xytara 3.1.13 → 3.1.15

package/scripts/verify_checkout_processor.js

@@ -1,109 +1,109 @@
-"use strict";
-
-// Verifies the provider-agnostic hosted-checkout processor adapter
-// (lib/checkout_processor_adapter.js). Offline: no network, no real Stripe
-// calls. Exercises config gating, webhook signature verify (round-trip),
-// event->grant mapping, and the not-configured safety behavior.
-
-const assert = require("assert");
-
-function withEnv(env, fn) {
-  const saved = {};
-  for (const k in env) {
-    saved[k] = process.env[k];
-    if (env[k] === undefined) delete process.env[k];
-    else process.env[k] = env[k];
-  }
-  // Re-require fresh so env is read on load.
-  delete require.cache[require.resolve("../lib/checkout_processor_adapter")];
-  const mod = require("../lib/checkout_processor_adapter");
-  try {
-    return fn(mod);
-  } finally {
-    for (const k in saved) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    delete require.cache[require.resolve("../lib/checkout_processor_adapter")];
-  }
-}
-
-async function main() {
-  // 1. Not configured => provider null, everything degrades safely.
-  await withEnv({ XYTARA_CHECKOUT_PROCESSOR: undefined }, async (m) => {
-    const cfg = m.loadCheckoutProcessorConfig();
-    assert.strictEqual(cfg.provider, null);
-    assert.strictEqual(m.isConfigured(cfg), false);
-    const s = await m.createProcessorCheckoutSession(cfg, { amountMinor: 100 });
-    assert.strictEqual(s.ok, false);
-    assert.strictEqual(s.reason, "processor_not_configured");
-    assert.strictEqual(m.verifyProcessorWebhook(cfg, {}, "{}").ok, false);
-    assert.strictEqual(m.mapProcessorEventToGrant(cfg, { type: "checkout.session.completed" }), null);
-  });
-
-  // 2. Stripe configured => webhook verify round-trip + event mapping.
-  await withEnv(
-    { XYTARA_CHECKOUT_PROCESSOR: "stripe", STRIPE_SECRET_KEY: "sk_test_x", STRIPE_WEBHOOK_SECRET: "whsec_test" },
-    async (m) => {
-      const cfg = m.loadCheckoutProcessorConfig();
-      assert.strictEqual(cfg.provider, "stripe");
-      assert.strictEqual(m.isConfigured(cfg), true);
-
-      const event = {
-        id: "evt_1",
-        type: "checkout.session.completed",
-        data: {
-          object: {
-            id: "cs_1",
-            payment_status: "paid",
-            payment_intent: "pi_1",
-            amount_total: 500,
-            currency: "usd",
-            metadata: { account_id: "acct_x", credits_units: "1000", purchase_intent_id: "pi_intent_1" }
-          }
-        }
-      };
-      const raw = JSON.stringify(event);
-      const sig = m.buildStripeSignatureHeader(cfg.webhookSecret, raw);
-
-      // Valid signature -> ok + parsed event.
-      const okRes = m.verifyProcessorWebhook(cfg, { "Stripe-Signature": sig }, raw);
-      assert.strictEqual(okRes.ok, true);
-      assert.strictEqual(okRes.event.id, "evt_1");
-
-      // Tampered body -> invalid.
-      assert.strictEqual(m.verifyProcessorWebhook(cfg, { "Stripe-Signature": sig }, raw + " ").ok, false);
-      // Missing signature header -> malformed.
-      assert.strictEqual(m.verifyProcessorWebhook(cfg, {}, raw).reason, "stripe_signature_malformed");
-      // Stale timestamp -> out of tolerance.
-      const oldSig = m.buildStripeSignatureHeader(cfg.webhookSecret, raw, Math.floor(Date.now() / 1000) - 99999);
-      assert.strictEqual(m.verifyProcessorWebhook(cfg, { "Stripe-Signature": oldSig }, raw).reason, "stripe_timestamp_out_of_tolerance");
-
-      // Event -> grant mapping.
-      const grant = m.mapProcessorEventToGrant(cfg, event);
-      assert.strictEqual(grant.account_id, "acct_x");
-      assert.strictEqual(grant.units, 1000);
-      assert.strictEqual(grant.source, "stripe");
-      assert.strictEqual(grant.provider_reference, "pi_1");
-      assert.strictEqual(grant.idempotency_key, "stripe:evt_1");
-      assert.strictEqual(grant.purchase_intent_id, "pi_intent_1");
-
-      // Non-paid / wrong-type events -> null.
-      assert.strictEqual(m.mapProcessorEventToGrant(cfg, { type: "checkout.session.completed", data: { object: { payment_status: "unpaid" } } }), null);
-      assert.strictEqual(m.mapProcessorEventToGrant(cfg, { type: "payment_intent.created", data: { object: {} } }), null);
-
-      // Session creation missing secret key -> explicit reason (no network).
-      const noKeyCfg = Object.assign({}, cfg, { secretKey: "" });
-      const s = await m.createProcessorCheckoutSession(noKeyCfg, { amountMinor: 500, currency: "usd", successUrl: "https://x", cancelUrl: "https://y" });
-      assert.strictEqual(s.ok, false);
-      assert.strictEqual(s.reason, "stripe_secret_key_missing");
-    }
-  );
-
-  console.log("verify_checkout_processor: all hosted-checkout processor adapter checks passed");
-}
-
-main().catch((error) => {
-  console.error("verify_checkout_processor failed:", error && error.message ? error.message : error);
-  process.exitCode = 1;
-});
+"use strict";
+
+// Verifies the provider-agnostic hosted-checkout processor adapter
+// (lib/checkout_processor_adapter.js). Offline: no network, no real Stripe
+// calls. Exercises config gating, webhook signature verify (round-trip),
+// event->grant mapping, and the not-configured safety behavior.
+
+const assert = require("assert");
+
+function withEnv(env, fn) {
+  const saved = {};
+  for (const k in env) {
+    saved[k] = process.env[k];
+    if (env[k] === undefined) delete process.env[k];
+    else process.env[k] = env[k];
+  }
+  // Re-require fresh so env is read on load.
+  delete require.cache[require.resolve("../lib/checkout_processor_adapter")];
+  const mod = require("../lib/checkout_processor_adapter");
+  try {
+    return fn(mod);
+  } finally {
+    for (const k in saved) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    delete require.cache[require.resolve("../lib/checkout_processor_adapter")];
+  }
+}
+
+async function main() {
+  // 1. Not configured => provider null, everything degrades safely.
+  await withEnv({ XYTARA_CHECKOUT_PROCESSOR: undefined }, async (m) => {
+    const cfg = m.loadCheckoutProcessorConfig();
+    assert.strictEqual(cfg.provider, null);
+    assert.strictEqual(m.isConfigured(cfg), false);
+    const s = await m.createProcessorCheckoutSession(cfg, { amountMinor: 100 });
+    assert.strictEqual(s.ok, false);
+    assert.strictEqual(s.reason, "processor_not_configured");
+    assert.strictEqual(m.verifyProcessorWebhook(cfg, {}, "{}").ok, false);
+    assert.strictEqual(m.mapProcessorEventToGrant(cfg, { type: "checkout.session.completed" }), null);
+  });
+
+  // 2. Stripe configured => webhook verify round-trip + event mapping.
+  await withEnv(
+    { XYTARA_CHECKOUT_PROCESSOR: "stripe", STRIPE_SECRET_KEY: "sk_test_x", STRIPE_WEBHOOK_SECRET: "whsec_test" },
+    async (m) => {
+      const cfg = m.loadCheckoutProcessorConfig();
+      assert.strictEqual(cfg.provider, "stripe");
+      assert.strictEqual(m.isConfigured(cfg), true);
+
+      const event = {
+        id: "evt_1",
+        type: "checkout.session.completed",
+        data: {
+          object: {
+            id: "cs_1",
+            payment_status: "paid",
+            payment_intent: "pi_1",
+            amount_total: 500,
+            currency: "usd",
+            metadata: { account_id: "acct_x", credits_units: "1000", purchase_intent_id: "pi_intent_1" }
+          }
+        }
+      };
+      const raw = JSON.stringify(event);
+      const sig = m.buildStripeSignatureHeader(cfg.webhookSecret, raw);
+
+      // Valid signature -> ok + parsed event.
+      const okRes = m.verifyProcessorWebhook(cfg, { "Stripe-Signature": sig }, raw);
+      assert.strictEqual(okRes.ok, true);
+      assert.strictEqual(okRes.event.id, "evt_1");
+
+      // Tampered body -> invalid.
+      assert.strictEqual(m.verifyProcessorWebhook(cfg, { "Stripe-Signature": sig }, raw + " ").ok, false);
+      // Missing signature header -> malformed.
+      assert.strictEqual(m.verifyProcessorWebhook(cfg, {}, raw).reason, "stripe_signature_malformed");
+      // Stale timestamp -> out of tolerance.
+      const oldSig = m.buildStripeSignatureHeader(cfg.webhookSecret, raw, Math.floor(Date.now() / 1000) - 99999);
+      assert.strictEqual(m.verifyProcessorWebhook(cfg, { "Stripe-Signature": oldSig }, raw).reason, "stripe_timestamp_out_of_tolerance");
+
+      // Event -> grant mapping.
+      const grant = m.mapProcessorEventToGrant(cfg, event);
+      assert.strictEqual(grant.account_id, "acct_x");
+      assert.strictEqual(grant.units, 1000);
+      assert.strictEqual(grant.source, "stripe");
+      assert.strictEqual(grant.provider_reference, "pi_1");
+      assert.strictEqual(grant.idempotency_key, "stripe:evt_1");
+      assert.strictEqual(grant.purchase_intent_id, "pi_intent_1");
+
+      // Non-paid / wrong-type events -> null.
+      assert.strictEqual(m.mapProcessorEventToGrant(cfg, { type: "checkout.session.completed", data: { object: { payment_status: "unpaid" } } }), null);
+      assert.strictEqual(m.mapProcessorEventToGrant(cfg, { type: "payment_intent.created", data: { object: {} } }), null);
+
+      // Session creation missing secret key -> explicit reason (no network).
+      const noKeyCfg = Object.assign({}, cfg, { secretKey: "" });
+      const s = await m.createProcessorCheckoutSession(noKeyCfg, { amountMinor: 500, currency: "usd", successUrl: "https://x", cancelUrl: "https://y" });
+      assert.strictEqual(s.ok, false);
+      assert.strictEqual(s.reason, "stripe_secret_key_missing");
+    }
+  );
+
+  console.log("verify_checkout_processor: all hosted-checkout processor adapter checks passed");
+}
+
+main().catch((error) => {
+  console.error("verify_checkout_processor failed:", error && error.message ? error.message : error);
+  process.exitCode = 1;
+});

package/scripts/verify_commerce_bridge.js

@@ -1,177 +1,177 @@
-"use strict";
-
-// Verifies the generic external-commerce bridge (/v1/commerce/*): an upstream fiat front
-// mints internal units for a confirmed purchase, then prepares a delegated-spend
-// credential for the paying customer's agent. Covers: bearer fail-closed/forbidden,
-// grants mint the mapped units + are idempotent per event (no double-mint on retry),
-// unknown package -> 422, prepare-execution authorizes + issues a credential when funded
-// and refuses when under-funded, and state reports the balance.
-
-const assert = require("assert");
-const http = require("http");
-
-async function req(baseUrl, method, path, body, headers = {}) {
-  const res = await fetch(`${baseUrl}${path}`, {
-    method,
-    headers: { "content-type": "application/json", ...headers },
-    ...(body !== undefined ? { body: JSON.stringify(body) } : {})
-  });
-  let json = null;
-  try { json = await res.json(); } catch (_) { json = null; }
-  return { status: res.status, json };
-}
-
-async function main() {
-  const prev = {
-    token: process.env.XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN,
-    packMap: process.env.XYTARA_COMMERCE_PACK_MAP_JSON
-  };
-  const TOKEN = "test-commerce-bridge-token";
-  process.env.XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN = TOKEN;
-  process.env.XYTARA_COMMERCE_PACK_MAP_JSON = JSON.stringify({ pkg_starter: 100, pkg_pro: 500 });
-  const auth = { authorization: `Bearer ${TOKEN}` };
-
-  delete require.cache[require.resolve("../server")];
-  const { createServer } = require("../server");
-  const server = createServer();
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-  const baseUrl = `http://127.0.0.1:${server.address().port}`;
-  const ACCOUNT = "acct_commerce_test";
-
-  try {
-    // 1. Auth mandatory: no bearer / wrong bearer -> 403.
-    let r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", eventRef: "evt_1" });
-    assert.strictEqual(r.status, 403, "grants without bearer must 403");
-    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", eventRef: "evt_1" }, { authorization: "Bearer wrong" });
-    assert.strictEqual(r.status, 403, "grants with wrong bearer must 403");
-
-    // 2. Grant mints the mapped units; response carries the upstream-read fields.
-    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", purchaseRef: "ord_1", providerRef: "txn_1", eventRef: "evt_1", orderType: "one_time", metadata: { checkoutSurface: "public_checkout" } }, auth);
-    assert.strictEqual(r.status, 200, "grant must 200");
-    assert.strictEqual(r.json.ok, true, "grant ok");
-    assert.strictEqual(r.json.units, 100, "mapped units minted");
-    assert.ok(typeof r.json.grantId === "string" && r.json.grantId.length > 0, "grantId returned");
-    assert.strictEqual(r.json.hiddenAccountRef, ACCOUNT, "hiddenAccountRef echoed");
-
-    // 3. State reflects the balance.
-    r = await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT}`, undefined, auth);
-    assert.strictEqual(r.status, 200, "state 200");
-    assert.strictEqual(r.json.availableUnits, 100, "balance = 100 after grant");
-
-    // 4. Idempotent per event: a webhook retry (same eventRef) must NOT double-mint.
-    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", purchaseRef: "ord_1", providerRef: "txn_1", eventRef: "evt_1" }, auth);
-    assert.strictEqual(r.status, 200, "replayed grant still 200");
-    const afterReplay = (await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT}`, undefined, auth)).json.availableUnits;
-    assert.strictEqual(afterReplay, 100, "replay must not double-mint (still 100)");
-
-    // 5. Unknown package -> 422.
-    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_does_not_exist", eventRef: "evt_2" }, auth);
-    assert.strictEqual(r.status, 422, "unknown package must 422");
-    assert.strictEqual(r.json.reason, "unknown_package", "422 reason");
-
-    // 6. prepare-execution authorizes + issues a BOUND delegated-spend credential.
-    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 40 }, auth);
-    assert.strictEqual(r.status, 200, "prepare 200");
-    assert.strictEqual(r.json.authorized, true, "authorized when funded");
-    assert.ok(typeof r.json.spendAuthorityRef === "string" && r.json.spendAuthorityRef.length > 0, "spendAuthorityRef (binding) issued");
-    assert.ok(typeof r.json.spendAuthorityToken === "string" && r.json.spendAuthorityToken.length > 0, "agent-presentable token issued");
-    assert.strictEqual(r.json.boundUnits, 40, "credential is BOUND to the quote (not the whole balance)");
-    assert.ok(typeof r.json.validUntil === "string", "validUntil set");
-    assert.ok(Array.isArray(r.json.capabilitySummary) && r.json.capabilitySummary.includes("doc.analyze"), "capability summarized");
-
-    // 6b. A positive quote is required (an unbounded authorization is never issued).
-    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze" }, auth);
-    assert.strictEqual(r.json.authorized, false, "no quote -> not authorized");
-    assert.strictEqual(r.json.authorityDecision, "quoted_units_required", "quote-required decision");
-
-    // 6c. A malformed agent key REFUSES rather than silently downgrading to bearer-only.
-    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 10, delegatedSpend: { agent_public_key: "not-a-real-key" } }, auth);
-    assert.strictEqual(r.json.authorized, false, "invalid agent key -> refuse");
-    assert.strictEqual(r.json.authorityDecision, "invalid_agent_key", "invalid_agent_key decision");
-
-    // 7. prepare-execution refuses when the quote exceeds the balance.
-    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 999999 }, auth);
-    assert.strictEqual(r.status, 200, "under-funded prepare still 200 (soft decision)");
-    assert.strictEqual(r.json.authorized, false, "not authorized when under-funded");
-    assert.strictEqual(r.json.authorityDecision, "insufficient_units", "decision surfaced");
-    assert.strictEqual(r.json.spendAuthorityRef, null, "no credential issued when refused");
-
-    // 8. account_ref required.
-    r = await req(baseUrl, "POST", "/v1/commerce/grants", { packageRef: "pkg_starter", eventRef: "evt_3" }, auth);
-    assert.strictEqual(r.status, 400, "missing accountRef must 400");
-    assert.strictEqual(r.json.reason, "account_ref_required", "400 reason");
-
-    // 8b. A SHARED eventRef across two accounts must NOT collide (each account minted).
-    const ACCOUNT_B = "acct_commerce_test_B";
-    await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_pro", eventRef: "shared_evt" }, auth);
-    await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT_B, packageRef: "pkg_pro", eventRef: "shared_evt" }, auth);
-    const balB = (await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT_B}`, undefined, auth)).json.availableUnits;
-    assert.strictEqual(balB, 500, "account B minted its own units despite sharing eventRef with A (no grant_id collision)");
-
-    // 9. ENFORCEMENT: a credential bounded to a quote must actually be bounded at SPEND
-    //    time on the consume route, and cannot target another account.
-    const prep = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 40 }, auth);
-    const spendToken = prep.json.spendAuthorityToken;
-    assert.ok(spendToken && spendToken.startsWith("xytara_spend_"), "prepare issued a delegated spend token");
-    const spendAuth = { authorization: `Bearer ${spendToken}` };
-
-    // 9a. Over-quota spend is REJECTED (the quote is enforced, not just echoed).
-    let sp = await req(baseUrl, "POST", "/v1/economics/rails/credits/consume", { account_id: ACCOUNT, units: 50, task_ref: "doc.analyze" }, spendAuth);
-    assert.strictEqual(sp.status, 403, "consuming > quoted units must be rejected (bound enforced on consume)");
-    assert.strictEqual(sp.json.reason, "authority_consequence_bound_exceeded", "bound-exceeded reason");
-
-    // 9b. Targeting ANOTHER account with this credential is REJECTED (account pinned).
-    sp = await req(baseUrl, "POST", "/v1/economics/rails/credits/consume", { account_id: ACCOUNT_B, units: 10, task_ref: "doc.analyze" }, spendAuth);
-    assert.strictEqual(sp.status, 403, "a credential for account A cannot spend account B");
-    assert.strictEqual(sp.json.reason, "delegated_account_mismatch", "account-mismatch reason");
-
-    // 9c. A within-quote spend on the OWN account SUCCEEDS.
-    sp = await req(baseUrl, "POST", "/v1/economics/rails/credits/consume", { account_id: ACCOUNT, units: 30, task_ref: "doc.analyze" }, spendAuth);
-    assert.strictEqual(sp.status, 200, `within-quote spend must succeed (got ${sp.status}: ${JSON.stringify(sp.json).slice(0,160)})`);
-
-    // 10. SETTLE: trusted server-side consumption via the commerce bearer (the upstream
-    //     seam burns units after executing paid work; no delegated token involved).
-    const ACCOUNT_S = "acct_commerce_settle";
-    await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT_S, packageRef: "pkg_pro", eventRef: "evt_settle" }, auth); // +500
-    // 10a. Settle requires the commerce bearer.
-    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 10 });
-    assert.strictEqual(r.status, 403, "settle without bearer must 403");
-    // 10b. account_ref + a positive unit count are required.
-    r = await req(baseUrl, "POST", "/v1/commerce/settle", { units: 10 }, auth);
-    assert.strictEqual(r.status, 400, "settle without accountRef must 400");
-    assert.strictEqual(r.json.reason, "account_ref_required", "settle 400 reason");
-    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 0 }, auth);
-    assert.strictEqual(r.status, 400, "settle without positive units must 400");
-    assert.strictEqual(r.json.reason, "units_required", "settle units reason");
-    // 10c. Over-balance settle is refused (balance is the hard cap).
-    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 999999, taskRef: "doc.analyze" }, auth);
-    assert.strictEqual(r.status, 409, "over-balance settle must 409");
-    assert.strictEqual(r.json.reason, "insufficient_credits", "settle insufficient reason");
-    // 10d. Within-balance settle burns units and returns the credit_spend/usage_meter shape.
-    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 200, taskRef: "doc.analyze", transactionRef: "txn_settle_1" }, auth);
-    assert.strictEqual(r.status, 200, `within-balance settle must 200 (got ${r.status}: ${JSON.stringify(r.json).slice(0,160)})`);
-    assert.strictEqual(r.json.ok, true, "settle ok");
-    assert.ok(r.json.credit_spend && typeof r.json.credit_spend.credit_spend_id === "string", "settle returns credit_spend");
-    assert.ok(typeof r.json.credit_spend.usage_meter_id === "string", "settle returns usage_meter_id");
-    const afterSettle = (await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT_S}`, undefined, auth)).json.availableUnits;
-    assert.strictEqual(afterSettle, 300, "settle burned 200 of 500 (300 left)");
-
-    // 9. Fail-closed when the bridge token is unset.
-    delete process.env.XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN;
-    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", eventRef: "evt_4" }, auth);
-    assert.strictEqual(r.status, 403, "unset token must fail closed (403)");
-    assert.strictEqual(r.json.reason, "commerce_bridge_auth_not_configured", "fail-closed reason");
-
-    console.log("xytara verify:commerce-bridge passed");
-  } finally {
-    await new Promise((resolve) => server.close(resolve));
-    const restore = (k, v) => { if (v === undefined) delete process.env[k]; else process.env[k] = v; };
-    restore("XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN", prev.token);
-    restore("XYTARA_COMMERCE_PACK_MAP_JSON", prev.packMap);
-  }
-}
-
-main().catch((error) => {
-  console.error(error && error.message ? error.message : error);
-  process.exitCode = 1;
-});
+"use strict";
+
+// Verifies the generic external-commerce bridge (/v1/commerce/*): an upstream fiat front
+// mints internal units for a confirmed purchase, then prepares a delegated-spend
+// credential for the paying customer's agent. Covers: bearer fail-closed/forbidden,
+// grants mint the mapped units + are idempotent per event (no double-mint on retry),
+// unknown package -> 422, prepare-execution authorizes + issues a credential when funded
+// and refuses when under-funded, and state reports the balance.
+
+const assert = require("assert");
+const http = require("http");
+
+async function req(baseUrl, method, path, body, headers = {}) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    method,
+    headers: { "content-type": "application/json", ...headers },
+    ...(body !== undefined ? { body: JSON.stringify(body) } : {})
+  });
+  let json = null;
+  try { json = await res.json(); } catch (_) { json = null; }
+  return { status: res.status, json };
+}
+
+async function main() {
+  const prev = {
+    token: process.env.XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN,
+    packMap: process.env.XYTARA_COMMERCE_PACK_MAP_JSON
+  };
+  const TOKEN = "test-commerce-bridge-token";
+  process.env.XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN = TOKEN;
+  process.env.XYTARA_COMMERCE_PACK_MAP_JSON = JSON.stringify({ pkg_starter: 100, pkg_pro: 500 });
+  const auth = { authorization: `Bearer ${TOKEN}` };
+
+  delete require.cache[require.resolve("../server")];
+  const { createServer } = require("../server");
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+  const ACCOUNT = "acct_commerce_test";
+
+  try {
+    // 1. Auth mandatory: no bearer / wrong bearer -> 403.
+    let r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", eventRef: "evt_1" });
+    assert.strictEqual(r.status, 403, "grants without bearer must 403");
+    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", eventRef: "evt_1" }, { authorization: "Bearer wrong" });
+    assert.strictEqual(r.status, 403, "grants with wrong bearer must 403");
+
+    // 2. Grant mints the mapped units; response carries the upstream-read fields.
+    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", purchaseRef: "ord_1", providerRef: "txn_1", eventRef: "evt_1", orderType: "one_time", metadata: { checkoutSurface: "public_checkout" } }, auth);
+    assert.strictEqual(r.status, 200, "grant must 200");
+    assert.strictEqual(r.json.ok, true, "grant ok");
+    assert.strictEqual(r.json.units, 100, "mapped units minted");
+    assert.ok(typeof r.json.grantId === "string" && r.json.grantId.length > 0, "grantId returned");
+    assert.strictEqual(r.json.hiddenAccountRef, ACCOUNT, "hiddenAccountRef echoed");
+
+    // 3. State reflects the balance.
+    r = await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT}`, undefined, auth);
+    assert.strictEqual(r.status, 200, "state 200");
+    assert.strictEqual(r.json.availableUnits, 100, "balance = 100 after grant");
+
+    // 4. Idempotent per event: a webhook retry (same eventRef) must NOT double-mint.
+    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", purchaseRef: "ord_1", providerRef: "txn_1", eventRef: "evt_1" }, auth);
+    assert.strictEqual(r.status, 200, "replayed grant still 200");
+    const afterReplay = (await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT}`, undefined, auth)).json.availableUnits;
+    assert.strictEqual(afterReplay, 100, "replay must not double-mint (still 100)");
+
+    // 5. Unknown package -> 422.
+    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_does_not_exist", eventRef: "evt_2" }, auth);
+    assert.strictEqual(r.status, 422, "unknown package must 422");
+    assert.strictEqual(r.json.reason, "unknown_package", "422 reason");
+
+    // 6. prepare-execution authorizes + issues a BOUND delegated-spend credential.
+    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 40 }, auth);
+    assert.strictEqual(r.status, 200, "prepare 200");
+    assert.strictEqual(r.json.authorized, true, "authorized when funded");
+    assert.ok(typeof r.json.spendAuthorityRef === "string" && r.json.spendAuthorityRef.length > 0, "spendAuthorityRef (binding) issued");
+    assert.ok(typeof r.json.spendAuthorityToken === "string" && r.json.spendAuthorityToken.length > 0, "agent-presentable token issued");
+    assert.strictEqual(r.json.boundUnits, 40, "credential is BOUND to the quote (not the whole balance)");
+    assert.ok(typeof r.json.validUntil === "string", "validUntil set");
+    assert.ok(Array.isArray(r.json.capabilitySummary) && r.json.capabilitySummary.includes("doc.analyze"), "capability summarized");
+
+    // 6b. A positive quote is required (an unbounded authorization is never issued).
+    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze" }, auth);
+    assert.strictEqual(r.json.authorized, false, "no quote -> not authorized");
+    assert.strictEqual(r.json.authorityDecision, "quoted_units_required", "quote-required decision");
+
+    // 6c. A malformed agent key REFUSES rather than silently downgrading to bearer-only.
+    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 10, delegatedSpend: { agent_public_key: "not-a-real-key" } }, auth);
+    assert.strictEqual(r.json.authorized, false, "invalid agent key -> refuse");
+    assert.strictEqual(r.json.authorityDecision, "invalid_agent_key", "invalid_agent_key decision");
+
+    // 7. prepare-execution refuses when the quote exceeds the balance.
+    r = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 999999 }, auth);
+    assert.strictEqual(r.status, 200, "under-funded prepare still 200 (soft decision)");
+    assert.strictEqual(r.json.authorized, false, "not authorized when under-funded");
+    assert.strictEqual(r.json.authorityDecision, "insufficient_units", "decision surfaced");
+    assert.strictEqual(r.json.spendAuthorityRef, null, "no credential issued when refused");
+
+    // 8. account_ref required.
+    r = await req(baseUrl, "POST", "/v1/commerce/grants", { packageRef: "pkg_starter", eventRef: "evt_3" }, auth);
+    assert.strictEqual(r.status, 400, "missing accountRef must 400");
+    assert.strictEqual(r.json.reason, "account_ref_required", "400 reason");
+
+    // 8b. A SHARED eventRef across two accounts must NOT collide (each account minted).
+    const ACCOUNT_B = "acct_commerce_test_B";
+    await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_pro", eventRef: "shared_evt" }, auth);
+    await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT_B, packageRef: "pkg_pro", eventRef: "shared_evt" }, auth);
+    const balB = (await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT_B}`, undefined, auth)).json.availableUnits;
+    assert.strictEqual(balB, 500, "account B minted its own units despite sharing eventRef with A (no grant_id collision)");
+
+    // 9. ENFORCEMENT: a credential bounded to a quote must actually be bounded at SPEND
+    //    time on the consume route, and cannot target another account.
+    const prep = await req(baseUrl, "POST", "/v1/commerce/prepare-execution", { accountRef: ACCOUNT, featureRef: "doc.analyze", quotedUnits: 40 }, auth);
+    const spendToken = prep.json.spendAuthorityToken;
+    assert.ok(spendToken && spendToken.startsWith("xytara_spend_"), "prepare issued a delegated spend token");
+    const spendAuth = { authorization: `Bearer ${spendToken}` };
+
+    // 9a. Over-quota spend is REJECTED (the quote is enforced, not just echoed).
+    let sp = await req(baseUrl, "POST", "/v1/economics/rails/credits/consume", { account_id: ACCOUNT, units: 50, task_ref: "doc.analyze" }, spendAuth);
+    assert.strictEqual(sp.status, 403, "consuming > quoted units must be rejected (bound enforced on consume)");
+    assert.strictEqual(sp.json.reason, "authority_consequence_bound_exceeded", "bound-exceeded reason");
+
+    // 9b. Targeting ANOTHER account with this credential is REJECTED (account pinned).
+    sp = await req(baseUrl, "POST", "/v1/economics/rails/credits/consume", { account_id: ACCOUNT_B, units: 10, task_ref: "doc.analyze" }, spendAuth);
+    assert.strictEqual(sp.status, 403, "a credential for account A cannot spend account B");
+    assert.strictEqual(sp.json.reason, "delegated_account_mismatch", "account-mismatch reason");
+
+    // 9c. A within-quote spend on the OWN account SUCCEEDS.
+    sp = await req(baseUrl, "POST", "/v1/economics/rails/credits/consume", { account_id: ACCOUNT, units: 30, task_ref: "doc.analyze" }, spendAuth);
+    assert.strictEqual(sp.status, 200, `within-quote spend must succeed (got ${sp.status}: ${JSON.stringify(sp.json).slice(0,160)})`);
+
+    // 10. SETTLE: trusted server-side consumption via the commerce bearer (the upstream
+    //     seam burns units after executing paid work; no delegated token involved).
+    const ACCOUNT_S = "acct_commerce_settle";
+    await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT_S, packageRef: "pkg_pro", eventRef: "evt_settle" }, auth); // +500
+    // 10a. Settle requires the commerce bearer.
+    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 10 });
+    assert.strictEqual(r.status, 403, "settle without bearer must 403");
+    // 10b. account_ref + a positive unit count are required.
+    r = await req(baseUrl, "POST", "/v1/commerce/settle", { units: 10 }, auth);
+    assert.strictEqual(r.status, 400, "settle without accountRef must 400");
+    assert.strictEqual(r.json.reason, "account_ref_required", "settle 400 reason");
+    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 0 }, auth);
+    assert.strictEqual(r.status, 400, "settle without positive units must 400");
+    assert.strictEqual(r.json.reason, "units_required", "settle units reason");
+    // 10c. Over-balance settle is refused (balance is the hard cap).
+    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 999999, taskRef: "doc.analyze" }, auth);
+    assert.strictEqual(r.status, 409, "over-balance settle must 409");
+    assert.strictEqual(r.json.reason, "insufficient_credits", "settle insufficient reason");
+    // 10d. Within-balance settle burns units and returns the credit_spend/usage_meter shape.
+    r = await req(baseUrl, "POST", "/v1/commerce/settle", { accountRef: ACCOUNT_S, units: 200, taskRef: "doc.analyze", transactionRef: "txn_settle_1" }, auth);
+    assert.strictEqual(r.status, 200, `within-balance settle must 200 (got ${r.status}: ${JSON.stringify(r.json).slice(0,160)})`);
+    assert.strictEqual(r.json.ok, true, "settle ok");
+    assert.ok(r.json.credit_spend && typeof r.json.credit_spend.credit_spend_id === "string", "settle returns credit_spend");
+    assert.ok(typeof r.json.credit_spend.usage_meter_id === "string", "settle returns usage_meter_id");
+    const afterSettle = (await req(baseUrl, "GET", `/v1/commerce/state?accountRef=${ACCOUNT_S}`, undefined, auth)).json.availableUnits;
+    assert.strictEqual(afterSettle, 300, "settle burned 200 of 500 (300 left)");
+
+    // 9. Fail-closed when the bridge token is unset.
+    delete process.env.XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN;
+    r = await req(baseUrl, "POST", "/v1/commerce/grants", { accountRef: ACCOUNT, packageRef: "pkg_starter", eventRef: "evt_4" }, auth);
+    assert.strictEqual(r.status, 403, "unset token must fail closed (403)");
+    assert.strictEqual(r.json.reason, "commerce_bridge_auth_not_configured", "fail-closed reason");
+
+    console.log("xytara verify:commerce-bridge passed");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    const restore = (k, v) => { if (v === undefined) delete process.env[k]; else process.env[k] = v; };
+    restore("XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN", prev.token);
+    restore("XYTARA_COMMERCE_PACK_MAP_JSON", prev.packMap);
+  }
+}
+
+main().catch((error) => {
+  console.error(error && error.message ? error.message : error);
+  process.exitCode = 1;
+});