xytara 2.2.0 → 2.4.0

package/lib/commerce_identity.js

@@ -0,0 +1,578 @@
+"use strict";
+
+function ensureArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function listTransactionEntriesForAccount(state, accountId) {
+  return Array.from(state.transactions.values())
+    .filter((entry) => entry && entry.transaction && entry.transaction.account_id === accountId);
+}
+
+function listReceiptsForAccount(state, accountId) {
+  return Array.from(state.receipts.values())
+    .map((entry) => entry && entry.receipt ? entry.receipt : null)
+    .filter((receipt) => receipt && receipt.account_id === accountId);
+}
+
+function listAgentAccountsForIdentity(state, accountId) {
+  return Array.from(state.agentAccounts.values())
+    .map((entry) => entry && entry.account ? entry.account : null)
+    .filter((account) => account && account.account_id === accountId);
+}
+
+function listIdentityBindingsForAccount(state, accountId) {
+  return Array.from(state.machineIdentityBindings.values())
+    .filter((binding) => binding && binding.account_id === accountId);
+}
+
+function collectIdentityDeliverables(entry) {
+  const deliverables = entry && entry.command && Array.isArray(entry.command.deliverables)
+    ? entry.command.deliverables
+    : [];
+  const identityRefs = [];
+  const registryRefs = [];
+  const anchorRefs = [];
+  for (const item of deliverables) {
+    if (!item || typeof item !== "object") continue;
+    if (item.identity_attestation_ref) identityRefs.push(item.identity_attestation_ref);
+    if (item.identity_link_ref) identityRefs.push(item.identity_link_ref);
+    if (item.registry_record_ref) registryRefs.push(item.registry_record_ref);
+    if (item.registry_pack_ref) registryRefs.push(item.registry_pack_ref);
+    if (item.anchor_ref) anchorRefs.push(item.anchor_ref);
+  }
+  return {
+    identity_refs: identityRefs,
+    registry_refs: registryRefs,
+    anchor_refs: anchorRefs
+  };
+}
+
+function buildMachineIdentitySummary(state, accountId) {
+  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
+  const identityBindings = listIdentityBindingsForAccount(state, accountId);
+  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
+  const receipts = listReceiptsForAccount(state, accountId);
+  const identityTransactions = transactionEntries.filter((entry) =>
+    ensureArray(entry.command && entry.command.deliverables).some((task) =>
+      task && typeof task.task_ref === "string" && (
+        task.task_ref === "identity.attest.preview" ||
+        task.task_ref === "identity.registry.link" ||
+        task.task_ref === "registry.register" ||
+        task.task_ref === "registry.pack.bundle" ||
+        task.task_ref === "anchoring.submit"
+      )
+    ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
+      task && typeof task.task_ref === "string" && (
+        task.task_ref === "identity.attest.preview" ||
+        task.task_ref === "identity.registry.link" ||
+        task.task_ref === "registry.register" ||
+        task.task_ref === "registry.pack.bundle" ||
+        task.task_ref === "anchoring.submit"
+      )
+    )
+  );
+  const refs = identityTransactions.reduce((acc, transaction) => {
+    const next = collectIdentityDeliverables(transaction);
+    acc.identity_refs.push(...next.identity_refs);
+    acc.registry_refs.push(...next.registry_refs);
+    acc.anchor_refs.push(...next.anchor_refs);
+    return acc;
+  }, {
+    identity_refs: [],
+    registry_refs: [],
+    anchor_refs: []
+  });
+
+  const latestIdentityTransaction = identityTransactions
+    .map((entry) => ({
+      transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
+      created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null
+    }))
+    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")))
+    .slice(-1)[0] || null;
+
+  let identityState = "unbound";
+  if (agentAccounts.length > 0) identityState = "account_issued";
+  if (identityBindings.length > 0) identityState = "identity_binding_present";
+  if (identityTransactions.length > 0) identityState = "identity_activity_present";
+  if (refs.registry_refs.length > 0 && refs.anchor_refs.length > 0) identityState = "registry_anchor_present";
+
+  return {
+    summary_version: "xytara-machine-identity-summary-v1",
+    account_id: accountId,
+    machine_identity_state: identityState,
+    counts: {
+      agent_account_count: agentAccounts.length,
+      identity_binding_count: identityBindings.length,
+      identity_transaction_count: identityTransactions.length,
+      receipt_count: receipts.length,
+      identity_ref_count: refs.identity_refs.length,
+      registry_ref_count: refs.registry_refs.length,
+      anchor_ref_count: refs.anchor_refs.length
+    },
+    latest_identity_transaction_id: latestIdentityTransaction ? latestIdentityTransaction.transaction_id : null,
+    linked_surfaces: {
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      agent_accounts_ref: "/v1/agent-accounts",
+      operator_shell_summary_ref: "/v1/operator-shell/summary"
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityBundle(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
+  const identityBindings = listIdentityBindingsForAccount(state, accountId);
+  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
+  const identityTransactions = transactionEntries
+    .filter((entry) =>
+      ensureArray(entry.command && entry.command.deliverables).some((task) =>
+        task && typeof task.task_ref === "string" && (
+          task.task_ref === "identity.attest.preview" ||
+          task.task_ref === "identity.registry.link" ||
+          task.task_ref === "registry.register" ||
+          task.task_ref === "registry.pack.bundle" ||
+          task.task_ref === "anchoring.submit"
+        )
+      ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
+        task && typeof task.task_ref === "string" && (
+          task.task_ref === "identity.attest.preview" ||
+          task.task_ref === "identity.registry.link" ||
+          task.task_ref === "registry.register" ||
+          task.task_ref === "registry.pack.bundle" ||
+          task.task_ref === "anchoring.submit"
+        )
+      )
+    )
+    .map((entry) => {
+      const refs = collectIdentityDeliverables(entry);
+      return {
+        transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
+        status: entry.transaction && entry.transaction.status ? entry.transaction.status : null,
+        created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null,
+        identity_refs: refs.identity_refs,
+        registry_refs: refs.registry_refs,
+        anchor_refs: refs.anchor_refs
+      };
+    });
+
+  return {
+    bundle_version: "xytara-machine-identity-bundle-v1",
+    account_id: accountId,
+    machine_identity_summary: summary,
+    agent_accounts: agentAccounts,
+    identity_bindings: identityBindings,
+    identity_transactions: identityTransactions,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      authority_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/authority-summary`,
+      wallet_ledger_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/wallet-ledger-bundle`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityAttachmentSummary(state, accountId) {
+  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const attachmentRows = bundle.identity_transactions.map((entry) => ({
+    transaction_id: entry.transaction_id,
+    identity_attachment_count: ensureArray(entry.identity_refs).length,
+    registry_attachment_count: ensureArray(entry.registry_refs).length,
+    anchor_attachment_count: ensureArray(entry.anchor_refs).length,
+    has_registry_anchor_pair: ensureArray(entry.registry_refs).length > 0 && ensureArray(entry.anchor_refs).length > 0,
+    created_at_iso: entry.created_at_iso || null
+  }));
+
+  return {
+    summary_version: "xytara-machine-identity-attachment-summary-v1",
+    account_id: accountId,
+    machine_identity_attachment_state: attachmentRows.length > 0 ? "attachments_present" : agentAccounts.length > 0 ? "account_only" : "unattached",
+    counts: {
+      agent_account_count: agentAccounts.length,
+      identity_binding_count: Array.isArray(bundle.identity_bindings) ? bundle.identity_bindings.length : 0,
+      attachment_row_count: attachmentRows.length,
+      registry_anchor_pair_count: attachmentRows.filter((entry) => entry.has_registry_anchor_pair).length
+    },
+    attachment_rows: attachmentRows,
+    linked_surfaces: {
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityLineageSummary(state, accountId) {
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const lineageRows = bundle.identity_transactions.map((entry, index) => {
+    const predecessor = index > 0 ? bundle.identity_transactions[index - 1] : null;
+    const successor = index < bundle.identity_transactions.length - 1 ? bundle.identity_transactions[index + 1] : null;
+    return {
+      transaction_id: entry.transaction_id,
+      predecessor_transaction_id: predecessor ? predecessor.transaction_id : null,
+      successor_transaction_id: successor ? successor.transaction_id : null,
+      lineage_position: predecessor ? successor ? "middle" : "leaf" : successor ? "root" : "standalone",
+      registry_ref_count: ensureArray(entry.registry_refs).length,
+      anchor_ref_count: ensureArray(entry.anchor_refs).length,
+      created_at_iso: entry.created_at_iso || null
+    };
+  });
+
+  return {
+    summary_version: "xytara-machine-identity-lineage-summary-v1",
+    account_id: accountId,
+    identity_transaction_count: bundle.identity_transactions.length,
+    root_count: lineageRows.filter((entry) => entry.lineage_position === "root" || entry.lineage_position === "standalone").length,
+    leaf_count: lineageRows.filter((entry) => entry.lineage_position === "leaf" || entry.lineage_position === "standalone").length,
+    lineage_rows: lineageRows,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityBindingLineageSummary(state, accountId) {
+  const identityBindings = listIdentityBindingsForAccount(state, accountId)
+    .slice()
+    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")));
+  const lineageRows = identityBindings.map((entry) => ({
+    binding_id: entry.binding_id,
+    status: entry.status,
+    identity_kind: entry.identity_kind,
+    predecessor_binding_id: entry.rotated_from_binding_id || null,
+    successor_binding_id: entry.replaced_by_binding_id || null,
+    lineage_position: entry.rotated_from_binding_id
+      ? entry.replaced_by_binding_id
+        ? "middle"
+        : "leaf"
+      : entry.replaced_by_binding_id
+        ? "root"
+        : "standalone",
+    expires_at_iso: entry.expires_at_iso || null,
+    created_at_iso: entry.created_at_iso || null,
+    updated_at_iso: entry.updated_at_iso || null
+  }));
+
+  return {
+    summary_version: "xytara-machine-identity-binding-lineage-summary-v1",
+    account_id: accountId,
+    identity_binding_count: identityBindings.length,
+    rotated_binding_count: lineageRows.filter((entry) => entry.predecessor_binding_id || entry.successor_binding_id).length,
+    lineage_rows: lineageRows,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
+      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityProfile(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
+  const lineage = buildMachineIdentityLineageSummary(state, accountId);
+  const primaryAgentAccount = Array.isArray(bundle.agent_accounts) && bundle.agent_accounts.length > 0
+    ? bundle.agent_accounts[0]
+    : null;
+  const primaryIdentityBinding = Array.isArray(bundle.identity_bindings) && bundle.identity_bindings.length > 0
+    ? bundle.identity_bindings[0]
+    : null;
+
+  return {
+    profile_version: "xytara-machine-identity-profile-v1",
+    account_id: accountId,
+    machine_identity_state: summary.machine_identity_state,
+    primary_identity_kind: primaryIdentityBinding
+      ? primaryIdentityBinding.identity_kind
+      : primaryAgentAccount
+        ? "agent_account"
+        : "runtime_account_only",
+    primary_agent_account_id: primaryAgentAccount ? primaryAgentAccount.account_id : null,
+    primary_identity_binding_id: primaryIdentityBinding ? primaryIdentityBinding.binding_id : null,
+    settlement_mode: primaryAgentAccount ? primaryAgentAccount.settlement_mode || null : null,
+    protocol: primaryAgentAccount ? primaryAgentAccount.protocol || null : null,
+    attachment_state: attachment.machine_identity_attachment_state,
+    lineage_state: lineage.identity_transaction_count > 0 ? "lineage_present" : "lineage_absent",
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityPolicyPack(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const profile = buildMachineIdentityProfile(state, accountId);
+  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
+  const lineage = buildMachineIdentityLineageSummary(state, accountId);
+  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
+  const policyTemplates = [
+    {
+      template_id: "runtime_builder_identity",
+      target_state: "account_issued",
+      recommended_for: "runtime-first machine onboarding",
+      steps: ["issue_agent_account", "confirm_protocol", "confirm_settlement_mode"],
+      binding_defaults: {
+        identity_kind: "runtime_builder_identity",
+        registry_scope: null,
+        attach_primary_agent_account: true,
+        use_latest_identity_transaction: false
+      }
+    },
+    {
+      template_id: "registry_anchor_identity",
+      target_state: "registry_anchor_present",
+      recommended_for: "identity-plus-registry continuity",
+      steps: ["identity_attest_preview", "registry_register", "identity_registry_link", "anchoring_submit"],
+      binding_defaults: {
+        identity_kind: "registry_anchor_identity",
+        registry_scope: "registry.identity.default",
+        attach_primary_agent_account: false,
+        use_latest_identity_transaction: true
+      }
+    },
+    {
+      template_id: "continuity_repair_identity",
+      target_state: "identity_activity_present",
+      recommended_for: "repair partial identity attachment posture",
+      steps: ["review_attachment_rows", "complete_registry_anchor_pair", "inspect_lineage"],
+      binding_defaults: {
+        identity_kind: "registry_anchor_identity",
+        registry_scope: "registry.identity.default",
+        attach_primary_agent_account: true,
+        use_latest_identity_transaction: true
+      }
+    }
+  ];
+
+  let recommendedPolicyMotion = "issue_identity_from_template";
+  if (summary.machine_identity_state === "registry_anchor_present") {
+    recommendedPolicyMotion = "maintain_identity_profile";
+  } else if (attachment.counts.registry_anchor_pair_count === 0 && attachment.counts.attachment_row_count > 0) {
+    recommendedPolicyMotion = "complete_registry_anchor_pair";
+  } else if (lineage.identity_transaction_count > 0) {
+    recommendedPolicyMotion = "stabilize_identity_lineage";
+  }
+
+  return {
+    pack_version: "xytara-machine-identity-policy-pack-v1",
+    account_id: accountId,
+    machine_identity_summary: summary,
+    machine_identity_profile: profile,
+    machine_identity_attachment_summary: attachment,
+    machine_identity_lineage_summary: lineage,
+    machine_identity_binding_lineage_summary: bindingLineage,
+    recommended_policy_motion: recommendedPolicyMotion,
+    policy_templates: policyTemplates,
+    linked_surfaces: {
+      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
+      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`,
+      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityPolicyApplicationSummary(state, accountId, templateId) {
+  const pack = buildMachineIdentityPolicyPack(state, accountId);
+  const selectedTemplate = ensureArray(pack.policy_templates).find((entry) => entry.template_id === templateId)
+    || ensureArray(pack.policy_templates).find((entry) => {
+      if (pack.recommended_policy_motion === "maintain_identity_profile") {
+        return entry.template_id === "registry_anchor_identity";
+      }
+      if (pack.recommended_policy_motion === "complete_registry_anchor_pair") {
+        return entry.template_id === "continuity_repair_identity";
+      }
+      if (pack.recommended_policy_motion === "stabilize_identity_lineage") {
+        return entry.template_id === "continuity_repair_identity";
+      }
+      return entry.template_id === "runtime_builder_identity";
+    })
+    || ensureArray(pack.policy_templates)[0]
+    || null;
+  const bindingDefaults = selectedTemplate && selectedTemplate.binding_defaults ? selectedTemplate.binding_defaults : {};
+  const suggestedBindingPayload = {
+    account_id: accountId,
+    identity_kind: bindingDefaults.identity_kind || "registry_anchor_identity",
+    registry_scope: bindingDefaults.registry_scope || null,
+    attached_agent_account_id: bindingDefaults.attach_primary_agent_account
+      ? pack.machine_identity_profile.primary_agent_account_id || null
+      : null,
+    source_transaction_id: bindingDefaults.use_latest_identity_transaction
+      ? pack.machine_identity_summary.latest_identity_transaction_id || null
+      : null,
+    issued_by: "operator",
+    labels: selectedTemplate ? [`policy:${selectedTemplate.template_id}`] : []
+  };
+
+  return {
+    summary_version: "xytara-machine-identity-policy-application-summary-v1",
+    account_id: accountId,
+    recommended_policy_motion: pack.recommended_policy_motion,
+    selected_template_id: selectedTemplate ? selectedTemplate.template_id : null,
+    available_template_ids: ensureArray(pack.policy_templates).map((entry) => entry.template_id),
+    suggested_binding_payload: suggestedBindingPayload,
+    selected_template: selectedTemplate,
+    linked_surfaces: {
+      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
+      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityPolicyPackSummary(state, accountId) {
+  const pack = buildMachineIdentityPolicyPack(state, accountId);
+  return {
+    summary_version: "xytara-machine-identity-policy-pack-summary-v1",
+    account_id: accountId,
+    machine_identity_state: pack.machine_identity_summary.machine_identity_state,
+    recommended_policy_motion: pack.recommended_policy_motion,
+    template_count: Array.isArray(pack.policy_templates) ? pack.policy_templates.length : 0,
+    linked_surfaces: pack.linked_surfaces,
+    generated_at_iso: pack.generated_at_iso
+  };
+}
+
+function buildMachineIdentityReviewBundle(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const reviewRows = ensureArray(bundle.identity_bindings).map((binding) => {
+    const hasRegistryScope = typeof binding.registry_scope === "string" && binding.registry_scope.length > 0;
+    const hasSourceTransaction = typeof binding.source_transaction_id === "string" && binding.source_transaction_id.length > 0;
+    const hasAttachedAgent = typeof binding.attached_agent_account_id === "string" && binding.attached_agent_account_id.length > 0;
+    const hasRotationLineage = Boolean(binding.rotated_from_binding_id || binding.replaced_by_binding_id);
+    const reviewState = binding.status !== "active"
+      ? "revoked"
+      : hasRegistryScope && (hasSourceTransaction || hasAttachedAgent)
+        ? "healthy"
+        : "repair_candidate";
+    return {
+      binding_id: binding.binding_id,
+      identity_kind: binding.identity_kind,
+      review_state: reviewState,
+      has_registry_scope: hasRegistryScope,
+      has_source_transaction: hasSourceTransaction,
+      has_attached_agent_account: hasAttachedAgent,
+      has_rotation_lineage: hasRotationLineage,
+      recommended_action: reviewState === "repair_candidate"
+        ? "complete_identity_binding_context"
+        : reviewState === "revoked"
+          ? "review_for_replacement"
+          : "keep_active"
+    };
+  });
+
+  return {
+    bundle_version: "xytara-machine-identity-review-bundle-v1",
+    account_id: accountId,
+    machine_identity_summary: summary,
+    review_rows: reviewRows,
+    review_counts: {
+      healthy_count: reviewRows.filter((entry) => entry.review_state === "healthy").length,
+      repair_candidate_count: reviewRows.filter((entry) => entry.review_state === "repair_candidate").length,
+      revoked_count: reviewRows.filter((entry) => entry.review_state === "revoked").length
+    },
+    linked_surfaces: {
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityAttentionSummary(state, accountId) {
+  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
+  const attentionRows = reviewBundle.review_rows.filter((entry) => entry.review_state !== "healthy");
+  return {
+    summary_version: "xytara-machine-identity-attention-summary-v1",
+    account_id: accountId,
+    overall_attention_state: attentionRows.length > 0 ? "attention_required" : "healthy",
+    attention_binding_count: attentionRows.length,
+    attention_rows: attentionRows,
+    review_counts: reviewBundle.review_counts,
+    linked_surfaces: {
+      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityOperatorBundle(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
+  const lineage = buildMachineIdentityLineageSummary(state, accountId);
+  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
+  const profile = buildMachineIdentityProfile(state, accountId);
+  const policyPackSummary = buildMachineIdentityPolicyPackSummary(state, accountId);
+  const policyApplicationSummary = buildMachineIdentityPolicyApplicationSummary(state, accountId, null);
+  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
+  const attentionSummary = buildMachineIdentityAttentionSummary(state, accountId);
+
+  return {
+    bundle_version: "xytara-machine-identity-operator-bundle-v1",
+    account_id: accountId,
+    operator_posture: {
+      machine_identity_state: summary.machine_identity_state,
+      overall_attention_state: attentionSummary.overall_attention_state,
+      recommended_policy_motion: policyPackSummary.recommended_policy_motion,
+      identity_binding_count: summary.counts.identity_binding_count,
+      identity_transaction_count: summary.counts.identity_transaction_count,
+      rotated_binding_count: bindingLineage.rotated_binding_count,
+      repair_candidate_count: reviewBundle.review_counts.repair_candidate_count,
+      revoked_binding_count: reviewBundle.review_counts.revoked_count
+    },
+    machine_identity_summary: summary,
+    machine_identity_profile: profile,
+    machine_identity_bundle: bundle,
+    machine_identity_attachment_summary: attachment,
+    machine_identity_lineage_summary: lineage,
+    machine_identity_binding_lineage_summary: bindingLineage,
+    machine_identity_policy_pack_summary: policyPackSummary,
+    machine_identity_policy_application_summary: policyApplicationSummary,
+    machine_identity_review_bundle: reviewBundle,
+    machine_identity_attention_summary: attentionSummary,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
+      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
+      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
+      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+module.exports = {
+  buildMachineIdentitySummary,
+  buildMachineIdentityBundle,
+  buildMachineIdentityAttachmentSummary,
+  buildMachineIdentityLineageSummary,
+  buildMachineIdentityBindingLineageSummary,
+  buildMachineIdentityProfile,
+  buildMachineIdentityPolicyPack,
+  buildMachineIdentityPolicyPackSummary,
+  buildMachineIdentityPolicyApplicationSummary,
+  buildMachineIdentityReviewBundle,
+  buildMachineIdentityAttentionSummary,
+  buildMachineIdentityOperatorBundle
+};

package/lib/commerce_runtime.js

@@ -20,8 +20,12 @@ function createRuntimeState() {
     checkoutSessions: new Map(),
     checkoutEvents: new Map(),
     externalCreditGrants: new Map(),
+    accountAuthorityBindings: new Map(),
     accountSpendCredentials: new Map(),
     accountSpendCredentialsByToken: new Map(),
+    machineIdentityBindings: new Map(),
+    operatorParticipants: new Map(),
+    networkParticipants: new Map(),
     runtimeBridgeDispatches: new Map(),
     agentAccounts: new Map(),
     transactions: new Map(),