xytara 3.1.13 → 3.1.14

package/scripts/verify_a2a_rpc.js

@@ -1,105 +1,105 @@
-"use strict";
-
-// Verifies the A2A JSON-RPC endpoint with the in-band x402 payment extension
-// (lib/a2a_rpc.js). The facilitator verify/settle and the command executor are
-// injected as mocks so this runs offline and moves no money.
-
-const assert = require("assert");
-const {
-  handleA2ARpc,
-  META_PAYLOAD,
-  META_STATUS,
-  META_REQUIRED
-} = require("../lib/a2a_rpc");
-
-const accepts = [
-  { scheme: "exact", network: "eip155:84532", asset: "0xUSDC", amount: "1000", payTo: "0xPAYTO", extra: { name: "USDC", version: "2" } }
-];
-const config = { verification_mode: "x402_facilitator", x402: { accepts, facilitator_url: "https://facilitator", settle: true } };
-
-function deps(overrides) {
-  return Object.assign(
-    {
-      createFacilitator: () => ({}),
-      verifyX402Payment: async () => ({ ok: true, authorization: { payer: "0xPAYER", paymentRequirements: accepts[0] } }),
-      settleX402Payment: async () => ({ ok: true, settlement: { success: true, transaction: "0xTX", network: "eip155:84532" } }),
-      encodeReceipt: (s) => Buffer.from(JSON.stringify(s), "utf8").toString("base64"),
-      executeAuthorized: async (state, payload, authz) => ({ status: 200, payload: { ok: true, ran: payload.task_ref, azmode: authz.verification_mode } }),
-      buildNamedTaskPayload: (ref, body) => ({ command: ref, task_ref: ref, body }),
-      state: {}
-    },
-    overrides || {}
-  );
-}
-
-function send(params, ctxOverrides) {
-  return handleA2ARpc(
-    { jsonrpc: "2.0", id: 1, method: "message/send", params },
-    Object.assign({ config, resourceUrl: "https://xytara.onrender.com/v1/a2a", deps: deps() }, ctxOverrides || {})
-  );
-}
-
-async function main() {
-  // 1. Unpaid -> input-required + x402 requirements in-band.
-  let out = await send({ message: { metadata: { task_ref: "a2a.negotiate" } } });
-  assert.strictEqual(out.http, 200);
-  assert.strictEqual(out.body.result.status.state, "input-required");
-  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-required");
-  assert.deepStrictEqual(out.body.result.status.message.metadata[META_REQUIRED].accepts, accepts);
-
-  // 2. Paid -> completed + PAYMENT-RESPONSE + executed through the x402 authz context.
-  out = await send({ message: { metadata: { task_ref: "a2a.negotiate", [META_PAYLOAD]: "BASE64PAYLOAD" } } });
-  assert.strictEqual(out.body.result.status.state, "completed");
-  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-completed");
-  assert.ok(out.headers && out.headers["PAYMENT-RESPONSE"], "settled 200 must carry PAYMENT-RESPONSE");
-  assert.strictEqual(out.body.result.artifacts[0].parts[0].data.ran, "a2a.negotiate");
-  assert.strictEqual(out.body.result.artifacts[0].parts[0].data.azmode, "x402_facilitator");
-
-  // 2b. Paid but the skill execution fails -> task is reported "failed" (not
-  // "completed"), still carries the settlement receipt (money moved).
-  out = await send(
-    { message: { metadata: { task_ref: "a2a.negotiate", [META_PAYLOAD]: "B64" } } },
-    { deps: deps({ executeAuthorized: async () => ({ status: 500, payload: { ok: false, reason: "boom" } }) }) }
-  );
-  assert.strictEqual(out.body.result.status.state, "failed");
-  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-completed");
-  assert.ok(out.headers && out.headers["PAYMENT-RESPONSE"], "failed-after-payment still carries receipt");
-  assert.strictEqual(out.body.result.artifacts.length, 0);
-
-  // 3. Verify fails -> payment-rejected.
-  out = await send(
-    { message: { metadata: { [META_PAYLOAD]: "BAD" } } },
-    { deps: deps({ verifyX402Payment: async () => ({ ok: false, reason: "payment_verification_failed", detail: "insufficient_balance" }) }) }
-  );
-  assert.strictEqual(out.body.result.status.state, "failed");
-  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-rejected");
-
-  // 4. Settle fails -> payment-failed.
-  out = await send(
-    { message: { metadata: { [META_PAYLOAD]: "OK" } } },
-    { deps: deps({ settleX402Payment: async () => ({ ok: false, reason: "payment_settlement_failed", detail: "facilitator" }) }) }
-  );
-  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-failed");
-
-  // 5. Unknown method -> -32601.
-  out = await handleA2ARpc({ jsonrpc: "2.0", id: 9, method: "tasks/cancel" }, { config, resourceUrl: "x", deps: deps() });
-  assert.strictEqual(out.body.error.code, -32601);
-
-  // 6. x402 mode off -> -32010.
-  out = await handleA2ARpc(
-    { jsonrpc: "2.0", id: 9, method: "message/send", params: { message: {} } },
-    { config: { verification_mode: "local_signed", x402: { accepts } }, resourceUrl: "x", deps: deps() }
-  );
-  assert.strictEqual(out.body.error.code, -32010);
-
-  // 7. Non-2.0 envelope -> -32600.
-  out = await handleA2ARpc({ id: 1, method: "message/send" }, { config, resourceUrl: "x", deps: deps() });
-  assert.strictEqual(out.body.error.code, -32600);
-
-  console.log("verify_a2a_rpc: all A2A x402 JSON-RPC checks passed");
-}
-
-main().catch((error) => {
-  console.error("verify_a2a_rpc failed:", error && error.message ? error.message : error);
-  process.exitCode = 1;
-});
+"use strict";
+
+// Verifies the A2A JSON-RPC endpoint with the in-band x402 payment extension
+// (lib/a2a_rpc.js). The facilitator verify/settle and the command executor are
+// injected as mocks so this runs offline and moves no money.
+
+const assert = require("assert");
+const {
+  handleA2ARpc,
+  META_PAYLOAD,
+  META_STATUS,
+  META_REQUIRED
+} = require("../lib/a2a_rpc");
+
+const accepts = [
+  { scheme: "exact", network: "eip155:84532", asset: "0xUSDC", amount: "1000", payTo: "0xPAYTO", extra: { name: "USDC", version: "2" } }
+];
+const config = { verification_mode: "x402_facilitator", x402: { accepts, facilitator_url: "https://facilitator", settle: true } };
+
+function deps(overrides) {
+  return Object.assign(
+    {
+      createFacilitator: () => ({}),
+      verifyX402Payment: async () => ({ ok: true, authorization: { payer: "0xPAYER", paymentRequirements: accepts[0] } }),
+      settleX402Payment: async () => ({ ok: true, settlement: { success: true, transaction: "0xTX", network: "eip155:84532" } }),
+      encodeReceipt: (s) => Buffer.from(JSON.stringify(s), "utf8").toString("base64"),
+      executeAuthorized: async (state, payload, authz) => ({ status: 200, payload: { ok: true, ran: payload.task_ref, azmode: authz.verification_mode } }),
+      buildNamedTaskPayload: (ref, body) => ({ command: ref, task_ref: ref, body }),
+      state: {}
+    },
+    overrides || {}
+  );
+}
+
+function send(params, ctxOverrides) {
+  return handleA2ARpc(
+    { jsonrpc: "2.0", id: 1, method: "message/send", params },
+    Object.assign({ config, resourceUrl: "https://xytara.onrender.com/v1/a2a", deps: deps() }, ctxOverrides || {})
+  );
+}
+
+async function main() {
+  // 1. Unpaid -> input-required + x402 requirements in-band.
+  let out = await send({ message: { metadata: { task_ref: "a2a.negotiate" } } });
+  assert.strictEqual(out.http, 200);
+  assert.strictEqual(out.body.result.status.state, "input-required");
+  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-required");
+  assert.deepStrictEqual(out.body.result.status.message.metadata[META_REQUIRED].accepts, accepts);
+
+  // 2. Paid -> completed + PAYMENT-RESPONSE + executed through the x402 authz context.
+  out = await send({ message: { metadata: { task_ref: "a2a.negotiate", [META_PAYLOAD]: "BASE64PAYLOAD" } } });
+  assert.strictEqual(out.body.result.status.state, "completed");
+  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-completed");
+  assert.ok(out.headers && out.headers["PAYMENT-RESPONSE"], "settled 200 must carry PAYMENT-RESPONSE");
+  assert.strictEqual(out.body.result.artifacts[0].parts[0].data.ran, "a2a.negotiate");
+  assert.strictEqual(out.body.result.artifacts[0].parts[0].data.azmode, "x402_facilitator");
+
+  // 2b. Paid but the skill execution fails -> task is reported "failed" (not
+  // "completed"), still carries the settlement receipt (money moved).
+  out = await send(
+    { message: { metadata: { task_ref: "a2a.negotiate", [META_PAYLOAD]: "B64" } } },
+    { deps: deps({ executeAuthorized: async () => ({ status: 500, payload: { ok: false, reason: "boom" } }) }) }
+  );
+  assert.strictEqual(out.body.result.status.state, "failed");
+  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-completed");
+  assert.ok(out.headers && out.headers["PAYMENT-RESPONSE"], "failed-after-payment still carries receipt");
+  assert.strictEqual(out.body.result.artifacts.length, 0);
+
+  // 3. Verify fails -> payment-rejected.
+  out = await send(
+    { message: { metadata: { [META_PAYLOAD]: "BAD" } } },
+    { deps: deps({ verifyX402Payment: async () => ({ ok: false, reason: "payment_verification_failed", detail: "insufficient_balance" }) }) }
+  );
+  assert.strictEqual(out.body.result.status.state, "failed");
+  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-rejected");
+
+  // 4. Settle fails -> payment-failed.
+  out = await send(
+    { message: { metadata: { [META_PAYLOAD]: "OK" } } },
+    { deps: deps({ settleX402Payment: async () => ({ ok: false, reason: "payment_settlement_failed", detail: "facilitator" }) }) }
+  );
+  assert.strictEqual(out.body.result.status.message.metadata[META_STATUS], "payment-failed");
+
+  // 5. Unknown method -> -32601.
+  out = await handleA2ARpc({ jsonrpc: "2.0", id: 9, method: "tasks/cancel" }, { config, resourceUrl: "x", deps: deps() });
+  assert.strictEqual(out.body.error.code, -32601);
+
+  // 6. x402 mode off -> -32010.
+  out = await handleA2ARpc(
+    { jsonrpc: "2.0", id: 9, method: "message/send", params: { message: {} } },
+    { config: { verification_mode: "local_signed", x402: { accepts } }, resourceUrl: "x", deps: deps() }
+  );
+  assert.strictEqual(out.body.error.code, -32010);
+
+  // 7. Non-2.0 envelope -> -32600.
+  out = await handleA2ARpc({ id: 1, method: "message/send" }, { config, resourceUrl: "x", deps: deps() });
+  assert.strictEqual(out.body.error.code, -32600);
+
+  console.log("verify_a2a_rpc: all A2A x402 JSON-RPC checks passed");
+}
+
+main().catch((error) => {
+  console.error("verify_a2a_rpc failed:", error && error.message ? error.message : error);
+  process.exitCode = 1;
+});

package/scripts/verify_agent_identity.js

@@ -1,153 +1,153 @@
-"use strict";
-
-// Verifies cryptographic agent identity for delegated-spend credentials:
-// ed25519 key binding + fresh signed-proof enforcement with replay (encoding-
-// agnostic, mandatory/fail-closed), expiry and future-dating guards; key binding
-// carried through rotation; invalid keys not bricking; and byte-for-byte backward
-// compatibility when no key is bound.
-
-const crypto = require("crypto");
-const assert = require("assert");
-const ai = require("../lib/agent_identity");
-const { createSpendCredential, resolveSpendCredential, createAuthorityBinding, rotateAuthorityBinding } = require("../lib/account_auth");
-
-function mkState() {
-  return {
-    accountSpendCredentials: new Map(),
-    accountSpendCredentialsByToken: new Map(),
-    accountAuthorityBindings: new Map(),
-    acceptedAgentSignatures: new Map()
-  };
-}
-
-function signAuth(privateKey, credentialId, timestamp) {
-  const msg = ai.buildSpendAuthMessage(credentialId, String(timestamp));
-  return crypto.sign(null, Buffer.from(msg, "utf8"), privateKey).toString("base64");
-}
-
-function main() {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
-  const pubPem = publicKey.export({ type: "spki", format: "pem" });
-  const pubDerB64 = publicKey.export({ type: "spki", format: "der" }).toString("base64");
-
-  // 1. Key helpers: ref stable across PEM/DER; invalid -> null; sign/verify.
-  const ref = ai.deriveAgentKeyRef(pubPem);
-  assert.ok(ref && ref.startsWith("ed25519-spki-sha256:"), "ref format");
-  assert.strictEqual(ai.deriveAgentKeyRef(pubDerB64), ref, "PEM and DER give the same ref");
-  assert.strictEqual(ai.deriveAgentKeyRef("not a key"), null, "invalid key -> null");
-  const m = "hello";
-  const sig = crypto.sign(null, Buffer.from(m), privateKey).toString("base64");
-  assert.strictEqual(ai.verifyAgentSignature(pubPem, m, sig), true, "valid sig verifies");
-  assert.strictEqual(ai.verifyAgentSignature(pubPem, "tampered", sig), false, "tampered msg fails");
-
-  // 2. No key bound -> bearer-only, unchanged behavior.
-  let state = mkState();
-  const cred0 = createSpendCredential(state, { credential_id: "c0", account_id: "acct" });
-  assert.strictEqual(cred0.identity_bound, false);
-  assert.strictEqual(cred0.agent_key_ref, null);
-  assert.strictEqual(resolveSpendCredential(state, cred0.bearer_token).ok, true, "bearer-only resolves");
-
-  // 3. Invalid key provided -> NOT bricked: stored as bearer-only (consistent view).
-  state = mkState();
-  const credBad = createSpendCredential(state, { credential_id: "cbad", account_id: "acct", agent_public_key: "garbage-not-a-key" });
-  assert.strictEqual(credBad.identity_bound, false, "invalid key is ignored");
-  assert.strictEqual(credBad.agent_key_ref, null);
-  assert.strictEqual(resolveSpendCredential(state, credBad.bearer_token).ok, true, "falls back to bearer-only");
-
-  // 4. Key bound -> signed proof required + enforced.
-  state = mkState();
-  const cred = createSpendCredential(state, { credential_id: "c1", account_id: "acct", agent_public_key: pubPem });
-  assert.strictEqual(cred.identity_bound, true);
-  assert.strictEqual(cred.agent_key_ref, ref);
-
-  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token).reason, "agent_signature_required", "no proof -> required");
-
-  const ts = Date.now();
-  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(privateKey, "c1", ts), timestamp: String(ts) }).ok, true, "valid proof authorizes");
-
-  // 5. Replay is encoding-agnostic (canonical decoded-signature key).
-  const ts2 = Date.now() + 1;
-  const sig2 = signAuth(privateKey, "c1", ts2);
-  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: sig2, timestamp: String(ts2) }).ok, true);
-  const sig2UrlSafe = sig2.replace(/\+/g, "-").replace(/\//g, "_"); // re-encoded, same bytes
-  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: sig2UrlSafe, timestamp: String(ts2) }).reason, "agent_signature_replayed", "re-encoded replay is caught");
-
-  // 6. Expired (too old) and future-dated proofs rejected.
-  const oldTs = Date.now() - 10 * 60 * 1000;
-  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(privateKey, "c1", oldTs), timestamp: String(oldTs) }).reason, "agent_signature_expired");
-  const futureTs = Date.now() + 10 * 60 * 1000;
-  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(privateKey, "c1", futureTs), timestamp: String(futureTs) }).reason, "agent_signature_future");
-
-  // 7. Wrong key -> invalid.
-  const other = crypto.generateKeyPairSync("ed25519");
-  const ts3 = Date.now();
-  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(other.privateKey, "c1", ts3), timestamp: String(ts3) }).reason, "agent_signature_invalid");
-
-  // 8. Fail closed if the replay store is unavailable.
-  const stateNoStore = { accountSpendCredentials: state.accountSpendCredentials, accountSpendCredentialsByToken: state.accountSpendCredentialsByToken, accountAuthorityBindings: new Map() };
-  const ts4 = Date.now();
-  assert.strictEqual(resolveSpendCredential(stateNoStore, cred.bearer_token, { signature: signAuth(privateKey, "c1", ts4), timestamp: String(ts4) }).reason, "agent_replay_store_unavailable");
-
-  // 9. Authority binding threads the key through; rotation preserves it.
-  state = mkState();
-  const binding = createAuthorityBinding(state, { binding_id: "b1", account_id: "acct", agent_public_key: pubPem, max_commit_units: 100 });
-  assert.strictEqual(binding.spend_credential.identity_bound, true, "binding credential key-bound");
-  assert.strictEqual(binding.spend_credential.agent_key_ref, ref);
-  const rotated = rotateAuthorityBinding(state, "b1", {});
-  assert.strictEqual(rotated.successor_authority_binding.spend_credential.identity_bound, true, "rotation preserves key binding");
-  assert.strictEqual(rotated.successor_authority_binding.spend_credential.agent_key_ref, ref, "rotation preserves the same key ref");
-
-  // 10. Request binding (amount/task) — additive, back-compat with everything above.
-  state = mkState();
-  const credB = createSpendCredential(state, { credential_id: "cb", account_id: "acct", agent_public_key: pubPem });
-  const bindReq = { account_id: "acct", units: 10, task_ref: "doc.analyze" };
-  const signBound = (ts, binding) =>
-    crypto.sign(null, Buffer.from(ai.buildSpendAuthMessage("cb", String(ts), ai.buildSpendBindingDigest(binding)), "utf8"), privateKey).toString("base64");
-
-  // 10a. A bound proof matching the request authorizes.
-  let tsb = Date.now();
-  let res = resolveSpendCredential(state, credB.bearer_token, { signature: signBound(tsb, bindReq), timestamp: String(tsb) }, bindReq);
-  assert.strictEqual(res.ok, true, "bound proof matching the request authorizes");
-
-  // 10b. A proof bound to 10 units cannot authorize a 999-unit request (amount tampering).
-  tsb = Date.now() + 1;
-  res = resolveSpendCredential(state, credB.bearer_token,
-    { signature: signBound(tsb, { account_id: "acct", units: 10, task_ref: "doc.analyze" }), timestamp: String(tsb) },
-    { account_id: "acct", units: 999, task_ref: "doc.analyze" });
-  assert.strictEqual(res.reason, "agent_signature_invalid", "amount-bound proof rejects a different amount");
-
-  // 10c. A proof bound to one task cannot authorize another.
-  tsb = Date.now() + 2;
-  res = resolveSpendCredential(state, credB.bearer_token,
-    { signature: signBound(tsb, { account_id: "acct", units: 10, task_ref: "doc.analyze" }), timestamp: String(tsb) },
-    { account_id: "acct", units: 10, task_ref: "image.render" });
-  assert.strictEqual(res.reason, "agent_signature_invalid", "task-bound proof rejects a different task");
-
-  // 10d. An unbound proof still authorizes by default even when a binding is supplied.
-  tsb = Date.now() + 3;
-  res = resolveSpendCredential(state, credB.bearer_token, { signature: signAuth(privateKey, "cb", tsb), timestamp: String(tsb) }, bindReq);
-  assert.strictEqual(res.ok, true, "unbound proof still authorizes by default (back-compat)");
-
-  // 10e. Strict binding is CALLER-scoped (requestBinding.require=true), not a global flag — so
-  //      it applies only where a binding is supplied (execute path), never the lifecycle paths.
-  const strictBind = { ...bindReq, require: true };
-  tsb = Date.now() + 4;
-  res = resolveSpendCredential(state, credB.bearer_token, { signature: signAuth(privateKey, "cb", tsb), timestamp: String(tsb) }, strictBind);
-  assert.strictEqual(res.reason, "agent_signature_binding_required_or_invalid", "strict refuses an unbound proof");
-  tsb = Date.now() + 5;
-  res = resolveSpendCredential(state, credB.bearer_token, { signature: signBound(tsb, bindReq), timestamp: String(tsb) }, strictBind);
-  assert.strictEqual(res.ok, true, "strict accepts a matching bound proof");
-  tsb = Date.now() + 6;
-  res = resolveSpendCredential(state, credB.bearer_token, { signature: signBound(tsb, bindReq), timestamp: String(tsb) }, { require: true });
-  assert.strictEqual(res.reason, "spend_binding_required", "strict requires a request binding");
-
-  // 10f. A key-bound credential on a NON-binding caller (no requestBinding) is unaffected by
-  //      strict mode — the lifecycle paths (reserve/release/reverse) keep working.
-  tsb = Date.now() + 7;
-  res = resolveSpendCredential(state, credB.bearer_token, { signature: signAuth(privateKey, "cb", tsb), timestamp: String(tsb) });
-  assert.strictEqual(res.ok, true, "no-binding caller still authorizes under back-compat");
-
-  console.log("verify_agent_identity: all checks passed");
-}
-
-main();
+"use strict";
+
+// Verifies cryptographic agent identity for delegated-spend credentials:
+// ed25519 key binding + fresh signed-proof enforcement with replay (encoding-
+// agnostic, mandatory/fail-closed), expiry and future-dating guards; key binding
+// carried through rotation; invalid keys not bricking; and byte-for-byte backward
+// compatibility when no key is bound.
+
+const crypto = require("crypto");
+const assert = require("assert");
+const ai = require("../lib/agent_identity");
+const { createSpendCredential, resolveSpendCredential, createAuthorityBinding, rotateAuthorityBinding } = require("../lib/account_auth");
+
+function mkState() {
+  return {
+    accountSpendCredentials: new Map(),
+    accountSpendCredentialsByToken: new Map(),
+    accountAuthorityBindings: new Map(),
+    acceptedAgentSignatures: new Map()
+  };
+}
+
+function signAuth(privateKey, credentialId, timestamp) {
+  const msg = ai.buildSpendAuthMessage(credentialId, String(timestamp));
+  return crypto.sign(null, Buffer.from(msg, "utf8"), privateKey).toString("base64");
+}
+
+function main() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const pubPem = publicKey.export({ type: "spki", format: "pem" });
+  const pubDerB64 = publicKey.export({ type: "spki", format: "der" }).toString("base64");
+
+  // 1. Key helpers: ref stable across PEM/DER; invalid -> null; sign/verify.
+  const ref = ai.deriveAgentKeyRef(pubPem);
+  assert.ok(ref && ref.startsWith("ed25519-spki-sha256:"), "ref format");
+  assert.strictEqual(ai.deriveAgentKeyRef(pubDerB64), ref, "PEM and DER give the same ref");
+  assert.strictEqual(ai.deriveAgentKeyRef("not a key"), null, "invalid key -> null");
+  const m = "hello";
+  const sig = crypto.sign(null, Buffer.from(m), privateKey).toString("base64");
+  assert.strictEqual(ai.verifyAgentSignature(pubPem, m, sig), true, "valid sig verifies");
+  assert.strictEqual(ai.verifyAgentSignature(pubPem, "tampered", sig), false, "tampered msg fails");
+
+  // 2. No key bound -> bearer-only, unchanged behavior.
+  let state = mkState();
+  const cred0 = createSpendCredential(state, { credential_id: "c0", account_id: "acct" });
+  assert.strictEqual(cred0.identity_bound, false);
+  assert.strictEqual(cred0.agent_key_ref, null);
+  assert.strictEqual(resolveSpendCredential(state, cred0.bearer_token).ok, true, "bearer-only resolves");
+
+  // 3. Invalid key provided -> NOT bricked: stored as bearer-only (consistent view).
+  state = mkState();
+  const credBad = createSpendCredential(state, { credential_id: "cbad", account_id: "acct", agent_public_key: "garbage-not-a-key" });
+  assert.strictEqual(credBad.identity_bound, false, "invalid key is ignored");
+  assert.strictEqual(credBad.agent_key_ref, null);
+  assert.strictEqual(resolveSpendCredential(state, credBad.bearer_token).ok, true, "falls back to bearer-only");
+
+  // 4. Key bound -> signed proof required + enforced.
+  state = mkState();
+  const cred = createSpendCredential(state, { credential_id: "c1", account_id: "acct", agent_public_key: pubPem });
+  assert.strictEqual(cred.identity_bound, true);
+  assert.strictEqual(cred.agent_key_ref, ref);
+
+  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token).reason, "agent_signature_required", "no proof -> required");
+
+  const ts = Date.now();
+  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(privateKey, "c1", ts), timestamp: String(ts) }).ok, true, "valid proof authorizes");
+
+  // 5. Replay is encoding-agnostic (canonical decoded-signature key).
+  const ts2 = Date.now() + 1;
+  const sig2 = signAuth(privateKey, "c1", ts2);
+  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: sig2, timestamp: String(ts2) }).ok, true);
+  const sig2UrlSafe = sig2.replace(/\+/g, "-").replace(/\//g, "_"); // re-encoded, same bytes
+  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: sig2UrlSafe, timestamp: String(ts2) }).reason, "agent_signature_replayed", "re-encoded replay is caught");
+
+  // 6. Expired (too old) and future-dated proofs rejected.
+  const oldTs = Date.now() - 10 * 60 * 1000;
+  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(privateKey, "c1", oldTs), timestamp: String(oldTs) }).reason, "agent_signature_expired");
+  const futureTs = Date.now() + 10 * 60 * 1000;
+  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(privateKey, "c1", futureTs), timestamp: String(futureTs) }).reason, "agent_signature_future");
+
+  // 7. Wrong key -> invalid.
+  const other = crypto.generateKeyPairSync("ed25519");
+  const ts3 = Date.now();
+  assert.strictEqual(resolveSpendCredential(state, cred.bearer_token, { signature: signAuth(other.privateKey, "c1", ts3), timestamp: String(ts3) }).reason, "agent_signature_invalid");
+
+  // 8. Fail closed if the replay store is unavailable.
+  const stateNoStore = { accountSpendCredentials: state.accountSpendCredentials, accountSpendCredentialsByToken: state.accountSpendCredentialsByToken, accountAuthorityBindings: new Map() };
+  const ts4 = Date.now();
+  assert.strictEqual(resolveSpendCredential(stateNoStore, cred.bearer_token, { signature: signAuth(privateKey, "c1", ts4), timestamp: String(ts4) }).reason, "agent_replay_store_unavailable");
+
+  // 9. Authority binding threads the key through; rotation preserves it.
+  state = mkState();
+  const binding = createAuthorityBinding(state, { binding_id: "b1", account_id: "acct", agent_public_key: pubPem, max_commit_units: 100 });
+  assert.strictEqual(binding.spend_credential.identity_bound, true, "binding credential key-bound");
+  assert.strictEqual(binding.spend_credential.agent_key_ref, ref);
+  const rotated = rotateAuthorityBinding(state, "b1", {});
+  assert.strictEqual(rotated.successor_authority_binding.spend_credential.identity_bound, true, "rotation preserves key binding");
+  assert.strictEqual(rotated.successor_authority_binding.spend_credential.agent_key_ref, ref, "rotation preserves the same key ref");
+
+  // 10. Request binding (amount/task) — additive, back-compat with everything above.
+  state = mkState();
+  const credB = createSpendCredential(state, { credential_id: "cb", account_id: "acct", agent_public_key: pubPem });
+  const bindReq = { account_id: "acct", units: 10, task_ref: "doc.analyze" };
+  const signBound = (ts, binding) =>
+    crypto.sign(null, Buffer.from(ai.buildSpendAuthMessage("cb", String(ts), ai.buildSpendBindingDigest(binding)), "utf8"), privateKey).toString("base64");
+
+  // 10a. A bound proof matching the request authorizes.
+  let tsb = Date.now();
+  let res = resolveSpendCredential(state, credB.bearer_token, { signature: signBound(tsb, bindReq), timestamp: String(tsb) }, bindReq);
+  assert.strictEqual(res.ok, true, "bound proof matching the request authorizes");
+
+  // 10b. A proof bound to 10 units cannot authorize a 999-unit request (amount tampering).
+  tsb = Date.now() + 1;
+  res = resolveSpendCredential(state, credB.bearer_token,
+    { signature: signBound(tsb, { account_id: "acct", units: 10, task_ref: "doc.analyze" }), timestamp: String(tsb) },
+    { account_id: "acct", units: 999, task_ref: "doc.analyze" });
+  assert.strictEqual(res.reason, "agent_signature_invalid", "amount-bound proof rejects a different amount");
+
+  // 10c. A proof bound to one task cannot authorize another.
+  tsb = Date.now() + 2;
+  res = resolveSpendCredential(state, credB.bearer_token,
+    { signature: signBound(tsb, { account_id: "acct", units: 10, task_ref: "doc.analyze" }), timestamp: String(tsb) },
+    { account_id: "acct", units: 10, task_ref: "image.render" });
+  assert.strictEqual(res.reason, "agent_signature_invalid", "task-bound proof rejects a different task");
+
+  // 10d. An unbound proof still authorizes by default even when a binding is supplied.
+  tsb = Date.now() + 3;
+  res = resolveSpendCredential(state, credB.bearer_token, { signature: signAuth(privateKey, "cb", tsb), timestamp: String(tsb) }, bindReq);
+  assert.strictEqual(res.ok, true, "unbound proof still authorizes by default (back-compat)");
+
+  // 10e. Strict binding is CALLER-scoped (requestBinding.require=true), not a global flag — so
+  //      it applies only where a binding is supplied (execute path), never the lifecycle paths.
+  const strictBind = { ...bindReq, require: true };
+  tsb = Date.now() + 4;
+  res = resolveSpendCredential(state, credB.bearer_token, { signature: signAuth(privateKey, "cb", tsb), timestamp: String(tsb) }, strictBind);
+  assert.strictEqual(res.reason, "agent_signature_binding_required_or_invalid", "strict refuses an unbound proof");
+  tsb = Date.now() + 5;
+  res = resolveSpendCredential(state, credB.bearer_token, { signature: signBound(tsb, bindReq), timestamp: String(tsb) }, strictBind);
+  assert.strictEqual(res.ok, true, "strict accepts a matching bound proof");
+  tsb = Date.now() + 6;
+  res = resolveSpendCredential(state, credB.bearer_token, { signature: signBound(tsb, bindReq), timestamp: String(tsb) }, { require: true });
+  assert.strictEqual(res.reason, "spend_binding_required", "strict requires a request binding");
+
+  // 10f. A key-bound credential on a NON-binding caller (no requestBinding) is unaffected by
+  //      strict mode — the lifecycle paths (reserve/release/reverse) keep working.
+  tsb = Date.now() + 7;
+  res = resolveSpendCredential(state, credB.bearer_token, { signature: signAuth(privateKey, "cb", tsb), timestamp: String(tsb) });
+  assert.strictEqual(res.ok, true, "no-binding caller still authorizes under back-compat");
+
+  console.log("verify_agent_identity: all checks passed");
+}
+
+main();

package/scripts/verify_all.js

@@ -4960,4 +4960,4 @@ main().catch((error) => {
   console.error(error);
   process.exit(1);
 });
-
+