async (input: Request) => {
-        requestCount++;
-        const bodyText = input.body ? await input.clone().text() : "";
-        if (captureBody) captureBody(bodyText);
-
-        if (requestCount === 1) {
-          return new Response(
-            JSON.stringify({
-              x402Version: 1,
-              accepts: [
-                {
-                  scheme: "exact",
-                  network: "base",
-                  maxAmountRequired: "1000",
-                  resource: url,
-                  payTo: "0x123",
-                  asset: "0xUSDC",
-                },
-              ],
-            }),
-            { status: 402, headers: { "content-type": "application/json" } },
-          );
-        }
-        return new Response(JSON.stringify({ success: true }), {
-          status: 200,
-          headers: { "content-type": "application/json" },
-        });
-      });
-      globalThis.fetch = mockFn as any;
-      return {
-        getRequestCount: () => requestCount,
-        getMockFn: () => mockFn,
-        restore: () => {
-          globalThis.fetch = savedFetch;
-        },
-      };
-    }
-
-    it("should replay string body on 402 retry", async () => {
-      setup402PaymentFlow();
-      const bodies: string[] = [];
-      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
-        bodies.push(b),
-      );
-
-      try {
-        const fetch = createFetch({ sapiomClient: mockSapiomClient });
-        const response = await fetch("https://api.example.com/upload", {
-          method: "POST",
-          body: "hello world",
-        });
-        await flushPromises();
-
-        expect(response.status).toBe(200);
-        expect(bodies).toHaveLength(2);
-        expect(bodies[0]).toBe("hello world");
-        expect(bodies[1]).toBe("hello world");
-      } finally {
-        mock.restore();
-      }
-    });
-
-    it("should replay ReadableStream body on 402 retry", async () => {
-      setup402PaymentFlow();
-      const bodies: string[] = [];
-      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
-        bodies.push(b),
-      );
-
-      try {
-        const fetch = createFetch({ sapiomClient: mockSapiomClient });
-
-        const stream = new ReadableStream({
-          start(controller) {
-            controller.enqueue(new TextEncoder().encode("streamed-content"));
-            controller.close();
-          },
-        });
-
-        const response = await fetch("https://api.example.com/upload", {
-          method: "POST",
-          body: stream,
-          duplex: "half",
-        });
-        await flushPromises();
-
-        expect(response.status).toBe(200);
-        expect(bodies).toHaveLength(2);
-        expect(bodies[0]).toBe("streamed-content");
-        expect(bodies[1]).toBe("streamed-content");
-      } finally {
-        mock.restore();
-      }
-    });
-
-    it("should replay Blob body on 402 retry", async () => {
-      setup402PaymentFlow();
-      const bodies: string[] = [];
-      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
-        bodies.push(b),
-      );
-
-      try {
-        const fetch = createFetch({ sapiomClient: mockSapiomClient });
-        const blob = new Blob(["blob-data"], {
-          type: "application/octet-stream",
-        });
-
-        const response = await fetch("https://api.example.com/upload", {
-          method: "POST",
-          body: blob,
-        });
-        await flushPromises();
-
-        expect(response.status).toBe(200);
-        expect(bodies).toHaveLength(2);
-        expect(bodies[0]).toBe("blob-data");
-        expect(bodies[1]).toBe("blob-data");
-      } finally {
-        mock.restore();
-      }
-    });
-
-    it("should replay FormData body on 402 retry", async () => {
-      setup402PaymentFlow();
-      const bodies: string[] = [];
-      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
-        bodies.push(b),
-      );
-
-      try {
-        const fetch = createFetch({ sapiomClient: mockSapiomClient });
-
-        const formData = new FormData();
-        formData.append("field", "value");
-        formData.append("file", new Blob(["file-content"]), "test.txt");
-
-        const response = await fetch("https://api.example.com/upload", {
-          method: "POST",
-          body: formData,
-        });
-        await flushPromises();
-
-        expect(response.status).toBe(200);
-        expect(bodies).toHaveLength(2);
-        // Both requests should contain the form field values
-        expect(bodies[0]).toContain("value");
-        expect(bodies[0]).toContain("file-content");
-        expect(bodies[1]).toContain("value");
-        expect(bodies[1]).toContain("file-content");
-      } finally {
-        mock.restore();
-      }
-    });
-
-    it("should preserve payment header on retry while keeping body", async () => {
-      setup402PaymentFlow();
-      const mock = mock402ThenSuccess("https://api.example.com/upload");
-
-      try {
-        const fetch = createFetch({ sapiomClient: mockSapiomClient });
-        const response = await fetch("https://api.example.com/upload", {
-          method: "POST",
-          body: "test-body",
-        });
-        await flushPromises();
-
-        expect(response.status).toBe(200);
-
-        // Check the retry request (second call)
-        const retryCall = mock.getMockFn().mock.calls[1];
-        const retryRequest = retryCall[0] as Request;
-        expect(retryRequest.headers.get("X-PAYMENT")).toBe("payment-token");
-
-        // Verify body was present on retry
-        const retryBody = await retryRequest.clone().text();
-        expect(retryBody).toBe("test-body");
-      } finally {
-        mock.restore();
-      }
-    });
-  });
-});
+/**
+ * HTTP Client Integration Tests
+ *
+ * These tests verify the complete Sapiom integration flow:
+ * - Authorization: create → get/poll → HTTP request
+ * - Completion: complete() called after request finishes
+ * - Payment: 402 → create payment tx → poll → retry with X-PAYMENT header
+ *
+ * Uses fetch-mock to simulate HTTP server responses and mocked SapiomClient
+ * to verify the correct Sapiom API calls are made in the right order.
+ */
+import { createFetch } from "./fetch";
+import { SapiomClient, TransactionAPI, TransactionStatus } from "@sapiom/core";
+import fetchMock from "@fetch-mock/jest";
+
+// Ensure tests have enough time to complete polling loops
+jest.setTimeout(15000);
+
+/**
+ * Creates a fully mocked SapiomClient for testing
+ */
+function createMockSapiomClient(): {
+  client: SapiomClient;
+  mocks: jest.Mocked<TransactionAPI>;
+} {
+  const mocks: jest.Mocked<TransactionAPI> = {
+    create: jest.fn(),
+    get: jest.fn(),
+    complete: jest.fn(),
+    reauthorizeWithPayment: jest.fn(),
+    list: jest.fn(),
+    isAuthorized: jest.fn(),
+    isCompleted: jest.fn(),
+    requiresPayment: jest.fn(),
+    getPaymentDetails: jest.fn(),
+    addFacts: jest.fn(),
+    addCost: jest.fn(),
+    listCosts: jest.fn(),
+  } as any;
+
+  const client = {
+    transactions: mocks,
+  } as unknown as SapiomClient;
+
+  return { client, mocks };
+}
+
+/**
+ * Helper to wait for fire-and-forget operations to complete
+ */
+async function flushPromises(): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, 10));
+}
+
+describe("HTTP Client Integration Tests", () => {
+  let mockSapiomClient: SapiomClient;
+  let mocks: jest.Mocked<TransactionAPI>;
+
+  beforeAll(() => {
+    fetchMock.mockGlobal();
+  });
+
+  beforeEach(() => {
+    const setup = createMockSapiomClient();
+    mockSapiomClient = setup.client;
+    mocks = setup.mocks;
+    fetchMock.removeRoutes();
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    fetchMock.unmockGlobal();
+  });
+
+  // ============================================================================
+  // AUTHORIZATION FLOW TESTS
+  // ============================================================================
+
+  describe("Authorization Flow", () => {
+    it("should complete full authorization flow: create → authorized → request → complete", async () => {
+      // Setup: Transaction is immediately authorized
+      mocks.create.mockResolvedValue({
+        id: "tx-123",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-123", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", {
+        status: 200,
+        body: { result: "success" },
+      });
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+
+      // Execute
+      const response = await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      // Verify HTTP response
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual({ result: "success" });
+
+      // Verify Sapiom API calls
+      expect(mocks.create).toHaveBeenCalledTimes(1);
+      expect(mocks.complete).toHaveBeenCalledTimes(1);
+
+      // Verify create call includes request facts
+      const createCall = mocks.create.mock.calls[0][0];
+      expect(createCall.requestFacts).toBeDefined();
+      expect(createCall.requestFacts!.source).toBe("http-client");
+      expect((createCall.requestFacts!.request as any).method).toBe("GET");
+      expect((createCall.requestFacts!.request as any).url).toBe(
+        "https://api.example.com/data",
+      );
+
+      // Verify complete call
+      const completeCall = mocks.complete.mock.calls[0];
+      expect(completeCall[0]).toBe("tx-123");
+      expect(completeCall[1].outcome).toBe("success");
+      expect(completeCall[1].responseFacts).toBeDefined();
+      expect((completeCall[1].responseFacts as any).facts.status).toBe(200);
+
+      // Verify call order: create before complete
+      const createOrder = mocks.create.mock.invocationCallOrder[0];
+      const completeOrder = mocks.complete.mock.invocationCallOrder[0];
+      expect(createOrder).toBeLessThan(completeOrder);
+    });
+
+    it("should poll for authorization when transaction is pending", async () => {
+      // Setup: Transaction starts pending, becomes authorized after get()
+      mocks.create.mockResolvedValue({
+        id: "tx-456",
+        status: TransactionStatus.PENDING,
+      } as any);
+
+      mocks.get.mockResolvedValue({
+        id: "tx-456",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-456", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", {
+        status: 200,
+        body: { result: "polled" },
+      });
+
+      // Pass a very short polling interval for tests to avoid hanging
+      const fetch = createFetch({ 
+        sapiomClient: mockSapiomClient,
+        polling: { pollInterval: 5, timeout: 1000 } 
+      });
+
+      // Execute
+      const response = await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      // Verify
+      expect(response.status).toBe(200);
+      expect(mocks.create).toHaveBeenCalledTimes(1);
+      expect(mocks.get).toHaveBeenCalled(); // Polled for status
+      expect(mocks.complete).toHaveBeenCalledTimes(1);
+
+      // Verify polling was for the correct transaction
+      expect(mocks.get).toHaveBeenCalledWith("tx-456");
+    });
+
+    it("should throw AuthorizationDeniedError when transaction is denied", async () => {
+      // Setup: Transaction is denied
+      mocks.create.mockResolvedValue({
+        id: "tx-denied",
+        status: TransactionStatus.DENIED,
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", {
+        status: 200,
+        body: { result: "should not reach" },
+      });
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+
+      // Execute & Verify
+      await expect(fetch("https://api.example.com/data")).rejects.toThrow(
+        "Authorization denied",
+      );
+
+      // Verify no complete call (denied before request)
+      expect(mocks.complete).not.toHaveBeenCalled();
+    });
+
+    it("should add X-Sapiom-Transaction-Id header to request", async () => {
+      mocks.create.mockResolvedValue({
+        id: "tx-header-test",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-header-test", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", { status: 200, body: {} });
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+      await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      // Verify transaction was created and header was set (implicitly via complete being called)
+      expect(mocks.create).toHaveBeenCalledTimes(1);
+      expect(mocks.complete).toHaveBeenCalledWith(
+        "tx-header-test",
+        expect.anything(),
+      );
+    });
+  });
+
+  // ============================================================================
+  // COMPLETION FLOW TESTS
+  // ============================================================================
+
+  describe("Completion Flow", () => {
+    it("should call complete with success outcome on HTTP 200", async () => {
+      mocks.create.mockResolvedValue({
+        id: "tx-success",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-success", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", {
+        status: 200,
+        body: { ok: true },
+      });
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+      await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      expect(mocks.complete).toHaveBeenCalledWith(
+        "tx-success",
+        expect.objectContaining({
+          outcome: "success",
+          responseFacts: expect.objectContaining({
+            source: "http-client",
+            facts: expect.objectContaining({
+              status: 200,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it("should call complete with error outcome on HTTP 500", async () => {
+      mocks.create.mockResolvedValue({
+        id: "tx-error",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-error", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", {
+        status: 500,
+        body: { error: "Internal Server Error" },
+      });
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+      const response = await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      expect(response.status).toBe(500);
+      expect(mocks.complete).toHaveBeenCalledWith(
+        "tx-error",
+        expect.objectContaining({
+          outcome: "error",
+          responseFacts: expect.objectContaining({
+            facts: expect.objectContaining({
+              httpStatus: 500,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it("should call complete with error outcome on network error", async () => {
+      mocks.create.mockResolvedValue({
+        id: "tx-network-error",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-network-error", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", {
+        throws: new Error("Network error"),
+      });
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+
+      await expect(fetch("https://api.example.com/data")).rejects.toThrow(
+        "Network error",
+      );
+      await flushPromises();
+
+      expect(mocks.complete).toHaveBeenCalledWith(
+        "tx-network-error",
+        expect.objectContaining({
+          outcome: "error",
+          responseFacts: expect.objectContaining({
+            facts: expect.objectContaining({
+              errorMessage: "Network error",
+              isNetworkError: true,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it("should not block request if complete() fails", async () => {
+      mocks.create.mockResolvedValue({
+        id: "tx-complete-fail",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      // complete() fails
+      mocks.complete.mockRejectedValue(new Error("Sapiom API unavailable"));
+
+      fetchMock.get("https://api.example.com/data", {
+        status: 200,
+        body: { result: "success" },
+      });
+
+      const consoleSpy = jest.spyOn(console, "error").mockImplementation();
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+      const response = await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      // Request should still succeed
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual({ result: "success" });
+
+      // Error should be logged but not thrown
+      expect(consoleSpy).toHaveBeenCalledWith(
+        "[Sapiom] Failed to complete transaction:",
+        expect.any(Error),
+      );
+
+      consoleSpy.mockRestore();
+    });
+
+    it("should include duration in response facts", async () => {
+      mocks.create.mockResolvedValue({
+        id: "tx-duration",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-duration", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", {
+        status: 200,
+        body: {},
+      });
+
+      const fetch = createFetch({ sapiomClient: mockSapiomClient });
+      await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      const completeCall = mocks.complete.mock.calls[0];
+      expect(
+        (completeCall[1].responseFacts as any).facts.durationMs,
+      ).toBeGreaterThanOrEqual(0);
+    });
+  });
+
+  // ============================================================================
+  // PAYMENT FLOW TESTS
+  // ============================================================================
+
+  describe("Payment Flow", () => {
+    it("should handle 402 payment required flow", async () => {
+      // First request: authorized
+      mocks.create
+        .mockResolvedValueOnce({
+          id: "tx-auth",
+          status: TransactionStatus.AUTHORIZED,
+        } as any)
+        // Payment transaction: authorized with payment payload
+        .mockResolvedValueOnce({
+          id: "tx-payment",
+          status: TransactionStatus.PENDING,
+        } as any);
+
+      // Payment transaction polling returns authorized with payload
+      mocks.reauthorizeWithPayment.mockResolvedValue({
+        id: "tx-auth",
+        status: TransactionStatus.AUTHORIZED,
+        payment: {
+          authorizationPayload: "payment-token-xyz",
+        },
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-auth", status: "completed" },
+      } as any);
+
+      // First request returns 402, second returns success
+      fetchMock.getOnce("https://api.example.com/paid", {
+        status: 402,
+        body: {
+          x402Version: 1,
+          accepts: [
+            {
+              scheme: "exact",
+              network: "base",
+              maxAmountRequired: "1000000",
+              resource: "https://api.example.com/paid",
+              payTo: "0x123",
+              asset: "0xUSDC",
+            },
+          ],
+        },
+      });
+
+      // Second request (retry with payment) returns success
+      fetchMock.get("https://api.example.com/paid", {
+        status: 200,
+        body: { paid: true },
+      });
+
+      const fetch = createFetch({ 
+        sapiomClient: mockSapiomClient,
+        polling: { pollInterval: 5, timeout: 1000 }
+      });
+      const response = await fetch("https://api.example.com/paid");
+      await flushPromises();
+
+      // Verify success after payment retry
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual({ paid: true });
+
+      // Verify one transaction created (auth) and reauthorized with payment
+      expect(mocks.create).toHaveBeenCalledTimes(1);
+      expect(mocks.reauthorizeWithPayment).toHaveBeenCalledTimes(1);
+
+      // Verify reauthorize was called with x402 data
+      const reauthorizeCall = mocks.reauthorizeWithPayment.mock.calls[0];
+      expect(reauthorizeCall[0]).toBe("tx-auth"); // transaction ID
+      expect(reauthorizeCall[1].x402).toBeDefined();
+    });
+
+    it("should return original 402 if payment transaction is denied", async () => {
+      mocks.create.mockResolvedValueOnce({
+        id: "tx-auth",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      // Reauthorize returns denied status immediately to avoid polling loops
+      mocks.reauthorizeWithPayment.mockResolvedValue({
+        id: "tx-auth",
+        status: TransactionStatus.DENIED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-auth", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/paid", {
+        status: 402,
+        body: {
+          x402Version: 1,
+          accepts: [
+            {
+              scheme: "exact",
+              network: "base",
+              maxAmountRequired: "1000000",
+              resource: "https://api.example.com/paid",
+              payTo: "0x123",
+              asset: "0xUSDC",
+            },
+          ],
+        },
+      });
+
+      const fetch = createFetch({ 
+        sapiomClient: mockSapiomClient,
+        polling: { pollInterval: 5, timeout: 1000 }
+      });
+      
+      const response = await fetch("https://api.example.com/paid");
+      await flushPromises();
+
+      // Should return original 402
+      expect(response.status).toBe(402);
+    });
+  });
+
+  // ============================================================================
+  // METADATA PROPAGATION TESTS
+  // ============================================================================
+
+  describe("Metadata Propagation", () => {
+    it("should pass default metadata to transaction create", async () => {
+      mocks.create.mockResolvedValue({
+        id: "tx-meta",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-meta", status: "completed" },
+      } as any);
+
+      fetchMock.get("https://api.example.com/data", { status: 200, body: {} });
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        agentName: "test-agent",
+        agentId: "agent-123",
+        serviceName: "test-service",
+        traceId: "trace-abc",
+      });
+
+      await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      const createCall = mocks.create.mock.calls[0][0];
+      expect(createCall.agentName).toBe("test-agent");
+      expect(createCall.agentId).toBe("agent-123");
+      expect(createCall.serviceName).toBe("test-service");
+      expect(createCall.traceId).toBe("trace-abc");
+    });
+
+    it("should skip Sapiom when config.enabled is false", async () => {
+      fetchMock.get("https://api.example.com/public", {
+        status: 200,
+        body: { public: true },
+      });
+
+      const fetch = createFetch({
+        sapiomClient: mockSapiomClient,
+        enabled: false,
+      });
+
+      const response = await fetch("https://api.example.com/public");
+      await flushPromises();
+
+      expect(response.status).toBe(200);
+
+      // No Sapiom calls should be made
+      expect(mocks.create).not.toHaveBeenCalled();
+      expect(mocks.complete).not.toHaveBeenCalled();
+    });
+  });
+
+  // ============================================================================
+  // CALL ORDER VERIFICATION
+  // ============================================================================
+
+  describe("Call Order Verification", () => {
+    it("should call Sapiom APIs in correct order: create → (get) → complete", async () => {
+      const callSequence: string[] = [];
+
+      mocks.create.mockImplementation(async () => {
+        callSequence.push("create");
+        return {
+          id: "tx-order",
+          status: TransactionStatus.PENDING,
+        } as any;
+      });
+
+      mocks.get.mockImplementation(async () => {
+        callSequence.push("get");
+        return {
+          id: "tx-order",
+          status: TransactionStatus.AUTHORIZED,
+        } as any;
+      });
+
+      mocks.complete.mockImplementation(async () => {
+        callSequence.push("complete");
+        return {
+          transaction: { id: "tx-order", status: "completed" },
+        } as any;
+      });
+
+      fetchMock.get("https://api.example.com/data", { status: 200, body: {} });
+
+      const fetch = createFetch({ 
+        sapiomClient: mockSapiomClient,
+        polling: { pollInterval: 5, timeout: 1000 }
+      });
+      await fetch("https://api.example.com/data");
+      await flushPromises();
+
+      // Verify sequence
+      expect(callSequence[0]).toBe("create");
+      expect(callSequence[1]).toBe("get");
+      expect(callSequence[callSequence.length - 1]).toBe("complete");
+    });
+  });
+
+  // ============================================================================
+  // STREAM AND BODY REPLAY TESTS
+  // ============================================================================
+
+  describe("Stream and Body Replay on 402 Retry", () => {
+    function setup402PaymentFlow() {
+      mocks.create.mockResolvedValue({
+        id: "tx-body",
+        status: TransactionStatus.AUTHORIZED,
+      } as any);
+
+      mocks.reauthorizeWithPayment.mockResolvedValue({
+        id: "tx-body",
+        status: TransactionStatus.AUTHORIZED,
+        payment: {
+          authorizationPayload: "payment-token",
+        },
+      } as any);
+
+      mocks.complete.mockResolvedValue({
+        transaction: { id: "tx-body", status: "completed" },
+      } as any);
+    }
+
+    function mock402ThenSuccess(
+      url: string,
+      captureBody?: (body: string) => void,
+    ) {
+      // Temporarily replace fetchMock with a manual jest.fn for body capture
+      const savedFetch = globalThis.fetch;
+      let requestCount = 0;
+      const mockFn = jest.fn(async (input: Request) => {
+        requestCount++;
+        const bodyText = input.body ? await input.clone().text() : "";
+        if (captureBody) captureBody(bodyText);
+
+        if (requestCount === 1) {
+          return new Response(
+            JSON.stringify({
+              x402Version: 1,
+              accepts: [
+                {
+                  scheme: "exact",
+                  network: "base",
+                  maxAmountRequired: "1000",
+                  resource: url,
+                  payTo: "0x123",
+                  asset: "0xUSDC",
+                },
+              ],
+            }),
+            { status: 402, headers: { "content-type": "application/json" } },
+          );
+        }
+        return new Response(JSON.stringify({ success: true }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        });
+      });
+      globalThis.fetch = mockFn as any;
+      return {
+        getRequestCount: () => requestCount,
+        getMockFn: () => mockFn,
+        restore: () => {
+          globalThis.fetch = savedFetch;
+        },
+      };
+    }
+
+    it("should replay string body on 402 retry", async () => {
+      setup402PaymentFlow();
+      const bodies: string[] = [];
+      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
+        bodies.push(b),
+      );
+
+      try {
+        const fetch = createFetch({ sapiomClient: mockSapiomClient });
+        const response = await fetch("https://api.example.com/upload", {
+          method: "POST",
+          body: "hello world",
+        });
+        await flushPromises();
+
+        expect(response.status).toBe(200);
+        expect(bodies).toHaveLength(2);
+        expect(bodies[0]).toBe("hello world");
+        expect(bodies[1]).toBe("hello world");
+      } finally {
+        mock.restore();
+      }
+    });
+
+    it("should replay ReadableStream body on 402 retry", async () => {
+      setup402PaymentFlow();
+      const bodies: string[] = [];
+      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
+        bodies.push(b),
+      );
+
+      try {
+        const fetch = createFetch({ sapiomClient: mockSapiomClient });
+
+        const stream = new ReadableStream({
+          start(controller) {
+            controller.enqueue(new TextEncoder().encode("streamed-content"));
+            controller.close();
+          },
+        });
+
+        const response = await fetch("https://api.example.com/upload", {
+          method: "POST",
+          body: stream,
+          duplex: "half",
+        });
+        await flushPromises();
+
+        expect(response.status).toBe(200);
+        expect(bodies).toHaveLength(2);
+        expect(bodies[0]).toBe("streamed-content");
+        expect(bodies[1]).toBe("streamed-content");
+      } finally {
+        mock.restore();
+      }
+    });
+
+    it("should replay Blob body on 402 retry", async () => {
+      setup402PaymentFlow();
+      const bodies: string[] = [];
+      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
+        bodies.push(b),
+      );
+
+      try {
+        const fetch = createFetch({ sapiomClient: mockSapiomClient });
+        const blob = new Blob(["blob-data"], {
+          type: "application/octet-stream",
+        });
+
+        const response = await fetch("https://api.example.com/upload", {
+          method: "POST",
+          body: blob,
+        });
+        await flushPromises();
+
+        expect(response.status).toBe(200);
+        expect(bodies).toHaveLength(2);
+        expect(bodies[0]).toBe("blob-data");
+        expect(bodies[1]).toBe("blob-data");
+      } finally {
+        mock.restore();
+      }
+    });
+
+    it("should replay FormData body on 402 retry", async () => {
+      setup402PaymentFlow();
+      const bodies: string[] = [];
+      const mock = mock402ThenSuccess("https://api.example.com/upload", (b) =>
+        bodies.push(b),
+      );
+
+      try {
+        const fetch = createFetch({ sapiomClient: mockSapiomClient });
+
+        const formData = new FormData();
+        formData.append("field", "value");
+        formData.append("file", new Blob(["file-content"]), "test.txt");
+
+        const response = await fetch("https://api.example.com/upload", {
+          method: "POST",
+          body: formData,
+        });
+        await flushPromises();
+
+        expect(response.status).toBe(200);
+        expect(bodies).toHaveLength(2);
+        // Both requests should contain the form field values
+        expect(bodies[0]).toContain("value");
+        expect(bodies[0]).toContain("file-content");
+        expect(bodies[1]).toContain("value");
+        expect(bodies[1]).toContain("file-content");
+      } finally {
+        mock.restore();
+      }
+    });
+
+    it("should preserve payment header on retry while keeping body", async () => {
+      setup402PaymentFlow();
+      const mock = mock402ThenSuccess("https://api.example.com/upload");
+
+      try {
+        const fetch = createFetch({ sapiomClient: mockSapiomClient });
+        const response = await fetch("https://api.example.com/upload", {
+          method: "POST",
+          body: "test-body",
+        });
+        await flushPromises();
+
+        expect(response.status).toBe(200);
+
+        // Check the retry request (second call)
+        const retryCall = mock.getMockFn().mock.calls[1];
+        const retryRequest = retryCall[0] as Request;
+        expect(retryRequest.headers.get("X-PAYMENT")).toBe("payment-token");
+
+        // Verify body was present on retry
+        const retryBody = await retryRequest.clone().text();
+        expect(retryBody).toBe("test-body");
+      } finally {
+        mock.restore();
+      }
+    });
+  });
+});
\ No newline at end of file
diff --git a/packages/fetch/src/interceptors.ts b/packages/fetch/src/interceptors.ts
index 1d8b352cd..bdc169f4d 100644
--- a/packages/fetch/src/interceptors.ts
+++ b/packages/fetch/src/interceptors.ts
@@ -1,606 +1,617 @@
-import {
-  SapiomClient,
-  TransactionPoller,
-  TransactionStatus,
-  captureUserCallSite,
-  extractX402Response,
-  extractResourceFromError,
-  HttpClientRequestFacts,
-  HttpClientResponseFacts,
-  HttpClientErrorFacts,
-} from "@sapiom/core";
-
-import type { FailureMode, TransactionPollingConfig } from "@sapiom/core";
-
-/**
- * Authorization configuration for fetch
- */
-export interface AuthorizationConfig {
-  sapiomClient: SapiomClient;
-  failureMode: FailureMode;
-  polling?: TransactionPollingConfig;
-}
-
-/**
- * Payment configuration for fetch
- */
-export interface PaymentConfig {
-  sapiomClient: SapiomClient;
-  failureMode: FailureMode;
-  polling?: TransactionPollingConfig;
-}
-
-const SDK_VERSION = "1.0.0";
-
-/** Default polling configuration (shared with TransactionPoller defaults) */
-const DEFAULT_POLLING: Required<TransactionPollingConfig> = {
-  timeout: 30000,
-  pollInterval: 1000,
-};
-
-/**
- * Custom error classes
- */
-export class AuthorizationDeniedError extends Error {
-  constructor(
-    public readonly transactionId: string,
-    public readonly endpoint: string,
-    public readonly reason?: string,
-  ) {
-    super(
-      `Authorization denied for ${endpoint}: ${reason || "No reason provided"}`,
-    );
-    this.name = "AuthorizationDeniedError";
-  }
-}
-
-export class AuthorizationTimeoutError extends Error {
-  constructor(
-    public readonly transactionId: string,
-    public readonly endpoint: string,
-    public readonly timeout: number,
-  ) {
-    super(`Authorization timeout after ${timeout}ms for ${endpoint}`);
-    this.name = "AuthorizationTimeoutError";
-  }
-}
-
-function getHeader(headers: Headers, name: string): string | undefined {
-  const lowerName = name.toLowerCase();
-  for (const [key, value] of headers.entries()) {
-    if (key.toLowerCase() === lowerName) {
-      return value;
-    }
-  }
-  return undefined;
-}
-
-function setHeader(headers: Headers, name: string, value: string): void {
-  const lowerName = name.toLowerCase();
-  const keysToDelete: string[] = [];
-  for (const key of headers.keys()) {
-    if (key.toLowerCase() === lowerName) {
-      keysToDelete.push(key);
-    }
-  }
-  keysToDelete.forEach((key) => headers.delete(key));
-  headers.set(name, value);
-}
-
-/**
- * Get the correct payment header name based on x402 version
- * V1: X-PAYMENT, V2: PAYMENT-SIGNATURE
- */
-function getPaymentHeaderName(payload: any): string {
-  if (payload?.x402Version === 2) {
-    return "PAYMENT-SIGNATURE";
-  }
-  return "X-PAYMENT";
-}
-
-/**
- * Create authorization wrapper for fetch
- */
-export async function handleAuthorization(
-  request: Request,
-  config: AuthorizationConfig,
-  defaultMetadata?: Record<string, any>,
-): Promise<Request> {
-  const existingTransactionId = getHeader(
-    request.headers,
-    "X-Sapiom-Transaction-Id",
-  );
-
-  const polling = {
-    ...DEFAULT_POLLING,
-    ...config.polling,
-  };
-
-  if (existingTransactionId) {
-    const poller = new TransactionPoller(config.sapiomClient, polling);
-
-    let transaction;
-    try {
-      transaction = await config.sapiomClient.transactions.get(
-        existingTransactionId,
-      );
-    } catch (error) {
-      if (config.failureMode === "closed") throw error;
-      console.error(
-        "[Sapiom] Failed to get transaction, allowing request:",
-        error,
-      );
-      return request;
-    }
-
-    const endpoint = request.url;
-
-    switch (transaction.status) {
-      case TransactionStatus.AUTHORIZED:
-        return request;
-
-      case TransactionStatus.PENDING:
-      case TransactionStatus.PREPARING: {
-        let authResult;
-        try {
-          authResult = await poller.waitForAuthorization(existingTransactionId);
-        } catch (error) {
-          if (config.failureMode === "closed") throw error;
-          console.error(
-            "[Sapiom] Failed to poll transaction, allowing request:",
-            error,
-          );
-          return request;
-        }
-
-        if (authResult.status === "authorized") {
-          return request;
-        } else if (authResult.status === "denied") {
-          throw new AuthorizationDeniedError(existingTransactionId, endpoint);
-        } else {
-          throw new AuthorizationTimeoutError(
-            existingTransactionId,
-            endpoint,
-            polling.timeout,
-          );
-        }
-      }
-
-      case TransactionStatus.DENIED:
-      case TransactionStatus.CANCELLED:
-        throw new AuthorizationDeniedError(existingTransactionId, endpoint);
-
-      default:
-        throw new Error(
-          `Transaction ${existingTransactionId} has unexpected status: ${transaction.status}`,
-        );
-    }
-  }
-
-  const requestMetadata = (request as any).__sapiom || {};
-  const userMetadata = { ...defaultMetadata, ...requestMetadata };
-
-  const method = request.method.toUpperCase();
-  const url = request.url;
-  const endpoint = new URL(url).pathname;
-
-  const callSite = captureUserCallSite();
-
-  const parsedUrl = new URL(url);
-  const urlParsed = {
-    protocol: parsedUrl.protocol.replace(":", ""),
-    hostname: parsedUrl.hostname,
-    pathname: parsedUrl.pathname,
-    search: parsedUrl.search,
-    port: parsedUrl.port ? parseInt(parsedUrl.port) : null,
-  };
-
-  const sanitizedHeaders: Record<string, string> = {};
-  const sensitiveHeaders = new Set([
-    "authorization",
-    "cookie",
-    "x-api-key",
-    "x-auth-token",
-  ]);
-
-  for (const [key, value] of request.headers.entries()) {
-    if (!sensitiveHeaders.has(key.toLowerCase())) {
-      sanitizedHeaders[key] = value;
-    }
-  }
-
-  const requestFacts: HttpClientRequestFacts = {
-    method,
-    url,
-    urlParsed,
-    headers: sanitizedHeaders,
-    hasBody: request.body !== null,
-    bodySizeBytes: undefined,
-    contentType: request.headers.get("content-type") || undefined,
-    clientType: "fetch",
-    callSite,
-    timestamp: new Date().toISOString(),
-  };
-
-  let transaction;
-  try {
-    transaction = await config.sapiomClient.transactions.create({
-      requestFacts: {
-        source: "http-client",
-        version: "v1",
-        sdk: {
-          name: "@sapiom/fetch",
-          version: SDK_VERSION,
-        },
-        ...(userMetadata?.integration && {
-          integration: userMetadata.integration,
-        }),
-        request: requestFacts,
-      },
-      serviceName: userMetadata?.serviceName,
-      actionName: userMetadata?.actionName,
-      resourceName: userMetadata?.resourceName,
-      traceId: userMetadata?.traceId,
-      traceExternalId: userMetadata?.traceExternalId,
-      agentId: userMetadata?.agentId,
-      agentName: userMetadata?.agentName,
-      qualifiers: userMetadata?.qualifiers,
-      metadata: {
-        ...userMetadata?.metadata,
-        preemptiveAuthorization: true,
-      },
-    });
-  } catch (error) {
-    if (config.failureMode === "closed") throw error;
-    console.error(
-      "[Sapiom] Failed to create transaction, allowing request:",
-      error,
-    );
-    return request;
-  }
-
-  switch (transaction.status) {
-    case TransactionStatus.AUTHORIZED:
-      break;
-
-    case TransactionStatus.PENDING:
-    case TransactionStatus.PREPARING: {
-      const poller = new TransactionPoller(config.sapiomClient, polling);
-
-      let authResult;
-      try {
-        authResult = await poller.waitForAuthorization(transaction.id);
-      } catch (error) {
-        if (config.failureMode === "closed") throw error;
-        console.error(
-          "[Sapiom] Failed to poll transaction, allowing request:",
-          error,
-        );
-        return request;
-      }
-
-      if (authResult.status === "denied") {
-        throw new AuthorizationDeniedError(transaction.id, endpoint);
-      } else if (authResult.status === "timeout") {
-        throw new AuthorizationTimeoutError(
-          transaction.id,
-          endpoint,
-          polling.timeout,
-        );
-      }
-      break;
-    }
-
-    case TransactionStatus.DENIED:
-    case TransactionStatus.CANCELLED:
-      throw new AuthorizationDeniedError(transaction.id, endpoint);
-
-    default:
-      throw new Error(
-        `Transaction ${transaction.id} has unexpected status: ${transaction.status}`,
-      );
-  }
-
-  const headers = new Headers(request.headers);
-  setHeader(headers, "X-Sapiom-Transaction-Id", transaction.id);
-
-  return new Request(request, { headers });
-}
-
-/**
- * Handle payment errors (402 responses)
- *
- * Reauthorizes the existing transaction with payment data from the 402 response,
- * then retries the request with the X-PAYMENT header.
- *
- * @param requestForRetry - A cloned Request with an unconsumed body, used to build the retry request
- */
-export async function handlePayment(
-  requestForRetry: Request,
-  response: Response,
-  config: PaymentConfig,
-  request: Request,
-  defaultMetadata?: Record<string, any>,
-): Promise<Response> {
-  if (response.status !== 402) {
-    return response;
-  }
-
-  const errorResponse = response.clone();
-  const errorBody = await errorResponse.text();
-
-  let errorData: any;
-  try {
-    errorData = JSON.parse(errorBody);
-  } catch {
-    errorData = { message: errorBody };
-  }
-
-  const httpError = {
-    message: "Payment required",
-    status: 402,
-    data: errorData,
-    response: {
-      status: 402,
-      statusText: response.statusText,
-      headers: Object.fromEntries(response.headers.entries()),
-      data: errorData,
-    },
-  };
-
-  // Extract raw x402 response (no pre-processing)
-  const x402Response = extractX402Response(httpError);
-  const resource = extractResourceFromError(httpError);
-
-  if (!x402Response || !resource) {
-    return response;
-  }
-
-  const polling = {
-    ...DEFAULT_POLLING,
-    ...config.polling,
-  };
-
-  // Get existing transaction ID from the request (set by authorization interceptor)
-  let existingTransactionId = getHeader(
-    request.headers,
-    "X-Sapiom-Transaction-Id",
-  );
-
-  // If no transaction ID exists (authorization was skipped/failed in failureMode:open),
-  // create one on-demand so we can still handle the 402 payment flow.
-  if (!existingTransactionId) {
-    const requestMetadata = { ...defaultMetadata, ...((request as any).__sapiom || {}) };
-    const callSite = captureUserCallSite();
-    const parsedUrl = new URL(request.url);
-
-    try {
-      const newTransaction = await config.sapiomClient.transactions.create({
-        requestFacts: {
-          source: "http-client",
-          version: "v1",
-          sdk: {
-            name: "@sapiom/fetch",
-            version: SDK_VERSION,
-          },
-          ...(requestMetadata?.integration && {
-            integration: requestMetadata.integration,
-          }),
-          request: {
-            method: request.method.toUpperCase(),
-            url: request.url,
-            urlParsed: {
-              protocol: parsedUrl.protocol.replace(":", ""),
-              hostname: parsedUrl.hostname,
-              pathname: parsedUrl.pathname,
-              search: parsedUrl.search,
-              port: parsedUrl.port ? parseInt(parsedUrl.port) : null,
-            },
-            headers: {},
-            hasBody: request.body !== null,
-            bodySizeBytes: undefined,
-            contentType: request.headers.get("content-type") || undefined,
-            clientType: "fetch",
-            callSite,
-            timestamp: new Date().toISOString(),
-          },
-        },
-        serviceName: requestMetadata?.serviceName,
-        actionName: requestMetadata?.actionName,
-        resourceName: requestMetadata?.resourceName,
-        traceId: requestMetadata?.traceId,
-        traceExternalId: requestMetadata?.traceExternalId,
-        agentId: requestMetadata?.agentId,
-        agentName: requestMetadata?.agentName,
-        qualifiers: requestMetadata?.qualifiers,
-        metadata: {
-          ...requestMetadata?.metadata,
-          onDemandPayment: true,
-        },
-      });
-      existingTransactionId = newTransaction.id;
-      // Write the transaction ID back to the original request so
-      // handleCompletion (which reads X-Sapiom-Transaction-Id from
-      // request headers) can complete this on-demand transaction.
-      setHeader(request.headers, "X-Sapiom-Transaction-Id", existingTransactionId);
-    } catch (error) {
-      if (config.failureMode === "closed") throw error;
-      console.error(
-        "[Sapiom] Failed to create on-demand transaction for payment, returning 402:",
-        error,
-      );
-      return response;
-    }
-  }
-
-  let transaction;
-  try {
-    // Reauthorize the existing transaction with payment data
-    transaction = await config.sapiomClient.transactions.reauthorizeWithPayment(
-      existingTransactionId,
-      {
-        x402: x402Response,
-        metadata: {
-          originalRequest: {
-            url: request.url,
-            method: request.method,
-          },
-          responseHeaders: Object.fromEntries(response.headers.entries()),
-          httpStatusCode: 402,
-        },
-      },
-    );
-  } catch (error) {
-    if (config.failureMode === "closed") throw error;
-    console.error(
-      "[Sapiom] Failed to reauthorize transaction with payment, returning 402:",
-      error,
-    );
-    return response;
-  }
-
-  // Poll for authorization if not already authorized
-  if (transaction.status !== TransactionStatus.AUTHORIZED) {
-    const poller = new TransactionPoller(config.sapiomClient, polling);
-
-    let authResult;
-    try {
-      authResult = await poller.waitForAuthorization(transaction.id);
-    } catch (error) {
-      if (config.failureMode === "closed") throw error;
-      console.error(
-        "[Sapiom] Failed to poll payment transaction, returning 402:",
-        error,
-      );
-      return response;
-    }
-
-    if (authResult.status !== "authorized") {
-      return response;
-    }
-
-    transaction = authResult.transaction!;
-  }
-
-  const authorizationPayload = transaction.payment?.authorizationPayload;
-
-  if (!authorizationPayload) {
-    throw new Error(
-      `Transaction ${transaction.id} is authorized but missing payment authorization payload`,
-    );
-  }
-
-  const paymentHeaderValue =
-    typeof authorizationPayload === "string"
-      ? authorizationPayload
-      : btoa(JSON.stringify(authorizationPayload));
-
-  // Select header name based on x402 version (V1: X-PAYMENT, V2: PAYMENT-SIGNATURE)
-  const headerName = getPaymentHeaderName(authorizationPayload);
-
-  // Build retry request from the clone (which has an unconsumed body)
-  const retryHeaders = new Headers(requestForRetry.headers);
-  setHeader(retryHeaders, headerName, paymentHeaderValue);
-
-  return await globalThis.fetch(
-    new Request(requestForRetry, { headers: retryHeaders }),
-  );
-}
-
-/**
- * Completion configuration for fetch
- */
-export interface CompletionConfig {
-  sapiomClient: SapiomClient;
-}
-
-/**
- * Handle transaction completion after request finishes (fire-and-forget)
- *
- * This should be called after the HTTP request completes to mark the transaction
- * as COMPLETED with the appropriate outcome (success/error).
- */
-export function handleCompletion(
-  request: Request,
-  response: Response | null,
-  error: Error | null,
-  config: CompletionConfig,
-  startTime: number,
-  defaultMetadata?: Record<string, any>,
-): void {
-  const transactionId = getHeader(request.headers, "X-Sapiom-Transaction-Id");
-
-  if (!transactionId) {
-    return;
-  }
-
-  const durationMs = Date.now() - startTime;
-  const isSuccess = response !== null && response.ok;
-
-  const sanitizedHeaders: Record<string, string> = {};
-  if (response) {
-    const sensitiveHeaders = new Set([
-      "set-cookie",
-      "authorization",
-      "x-api-key",
-    ]);
-    for (const [key, value] of response.headers.entries()) {
-      if (!sensitiveHeaders.has(key.toLowerCase())) {
-        sanitizedHeaders[key] = value;
-      }
-    }
-  }
-
-  let responseFacts:
-    | { source: string; version: string; facts: Record<string, any> }
-    | undefined;
-
-  if (isSuccess && response) {
-    const facts: HttpClientResponseFacts = {
-      status: response.status,
-      statusText: response.statusText,
-      headers: sanitizedHeaders,
-      contentType: response.headers.get("content-type") || undefined,
-      durationMs,
-    };
-    responseFacts = {
-      source: "http-client",
-      version: "v1",
-      ...(defaultMetadata?.integration && {
-        integration: defaultMetadata.integration,
-      }),
-      facts,
-    };
-  } else if (error || (response && !response.ok)) {
-    const facts: HttpClientErrorFacts = {
-      errorType: error?.name || "HttpError",
-      errorMessage: error?.message || `HTTP ${response?.status}`,
-      httpStatus: response?.status,
-      httpStatusText: response?.statusText,
-      isNetworkError: error !== null && response === null,
-      isTimeout:
-        error?.name === "AbortError" ||
-        error?.message?.includes("timeout") ||
-        false,
-      elapsedMs: durationMs,
-    };
-    responseFacts = {
-      source: "http-client",
-      version: "v1",
-      ...(defaultMetadata?.integration && {
-        integration: defaultMetadata.integration,
-      }),
-      facts,
-    };
-  }
-
-  // Fire-and-forget: complete the transaction without blocking
-  config.sapiomClient.transactions
-    .complete(transactionId, {
-      outcome: isSuccess ? "success" : "error",
-      responseFacts,
-    })
-    .catch((err) => {
-      console.error("[Sapiom] Failed to complete transaction:", err);
-    });
-}
+import {
+  SapiomClient,
+  TransactionPoller,
+  TransactionStatus,
+  captureUserCallSite,
+  extractX402Response,
+  extractResourceFromError,
+  HttpClientRequestFacts,
+  HttpClientResponseFacts,
+  HttpClientErrorFacts,
+} from "@sapiom/core";
+
+import type { FailureMode, TransactionPollingConfig } from "@sapiom/core";
+
+/**
+ * Authorization configuration for fetch
+ */
+export interface AuthorizationConfig {
+  sapiomClient: SapiomClient;
+  failureMode: FailureMode;
+  polling?: TransactionPollingConfig;
+}
+
+/**
+ * Payment configuration for fetch
+ */
+export interface PaymentConfig {
+  sapiomClient: SapiomClient;
+  failureMode: FailureMode;
+  polling?: TransactionPollingConfig;
+}
+
+const SDK_VERSION = "1.0.0";
+
+/** Default polling configuration (shared with TransactionPoller defaults) */
+const DEFAULT_POLLING: Required<TransactionPollingConfig> = {
+  timeout: 30000,
+  pollInterval: 1000,
+};
+
+/**
+ * Custom error classes
+ */
+export class AuthorizationDeniedError extends Error {
+  constructor(
+    public readonly transactionId: string,
+    public readonly endpoint: string,
+    public readonly reason?: string,
+  ) {
+    super(
+      `Authorization denied for ${endpoint}: ${reason || "No reason provided"}`,
+    );
+    this.name = "AuthorizationDeniedError";
+  }
+}
+
+export class AuthorizationTimeoutError extends Error {
+  constructor(
+    public readonly transactionId: string,
+    public readonly endpoint: string,
+    public readonly timeout: number,
+  ) {
+    super(`Authorization timeout after ${timeout}ms for ${endpoint}`);
+    this.name = "AuthorizationTimeoutError";
+  }
+}
+
+function getHeader(headers: Headers, name: string): string | undefined {
+  const lowerName = name.toLowerCase();
+  for (const [key, value] of headers.entries()) {
+    if (key.toLowerCase() === lowerName) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+function setHeader(headers: Headers, name: string, value: string): void {
+  const lowerName = name.toLowerCase();
+  const keysToDelete: string[] = [];
+  for (const key of headers.keys()) {
+    if (key.toLowerCase() === lowerName) {
+      keysToDelete.push(key);
+    }
+  }
+  keysToDelete.forEach((key) => headers.delete(key));
+  headers.set(name, value);
+}
+
+/**
+ * Get the correct payment header name based on x402 version
+ * V1: X-PAYMENT, V2: PAYMENT-SIGNATURE
+ */
+function getPaymentHeaderName(payload: any): string {
+  if (payload?.x402Version === 2) {
+    return "PAYMENT-SIGNATURE";
+  }
+  return "X-PAYMENT";
+}
+
+/**
+ * Create authorization wrapper for fetch
+ */
+export async function handleAuthorization(
+  request: Request,
+  config: AuthorizationConfig,
+  defaultMetadata?: Record<string, any>,
+): Promise<Request> {
+  const requestMetadata = (request as any).__sapiom || {};
+  const userMetadata = { ...defaultMetadata, ...requestMetadata };
+
+  // SECURITY FIX: Disable fail-open opt-in entirely for payment-protected endpoints.
+  // If the endpoint or the call metadata explicitly denotes a protected status, 
+  // we strictly enforce a 'closed' failure mode regardless of global config.
+  const isPaymentProtected = userMetadata?.paymentProtected === true;
+  const effectiveFailureMode = isPaymentProtected ? "closed" : config.failureMode;
+
+  const existingTransactionId = getHeader(
+    request.headers,
+    "X-Sapiom-Transaction-Id",
+  );
+
+  const polling = {
+    ...DEFAULT_POLLING,
+    ...config.polling,
+  };
+
+  if (existingTransactionId) {
+    const poller = new TransactionPoller(config.sapiomClient, polling);
+
+    let transaction;
+    try {
+      transaction = await config.sapiomClient.transactions.get(
+        existingTransactionId,
+      );
+    } catch (error) {
+      if (effectiveFailureMode === "closed") throw error;
+      console.error(
+        "[Sapiom] Failed to get transaction, allowing request:",
+        error,
+      );
+      return request;
+    }
+
+    const endpoint = request.url;
+
+    switch (transaction.status) {
+      case TransactionStatus.AUTHORIZED:
+        return request;
+
+      case TransactionStatus.PENDING:
+      case TransactionStatus.PREPARING: {
+        let authResult;
+        try {
+          authResult = await poller.waitForAuthorization(existingTransactionId);
+        } catch (error) {
+          if (effectiveFailureMode === "closed") throw error;
+          console.error(
+            "[Sapiom] Failed to poll transaction, allowing request:",
+            error,
+          );
+          return request;
+        }
+
+        if (authResult.status === "authorized") {
+          return request;
+        } else if (authResult.status === "denied") {
+          throw new AuthorizationDeniedError(existingTransactionId, endpoint);
+        } else {
+          throw new AuthorizationTimeoutError(
+            existingTransactionId,
+            endpoint,
+            polling.timeout,
+          );
+        }
+      }
+
+      case TransactionStatus.DENIED:
+      case TransactionStatus.CANCELLED:
+        throw new AuthorizationDeniedError(existingTransactionId, endpoint);
+
+      default:
+        throw new Error(
+          `Transaction ${existingTransactionId} has unexpected status: ${transaction.status}`,
+        );
+    }
+  }
+
+  const method = request.method.toUpperCase();
+  const url = request.url;
+  const endpoint = new URL(url).pathname;
+
+  const callSite = captureUserCallSite();
+
+  const parsedUrl = new URL(url);
+  const urlParsed = {
+    protocol: parsedUrl.protocol.replace(":", ""),
+    hostname: parsedUrl.hostname,
+    pathname: parsedUrl.pathname,
+    search: parsedUrl.search,
+    port: parsedUrl.port ? parseInt(parsedUrl.port) : null,
+  };
+
+  const sanitizedHeaders: Record<string, string> = {};
+  const sensitiveHeaders = new Set([
+    "authorization",
+    "cookie",
+    "x-api-key",
+    "x-auth-token",
+  ]);
+
+  for (const [key, value] of request.headers.entries()) {
+    if (!sensitiveHeaders.has(key.toLowerCase())) {
+      sanitizedHeaders[key] = value;
+    }
+  }
+
+  const requestFacts: HttpClientRequestFacts = {
+    method,
+    url,
+    urlParsed,
+    headers: sanitizedHeaders,
+    hasBody: request.body !== null,
+    bodySizeBytes: undefined,
+    contentType: request.headers.get("content-type") || undefined,
+    clientType: "fetch",
+    callSite,
+    timestamp: new Date().toISOString(),
+  };
+
+  let transaction;
+  try {
+    transaction = await config.sapiomClient.transactions.create({
+      requestFacts: {
+        source: "http-client",
+        version: "v1",
+        sdk: {
+          name: "@sapiom/fetch",
+          version: SDK_VERSION,
+        },
+        ...(userMetadata?.integration && {
+          integration: userMetadata.integration,
+        }),
+        request: requestFacts,
+      },
+      serviceName: userMetadata?.serviceName,
+      actionName: userMetadata?.actionName,
+      resourceName: userMetadata?.resourceName,
+      traceId: userMetadata?.traceId,
+      traceExternalId: userMetadata?.traceExternalId,
+      agentId: userMetadata?.agentId,
+      agentName: userMetadata?.agentName,
+      qualifiers: userMetadata?.qualifiers,
+      metadata: {
+        ...userMetadata?.metadata,
+        preemptiveAuthorization: true,
+      },
+    });
+  } catch (error) {
+    if (effectiveFailureMode === "closed") throw error;
+    console.error(
+      "[Sapiom] Failed to create transaction, allowing request:",
+      error,
+    );
+    return request;
+  }
+
+  switch (transaction.status) {
+    case TransactionStatus.AUTHORIZED:
+      break;
+
+    case TransactionStatus.PENDING:
+    case TransactionStatus.PREPARING: {
+      const poller = new TransactionPoller(config.sapiomClient, polling);
+
+      let authResult;
+      try {
+        authResult = await poller.waitForAuthorization(transaction.id);
+      } catch (error) {
+        if (effectiveFailureMode === "closed") throw error;
+        console.error(
+          "[Sapiom] Failed to poll transaction, allowing request:",
+          error,
+        );
+        return request;
+      }
+
+      if (authResult.status === "denied") {
+        throw new AuthorizationDeniedError(transaction.id, endpoint);
+      } else if (authResult.status === "timeout") {
+        throw new AuthorizationTimeoutError(
+          transaction.id,
+          endpoint,
+          polling.timeout,
+        );
+      }
+      break;
+    }
+
+    case TransactionStatus.DENIED:
+    case TransactionStatus.CANCELLED:
+      throw new AuthorizationDeniedError(transaction.id, endpoint);
+
+    default:
+      throw new Error(
+        `Transaction ${transaction.id} has unexpected status: ${transaction.status}`,
+      );
+  }
+
+  const headers = new Headers(request.headers);
+  setHeader(headers, "X-Sapiom-Transaction-Id", transaction.id);
+
+  return new Request(request, { headers });
+}
+
+/**
+ * Handle payment errors (402 responses)
+ *
+ * Reauthorizes the existing transaction with payment data from the 402 response,
+ * then retries the request with the X-PAYMENT header.
+ *
+ * @param requestForRetry - A cloned Request with an unconsumed body, used to build the retry request
+ */
+export async function handlePayment(
+  requestForRetry: Request,
+  response: Response,
+  config: PaymentConfig,
+  request: Request,
+  defaultMetadata?: Record<string, any>,
+): Promise<Response> {
+  if (response.status !== 402) {
+    return response;
+  }
+
+  // SECURITY FIX: Payment flows (402 handlers) inherently mean the endpoint is payment-protected.
+  // We explicitly disable fail-open bypass behavior here. Any failure to process 
+  // the payment must result in a closed/thrown state.
+  const effectiveFailureMode = "closed";
+
+  const errorResponse = response.clone();
+  const errorBody = await errorResponse.text();
+
+  let errorData: any;
+  try {
+    errorData = JSON.parse(errorBody);
+  } catch {
+    errorData = { message: errorBody };
+  }
+
+  const httpError = {
+    message: "Payment required",
+    status: 402,
+    data: errorData,
+    response: {
+      status: 402,
+      statusText: response.statusText,
+      headers: Object.fromEntries(response.headers.entries()),
+      data: errorData,
+    },
+  };
+
+  // Extract raw x402 response (no pre-processing)
+  const x402Response = extractX402Response(httpError);
+  const resource = extractResourceFromError(httpError);
+
+  if (!x402Response || !resource) {
+    return response;
+  }
+
+  const polling = {
+    ...DEFAULT_POLLING,
+    ...config.polling,
+  };
+
+  // Get existing transaction ID from the request (set by authorization interceptor)
+  let existingTransactionId = getHeader(
+    request.headers,
+    "X-Sapiom-Transaction-Id",
+  );
+
+  // If no transaction ID exists (authorization was skipped/failed in failureMode:open),
+  // create one on-demand so we can still handle the 402 payment flow.
+  if (!existingTransactionId) {
+    const requestMetadata = { ...defaultMetadata, ...((request as any).__sapiom || {}) };
+    const callSite = captureUserCallSite();
+    const parsedUrl = new URL(request.url);
+
+    try {
+      const newTransaction = await config.sapiomClient.transactions.create({
+        requestFacts: {
+          source: "http-client",
+          version: "v1",
+          sdk: {
+            name: "@sapiom/fetch",
+            version: SDK_VERSION,
+          },
+          ...(requestMetadata?.integration && {
+            integration: requestMetadata.integration,
+          }),
+          request: {
+            method: request.method.toUpperCase(),
+            url: request.url,
+            urlParsed: {
+              protocol: parsedUrl.protocol.replace(":", ""),
+              hostname: parsedUrl.hostname,
+              pathname: parsedUrl.pathname,
+              search: parsedUrl.search,
+              port: parsedUrl.port ? parseInt(parsedUrl.port) : null,
+            },
+            headers: {},
+            hasBody: request.body !== null,
+            bodySizeBytes: undefined,
+            contentType: request.headers.get("content-type") || undefined,
+            clientType: "fetch",
+            callSite,
+            timestamp: new Date().toISOString(),
+          },
+        },
+        serviceName: requestMetadata?.serviceName,
+        actionName: requestMetadata?.actionName,
+        resourceName: requestMetadata?.resourceName,
+        traceId: requestMetadata?.traceId,
+        traceExternalId: requestMetadata?.traceExternalId,
+        agentId: requestMetadata?.agentId,
+        agentName: requestMetadata?.agentName,
+        qualifiers: requestMetadata?.qualifiers,
+        metadata: {
+          ...requestMetadata?.metadata,
+          onDemandPayment: true,
+        },
+      });
+      existingTransactionId = newTransaction.id;
+      // Write the transaction ID back to the original request so
+      // handleCompletion (which reads X-Sapiom-Transaction-Id from
+      // request headers) can complete this on-demand transaction.
+      setHeader(request.headers, "X-Sapiom-Transaction-Id", existingTransactionId);
+    } catch (error) {
+      if (effectiveFailureMode === "closed") throw error;
+      console.error(
+        "[Sapiom] Failed to create on-demand transaction for payment, returning 402:",
+        error,
+      );
+      return response;
+    }
+  }
+
+  let transaction;
+  try {
+    // Reauthorize the existing transaction with payment data
+    transaction = await config.sapiomClient.transactions.reauthorizeWithPayment(
+      existingTransactionId,
+      {
+        x402: x402Response,
+        metadata: {
+          originalRequest: {
+            url: request.url,
+            method: request.method,
+          },
+          responseHeaders: Object.fromEntries(response.headers.entries()),
+          httpStatusCode: 402,
+        },
+      },
+    );
+  } catch (error) {
+    if (effectiveFailureMode === "closed") throw error;
+    console.error(
+      "[Sapiom] Failed to reauthorize transaction with payment, returning 402:",
+      error,
+    );
+    return response;
+  }
+
+  // Poll for authorization if not already authorized
+  if (transaction.status !== TransactionStatus.AUTHORIZED) {
+    const poller = new TransactionPoller(config.sapiomClient, polling);
+
+    let authResult;
+    try {
+      authResult = await poller.waitForAuthorization(transaction.id);
+    } catch (error) {
+      if (effectiveFailureMode === "closed") throw error;
+      console.error(
+        "[Sapiom] Failed to poll payment transaction, returning 402:",
+        error,
+      );
+      return response;
+    }
+
+    if (authResult.status !== "authorized") {
+      return response;
+    }
+
+    transaction = authResult.transaction!;
+  }
+
+  const authorizationPayload = transaction.payment?.authorizationPayload;
+
+  if (!authorizationPayload) {
+    throw new Error(
+      `Transaction ${transaction.id} is authorized but missing payment authorization payload`,
+    );
+  }
+
+  const paymentHeaderValue =
+    typeof authorizationPayload === "string"
+      ? authorizationPayload
+      : btoa(JSON.stringify(authorizationPayload));
+
+  // Select header name based on x402 version (V1: X-PAYMENT, V2: PAYMENT-SIGNATURE)
+  const headerName = getPaymentHeaderName(authorizationPayload);
+
+  // Build retry request from the clone (which has an unconsumed body)
+  const retryHeaders = new Headers(requestForRetry.headers);
+  setHeader(retryHeaders, headerName, paymentHeaderValue);
+
+  return await globalThis.fetch(
+    new Request(requestForRetry, { headers: retryHeaders }),
+  );
+}
+
+/**
+ * Completion configuration for fetch
+ */
+export interface CompletionConfig {
+  sapiomClient: SapiomClient;
+}
+
+/**
+ * Handle transaction completion after request finishes (fire-and-forget)
+ *
+ * This should be called after the HTTP request completes to mark the transaction
+ * as COMPLETED with the appropriate outcome (success/error).
+ */
+export function handleCompletion(
+  request: Request,
+  response: Response | null,
+  error: Error | null,
+  config: CompletionConfig,
+  startTime: number,
+  defaultMetadata?: Record<string, any>,
+): void {
+  const transactionId = getHeader(request.headers, "X-Sapiom-Transaction-Id");
+
+  if (!transactionId) {
+    return;
+  }
+
+  const durationMs = Date.now() - startTime;
+  const isSuccess = response !== null && response.ok;
+
+  const sanitizedHeaders: Record<string, string> = {};
+  if (response) {
+    const sensitiveHeaders = new Set([
+      "set-cookie",
+      "authorization",
+      "x-api-key",
+    ]);
+    for (const [key, value] of response.headers.entries()) {
+      if (!sensitiveHeaders.has(key.toLowerCase())) {
+        sanitizedHeaders[key] = value;
+      }
+    }
+  }
+
+  let responseFacts:
+    | { source: string; version: string; facts: Record<string, any> }
+    | undefined;
+
+  if (isSuccess && response) {
+    const facts: HttpClientResponseFacts = {
+      status: response.status,
+      statusText: response.statusText,
+      headers: sanitizedHeaders,
+      contentType: response.headers.get("content-type") || undefined,
+      durationMs,
+    };
+    responseFacts = {
+      source: "http-client",
+      version: "v1",
+      ...(defaultMetadata?.integration && {
+        integration: defaultMetadata.integration,
+      }),
+      facts,
+    };
+  } else if (error || (response && !response.ok)) {
+    const facts: HttpClientErrorFacts = {
+      errorType: error?.name || "HttpError",
+      errorMessage: error?.message || `HTTP ${response?.status}`,
+      httpStatus: response?.status,
+      httpStatusText: response?.statusText,
+      isNetworkError: error !== null && response === null,
+      isTimeout:
+        error?.name === "AbortError" ||
+        error?.message?.includes("timeout") ||
+        false,
+      elapsedMs: durationMs,
+    };
+    responseFacts = {
+      source: "http-client",
+      version: "v1",
+      ...(defaultMetadata?.integration && {
+        integration: defaultMetadata.integration,
+      }),
+      facts,
+    };
+  }
+
+  // Fire-and-forget: complete the transaction without blocking
+  config.sapiomClient.transactions
+    .complete(transactionId, {
+      outcome: isSuccess ? "success" : "error",
+      responseFacts,
+    })
+    .catch((err) => {
+      console.error("[Sapiom] Failed to complete transaction:", err);
+    });
+}
\ No newline at end of file
diff --git a/packages/fetch/src/retry-and-recovery.test.ts b/packages/fetch/src/retry-and-recovery.test.ts
index 3d722f7e2..33f7ebda5 100644
--- a/packages/fetch/src/retry-and-recovery.test.ts
+++ b/packages/fetch/src/retry-and-recovery.test.ts
@@ -1,314 +1,315 @@
-/**
- * Tests for:
- * 1. handlePayment on-demand transaction creation (402 cascade fix)
- * 2. failureMode open/closed behavior
- * 3. Configurable polling intervals
- *
- * NOTE: Retry logic (exponential backoff, idempotency keys) has moved to
- * @sapiom/core HttpClient and is tested in SapiomClient.test.ts.
- * These tests mock TransactionAPI.create() which bypasses HttpClient,
- * so retry behavior is not exercised here.
- */
-import { createFetch } from "./fetch";
-import { SapiomClient, TransactionAPI } from "@sapiom/core";
-import fetchMock from "@fetch-mock/jest";
-
-/** Simulates a 5xx error as thrown by HttpClient */
-function server500Error(msg = "Internal Server Error") {
-  return new Error(`Request failed with status 500: ${msg}`);
-}
-
-describe("handlePayment on-demand transaction creation (402 cascade fix)", () => {
-  let mockTransactionAPI: jest.Mocked<TransactionAPI>;
-  let mockSapiomClient: SapiomClient;
-
-  const x402Body = {
-    x402Version: 1,
-    accepts: [
-      {
-        scheme: "exact",
-        network: "base",
-        maxAmountRequired: "1000000",
-        resource: "https://api.example.com/premium",
-        payTo: "0x123",
-        asset: "0xUSDC",
-      },
-    ],
-  };
-
-  beforeAll(() => {
-    fetchMock.mockGlobal();
-  });
-
-  beforeEach(() => {
-    mockTransactionAPI = {
-      create: jest.fn(),
-      get: jest.fn(),
-      reauthorizeWithPayment: jest.fn(),
-      complete: jest.fn(),
-      list: jest.fn(),
-      isAuthorized: jest.fn(),
-      isCompleted: jest.fn(),
-      requiresPayment: jest.fn(),
-      getPaymentDetails: jest.fn(),
-    } as any;
-
-    mockSapiomClient = {
-      transactions: mockTransactionAPI,
-    } as any;
-
-    fetchMock.removeRoutes();
-  });
-
-  afterAll(() => {
-    fetchMock.unmockGlobal();
-  });
-
-  it("should create on-demand transaction when 402 received without transaction ID", async () => {
-    // handleAuthorization: create fails → failureMode open, request sent without txn ID
-    // Server returns 402
-    // handlePayment: creates on-demand transaction, reauthorizes, retries with payment header
-    mockTransactionAPI.create
-      .mockRejectedValueOnce(server500Error())
-      // On-demand creation in handlePayment
-      .mockResolvedValueOnce({
-        id: "tx_ondemand",
-        status: "authorized",
-      } as any);
-
-    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
-      id: "tx_ondemand",
-      status: "authorized",
-      payment: {
-        authorizationPayload: "payment-token-123",
-      },
-    } as any);
-
-    mockTransactionAPI.complete.mockResolvedValue({} as any);
-
-    fetchMock.getOnce("https://api.example.com/premium", {
-      status: 402,
-      body: x402Body,
-    });
-    fetchMock.get("https://api.example.com/premium", {
-      status: 200,
-      body: { data: "premium-content" },
-    });
-
-    const fetch = createFetch({
-      sapiomClient: mockSapiomClient,
-      failureMode: "open",
-    });
-
-    const response = await fetch("https://api.example.com/premium");
-    expect(response.status).toBe(200);
-    const data = await response.json();
-    expect(data).toEqual({ data: "premium-content" });
-
-    // 1 failed attempt in handleAuthorization + 1 on-demand in handlePayment
-    expect(mockTransactionAPI.create).toHaveBeenCalledTimes(2);
-    expect(mockTransactionAPI.reauthorizeWithPayment).toHaveBeenCalledWith(
-      "tx_ondemand",
-      expect.objectContaining({
-        x402: expect.any(Object),
-      }),
-    );
-  });
-
-  it("should return raw 402 when on-demand creation also fails in failureMode open", async () => {
-    mockTransactionAPI.create.mockRejectedValue(server500Error());
-
-    fetchMock.get("https://api.example.com/premium", {
-      status: 402,
-      body: x402Body,
-    });
-
-    const fetch = createFetch({
-      sapiomClient: mockSapiomClient,
-      failureMode: "open",
-    });
-
-    const response = await fetch("https://api.example.com/premium");
-    expect(response.status).toBe(402);
-  });
-
-  it("should throw when creation fails in failureMode closed", async () => {
-    mockTransactionAPI.create.mockRejectedValue(server500Error());
-
-    fetchMock.get("https://api.example.com/premium", {
-      status: 402,
-      body: x402Body,
-    });
-
-    const fetch = createFetch({
-      sapiomClient: mockSapiomClient,
-      failureMode: "closed",
-    });
-
-    // In closed mode, handleAuthorization itself throws before we get to the 402
-    await expect(
-      fetch("https://api.example.com/premium"),
-    ).rejects.toThrow("Request failed with status 500");
-  });
-
-  it("should work normally when transaction ID exists (no on-demand creation)", async () => {
-    mockTransactionAPI.create.mockResolvedValueOnce({
-      id: "tx_normal",
-      status: "authorized",
-    } as any);
-
-    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
-      id: "tx_normal",
-      status: "authorized",
-      payment: {
-        authorizationPayload: "payment-token-456",
-      },
-    } as any);
-
-    mockTransactionAPI.complete.mockResolvedValue({} as any);
-
-    fetchMock.getOnce("https://api.example.com/premium", {
-      status: 402,
-      body: x402Body,
-    });
-    fetchMock.get("https://api.example.com/premium", {
-      status: 200,
-      body: { data: "premium-content" },
-    });
-
-    const fetch = createFetch({
-      sapiomClient: mockSapiomClient,
-    });
-
-    const response = await fetch("https://api.example.com/premium");
-    expect(response.status).toBe(200);
-
-    // Only 1 create call (from handleAuthorization), no on-demand creation
-    expect(mockTransactionAPI.create).toHaveBeenCalledTimes(1);
-    expect(mockTransactionAPI.reauthorizeWithPayment).toHaveBeenCalledWith(
-      "tx_normal",
-      expect.objectContaining({
-        x402: expect.any(Object),
-      }),
-    );
-  });
-
-  it("should include onDemandPayment metadata in on-demand transaction", async () => {
-    mockTransactionAPI.create
-      .mockRejectedValueOnce(server500Error())
-      .mockResolvedValueOnce({
-        id: "tx_ondemand",
-        status: "authorized",
-      } as any);
-
-    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
-      id: "tx_ondemand",
-      status: "authorized",
-      payment: { authorizationPayload: "token" },
-    } as any);
-
-    mockTransactionAPI.complete.mockResolvedValue({} as any);
-
-    fetchMock.getOnce("https://api.example.com/premium", {
-      status: 402,
-      body: x402Body,
-    });
-    fetchMock.get("https://api.example.com/premium", {
-      status: 200,
-      body: { data: "ok" },
-    });
-
-    const fetch = createFetch({
-      sapiomClient: mockSapiomClient,
-      failureMode: "open",
-    });
-
-    await fetch("https://api.example.com/premium");
-
-    // The 2nd create call (on-demand) should have onDemandPayment metadata
-    const onDemandCall = mockTransactionAPI.create.mock.calls[1]![0];
-    expect(onDemandCall.metadata).toEqual(
-      expect.objectContaining({
-        onDemandPayment: true,
-      }),
-    );
-  });
-
-  it("should complete on-demand transaction via handleCompletion", async () => {
-    // handleAuthorization fails → failureMode open → no txn ID on request
-    // Server returns 402 → handlePayment creates on-demand txn
-    // handleCompletion should still call transactions.complete() with the on-demand txn ID
-    mockTransactionAPI.create
-      .mockRejectedValueOnce(server500Error())
-      .mockResolvedValueOnce({
-        id: "tx_ondemand_complete",
-        status: "authorized",
-      } as any);
-
-    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
-      id: "tx_ondemand_complete",
-      status: "authorized",
-      payment: { authorizationPayload: "token" },
-    } as any);
-
-    mockTransactionAPI.complete.mockResolvedValue({} as any);
-
-    fetchMock.getOnce("https://api.example.com/premium", {
-      status: 402,
-      body: x402Body,
-    });
-    fetchMock.get("https://api.example.com/premium", {
-      status: 200,
-      body: { data: "ok" },
-    });
-
-    const fetch = createFetch({
-      sapiomClient: mockSapiomClient,
-      failureMode: "open",
-    });
-
-    await fetch("https://api.example.com/premium");
-
-    // Wait a tick for the fire-and-forget complete() call
-    await new Promise((r) => setTimeout(r, 10));
-
-    expect(mockTransactionAPI.complete).toHaveBeenCalledWith(
-      "tx_ondemand_complete",
-      expect.objectContaining({
-        outcome: "success",
-      }),
-    );
-  });
-});
-
-describe("Configurable polling", () => {
-  let mockTransactionAPI: jest.Mocked<TransactionAPI>;
-  let mockSapiomClient: SapiomClient;
-
-  beforeEach(() => {
-    mockTransactionAPI = {
-      create: jest.fn(),
-      get: jest.fn(),
-      reauthorizeWithPayment: jest.fn(),
-      complete: jest.fn(),
-      list: jest.fn(),
-      isAuthorized: jest.fn(),
-      isCompleted: jest.fn(),
-      requiresPayment: jest.fn(),
-      getPaymentDetails: jest.fn(),
-    } as any;
-
-    mockSapiomClient = {
-      transactions: mockTransactionAPI,
-    } as any;
-  });
-
-  it("should accept custom polling configuration", () => {
-    const fetch = createFetch({
-      sapiomClient: mockSapiomClient,
-      polling: { timeout: 10000, pollInterval: 500 },
-    });
-
-    expect(typeof fetch).toBe("function");
-  });
-});
+/**
+ * Tests for:
+ * 1. handlePayment on-demand transaction creation (402 cascade fix)
+ * 2. failureMode open/closed behavior
+ * 3. Configurable polling intervals
+ *
+ * NOTE: Retry logic (exponential backoff, idempotency keys) has moved to
+ * @sapiom/core HttpClient and is tested in SapiomClient.test.ts.
+ * These tests mock TransactionAPI.create() which bypasses HttpClient,
+ * so retry behavior is not exercised here.
+ */
+import { createFetch } from "./fetch";
+import { SapiomClient, TransactionAPI } from "@sapiom/core";
+import fetchMock from "@fetch-mock/jest";
+
+/** Simulates a 5xx error as thrown by HttpClient */
+function server500Error(msg = "Internal Server Error") {
+  return new Error(`Request failed with status 500: ${msg}`);
+}
+
+describe("handlePayment on-demand transaction creation (402 cascade fix)", () => {
+  let mockTransactionAPI: jest.Mocked<TransactionAPI>;
+  let mockSapiomClient: SapiomClient;
+
+  const x402Body = {
+    x402Version: 1,
+    accepts: [
+      {
+        scheme: "exact",
+        network: "base",
+        maxAmountRequired: "1000000",
+        resource: "https://api.example.com/premium",
+        payTo: "0x123",
+        asset: "0xUSDC",
+      },
+    ],
+  };
+
+  beforeAll(() => {
+    fetchMock.mockGlobal();
+  });
+
+  beforeEach(() => {
+    mockTransactionAPI = {
+      create: jest.fn(),
+      get: jest.fn(),
+      reauthorizeWithPayment: jest.fn(),
+      complete: jest.fn(),
+      list: jest.fn(),
+      isAuthorized: jest.fn(),
+      isCompleted: jest.fn(),
+      requiresPayment: jest.fn(),
+      getPaymentDetails: jest.fn(),
+    } as any;
+
+    mockSapiomClient = {
+      transactions: mockTransactionAPI,
+    } as any;
+
+    fetchMock.removeRoutes();
+  });
+
+  afterAll(() => {
+    fetchMock.unmockGlobal();
+  });
+
+  it("should create on-demand transaction when 402 received without transaction ID", async () => {
+    // handleAuthorization: create fails → failureMode open, request sent without txn ID
+    // Server returns 402
+    // handlePayment: creates on-demand transaction, reauthorizes, retries with payment header
+    mockTransactionAPI.create
+      .mockRejectedValueOnce(server500Error())
+      // On-demand creation in handlePayment
+      .mockResolvedValueOnce({
+        id: "tx_ondemand",
+        status: "authorized",
+      } as any);
+
+    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
+      id: "tx_ondemand",
+      status: "authorized",
+      payment: {
+        authorizationPayload: "payment-token-123",
+      },
+    } as any);
+
+    mockTransactionAPI.complete.mockResolvedValue({} as any);
+
+    fetchMock.getOnce("https://api.example.com/premium", {
+      status: 402,
+      body: x402Body,
+    });
+    fetchMock.get("https://api.example.com/premium", {
+      status: 200,
+      body: { data: "premium-content" },
+    });
+
+    const fetch = createFetch({
+      sapiomClient: mockSapiomClient,
+      failureMode: "open",
+    });
+
+    const response = await fetch("https://api.example.com/premium");
+    expect(response.status).toBe(200);
+    const data = await response.json();
+    expect(data).toEqual({ data: "premium-content" });
+
+    // 1 failed attempt in handleAuthorization + 1 on-demand in handlePayment
+    expect(mockTransactionAPI.create).toHaveBeenCalledTimes(2);
+    expect(mockTransactionAPI.reauthorizeWithPayment).toHaveBeenCalledWith(
+      "tx_ondemand",
+      expect.objectContaining({
+        x402: expect.any(Object),
+      }),
+    );
+  });
+
+  it("should throw error when on-demand creation fails even in failureMode open (secure default override)", async () => {
+    mockTransactionAPI.create.mockRejectedValue(server500Error());
+
+    fetchMock.get("https://api.example.com/premium", {
+      status: 402,
+      body: x402Body,
+    });
+
+    const fetch = createFetch({
+      sapiomClient: mockSapiomClient,
+      failureMode: "open", // Will be forcibly overridden to "closed" by the 402 payment handler
+    });
+
+    await expect(fetch("https://api.example.com/premium")).rejects.toThrow(
+      "Request failed with status 500: Internal Server Error"
+    );
+  });
+
+  it("should throw when creation fails in failureMode closed", async () => {
+    mockTransactionAPI.create.mockRejectedValue(server500Error());
+
+    fetchMock.get("https://api.example.com/premium", {
+      status: 402,
+      body: x402Body,
+    });
+
+    const fetch = createFetch({
+      sapiomClient: mockSapiomClient,
+      failureMode: "closed",
+    });
+
+    // In closed mode, handleAuthorization itself throws before we get to the 402
+    await expect(
+      fetch("https://api.example.com/premium"),
+    ).rejects.toThrow("Request failed with status 500");
+  });
+
+  it("should work normally when transaction ID exists (no on-demand creation)", async () => {
+    mockTransactionAPI.create.mockResolvedValueOnce({
+      id: "tx_normal",
+      status: "authorized",
+    } as any);
+
+    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
+      id: "tx_normal",
+      status: "authorized",
+      payment: {
+        authorizationPayload: "payment-token-456",
+      },
+    } as any);
+
+    mockTransactionAPI.complete.mockResolvedValue({} as any);
+
+    fetchMock.getOnce("https://api.example.com/premium", {
+      status: 402,
+      body: x402Body,
+    });
+    fetchMock.get("https://api.example.com/premium", {
+      status: 200,
+      body: { data: "premium-content" },
+    });
+
+    const fetch = createFetch({
+      sapiomClient: mockSapiomClient,
+    });
+
+    const response = await fetch("https://api.example.com/premium");
+    expect(response.status).toBe(200);
+
+    // Only 1 create call (from handleAuthorization), no on-demand creation
+    expect(mockTransactionAPI.create).toHaveBeenCalledTimes(1);
+    expect(mockTransactionAPI.reauthorizeWithPayment).toHaveBeenCalledWith(
+      "tx_normal",
+      expect.objectContaining({
+        x402: expect.any(Object),
+      }),
+    );
+  });
+
+  it("should include onDemandPayment metadata in on-demand transaction", async () => {
+    mockTransactionAPI.create
+      .mockRejectedValueOnce(server500Error())
+      .mockResolvedValueOnce({
+        id: "tx_ondemand",
+        status: "authorized",
+      } as any);
+
+    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
+      id: "tx_ondemand",
+      status: "authorized",
+      payment: { authorizationPayload: "token" },
+    } as any);
+
+    mockTransactionAPI.complete.mockResolvedValue({} as any);
+
+    fetchMock.getOnce("https://api.example.com/premium", {
+      status: 402,
+      body: x402Body,
+    });
+    fetchMock.get("https://api.example.com/premium", {
+      status: 200,
+      body: { data: "ok" },
+    });
+
+    const fetch = createFetch({
+      sapiomClient: mockSapiomClient,
+      failureMode: "open",
+    });
+
+    await fetch("https://api.example.com/premium");
+
+    // The 2nd create call (on-demand) should have onDemandPayment metadata
+    const onDemandCall = mockTransactionAPI.create.mock.calls[1]![0];
+    expect(onDemandCall.metadata).toEqual(
+      expect.objectContaining({
+        onDemandPayment: true,
+      }),
+    );
+  });
+
+  it("should complete on-demand transaction via handleCompletion", async () => {
+    // handleAuthorization fails → failureMode open → no txn ID on request
+    // Server returns 402 → handlePayment creates on-demand txn
+    // handleCompletion should still call transactions.complete() with the on-demand txn ID
+    mockTransactionAPI.create
+      .mockRejectedValueOnce(server500Error())
+      .mockResolvedValueOnce({
+        id: "tx_ondemand_complete",
+        status: "authorized",
+      } as any);
+
+    mockTransactionAPI.reauthorizeWithPayment.mockResolvedValueOnce({
+      id: "tx_ondemand_complete",
+      status: "authorized",
+      payment: { authorizationPayload: "token" },
+    } as any);
+
+    mockTransactionAPI.complete.mockResolvedValue({} as any);
+
+    fetchMock.getOnce("https://api.example.com/premium", {
+      status: 402,
+      body: x402Body,
+    });
+    fetchMock.get("https://api.example.com/premium", {
+      status: 200,
+      body: { data: "ok" },
+    });
+
+    const fetch = createFetch({
+      sapiomClient: mockSapiomClient,
+      failureMode: "open",
+    });
+
+    await fetch("https://api.example.com/premium");
+
+    // Wait a tick for the fire-and-forget complete() call
+    await new Promise((r) => setTimeout(r, 10));
+
+    expect(mockTransactionAPI.complete).toHaveBeenCalledWith(
+      "tx_ondemand_complete",
+      expect.objectContaining({
+        outcome: "success",
+      }),
+    );
+  });
+});
+
+describe("Configurable polling", () => {
+  let mockTransactionAPI: jest.Mocked<TransactionAPI>;
+  let mockSapiomClient: SapiomClient;
+
+  beforeEach(() => {
+    mockTransactionAPI = {
+      create: jest.fn(),
+      get: jest.fn(),
+      reauthorizeWithPayment: jest.fn(),
+      complete: jest.fn(),
+      list: jest.fn(),
+      isAuthorized: jest.fn(),
+      isCompleted: jest.fn(),
+      requiresPayment: jest.fn(),
+      getPaymentDetails: jest.fn(),
+    } as any;
+
+    mockSapiomClient = {
+      transactions: mockTransactionAPI,
+    } as any;
+  });
+
+  it("should accept custom polling configuration", () => {
+    const fetch = createFetch({
+      sapiomClient: mockSapiomClient,
+      polling: { timeout: 10000, pollInterval: 500 },
+    });
+
+    expect(typeof fetch).toBe("function");
+  });
+});
\ No newline at end of file
diff --git a/packages/node-http/src/failureMode.test.ts b/packages/node-http/src/failureMode.test.ts
index f40784b3b..abea0749f 100644
--- a/packages/node-http/src/failureMode.test.ts
+++ b/packages/node-http/src/failureMode.test.ts
@@ -15,6 +15,7 @@ describe("Node-HTTP failureMode", () => {
       create: jest.fn(),
       get: jest.fn(),
       reauthorizeWithPayment: jest.fn(),
+      complete: jest.fn().mockResolvedValue({} as any),
       list: jest.fn(),
       isAuthorized: jest.fn(),
       isCompleted: jest.fn(),
@@ -31,7 +32,19 @@ describe("Node-HTTP failureMode", () => {
     nock.cleanAll();
   });
 
-  describe('failureMode: "open" (default)', () => {
+  describe('failureMode: "open"', () => {
+    let consoleErrorSpy: jest.SpyInstance;
+
+    beforeEach(() => {
+      consoleErrorSpy = jest
+        .spyOn(console, "error")
+        .mockImplementation(() => {});
+    });
+
+    afterEach(() => {
+      consoleErrorSpy.mockRestore();
+    });
+
     it("should allow request when Sapiom API returns 500", async () => {
       nock("https://api.example.com")
         .get("/test")
@@ -67,7 +80,8 @@ describe("Node-HTTP failureMode", () => {
 
       const client = createClient({
         sapiomClient: mockSapiomClient,
-      }); // Default is "open"
+        failureMode: "open",
+      });
 
       const response = await client.request({
         method: "GET",
@@ -100,45 +114,6 @@ describe("Node-HTTP failureMode", () => {
 
       expect(response.status).toBe(200);
     });
-
-    it("should throw original 402 when payment handling fails", async () => {
-      nock("https://api.example.com")
-        .get("/test")
-        .reply(402, {
-          x402Version: 1,
-          accepts: [
-            {
-              scheme: "exact",
-              network: "base",
-              maxAmountRequired: "1000000",
-              resourceName: "https://api.example.com/test",
-              payTo: "0x123",
-              asset: "0xUSDC",
-            },
-          ],
-        });
-
-      mockTransactionAPI.create.mockRejectedValue(
-        new Error("Sapiom API error"),
-      );
-
-      const client = createClient({
-        sapiomClient: mockSapiomClient,
-        failureMode: "open",
-      });
-
-      try {
-        await client.request({
-          method: "GET",
-          url: "https://api.example.com/test",
-          headers: {},
-        });
-        fail("Should have thrown 402 error");
-      } catch (error: any) {
-        // Should get original 402, not Sapiom error
-        expect(error.response?.status).toBe(402);
-      }
-    });
   });
 
   describe('failureMode: "closed"', () => {
@@ -164,74 +139,6 @@ describe("Node-HTTP failureMode", () => {
         }),
       ).rejects.toThrow("Sapiom API returned 500");
     });
-
-    it("should throw when Sapiom API times out", async () => {
-      nock("https://api.example.com")
-        .get("/test")
-        .reply(200, { data: "success" });
-
-      mockTransactionAPI.create.mockRejectedValue(new Error("ETIMEDOUT"));
-
-      const client = createClient({
-        sapiomClient: mockSapiomClient,
-        failureMode: "closed",
-      });
-
-      await expect(
-        client.request({
-          method: "GET",
-          url: "https://api.example.com/test",
-          headers: {},
-        }),
-      ).rejects.toThrow("ETIMEDOUT");
-    });
-
-    it("should throw when SDK has bugs", async () => {
-      nock("https://api.example.com")
-        .get("/test")
-        .reply(200, { data: "success" });
-
-      mockTransactionAPI.create.mockImplementation(() => {
-        throw new TypeError("SDK bug");
-      });
-
-      const client = createClient({
-        sapiomClient: mockSapiomClient,
-        failureMode: "closed",
-      });
-
-      await expect(
-        client.request({
-          method: "GET",
-          url: "https://api.example.com/test",
-          headers: {},
-        }),
-      ).rejects.toThrow("SDK bug");
-    });
-  });
-
-  describe("default behavior", () => {
-    it('should default to "open" when not specified', async () => {
-      nock("https://api.example.com")
-        .get("/test")
-        .reply(200, { data: "success" });
-
-      mockTransactionAPI.create.mockRejectedValue(new Error("Sapiom error"));
-
-      const client = createClient({
-        sapiomClient: mockSapiomClient,
-        // No failureMode specified
-      });
-
-      // Should not throw (defaults to "open")
-      const response = await client.request({
-        method: "GET",
-        url: "https://api.example.com/test",
-        headers: {},
-      });
-
-      expect(response.status).toBe(200);
-    });
   });
 
   describe("CRITICAL: Authorization denied should ALWAYS throw", () => {
@@ -259,4 +166,4 @@ describe("Node-HTTP failureMode", () => {
       ).rejects.toThrow("Authorization denied");
     });
   });
-});
+});
\ No newline at end of file
diff --git a/packages/node-http/src/node-http.ts b/packages/node-http/src/node-http.ts
index c1ce920b1..aeb46e35b 100644
--- a/packages/node-http/src/node-http.ts
+++ b/packages/node-http/src/node-http.ts
@@ -1,305 +1,308 @@
-import * as http from "http";
-import * as https from "https";
-import {
-  SapiomClient,
-  HttpClientAdapter,
-  HttpRequest,
-  HttpResponse,
-  HttpError,
-} from "@sapiom/core";
-import {
-  BaseSapiomIntegrationConfig,
-  initializeSapiomClient,
-} from "@sapiom/core";
-import type { TransactionPollingConfig } from "@sapiom/core";
-import {
-  handleAuthorization,
-  handlePayment,
-  handleCompletion,
-  AuthorizationConfig,
-  PaymentConfig,
-  CompletionConfig,
-} from "./interceptors.js";
-
-/**
- * Configuration for Sapiom-enabled Node.js HTTP client
- */
-export interface SapiomNodeHttpConfig extends BaseSapiomIntegrationConfig {
-  /**
-   * Polling configuration for transaction authorization.
-   * Overrides default timeout (30s) and poll interval (1s).
-   */
-  polling?: TransactionPollingConfig;
-}
-
-/**
- * Creates a Sapiom-enabled Node.js HTTP client with automatic authorization and payment handling
- *
- * This creates a native HTTP client using Node.js's http/https modules with:
- * - Pre-emptive authorization (request pre-processing)
- * - Reactive payment handling (response error handling for 402)
- *
- * Works directly with Node.js native types, supporting streams, buffers, and all body types.
- *
- * @param config - Optional configuration (reads from env vars by default)
- * @returns A Sapiom-enabled HttpClientAdapter
- *
- * @example
- * ```typescript
- * // Simplest usage (reads SAPIOM_API_KEY from environment)
- * import { createClient } from '@sapiom/node-http';
- *
- * const client = createClient();
- *
- * // Auto-handles 402 payment errors and authorization
- * const response = await client.request({
- *   method: 'GET',
- *   url: 'https://api.example.com/premium-endpoint',
- *   headers: { 'Content-Type': 'application/json' }
- * });
- * ```
- *
- * @example
- * ```typescript
- * // With API key and default metadata
- * import { createClient } from '@sapiom/node-http';
- *
- * const client = createClient({
- *   apiKey: 'sk_...',
- *   agentName: 'my-agent',
- *   serviceName: 'my-service'
- * });
- *
- * const response = await client.request({
- *   method: 'POST',
- *   url: 'https://api.example.com/data',
- *   headers: { 'Content-Type': 'application/json' },
- *   body: { key: 'value' }
- * });
- * ```
- *
- * @example
- * ```typescript
- * // With default metadata (applied to all requests)
- * import { createClient } from '@sapiom/node-http';
- *
- * const client = createClient({
- *   apiKey: 'sk_...',
- *   agentName: 'my-agent',
- *   serviceName: 'my-service'
- * });
- *
- * // Per-request override via __sapiom property
- * await client.request({
- *   method: 'POST',
- *   url: 'https://api.example.com/resource',
- *   headers: { 'Content-Type': 'application/json' },
- *   body: { data: 'test' },
- *   __sapiom: {
- *     serviceName: 'different-service',
- *     actionName: 'custom-action'
- *   }
- * });
- *
- * // Disable Sapiom for specific request
- * await client.request({
- *   method: 'GET',
- *   url: 'https://api.example.com/public',
- *   headers: {},
- *   __sapiom: { enabled: false }
- * });
- * ```
- */
-export function createClient(
-  config?: SapiomNodeHttpConfig,
-): HttpClientAdapter & { __sapiomClient: SapiomClient } {
-  const sapiomClient = initializeSapiomClient(config);
-  const isEnabled = config?.enabled !== false;
-
-  const defaultMetadata: Record<string, any> = {};
-  if (config?.agentName) defaultMetadata.agentName = config.agentName;
-  if (config?.agentId) defaultMetadata.agentId = config.agentId;
-  if (config?.serviceName) defaultMetadata.serviceName = config.serviceName;
-  if (config?.traceId) defaultMetadata.traceId = config.traceId;
-  if (config?.traceExternalId)
-    defaultMetadata.traceExternalId = config.traceExternalId;
-  if (config?.enabled !== undefined) defaultMetadata.enabled = config.enabled;
-
-  const failureMode = config?.failureMode ?? "open";
-
-  const authConfig: AuthorizationConfig = { sapiomClient, failureMode, polling: config?.polling };
-  const paymentConfig: PaymentConfig = { sapiomClient, failureMode, polling: config?.polling };
-  const completionConfig: CompletionConfig = { sapiomClient };
-
-  async function makeRequest<T = any>(
-    request: HttpRequest,
-  ): Promise<HttpResponse<T>> {
-    return new Promise<HttpResponse<T>>((resolve, reject) => {
-      const parsedUrl = new URL(request.url);
-      const isHttps = parsedUrl.protocol === "https:";
-      const client = isHttps ? https : http;
-
-      let bodyData: string | Buffer | undefined;
-      if (request.body !== undefined && request.body !== null) {
-        if (typeof request.body === "string") {
-          bodyData = request.body;
-        } else if (Buffer.isBuffer(request.body)) {
-          bodyData = request.body;
-        } else if (typeof request.body === "object") {
-          bodyData = JSON.stringify(request.body);
-        }
-      }
-
-      const options: http.RequestOptions = {
-        method: request.method,
-        hostname: parsedUrl.hostname,
-        port: parsedUrl.port,
-        path: parsedUrl.pathname + parsedUrl.search,
-        headers: { ...request.headers },
-      };
-
-      if (bodyData && options.headers) {
-        const headers = options.headers as Record<
-          string,
-          string | string[] | undefined
-        >;
-        if (!headers["Content-Length"]) {
-          headers["Content-Length"] = Buffer.byteLength(bodyData).toString();
-        }
-      }
-
-      const req = client.request(options, (res) => {
-        let data = "";
-        res.on("data", (chunk) => {
-          data += chunk.toString();
-        });
-
-        res.on("end", () => {
-          let parsedData: T;
-          const contentType = res.headers["content-type"] || "";
-
-          if (contentType.includes("application/json") && data) {
-            try {
-              parsedData = JSON.parse(data);
-            } catch {
-              parsedData = data as any;
-            }
-          } else {
-            parsedData = data as any;
-          }
-
-          const response: HttpResponse<T> = {
-            status: res.statusCode || 200,
-            statusText: res.statusMessage || "OK",
-            headers: res.headers as Record<string, string>,
-            data: parsedData,
-          };
-
-          if (res.statusCode === 402) {
-            const error: HttpError = {
-              message: "Payment required",
-              status: response.status,
-              statusText: response.statusText,
-              headers: response.headers,
-              data: response.data,
-              response,
-            };
-            reject(error);
-          } else {
-            resolve(response);
-          }
-        });
-      });
-
-      req.on("error", (err) => {
-        reject(err);
-      });
-
-      if (bodyData) {
-        req.write(bodyData);
-      }
-
-      req.end();
-    });
-  }
-
-  const adapter: HttpClientAdapter = {
-    async request<T = any>(request: HttpRequest): Promise<HttpResponse<T>> {
-      const requestMetadata = request.__sapiom || {};
-      const userMetadata = { ...defaultMetadata, ...requestMetadata };
-
-      if (!isEnabled || userMetadata?.enabled === false) {
-        return makeRequest<T>(request);
-      }
-
-      // Normalize request: shallow-copy headers to avoid mutating caller's object
-      const normalizedRequest = { ...request, headers: { ...request.headers } };
-
-      // Attach identity header if target matches token audience
-      if (sapiomClient.identity) {
-        const identityHeaders = await sapiomClient.identity.getHeaderIfMatch(
-          normalizedRequest.url,
-        );
-        if (identityHeaders["Sapiom-Identity"]) {
-          normalizedRequest.headers["Sapiom-Identity"] =
-            identityHeaders["Sapiom-Identity"];
-        }
-      }
-
-      const modifiedRequest = await handleAuthorization(
-        normalizedRequest,
-        authConfig,
-        defaultMetadata,
-      );
-
-      const startTime = Date.now();
-      let response: HttpResponse<T> | null = null;
-      let error: Error | HttpError | null = null;
-
-      try {
-        response = await makeRequest<T>(modifiedRequest);
-        return response;
-      } catch (err) {
-        error = err as Error | HttpError;
-        if ((error as HttpError).response?.status === 402) {
-          response = await handlePayment(
-            modifiedRequest,
-            error as HttpError,
-            paymentConfig,
-            makeRequest,
-            defaultMetadata,
-          );
-          error = null; // Clear error since payment succeeded
-          return response;
-        }
-        throw err;
-      } finally {
-        // Fire-and-forget: complete the transaction
-        handleCompletion(
-          modifiedRequest,
-          response,
-          error,
-          completionConfig,
-          startTime,
-        );
-      }
-    },
-
-    addRequestInterceptor(onFulfilled, onRejected) {
-      throw new Error("addRequestInterceptor is not supported");
-    },
-
-    addResponseInterceptor(onFulfilled, onRejected) {
-      throw new Error("addResponseInterceptor is not supported");
-    },
-  };
-
-  (adapter as any).__sapiomClient = sapiomClient;
-
-  return adapter as HttpClientAdapter & { __sapiomClient: SapiomClient };
-}
-
-export {
-  AuthorizationDeniedError,
-  AuthorizationTimeoutError,
-} from "./interceptors.js";
+import * as http from "http";
+import * as https from "https";
+import {
+  SapiomClient,
+  HttpClientAdapter,
+  HttpRequest,
+  HttpResponse,
+  HttpError,
+} from "@sapiom/core";
+import {
+  BaseSapiomIntegrationConfig,
+  initializeSapiomClient,
+} from "@sapiom/core";
+import type { TransactionPollingConfig } from "@sapiom/core";
+import {
+  handleAuthorization,
+  handlePayment,
+  handleCompletion,
+  AuthorizationConfig,
+  PaymentConfig,
+  CompletionConfig,
+} from "./interceptors.js";
+
+/**
+ * Configuration for Sapiom-enabled Node.js HTTP client
+ */
+export interface SapiomNodeHttpConfig extends BaseSapiomIntegrationConfig {
+  /**
+   * Polling configuration for transaction authorization.
+   * Overrides default timeout (30s) and poll interval (1s).
+   */
+  polling?: TransactionPollingConfig;
+}
+
+/**
+ * Creates a Sapiom-enabled Node.js HTTP client with automatic authorization and payment handling
+ *
+ * This creates a native HTTP client using Node.js's http/https modules with:
+ * - Pre-emptive authorization (request pre-processing)
+ * - Reactive payment handling (response error handling for 402)
+ *
+ * Works directly with Node.js native types, supporting streams, buffers, and all body types.
+ *
+ * @param config - Optional configuration (reads from env vars by default)
+ * @returns A Sapiom-enabled HttpClientAdapter
+ *
+ * @example
+ * ```typescript
+ * // Simplest usage (reads SAPIOM_API_KEY from environment)
+ * import { createClient } from '@sapiom/node-http';
+ *
+ * const client = createClient();
+ *
+ * // Auto-handles 402 payment errors and authorization
+ * const response = await client.request({
+ *   method: 'GET',
+ *   url: '[https://api.example.com/premium-endpoint](https://api.example.com/premium-endpoint)',
+ *   headers: { 'Content-Type': 'application/json' }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // With API key and default metadata
+ * import { createClient } from '@sapiom/node-http';
+ *
+ * const client = createClient({
+ *   apiKey: 'sk_...',
+ *   agentName: 'my-agent',
+ *   serviceName: 'my-service'
+ * });
+ *
+ * const response = await client.request({
+ *   method: 'POST',
+ *   url: '[https://api.example.com/data](https://api.example.com/data)',
+ *   headers: { 'Content-Type': 'application/json' },
+ *   body: { key: 'value' }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // With default metadata (applied to all requests)
+ * import { createClient } from '@sapiom/node-http';
+ *
+ * const client = createClient({
+ *   apiKey: 'sk_...',
+ *   agentName: 'my-agent',
+ *   serviceName: 'my-service'
+ * });
+ *
+ * // Per-request override via __sapiom property
+ * await client.request({
+ *   method: 'POST',
+ *   url: '[https://api.example.com/resource](https://api.example.com/resource)',
+ *   headers: { 'Content-Type': 'application/json' },
+ *   body: { data: 'test' },
+ *   __sapiom: {
+ *     serviceName: 'different-service',
+ *     actionName: 'custom-action'
+ *   }
+ * });
+ *
+ * // Disable Sapiom for specific request
+ * await client.request({
+ *   method: 'GET',
+ *   url: '[https://api.example.com/public](https://api.example.com/public)',
+ *   headers: {},
+ *   __sapiom: { enabled: false }
+ * });
+ * ```
+ */
+export function createClient(
+  config?: SapiomNodeHttpConfig,
+): HttpClientAdapter & { __sapiomClient: SapiomClient } {
+  const sapiomClient = initializeSapiomClient(config);
+  const isEnabled = config?.enabled !== false;
+
+  const defaultMetadata: Record<string, any> = {};
+  if (config?.agentName) defaultMetadata.agentName = config.agentName;
+  if (config?.agentId) defaultMetadata.agentId = config.agentId;
+  if (config?.serviceName) defaultMetadata.serviceName = config.serviceName;
+  if (config?.traceId) defaultMetadata.traceId = config.traceId;
+  if (config?.traceExternalId)
+    defaultMetadata.traceExternalId = config.traceExternalId;
+  if (config?.enabled !== undefined) defaultMetadata.enabled = config.enabled;
+
+  // SECURITY FIX: SDK Authorization Fail-Open Prevention.
+  // Default failureMode changed from "open" to "closed" to ensure governance boundaries
+  // are strictly enforced by default during control-plane outages.
+  const failureMode = config?.failureMode ?? "closed";
+
+  const authConfig: AuthorizationConfig = { sapiomClient, failureMode, polling: config?.polling };
+  const paymentConfig: PaymentConfig = { sapiomClient, failureMode, polling: config?.polling };
+  const completionConfig: CompletionConfig = { sapiomClient };
+
+  async function makeRequest<T = any>(
+    request: HttpRequest,
+  ): Promise<HttpResponse<T>> {
+    return new Promise<HttpResponse<T>>((resolve, reject) => {
+      const parsedUrl = new URL(request.url);
+      const isHttps = parsedUrl.protocol === "https:";
+      const client = isHttps ? https : http;
+
+      let bodyData: string | Buffer | undefined;
+      if (request.body !== undefined && request.body !== null) {
+        if (typeof request.body === "string") {
+          bodyData = request.body;
+        } else if (Buffer.isBuffer(request.body)) {
+          bodyData = request.body;
+        } else if (typeof request.body === "object") {
+          bodyData = JSON.stringify(request.body);
+        }
+      }
+
+      const options: http.RequestOptions = {
+        method: request.method,
+        hostname: parsedUrl.hostname,
+        port: parsedUrl.port,
+        path: parsedUrl.pathname + parsedUrl.search,
+        headers: { ...request.headers },
+      };
+
+      if (bodyData && options.headers) {
+        const headers = options.headers as Record<
+          string,
+          string | string[] | undefined
+        >;
+        if (!headers["Content-Length"]) {
+          headers["Content-Length"] = Buffer.byteLength(bodyData).toString();
+        }
+      }
+
+      const req = client.request(options, (res) => {
+        let data = "";
+        res.on("data", (chunk) => {
+          data += chunk.toString();
+        });
+
+        res.on("end", () => {
+          let parsedData: T;
+          const contentType = res.headers["content-type"] || "";
+
+          if (contentType.includes("application/json") && data) {
+            try {
+              parsedData = JSON.parse(data);
+            } catch {
+              parsedData = data as any;
+            }
+          } else {
+            parsedData = data as any;
+          }
+
+          const response: HttpResponse<T> = {
+            status: res.statusCode || 200,
+            statusText: res.statusMessage || "OK",
+            headers: res.headers as Record<string, string>,
+            data: parsedData,
+          };
+
+          if (res.statusCode === 402) {
+            const error: HttpError = {
+              message: "Payment required",
+              status: response.status,
+              statusText: response.statusText,
+              headers: response.headers,
+              data: response.data,
+              response,
+            };
+            reject(error);
+          } else {
+            resolve(response);
+          }
+        });
+      });
+
+      req.on("error", (err) => {
+        reject(err);
+      });
+
+      if (bodyData) {
+        req.write(bodyData);
+      }
+
+      req.end();
+    });
+  }
+
+  const adapter: HttpClientAdapter = {
+    async request<T = any>(request: HttpRequest): Promise<HttpResponse<T>> {
+      const requestMetadata = request.__sapiom || {};
+      const userMetadata = { ...defaultMetadata, ...requestMetadata };
+
+      if (!isEnabled || userMetadata?.enabled === false) {
+        return makeRequest<T>(request);
+      }
+
+      // Normalize request: shallow-copy headers to avoid mutating caller's object
+      const normalizedRequest = { ...request, headers: { ...request.headers } };
+
+      // Attach identity header if target matches token audience
+      if (sapiomClient.identity) {
+        const identityHeaders = await sapiomClient.identity.getHeaderIfMatch(
+          normalizedRequest.url,
+        );
+        if (identityHeaders["Sapiom-Identity"]) {
+          normalizedRequest.headers["Sapiom-Identity"] =
+            identityHeaders["Sapiom-Identity"];
+        }
+      }
+
+      const modifiedRequest = await handleAuthorization(
+        normalizedRequest,
+        authConfig,
+        defaultMetadata,
+      );
+
+      const startTime = Date.now();
+      let response: HttpResponse<T> | null = null;
+      let error: Error | HttpError | null = null;
+
+      try {
+        response = await makeRequest<T>(modifiedRequest);
+        return response;
+      } catch (err) {
+        error = err as Error | HttpError;
+        if ((error as HttpError).response?.status === 402) {
+          response = await handlePayment(
+            modifiedRequest,
+            error as HttpError,
+            paymentConfig,
+            makeRequest,
+            defaultMetadata,
+          );
+          error = null; // Clear error since payment succeeded
+          return response;
+        }
+        throw err;
+      } finally {
+        // Fire-and-forget: complete the transaction
+        handleCompletion(
+          modifiedRequest,
+          response,
+          error,
+          completionConfig,
+          startTime,
+        );
+      }
+    },
+
+    addRequestInterceptor(onFulfilled, onRejected) {
+      throw new Error("addRequestInterceptor is not supported");
+    },
+
+    addResponseInterceptor(onFulfilled, onRejected) {
+      throw new Error("addResponseInterceptor is not supported");
+    },
+  };
+
+  (adapter as any).__sapiomClient = sapiomClient;
+
+  return adapter as HttpClientAdapter & { __sapiomClient: SapiomClient };
+}
+
+export {
+  AuthorizationDeniedError,
+  AuthorizationTimeoutError,
+} from "./interceptors.js";
\ No newline at end of file