xytara 3.1.4 → 3.1.6

package/lib/x402_facilitator.js

@@ -1,155 +1,181 @@
-"use strict";
-
-// Self-contained x402 v2 facilitator client for the main runtime.
-//
-// This mirrors the proven logic in services/mcp-execution-target/server.js but takes
-// all configuration as explicit arguments so it has no dependency on any global state
-// and can be reused by any paid route. It is intentionally duplicated rather than shared
-// with the standalone MCP executor, which deploys from its own subdirectory.
-//
-// The trust model is the same one proven live: this process never verifies balances or
-// broadcasts transfers itself. It asks an x402 facilitator to verify the buyer's signed
-// EIP-3009 authorization and to settle it on-chain, and refuses to serve work unless the
-// facilitator confirms both. If the facilitator is unreachable, access fails closed.
-
-function normalizeString(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function normalizeAddress(value) {
-  return normalizeString(value).toLowerCase();
-}
-
-// Decode a PAYMENT-SIGNATURE header into an x402 v2 payment payload.
-function decodePaymentSignatureHeader(value) {
-  const raw = normalizeString(value);
-  if (!raw) return null;
-  for (const encoding of ["base64url", "base64"]) {
-    try {
-      const decoded = Buffer.from(raw, encoding).toString("utf8");
-      const parsed = JSON.parse(decoded);
-      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) continue;
-      if (Number(parsed.x402Version) !== 2) continue;
-      if (!parsed.accepted || typeof parsed.accepted !== "object") continue;
-      if (!parsed.payload || typeof parsed.payload !== "object") continue;
-      return parsed;
-    } catch (_) {
-      // try the next encoding
-    }
-  }
-  return null;
-}
-
-// Find the advertised requirements entry the buyer claims to be paying.
-function matchAcceptedRequirements(paymentPayload, accepts) {
-  const accepted = paymentPayload && paymentPayload.accepted ? paymentPayload.accepted : null;
-  if (!accepted || !Array.isArray(accepts)) return null;
-  return (
-    accepts.find(
-      (entry) =>
-        entry.scheme === normalizeString(accepted.scheme) &&
-        entry.network === normalizeString(accepted.network) &&
-        normalizeAddress(entry.asset) === normalizeAddress(accepted.asset) &&
-        normalizeAddress(entry.payTo) === normalizeAddress(accepted.payTo) &&
-        String(entry.amount) === String(accepted.amount)
-    ) || null
-  );
-}
-
-function createFacilitatorClient(config) {
-  const url = normalizeString(config && config.url).replace(/\/$/, "");
-  const headers = config && config.headers && typeof config.headers === "object" ? config.headers : {};
-  const timeoutMs = Math.max(1000, Number(config && config.timeoutMs) || 15000);
-
-  async function post(path, body) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-      const response = await fetch(`${url}${path}`, {
-        method: "POST",
-        headers: { "content-type": "application/json", accept: "application/json", ...headers },
-        body: JSON.stringify(body),
-        signal: controller.signal
-      });
-      const text = await response.text();
-      let json = null;
-      try {
-        json = text ? JSON.parse(text) : null;
-      } catch (_) {
-        json = null;
-      }
-      return { ok: response.ok, status: response.status, json };
-    } catch (error) {
-      return { ok: false, status: 0, json: null, error: error && error.message ? error.message : "facilitator_request_failed" };
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-
-  return {
-    verify: (payload, requirements) => post("/verify", { x402Version: 2, paymentPayload: payload, paymentRequirements: requirements }),
-    settle: (payload, requirements) => post("/settle", { x402Version: 2, paymentPayload: payload, paymentRequirements: requirements })
-  };
-}
-
-// Verify a buyer's x402 payment against the advertised requirements via the facilitator.
-// Returns { ok:true, authorization } or { ok:false, status:402, reason, detail }.
-async function verifyX402Payment({ paymentHeader, accepts, resourceUrl, facilitator }) {
-  const header = normalizeString(paymentHeader);
-  if (!header) {
-    return { ok: false, status: 402, reason: "payment_required" };
-  }
-  const paymentPayload = decodePaymentSignatureHeader(header);
-  if (!paymentPayload) {
-    return { ok: false, status: 402, reason: "payment_signature_invalid", detail: "PAYMENT-SIGNATURE must be a base64 JSON x402 v2 payment payload" };
-  }
-  const paymentRequirements = matchAcceptedRequirements(paymentPayload, accepts);
-  if (!paymentRequirements) {
-    return { ok: false, status: 402, reason: "payment_requirements_mismatch", detail: "accepted requirements do not match any advertised payment option" };
-  }
-  const requirementsForFacilitator = { ...paymentRequirements, resource: resourceUrl };
-  const verification = await facilitator.verify(paymentPayload, requirementsForFacilitator);
-  if (!verification.ok || !verification.json) {
-    return { ok: false, status: 402, reason: "facilitator_unreachable", detail: verification.error || `facilitator verify returned HTTP ${verification.status}` };
-  }
-  if (verification.json.isValid !== true) {
-    return { ok: false, status: 402, reason: "payment_verification_failed", detail: normalizeString(verification.json.invalidReason) || "facilitator rejected the payment" };
-  }
-  return {
-    ok: true,
-    authorization: {
-      paymentPayload,
-      paymentRequirements: requirementsForFacilitator,
-      payer: normalizeString(verification.json.payer) || null
-    }
-  };
-}
-
-// Settle a verified payment on-chain via the facilitator (unless settlement is disabled).
-// Returns { ok:true, settlement } or { ok:false, status:402, reason, detail }.
-async function settleX402Payment({ authorization, facilitator, settle }) {
-  if (settle === false) {
-    return { ok: true, settlement: { success: true, skipped: true, reason: "settlement_disabled_by_operator", payer: authorization.payer } };
-  }
-  const settlement = await facilitator.settle(authorization.paymentPayload, authorization.paymentRequirements);
-  if (!settlement.ok || !settlement.json) {
-    return { ok: false, status: 402, reason: "facilitator_unreachable", detail: settlement.error || `facilitator settle returned HTTP ${settlement.status}` };
-  }
-  if (settlement.json.success !== true) {
-    return { ok: false, status: 402, reason: "payment_settlement_failed", detail: normalizeString(settlement.json.errorReason) || "facilitator could not settle the payment" };
-  }
-  return { ok: true, settlement: settlement.json };
-}
-
-function encodePaymentResponse(settlement) {
-  return Buffer.from(JSON.stringify(settlement), "utf8").toString("base64");
-}
-
-module.exports = {
-  decodePaymentSignatureHeader,
-  matchAcceptedRequirements,
-  createFacilitatorClient,
-  verifyX402Payment,
-  settleX402Payment,
-  encodePaymentResponse
-};
+"use strict";
+
+const { buildCdpBearerToken } = require("./cdp_jwt");
+
+// Self-contained x402 v2 facilitator client for the main runtime.
+//
+// This mirrors the proven logic in services/mcp-execution-target/server.js but takes
+// all configuration as explicit arguments so it has no dependency on any global state
+// and can be reused by any paid route. It is intentionally duplicated rather than shared
+// with the standalone MCP executor, which deploys from its own subdirectory.
+//
+// The trust model is the same one proven live: this process never verifies balances or
+// broadcasts transfers itself. It asks an x402 facilitator to verify the buyer's signed
+// EIP-3009 authorization and to settle it on-chain, and refuses to serve work unless the
+// facilitator confirms both. If the facilitator is unreachable, access fails closed.
+
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function normalizeAddress(value) {
+  return normalizeString(value).toLowerCase();
+}
+
+// Decode a PAYMENT-SIGNATURE header into an x402 v2 payment payload.
+function decodePaymentSignatureHeader(value) {
+  const raw = normalizeString(value);
+  if (!raw) return null;
+  for (const encoding of ["base64url", "base64"]) {
+    try {
+      const decoded = Buffer.from(raw, encoding).toString("utf8");
+      const parsed = JSON.parse(decoded);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) continue;
+      if (Number(parsed.x402Version) !== 2) continue;
+      if (!parsed.accepted || typeof parsed.accepted !== "object") continue;
+      if (!parsed.payload || typeof parsed.payload !== "object") continue;
+      return parsed;
+    } catch (_) {
+      // try the next encoding
+    }
+  }
+  return null;
+}
+
+// Find the advertised requirements entry the buyer claims to be paying.
+function matchAcceptedRequirements(paymentPayload, accepts) {
+  const accepted = paymentPayload && paymentPayload.accepted ? paymentPayload.accepted : null;
+  if (!accepted || !Array.isArray(accepts)) return null;
+  return (
+    accepts.find(
+      (entry) =>
+        entry.scheme === normalizeString(accepted.scheme) &&
+        entry.network === normalizeString(accepted.network) &&
+        normalizeAddress(entry.asset) === normalizeAddress(accepted.asset) &&
+        normalizeAddress(entry.payTo) === normalizeAddress(accepted.payTo) &&
+        String(entry.amount) === String(accepted.amount)
+    ) || null
+  );
+}
+
+function createFacilitatorClient(config) {
+  const url = normalizeString(config && config.url).replace(/\/$/, "");
+  const headers = config && config.headers && typeof config.headers === "object" ? config.headers : {};
+  const timeoutMs = Math.max(1000, Number(config && config.timeoutMs) || 15000);
+  // Optional Coinbase CDP auth: when a CDP Secret API Key is configured, a fresh short-lived
+  // EdDSA Bearer JWT is minted per request (CDP rejects static tokens). This is what unlocks
+  // the CDP-hosted facilitator and Base mainnet settlement.
+  const cdp = config && config.cdp && typeof config.cdp === "object" ? config.cdp : null;
+  const cdpKeyId = cdp ? normalizeString(cdp.key_id || cdp.keyId) : "";
+  const cdpKeySecret = cdp ? String((cdp.key_secret || cdp.keySecret) || "").trim() : "";
+  const cdpEnabled = Boolean(cdpKeyId && cdpKeySecret);
+
+  async function post(path, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let authHeaders = {};
+    if (cdpEnabled) {
+      try {
+        const target = new URL(`${url}${path}`);
+        const token = buildCdpBearerToken({ keyId: cdpKeyId, keySecret: cdpKeySecret, method: "POST", host: target.host, path: target.pathname });
+        authHeaders = { Authorization: `Bearer ${token}` };
+      } catch (error) {
+        clearTimeout(timer);
+        return { ok: false, status: 0, json: null, error: error && error.message ? error.message : "cdp_jwt_failed" };
+      }
+    }
+    try {
+      const response = await fetch(`${url}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json", ...headers, ...authHeaders },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      const text = await response.text();
+      let json = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch (_) {
+        json = null;
+      }
+      return { ok: response.ok, status: response.status, json };
+    } catch (error) {
+      return { ok: false, status: 0, json: null, error: error && error.message ? error.message : "facilitator_request_failed" };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  return {
+    verify: (payload, requirements) => post("/verify", { x402Version: 2, paymentPayload: payload, paymentRequirements: requirements }),
+    settle: (payload, requirements) => post("/settle", { x402Version: 2, paymentPayload: payload, paymentRequirements: requirements })
+  };
+}
+
+// Verify a buyer's x402 payment against the advertised requirements via the facilitator.
+// Returns { ok:true, authorization } or { ok:false, status:402, reason, detail }.
+async function verifyX402Payment({ paymentHeader, accepts, resourceUrl, facilitator }) {
+  const header = normalizeString(paymentHeader);
+  if (!header) {
+    return { ok: false, status: 402, reason: "payment_required" };
+  }
+  const paymentPayload = decodePaymentSignatureHeader(header);
+  if (!paymentPayload) {
+    return { ok: false, status: 402, reason: "payment_signature_invalid", detail: "PAYMENT-SIGNATURE must be a base64 JSON x402 v2 payment payload" };
+  }
+  const paymentRequirements = matchAcceptedRequirements(paymentPayload, accepts);
+  if (!paymentRequirements) {
+    return { ok: false, status: 402, reason: "payment_requirements_mismatch", detail: "accepted requirements do not match any advertised payment option" };
+  }
+  // The x402 v2 PaymentRequirements shape is exactly {scheme, network, asset, amount, payTo,
+  // maxTimeoutSeconds, extra} with no `resource` field (resource lives on the payload in v2).
+  // Adding one makes strict facilitators (e.g. Coinbase CDP) reject the request with HTTP 400
+  // and makes paymentRequirements diverge from paymentPayload.accepted, so send it clean.
+  // resourceUrl is accepted for API compatibility but intentionally not sent to the facilitator.
+  void resourceUrl;
+  const requirementsForFacilitator = { ...paymentRequirements };
+  const verification = await facilitator.verify(paymentPayload, requirementsForFacilitator);
+  if (!verification.ok || !verification.json) {
+    return { ok: false, status: 402, reason: "facilitator_unreachable", detail: verification.error || `facilitator verify returned HTTP ${verification.status}` };
+  }
+  if (verification.json.isValid !== true) {
+    return { ok: false, status: 402, reason: "payment_verification_failed", detail: normalizeString(verification.json.invalidReason) || "facilitator rejected the payment" };
+  }
+  return {
+    ok: true,
+    authorization: {
+      paymentPayload,
+      paymentRequirements: requirementsForFacilitator,
+      payer: normalizeString(verification.json.payer) || null
+    }
+  };
+}
+
+// Settle a verified payment on-chain via the facilitator (unless settlement is disabled).
+// Returns { ok:true, settlement } or { ok:false, status:402, reason, detail }.
+async function settleX402Payment({ authorization, facilitator, settle }) {
+  if (settle === false) {
+    return { ok: true, settlement: { success: true, skipped: true, reason: "settlement_disabled_by_operator", payer: authorization.payer } };
+  }
+  const settlement = await facilitator.settle(authorization.paymentPayload, authorization.paymentRequirements);
+  if (!settlement.ok || !settlement.json) {
+    return { ok: false, status: 402, reason: "facilitator_unreachable", detail: settlement.error || `facilitator settle returned HTTP ${settlement.status}` };
+  }
+  if (settlement.json.success !== true) {
+    return { ok: false, status: 402, reason: "payment_settlement_failed", detail: normalizeString(settlement.json.errorReason) || "facilitator could not settle the payment" };
+  }
+  return { ok: true, settlement: settlement.json };
+}
+
+function encodePaymentResponse(settlement) {
+  return Buffer.from(JSON.stringify(settlement), "utf8").toString("base64");
+}
+
+module.exports = {
+  decodePaymentSignatureHeader,
+  matchAcceptedRequirements,
+  createFacilitatorClient,
+  verifyX402Payment,
+  settleX402Payment,
+  encodePaymentResponse
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "3.1.4",
+  "version": "3.1.6",
   "description": "Agent-commerce runtime for quote, pay, execute, deliver, meter, and integrate.",
   "main": "index.js",
   "bin": {
@@ -100,7 +100,8 @@
     "verify:production-readiness": "node scripts/verify_production_readiness.js",
     "verify:final-activation": "node scripts/verify_final_activation.js",
     "verify:x402-facilitator": "node scripts/verify_x402_facilitator.js",
-    "verify:all": "node scripts/verify_all.js && node scripts/verify_integrations.js && node scripts/verify_adapters.js && node scripts/verify_control_plane_contracts.js && node scripts/verify_control_plane_routes.js && node scripts/verify_framework_provider_promotion.js && node scripts/verify_operator_observability_boundary.js && node scripts/verify_pricing_experiment_plan.js && node scripts/verify_treasury_public_boundary.js && node scripts/verify_market_lanes.js && node scripts/verify_market_lane_depth.js && node scripts/verify_market_lane_traces.js && node scripts/verify_market_lane_promotion.js && node scripts/verify_provider_runtime_breadth.js && node scripts/verify_provider_runtime_journeys.js && node scripts/verify_lifecycle_continuity.js && node scripts/verify_first_run_conversions.js && node scripts/verify_delivery_summary.js && node scripts/verify_runtime_durability.js && node scripts/verify_revenue_launch_paths.js && node scripts/verify_full_catalog.js && node scripts/verify_tooling.js && node scripts/verify_examples.js && node scripts/verify_service.js && node scripts/verify_x402_facilitator.js",
-    "prepublishOnly": "npm run verify:release-candidate"
+    "verify:all": "node scripts/verify_all.js && node scripts/verify_integrations.js && node scripts/verify_adapters.js && node scripts/verify_control_plane_contracts.js && node scripts/verify_control_plane_routes.js && node scripts/verify_framework_provider_promotion.js && node scripts/verify_operator_observability_boundary.js && node scripts/verify_pricing_experiment_plan.js && node scripts/verify_treasury_public_boundary.js && node scripts/verify_market_lanes.js && node scripts/verify_market_lane_depth.js && node scripts/verify_market_lane_traces.js && node scripts/verify_market_lane_promotion.js && node scripts/verify_provider_runtime_breadth.js && node scripts/verify_provider_runtime_journeys.js && node scripts/verify_lifecycle_continuity.js && node scripts/verify_first_run_conversions.js && node scripts/verify_delivery_summary.js && node scripts/verify_runtime_durability.js && node scripts/verify_revenue_launch_paths.js && node scripts/verify_full_catalog.js && node scripts/verify_tooling.js && node scripts/verify_examples.js && node scripts/verify_service.js && node scripts/verify_x402_facilitator.js && node scripts/verify_cdp_facilitator.js",
+    "prepublishOnly": "npm run verify:release-candidate",
+    "verify:cdp-facilitator": "node scripts/verify_cdp_facilitator.js"
   }
 }

package/scripts/verify_cdp_facilitator.js

@@ -0,0 +1,110 @@
+"use strict";
+
+// Verifies the Coinbase CDP auth path for the x402 facilitator client: when a CDP Secret
+// API Key is configured, the client must mint a fresh, valid EdDSA Bearer JWT per request
+// (CDP rejects static tokens). A mock facilitator stands in for CDP and cryptographically
+// verifies the token's signature and claims before accepting the call. No real network/chain.
+
+const assert = require("assert");
+const http = require("http");
+const crypto = require("crypto");
+
+const { createFacilitatorClient } = require("../lib/x402_facilitator");
+const { loadPaymentConfig } = require("../lib/payment_config");
+
+// A throwaway Ed25519 key, exported as the base64 64-byte (seed||public) secret CDP uses.
+function makeCdpKey() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const seed = privateKey.export({ format: "der", type: "pkcs8" }).subarray(16); // last 32 bytes
+  const pub = publicKey.export({ format: "der", type: "spki" }).subarray(12); // last 32 bytes
+  return { publicKey, keySecret: Buffer.concat([seed, pub]).toString("base64") };
+}
+
+function startCdpMock(expectedPublicKey, seen) {
+  const server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const reply = (code, payload) => {
+        const text = JSON.stringify(payload);
+        res.writeHead(code, { "content-type": "application/json", "content-length": Buffer.byteLength(text) });
+        res.end(text);
+      };
+      const auth = String((req.headers.authorization || ""));
+      if (!auth.startsWith("Bearer ")) return reply(401, { error: "missing_bearer" });
+      const token = auth.slice("Bearer ".length);
+      const parts = token.split(".");
+      if (parts.length !== 3) return reply(401, { error: "malformed_jwt" });
+      const header = JSON.parse(Buffer.from(parts[0], "base64").toString("utf8"));
+      const claims = JSON.parse(Buffer.from(parts[1], "base64").toString("utf8"));
+      const sig = Buffer.from(parts[2].replace(/-/g, "+").replace(/_/g, "/"), "base64");
+      const signatureValid = crypto.verify(null, Buffer.from(`${parts[0]}.${parts[1]}`), expectedPublicKey, sig);
+      // Record what the facilitator observed so the test can assert on it.
+      seen.push({ header, claims, signatureValid, path: req.url, nonce: header.nonce });
+      if (header.alg !== "EdDSA") return reply(401, { error: "bad_alg" });
+      if (!signatureValid) return reply(401, { error: "bad_signature" });
+      if (claims.iss !== "cdp") return reply(401, { error: "bad_iss" });
+      if (!Array.isArray(claims.aud) || claims.aud[0] !== "cdp_service") return reply(401, { error: "bad_aud" });
+      const now = Math.floor(Date.now() / 1000);
+      if (!(claims.exp > now && claims.exp - claims.nbf <= 120)) return reply(401, { error: "bad_exp" });
+      if (!(claims.uri.startsWith("POST 127.0.0.1:") && claims.uri.endsWith(req.url))) return reply(401, { error: "bad_uri", uri: claims.uri });
+      if (req.url === "/verify") return reply(200, { isValid: true, payer: "0x2222222222222222222222222222222222222222" });
+      if (req.url === "/settle") return reply(200, { success: true, transaction: "0xcdpmocktx", network: "eip155:8453" });
+      return reply(404, { error: "not_found" });
+    });
+  });
+  return new Promise((resolve) => server.listen(0, "127.0.0.1", () => resolve({ server, port: server.address().port })));
+}
+
+const PAYLOAD = { x402Version: 2, accepted: { scheme: "exact" }, payload: { signature: "ok", authorization: {} } };
+const REQS = { scheme: "exact", network: "eip155:8453", asset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", amount: "10000", payTo: "0xabc", resource: "https://x/y" };
+
+async function main() {
+  const { publicKey, keySecret } = makeCdpKey();
+  const seen = [];
+  const mock = await startCdpMock(publicKey, seen);
+  const baseUrl = `http://127.0.0.1:${mock.port}`;
+
+  try {
+    // 1. Config loader picks up the CDP env into config.x402.cdp.
+    const prev = { id: process.env.XYTARA_X402_CDP_KEY_ID, sec: process.env.XYTARA_X402_CDP_KEY_SECRET };
+    process.env.XYTARA_X402_CDP_KEY_ID = "11111111-2222-3333-4444-555555555555";
+    process.env.XYTARA_X402_CDP_KEY_SECRET = keySecret;
+    const cfg = loadPaymentConfig();
+    assert.ok(cfg.x402.cdp && cfg.x402.cdp.key_id === "11111111-2222-3333-4444-555555555555", "config must load CDP key id");
+    assert.strictEqual(cfg.x402.cdp.key_secret, keySecret, "config must load CDP key secret");
+
+    // 2. The client attaches a valid per-request Bearer that the mock CDP accepts.
+    const client = createFacilitatorClient({ url: baseUrl, cdp: cfg.x402.cdp, timeoutMs: 5000 });
+    const verify = await client.verify(PAYLOAD, REQS);
+    assert.strictEqual(verify.ok, true, "verify must succeed with a valid CDP Bearer");
+    assert.strictEqual(verify.json.isValid, true, "mock CDP must accept the token on /verify");
+    const settle = await client.settle(PAYLOAD, REQS);
+    assert.strictEqual(settle.ok, true, "settle must succeed with a valid CDP Bearer");
+    assert.strictEqual(settle.json.transaction, "0xcdpmocktx", "settle must return the mock tx");
+
+    // 3. Each request minted its own token (fresh nonce), signature valid, uri bound to the path.
+    assert.strictEqual(seen.length, 2, "mock must have seen two authenticated calls");
+    assert.ok(seen.every((e) => e.signatureValid), "every token signature must verify");
+    assert.notStrictEqual(seen[0].nonce, seen[1].nonce, "each request must mint a fresh token (distinct nonce)");
+    assert.ok(seen[0].claims.uri.endsWith("/verify") && seen[1].claims.uri.endsWith("/settle"), "uri claim must bind to each request path");
+
+    // 4. Without CDP creds, no Authorization header is sent (static-facilitator path unaffected).
+    const seen2 = [];
+    const mock2 = await startCdpMock(publicKey, seen2);
+    const plainClient = createFacilitatorClient({ url: `http://127.0.0.1:${mock2.port}`, timeoutMs: 5000 });
+    const plain = await plainClient.verify(PAYLOAD, REQS);
+    assert.strictEqual(plain.status, 401, "without CDP creds the mock sees no Bearer and rejects");
+    assert.strictEqual(seen2.length, 0, "no JWT should be minted when CDP is not configured");
+    await new Promise((r) => mock2.server.close(r));
+
+    if (prev.id === undefined) delete process.env.XYTARA_X402_CDP_KEY_ID; else process.env.XYTARA_X402_CDP_KEY_ID = prev.id;
+    if (prev.sec === undefined) delete process.env.XYTARA_X402_CDP_KEY_SECRET; else process.env.XYTARA_X402_CDP_KEY_SECRET = prev.sec;
+
+    console.log("xytara verify:cdp-facilitator passed");
+  } finally {
+    await new Promise((r) => mock.server.close(r));
+  }
+}
+
+main().catch((e) => { console.error(e && e.message ? e.message : e); process.exitCode = 1; });