xytara 3.1.13 → 3.1.15

package/scripts/verify_final_activation.js

@@ -1,191 +1,191 @@
-"use strict";
-
-const assert = require("assert");
-
-function parseCsvEnv(value) {
-  if (!value) {
-    return [];
-  }
-  return value
-    .split(",")
-    .map((entry) => entry.trim())
-    .filter(Boolean);
-}
-
-async function getJson(baseUrl, path, headers) {
-  const response = await fetch(`${baseUrl}${path}`, {
-    headers: headers || {}
-  });
-  const json = await response.json();
-  return {
-    status: response.status,
-    json
-  };
-}
-
-function assertContainsAll(actual, expected, label) {
-  for (const entry of expected) {
-    assert.strictEqual(
-      actual.includes(entry),
-      true,
-      `${label} missing expected entry: ${entry}`
-    );
-  }
-}
-
-async function main() {
-  const baseUrl = process.env.XYTARA_VERIFY_BASE_URL || "https://xytara.onrender.com";
-  const expectedLiveRails = parseCsvEnv(process.env.XYTARA_EXPECTED_LIVE_RAILS);
-  const expectedReadinessOnlyRails = parseCsvEnv(process.env.XYTARA_EXPECTED_READINESS_ONLY_RAILS);
-  const expectedBsvRuntimeMode = process.env.XYTARA_EXPECTED_BSV_RUNTIME_MODE || "arc";
-  const operatorAccountId = process.env.XYTARA_VERIFY_ACCOUNT_ID || process.env.XYTARA_TREASURY_ACCOUNT_ID || "";
-  const operatorBearerToken = process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN || "";
-  const operatorHeaders = operatorBearerToken
-    ? { authorization: `Bearer ${operatorBearerToken}` }
-    : null;
-
-  const treasurySummary = await getJson(baseUrl, "/v1/treasury-destinations/summary");
-  assert.strictEqual(treasurySummary.status, 200, "treasury destinations summary route failed");
-  assert.strictEqual(
-    treasurySummary.json.category,
-    "machine-commerce-treasury-destinations-pack-summary",
-    "treasury destinations summary category mismatch"
-  );
-  assert.strictEqual(
-    treasurySummary.json.public_claimable_profile_count > 0,
-    true,
-    "public claimable treasury profile count must be positive"
-  );
-  assert.strictEqual(
-    Array.isArray(treasurySummary.json.public_claim_boundary.live_claimable_rails),
-    true,
-    "treasury summary live claimable rails missing"
-  );
-  assert.strictEqual(
-    Array.isArray(treasurySummary.json.public_claim_boundary.readiness_only_rails),
-    true,
-    "treasury summary readiness-only rails missing"
-  );
-
-  const paymentRailTruthSummary = await getJson(baseUrl, "/v1/payment-rail-truth/summary");
-  assert.strictEqual(paymentRailTruthSummary.status, 200, "payment rail truth summary route failed");
-  assert.strictEqual(
-    paymentRailTruthSummary.json.category,
-    "machine-commerce-payment-rail-truth-model",
-    "payment rail truth summary category mismatch"
-  );
-  assert.strictEqual(
-    paymentRailTruthSummary.json.public_live_landing_rail_count > 0,
-    true,
-    "public live landing rail count must be positive"
-  );
-
-  const autonomousEntrySummary = await getJson(baseUrl, "/v1/autonomous-entry/summary");
-  assert.strictEqual(autonomousEntrySummary.status, 200, "autonomous entry summary route failed");
-  assert.strictEqual(
-    autonomousEntrySummary.json.category,
-    "machine-commerce-autonomous-entry-pack-summary",
-    "autonomous entry summary category mismatch"
-  );
-  assert.strictEqual(
-    autonomousEntrySummary.json.public_live_landing_rail_count > 0,
-    true,
-    "autonomous entry live landing rail count must be positive"
-  );
-
-  const bsvReadiness = await getJson(baseUrl, "/v1/settlement/bsv-teranode/readiness");
-  assert.strictEqual(bsvReadiness.status, 200, "BSV readiness route failed");
-  assert.strictEqual(bsvReadiness.json.rail, "bsv_teranode", "BSV readiness rail mismatch");
-  assert.strictEqual(bsvReadiness.json.ready, true, "BSV readiness must be true");
-  assert.strictEqual(
-    bsvReadiness.json.runtime_mode,
-    expectedBsvRuntimeMode,
-    `BSV readiness runtime mode must be ${expectedBsvRuntimeMode}`
-  );
-
-  if (expectedLiveRails.length > 0) {
-    assertContainsAll(
-      treasurySummary.json.public_claim_boundary.live_claimable_rails,
-      expectedLiveRails,
-      "live claimable rails"
-    );
-  }
-
-  if (expectedReadinessOnlyRails.length > 0) {
-    assertContainsAll(
-      treasurySummary.json.public_claim_boundary.readiness_only_rails,
-      expectedReadinessOnlyRails,
-      "readiness-only rails"
-    );
-  }
-
-  let operatorChecks = {
-    attempted: false
-  };
-
-  if (operatorHeaders && operatorAccountId) {
-    operatorChecks = {
-      attempted: true
-    };
-
-    const paymentLedger = await getJson(baseUrl, "/v1/payment-ledger", operatorHeaders);
-    assert.strictEqual(paymentLedger.status, 200, "payment ledger route failed");
-
-    const activityLedger = await getJson(baseUrl, "/v1/activity-ledger", operatorHeaders);
-    assert.strictEqual(activityLedger.status, 200, "activity ledger route failed");
-
-    const treasurySummaryRoute = await getJson(
-      baseUrl,
-      `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/treasury-summary`,
-      operatorHeaders
-    );
-    assert.strictEqual(treasurySummaryRoute.status, 200, "account treasury summary route failed");
-
-    const railSummaryRoute = await getJson(
-      baseUrl,
-      `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/rail-summary`,
-      operatorHeaders
-    );
-    assert.strictEqual(railSummaryRoute.status, 200, "account rail summary route failed");
-
-    const reconciliationReport = await getJson(baseUrl, "/v1/reconciliation-report", operatorHeaders);
-    assert.strictEqual(reconciliationReport.status, 200, "reconciliation report route failed");
-
-    operatorChecks.payment_ledger_count = Array.isArray(paymentLedger.json.entries)
-      ? paymentLedger.json.entries.length
-      : Array.isArray(paymentLedger.json.payments)
-        ? paymentLedger.json.payments.length
-        : null;
-    operatorChecks.activity_ledger_count = Array.isArray(activityLedger.json.entries)
-      ? activityLedger.json.entries.length
-      : Array.isArray(activityLedger.json.activities)
-        ? activityLedger.json.activities.length
-        : null;
-    operatorChecks.account_id = operatorAccountId;
-    operatorChecks.reconciliation_category = reconciliationReport.json.category || null;
-  }
-
-  const output = {
-    ok: true,
-    product: "xytara",
-    category: "xytara-final-activation-verification",
-    base_url: baseUrl,
-    expected_bsv_runtime_mode: expectedBsvRuntimeMode,
-    live_claimable_rails: treasurySummary.json.public_claim_boundary.live_claimable_rails,
-    readiness_only_rails: treasurySummary.json.public_claim_boundary.readiness_only_rails,
-    public_claimable_profile_count: treasurySummary.json.public_claimable_profile_count,
-    public_live_landing_rail_count: paymentRailTruthSummary.json.public_live_landing_rail_count,
-    autonomous_entry_live_landing_rail_count: autonomousEntrySummary.json.public_live_landing_rail_count,
-    bsv_ready: bsvReadiness.json.ready,
-    bsv_runtime_mode: bsvReadiness.json.runtime_mode,
-    operator_checks: operatorChecks,
-    boundary: "launch_activation_truth_must_match_live_treasury_payment_autonomous_entry_and_bsv_readiness_surfaces"
-  };
-
-  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
-}
-
-main().catch((error) => {
-  process.stderr.write(`${error.stack || error.message}\n`);
-  process.exit(1);
-});
+"use strict";
+
+const assert = require("assert");
+
+function parseCsvEnv(value) {
+  if (!value) {
+    return [];
+  }
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+async function getJson(baseUrl, path, headers) {
+  const response = await fetch(`${baseUrl}${path}`, {
+    headers: headers || {}
+  });
+  const json = await response.json();
+  return {
+    status: response.status,
+    json
+  };
+}
+
+function assertContainsAll(actual, expected, label) {
+  for (const entry of expected) {
+    assert.strictEqual(
+      actual.includes(entry),
+      true,
+      `${label} missing expected entry: ${entry}`
+    );
+  }
+}
+
+async function main() {
+  const baseUrl = process.env.XYTARA_VERIFY_BASE_URL || "https://xytara.onrender.com";
+  const expectedLiveRails = parseCsvEnv(process.env.XYTARA_EXPECTED_LIVE_RAILS);
+  const expectedReadinessOnlyRails = parseCsvEnv(process.env.XYTARA_EXPECTED_READINESS_ONLY_RAILS);
+  const expectedBsvRuntimeMode = process.env.XYTARA_EXPECTED_BSV_RUNTIME_MODE || "arc";
+  const operatorAccountId = process.env.XYTARA_VERIFY_ACCOUNT_ID || process.env.XYTARA_TREASURY_ACCOUNT_ID || "";
+  const operatorBearerToken = process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN || "";
+  const operatorHeaders = operatorBearerToken
+    ? { authorization: `Bearer ${operatorBearerToken}` }
+    : null;
+
+  const treasurySummary = await getJson(baseUrl, "/v1/treasury-destinations/summary");
+  assert.strictEqual(treasurySummary.status, 200, "treasury destinations summary route failed");
+  assert.strictEqual(
+    treasurySummary.json.category,
+    "machine-commerce-treasury-destinations-pack-summary",
+    "treasury destinations summary category mismatch"
+  );
+  assert.strictEqual(
+    treasurySummary.json.public_claimable_profile_count > 0,
+    true,
+    "public claimable treasury profile count must be positive"
+  );
+  assert.strictEqual(
+    Array.isArray(treasurySummary.json.public_claim_boundary.live_claimable_rails),
+    true,
+    "treasury summary live claimable rails missing"
+  );
+  assert.strictEqual(
+    Array.isArray(treasurySummary.json.public_claim_boundary.readiness_only_rails),
+    true,
+    "treasury summary readiness-only rails missing"
+  );
+
+  const paymentRailTruthSummary = await getJson(baseUrl, "/v1/payment-rail-truth/summary");
+  assert.strictEqual(paymentRailTruthSummary.status, 200, "payment rail truth summary route failed");
+  assert.strictEqual(
+    paymentRailTruthSummary.json.category,
+    "machine-commerce-payment-rail-truth-model",
+    "payment rail truth summary category mismatch"
+  );
+  assert.strictEqual(
+    paymentRailTruthSummary.json.public_live_landing_rail_count > 0,
+    true,
+    "public live landing rail count must be positive"
+  );
+
+  const autonomousEntrySummary = await getJson(baseUrl, "/v1/autonomous-entry/summary");
+  assert.strictEqual(autonomousEntrySummary.status, 200, "autonomous entry summary route failed");
+  assert.strictEqual(
+    autonomousEntrySummary.json.category,
+    "machine-commerce-autonomous-entry-pack-summary",
+    "autonomous entry summary category mismatch"
+  );
+  assert.strictEqual(
+    autonomousEntrySummary.json.public_live_landing_rail_count > 0,
+    true,
+    "autonomous entry live landing rail count must be positive"
+  );
+
+  const bsvReadiness = await getJson(baseUrl, "/v1/settlement/bsv-teranode/readiness");
+  assert.strictEqual(bsvReadiness.status, 200, "BSV readiness route failed");
+  assert.strictEqual(bsvReadiness.json.rail, "bsv_teranode", "BSV readiness rail mismatch");
+  assert.strictEqual(bsvReadiness.json.ready, true, "BSV readiness must be true");
+  assert.strictEqual(
+    bsvReadiness.json.runtime_mode,
+    expectedBsvRuntimeMode,
+    `BSV readiness runtime mode must be ${expectedBsvRuntimeMode}`
+  );
+
+  if (expectedLiveRails.length > 0) {
+    assertContainsAll(
+      treasurySummary.json.public_claim_boundary.live_claimable_rails,
+      expectedLiveRails,
+      "live claimable rails"
+    );
+  }
+
+  if (expectedReadinessOnlyRails.length > 0) {
+    assertContainsAll(
+      treasurySummary.json.public_claim_boundary.readiness_only_rails,
+      expectedReadinessOnlyRails,
+      "readiness-only rails"
+    );
+  }
+
+  let operatorChecks = {
+    attempted: false
+  };
+
+  if (operatorHeaders && operatorAccountId) {
+    operatorChecks = {
+      attempted: true
+    };
+
+    const paymentLedger = await getJson(baseUrl, "/v1/payment-ledger", operatorHeaders);
+    assert.strictEqual(paymentLedger.status, 200, "payment ledger route failed");
+
+    const activityLedger = await getJson(baseUrl, "/v1/activity-ledger", operatorHeaders);
+    assert.strictEqual(activityLedger.status, 200, "activity ledger route failed");
+
+    const treasurySummaryRoute = await getJson(
+      baseUrl,
+      `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/treasury-summary`,
+      operatorHeaders
+    );
+    assert.strictEqual(treasurySummaryRoute.status, 200, "account treasury summary route failed");
+
+    const railSummaryRoute = await getJson(
+      baseUrl,
+      `/v1/economics/accounts/${encodeURIComponent(operatorAccountId)}/rail-summary`,
+      operatorHeaders
+    );
+    assert.strictEqual(railSummaryRoute.status, 200, "account rail summary route failed");
+
+    const reconciliationReport = await getJson(baseUrl, "/v1/reconciliation-report", operatorHeaders);
+    assert.strictEqual(reconciliationReport.status, 200, "reconciliation report route failed");
+
+    operatorChecks.payment_ledger_count = Array.isArray(paymentLedger.json.entries)
+      ? paymentLedger.json.entries.length
+      : Array.isArray(paymentLedger.json.payments)
+        ? paymentLedger.json.payments.length
+        : null;
+    operatorChecks.activity_ledger_count = Array.isArray(activityLedger.json.entries)
+      ? activityLedger.json.entries.length
+      : Array.isArray(activityLedger.json.activities)
+        ? activityLedger.json.activities.length
+        : null;
+    operatorChecks.account_id = operatorAccountId;
+    operatorChecks.reconciliation_category = reconciliationReport.json.category || null;
+  }
+
+  const output = {
+    ok: true,
+    product: "xytara",
+    category: "xytara-final-activation-verification",
+    base_url: baseUrl,
+    expected_bsv_runtime_mode: expectedBsvRuntimeMode,
+    live_claimable_rails: treasurySummary.json.public_claim_boundary.live_claimable_rails,
+    readiness_only_rails: treasurySummary.json.public_claim_boundary.readiness_only_rails,
+    public_claimable_profile_count: treasurySummary.json.public_claimable_profile_count,
+    public_live_landing_rail_count: paymentRailTruthSummary.json.public_live_landing_rail_count,
+    autonomous_entry_live_landing_rail_count: autonomousEntrySummary.json.public_live_landing_rail_count,
+    bsv_ready: bsvReadiness.json.ready,
+    bsv_runtime_mode: bsvReadiness.json.runtime_mode,
+    operator_checks: operatorChecks,
+    boundary: "launch_activation_truth_must_match_live_treasury_payment_autonomous_entry_and_bsv_readiness_surfaces"
+  };
+
+  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error.stack || error.message}\n`);
+  process.exit(1);
+});

package/scripts/verify_l402_adapter.js

@@ -1,86 +1,86 @@
-"use strict";
-
-// Verifies the L402 Lightning adapter (lib/l402_adapter.js). Offline: no node,
-// no network. Exercises config gating, macaroon issue/verify, REAL preimage
-// verification (sha256(preimage) === payment_hash), header parsing, and the
-// full verifyL402Authorization round-trip.
-
-const assert = require("assert");
-const crypto = require("crypto");
-const m = require("../lib/l402_adapter");
-
-function setEnv(env) {
-  const saved = {};
-  for (const k in env) {
-    saved[k] = process.env[k];
-    if (env[k] === undefined) delete process.env[k];
-    else process.env[k] = env[k];
-  }
-  return () => {
-    for (const k in saved) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-  };
-}
-
-async function main() {
-  // 1. Not configured.
-  let restore = setEnv({ XYTARA_L402_PROVIDER: undefined });
-  let cfg = m.loadL402Config();
-  assert.strictEqual(cfg.provider, null);
-  assert.strictEqual(m.isConfigured(cfg), false);
-  assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 10 })).reason, "l402_provider_not_configured");
-  assert.strictEqual(m.verifyL402Authorization(cfg, "L402 x:ab").reason, "l402_provider_not_configured");
-  restore();
-
-  // 2. Configured (lnbits) — crypto paths (no network).
-  restore = setEnv({ XYTARA_L402_PROVIDER: "lnbits", XYTARA_L402_ROOT_KEY: "root_test_key", XYTARA_L402_PRICE_SATS: "21" });
-  cfg = m.loadL402Config();
-  assert.strictEqual(cfg.provider, "lnbits");
-  assert.strictEqual(m.isConfigured(cfg), true);
-
-  // Real Lightning preimage/payment_hash relationship.
-  const preimage = crypto.randomBytes(32).toString("hex");
-  const paymentHash = crypto.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
-  assert.strictEqual(m.verifyPreimage(preimage, paymentHash), true, "correct preimage must verify");
-  assert.strictEqual(m.verifyPreimage(crypto.randomBytes(32).toString("hex"), paymentHash), false, "wrong preimage must fail");
-
-  // Macaroon issue + verify round-trip.
-  const macaroon = m.issueL402Macaroon(cfg, { payment_hash: paymentHash, amountSats: 21 });
-  assert.ok(macaroon && macaroon.includes("."), "macaroon issued");
-  const mac = m.verifyL402Macaroon(cfg, macaroon);
-  assert.strictEqual(mac.ok, true);
-  assert.strictEqual(mac.payment_hash, paymentHash);
-
-  // Tampered macaroon -> invalid signature.
-  const tampered = macaroon.slice(0, -2) + (macaroon.slice(-2) === "00" ? "11" : "00");
-  assert.strictEqual(m.verifyL402Macaroon(cfg, tampered).ok, false);
-
-  // Header parsing.
-  assert.deepStrictEqual(m.parseL402Header(`L402 ${macaroon}:${preimage}`), { macaroon, preimage });
-  assert.strictEqual(m.parseL402Header("Bearer abc"), null);
-
-  // Full authorization verify: correct preimage -> ok.
-  const okAuth = m.verifyL402Authorization(cfg, `L402 ${macaroon}:${preimage}`);
-  assert.strictEqual(okAuth.ok, true);
-  assert.strictEqual(okAuth.payment_hash, paymentHash);
-
-  // Full authorization verify: wrong preimage -> preimage mismatch.
-  const wrongPreimage = crypto.randomBytes(32).toString("hex");
-  assert.strictEqual(m.verifyL402Authorization(cfg, `L402 ${macaroon}:${wrongPreimage}`).reason, "l402_preimage_mismatch");
-
-  // Invoice creation without lnbits url/key -> explicit reason (no network attempt).
-  assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 21 })).reason, "lnbits_not_configured");
-
-  // WWW-Authenticate format.
-  assert.ok(m.buildWwwAuthenticate(macaroon, "lnbc10n1...").startsWith("L402 macaroon="));
-  restore();
-
-  console.log("verify_l402_adapter: all L402 Lightning adapter checks passed");
-}
-
-main().catch((error) => {
-  console.error("verify_l402_adapter failed:", error && error.message ? error.message : error);
-  process.exitCode = 1;
-});
+"use strict";
+
+// Verifies the L402 Lightning adapter (lib/l402_adapter.js). Offline: no node,
+// no network. Exercises config gating, macaroon issue/verify, REAL preimage
+// verification (sha256(preimage) === payment_hash), header parsing, and the
+// full verifyL402Authorization round-trip.
+
+const assert = require("assert");
+const crypto = require("crypto");
+const m = require("../lib/l402_adapter");
+
+function setEnv(env) {
+  const saved = {};
+  for (const k in env) {
+    saved[k] = process.env[k];
+    if (env[k] === undefined) delete process.env[k];
+    else process.env[k] = env[k];
+  }
+  return () => {
+    for (const k in saved) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  };
+}
+
+async function main() {
+  // 1. Not configured.
+  let restore = setEnv({ XYTARA_L402_PROVIDER: undefined });
+  let cfg = m.loadL402Config();
+  assert.strictEqual(cfg.provider, null);
+  assert.strictEqual(m.isConfigured(cfg), false);
+  assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 10 })).reason, "l402_provider_not_configured");
+  assert.strictEqual(m.verifyL402Authorization(cfg, "L402 x:ab").reason, "l402_provider_not_configured");
+  restore();
+
+  // 2. Configured (lnbits) — crypto paths (no network).
+  restore = setEnv({ XYTARA_L402_PROVIDER: "lnbits", XYTARA_L402_ROOT_KEY: "root_test_key", XYTARA_L402_PRICE_SATS: "21" });
+  cfg = m.loadL402Config();
+  assert.strictEqual(cfg.provider, "lnbits");
+  assert.strictEqual(m.isConfigured(cfg), true);
+
+  // Real Lightning preimage/payment_hash relationship.
+  const preimage = crypto.randomBytes(32).toString("hex");
+  const paymentHash = crypto.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
+  assert.strictEqual(m.verifyPreimage(preimage, paymentHash), true, "correct preimage must verify");
+  assert.strictEqual(m.verifyPreimage(crypto.randomBytes(32).toString("hex"), paymentHash), false, "wrong preimage must fail");
+
+  // Macaroon issue + verify round-trip.
+  const macaroon = m.issueL402Macaroon(cfg, { payment_hash: paymentHash, amountSats: 21 });
+  assert.ok(macaroon && macaroon.includes("."), "macaroon issued");
+  const mac = m.verifyL402Macaroon(cfg, macaroon);
+  assert.strictEqual(mac.ok, true);
+  assert.strictEqual(mac.payment_hash, paymentHash);
+
+  // Tampered macaroon -> invalid signature.
+  const tampered = macaroon.slice(0, -2) + (macaroon.slice(-2) === "00" ? "11" : "00");
+  assert.strictEqual(m.verifyL402Macaroon(cfg, tampered).ok, false);
+
+  // Header parsing.
+  assert.deepStrictEqual(m.parseL402Header(`L402 ${macaroon}:${preimage}`), { macaroon, preimage });
+  assert.strictEqual(m.parseL402Header("Bearer abc"), null);
+
+  // Full authorization verify: correct preimage -> ok.
+  const okAuth = m.verifyL402Authorization(cfg, `L402 ${macaroon}:${preimage}`);
+  assert.strictEqual(okAuth.ok, true);
+  assert.strictEqual(okAuth.payment_hash, paymentHash);
+
+  // Full authorization verify: wrong preimage -> preimage mismatch.
+  const wrongPreimage = crypto.randomBytes(32).toString("hex");
+  assert.strictEqual(m.verifyL402Authorization(cfg, `L402 ${macaroon}:${wrongPreimage}`).reason, "l402_preimage_mismatch");
+
+  // Invoice creation without lnbits url/key -> explicit reason (no network attempt).
+  assert.strictEqual((await m.createLightningInvoice(cfg, { amountSats: 21 })).reason, "lnbits_not_configured");
+
+  // WWW-Authenticate format.
+  assert.ok(m.buildWwwAuthenticate(macaroon, "lnbc10n1...").startsWith("L402 macaroon="));
+  restore();
+
+  console.log("verify_l402_adapter: all L402 Lightning adapter checks passed");
+}
+
+main().catch((error) => {
+  console.error("verify_l402_adapter failed:", error && error.message ? error.message : error);
+  process.exitCode = 1;
+});

package/scripts/verify_lifecycle_spend_binding.js

@@ -0,0 +1,88 @@
+"use strict";
+
+// End-to-end check (real local server) that the credit lifecycle routes honour REQUEST-BOUND agent
+// signatures: a signature committing to (account, units, task) clears the identity gate for exactly
+// that request, cannot be stretched to a larger amount, cannot be replayed, and a forged key fails —
+// while an unbound signature still authorizes (back-compat) and a bare bearer is refused.
+
+const assert = require("assert");
+const crypto = require("crypto");
+const { buildSpendAuthMessage, buildSpendBindingDigest } = require("../lib/agent_identity");
+
+async function post(baseUrl, path, headers, body) {
+  const res = await fetch(`${baseUrl}${path}`, { method: "POST", headers: { "content-type": "application/json", ...headers }, body: JSON.stringify(body) });
+  let json = null;
+  try { json = await res.json(); } catch (_) { json = null; }
+  return { status: res.status, json };
+}
+
+async function main() {
+  const OP = "lifecycle-binding-operator-token";
+  const prev = process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN;
+  process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN = OP;
+  delete require.cache[require.resolve("../server")];
+  const { createServer } = require("../server");
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+  try {
+    const account = "acct_binding_check";
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+    const created = await post(baseUrl, "/v1/account-auth/spend-credentials", { authorization: `Bearer ${OP}` }, {
+      account_id: account,
+      agent_public_key: publicKey.export({ type: "spki", format: "pem" })
+    });
+    const cred = (created.json && created.json.spend_credential) || created.json;
+    assert.ok(cred && cred.bearer_token && cred.credential_id, "key-bound credential created");
+    const auth = { authorization: `Bearer ${cred.bearer_token}` };
+    const signBound = (units, task, key = privateKey) => {
+      const ts = String(Date.now());
+      const digest = buildSpendBindingDigest({ account_id: account, units, task_ref: task });
+      return { "x-agent-timestamp": ts, "x-agent-signature": crypto.sign(null, Buffer.from(buildSpendAuthMessage(cred.credential_id, ts, digest), "utf8"), key).toString("base64") };
+    };
+    const signUnbound = () => {
+      const ts = String(Date.now());
+      return { "x-agent-timestamp": ts, "x-agent-signature": crypto.sign(null, Buffer.from(buildSpendAuthMessage(cred.credential_id, ts), "utf8"), privateKey).toString("base64") };
+    };
+    const reserve = (headers, units, task) => post(baseUrl, "/v1/economics/rails/credits/reserve", { ...auth, ...headers }, { account_id: account, units, task_ref: task });
+    const identityRejection = (r) => r.status === 403 && r.json && typeof r.json.reason === "string" && r.json.reason.startsWith("agent_signature");
+
+    // Bare bearer -> refused.
+    let r = await reserve({}, 1, "devcon.demo");
+    assert.strictEqual(r.json && r.json.reason, "agent_signature_required", "bearer alone refused");
+
+    // Signature bound to (account, 1 unit, task) -> clears the identity gate for exactly that request.
+    const bound = signBound(1, "devcon.demo");
+    r = await reserve(bound, 1, "devcon.demo");
+    assert.ok(!identityRejection(r), `bound signature clears the identity gate (got ${r.status} ${r.json && r.json.reason})`);
+
+    // The same bound signature replayed -> refused.
+    r = await reserve(bound, 1, "devcon.demo");
+    assert.strictEqual(r.json && r.json.reason, "agent_signature_replayed", "replay refused");
+
+    // A fresh signature bound to 1 unit, presented for 100 units -> refused (cannot be stretched).
+    r = await reserve(signBound(1, "devcon.demo"), 100, "devcon.demo");
+    assert.strictEqual(r.json && r.json.reason, "agent_signature_invalid", "amount cannot be stretched");
+
+    // ...or for another task -> refused.
+    r = await reserve(signBound(1, "devcon.demo"), 1, "other.task");
+    assert.strictEqual(r.json && r.json.reason, "agent_signature_invalid", "task cannot be swapped");
+
+    // A different (attacker) key -> refused.
+    r = await reserve(signBound(1, "devcon.demo", crypto.generateKeyPairSync("ed25519").privateKey), 1, "devcon.demo");
+    assert.strictEqual(r.json && r.json.reason, "agent_signature_invalid", "foreign key refused");
+
+    // Back-compat: an unbound signature still authorizes on the lifecycle routes.
+    r = await reserve(signUnbound(), 1, "devcon.demo");
+    assert.ok(!identityRejection(r), "unbound signature still clears the gate (back-compat)");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    if (prev === undefined) delete process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN; else process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN = prev;
+  }
+  console.log("xytara verify:lifecycle-spend-binding passed");
+}
+
+main().catch((error) => {
+  console.error(error && error.message ? error.message : error);
+  process.exitCode = 1;
+});