xytara 3.1.13 → 3.1.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (55) hide show
  1. package/.env.example +8 -1
  2. package/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md +126 -126
  3. package/RELEASE_NOTES.md +6 -4
  4. package/lib/a2a_rpc.js +280 -280
  5. package/lib/account_auth.js +585 -585
  6. package/lib/agent_identity.js +162 -162
  7. package/lib/bolt_adapter.js +187 -187
  8. package/lib/bolt_payment_front.js +224 -224
  9. package/lib/checkout_processor_adapter.js +217 -217
  10. package/lib/command_flow.js +722 -722
  11. package/lib/commerce_artifacts.js +591 -591
  12. package/lib/commerce_bridge.js +274 -274
  13. package/lib/commerce_cases.js +399 -399
  14. package/lib/commerce_client.js +7694 -7694
  15. package/lib/commerce_quotes.js +29 -0
  16. package/lib/commerce_runtime.js +322 -322
  17. package/lib/execution_dedupe.js +86 -86
  18. package/lib/external_credit_bridge.js +142 -142
  19. package/lib/http_transport.js +81 -81
  20. package/lib/l402_adapter.js +241 -241
  21. package/lib/l402_payment_front.js +265 -265
  22. package/lib/mpp_adapter.js +237 -237
  23. package/lib/payment_config.js +253 -253
  24. package/lib/payment_verification.js +357 -357
  25. package/lib/provider_payout_execution.js +155 -155
  26. package/lib/provider_registry.js +842 -842
  27. package/lib/rate_limiter.js +81 -81
  28. package/lib/runtime_state_store.js +491 -369
  29. package/lib/settlement_bsv_live.js +600 -600
  30. package/lib/settlement_bsv_teranode.js +117 -117
  31. package/lib/stripe_mpp_payment_front.js +258 -258
  32. package/lib/x402_facilitator.js +191 -191
  33. package/package.json +5 -3
  34. package/scripts/state_backup_offsite.js +196 -0
  35. package/scripts/verify_a2a_rpc.js +105 -105
  36. package/scripts/verify_agent_identity.js +153 -153
  37. package/scripts/verify_all.js +1 -1
  38. package/scripts/verify_bolt_adapter.js +128 -128
  39. package/scripts/verify_cdp_facilitator.js +110 -110
  40. package/scripts/verify_checkout_processor.js +109 -109
  41. package/scripts/verify_commerce_bridge.js +177 -177
  42. package/scripts/verify_execution_dedupe.js +189 -189
  43. package/scripts/verify_execution_surfacing.js +76 -76
  44. package/scripts/verify_final_activation.js +191 -191
  45. package/scripts/verify_l402_adapter.js +86 -86
  46. package/scripts/verify_mpp_adapter.js +128 -128
  47. package/scripts/verify_production_readiness.js +268 -268
  48. package/scripts/verify_rate_limiter.js +52 -52
  49. package/scripts/verify_refund_credit.js +106 -106
  50. package/scripts/verify_release_candidate.js +81 -81
  51. package/scripts/verify_runtime_state_guard.js +117 -0
  52. package/scripts/verify_service.js +15421 -15421
  53. package/scripts/verify_verify_execute_settle.js +208 -208
  54. package/scripts/verify_x402_facilitator.js +286 -286
  55. package/server.js +11976 -11974
@@ -1,191 +1,191 @@
1
- "use strict";
2
-
3
- const assert = require("assert");
4
-
5
- function parseCsvEnv(value) {
6
- if (!value) {
7
- return [];
8
- }
9
- return value
10
- .split(",")
11
- .map((entry) => entry.trim())
12
- .filter(Boolean);
13
- }
14
-
15
- async function getJson(baseUrl, path, headers) {
16
- const response = await fetch(`${baseUrl}${path}`, {
17
- headers: headers || {}
18
- });
19
- const json = await response.json();
20
- return {
21
- status: response.status,
22
- json
23
- };
24
- }
25
-
26
- function assertContainsAll(actual, expected, label) {
27
- for (const entry of expected) {
28
- assert.strictEqual(
29
- actual.includes(entry),
30
- true,
31
- `${label} missing expected entry: ${entry}`
32
- );
33
- }
34
- }
35
-
36
- async function main() {
37
- const baseUrl = process.env.XYTARA_VERIFY_BASE_URL || "https://xytara.onrender.com";
38
- const expectedLiveRails = parseCsvEnv(process.env.XYTARA_EXPECTED_LIVE_RAILS);
39
- const expectedReadinessOnlyRails = parseCsvEnv(process.env.XYTARA_EXPECTED_READINESS_ONLY_RAILS);
40
- const expectedBsvRuntimeMode = process.env.XYTARA_EXPECTED_BSV_RUNTIME_MODE || "arc";
41
- const operatorAccountId = process.env.XYTARA_VERIFY_ACCOUNT_ID || process.env.XYTARA_TREASURY_ACCOUNT_ID || "";
42
- const operatorBearerToken = process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN || "";
43
- const operatorHeaders = operatorBearerToken
44
- ? { authorization: `Bearer ${operatorBearerToken}` }
45
- : null;
46
-
47
- const treasurySummary = await getJson(baseUrl, "/v1/treasury-destinations/summary");
48
- assert.strictEqual(treasurySummary.status, 200, "treasury destinations summary route failed");
49
- assert.strictEqual(
50
- treasurySummary.json.category,
51
- "machine-commerce-treasury-destinations-pack-summary",
52
- "treasury destinations summary category mismatch"
53
- );
54
- assert.strictEqual(
55
- treasurySummary.json.public_claimable_profile_count > 0,
56
- true,
57
- "public claimable treasury profile count must be positive"
58
- );
59
- assert.strictEqual(
60
- Array.isArray(treasurySummary.json.public_claim_boundary.live_claimable_rails),
61
- true,
62
- "treasury summary live claimable rails missing"
63
- );
64
- assert.strictEqual(
65
- Array.isArray(treasurySummary.json.public_claim_boundary.readiness_only_rails),
66
- true,
67
- "treasury summary readiness-only rails missing"
68
- );
69
-
70
- const paymentRailTruthSummary = await getJson(baseUrl, "/v1/payment-rail-truth/summary");
71
- assert.strictEqual(paymentRailTruthSummary.status, 200, "payment rail truth summary route failed");
72
- assert.strictEqual(
73
- paymentRailTruthSummary.json.category,
74
- "machine-commerce-payment-rail-truth-model",
75
- "payment rail truth summary category mismatch"
76
- );
77
- assert.strictEqual(
78
- paymentRailTruthSummary.json.public_live_landing_rail_count > 0,
79
- true,
80
- "public live landing rail count must be positive"
81
- );
82
-
83
- const autonomousEntrySummary = await getJson(baseUrl, "/v1/autonomous-entry/summary");
84
- assert.strictEqual(autonomousEntrySummary.status, 200, "autonomous entry summary route failed");
85
- assert.strictEqual(
86
- autonomousEntrySummary.json.category,
87
- "machine-commerce-autonomous-entry-pack-summary",
88
- "autonomous entry summary category mismatch"
89
- );
90
- assert.strictEqual(
91
- autonomousEntrySummary.json.public_live_landing_rail_count > 0,
92
- true,
93
- "autonomous entry live landing rail count must be positive"
94
- );
95
-
96
- const bsvReadiness = await getJson(baseUrl, "/v1/settlement/bsv-teranode/readiness");
97
- assert.strictEqual(bsvReadiness.status, 200, "BSV readiness route failed");
98
- assert.strictEqual(bsvReadiness.json.rail, "bsv_teranode", "BSV readiness rail mismatch");
99
- assert.strictEqual(bsvReadiness.json.ready, true, "BSV readiness must be true");
100
- assert.strictEqual(
101
- bsvReadiness.json.runtime_mode,
102
- expectedBsvRuntimeMode,
103
- `BSV readiness runtime mode must be ${expectedBsvRuntimeMode}`
104
- );
105
-
106
- if (expectedLiveRails.length > 0) {
107
- assertContainsAll(
108
- treasurySummary.json.public_claim_boundary.live_claimable_rails,
109
- expectedLiveRails,
110
- "live claimable rails"
111
- );
112
- }
113
-
114
- if (expectedReadinessOnlyRails.length > 0) {
115
- assertContainsAll(
116
- treasurySummary.json.public_claim_boundary.readiness_only_rails,
117
- expectedReadinessOnlyRails,
118
- "readiness-only rails"
119
- );
120
- }
121
-
122
- let operatorChecks = {
123
- attempted: false
124
- };
125
-
126
- if (operatorHeaders && operatorAccountId) {
127
- operatorChecks = {
128
- attempted: true
129
- };
130
-
131
- const paymentLedger = await getJson(baseUrl, "/v1/payment-ledger", operatorHeaders);
132
- assert.strictEqual(paymentLedger.status, 200, "payment ledger route failed");
133
-
134
- const activityLedger = await getJson(baseUrl, "/v1/activity-ledger", operatorHeaders);
135
- assert.strictEqual(activityLedger.status, 200, "activity ledger route failed");
136
-
137
- const treasurySummaryRoute = await getJson(
138
- baseUrl,
139
- `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/treasury-summary`,
140
- operatorHeaders
141
- );
142
- assert.strictEqual(treasurySummaryRoute.status, 200, "account treasury summary route failed");
143
-
144
- const railSummaryRoute = await getJson(
145
- baseUrl,
146
- `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/rail-summary`,
147
- operatorHeaders
148
- );
149
- assert.strictEqual(railSummaryRoute.status, 200, "account rail summary route failed");
150
-
151
- const reconciliationReport = await getJson(baseUrl, "/v1/reconciliation-report", operatorHeaders);
152
- assert.strictEqual(reconciliationReport.status, 200, "reconciliation report route failed");
153
-
154
- operatorChecks.payment_ledger_count = Array.isArray(paymentLedger.json.entries)
155
- ? paymentLedger.json.entries.length
156
- : Array.isArray(paymentLedger.json.payments)
157
- ? paymentLedger.json.payments.length
158
- : null;
159
- operatorChecks.activity_ledger_count = Array.isArray(activityLedger.json.entries)
160
- ? activityLedger.json.entries.length
161
- : Array.isArray(activityLedger.json.activities)
162
- ? activityLedger.json.activities.length
163
- : null;
164
- operatorChecks.account_id = operatorAccountId;
165
- operatorChecks.reconciliation_category = reconciliationReport.json.category || null;
166
- }
167
-
168
- const output = {
169
- ok: true,
170
- product: "xytara",
171
- category: "xytara-final-activation-verification",
172
- base_url: baseUrl,
173
- expected_bsv_runtime_mode: expectedBsvRuntimeMode,
174
- live_claimable_rails: treasurySummary.json.public_claim_boundary.live_claimable_rails,
175
- readiness_only_rails: treasurySummary.json.public_claim_boundary.readiness_only_rails,
176
- public_claimable_profile_count: treasurySummary.json.public_claimable_profile_count,
177
- public_live_landing_rail_count: paymentRailTruthSummary.json.public_live_landing_rail_count,
178
- autonomous_entry_live_landing_rail_count: autonomousEntrySummary.json.public_live_landing_rail_count,
179
- bsv_ready: bsvReadiness.json.ready,
180
- bsv_runtime_mode: bsvReadiness.json.runtime_mode,
181
- operator_checks: operatorChecks,
182
- boundary: "launch_activation_truth_must_match_live_treasury_payment_autonomous_entry_and_bsv_readiness_surfaces"
183
- };
184
-
185
- process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
186
- }
187
-
188
- main().catch((error) => {
189
- process.stderr.write(`${error.stack || error.message}\n`);
190
- process.exit(1);
191
- });
1
+ "use strict";
2
+
3
+ const assert = require("assert");
4
+
5
+ function parseCsvEnv(value) {
6
+ if (!value) {
7
+ return [];
8
+ }
9
+ return value
10
+ .split(",")
11
+ .map((entry) => entry.trim())
12
+ .filter(Boolean);
13
+ }
14
+
15
+ async function getJson(baseUrl, path, headers) {
16
+ const response = await fetch(`${baseUrl}${path}`, {
17
+ headers: headers || {}
18
+ });
19
+ const json = await response.json();
20
+ return {
21
+ status: response.status,
22
+ json
23
+ };
24
+ }
25
+
26
+ function assertContainsAll(actual, expected, label) {
27
+ for (const entry of expected) {
28
+ assert.strictEqual(
29
+ actual.includes(entry),
30
+ true,
31
+ `${label} missing expected entry: ${entry}`
32
+ );
33
+ }
34
+ }
35
+
36
+ async function main() {
37
+ const baseUrl = process.env.XYTARA_VERIFY_BASE_URL || "https://xytara.onrender.com";
38
+ const expectedLiveRails = parseCsvEnv(process.env.XYTARA_EXPECTED_LIVE_RAILS);
39
+ const expectedReadinessOnlyRails = parseCsvEnv(process.env.XYTARA_EXPECTED_READINESS_ONLY_RAILS);
40
+ const expectedBsvRuntimeMode = process.env.XYTARA_EXPECTED_BSV_RUNTIME_MODE || "arc";
41
+ const operatorAccountId = process.env.XYTARA_VERIFY_ACCOUNT_ID || process.env.XYTARA_TREASURY_ACCOUNT_ID || "";
42
+ const operatorBearerToken = process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN || "";
43
+ const operatorHeaders = operatorBearerToken
44
+ ? { authorization: `Bearer ${operatorBearerToken}` }
45
+ : null;
46
+
47
+ const treasurySummary = await getJson(baseUrl, "/v1/treasury-destinations/summary");
48
+ assert.strictEqual(treasurySummary.status, 200, "treasury destinations summary route failed");
49
+ assert.strictEqual(
50
+ treasurySummary.json.category,
51
+ "machine-commerce-treasury-destinations-pack-summary",
52
+ "treasury destinations summary category mismatch"
53
+ );
54
+ assert.strictEqual(
55
+ treasurySummary.json.public_claimable_profile_count > 0,
56
+ true,
57
+ "public claimable treasury profile count must be positive"
58
+ );
59
+ assert.strictEqual(
60
+ Array.isArray(treasurySummary.json.public_claim_boundary.live_claimable_rails),
61
+ true,
62
+ "treasury summary live claimable rails missing"
63
+ );
64
+ assert.strictEqual(
65
+ Array.isArray(treasurySummary.json.public_claim_boundary.readiness_only_rails),
66
+ true,
67
+ "treasury summary readiness-only rails missing"
68
+ );
69
+
70
+ const paymentRailTruthSummary = await getJson(baseUrl, "/v1/payment-rail-truth/summary");
71
+ assert.strictEqual(paymentRailTruthSummary.status, 200, "payment rail truth summary route failed");
72
+ assert.strictEqual(
73
+ paymentRailTruthSummary.json.category,
74
+ "machine-commerce-payment-rail-truth-model",
75
+ "payment rail truth summary category mismatch"
76
+ );
77
+ assert.strictEqual(
78
+ paymentRailTruthSummary.json.public_live_landing_rail_count > 0,
79
+ true,
80
+ "public live landing rail count must be positive"
81
+ );
82
+
83
+ const autonomousEntrySummary = await getJson(baseUrl, "/v1/autonomous-entry/summary");
84
+ assert.strictEqual(autonomousEntrySummary.status, 200, "autonomous entry summary route failed");
85
+ assert.strictEqual(
86
+ autonomousEntrySummary.json.category,
87
+ "machine-commerce-autonomous-entry-pack-summary",
88
+ "autonomous entry summary category mismatch"
89
+ );
90
+ assert.strictEqual(
91
+ autonomousEntrySummary.json.public_live_landing_rail_count > 0,
92
+ true,
93
+ "autonomous entry live landing rail count must be positive"
94
+ );
95
+
96
+ const bsvReadiness = await getJson(baseUrl, "/v1/settlement/bsv-teranode/readiness");
97
+ assert.strictEqual(bsvReadiness.status, 200, "BSV readiness route failed");
98
+ assert.strictEqual(bsvReadiness.json.rail, "bsv_teranode", "BSV readiness rail mismatch");
99
+ assert.strictEqual(bsvReadiness.json.ready, true, "BSV readiness must be true");
100
+ assert.strictEqual(
101
+ bsvReadiness.json.runtime_mode,
102
+ expectedBsvRuntimeMode,
103
+ `BSV readiness runtime mode must be ${expectedBsvRuntimeMode}`
104
+ );
105
+
106
+ if (expectedLiveRails.length > 0) {
107
+ assertContainsAll(
108
+ treasurySummary.json.public_claim_boundary.live_claimable_rails,
109
+ expectedLiveRails,
110
+ "live claimable rails"
111
+ );
112
+ }
113
+
114
+ if (expectedReadinessOnlyRails.length > 0) {
115
+ assertContainsAll(
116
+ treasurySummary.json.public_claim_boundary.readiness_only_rails,
117
+ expectedReadinessOnlyRails,
118
+ "readiness-only rails"
119
+ );
120
+ }
121
+
122
+ let operatorChecks = {
123
+ attempted: false
124
+ };
125
+
126
+ if (operatorHeaders && operatorAccountId) {
127
+ operatorChecks = {
128
+ attempted: true
129
+ };
130
+
131
+ const paymentLedger = await getJson(baseUrl, "/v1/payment-ledger", operatorHeaders);
132
+ assert.strictEqual(paymentLedger.status, 200, "payment ledger route failed");
133
+
134
+ const activityLedger = await getJson(baseUrl, "/v1/activity-ledger", operatorHeaders);
135
+ assert.strictEqual(activityLedger.status, 200, "activity ledger route failed");
136
+
137
+ const treasurySummaryRoute = await getJson(
138
+ baseUrl,
139
+ `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/treasury-summary`,
140
+ operatorHeaders
141
+ );
142
+ assert.strictEqual(treasurySummaryRoute.status, 200, "account treasury summary route failed");
143
+
144
+ const railSummaryRoute = await getJson(
145
+ baseUrl,
146
+ `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/rail-summary`,
147
+ operatorHeaders
148
+ );
149
+ assert.strictEqual(railSummaryRoute.status, 200, "account rail summary route failed");
150
+
151
+ const reconciliationReport = await getJson(baseUrl, "/v1/reconciliation-report", operatorHeaders);
152
+ assert.strictEqual(reconciliationReport.status, 200, "reconciliation report route failed");
153
+
154
+ operatorChecks.payment_ledger_count = Array.isArray(paymentLedger.json.entries)
155
+ ? paymentLedger.json.entries.length
156
+ : Array.isArray(paymentLedger.json.payments)
157
+ ? paymentLedger.json.payments.length
158
+ : null;
159
+ operatorChecks.activity_ledger_count = Array.isArray(activityLedger.json.entries)
160
+ ? activityLedger.json.entries.length
161
+ : Array.isArray(activityLedger.json.activities)
162
+ ? activityLedger.json.activities.length
163
+ : null;
164
+ operatorChecks.account_id = operatorAccountId;
165
+ operatorChecks.reconciliation_category = reconciliationReport.json.category || null;
166
+ }
167
+
168
+ const output = {
169
+ ok: true,
170
+ product: "xytara",
171
+ category: "xytara-final-activation-verification",
172
+ base_url: baseUrl,
173
+ expected_bsv_runtime_mode: expectedBsvRuntimeMode,
174
+ live_claimable_rails: treasurySummary.json.public_claim_boundary.live_claimable_rails,
175
+ readiness_only_rails: treasurySummary.json.public_claim_boundary.readiness_only_rails,
176
+ public_claimable_profile_count: treasurySummary.json.public_claimable_profile_count,
177
+ public_live_landing_rail_count: paymentRailTruthSummary.json.public_live_landing_rail_count,
178
+ autonomous_entry_live_landing_rail_count: autonomousEntrySummary.json.public_live_landing_rail_count,
179
+ bsv_ready: bsvReadiness.json.ready,
180
+ bsv_runtime_mode: bsvReadiness.json.runtime_mode,
181
+ operator_checks: operatorChecks,
182
+ boundary: "launch_activation_truth_must_match_live_treasury_payment_autonomous_entry_and_bsv_readiness_surfaces"
183
+ };
184
+
185
+ process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
186
+ }
187
+
188
+ main().catch((error) => {
189
+ process.stderr.write(`${error.stack || error.message}\n`);
190
+ process.exit(1);
191
+ });
@@ -1,86 +1,86 @@
1
- "use strict";
2
-
3
- // Verifies the L402 Lightning adapter (lib/l402_adapter.js). Offline: no node,
4
- // no network. Exercises config gating, macaroon issue/verify, REAL preimage
5
- // verification (sha256(preimage) === payment_hash), header parsing, and the
6
- // full verifyL402Authorization round-trip.
7
-
8
- const assert = require("assert");
9
- const crypto = require("crypto");
10
- const m = require("../lib/l402_adapter");
11
-
12
- function setEnv(env) {
13
- const saved = {};
14
- for (const k in env) {
15
- saved[k] = process.env[k];
16
- if (env[k] === undefined) delete process.env[k];
17
- else process.env[k] = env[k];
18
- }
19
- return () => {
20
- for (const k in saved) {
21
- if (saved[k] === undefined) delete process.env[k];
22
- else process.env[k] = saved[k];
23
- }
24
- };
25
- }
26
-
27
- async function main() {
28
- // 1. Not configured.
29
- let restore = setEnv({ XYTARA_L402_PROVIDER: undefined });
30
- let cfg = m.loadL402Config();
31
- assert.strictEqual(cfg.provider, null);
32
- assert.strictEqual(m.isConfigured(cfg), false);
33
- assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 10 })).reason, "l402_provider_not_configured");
34
- assert.strictEqual(m.verifyL402Authorization(cfg, "L402 x:ab").reason, "l402_provider_not_configured");
35
- restore();
36
-
37
- // 2. Configured (lnbits) — crypto paths (no network).
38
- restore = setEnv({ XYTARA_L402_PROVIDER: "lnbits", XYTARA_L402_ROOT_KEY: "root_test_key", XYTARA_L402_PRICE_SATS: "21" });
39
- cfg = m.loadL402Config();
40
- assert.strictEqual(cfg.provider, "lnbits");
41
- assert.strictEqual(m.isConfigured(cfg), true);
42
-
43
- // Real Lightning preimage/payment_hash relationship.
44
- const preimage = crypto.randomBytes(32).toString("hex");
45
- const paymentHash = crypto.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
46
- assert.strictEqual(m.verifyPreimage(preimage, paymentHash), true, "correct preimage must verify");
47
- assert.strictEqual(m.verifyPreimage(crypto.randomBytes(32).toString("hex"), paymentHash), false, "wrong preimage must fail");
48
-
49
- // Macaroon issue + verify round-trip.
50
- const macaroon = m.issueL402Macaroon(cfg, { payment_hash: paymentHash, amountSats: 21 });
51
- assert.ok(macaroon && macaroon.includes("."), "macaroon issued");
52
- const mac = m.verifyL402Macaroon(cfg, macaroon);
53
- assert.strictEqual(mac.ok, true);
54
- assert.strictEqual(mac.payment_hash, paymentHash);
55
-
56
- // Tampered macaroon -> invalid signature.
57
- const tampered = macaroon.slice(0, -2) + (macaroon.slice(-2) === "00" ? "11" : "00");
58
- assert.strictEqual(m.verifyL402Macaroon(cfg, tampered).ok, false);
59
-
60
- // Header parsing.
61
- assert.deepStrictEqual(m.parseL402Header(`L402 ${macaroon}:${preimage}`), { macaroon, preimage });
62
- assert.strictEqual(m.parseL402Header("Bearer abc"), null);
63
-
64
- // Full authorization verify: correct preimage -> ok.
65
- const okAuth = m.verifyL402Authorization(cfg, `L402 ${macaroon}:${preimage}`);
66
- assert.strictEqual(okAuth.ok, true);
67
- assert.strictEqual(okAuth.payment_hash, paymentHash);
68
-
69
- // Full authorization verify: wrong preimage -> preimage mismatch.
70
- const wrongPreimage = crypto.randomBytes(32).toString("hex");
71
- assert.strictEqual(m.verifyL402Authorization(cfg, `L402 ${macaroon}:${wrongPreimage}`).reason, "l402_preimage_mismatch");
72
-
73
- // Invoice creation without lnbits url/key -> explicit reason (no network attempt).
74
- assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 21 })).reason, "lnbits_not_configured");
75
-
76
- // WWW-Authenticate format.
77
- assert.ok(m.buildWwwAuthenticate(macaroon, "lnbc10n1...").startsWith("L402 macaroon="));
78
- restore();
79
-
80
- console.log("verify_l402_adapter: all L402 Lightning adapter checks passed");
81
- }
82
-
83
- main().catch((error) => {
84
- console.error("verify_l402_adapter failed:", error && error.message ? error.message : error);
85
- process.exitCode = 1;
86
- });
1
+ "use strict";
2
+
3
+ // Verifies the L402 Lightning adapter (lib/l402_adapter.js). Offline: no node,
4
+ // no network. Exercises config gating, macaroon issue/verify, REAL preimage
5
+ // verification (sha256(preimage) === payment_hash), header parsing, and the
6
+ // full verifyL402Authorization round-trip.
7
+
8
+ const assert = require("assert");
9
+ const crypto = require("crypto");
10
+ const m = require("../lib/l402_adapter");
11
+
12
+ function setEnv(env) {
13
+ const saved = {};
14
+ for (const k in env) {
15
+ saved[k] = process.env[k];
16
+ if (env[k] === undefined) delete process.env[k];
17
+ else process.env[k] = env[k];
18
+ }
19
+ return () => {
20
+ for (const k in saved) {
21
+ if (saved[k] === undefined) delete process.env[k];
22
+ else process.env[k] = saved[k];
23
+ }
24
+ };
25
+ }
26
+
27
+ async function main() {
28
+ // 1. Not configured.
29
+ let restore = setEnv({ XYTARA_L402_PROVIDER: undefined });
30
+ let cfg = m.loadL402Config();
31
+ assert.strictEqual(cfg.provider, null);
32
+ assert.strictEqual(m.isConfigured(cfg), false);
33
+ assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 10 })).reason, "l402_provider_not_configured");
34
+ assert.strictEqual(m.verifyL402Authorization(cfg, "L402 x:ab").reason, "l402_provider_not_configured");
35
+ restore();
36
+
37
+ // 2. Configured (lnbits) — crypto paths (no network).
38
+ restore = setEnv({ XYTARA_L402_PROVIDER: "lnbits", XYTARA_L402_ROOT_KEY: "root_test_key", XYTARA_L402_PRICE_SATS: "21" });
39
+ cfg = m.loadL402Config();
40
+ assert.strictEqual(cfg.provider, "lnbits");
41
+ assert.strictEqual(m.isConfigured(cfg), true);
42
+
43
+ // Real Lightning preimage/payment_hash relationship.
44
+ const preimage = crypto.randomBytes(32).toString("hex");
45
+ const paymentHash = crypto.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
46
+ assert.strictEqual(m.verifyPreimage(preimage, paymentHash), true, "correct preimage must verify");
47
+ assert.strictEqual(m.verifyPreimage(crypto.randomBytes(32).toString("hex"), paymentHash), false, "wrong preimage must fail");
48
+
49
+ // Macaroon issue + verify round-trip.
50
+ const macaroon = m.issueL402Macaroon(cfg, { payment_hash: paymentHash, amountSats: 21 });
51
+ assert.ok(macaroon && macaroon.includes("."), "macaroon issued");
52
+ const mac = m.verifyL402Macaroon(cfg, macaroon);
53
+ assert.strictEqual(mac.ok, true);
54
+ assert.strictEqual(mac.payment_hash, paymentHash);
55
+
56
+ // Tampered macaroon -> invalid signature.
57
+ const tampered = macaroon.slice(0, -2) + (macaroon.slice(-2) === "00" ? "11" : "00");
58
+ assert.strictEqual(m.verifyL402Macaroon(cfg, tampered).ok, false);
59
+
60
+ // Header parsing.
61
+ assert.deepStrictEqual(m.parseL402Header(`L402 ${macaroon}:${preimage}`), { macaroon, preimage });
62
+ assert.strictEqual(m.parseL402Header("Bearer abc"), null);
63
+
64
+ // Full authorization verify: correct preimage -> ok.
65
+ const okAuth = m.verifyL402Authorization(cfg, `L402 ${macaroon}:${preimage}`);
66
+ assert.strictEqual(okAuth.ok, true);
67
+ assert.strictEqual(okAuth.payment_hash, paymentHash);
68
+
69
+ // Full authorization verify: wrong preimage -> preimage mismatch.
70
+ const wrongPreimage = crypto.randomBytes(32).toString("hex");
71
+ assert.strictEqual(m.verifyL402Authorization(cfg, `L402 ${macaroon}:${wrongPreimage}`).reason, "l402_preimage_mismatch");
72
+
73
+ // Invoice creation without lnbits url/key -> explicit reason (no network attempt).
74
+ assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 21 })).reason, "lnbits_not_configured");
75
+
76
+ // WWW-Authenticate format.
77
+ assert.ok(m.buildWwwAuthenticate(macaroon, "lnbc10n1...").startsWith("L402 macaroon="));
78
+ restore();
79
+
80
+ console.log("verify_l402_adapter: all L402 Lightning adapter checks passed");
81
+ }
82
+
83
+ main().catch((error) => {
84
+ console.error("verify_l402_adapter failed:", error && error.message ? error.message : error);
85
+ process.exitCode = 1;
86
+ });