xytara 3.1.13 → 3.1.14

package/scripts/verify_bolt_adapter.js

@@ -1,128 +1,128 @@
-"use strict";
-
-// Verifies the BSV/UTXO (BOLT) adapter (lib/bolt_adapter.js). Offline: the chain
-// fetch is injected as a mock, so no network. Exercises config gating, header
-// parsing, and the on-chain amount/address verification + confirmations logic.
-
-const assert = require("assert");
-const m = require("../lib/bolt_adapter");
-
-function setEnv(env) {
-  const saved = {};
-  for (const k in env) {
-    saved[k] = process.env[k];
-    if (env[k] === undefined) delete process.env[k];
-    else process.env[k] = env[k];
-  }
-  return () => {
-    for (const k in saved) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-  };
-}
-
-const PAYTO = "1NaxytraPayToAddressExampleXXXXXXXXXX";
-const TXID = "a".repeat(64);
-
-function mockTx(voutValueBsv, address, confirmations) {
-  return async () => ({ status: 200, json: { confirmations, vout: [{ value: voutValueBsv, scriptPubKey: { addresses: [address] } }] } });
-}
-
-async function main() {
-  // 1. Not configured.
-  let restore = setEnv({ XYTARA_BOLT_PROVIDER: undefined });
-  let cfg = m.loadBoltConfig();
-  assert.strictEqual(cfg.provider, null);
-  assert.strictEqual(m.isConfigured(cfg), false);
-  assert.strictEqual((await m.verifyBsvPayment(cfg, TXID)).reason, "bolt_provider_not_configured");
-  restore();
-
-  // 2. Configured (whatsonchain).
-  restore = setEnv({
-    XYTARA_BOLT_PROVIDER: "whatsonchain",
-    XYTARA_BOLT_PAYTO_ADDRESS: PAYTO,
-    XYTARA_BOLT_PRICE_SATS: "1000",
-    XYTARA_BOLT_MIN_CONFIRMATIONS: "1",
-    XYTARA_BOLT_NETWORK: "main"
-  });
-  cfg = m.loadBoltConfig();
-  assert.strictEqual(cfg.provider, "whatsonchain");
-  assert.ok(cfg.apiUrl.includes("whatsonchain.com"));
-
-  // Header parsing.
-  assert.deepStrictEqual(m.parseBoltHeader(`BOLT ${TXID}`), { txid: TXID });
-  assert.strictEqual(m.parseBoltHeader("BOLT not-a-txid"), null);
-  assert.strictEqual(m.parseBoltHeader("Bearer x"), null);
-
-  // Challenge shape.
-  const ch = m.buildBoltChallenge(cfg);
-  assert.strictEqual(ch.address, PAYTO);
-  assert.strictEqual(ch.amount_sats, 1000);
-
-  // Invalid txid -> rejected before any fetch.
-  assert.strictEqual((await m.verifyBsvPayment(cfg, "xyz")).reason, "bolt_txid_invalid");
-
-  // Sufficient payment (0.00002 BSV = 2000 sats to PAYTO, 3 confs) -> ok.
-  let r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.00002, PAYTO, 3));
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(r.paid_sats, 2000);
-  assert.strictEqual(r.confirmations, 3);
-
-  // --- Per-quote binding: unique exact amount ---
-  const reqSats = m.computeRequiredSats(cfg, { quote_id: "quote_x" });
-  assert.ok(reqSats >= 1000 && reqSats < 1000 + cfg.bindingWindowSats, "required = price + bounded offset");
-  assert.strictEqual(reqSats, m.computeRequiredSats(cfg, { quote_id: "quote_x" }), "deterministic");
-  // Paying the EXACT bound amount -> ok.
-  r = await m.verifyBsvPayment(cfg, TXID, mockTx(reqSats / 1e8, PAYTO, 3), { requiredSats: reqSats });
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(r.paid_sats, reqSats);
-  assert.strictEqual(r.required_sats, reqSats);
-  // Paying a DIFFERENT amount (even to the right address) -> mismatch, so an
-  // unrelated payment cannot be reused to satisfy this quote.
-  r = await m.verifyBsvPayment(cfg, TXID, mockTx((reqSats + 1) / 1e8, PAYTO, 3), { requiredSats: reqSats });
-  assert.strictEqual(r.reason, "bolt_amount_mismatch");
-  // Challenge advertises the exact amount.
-  const boundChallenge = m.buildBoltChallenge(cfg, { requiredSats: reqSats });
-  assert.strictEqual(boundChallenge.amount_sats, reqSats);
-  assert.strictEqual(boundChallenge.exact, true);
-
-  // Insufficient amount (500 sats < 1000) -> rejected.
-  r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.000005, PAYTO, 3));
-  assert.strictEqual(r.ok, false);
-  assert.strictEqual(r.reason, "bolt_amount_insufficient");
-
-  // Paid to the wrong address -> counts as zero -> insufficient.
-  r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.001, "1SomeOtherAddressXXXXXXXXXXXXXXXXXXX", 3));
-  assert.strictEqual(r.reason, "bolt_amount_insufficient");
-
-  // Too few confirmations -> rejected.
-  r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.00002, PAYTO, 0));
-  assert.strictEqual(r.reason, "bolt_insufficient_confirmations");
-
-  // Default min_confirmations is 1 (not 0) when unset -> mempool (0-conf) rejected.
-  const dflt = setEnv({ XYTARA_BOLT_PROVIDER: "whatsonchain", XYTARA_BOLT_PAYTO_ADDRESS: PAYTO, XYTARA_BOLT_PRICE_SATS: "1000", XYTARA_BOLT_MIN_CONFIRMATIONS: undefined });
-  const dcfg = m.loadBoltConfig();
-  assert.strictEqual(dcfg.minConfirmations, 1);
-  r = await m.verifyBsvPayment(dcfg, TXID, mockTx(0.00002, PAYTO, 0));
-  assert.strictEqual(r.reason, "bolt_insufficient_confirmations");
-  dflt();
-
-  // Tx not found (404) -> rejected.
-  r = await m.verifyBsvPayment(cfg, TXID, async () => ({ status: 404, json: null }));
-  assert.strictEqual(r.reason, "bolt_tx_not_found");
-  restore();
-
-  // 3. Configured but missing payto/price -> explicit reason (no fetch).
-  restore = setEnv({ XYTARA_BOLT_PROVIDER: "whatsonchain", XYTARA_BOLT_PAYTO_ADDRESS: undefined, XYTARA_BOLT_PRICE_SATS: undefined });
-  cfg = m.loadBoltConfig();
-  assert.strictEqual((await m.verifyBsvPayment(cfg, TXID)).reason, "bolt_payto_or_price_missing");
-  restore();
-
-  console.log("verify_bolt_adapter: all BSV/UTXO (BOLT) adapter checks passed");
-}
-
-main().catch((error) => {
-  console.error("verify_bolt_adapter failed:", error && error.message ? error.message : error);
-  process.exitCode = 1;
-});
+"use strict";
+
+// Verifies the BSV/UTXO (BOLT) adapter (lib/bolt_adapter.js). Offline: the chain
+// fetch is injected as a mock, so no network. Exercises config gating, header
+// parsing, and the on-chain amount/address verification + confirmations logic.
+
+const assert = require("assert");
+const m = require("../lib/bolt_adapter");
+
+function setEnv(env) {
+  const saved = {};
+  for (const k in env) {
+    saved[k] = process.env[k];
+    if (env[k] === undefined) delete process.env[k];
+    else process.env[k] = env[k];
+  }
+  return () => {
+    for (const k in saved) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  };
+}
+
+const PAYTO = "1NaxytraPayToAddressExampleXXXXXXXXXX";
+const TXID = "a".repeat(64);
+
+function mockTx(voutValueBsv, address, confirmations) {
+  return async () => ({ status: 200, json: { confirmations, vout: [{ value: voutValueBsv, scriptPubKey: { addresses: [address] } }] } });
+}
+
+async function main() {
+  // 1. Not configured.
+  let restore = setEnv({ XYTARA_BOLT_PROVIDER: undefined });
+  let cfg = m.loadBoltConfig();
+  assert.strictEqual(cfg.provider, null);
+  assert.strictEqual(m.isConfigured(cfg), false);
+  assert.strictEqual((await m.verifyBsvPayment(cfg, TXID)).reason, "bolt_provider_not_configured");
+  restore();
+
+  // 2. Configured (whatsonchain).
+  restore = setEnv({
+    XYTARA_BOLT_PROVIDER: "whatsonchain",
+    XYTARA_BOLT_PAYTO_ADDRESS: PAYTO,
+    XYTARA_BOLT_PRICE_SATS: "1000",
+    XYTARA_BOLT_MIN_CONFIRMATIONS: "1",
+    XYTARA_BOLT_NETWORK: "main"
+  });
+  cfg = m.loadBoltConfig();
+  assert.strictEqual(cfg.provider, "whatsonchain");
+  assert.ok(cfg.apiUrl.includes("whatsonchain.com"));
+
+  // Header parsing.
+  assert.deepStrictEqual(m.parseBoltHeader(`BOLT ${TXID}`), { txid: TXID });
+  assert.strictEqual(m.parseBoltHeader("BOLT not-a-txid"), null);
+  assert.strictEqual(m.parseBoltHeader("Bearer x"), null);
+
+  // Challenge shape.
+  const ch = m.buildBoltChallenge(cfg);
+  assert.strictEqual(ch.address, PAYTO);
+  assert.strictEqual(ch.amount_sats, 1000);
+
+  // Invalid txid -> rejected before any fetch.
+  assert.strictEqual((await m.verifyBsvPayment(cfg, "xyz")).reason, "bolt_txid_invalid");
+
+  // Sufficient payment (0.00002 BSV = 2000 sats to PAYTO, 3 confs) -> ok.
+  let r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.00002, PAYTO, 3));
+  assert.strictEqual(r.ok, true);
+  assert.strictEqual(r.paid_sats, 2000);
+  assert.strictEqual(r.confirmations, 3);
+
+  // --- Per-quote binding: unique exact amount ---
+  const reqSats = m.computeRequiredSats(cfg, { quote_id: "quote_x" });
+  assert.ok(reqSats >= 1000 && reqSats < 1000 + cfg.bindingWindowSats, "required = price + bounded offset");
+  assert.strictEqual(reqSats, m.computeRequiredSats(cfg, { quote_id: "quote_x" }), "deterministic");
+  // Paying the EXACT bound amount -> ok.
+  r = await m.verifyBsvPayment(cfg, TXID, mockTx(reqSats / 1e8, PAYTO, 3), { requiredSats: reqSats });
+  assert.strictEqual(r.ok, true);
+  assert.strictEqual(r.paid_sats, reqSats);
+  assert.strictEqual(r.required_sats, reqSats);
+  // Paying a DIFFERENT amount (even to the right address) -> mismatch, so an
+  // unrelated payment cannot be reused to satisfy this quote.
+  r = await m.verifyBsvPayment(cfg, TXID, mockTx((reqSats + 1) / 1e8, PAYTO, 3), { requiredSats: reqSats });
+  assert.strictEqual(r.reason, "bolt_amount_mismatch");
+  // Challenge advertises the exact amount.
+  const boundChallenge = m.buildBoltChallenge(cfg, { requiredSats: reqSats });
+  assert.strictEqual(boundChallenge.amount_sats, reqSats);
+  assert.strictEqual(boundChallenge.exact, true);
+
+  // Insufficient amount (500 sats < 1000) -> rejected.
+  r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.000005, PAYTO, 3));
+  assert.strictEqual(r.ok, false);
+  assert.strictEqual(r.reason, "bolt_amount_insufficient");
+
+  // Paid to the wrong address -> counts as zero -> insufficient.
+  r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.001, "1SomeOtherAddressXXXXXXXXXXXXXXXXXXX", 3));
+  assert.strictEqual(r.reason, "bolt_amount_insufficient");
+
+  // Too few confirmations -> rejected.
+  r = await m.verifyBsvPayment(cfg, TXID, mockTx(0.00002, PAYTO, 0));
+  assert.strictEqual(r.reason, "bolt_insufficient_confirmations");
+
+  // Default min_confirmations is 1 (not 0) when unset -> mempool (0-conf) rejected.
+  const dflt = setEnv({ XYTARA_BOLT_PROVIDER: "whatsonchain", XYTARA_BOLT_PAYTO_ADDRESS: PAYTO, XYTARA_BOLT_PRICE_SATS: "1000", XYTARA_BOLT_MIN_CONFIRMATIONS: undefined });
+  const dcfg = m.loadBoltConfig();
+  assert.strictEqual(dcfg.minConfirmations, 1);
+  r = await m.verifyBsvPayment(dcfg, TXID, mockTx(0.00002, PAYTO, 0));
+  assert.strictEqual(r.reason, "bolt_insufficient_confirmations");
+  dflt();
+
+  // Tx not found (404) -> rejected.
+  r = await m.verifyBsvPayment(cfg, TXID, async () => ({ status: 404, json: null }));
+  assert.strictEqual(r.reason, "bolt_tx_not_found");
+  restore();
+
+  // 3. Configured but missing payto/price -> explicit reason (no fetch).
+  restore = setEnv({ XYTARA_BOLT_PROVIDER: "whatsonchain", XYTARA_BOLT_PAYTO_ADDRESS: undefined, XYTARA_BOLT_PRICE_SATS: undefined });
+  cfg = m.loadBoltConfig();
+  assert.strictEqual((await m.verifyBsvPayment(cfg, TXID)).reason, "bolt_payto_or_price_missing");
+  restore();
+
+  console.log("verify_bolt_adapter: all BSV/UTXO (BOLT) adapter checks passed");
+}
+
+main().catch((error) => {
+  console.error("verify_bolt_adapter failed:", error && error.message ? error.message : error);
+  process.exitCode = 1;
+});

package/scripts/verify_cdp_facilitator.js

@@ -1,110 +1,110 @@
-"use strict";
-
-// Verifies the Coinbase CDP auth path for the x402 facilitator client: when a CDP Secret
-// API Key is configured, the client must mint a fresh, valid EdDSA Bearer JWT per request
-// (CDP rejects static tokens). A mock facilitator stands in for CDP and cryptographically
-// verifies the token's signature and claims before accepting the call. No real network/chain.
-
-const assert = require("assert");
-const http = require("http");
-const crypto = require("crypto");
-
-const { createFacilitatorClient } = require("../lib/x402_facilitator");
-const { loadPaymentConfig } = require("../lib/payment_config");
-
-// A throwaway Ed25519 key, exported as the base64 64-byte (seed||public) secret CDP uses.
-function makeCdpKey() {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
-  const seed = privateKey.export({ format: "der", type: "pkcs8" }).subarray(16); // last 32 bytes
-  const pub = publicKey.export({ format: "der", type: "spki" }).subarray(12); // last 32 bytes
-  return { publicKey, keySecret: Buffer.concat([seed, pub]).toString("base64") };
-}
-
-function startCdpMock(expectedPublicKey, seen) {
-  const server = http.createServer((req, res) => {
-    const chunks = [];
-    req.on("data", (c) => chunks.push(c));
-    req.on("end", () => {
-      const reply = (code, payload) => {
-        const text = JSON.stringify(payload);
-        res.writeHead(code, { "content-type": "application/json", "content-length": Buffer.byteLength(text) });
-        res.end(text);
-      };
-      const auth = String((req.headers.authorization || ""));
-      if (!auth.startsWith("Bearer ")) return reply(401, { error: "missing_bearer" });
-      const token = auth.slice("Bearer ".length);
-      const parts = token.split(".");
-      if (parts.length !== 3) return reply(401, { error: "malformed_jwt" });
-      const header = JSON.parse(Buffer.from(parts[0], "base64").toString("utf8"));
-      const claims = JSON.parse(Buffer.from(parts[1], "base64").toString("utf8"));
-      const sig = Buffer.from(parts[2].replace(/-/g, "+").replace(/_/g, "/"), "base64");
-      const signatureValid = crypto.verify(null, Buffer.from(`${parts[0]}.${parts[1]}`), expectedPublicKey, sig);
-      // Record what the facilitator observed so the test can assert on it.
-      seen.push({ header, claims, signatureValid, path: req.url, nonce: header.nonce });
-      if (header.alg !== "EdDSA") return reply(401, { error: "bad_alg" });
-      if (!signatureValid) return reply(401, { error: "bad_signature" });
-      if (claims.iss !== "cdp") return reply(401, { error: "bad_iss" });
-      if (!Array.isArray(claims.aud) || claims.aud[0] !== "cdp_service") return reply(401, { error: "bad_aud" });
-      const now = Math.floor(Date.now() / 1000);
-      if (!(claims.exp > now && claims.exp - claims.nbf <= 120)) return reply(401, { error: "bad_exp" });
-      if (!(claims.uri.startsWith("POST 127.0.0.1:") && claims.uri.endsWith(req.url))) return reply(401, { error: "bad_uri", uri: claims.uri });
-      if (req.url === "/verify") return reply(200, { isValid: true, payer: "0x2222222222222222222222222222222222222222" });
-      if (req.url === "/settle") return reply(200, { success: true, transaction: "0xcdpmocktx", network: "eip155:8453" });
-      return reply(404, { error: "not_found" });
-    });
-  });
-  return new Promise((resolve) => server.listen(0, "127.0.0.1", () => resolve({ server, port: server.address().port })));
-}
-
-const PAYLOAD = { x402Version: 2, accepted: { scheme: "exact" }, payload: { signature: "ok", authorization: {} } };
-const REQS = { scheme: "exact", network: "eip155:8453", asset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", amount: "10000", payTo: "0xabc", resource: "https://x/y" };
-
-async function main() {
-  const { publicKey, keySecret } = makeCdpKey();
-  const seen = [];
-  const mock = await startCdpMock(publicKey, seen);
-  const baseUrl = `http://127.0.0.1:${mock.port}`;
-
-  try {
-    // 1. Config loader picks up the CDP env into config.x402.cdp.
-    const prev = { id: process.env.XYTARA_X402_CDP_KEY_ID, sec: process.env.XYTARA_X402_CDP_KEY_SECRET };
-    process.env.XYTARA_X402_CDP_KEY_ID = "11111111-2222-3333-4444-555555555555";
-    process.env.XYTARA_X402_CDP_KEY_SECRET = keySecret;
-    const cfg = loadPaymentConfig();
-    assert.ok(cfg.x402.cdp && cfg.x402.cdp.key_id === "11111111-2222-3333-4444-555555555555", "config must load CDP key id");
-    assert.strictEqual(cfg.x402.cdp.key_secret, keySecret, "config must load CDP key secret");
-
-    // 2. The client attaches a valid per-request Bearer that the mock CDP accepts.
-    const client = createFacilitatorClient({ url: baseUrl, cdp: cfg.x402.cdp, timeoutMs: 5000 });
-    const verify = await client.verify(PAYLOAD, REQS);
-    assert.strictEqual(verify.ok, true, "verify must succeed with a valid CDP Bearer");
-    assert.strictEqual(verify.json.isValid, true, "mock CDP must accept the token on /verify");
-    const settle = await client.settle(PAYLOAD, REQS);
-    assert.strictEqual(settle.ok, true, "settle must succeed with a valid CDP Bearer");
-    assert.strictEqual(settle.json.transaction, "0xcdpmocktx", "settle must return the mock tx");
-
-    // 3. Each request minted its own token (fresh nonce), signature valid, uri bound to the path.
-    assert.strictEqual(seen.length, 2, "mock must have seen two authenticated calls");
-    assert.ok(seen.every((e) => e.signatureValid), "every token signature must verify");
-    assert.notStrictEqual(seen[0].nonce, seen[1].nonce, "each request must mint a fresh token (distinct nonce)");
-    assert.ok(seen[0].claims.uri.endsWith("/verify") && seen[1].claims.uri.endsWith("/settle"), "uri claim must bind to each request path");
-
-    // 4. Without CDP creds, no Authorization header is sent (static-facilitator path unaffected).
-    const seen2 = [];
-    const mock2 = await startCdpMock(publicKey, seen2);
-    const plainClient = createFacilitatorClient({ url: `http://127.0.0.1:${mock2.port}`, timeoutMs: 5000 });
-    const plain = await plainClient.verify(PAYLOAD, REQS);
-    assert.strictEqual(plain.status, 401, "without CDP creds the mock sees no Bearer and rejects");
-    assert.strictEqual(seen2.length, 0, "no JWT should be minted when CDP is not configured");
-    await new Promise((r) => mock2.server.close(r));
-
-    if (prev.id === undefined) delete process.env.XYTARA_X402_CDP_KEY_ID; else process.env.XYTARA_X402_CDP_KEY_ID = prev.id;
-    if (prev.sec === undefined) delete process.env.XYTARA_X402_CDP_KEY_SECRET; else process.env.XYTARA_X402_CDP_KEY_SECRET = prev.sec;
-
-    console.log("xytara verify:cdp-facilitator passed");
-  } finally {
-    await new Promise((r) => mock.server.close(r));
-  }
-}
-
-main().catch((e) => { console.error(e && e.message ? e.message : e); process.exitCode = 1; });
+"use strict";
+
+// Verifies the Coinbase CDP auth path for the x402 facilitator client: when a CDP Secret
+// API Key is configured, the client must mint a fresh, valid EdDSA Bearer JWT per request
+// (CDP rejects static tokens). A mock facilitator stands in for CDP and cryptographically
+// verifies the token's signature and claims before accepting the call. No real network/chain.
+
+const assert = require("assert");
+const http = require("http");
+const crypto = require("crypto");
+
+const { createFacilitatorClient } = require("../lib/x402_facilitator");
+const { loadPaymentConfig } = require("../lib/payment_config");
+
+// A throwaway Ed25519 key, exported as the base64 64-byte (seed||public) secret CDP uses.
+function makeCdpKey() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const seed = privateKey.export({ format: "der", type: "pkcs8" }).subarray(16); // last 32 bytes
+  const pub = publicKey.export({ format: "der", type: "spki" }).subarray(12); // last 32 bytes
+  return { publicKey, keySecret: Buffer.concat([seed, pub]).toString("base64") };
+}
+
+function startCdpMock(expectedPublicKey, seen) {
+  const server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const reply = (code, payload) => {
+        const text = JSON.stringify(payload);
+        res.writeHead(code, { "content-type": "application/json", "content-length": Buffer.byteLength(text) });
+        res.end(text);
+      };
+      const auth = String((req.headers.authorization || ""));
+      if (!auth.startsWith("Bearer ")) return reply(401, { error: "missing_bearer" });
+      const token = auth.slice("Bearer ".length);
+      const parts = token.split(".");
+      if (parts.length !== 3) return reply(401, { error: "malformed_jwt" });
+      const header = JSON.parse(Buffer.from(parts[0], "base64").toString("utf8"));
+      const claims = JSON.parse(Buffer.from(parts[1], "base64").toString("utf8"));
+      const sig = Buffer.from(parts[2].replace(/-/g, "+").replace(/_/g, "/"), "base64");
+      const signatureValid = crypto.verify(null, Buffer.from(`${parts[0]}.${parts[1]}`), expectedPublicKey, sig);
+      // Record what the facilitator observed so the test can assert on it.
+      seen.push({ header, claims, signatureValid, path: req.url, nonce: header.nonce });
+      if (header.alg !== "EdDSA") return reply(401, { error: "bad_alg" });
+      if (!signatureValid) return reply(401, { error: "bad_signature" });
+      if (claims.iss !== "cdp") return reply(401, { error: "bad_iss" });
+      if (!Array.isArray(claims.aud) || claims.aud[0] !== "cdp_service") return reply(401, { error: "bad_aud" });
+      const now = Math.floor(Date.now() / 1000);
+      if (!(claims.exp > now && claims.exp - claims.nbf <= 120)) return reply(401, { error: "bad_exp" });
+      if (!(claims.uri.startsWith("POST 127.0.0.1:") && claims.uri.endsWith(req.url))) return reply(401, { error: "bad_uri", uri: claims.uri });
+      if (req.url === "/verify") return reply(200, { isValid: true, payer: "0x2222222222222222222222222222222222222222" });
+      if (req.url === "/settle") return reply(200, { success: true, transaction: "0xcdpmocktx", network: "eip155:8453" });
+      return reply(404, { error: "not_found" });
+    });
+  });
+  return new Promise((resolve) => server.listen(0, "127.0.0.1", () => resolve({ server, port: server.address().port })));
+}
+
+const PAYLOAD = { x402Version: 2, accepted: { scheme: "exact" }, payload: { signature: "ok", authorization: {} } };
+const REQS = { scheme: "exact", network: "eip155:8453", asset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", amount: "10000", payTo: "0xabc", resource: "https://x/y" };
+
+async function main() {
+  const { publicKey, keySecret } = makeCdpKey();
+  const seen = [];
+  const mock = await startCdpMock(publicKey, seen);
+  const baseUrl = `http://127.0.0.1:${mock.port}`;
+
+  try {
+    // 1. Config loader picks up the CDP env into config.x402.cdp.
+    const prev = { id: process.env.XYTARA_X402_CDP_KEY_ID, sec: process.env.XYTARA_X402_CDP_KEY_SECRET };
+    process.env.XYTARA_X402_CDP_KEY_ID = "11111111-2222-3333-4444-555555555555";
+    process.env.XYTARA_X402_CDP_KEY_SECRET = keySecret;
+    const cfg = loadPaymentConfig();
+    assert.ok(cfg.x402.cdp && cfg.x402.cdp.key_id === "11111111-2222-3333-4444-555555555555", "config must load CDP key id");
+    assert.strictEqual(cfg.x402.cdp.key_secret, keySecret, "config must load CDP key secret");
+
+    // 2. The client attaches a valid per-request Bearer that the mock CDP accepts.
+    const client = createFacilitatorClient({ url: baseUrl, cdp: cfg.x402.cdp, timeoutMs: 5000 });
+    const verify = await client.verify(PAYLOAD, REQS);
+    assert.strictEqual(verify.ok, true, "verify must succeed with a valid CDP Bearer");
+    assert.strictEqual(verify.json.isValid, true, "mock CDP must accept the token on /verify");
+    const settle = await client.settle(PAYLOAD, REQS);
+    assert.strictEqual(settle.ok, true, "settle must succeed with a valid CDP Bearer");
+    assert.strictEqual(settle.json.transaction, "0xcdpmocktx", "settle must return the mock tx");
+
+    // 3. Each request minted its own token (fresh nonce), signature valid, uri bound to the path.
+    assert.strictEqual(seen.length, 2, "mock must have seen two authenticated calls");
+    assert.ok(seen.every((e) => e.signatureValid), "every token signature must verify");
+    assert.notStrictEqual(seen[0].nonce, seen[1].nonce, "each request must mint a fresh token (distinct nonce)");
+    assert.ok(seen[0].claims.uri.endsWith("/verify") && seen[1].claims.uri.endsWith("/settle"), "uri claim must bind to each request path");
+
+    // 4. Without CDP creds, no Authorization header is sent (static-facilitator path unaffected).
+    const seen2 = [];
+    const mock2 = await startCdpMock(publicKey, seen2);
+    const plainClient = createFacilitatorClient({ url: `http://127.0.0.1:${mock2.port}`, timeoutMs: 5000 });
+    const plain = await plainClient.verify(PAYLOAD, REQS);
+    assert.strictEqual(plain.status, 401, "without CDP creds the mock sees no Bearer and rejects");
+    assert.strictEqual(seen2.length, 0, "no JWT should be minted when CDP is not configured");
+    await new Promise((r) => mock2.server.close(r));
+
+    if (prev.id === undefined) delete process.env.XYTARA_X402_CDP_KEY_ID; else process.env.XYTARA_X402_CDP_KEY_ID = prev.id;
+    if (prev.sec === undefined) delete process.env.XYTARA_X402_CDP_KEY_SECRET; else process.env.XYTARA_X402_CDP_KEY_SECRET = prev.sec;
+
+    console.log("xytara verify:cdp-facilitator passed");
+  } finally {
+    await new Promise((r) => mock.server.close(r));
+  }
+}
+
+main().catch((e) => { console.error(e && e.message ? e.message : e); process.exitCode = 1; });